--- /dev/null
+From 7dc7a8b04f3da8aa3c3be514e155e2fa094e976f Mon Sep 17 00:00:00 2001
+From: Guenter Roeck <linux@roeck-us.net>
+Date: Tue, 10 Nov 2020 15:52:01 -0800
+Subject: ACPI: fan: Initialize performance state sysfs attribute
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+commit 7dc7a8b04f3da8aa3c3be514e155e2fa094e976f upstream.
+
+The following warning is reported if lock debugging is enabled.
+
+DEBUG_LOCKS_WARN_ON(1)
+WARNING: CPU: 1 PID: 1 at kernel/locking/lockdep.c:4617 lockdep_init_map_waits+0x141/0x222
+...
+Call Trace:
+ __kernfs_create_file+0x7a/0xd8
+ sysfs_add_file_mode_ns+0x135/0x189
+ sysfs_create_file_ns+0x70/0xa0
+ acpi_fan_probe+0x547/0x621
+ platform_drv_probe+0x67/0x8b
+ ...
+
+Dynamically allocated sysfs attributes need to be initialized to avoid
+the warning.
+
+Fixes: d19e470b6605 ("ACPI: fan: Expose fan performance state information")
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Cc: 5.6+ <stable@vger.kernel.org> # 5.6+
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/acpi/fan.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/acpi/fan.c
++++ b/drivers/acpi/fan.c
+@@ -351,6 +351,7 @@ static int acpi_fan_get_fps(struct acpi_
+ struct acpi_fan_fps *fps = &fan->fps[i];
+
+ snprintf(fps->name, ACPI_FPS_NAME_LEN, "state%d", i);
++ sysfs_attr_init(&fps->dev_attr.attr);
+ fps->dev_attr.show = show_state;
+ fps->dev_attr.store = NULL;
+ fps->dev_attr.attr.name = fps->name;
--- /dev/null
+From f126b6702e7354d6247a36f20b9172457af5c15a Mon Sep 17 00:00:00 2001
+From: Dinh Nguyen <dinguyen@kernel.org>
+Date: Sun, 1 Nov 2020 14:02:56 -0600
+Subject: arm64: dts: agilex/stratix10: Fix qspi node compatible
+
+From: Dinh Nguyen <dinguyen@kernel.org>
+
+commit f126b6702e7354d6247a36f20b9172457af5c15a upstream.
+
+The QSPI flash node needs to have the required "jedec,spi-nor"
+in the compatible string.
+
+Fixes: 0cb140d07fc7 ("arm64: dts: stratix10: Add QSPI support for Stratix10")
+Cc: stable@vger.kernel.org
+Suggested-by: Vignesh Raghavendra <vigneshr@ti.com>
+Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm64/boot/dts/altera/socfpga_stratix10_socdk.dts | 2 +-
+ arch/arm64/boot/dts/altera/socfpga_stratix10_socdk_nand.dts | 2 +-
+ arch/arm64/boot/dts/intel/socfpga_agilex_socdk.dts | 2 +-
+ 3 files changed, 3 insertions(+), 3 deletions(-)
+
+--- a/arch/arm64/boot/dts/altera/socfpga_stratix10_socdk.dts
++++ b/arch/arm64/boot/dts/altera/socfpga_stratix10_socdk.dts
+@@ -159,7 +159,7 @@
+ flash@0 {
+ #address-cells = <1>;
+ #size-cells = <1>;
+- compatible = "n25q00a";
++ compatible = "micron,mt25qu02g", "jedec,spi-nor";
+ reg = <0>;
+ spi-max-frequency = <100000000>;
+
+--- a/arch/arm64/boot/dts/altera/socfpga_stratix10_socdk_nand.dts
++++ b/arch/arm64/boot/dts/altera/socfpga_stratix10_socdk_nand.dts
+@@ -192,7 +192,7 @@
+ flash@0 {
+ #address-cells = <1>;
+ #size-cells = <1>;
+- compatible = "n25q00a";
++ compatible = "micron,mt25qu02g", "jedec,spi-nor";
+ reg = <0>;
+ spi-max-frequency = <100000000>;
+
+--- a/arch/arm64/boot/dts/intel/socfpga_agilex_socdk.dts
++++ b/arch/arm64/boot/dts/intel/socfpga_agilex_socdk.dts
+@@ -110,7 +110,7 @@
+ flash@0 {
+ #address-cells = <1>;
+ #size-cells = <1>;
+- compatible = "mt25qu02g";
++ compatible = "micron,mt25qu02g", "jedec,spi-nor";
+ reg = <0>;
+ spi-max-frequency = <100000000>;
+
--- /dev/null
+From f902b216501094495ff75834035656e8119c537f Mon Sep 17 00:00:00 2001
+From: Jan Kara <jack@suse.cz>
+Date: Wed, 18 Nov 2020 16:30:32 +0100
+Subject: ext4: fix bogus warning in ext4_update_dx_flag()
+
+From: Jan Kara <jack@suse.cz>
+
+commit f902b216501094495ff75834035656e8119c537f upstream.
