--- /dev/null
+From 596143e3aec35c93508d6b7a05ddc999ee209b61 Mon Sep 17 00:00:00 2001
+From: Jackie Liu <liuyun01@kylinos.cn>
+Date: Mon, 23 Aug 2021 17:25:26 +0800
+Subject: acpi/arm64: fix next_platform_timer() section mismatch error
+
+From: Jackie Liu <liuyun01@kylinos.cn>
+
+commit 596143e3aec35c93508d6b7a05ddc999ee209b61 upstream.
+
+Fix modpost Section mismatch error in next_platform_timer().
+
+ [...]
+ WARNING: modpost: vmlinux.o(.text.unlikely+0x26e60): Section mismatch in reference from the function next_platform_timer() to the variable .init.data:acpi_gtdt_desc
+ The function next_platform_timer() references
+ the variable __initdata acpi_gtdt_desc.
+ This is often because next_platform_timer lacks a __initdata
+ annotation or the annotation of acpi_gtdt_desc is wrong.
+
+ WARNING: modpost: vmlinux.o(.text.unlikely+0x26e64): Section mismatch in reference from the function next_platform_timer() to the variable .init.data:acpi_gtdt_desc
+ The function next_platform_timer() references
+ the variable __initdata acpi_gtdt_desc.
+ This is often because next_platform_timer lacks a __initdata
+ annotation or the annotation of acpi_gtdt_desc is wrong.
+
+ ERROR: modpost: Section mismatches detected.
+ Set CONFIG_SECTION_MISMATCH_WARN_ONLY=y to allow them.
+ make[1]: *** [scripts/Makefile.modpost:59: vmlinux.symvers] Error 1
+ make[1]: *** Deleting file 'vmlinux.symvers'
+ make: *** [Makefile:1176: vmlinux] Error 2
+ [...]
+
+Fixes: a712c3ed9b8a ("acpi/arm64: Add memory-mapped timer support in GTDT driver")
+Signed-off-by: Jackie Liu <liuyun01@kylinos.cn>
+Acked-by: Hanjun Guo <guohanjun@huawei.com>
+Link: https://lore.kernel.org/r/20210823092526.2407526-1-liu.yun@linux.dev
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/acpi/arm64/gtdt.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/acpi/arm64/gtdt.c
++++ b/drivers/acpi/arm64/gtdt.c
+@@ -36,7 +36,7 @@ struct acpi_gtdt_descriptor {
+
+ static struct acpi_gtdt_descriptor acpi_gtdt_desc __initdata;
+
+-static inline void *next_platform_timer(void *platform_timer)
++static inline __init void *next_platform_timer(void *platform_timer)
+ {
+ struct acpi_gtdt_header *gh = platform_timer;
+
--- /dev/null
+From 776c75010803849c1cc4f11031a2b3960ab05202 Mon Sep 17 00:00:00 2001
+From: Wang Hai <wanghai38@huawei.com>
+Date: Wed, 13 Oct 2021 14:16:31 +0800
+Subject: ata: ahci_platform: fix null-ptr-deref in ahci_platform_enable_regulators()
+
+From: Wang Hai <wanghai38@huawei.com>
+
+commit 776c75010803849c1cc4f11031a2b3960ab05202 upstream.
+
+I got a null-ptr-deref report:
+
+KASAN: null-ptr-deref in range [0x0000000000000090-0x0000000000000097]
+...
+RIP: 0010:regulator_enable+0x84/0x260
+...
+Call Trace:
+ ahci_platform_enable_regulators+0xae/0x320
+ ahci_platform_enable_resources+0x1a/0x120
+ ahci_probe+0x4f/0x1b9
+ platform_probe+0x10b/0x280
+...
+ entry_SYSCALL_64_after_hwframe+0x44/0xae
+
+If devm_regulator_get() in ahci_platform_get_resources() fails,
+hpriv->phy_regulator will point to NULL, when enabling or disabling it,
+null-ptr-deref will occur.
+
+ahci_probe()
+ ahci_platform_get_resources()
+ devm_regulator_get(, "phy") // failed, let phy_regulator = NULL
+ ahci_platform_enable_resources()
+ ahci_platform_enable_regulators()
+ regulator_enable(hpriv->phy_regulator) // null-ptr-deref
+
+commit 962399bb7fbf ("ata: libahci_platform: Fix regulator_get_optional()
+misuse") replaces devm_regulator_get_optional() with devm_regulator_get(),
+but PHY regulator omits to delete "hpriv->phy_regulator = NULL;" like AHCI.
+Delete it like AHCI regulator to fix this bug.
+
+Fixes: commit 962399bb7fbf ("ata: libahci_platform: Fix regulator_get_optional() misuse")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Wang Hai <wanghai38@huawei.com>
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Damien Le Moal <damien.lemoal@wdc.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/ata/libahci_platform.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+--- a/drivers/ata/libahci_platform.c
++++ b/drivers/ata/libahci_platform.c
+@@ -440,10 +440,7 @@ struct ahci_host_priv *ahci_platform_get
+ hpriv->phy_regulator = devm_regulator_get(dev, "phy");
+ if (IS_ERR(hpriv->phy_regulator)) {
+ rc = PTR_ERR(hpriv->phy_regulator);
+- if (rc == -EPROBE_DEFER)
+- goto err_out;
+- rc = 0;
+- hpriv->phy_regulator = NULL;
++ goto err_out;
+ }
+
+ if (flags & AHCI_PLATFORM_GET_RESETS) {
--- /dev/null
+From 97794170b696856483f74b47bfb6049780d2d3a0 Mon Sep 17 00:00:00 2001
+From: Douglas Anderson <dianders@chromium.org>
+Date: Tue, 5 Oct 2021 19:29:08 -0700
+Subject: drm/edid: In connector_bad_edid() cap num_of_ext by num_blocks read
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Douglas Anderson <dianders@chromium.org>
+
+commit 97794170b696856483f74b47bfb6049780d2d3a0 upstream.
+
+In commit e11f5bd8228f ("drm: Add support for DP 1.4 Compliance edid
+corruption test") the function connector_bad_edid() started assuming
+that the memory for the EDID passed to it was big enough to hold
+`edid[0x7e] + 1` blocks of data (1 extra for the base block). It
+completely ignored the fact that the function was passed `num_blocks`
+which indicated how much memory had been allocated for the EDID.
+
+Let's fix this by adding a bounds check.
+
+This is important for handling the case where there's an error in the
+first block of the EDID. In that case we will call
+connector_bad_edid() without having re-allocated memory based on
+`edid[0x7e]`.
+
+Fixes: e11f5bd8228f ("drm: Add support for DP 1.4 Compliance edid corruption test")
+Reported-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20211005192905.v2.1.Ib059f9c23c2611cb5a9d760e7d0a700c1295928d@changeid
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/drm_edid.c | 15 ++++++++++++---
+ 1 file changed, 12 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/drm_edid.c
++++ b/drivers/gpu/drm/drm_edid.c
+@@ -1835,11 +1835,20 @@ static void connector_bad_edid(struct dr
+ u8 *edid, int num_blocks)
+ {
+ int i;
+- u8 num_of_ext = edid[0x7e];
++ u8 last_block;
++
++ /*
++ * 0x7e in the EDID is the number of extension blocks. The EDID
++ * is 1 (base block) + num_ext_blocks big. That means we can think
++ * of 0x7e in the EDID of the _index_ of the last block in the
++ * combined chunk of memory.
++ */
++ last_block = edid[0x7e];
+
+ /* Calculate real checksum for the last edid extension block data */
+- connector->real_edid_checksum =
+- drm_edid_block_checksum(edid + num_of_ext * EDID_LENGTH);
++ if (last_block < num_blocks)
++ connector->real_edid_checksum =
++ drm_edid_block_checksum(edid + last_block * EDID_LENGTH);
+
+ if (connector->bad_edid_counter++ && !drm_debug_enabled(DRM_UT_KMS))
+ return;
--- /dev/null
+From 14eb0cb4e9a7323c8735cf6c681ed8423ce6ae06 Mon Sep 17 00:00:00 2001
+From: Rob Clark <robdclark@chromium.org>
+Date: Thu, 30 Sep 2021 10:43:20 -0700
+Subject: drm/msm/a6xx: Track current ctx by seqno
+
+From: Rob Clark <robdclark@chromium.org>
+
+commit 14eb0cb4e9a7323c8735cf6c681ed8423ce6ae06 upstream.
+
+In theory a context can be destroyed and a new one allocated at the same
+address, making the pointer comparision to detect when we don't need to
+update the current pagetables invalid. Instead assign a sequence number
+to each context on creation, and use this for the check.