+
+The idea of the warning in ext4_update_dx_flag() is that we should warn
+when we are clearing EXT4_INODE_INDEX on a filesystem with metadata
+checksums enabled since after clearing the flag, checksums for internal
+htree nodes will become invalid. So there's no need to warn (or actually
+do anything) when EXT4_INODE_INDEX is not set.
+
+Link: https://lore.kernel.org/r/20201118153032.17281-1-jack@suse.cz
+Fixes: 48a34311953d ("ext4: fix checksum errors with indexed dirs")
+Reported-by: Eric Biggers <ebiggers@kernel.org>
+Reviewed-by: Eric Biggers <ebiggers@google.com>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Cc: stable@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/ext4/ext4.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/fs/ext4/ext4.h
++++ b/fs/ext4/ext4.h
+@@ -2622,7 +2622,8 @@ void ext4_insert_dentry(struct inode *in
+ struct ext4_filename *fname);
+ static inline void ext4_update_dx_flag(struct inode *inode)
+ {
+- if (!ext4_has_feature_dir_index(inode->i_sb)) {
++ if (!ext4_has_feature_dir_index(inode->i_sb) &&
++ ext4_test_inode_flag(inode, EXT4_INODE_INDEX)) {
+ /* ext4_iget() should have caught this... */
+ WARN_ON_ONCE(ext4_has_feature_metadata_csum(inode->i_sb));
+ ext4_clear_inode_flag(inode, EXT4_INODE_INDEX);
--- /dev/null
+From e5b1032a656e9aa4c7a4df77cb9156a2a651a5f9 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Tue, 10 Nov 2020 14:38:35 +0100
+Subject: iio: accel: kxcjk1013: Add support for KIOX010A ACPI DSM for setting tablet-mode
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+commit e5b1032a656e9aa4c7a4df77cb9156a2a651a5f9 upstream.
+
+Some 360 degree hinges (yoga) style 2-in-1 devices use 2 KXCJ91008-s
+to allow the OS to determine the angle between the display and the base
+of the device, so that the OS can determine if the 2-in-1 is in laptop
+or in tablet-mode.
+
+On Windows both accelerometers are read by a special HingeAngleService
+process; and this process calls a DSM (Device Specific Method) on the
+ACPI KIOX010A device node for the sensor in the display, to let the
+embedded-controller (EC) know about the mode so that it can disable the
+kbd and touchpad to avoid spurious input while folded into tablet-mode.
+
+This notifying of the EC is problematic because sometimes the EC comes up
+thinking that device is in tablet-mode and the kbd and touchpad do not
+work. This happens for example on Irbis NB111 devices after a suspend /
+resume cycle (after a complete battery drain / hard reset without having
+booted Windows at least once). Other 2-in-1s which are likely affected
+too are e.g. the Teclast F5 and F6 series.
+
+The kxcjk-1013 driver may seem like a strange place to deal with this,
+but since it is *the* driver for the ACPI KIOX010A device, it is also
+the driver which has access to the ACPI handle needed by the DSM.
+
+Add support for calling the DSM and on probe unconditionally tell the
+EC that the device is laptop mode, fixing the kbd and touchpad sometimes
+not working.
+
+Fixes: 7f6232e69539 ("iio: accel: kxcjk1013: Add KIOX010A ACPI Hardware-ID")
+Reported-and-tested-by: russianneuromancer <russianneuromancer@ya.ru>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Cc: <Stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20201110133835.129080-3-hdegoede@redhat.com
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/accel/kxcjk-1013.c | 36 ++++++++++++++++++++++++++++++++++++
+ 1 file changed, 36 insertions(+)
+
+--- a/drivers/iio/accel/kxcjk-1013.c
++++ b/drivers/iio/accel/kxcjk-1013.c
+@@ -129,6 +129,7 @@ enum kx_chipset {
+ enum kx_acpi_type {
+ ACPI_GENERIC,
+ ACPI_SMO8500,
++ ACPI_KIOX010A,
+ };
+
+ struct kxcjk1013_data {
+@@ -275,6 +276,32 @@ static const struct {
+ {19163, 1, 0},
+ {38326, 0, 1} };
+
++#ifdef CONFIG_ACPI
++enum kiox010a_fn_index {
++ KIOX010A_SET_LAPTOP_MODE = 1,
++ KIOX010A_SET_TABLET_MODE = 2,
++};
++
++static int kiox010a_dsm(struct device *dev, int fn_index)
++{
++ acpi_handle handle = ACPI_HANDLE(dev);
++ guid_t kiox010a_dsm_guid;
++ union acpi_object *obj;
++
++ if (!handle)
++ return -ENODEV;
++