+
+Fixes: 84c31ee16f90 ("drm/msm/a6xx: Add support for per-instance pagetables")
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 6 +++---
+ drivers/gpu/drm/msm/adreno/a6xx_gpu.h | 11 ++++++++++-
+ drivers/gpu/drm/msm/msm_drv.c | 3 +++
+ drivers/gpu/drm/msm/msm_drv.h | 1 +
+ 4 files changed, 17 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
++++ b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
+@@ -99,7 +99,7 @@ static void a6xx_set_pagetable(struct a6
+ u32 asid;
+ u64 memptr = rbmemptr(ring, ttbr0);
+
+- if (ctx == a6xx_gpu->cur_ctx)
++ if (ctx->seqno == a6xx_gpu->cur_ctx_seqno)
+ return;
+
+ if (msm_iommu_pagetable_params(ctx->aspace->mmu, &ttbr, &asid))
+@@ -132,7 +132,7 @@ static void a6xx_set_pagetable(struct a6
+ OUT_PKT7(ring, CP_EVENT_WRITE, 1);
+ OUT_RING(ring, 0x31);
+
+- a6xx_gpu->cur_ctx = ctx;
++ a6xx_gpu->cur_ctx_seqno = ctx->seqno;
+ }
+
+ static void a6xx_submit(struct msm_gpu *gpu, struct msm_gem_submit *submit)
+@@ -887,7 +887,7 @@ static int a6xx_hw_init(struct msm_gpu *
+ /* Always come up on rb 0 */
+ a6xx_gpu->cur_ring = gpu->rb[0];
+
+- a6xx_gpu->cur_ctx = NULL;
++ a6xx_gpu->cur_ctx_seqno = 0;
+
+ /* Enable the SQE_to start the CP engine */
+ gpu_write(gpu, REG_A6XX_CP_SQE_CNTL, 1);
+--- a/drivers/gpu/drm/msm/adreno/a6xx_gpu.h
++++ b/drivers/gpu/drm/msm/adreno/a6xx_gpu.h
+@@ -19,7 +19,16 @@ struct a6xx_gpu {
+ uint64_t sqe_iova;
+
+ struct msm_ringbuffer *cur_ring;
+- struct msm_file_private *cur_ctx;
++
++ /**
++ * cur_ctx_seqno:
++ *
++ * The ctx->seqno value of the context with current pgtables
++ * installed. Tracked by seqno rather than pointer value to
++ * avoid dangling pointers, and cases where a ctx can be freed
++ * and a new one created with the same address.
++ */
++ int cur_ctx_seqno;
+
+ struct a6xx_gmu gmu;
+
+--- a/drivers/gpu/drm/msm/msm_drv.c
++++ b/drivers/gpu/drm/msm/msm_drv.c
+@@ -581,6 +581,7 @@ static void load_gpu(struct drm_device *
+
+ static int context_init(struct drm_device *dev, struct drm_file *file)
+ {
++ static atomic_t ident = ATOMIC_INIT(0);
+ struct msm_drm_private *priv = dev->dev_private;
+ struct msm_file_private *ctx;
+
+@@ -594,6 +595,8 @@ static int context_init(struct drm_devic
+ ctx->aspace = msm_gpu_create_private_address_space(priv->gpu, current);
+ file->driver_priv = ctx;
+
++ ctx->seqno = atomic_inc_return(&ident);
++
+ return 0;
+ }
+
+--- a/drivers/gpu/drm/msm/msm_drv.h
++++ b/drivers/gpu/drm/msm/msm_drv.h
+@@ -58,6 +58,7 @@ struct msm_file_private {
+ int queueid;
+ struct msm_gem_address_space *aspace;
+ struct kref ref;
++ int seqno;
+ };
+
+ enum msm_mdp_plane_property {
--- /dev/null
+From 739b4e7756d3301dd673ca517afca46a5f635562 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Fri, 1 Oct 2021 15:33:08 +0300
+Subject: drm/msm/dsi: Fix an error code in msm_dsi_modeset_init()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit 739b4e7756d3301dd673ca517afca46a5f635562 upstream.
+
+Return an error code if msm_dsi_manager_validate_current_config().
+Don't return success.
+
+Fixes: 8b03ad30e314 ("drm/msm/dsi: Use one connector for dual DSI mode")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://lore.kernel.org/r/20211001123308.GF2283@kili
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/msm/dsi/dsi.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/msm/dsi/dsi.c
++++ b/drivers/gpu/drm/msm/dsi/dsi.c
+@@ -208,8 +208,10 @@ int msm_dsi_modeset_init(struct msm_dsi
+ goto fail;
+ }
+
+- if (!msm_dsi_manager_validate_current_config(msm_dsi->id))
++ if (!msm_dsi_manager_validate_current_config(msm_dsi->id)) {
++ ret = -EINVAL;
+ goto fail;
++ }
+
+ msm_dsi->encoder = encoder;
+
--- /dev/null
+From c8f01ffc83923a91e8087aaa077de13354a7aa59 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Fri, 1 Oct 2021 15:34:09 +0300
+Subject: drm/msm/dsi: fix off by one in dsi_bus_clk_enable error handling
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit c8f01ffc83923a91e8087aaa077de13354a7aa59 upstream.
+
+This disables a lock which wasn't enabled and it does not disable
+the first lock in the array.
+
+Fixes: 6e0eb52eba9e ("drm/msm/dsi: Parse bus clocks from a list")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://lore.kernel.org/r/20211001123409.GG2283@kili
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/msm/dsi/dsi_host.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/msm/dsi/dsi_host.c
++++ b/drivers/gpu/drm/msm/dsi/dsi_host.c
+@@ -464,7 +464,7 @@ static int dsi_bus_clk_enable(struct msm
+
+ return 0;
+ err:
+- for (; i > 0; i--)
++ while (--i >= 0)
+ clk_disable_unprepare(msm_host->bus_clks[i]);
+
+ return ret;
--- /dev/null
+From 2133c4fc8e1348dcb752f267a143fe2254613b34 Mon Sep 17 00:00:00 2001
+From: Colin Ian King <colin.king@canonical.com>
+Date: Wed, 29 Sep 2021 13:18:57 +0100
+Subject: drm/msm: Fix null pointer dereference on pointer edp
+
+From: Colin Ian King <colin.king@canonical.com>
+
+commit 2133c4fc8e1348dcb752f267a143fe2254613b34 upstream.
+
+The initialization of pointer dev dereferences pointer edp before
+edp is null checked, so there is a potential null pointer deference
+issue. Fix this by only dereferencing edp after edp has been null
+checked.
+
+Addresses-Coverity: ("Dereference before null check")
+Fixes: ab5b0107ccf3 ("drm/msm: Initial add eDP support in msm drm driver (v5)")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://lore.kernel.org/r/20210929121857.213922-1-colin.king@canonical.com
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/msm/edp/edp_ctrl.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/msm/edp/edp_ctrl.c
++++ b/drivers/gpu/drm/msm/edp/edp_ctrl.c
+@@ -1116,7 +1116,7 @@ void msm_edp_ctrl_power(struct edp_ctrl
+ int msm_edp_ctrl_init(struct msm_edp *edp)
+ {
+ struct edp_ctrl *ctrl = NULL;
+- struct device *dev = &edp->pdev->dev;
++ struct device *dev;
+ int ret;
+
+ if (!edp) {
+@@ -1124,6 +1124,7 @@ int msm_edp_ctrl_init(struct msm_edp *ed
+ return -EINVAL;
+ }
+
++ dev = &edp->pdev->dev;
+ ctrl = devm_kzalloc(dev, sizeof(*ctrl), GFP_KERNEL);
+ if (!ctrl)
+ return -ENOMEM;
--- /dev/null
+From c491a0c7bbf3a64732cb8414021429d15ec08eec Mon Sep 17 00:00:00 2001
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Date: Sat, 25 Sep 2021 22:28:24 +0300
+Subject: drm/msm/mdp5: fix cursor-related warnings
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+commit c491a0c7bbf3a64732cb8414021429d15ec08eec upstream.
+
+Since f35a2a99100f ("drm/encoder: make encoder control functions
+optional") drm_mode_config_validate would print warnings if both cursor
+plane and cursor functions are provided. Restore separate set of
+drm_crtc_funcs to be used if separate cursor plane is provided.