++ guid_parse("1f339696-d475-4e26-8cad-2e9f8e6d7a91", &kiox010a_dsm_guid);
++
++ obj = acpi_evaluate_dsm(handle, &kiox010a_dsm_guid, 1, fn_index, NULL);
++ if (!obj)
++ return -EIO;
++
++ ACPI_FREE(obj);
++ return 0;
++}
++#endif
++
+ static int kxcjk1013_set_mode(struct kxcjk1013_data *data,
+ enum kxcjk1013_mode mode)
+ {
+@@ -352,6 +379,13 @@ static int kxcjk1013_chip_init(struct kx
+ {
+ int ret;
+
++#ifdef CONFIG_ACPI
++ if (data->acpi_type == ACPI_KIOX010A) {
++ /* Make sure the kbd and touchpad on 2-in-1s using 2 KXCJ91008-s work */
++ kiox010a_dsm(&data->client->dev, KIOX010A_SET_LAPTOP_MODE);
++ }
++#endif
++
+ ret = i2c_smbus_read_byte_data(data->client, KXCJK1013_REG_WHO_AM_I);
+ if (ret < 0) {
+ dev_err(&data->client->dev, "Error reading who_am_i\n");
+@@ -1262,6 +1296,8 @@ static const char *kxcjk1013_match_acpi_
+
+ if (strcmp(id->id, "SMO8500") == 0)
+ *acpi_type = ACPI_SMO8500;
++ else if (strcmp(id->id, "KIOX010A") == 0)
++ *acpi_type = ACPI_KIOX010A;
+
+ *chipset = (enum kx_chipset)id->driver_data;
+
--- /dev/null
+From 11e94f28c3de35d5ad1ac6a242a5b30f4378991a Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Tue, 10 Nov 2020 14:38:34 +0100
+Subject: iio: accel: kxcjk1013: Replace is_smo8500_device with an acpi_type enum
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+commit 11e94f28c3de35d5ad1ac6a242a5b30f4378991a upstream.
+
+Replace the boolean is_smo8500_device variable with an acpi_type enum.
+
+For now this can be either ACPI_GENERIC or ACPI_SMO8500, this is a
+preparation patch for adding special handling for the KIOX010A ACPI HID,
+which will add a ACPI_KIOX010A acpi_type to the introduced enum.
+
+For stable as needed as precursor for next patch.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Fixes: 7f6232e69539 ("iio: accel: kxcjk1013: Add KIOX010A ACPI Hardware-ID")
+Cc: <Stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20201110133835.129080-2-hdegoede@redhat.com
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/accel/kxcjk-1013.c | 15 ++++++++++-----
+ 1 file changed, 10 insertions(+), 5 deletions(-)
+
+--- a/drivers/iio/accel/kxcjk-1013.c
++++ b/drivers/iio/accel/kxcjk-1013.c
+@@ -126,6 +126,11 @@ enum kx_chipset {
+ KX_MAX_CHIPS /* this must be last */
+ };
+
++enum kx_acpi_type {
++ ACPI_GENERIC,
++ ACPI_SMO8500,
++};
++
+ struct kxcjk1013_data {
+ struct i2c_client *client;
+ struct iio_trigger *dready_trig;
+@@ -143,7 +148,7 @@ struct kxcjk1013_data {
+ bool motion_trigger_on;
+ int64_t timestamp;
+ enum kx_chipset chipset;
+- bool is_smo8500_device;
++ enum kx_acpi_type acpi_type;
+ };
+
+ enum kxcjk1013_axis {
+@@ -1247,7 +1252,7 @@ static irqreturn_t kxcjk1013_data_rdy_tr
+
+ static const char *kxcjk1013_match_acpi_device(struct device *dev,
+ enum kx_chipset *chipset,
+- bool *is_smo8500_device)
++ enum kx_acpi_type *acpi_type)
+ {
+ const struct acpi_device_id *id;
+
+@@ -1256,7 +1261,7 @@ static const char *kxcjk1013_match_acpi_
+ return NULL;
+
+ if (strcmp(id->id, "SMO8500") == 0)
+- *is_smo8500_device = true;
++ *acpi_type = ACPI_SMO8500;
+
+ *chipset = (enum kx_chipset)id->driver_data;
+
+@@ -1299,7 +1304,7 @@ static int kxcjk1013_probe(struct i2c_cl
+ } else if (ACPI_HANDLE(&client->dev)) {
+ name = kxcjk1013_match_acpi_device(&client->dev,
+ &data->chipset,
+- &data->is_smo8500_device);
++ &data->acpi_type);
+ } else
+ return -ENODEV;
+
+@@ -1316,7 +1321,7 @@ static int kxcjk1013_probe(struct i2c_cl
+ indio_dev->modes = INDIO_DIRECT_MODE;
+ indio_dev->info = &kxcjk1013_info;
+
+- if (client->irq > 0 && !data->is_smo8500_device) {
++ if (client->irq > 0 && data->acpi_type != ACPI_SMO8500) {
+ ret = devm_request_threaded_irq(&client->dev, client->irq,
+ kxcjk1013_data_rdy_trig_poll,
+ kxcjk1013_event_handler,
--- /dev/null
+From 6d6aa2907d59ddd3c0ebb2b93e1ddc84e474485b Mon Sep 17 00:00:00 2001
+From: Paul Cercueil <paul@crapouillou.net>
+Date: Tue, 3 Nov 2020 20:12:38 +0000
+Subject: iio/adc: ingenic: Fix AUX/VBAT readings when touchscreen is used
+
+From: Paul Cercueil <paul@crapouillou.net>
+
+commit 6d6aa2907d59ddd3c0ebb2b93e1ddc84e474485b upstream.