+
+[ 6.556046] ------------[ cut here ]------------
+[ 6.556071] [CRTC:93:crtc-0] must not have both a cursor plane and a cursor_set func
+[ 6.556091] WARNING: CPU: 1 PID: 76 at drivers/gpu/drm/drm_mode_config.c:648 drm_mode_config_validate+0x238/0x4d0
+[ 6.567453] Modules linked in:
+[ 6.577604] CPU: 1 PID: 76 Comm: kworker/u8:2 Not tainted 5.15.0-rc1-dirty #43
+[ 6.580557] Hardware name: Qualcomm Technologies, Inc. DB820c (DT)
+[ 6.587763] Workqueue: events_unbound deferred_probe_work_func
+[ 6.593926] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+[ 6.599740] pc : drm_mode_config_validate+0x238/0x4d0
+[ 6.606596] lr : drm_mode_config_validate+0x238/0x4d0
+[ 6.611804] sp : ffff8000121b3980
+[ 6.616838] x29: ffff8000121b3990 x28: 0000000000000000 x27: 0000000000000001
+[ 6.620140] x26: ffff8000114cde50 x25: ffff8000114cdd40 x24: ffff0000987282d8
+[ 6.627258] x23: 0000000000000000 x22: 0000000000000000 x21: 0000000000000001
+[ 6.634376] x20: ffff000098728000 x19: ffff000080a39000 x18: ffffffffffffffff
+[ 6.641494] x17: 3136564e3631564e x16: 0000000000000324 x15: ffff800011c78709
+[ 6.648613] x14: 0000000000000000 x13: ffff800011a22850 x12: 00000000000009ab
+[ 6.655730] x11: 0000000000000339 x10: ffff800011a22850 x9 : ffff800011a22850
+[ 6.662848] x8 : 00000000ffffefff x7 : ffff800011a7a850 x6 : ffff800011a7a850
+[ 6.669966] x5 : 000000000000bff4 x4 : 40000000fffff339 x3 : 0000000000000000
+[ 6.677084] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff00008093b800
+[ 6.684205] Call trace:
+[ 6.691319] drm_mode_config_validate+0x238/0x4d0
+[ 6.693577] drm_dev_register+0x17c/0x210
+[ 6.698435] msm_drm_bind+0x4b4/0x694
+[ 6.702429] try_to_bring_up_master+0x164/0x1d0
+[ 6.706075] __component_add+0xa0/0x170
+[ 6.710415] component_add+0x14/0x20
+[ 6.714234] msm_hdmi_dev_probe+0x1c/0x2c
+[ 6.718053] platform_probe+0x68/0xe0
+[ 6.721959] really_probe.part.0+0x9c/0x30c
+[ 6.725606] __driver_probe_device+0x98/0x144
+[ 6.729600] driver_probe_device+0xc8/0x15c
+[ 6.734114] __device_attach_driver+0xb4/0x120
+[ 6.738106] bus_for_each_drv+0x78/0xd0
+[ 6.742619] __device_attach+0xdc/0x184
+[ 6.746351] device_initial_probe+0x14/0x20
+[ 6.750172] bus_probe_device+0x9c/0xa4
+[ 6.754337] deferred_probe_work_func+0x88/0xc0
+[ 6.758158] process_one_work+0x1d0/0x370
+[ 6.762671] worker_thread+0x2c8/0x470
+[ 6.766839] kthread+0x15c/0x170
+[ 6.770483] ret_from_fork+0x10/0x20
+[ 6.773870] ---[ end trace 5884eb76cd26d274 ]---
+[ 6.777500] ------------[ cut here ]------------
+[ 6.782043] [CRTC:93:crtc-0] must not have both a cursor plane and a cursor_move func
+[ 6.782063] WARNING: CPU: 1 PID: 76 at drivers/gpu/drm/drm_mode_config.c:654 drm_mode_config_validate+0x290/0x4d0
+[ 6.794362] Modules linked in:
+[ 6.804600] CPU: 1 PID: 76 Comm: kworker/u8:2 Tainted: G W 5.15.0-rc1-dirty #43
+[ 6.807555] Hardware name: Qualcomm Technologies, Inc. DB820c (DT)
+[ 6.816148] Workqueue: events_unbound deferred_probe_work_func
+[ 6.822311] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+[ 6.828126] pc : drm_mode_config_validate+0x290/0x4d0
+[ 6.834981] lr : drm_mode_config_validate+0x290/0x4d0
+[ 6.840189] sp : ffff8000121b3980
+[ 6.845223] x29: ffff8000121b3990 x28: 0000000000000000 x27: 0000000000000001
+[ 6.848525] x26: ffff8000114cde50 x25: ffff8000114cdd40 x24: ffff0000987282d8
+[ 6.855643] x23: 0000000000000000 x22: 0000000000000000 x21: 0000000000000001
+[ 6.862763] x20: ffff000098728000 x19: ffff000080a39000 x18: ffffffffffffffff
+[ 6.869879] x17: 3136564e3631564e x16: 0000000000000324 x15: ffff800011c790c2
+[ 6.876998] x14: 0000000000000000 x13: ffff800011a22850 x12: 0000000000000a2f
+[ 6.884116] x11: 0000000000000365 x10: ffff800011a22850 x9 : ffff800011a22850
+[ 6.891234] x8 : 00000000ffffefff x7 : ffff800011a7a850 x6 : ffff800011a7a850
+[ 6.898351] x5 : 000000000000bff4 x4 : 40000000fffff365 x3 : 0000000000000000
+[ 6.905470] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff00008093b800
+[ 6.912590] Call trace:
+[ 6.919702] drm_mode_config_validate+0x290/0x4d0
+[ 6.921960] drm_dev_register+0x17c/0x210
+[ 6.926821] msm_drm_bind+0x4b4/0x694
+[ 6.930813] try_to_bring_up_master+0x164/0x1d0
+[ 6.934459] __component_add+0xa0/0x170
+[ 6.938799] component_add+0x14/0x20
+[ 6.942619] msm_hdmi_dev_probe+0x1c/0x2c
+[ 6.946438] platform_probe+0x68/0xe0
+[ 6.950345] really_probe.part.0+0x9c/0x30c
+[ 6.953991] __driver_probe_device+0x98/0x144
+[ 6.957984] driver_probe_device+0xc8/0x15c
+[ 6.962498] __device_attach_driver+0xb4/0x120
+[ 6.966492] bus_for_each_drv+0x78/0xd0
+[ 6.971004] __device_attach+0xdc/0x184
+[ 6.974737] device_initial_probe+0x14/0x20
+[ 6.978556] bus_probe_device+0x9c/0xa4
+[ 6.982722] deferred_probe_work_func+0x88/0xc0
+[ 6.986543] process_one_work+0x1d0/0x370
+[ 6.991057] worker_thread+0x2c8/0x470
+[ 6.995223] kthread+0x15c/0x170
+[ 6.998869] ret_from_fork+0x10/0x20
+[ 7.002255] ---[ end trace 5884eb76cd26d275 ]---
+
+Fixes: aa649e875daf ("drm/msm/mdp5: mdp5_crtc: Restore cursor state only if LM cursors are enabled")
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://lore.kernel.org/r/20210925192824.3416259-1-dmitry.baryshkov@linaro.org
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+--- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c
++++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c
+@@ -1119,6 +1119,20 @@ static void mdp5_crtc_reset(struct drm_c
+ __drm_atomic_helper_crtc_reset(crtc, &mdp5_cstate->base);
+ }
+
++static const struct drm_crtc_funcs mdp5_crtc_no_lm_cursor_funcs = {
++ .set_config = drm_atomic_helper_set_config,
++ .destroy = mdp5_crtc_destroy,
++ .page_flip = drm_atomic_helper_page_flip,
++ .reset = mdp5_crtc_reset,
++ .atomic_duplicate_state = mdp5_crtc_duplicate_state,
++ .atomic_destroy_state = mdp5_crtc_destroy_state,
++ .atomic_print_state = mdp5_crtc_atomic_print_state,
++ .get_vblank_counter = mdp5_crtc_get_vblank_counter,
++ .enable_vblank = msm_crtc_enable_vblank,
++ .disable_vblank = msm_crtc_disable_vblank,
++ .get_vblank_timestamp = drm_crtc_vblank_helper_get_vblank_timestamp,
++};
++
+ static const struct drm_crtc_funcs mdp5_crtc_funcs = {
+ .set_config = drm_atomic_helper_set_config,
+ .destroy = mdp5_crtc_destroy,
+@@ -1307,6 +1321,8 @@ struct drm_crtc *mdp5_crtc_init(struct d
+ mdp5_crtc->lm_cursor_enabled = cursor_plane ? false : true;
+
+ drm_crtc_init_with_planes(dev, crtc, plane, cursor_plane,
++ cursor_plane ?
++ &mdp5_crtc_no_lm_cursor_funcs :
+ &mdp5_crtc_funcs, NULL);
+
+ drm_flip_work_init(&mdp5_crtc->unref_cursor_work,
--- /dev/null
+From a14bc107edd0c108bda2245e50daa22f91c95d20 Mon Sep 17 00:00:00 2001
+From: Vegard Nossum <vegard.nossum@oracle.com>
+Date: Tue, 12 Oct 2021 13:52:42 +0200
+Subject: drm/panel: olimex-lcd-olinuxino: select CRC32
+
+From: Vegard Nossum <vegard.nossum@oracle.com>
+
+commit a14bc107edd0c108bda2245e50daa22f91c95d20 upstream.
+
+Fix the following build/link error by adding a dependency on the CRC32
+routines:
+
+ ld: drivers/gpu/drm/panel/panel-olimex-lcd-olinuxino.o: in function `lcd_olinuxino_probe':
+ panel-olimex-lcd-olinuxino.c:(.text+0x303): undefined reference to `crc32_le'
+
+Fixes: 17fd7a9d324fd ("drm/panel: Add support for Olimex LCD-OLinuXino panel")
+Cc: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com>
+Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20211012115242.10325-1-vegard.nossum@oracle.com
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/panel/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/panel/Kconfig
++++ b/drivers/gpu/drm/panel/Kconfig
+@@ -233,6 +233,7 @@ config DRM_PANEL_OLIMEX_LCD_OLINUXINO
+ depends on OF
+ depends on I2C
+ depends on BACKLIGHT_CLASS_DEVICE
++ select CRC32
+ help
+ The panel is used with different sizes LCDs, from 480x272 to
+ 1280x800, and 24 bit per pixel.
--- /dev/null
+From 5c976a56570f29aaf4a2f9a1bf99789c252183c9 Mon Sep 17 00:00:00 2001
+From: Shannon Nelson <snelson@pensando.io>
+Date: Fri, 8 Oct 2021 12:38:01 -0700
+Subject: ionic: don't remove netdev->dev_addr when syncing uc list
+
+From: Shannon Nelson <snelson@pensando.io>
+
+commit 5c976a56570f29aaf4a2f9a1bf99789c252183c9 upstream.
+
+Bridging, and possibly other upper stack gizmos, adds the
+lower device's netdev->dev_addr to its own uc list, and
+then requests it be deleted when the upper bridge device is
+removed. This delete request also happens with the bridging
+vlan_filtering is enabled and then disabled.
+
+Bonding has a similar behavior with the uc list, but since it
+also uses set_mac to manage netdev->dev_addr, it doesn't have
+the same the failure case.
+
+Because we store our netdev->dev_addr in our uc list, we need
+to ignore the delete request from dev_uc_sync so as to not
+lose the address and all hope of communicating. Note that
+ndo_set_mac_address is expressly changing netdev->dev_addr,
+so no limitation is set there.
+
+Fixes: 2a654540be10 ("ionic: Add Rx filter and rx_mode ndo support")
+Signed-off-by: Shannon Nelson <snelson@pensando.io>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/pensando/ionic/ionic_lif.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/net/ethernet/pensando/ionic/ionic_lif.c
++++ b/drivers/net/ethernet/pensando/ionic/ionic_lif.c
+@@ -1096,6 +1096,10 @@ static int ionic_ndo_addr_add(struct net
+
+ static int ionic_addr_del(struct net_device *netdev, const u8 *addr)
+ {
++ /* Don't delete our own address from the uc list */
++ if (ether_addr_equal(addr, netdev->dev_addr))
++ return 0;
++
+ return ionic_lif_addr(netdev_priv(netdev), addr, false, true);
+ }
+
--- /dev/null
+From 332fdf951df8b870e3da86b122ae304e2aabe88c Mon Sep 17 00:00:00 2001
+From: Ido Schimmel <idosch@nvidia.com>
+Date: Tue, 12 Oct 2021 20:49:55 +0300
+Subject: mlxsw: thermal: Fix out-of-bounds memory accesses
+
+From: Ido Schimmel <idosch@nvidia.com>
+
+commit 332fdf951df8b870e3da86b122ae304e2aabe88c upstream.
+
+Currently, mlxsw allows cooling states to be set above the maximum
+cooling state supported by the driver:
+
+ # cat /sys/class/thermal/thermal_zone2/cdev0/type
+ mlxsw_fan
+ # cat /sys/class/thermal/thermal_zone2/cdev0/max_state
+ 10
+ # echo 18 > /sys/class/thermal/thermal_zone2/cdev0/cur_state
+ # echo $?
+ 0
+
+This results in out-of-bounds memory accesses when thermal state
+transition statistics are enabled (CONFIG_THERMAL_STATISTICS=y), as the
+transition table is accessed with a too large index (state) [1].
+
+According to the thermal maintainer, it is the responsibility of the
+driver to reject such operations [2].
+
+Therefore, return an error when the state to be set exceeds the maximum
+cooling state supported by the driver.
+
+To avoid dead code, as suggested by the thermal maintainer [3],
+partially revert commit a421ce088ac8 ("mlxsw: core: Extend cooling
+device with cooling levels") that tried to interpret these invalid
+cooling states (above the maximum) in a special way. The cooling levels
+array is not removed in order to prevent the fans going below 20% PWM,
+which would cause them to get stuck at 0% PWM.
+
+[1]
+BUG: KASAN: slab-out-of-bounds in thermal_cooling_device_stats_update+0x271/0x290
+Read of size 4 at addr ffff8881052f7bf8 by task kworker/0:0/5
+
+CPU: 0 PID: 5 Comm: kworker/0:0 Not tainted 5.15.0-rc3-custom-45935-gce1adf704b14 #122
+Hardware name: Mellanox Technologies Ltd. "MSN2410-CB2FO"/"SA000874", BIOS 4.6.5 03/08/2016
+Workqueue: events_freezable_power_ thermal_zone_device_check
+Call Trace:
+ dump_stack_lvl+0x8b/0xb3
+ print_address_description.constprop.0+0x1f/0x140
+ kasan_report.cold+0x7f/0x11b
+ thermal_cooling_device_stats_update+0x271/0x290
+ __thermal_cdev_update+0x15e/0x4e0
+ thermal_cdev_update+0x9f/0xe0
+ step_wise_throttle+0x770/0xee0
+ thermal_zone_device_update+0x3f6/0xdf0
+ process_one_work+0xa42/0x1770
+ worker_thread+0x62f/0x13e0
+ kthread+0x3ee/0x4e0
+ ret_from_fork+0x1f/0x30
+
+Allocated by task 1:
+ kasan_save_stack+0x1b/0x40
+ __kasan_kmalloc+0x7c/0x90
+ thermal_cooling_device_setup_sysfs+0x153/0x2c0
+ __thermal_cooling_device_register.part.0+0x25b/0x9c0
+ thermal_cooling_device_register+0xb3/0x100
+ mlxsw_thermal_init+0x5c5/0x7e0
+ __mlxsw_core_bus_device_register+0xcb3/0x19c0
+ mlxsw_core_bus_device_register+0x56/0xb0
+ mlxsw_pci_probe+0x54f/0x710
+ local_pci_probe+0xc6/0x170
+ pci_device_probe+0x2b2/0x4d0
+ really_probe+0x293/0xd10
+ __driver_probe_device+0x2af/0x440
+ driver_probe_device+0x51/0x1e0
+ __driver_attach+0x21b/0x530
+ bus_for_each_dev+0x14c/0x1d0
+ bus_add_driver+0x3ac/0x650
+ driver_register+0x241/0x3d0
+ mlxsw_sp_module_init+0xa2/0x174
+ do_one_initcall+0xee/0x5f0
+ kernel_init_freeable+0x45a/0x4de
+ kernel_init+0x1f/0x210
+ ret_from_fork+0x1f/0x30
+
+The buggy address belongs to the object at ffff8881052f7800
+ which belongs to the cache kmalloc-1k of size 1024
+The buggy address is located 1016 bytes inside of
+ 1024-byte region [ffff8881052f7800, ffff8881052f7c00)
+The buggy address belongs to the page:
+page:0000000052355272 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1052f0
+head:0000000052355272 order:3 compound_mapcount:0 compound_pincount:0
+flags: 0x200000000010200(slab|head|node=0|zone=2)
+raw: 0200000000010200 ffffea0005034800 0000000300000003 ffff888100041dc0
+raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
+page dumped because: kasan: bad access detected
+
+Memory state around the buggy address:
+ ffff8881052f7a80: 00 00 00 00 00 00 04 fc fc fc fc fc fc fc fc fc
+ ffff8881052f7b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
+>ffff8881052f7b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
+ ^
+ ffff8881052f7c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
+ ffff8881052f7c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
+
+[2] https://lore.kernel.org/linux-pm/9aca37cb-1629-5c67-1895-1fdc45c0244e@linaro.org/
+[3] https://lore.kernel.org/linux-pm/af9857f2-578e-de3a-e62b-6baff7e69fd4@linaro.org/
+
+CC: Daniel Lezcano <daniel.lezcano@linaro.org>
+Fixes: a50c1e35650b ("mlxsw: core: Implement thermal zone")
+Fixes: a421ce088ac8 ("mlxsw: core: Extend cooling device with cooling levels")
+Signed-off-by: Ido Schimmel <idosch@nvidia.com>
+Tested-by: Vadim Pasternak <vadimp@nvidia.com>
+Link: https://lore.kernel.org/r/20211012174955.472928-1-idosch@idosch.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/mellanox/mlxsw/core_thermal.c | 52 ++-------------------
+ 1 file changed, 5 insertions(+), 47 deletions(-)
+
+--- a/drivers/net/ethernet/mellanox/mlxsw/core_thermal.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/core_thermal.c
+@@ -25,16 +25,8 @@
+ #define MLXSW_THERMAL_ZONE_MAX_NAME 16
+ #define MLXSW_THERMAL_TEMP_SCORE_MAX GENMASK(31, 0)
+ #define MLXSW_THERMAL_MAX_STATE 10
++#define MLXSW_THERMAL_MIN_STATE 2
+ #define MLXSW_THERMAL_MAX_DUTY 255
+-/* Minimum and maximum fan allowed speed in percent: from 20% to 100%. Values
+- * MLXSW_THERMAL_MAX_STATE + x, where x is between 2 and 10 are used for
+- * setting fan speed dynamic minimum. For example, if value is set to 14 (40%)
+- * cooling levels vector will be set to 4, 4, 4, 4, 4, 5, 6, 7, 8, 9, 10 to
+- * introduce PWM speed in percent: 40, 40, 40, 40, 40, 50, 60. 70, 80, 90, 100.
+- */
+-#define MLXSW_THERMAL_SPEED_MIN (MLXSW_THERMAL_MAX_STATE + 2)
+-#define MLXSW_THERMAL_SPEED_MAX (MLXSW_THERMAL_MAX_STATE * 2)
+-#define MLXSW_THERMAL_SPEED_MIN_LEVEL 2 /* 20% */
+
+ /* External cooling devices, allowed for binding to mlxsw thermal zones. */
+ static char * const mlxsw_thermal_external_allowed_cdev[] = {
+@@ -635,49 +627,16 @@ static int mlxsw_thermal_set_cur_state(s
+ struct mlxsw_thermal *thermal = cdev->devdata;
+ struct device *dev = thermal->bus_info->dev;
+ char mfsc_pl[MLXSW_REG_MFSC_LEN];
+- unsigned long cur_state, i;
+ int idx;
+- u8 duty;
+ int err;
+
++ if (state > MLXSW_THERMAL_MAX_STATE)
++ return -EINVAL;
++
+ idx = mlxsw_get_cooling_device_idx(thermal, cdev);
+ if (idx < 0)
+ return idx;
+
+- /* Verify if this request is for changing allowed fan dynamical
+- * minimum. If it is - update cooling levels accordingly and update
+- * state, if current state is below the newly requested minimum state.