+
+When the command feature of the ADC is used, it is possible to program
+the ADC, and specify at each step what input should be processed, and in
+comparison to what reference.
+
+This broke the AUX and battery readings when the touchscreen was
+enabled, most likely because the CMD feature would change the VREF all
+the time.
+
+Now, when AUX or battery are read, we temporarily disable the CMD
+feature, which means that we won't get touchscreen readings in that time
+frame. But it now gives correct values for AUX / battery, and the
+touchscreen isn't disabled for long enough to be an actual issue.
+
+Fixes: b96952f498db ("IIO: Ingenic JZ47xx: Add touchscreen mode.")
+Signed-off-by: Paul Cercueil <paul@crapouillou.net>
+Acked-by: Artur Rojek <contact@artur-rojek.eu>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20201103201238.161083-1-paul@crapouillou.net
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/adc/ingenic-adc.c | 32 ++++++++++++++++++++++++++------
+ 1 file changed, 26 insertions(+), 6 deletions(-)
+
+--- a/drivers/iio/adc/ingenic-adc.c
++++ b/drivers/iio/adc/ingenic-adc.c
+@@ -177,13 +177,12 @@ static void ingenic_adc_set_config(struc
+ mutex_unlock(&adc->lock);
+ }
+
+-static void ingenic_adc_enable(struct ingenic_adc *adc,
+- int engine,
+- bool enabled)
++static void ingenic_adc_enable_unlocked(struct ingenic_adc *adc,
++ int engine,
++ bool enabled)
+ {
+ u8 val;
+
+- mutex_lock(&adc->lock);
+ val = readb(adc->base + JZ_ADC_REG_ENABLE);
+
+ if (enabled)
+@@ -192,20 +191,41 @@ static void ingenic_adc_enable(struct in
+ val &= ~BIT(engine);
+
+ writeb(val, adc->base + JZ_ADC_REG_ENABLE);
++}
++
++static void ingenic_adc_enable(struct ingenic_adc *adc,
++ int engine,
++ bool enabled)
++{
++ mutex_lock(&adc->lock);
++ ingenic_adc_enable_unlocked(adc, engine, enabled);
+ mutex_unlock(&adc->lock);
+ }
+
+ static int ingenic_adc_capture(struct ingenic_adc *adc,
+ int engine)
+ {
++ u32 cfg;
+ u8 val;
+ int ret;
+
+- ingenic_adc_enable(adc, engine, true);
++ /*
++ * Disable CMD_SEL temporarily, because it causes wrong VBAT readings,
++ * probably due to the switch of VREF. We must keep the lock here to
++ * avoid races with the buffer enable/disable functions.
++ */
++ mutex_lock(&adc->lock);
++ cfg = readl(adc->base + JZ_ADC_REG_CFG);
++ writel(cfg & ~JZ_ADC_REG_CFG_CMD_SEL, adc->base + JZ_ADC_REG_CFG);
++
++ ingenic_adc_enable_unlocked(adc, engine, true);
+ ret = readb_poll_timeout(adc->base + JZ_ADC_REG_ENABLE, val,
+ !(val & BIT(engine)), 250, 1000);
+ if (ret)
+- ingenic_adc_enable(adc, engine, false);
++ ingenic_adc_enable_unlocked(adc, engine, false);
++
++ writel(cfg, adc->base + JZ_ADC_REG_CFG);
++ mutex_unlock(&adc->lock);
+
+ return ret;
+ }
--- /dev/null
+From c91ebcc578e09783cfa4d85c1b437790f140f29a Mon Sep 17 00:00:00 2001
+From: Paul Cercueil <paul@crapouillou.net>
+Date: Wed, 4 Nov 2020 19:28:43 +0000
+Subject: iio/adc: ingenic: Fix battery VREF for JZ4770 SoC
+
+From: Paul Cercueil <paul@crapouillou.net>
+
+commit c91ebcc578e09783cfa4d85c1b437790f140f29a upstream.
+
+The reference voltage for the battery is clearly marked as 1.2V in the
+programming manual. With this fixed, the battery channel now returns
+correct values.
+
+Fixes: a515d6488505 ("IIO: Ingenic JZ47xx: Add support for JZ4770 SoC ADC.")