+- * For example, if current state is 5, and minimal state is to be
+- * changed from 4 to 6, thermal->cooling_levels[0 to 5] will be changed
+- * all from 4 to 6. And state 5 (thermal->cooling_levels[4]) should be
+- * overwritten.
+- */
+- if (state >= MLXSW_THERMAL_SPEED_MIN &&
+- state <= MLXSW_THERMAL_SPEED_MAX) {
+- state -= MLXSW_THERMAL_MAX_STATE;
+- for (i = 0; i <= MLXSW_THERMAL_MAX_STATE; i++)
+- thermal->cooling_levels[i] = max(state, i);
+-
+- mlxsw_reg_mfsc_pack(mfsc_pl, idx, 0);
+- err = mlxsw_reg_query(thermal->core, MLXSW_REG(mfsc), mfsc_pl);
+- if (err)
+- return err;
+-
+- duty = mlxsw_reg_mfsc_pwm_duty_cycle_get(mfsc_pl);
+- cur_state = mlxsw_duty_to_state(duty);
+-
+- /* If current fan state is lower than requested dynamical
+- * minimum, increase fan speed up to dynamical minimum.
+- */
+- if (state < cur_state)
+- return 0;
+-
+- state = cur_state;
+- }
+-
+- if (state > MLXSW_THERMAL_MAX_STATE)
+- return -EINVAL;
+-
+ /* Normalize the state to the valid speed range. */
+ state = thermal->cooling_levels[state];
+ mlxsw_reg_mfsc_pack(mfsc_pl, idx, mlxsw_state_to_duty(state));
+@@ -980,8 +939,7 @@ int mlxsw_thermal_init(struct mlxsw_core
+
+ /* Initialize cooling levels per PWM state. */
+ for (i = 0; i < MLXSW_THERMAL_MAX_STATE; i++)
+- thermal->cooling_levels[i] = max(MLXSW_THERMAL_SPEED_MIN_LEVEL,
+- i);
++ thermal->cooling_levels[i] = max(MLXSW_THERMAL_MIN_STATE, i);
+
+ thermal->polling_delay = bus_info->low_frequency ?
+ MLXSW_THERMAL_SLOW_POLL_INT :
--- /dev/null
+From 14132690860e4d06aa3e1c4d7d8e9866ba7756dd Mon Sep 17 00:00:00 2001
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Date: Thu, 7 Oct 2021 19:49:57 +0200
+Subject: mqprio: Correct stats in mqprio_dump_class_stats().
+
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+
+commit 14132690860e4d06aa3e1c4d7d8e9866ba7756dd upstream.
+
+Introduction of lockless subqueues broke the class statistics.
+Before the change stats were accumulated in `bstats' and `qstats'
+on the stack which was then copied to struct gnet_dump.
+
+After the change the `bstats' and `qstats' are initialized to 0
+and never updated, yet still fed to gnet_dump. The code updates
+the global qdisc->cpu_bstats and qdisc->cpu_qstats instead,
+clobbering them. Most likely a copy-paste error from the code in
+mqprio_dump().
+
+__gnet_stats_copy_basic() and __gnet_stats_copy_queue() accumulate
+the values for per-CPU case but for global stats they overwrite
+the value, so only stats from the last loop iteration / tc end up
+in sch->[bq]stats.
+
+Use the on-stack [bq]stats variables again and add the stats manually
+in the global case.
+
+Fixes: ce679e8df7ed2 ("net: sched: add support for TCQ_F_NOLOCK subqueues to sch_mqprio")
+Cc: John Fastabend <john.fastabend@gmail.com>
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+https://lore.kernel.org/all/20211007175000.2334713-2-bigeasy@linutronix.de/
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/sched/sch_mqprio.c | 30 ++++++++++++++++++------------
+ 1 file changed, 18 insertions(+), 12 deletions(-)
+
+--- a/net/sched/sch_mqprio.c
++++ b/net/sched/sch_mqprio.c
+@@ -529,22 +529,28 @@ static int mqprio_dump_class_stats(struc
+ for (i = tc.offset; i < tc.offset + tc.count; i++) {
+ struct netdev_queue *q = netdev_get_tx_queue(dev, i);
+ struct Qdisc *qdisc = rtnl_dereference(q->qdisc);
+- struct gnet_stats_basic_cpu __percpu *cpu_bstats = NULL;
+- struct gnet_stats_queue __percpu *cpu_qstats = NULL;
+
+ spin_lock_bh(qdisc_lock(qdisc));
++
+ if (qdisc_is_percpu_stats(qdisc)) {
+- cpu_bstats = qdisc->cpu_bstats;
+- cpu_qstats = qdisc->cpu_qstats;
+- }
++ qlen = qdisc_qlen_sum(qdisc);
+
+- qlen = qdisc_qlen_sum(qdisc);
+- __gnet_stats_copy_basic(NULL, &sch->bstats,
+- cpu_bstats, &qdisc->bstats);
+- __gnet_stats_copy_queue(&sch->qstats,
+- cpu_qstats,
+- &qdisc->qstats,
+- qlen);
++ __gnet_stats_copy_basic(NULL, &bstats,
++ qdisc->cpu_bstats,
++ &qdisc->bstats);
++ __gnet_stats_copy_queue(&qstats,
++ qdisc->cpu_qstats,
++ &qdisc->qstats,
++ qlen);
++ } else {
++ qlen += qdisc->q.qlen;
++ bstats.bytes += qdisc->bstats.bytes;
++ bstats.packets += qdisc->bstats.packets;
++ qstats.backlog += qdisc->qstats.backlog;
++ qstats.drops += qdisc->qstats.drops;
++ qstats.requeues += qdisc->qstats.requeues;
++ qstats.overlimits += qdisc->qstats.overlimits;
++ }
+ spin_unlock_bh(qdisc_lock(qdisc));
+ }
+
--- /dev/null
+From 9fde506e0c53b8309f69b18b4b8144c544b4b3b1 Mon Sep 17 00:00:00 2001
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+Date: Tue, 12 Oct 2021 14:40:37 +0300
+Subject: net: mscc: ocelot: warn when a PTP IRQ is raised for an unknown skb
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+commit 9fde506e0c53b8309f69b18b4b8144c544b4b3b1 upstream.
+
+When skb_match is NULL, it means we received a PTP IRQ for a timestamp
+ID that the kernel has no idea about, since there is no skb in the
+timestamping queue with that timestamp ID.
+
+This is a grave error and not something to just "continue" over.
+So print a big warning in case this happens.
+
+Also, move the check above ocelot_get_hwtimestamp(), there is no point
+in reading the full 64-bit current PTP time if we're not going to do
+anything with it anyway for this skb.
+
+Fixes: 4e3b0468e6d7 ("net: mscc: PTP Hardware Clock (PHC) support")
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/mscc/ocelot.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/ethernet/mscc/ocelot.c
++++ b/drivers/net/ethernet/mscc/ocelot.c
+@@ -594,12 +594,12 @@ void ocelot_get_txtstamp(struct ocelot *
+
+ spin_unlock_irqrestore(&port->tx_skbs.lock, flags);
+
++ if (WARN_ON(!skb_match))
++ continue;
++
+ /* Get the h/w timestamp */
+ ocelot_get_hwtimestamp(ocelot, &ts);
+
+- if (unlikely(!skb_match))
+- continue;
+-
+ /* Set the timestamp into the skb */
+ memset(&shhwtstamps, 0, sizeof(shhwtstamps));
+ shhwtstamps.hwtstamp = ktime_set(ts.tv_sec, ts.tv_nsec);
--- /dev/null
+From 291c932fc3692e4d211a445ba8aa35663831bac7 Mon Sep 17 00:00:00 2001
+From: Ziyang Xuan <william.xuanziyang@huawei.com>
+Date: Wed, 13 Oct 2021 15:50:32 +0800
+Subject: NFC: digital: fix possible memory leak in digital_in_send_sdd_req()
+
+From: Ziyang Xuan <william.xuanziyang@huawei.com>
+
+commit 291c932fc3692e4d211a445ba8aa35663831bac7 upstream.
+
+'skb' is allocated in digital_in_send_sdd_req(), but not free when
+digital_in_send_cmd() failed, which will cause memory leak. Fix it
+by freeing 'skb' if digital_in_send_cmd() return failed.
+
+Fixes: 2c66daecc409 ("NFC Digital: Add NFC-A technology support")
+Signed-off-by: Ziyang Xuan <william.xuanziyang@huawei.com>
+Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/nfc/digital_technology.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/net/nfc/digital_technology.c
++++ b/net/nfc/digital_technology.c
+@@ -465,8 +465,12 @@ static int digital_in_send_sdd_req(struc
+ skb_put_u8(skb, sel_cmd);
+ skb_put_u8(skb, DIGITAL_SDD_REQ_SEL_PAR);
+
+- return digital_in_send_cmd(ddev, skb, 30, digital_in_recv_sdd_res,
+- target);
++ rc = digital_in_send_cmd(ddev, skb, 30, digital_in_recv_sdd_res,
++ target);
++ if (rc)
++ kfree_skb(skb);
++
++ return rc;
+ }
+
+ static void digital_in_recv_sens_res(struct nfc_digital_dev *ddev, void *arg,
--- /dev/null
+From 58e7dcc9ca29c14e44267a4d0ea61e3229124907 Mon Sep 17 00:00:00 2001
+From: Ziyang Xuan <william.xuanziyang@huawei.com>
+Date: Wed, 13 Oct 2021 15:50:12 +0800
+Subject: NFC: digital: fix possible memory leak in digital_tg_listen_mdaa()
+
+From: Ziyang Xuan <william.xuanziyang@huawei.com>
+
+commit 58e7dcc9ca29c14e44267a4d0ea61e3229124907 upstream.
+
+'params' is allocated in digital_tg_listen_mdaa(), but not free when
+digital_send_cmd() failed, which will cause memory leak. Fix it by
+freeing 'params' if digital_send_cmd() return failed.
+
+Fixes: 1c7a4c24fbfd ("NFC Digital: Add target NFC-DEP support")
+Signed-off-by: Ziyang Xuan <william.xuanziyang@huawei.com>
+Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/nfc/digital_core.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/net/nfc/digital_core.c
++++ b/net/nfc/digital_core.c
+@@ -277,6 +277,7 @@ int digital_tg_configure_hw(struct nfc_d
+ static int digital_tg_listen_mdaa(struct nfc_digital_dev *ddev, u8 rf_tech)
+ {
+ struct digital_tg_mdaa_params *params;
++ int rc;
+
+ params = kzalloc(sizeof(*params), GFP_KERNEL);
+ if (!params)
+@@ -291,8 +292,12 @@ static int digital_tg_listen_mdaa(struct
+ get_random_bytes(params->nfcid2 + 2, NFC_NFCID2_MAXSIZE - 2);
+ params->sc = DIGITAL_SENSF_FELICA_SC;
+
+- return digital_send_cmd(ddev, DIGITAL_CMD_TG_LISTEN_MDAA, NULL, params,
+- 500, digital_tg_recv_atr_req, NULL);
++ rc = digital_send_cmd(ddev, DIGITAL_CMD_TG_LISTEN_MDAA, NULL, params,
++ 500, digital_tg_recv_atr_req, NULL);
++ if (rc)
++ kfree(params);
++
++ return rc;
+ }
+
+ static int digital_tg_listen_md(struct nfc_digital_dev *ddev, u8 rf_tech)
--- /dev/null
+From 0911ab31896f0e908540746414a77dd63912748d Mon Sep 17 00:00:00 2001
+From: Ziyang Xuan <william.xuanziyang@huawei.com>
+Date: Wed, 13 Oct 2021 11:49:32 +0800
+Subject: nfc: fix error handling of nfc_proto_register()
+
+From: Ziyang Xuan <william.xuanziyang@huawei.com>
+
+commit 0911ab31896f0e908540746414a77dd63912748d upstream.
+
+When nfc proto id is using, nfc_proto_register() return -EBUSY error
+code, but forgot to unregister proto. Fix it by adding proto_unregister()
+in the error handling case.
+
+Fixes: c7fe3b52c128 ("NFC: add NFC socket family")
+Signed-off-by: Ziyang Xuan <william.xuanziyang@huawei.com>
+Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
+Link: https://lore.kernel.org/r/20211013034932.2833737-1-william.xuanziyang@huawei.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/nfc/af_nfc.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/net/nfc/af_nfc.c
++++ b/net/nfc/af_nfc.c
+@@ -60,6 +60,9 @@ int nfc_proto_register(const struct nfc_
+ proto_tab[nfc_proto->id] = nfc_proto;
+ write_unlock(&proto_tab_lock);
+
++ if (rc)
++ proto_unregister(nfc_proto->proto);
++
+ return rc;
+ }
+ EXPORT_SYMBOL(nfc_proto_register);
--- /dev/null
+From 60d950f443a52d950126ad664fbd4a1eb8353dc9 Mon Sep 17 00:00:00 2001
+From: Baowen Zheng <baowen.zheng@corigine.com>
+Date: Tue, 12 Oct 2021 14:48:50 +0200
+Subject: nfp: flow_offload: move flow_indr_dev_register from app init to app start
+
+From: Baowen Zheng <baowen.zheng@corigine.com>
+
+commit 60d950f443a52d950126ad664fbd4a1eb8353dc9 upstream.
+
+In commit 74fc4f828769 ("net: Fix offloading indirect devices dependency
+on qdisc order creation"), it adds a process to trigger the callback to
+setup the bo callback when the driver regists a callback.
+
+In our current implement, we are not ready to run the callback when nfp
+call the function flow_indr_dev_register, then there will be error
+message as:
+
+kernel: Oops: 0000 [#1] SMP PTI
+kernel: CPU: 0 PID: 14119 Comm: kworker/0:0 Tainted: G
+kernel: Workqueue: events work_for_cpu_fn
+kernel: RIP: 0010:nfp_flower_indr_setup_tc_cb+0x258/0x410
+kernel: RSP: 0018:ffffbc1e02c57bf8 EFLAGS: 00010286
+kernel: RAX: 0000000000000000 RBX: ffff9c761fabc000 RCX: 0000000000000001
+kernel: RDX: 0000000000000001 RSI: fffffffffffffff0 RDI: ffffffffc0be9ef1
+kernel: RBP: ffffbc1e02c57c58 R08: ffffffffc08f33aa R09: ffff9c6db7478800
+kernel: R10: 0000009c003f6e00 R11: ffffbc1e02800000 R12: ffffbc1e000d9000
+kernel: R13: ffffbc1e000db428 R14: ffff9c6db7478800 R15: ffff9c761e884e80
+kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+kernel: CR2: fffffffffffffff0 CR3: 00000009e260a004 CR4: 00000000007706f0
+kernel: DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+kernel: DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+kernel: PKRU: 55555554
+kernel: Call Trace:
+kernel: ? flow_indr_dev_register+0xab/0x210
+kernel: ? __cond_resched+0x15/0x30
+kernel: ? kmem_cache_alloc_trace+0x44/0x4b0
+kernel: ? nfp_flower_setup_tc+0x1d0/0x1d0 [nfp]
+kernel: flow_indr_dev_register+0x158/0x210
+kernel: ? tcf_block_unbind+0xe0/0xe0
+kernel: nfp_flower_init+0x40b/0x650 [nfp]
+kernel: nfp_net_pci_probe+0x25f/0x960 [nfp]
+kernel: ? nfp_rtsym_read_le+0x76/0x130 [nfp]
+kernel: nfp_pci_probe+0x6a9/0x820 [nfp]
+kernel: local_pci_probe+0x45/0x80
+
+So we need to call flow_indr_dev_register in app start process instead of
+init stage.
+
+Fixes: 74fc4f828769 ("net: Fix offloading indirect devices dependency on qdisc order creation")
+Signed-off-by: Baowen Zheng <baowen.zheng@corigine.com>
+Signed-off-by: Simon Horman <simon.horman@corigine.com>
+Signed-off-by: Louis Peens <louis.peens@corigine.com>
+Link: https://lore.kernel.org/r/20211012124850.13025-1-louis.peens@corigine.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/netronome/nfp/flower/main.c | 19 ++++++++++++++-----
+ 1 file changed, 14 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/ethernet/netronome/nfp/flower/main.c
++++ b/drivers/net/ethernet/netronome/nfp/flower/main.c
+@@ -830,10 +830,6 @@ static int nfp_flower_init(struct nfp_ap
+ if (err)
+ goto err_cleanup;
+
+- err = flow_indr_dev_register(nfp_flower_indr_setup_tc_cb, app);
+- if (err)
+- goto err_cleanup;
+-
+ if (app_priv->flower_ext_feats & NFP_FL_FEATS_VF_RLIM)
+ nfp_flower_qos_init(app);
+
+@@ -942,7 +938,20 @@ static int nfp_flower_start(struct nfp_a
+ return err;
+ }
+
+- return nfp_tunnel_config_start(app);
++ err = flow_indr_dev_register(nfp_flower_indr_setup_tc_cb, app);
++ if (err)
++ return err;
++
++ err = nfp_tunnel_config_start(app);
++ if (err)
++ goto err_tunnel_config;
++
++ return 0;
++
++err_tunnel_config:
++ flow_indr_dev_unregister(nfp_flower_indr_setup_tc_cb, app,
++ nfp_flower_setup_indr_tc_release);
++ return err;
+ }
+
+ static void nfp_flower_stop(struct nfp_app *app)
--- /dev/null
+From 013923477cb311293df9079332cf8b806ed0e6f2 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Wed, 6 Oct 2021 10:34:19 +0300
+Subject: pata_legacy: fix a couple uninitialized variable bugs
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit 013923477cb311293df9079332cf8b806ed0e6f2 upstream.
+
+The last byte of "pad" is used without being initialized.
+
+Fixes: 55dba3120fbc ("libata: update ->data_xfer hook for ATAPI")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Damien Le Moal <damien.lemoal@wdc.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/ata/pata_legacy.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/ata/pata_legacy.c
++++ b/drivers/ata/pata_legacy.c
+@@ -315,7 +315,8 @@ static unsigned int pdc_data_xfer_vlb(st
+ iowrite32_rep(ap->ioaddr.data_addr, buf, buflen >> 2);
+
+ if (unlikely(slop)) {
+- __le32 pad;
++ __le32 pad = 0;
++
+ if (rw == READ) {
+ pad = cpu_to_le32(ioread32(ap->ioaddr.data_addr));
+ memcpy(buf + buflen - slop, &pad, slop);
+@@ -705,7 +706,8 @@ static unsigned int vlb32_data_xfer(stru
+ ioread32_rep(ap->ioaddr.data_addr, buf, buflen >> 2);
+
+ if (unlikely(slop)) {
+- __le32 pad;
++ __le32 pad = 0;
++
+ if (rw == WRITE) {
+ memcpy(&pad, buf + buflen - slop, slop);
+ iowrite32(le32_to_cpu(pad), ap->ioaddr.data_addr);
--- /dev/null
+From 9b024201693e397441668cca0d2df7055fe572eb Mon Sep 17 00:00:00 2001
+From: Vadim Pasternak <vadimp@nvidia.com>
+Date: Mon, 27 Sep 2021 17:22:13 +0300
+Subject: platform/mellanox: mlxreg-io: Fix argument base in kstrtou32() call
+
+From: Vadim Pasternak <vadimp@nvidia.com>
+
+commit 9b024201693e397441668cca0d2df7055fe572eb upstream.