+Signed-off-by: Paul Cercueil <paul@crapouillou.net>
+Acked-by: Artur Rojek <contact@artur-rojek.eu>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20201104192843.67187-1-paul@crapouillou.net
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/adc/ingenic-adc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/iio/adc/ingenic-adc.c
++++ b/drivers/iio/adc/ingenic-adc.c
+@@ -71,7 +71,7 @@
+ #define JZ4725B_ADC_BATTERY_HIGH_VREF_BITS 10
+ #define JZ4740_ADC_BATTERY_HIGH_VREF (7500 * 0.986)
+ #define JZ4740_ADC_BATTERY_HIGH_VREF_BITS 12
+-#define JZ4770_ADC_BATTERY_VREF 6600
++#define JZ4770_ADC_BATTERY_VREF 1200
+ #define JZ4770_ADC_BATTERY_VREF_BITS 12
+
+ #define JZ_ADC_IRQ_AUX BIT(0)
--- /dev/null
+From 15207a92e019803d62687455d8aa2ff9eb3dc82c Mon Sep 17 00:00:00 2001
+From: Fabien Parent <fparent@baylibre.com>
+Date: Sun, 18 Oct 2020 21:46:44 +0200
+Subject: iio: adc: mediatek: fix unset field
+
+From: Fabien Parent <fparent@baylibre.com>
+
+commit 15207a92e019803d62687455d8aa2ff9eb3dc82c upstream.
+
+dev_comp field is used in a couple of places but it is never set. This
+results in kernel oops when dereferencing a NULL pointer. Set the
+`dev_comp` field correctly in the probe function.
+
+Fixes: 6d97024dce23 ("iio: adc: mediatek: mt6577-auxadc, add mt6765 support")
+Signed-off-by: Fabien Parent <fparent@baylibre.com>
+Reviewed-by: Matthias Brugger <matthias.bgg@gmail.com>
+Cc: <Stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20201018194644.3366846-1-fparent@baylibre.com
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/adc/mt6577_auxadc.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/iio/adc/mt6577_auxadc.c
++++ b/drivers/iio/adc/mt6577_auxadc.c
+@@ -9,9 +9,9 @@
+ #include <linux/err.h>
+ #include <linux/kernel.h>
+ #include <linux/module.h>
+-#include <linux/of.h>
+-#include <linux/of_device.h>
++#include <linux/mod_devicetable.h>
+ #include <linux/platform_device.h>
++#include <linux/property.h>
+ #include <linux/iopoll.h>
+ #include <linux/io.h>
+ #include <linux/iio/iio.h>
+@@ -276,6 +276,8 @@ static int mt6577_auxadc_probe(struct pl
+ goto err_disable_clk;
+ }
+
++ adc_dev->dev_comp = device_get_match_data(&pdev->dev);
++
+ mutex_init(&adc_dev->lock);
+
+ mt6577_auxadc_mod_reg(adc_dev->reg_base + MT6577_AUXADC_MISC,
--- /dev/null
+From 695e2f5c289bb7f8b85351dcfa35fa236e0200a4 Mon Sep 17 00:00:00 2001
+From: Olivier Moysan <olivier.moysan@st.com>
+Date: Wed, 21 Oct 2020 10:53:13 +0200
+Subject: iio: adc: stm32-adc: fix a regression when using dma and irq
+
+From: Olivier Moysan <olivier.moysan@st.com>
+
+commit 695e2f5c289bb7f8b85351dcfa35fa236e0200a4 upstream.
+
+Since overrun interrupt support has been added, there's a regression when
+two ADCs are used at the same time, with:
+- an ADC configured to use IRQs. EOCIE bit is set. The handler is normally
+ called in this case.
+- an ADC configured to use DMA. EOCIE bit isn't set. EOC triggers the DMA
+ request. It's then automatically cleared by DMA read. But the handler
+ gets called due to status bit is temporarily set (IRQ triggered by the
+ other ADC).
+
+This is a regression as similar issue had been fixed earlier by
+commit dcb10920179a ("iio: adc: stm32-adc:
+fix a race when using several adcs with dma and irq").
+Issue is that stm32_adc_eoc_enabled() returns non-zero value (always)
+since OVR bit has been added and enabled for both DMA and IRQ case.
+
+Remove OVR mask in IER register, and rely only on CSR status for overrun.
+To avoid subsequent calls to interrupt routine on overrun, CSR OVR bit has
+to be cleared. CSR OVR bit cannot be cleared directly by software.
+To do this ADC must be stopped first, and OVR bit in ADC ISR has
+to be cleared.
+Also add a check in ADC IRQ handler to report spurious IRQs.