+
+Change kstrtou32() argument 'base' to be zero instead of 'len'.
+It works by chance for setting one bit value, but it is not supposed to
+work in case value passed to mlxreg_io_attr_store() is greater than 1.
+
+It works for example, for:
+echo 1 > /sys/devices/platform/mlxplat/mlxreg-io/hwmon/.../jtag_enable
+But it will fail for:
+echo n > /sys/devices/platform/mlxplat/mlxreg-io/hwmon/.../jtag_enable,
+where n > 1.
+
+The flow for input buffer conversion is as below:
+_kstrtoull(const char *s, unsigned int base, unsigned long long *res)
+calls:
+rv = _parse_integer(s, base, &_res);
+
+For the second case, where n > 1:
+- _parse_integer() converts 's' to 'val'.
+ For n=2, 'len' is set to 2 (string buffer is 0x32 0x0a), for n=3
+ 'len' is set to 3 (string buffer 0x33 0x0a), etcetera.
+- 'base' is equal or greater then '2' (length of input buffer).
+
+As a result, _parse_integer() exits with result zero (rv):
+ rv = 0;
+ while (1) {
+ ...
+ if (val >= base)-> (2 >= 2)
+ break;
+ ...
+ rv++;
+ ...
+ }
+
+And _kstrtoull() in their turn will fail:
+ if (rv == 0)
+ return -EINVAL;
+
+Fixes: 5ec4a8ace06c ("platform/mellanox: Introduce support for Mellanox register access driver")
+Signed-off-by: Vadim Pasternak <vadimp@nvidia.com>
+Link: https://lore.kernel.org/r/20210927142214.2613929-2-vadimp@nvidia.com
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/platform/mellanox/mlxreg-io.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/platform/mellanox/mlxreg-io.c
++++ b/drivers/platform/mellanox/mlxreg-io.c
+@@ -141,7 +141,7 @@ mlxreg_io_attr_store(struct device *dev,
+ return -EINVAL;
+
+ /* Convert buffer to input value. */
+- ret = kstrtou32(buf, len, &input_val);
++ ret = kstrtou32(buf, 0, &input_val);
+ if (ret)
+ return ret;
+
--- /dev/null
+From db9cc7d6f95e7d89b0ce57e785cfd9d67a7505d8 Mon Sep 17 00:00:00 2001
+From: Vadim Pasternak <vadimp@nvidia.com>
+Date: Mon, 27 Sep 2021 17:22:14 +0300
+Subject: platform/mellanox: mlxreg-io: Fix read access of n-bytes size attributes
+
+From: Vadim Pasternak <vadimp@nvidia.com>
+
+commit db9cc7d6f95e7d89b0ce57e785cfd9d67a7505d8 upstream.
+
+Fix shift argument for function rol32(). It should be provided in bits,
+while was provided in bytes.
+
+Fixes: 86148190a7db ("platform/mellanox: mlxreg-io: Add support for complex attributes")
+Signed-off-by: Vadim Pasternak <vadimp@nvidia.com>
+Link: https://lore.kernel.org/r/20210927142214.2613929-3-vadimp@nvidia.com
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/platform/mellanox/mlxreg-io.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/platform/mellanox/mlxreg-io.c
++++ b/drivers/platform/mellanox/mlxreg-io.c
+@@ -98,7 +98,7 @@ mlxreg_io_get_reg(void *regmap, struct m
+ if (ret)
+ goto access_error;
+
+- *regval |= rol32(val, regsize * i);
++ *regval |= rol32(val, regsize * i * 8);
+ }
+ }
+
--- /dev/null
+From 41512e4dc0b84525495e784295092592adb87f1b Mon Sep 17 00:00:00 2001
+From: Prashant Malani <pmalani@chromium.org>
+Date: Tue, 28 Sep 2021 03:19:30 -0700
+Subject: platform/x86: intel_scu_ipc: Fix busy loop expiry time
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Prashant Malani <pmalani@chromium.org>
+
+commit 41512e4dc0b84525495e784295092592adb87f1b upstream.
+
+The macro IPC_TIMEOUT is already in jiffies (it is also used like that
+elsewhere in the file when calling wait_for_completion_timeout()). Don’t
+convert it using helper functions for the purposes of calculating the
+busy loop expiry time.
+
+Fixes: e7b7ab3847c9 (“platform/x86: intel_scu_ipc: Sleeping is fine when polling”)
+Signed-off-by: Prashant Malani <pmalani@chromium.org>
+Cc: Benson Leung <bleung@chromium.org>
+Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Link: https://lore.kernel.org/r/20210928101932.2543937-2-pmalani@chromium.org
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/platform/x86/intel_scu_ipc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/platform/x86/intel_scu_ipc.c
++++ b/drivers/platform/x86/intel_scu_ipc.c
+@@ -232,7 +232,7 @@ static inline u32 ipc_data_readl(struct
+ /* Wait till scu status is busy */
+ static inline int busy_loop(struct intel_scu_ipc_dev *scu)
+ {
+- unsigned long end = jiffies + msecs_to_jiffies(IPC_TIMEOUT);
++ unsigned long end = jiffies + IPC_TIMEOUT;
+
+ do {
+ u32 status;
--- /dev/null
+From a5a14ea7b4e55604acb0dc9d88fdb4cb6945bc77 Mon Sep 17 00:00:00 2001
+From: chongjiapeng <jiapeng.chong@linux.alibaba.com>
+Date: Sat, 9 Oct 2021 16:09:26 +0800
+Subject: qed: Fix missing error code in qed_slowpath_start()
+
+From: chongjiapeng <jiapeng.chong@linux.alibaba.com>
+
+commit a5a14ea7b4e55604acb0dc9d88fdb4cb6945bc77 upstream.
+
+The error code is missing in this code scenario, add the error code
+'-EINVAL' to the return value 'rc'.
+
+Eliminate the follow smatch warning:
+
+drivers/net/ethernet/qlogic/qed/qed_main.c:1298 qed_slowpath_start()
+warn: missing error code 'rc'.
+
+Reported-by: Abaci Robot <abaci@linux.alibaba.com>
+Fixes: d51e4af5c209 ("qed: aRFS infrastructure support")
+Signed-off-by: chongjiapeng <jiapeng.chong@linux.alibaba.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/qlogic/qed/qed_main.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/ethernet/qlogic/qed/qed_main.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_main.c
+@@ -1295,6 +1295,7 @@ static int qed_slowpath_start(struct qed
+ } else {
+ DP_NOTICE(cdev,
+ "Failed to acquire PTT for aRFS\n");
++ rc = -EINVAL;
+ goto err;
+ }
+ }
--- /dev/null
+From 9973a43012b6ad1720dbc4d5faf5302c28635b8c Mon Sep 17 00:00:00 2001
+From: Vegard Nossum <vegard.nossum@oracle.com>
+Date: Mon, 11 Oct 2021 17:22:49 +0200
+Subject: r8152: select CRC32 and CRYPTO/CRYPTO_HASH/CRYPTO_SHA256
+
+From: Vegard Nossum <vegard.nossum@oracle.com>
+
+commit 9973a43012b6ad1720dbc4d5faf5302c28635b8c upstream.