+
+Fixes: cc06e67d8fa5 ("iio: adc: stm32-adc: Add check on overrun interrupt")
+Signed-off-by: Olivier Moysan <olivier.moysan@st.com>
+Signed-off-by: Fabrice Gasnier <fabrice.gasnier@st.com>
+Cc: <Stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20201021085313.5335-1-olivier.moysan@st.com
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/adc/stm32-adc-core.c | 41 +++++++++++++------------------
+ drivers/iio/adc/stm32-adc.c | 50 +++++++++++++++++++++++++++++++++++++--
+ 2 files changed, 65 insertions(+), 26 deletions(-)
+
+--- a/drivers/iio/adc/stm32-adc-core.c
++++ b/drivers/iio/adc/stm32-adc-core.c
+@@ -41,18 +41,16 @@
+ * struct stm32_adc_common_regs - stm32 common registers
+ * @csr: common status register offset
+ * @ccr: common control register offset
+- * @eoc1_msk: adc1 end of conversion flag in @csr
+- * @eoc2_msk: adc2 end of conversion flag in @csr
+- * @eoc3_msk: adc3 end of conversion flag in @csr
++ * @eoc_msk: array of eoc (end of conversion flag) masks in csr for adc1..n
++ * @ovr_msk: array of ovr (overrun flag) masks in csr for adc1..n
+ * @ier: interrupt enable register offset for each adc
+ * @eocie_msk: end of conversion interrupt enable mask in @ier
+ */
+ struct stm32_adc_common_regs {
+ u32 csr;
+ u32 ccr;
+- u32 eoc1_msk;
+- u32 eoc2_msk;
+- u32 eoc3_msk;
++ u32 eoc_msk[STM32_ADC_MAX_ADCS];
++ u32 ovr_msk[STM32_ADC_MAX_ADCS];
+ u32 ier;
+ u32 eocie_msk;
+ };
+@@ -282,21 +280,20 @@ out:
+ static const struct stm32_adc_common_regs stm32f4_adc_common_regs = {
+ .csr = STM32F4_ADC_CSR,
+ .ccr = STM32F4_ADC_CCR,
+- .eoc1_msk = STM32F4_EOC1 | STM32F4_OVR1,
+- .eoc2_msk = STM32F4_EOC2 | STM32F4_OVR2,
+- .eoc3_msk = STM32F4_EOC3 | STM32F4_OVR3,
++ .eoc_msk = { STM32F4_EOC1, STM32F4_EOC2, STM32F4_EOC3},
++ .ovr_msk = { STM32F4_OVR1, STM32F4_OVR2, STM32F4_OVR3},
+ .ier = STM32F4_ADC_CR1,
+- .eocie_msk = STM32F4_EOCIE | STM32F4_OVRIE,
++ .eocie_msk = STM32F4_EOCIE,
+ };
+
+ /* STM32H7 common registers definitions */
+ static const struct stm32_adc_common_regs stm32h7_adc_common_regs = {
+ .csr = STM32H7_ADC_CSR,
+ .ccr = STM32H7_ADC_CCR,
+- .eoc1_msk = STM32H7_EOC_MST | STM32H7_OVR_MST,
+- .eoc2_msk = STM32H7_EOC_SLV | STM32H7_OVR_SLV,
++ .eoc_msk = { STM32H7_EOC_MST, STM32H7_EOC_SLV},
++ .ovr_msk = { STM32H7_OVR_MST, STM32H7_OVR_SLV},
+ .ier = STM32H7_ADC_IER,
+- .eocie_msk = STM32H7_EOCIE | STM32H7_OVRIE,
++ .eocie_msk = STM32H7_EOCIE,
+ };
+
+ static const unsigned int stm32_adc_offset[STM32_ADC_MAX_ADCS] = {
+@@ -318,6 +315,7 @@ static void stm32_adc_irq_handler(struct
+ {
+ struct stm32_adc_priv *priv = irq_desc_get_handler_data(desc);
+ struct irq_chip *chip = irq_desc_get_chip(desc);
++ int i;
+ u32 status;
+
+ chained_irq_enter(chip, desc);
+@@ -335,17 +333,12 @@ static void stm32_adc_irq_handler(struct
+ * before invoking the interrupt handler (e.g. call ISR only for
+ * IRQ-enabled ADCs).
+ */
+- if (status & priv->cfg->regs->eoc1_msk &&
+- stm32_adc_eoc_enabled(priv, 0))
+- generic_handle_irq(irq_find_mapping(priv->domain, 0));
+-
+- if (status & priv->cfg->regs->eoc2_msk &&
+- stm32_adc_eoc_enabled(priv, 1))
+- generic_handle_irq(irq_find_mapping(priv->domain, 1));
+-
+- if (status & priv->cfg->regs->eoc3_msk &&
+- stm32_adc_eoc_enabled(priv, 2))
+- generic_handle_irq(irq_find_mapping(priv->domain, 2));
++ for (i = 0; i < priv->cfg->num_irqs; i++) {
++ if ((status & priv->cfg->regs->eoc_msk[i] &&
++ stm32_adc_eoc_enabled(priv, i)) ||
++ (status & priv->cfg->regs->ovr_msk[i]))
++ generic_handle_irq(irq_find_mapping(priv->domain, i));
++ }
+
+ chained_irq_exit(chip, desc);
+ };
+--- a/drivers/iio/adc/stm32-adc.c
++++ b/drivers/iio/adc/stm32-adc.c
+@@ -154,6 +154,7 @@ struct stm32_adc;
+ * @start_conv: routine to start conversions
+ * @stop_conv: routine to stop conversions
+ * @unprepare: optional unprepare routine (disable, power-down)
++ * @irq_clear: routine to clear irqs
+ * @smp_cycles: programmable sampling time (ADC clock cycles)
+ */
+ struct stm32_adc_cfg {
+@@ -166,6 +167,7 @@ struct stm32_adc_cfg {
+ void (*start_conv)(struct iio_dev *, bool dma);
+ void (*stop_conv)(struct iio_dev *);
+ void (*unprepare)(struct iio_dev *);
++ void (*irq_clear)(struct iio_dev *indio_dev, u32 msk);
+ const unsigned int *smp_cycles;
+ };
+
+@@ -621,6 +623,13 @@ static void stm32f4_adc_stop_conv(struct
+ STM32F4_ADON | STM32F4_DMA | STM32F4_DDS);
+ }
+
++static void stm32f4_adc_irq_clear(struct iio_dev *indio_dev, u32 msk)
++{
++ struct stm32_adc *adc = iio_priv(indio_dev);
++
++ stm32_adc_clr_bits(adc, adc->cfg->regs->isr_eoc.reg, msk);
++}
++
+ static void stm32h7_adc_start_conv(struct iio_dev *indio_dev, bool dma)
+ {
+ struct stm32_adc *adc = iio_priv(indio_dev);
+@@ -659,6 +668,13 @@ static void stm32h7_adc_stop_conv(struct
+ stm32_adc_clr_bits(adc, STM32H7_ADC_CFGR, STM32H7_DMNGT_MASK);
+ }
+
++static void stm32h7_adc_irq_clear(struct iio_dev *indio_dev, u32 msk)
++{
++ struct stm32_adc *adc = iio_priv(indio_dev);
++ /* On STM32H7 IRQs are cleared by writing 1 into ISR register */
++ stm32_adc_set_bits(adc, adc->cfg->regs->isr_eoc.reg, msk);
++}
++
+ static int stm32h7_adc_exit_pwr_down(struct iio_dev *indio_dev)
+ {
+ struct stm32_adc *adc = iio_priv(indio_dev);
+@@ -1235,17 +1251,40 @@ static int stm32_adc_read_raw(struct iio
+ }
+ }
+
++static void stm32_adc_irq_clear(struct iio_dev *indio_dev, u32 msk)
++{
++ struct stm32_adc *adc = iio_priv(indio_dev);
++
++ adc->cfg->irq_clear(indio_dev, msk);
++}
++
+ static irqreturn_t stm32_adc_threaded_isr(int irq, void *data)
+ {
+ struct iio_dev *indio_dev = data;
+ struct stm32_adc *adc = iio_priv(indio_dev);
+ const struct stm32_adc_regspec *regs = adc->cfg->regs;
+ u32 status = stm32_adc_readl(adc, regs->isr_eoc.reg);
++ u32 mask = stm32_adc_readl(adc, regs->ier_eoc.reg);
+
+- if (status & regs->isr_ovr.mask)
++ /* Check ovr status right now, as ovr mask should be already disabled */
++ if (status & regs->isr_ovr.mask) {
++ /*
++ * Clear ovr bit to avoid subsequent calls to IRQ handler.
++ * This requires to stop ADC first. OVR bit state in ISR,
++ * is propaged to CSR register by hardware.