+
+Fix the following build/link errors by adding a dependency on
+CRYPTO, CRYPTO_HASH, CRYPTO_SHA256 and CRC32:
+
+ ld: drivers/net/usb/r8152.o: in function `rtl8152_fw_verify_checksum':
+ r8152.c:(.text+0x2b2a): undefined reference to `crypto_alloc_shash'
+ ld: r8152.c:(.text+0x2bed): undefined reference to `crypto_shash_digest'
+ ld: r8152.c:(.text+0x2c50): undefined reference to `crypto_destroy_tfm'
+ ld: drivers/net/usb/r8152.o: in function `_rtl8152_set_rx_mode':
+ r8152.c:(.text+0xdcb0): undefined reference to `crc32_le'
+
+Fixes: 9370f2d05a2a1 ("r8152: support request_firmware for RTL8153")
+Fixes: ac718b69301c7 ("net/usb: new driver for RTL8152")
+Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/usb/Kconfig | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/net/usb/Kconfig
++++ b/drivers/net/usb/Kconfig
+@@ -99,6 +99,10 @@ config USB_RTL8150
+ config USB_RTL8152
+ tristate "Realtek RTL8152/RTL8153 Based USB Ethernet Adapters"
+ select MII
++ select CRC32
++ select CRYPTO
++ select CRYPTO_HASH
++ select CRYPTO_SHA256
+ help
+ This option adds support for Realtek RTL8152 based USB 2.0
+ 10/100 Ethernet adapters and RTL8153 based USB 3.0 10/100/1000
net-dsa-microchip-added-the-condition-for-scheduling-ksz_mib_read_work.patch
net-encx24j600-check-error-in-devm_regmap_init_encx24j600.patch
ethernet-s2io-fix-setting-mac-address-during-resume.patch
+vhost-vdpa-fix-the-wrong-input-in-config_cb.patch
+nfc-fix-error-handling-of-nfc_proto_register.patch
+nfc-digital-fix-possible-memory-leak-in-digital_tg_listen_mdaa.patch
+nfc-digital-fix-possible-memory-leak-in-digital_in_send_sdd_req.patch
+pata_legacy-fix-a-couple-uninitialized-variable-bugs.patch
+ata-ahci_platform-fix-null-ptr-deref-in-ahci_platform_enable_regulators.patch
+mlxsw-thermal-fix-out-of-bounds-memory-accesses.patch
+platform-mellanox-mlxreg-io-fix-argument-base-in-kstrtou32-call.patch
+platform-mellanox-mlxreg-io-fix-read-access-of-n-bytes-size-attributes.patch
+spi-bcm-qspi-clear-mspi-spifie-interrupt-during-probe.patch
+drm-panel-olimex-lcd-olinuxino-select-crc32.patch
+drm-edid-in-connector_bad_edid-cap-num_of_ext-by-num_blocks-read.patch
+drm-msm-fix-null-pointer-dereference-on-pointer-edp.patch
+drm-msm-mdp5-fix-cursor-related-warnings.patch
+drm-msm-a6xx-track-current-ctx-by-seqno.patch
+drm-msm-dsi-fix-an-error-code-in-msm_dsi_modeset_init.patch
+drm-msm-dsi-fix-off-by-one-in-dsi_bus_clk_enable-error-handling.patch
+acpi-arm64-fix-next_platform_timer-section-mismatch-error.patch
+platform-x86-intel_scu_ipc-fix-busy-loop-expiry-time.patch
+mqprio-correct-stats-in-mqprio_dump_class_stats.patch
+qed-fix-missing-error-code-in-qed_slowpath_start.patch
+r8152-select-crc32-and-crypto-crypto_hash-crypto_sha256.patch
+nfp-flow_offload-move-flow_indr_dev_register-from-app-init-to-app-start.patch
+net-mscc-ocelot-warn-when-a-ptp-irq-is-raised-for-an-unknown-skb.patch
+ionic-don-t-remove-netdev-dev_addr-when-syncing-uc-list.patch
--- /dev/null
+From 75b3cb97eb1f05042745c0655a7145b0262d4c5c Mon Sep 17 00:00:00 2001
+From: Kamal Dasu <kdasu@broadcom.com>
+Date: Fri, 8 Oct 2021 16:36:02 -0400
+Subject: spi: bcm-qspi: clear MSPI spifie interrupt during probe
+
+From: Kamal Dasu <kdasu@broadcom.com>
+
+commit 75b3cb97eb1f05042745c0655a7145b0262d4c5c upstream.
+
+Intermittent Kernel crash has been observed on probe in
+bcm_qspi_mspi_l2_isr() handler when the MSPI spifie interrupt bit
+has not been cleared before registering for interrupts.
+Fix the driver to move SoC specific custom interrupt handling code
+before we register IRQ in probe. Also clear MSPI interrupt status
+resgiter prior to registering IRQ handlers.
+
+Fixes: cc20a38612db ("spi: iproc-qspi: Add Broadcom iProc SoCs support")
+Signed-off-by: Kamal Dasu <kdasu@broadcom.com>
+Acked-by: Florian Fainelli <f.fainelli@gmail.com>
+Link: https://lore.kernel.org/r/20211008203603.40915-3-kdasu.kdev@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/spi/spi-bcm-qspi.c | 77 ++++++++++++++++++++++++++-------------------
+ 1 file changed, 45 insertions(+), 32 deletions(-)
+
+--- a/drivers/spi/spi-bcm-qspi.c
++++ b/drivers/spi/spi-bcm-qspi.c
+@@ -1250,10 +1250,14 @@ static void bcm_qspi_hw_init(struct bcm_
+
+ static void bcm_qspi_hw_uninit(struct bcm_qspi *qspi)
+ {
++ u32 status = bcm_qspi_read(qspi, MSPI, MSPI_MSPI_STATUS);
++
+ bcm_qspi_write(qspi, MSPI, MSPI_SPCR2, 0);
+ if (has_bspi(qspi))
+ bcm_qspi_write(qspi, MSPI, MSPI_WRITE_LOCK, 0);
+
++ /* clear interrupt */
++ bcm_qspi_write(qspi, MSPI, MSPI_MSPI_STATUS, status & ~1);
+ }
+
+ static const struct spi_controller_mem_ops bcm_qspi_mem_ops = {
+@@ -1397,6 +1401,47 @@ int bcm_qspi_probe(struct platform_devic
+ if (!qspi->dev_ids)
+ return -ENOMEM;
+
++ /*
++ * Some SoCs integrate spi controller (e.g., its interrupt bits)
++ * in specific ways
++ */
++ if (soc_intc) {
++ qspi->soc_intc = soc_intc;
++ soc_intc->bcm_qspi_int_set(soc_intc, MSPI_DONE, true);
++ } else {
++ qspi->soc_intc = NULL;
++ }
++
++ if (qspi->clk) {
++ ret = clk_prepare_enable(qspi->clk);
++ if (ret) {
++ dev_err(dev, "failed to prepare clock\n");
++ goto qspi_probe_err;
++ }
++ qspi->base_clk = clk_get_rate(qspi->clk);
++ } else {
++ qspi->base_clk = MSPI_BASE_FREQ;
++ }
++
++ if (data->has_mspi_rev) {
++ rev = bcm_qspi_read(qspi, MSPI, MSPI_REV);
++ /* some older revs do not have a MSPI_REV register */
++ if ((rev & 0xff) == 0xff)
++ rev = 0;
++ }
++
++ qspi->mspi_maj_rev = (rev >> 4) & 0xf;
++ qspi->mspi_min_rev = rev & 0xf;
++ qspi->mspi_spcr3_sysclk = data->has_spcr3_sysclk;
++
++ qspi->max_speed_hz = qspi->base_clk / (bcm_qspi_spbr_min(qspi) * 2);
++
++ /*
++ * On SW resets it is possible to have the mask still enabled
++ * Need to disable the mask and clear the status while we init
++ */
++ bcm_qspi_hw_uninit(qspi);
++
+ for (val = 0; val < num_irqs; val++) {
+ irq = -1;
+ name = qspi_irq_tab[val].irq_name;
+@@ -1433,38 +1478,6 @@ int bcm_qspi_probe(struct platform_devic
+ goto qspi_probe_err;
+ }
+
+- /*
+- * Some SoCs integrate spi controller (e.g., its interrupt bits)
+- * in specific ways
+- */
+- if (soc_intc) {
+- qspi->soc_intc = soc_intc;
+- soc_intc->bcm_qspi_int_set(soc_intc, MSPI_DONE, true);
+- } else {
+- qspi->soc_intc = NULL;
+- }
+-
+- ret = clk_prepare_enable(qspi->clk);
+- if (ret) {
+- dev_err(dev, "failed to prepare clock\n");
+- goto qspi_probe_err;
+- }
+-
+- qspi->base_clk = clk_get_rate(qspi->clk);
+-
+- if (data->has_mspi_rev) {
+- rev = bcm_qspi_read(qspi, MSPI, MSPI_REV);
+- /* some older revs do not have a MSPI_REV register */
+- if ((rev & 0xff) == 0xff)
+- rev = 0;
+- }
+-
+- qspi->mspi_maj_rev = (rev >> 4) & 0xf;
+- qspi->mspi_min_rev = rev & 0xf;
+- qspi->mspi_spcr3_sysclk = data->has_spcr3_sysclk;
+-
+- qspi->max_speed_hz = qspi->base_clk / (bcm_qspi_spbr_min(qspi) * 2);
+-
+ bcm_qspi_hw_init(qspi);
+ init_completion(&qspi->mspi_done);
+ init_completion(&qspi->bspi_done);
--- /dev/null
+From bcef9356fc2e1302daf373c83c826aa27954d128 Mon Sep 17 00:00:00 2001
+From: Cindy Lu <lulu@redhat.com>
+Date: Wed, 29 Sep 2021 17:09:33 +0800
+Subject: vhost-vdpa: Fix the wrong input in config_cb
+
+From: Cindy Lu <lulu@redhat.com>
+
+commit bcef9356fc2e1302daf373c83c826aa27954d128 upstream.
+
+Fix the wrong input in for config_cb. In function vhost_vdpa_config_cb,
+the input cb.private was used as struct vhost_vdpa, so the input was
+wrong here, fix this issue
+
+Fixes: 776f395004d8 ("vhost_vdpa: Support config interrupt in vdpa")
+Signed-off-by: Cindy Lu <lulu@redhat.com>
+Link: https://lore.kernel.org/r/20210929090933.20465-1-lulu@redhat.com
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/vhost/vdpa.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/vhost/vdpa.c
++++ b/drivers/vhost/vdpa.c
+@@ -325,7 +325,7 @@ static long vhost_vdpa_set_config_call(s
+ struct eventfd_ctx *ctx;
+
+ cb.callback = vhost_vdpa_config_cb;
+- cb.private = v->vdpa;
++ cb.private = v;
+ if (copy_from_user(&fd, argp, sizeof(fd)))
+ return -EFAULT;
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