++ */
++ adc->cfg->stop_conv(indio_dev);
++ stm32_adc_irq_clear(indio_dev, regs->isr_ovr.mask);
+ dev_err(&indio_dev->dev, "Overrun, stopping: restart needed\n");
++ return IRQ_HANDLED;
++ }
+
+- return IRQ_HANDLED;
++ if (!(status & mask))
++ dev_err_ratelimited(&indio_dev->dev,
++ "Unexpected IRQ: IER=0x%08x, ISR=0x%08x\n",
++ mask, status);
++
++ return IRQ_NONE;
+ }
+
+ static irqreturn_t stm32_adc_isr(int irq, void *data)
+@@ -1254,6 +1293,10 @@ static irqreturn_t stm32_adc_isr(int irq
+ struct stm32_adc *adc = iio_priv(indio_dev);
+ const struct stm32_adc_regspec *regs = adc->cfg->regs;
+ u32 status = stm32_adc_readl(adc, regs->isr_eoc.reg);
++ u32 mask = stm32_adc_readl(adc, regs->ier_eoc.reg);
++
++ if (!(status & mask))
++ return IRQ_WAKE_THREAD;
+
+ if (status & regs->isr_ovr.mask) {
+ /*
+@@ -2050,6 +2093,7 @@ static const struct stm32_adc_cfg stm32f
+ .start_conv = stm32f4_adc_start_conv,
+ .stop_conv = stm32f4_adc_stop_conv,
+ .smp_cycles = stm32f4_adc_smp_cycles,
++ .irq_clear = stm32f4_adc_irq_clear,
+ };
+
+ static const struct stm32_adc_cfg stm32h7_adc_cfg = {
+@@ -2061,6 +2105,7 @@ static const struct stm32_adc_cfg stm32h
+ .prepare = stm32h7_adc_prepare,
+ .unprepare = stm32h7_adc_unprepare,
+ .smp_cycles = stm32h7_adc_smp_cycles,
++ .irq_clear = stm32h7_adc_irq_clear,
+ };
+
+ static const struct stm32_adc_cfg stm32mp1_adc_cfg = {
+@@ -2073,6 +2118,7 @@ static const struct stm32_adc_cfg stm32m
+ .prepare = stm32h7_adc_prepare,
+ .unprepare = stm32h7_adc_unprepare,
+ .smp_cycles = stm32h7_adc_smp_cycles,
++ .irq_clear = stm32h7_adc_irq_clear,
+ };
+
+ static const struct of_device_id stm32_adc_of_match[] = {
--- /dev/null
+From 56e4f2dda23c6d39d327944faa89efaa4eb290d1 Mon Sep 17 00:00:00 2001
+From: Gwendal Grignou <gwendal@chromium.org>
+Date: Tue, 30 Jun 2020 08:37:30 -0700
+Subject: iio: cros_ec: Use default frequencies when EC returns invalid information
+
+From: Gwendal Grignou <gwendal@chromium.org>
+
+commit 56e4f2dda23c6d39d327944faa89efaa4eb290d1 upstream.
+
+Minimal and maximal frequencies supported by a sensor is queried.
+On some older machines, these frequencies are not returned properly and
+the EC returns 0 instead.
+When returned maximal frequency is 0, ignore the information and use
+default frequencies instead.
+
+Fixes: ae7b02ad2f32 ("iio: common: cros_ec_sensors: Expose cros_ec_sensors frequency range via iio sysfs")
+Signed-off-by: Gwendal Grignou <gwendal@chromium.org>
+Reviewed-by: Enric Balletbo i Serra <enric.balletbo@collabora.com>
+Link: https://lore.kernel.org/r/20200630153730.3302889-1-gwendal@chromium.org
+CC: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/common/cros_ec_sensors/cros_ec_sensors_core.c | 16 +++++++++-----
+ 1 file changed, 11 insertions(+), 5 deletions(-)
+
+--- a/drivers/iio/common/cros_ec_sensors/cros_ec_sensors_core.c
++++ b/drivers/iio/common/cros_ec_sensors/cros_ec_sensors_core.c
+@@ -255,7 +255,7 @@ int cros_ec_sensors_core_init(struct pla
+ struct cros_ec_sensorhub *sensor_hub = dev_get_drvdata(dev->parent);
+ struct cros_ec_dev *ec = sensor_hub->ec;
+ struct cros_ec_sensor_platform *sensor_platform = dev_get_platdata(dev);
+- u32 ver_mask;
++ u32 ver_mask, temp;
+ int frequencies[ARRAY_SIZE(state->frequencies) / 2] = { 0 };
+ int ret, i;
+
+@@ -310,10 +310,16 @@ int cros_ec_sensors_core_init(struct pla
+ &frequencies[2],
+ &state->fifo_max_event_count);
+ } else {
+- frequencies[1] = state->resp->info_3.min_frequency;
+- frequencies[2] = state->resp->info_3.max_frequency;
+- state->fifo_max_event_count =
+- state->resp->info_3.fifo_max_event_count;
++ if (state->resp->info_3.max_frequency == 0) {
++ get_default_min_max_freq(state->resp->info.type,
++ &frequencies[1],
++ &frequencies[2],
++ &temp);
++ } else {
++ frequencies[1] = state->resp->info_3.min_frequency;
++ frequencies[2] = state->resp->info_3.max_frequency;
++ }
++ state->fifo_max_event_count = state->resp->info_3.fifo_max_event_count;
+ }
+ for (i = 0; i < ARRAY_SIZE(frequencies); i++) {
+ state->frequencies[2 * i] = frequencies[i] / 1000;
--- /dev/null
+From fe0b980ffd1dd8b10c09f82385514819ba2a661d Mon Sep 17 00:00:00 2001
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Sun, 1 Nov 2020 17:21:18 +0100
+Subject: iio: imu: st_lsm6dsx: set 10ms as min shub slave timeout
+
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+
+commit fe0b980ffd1dd8b10c09f82385514819ba2a661d upstream.
+
+Set 10ms as minimum i2c slave configuration timeout since st_lsm6dsx
+relies on accel ODR for i2c master clock and at high sample rates
+(e.g. 833Hz or 416Hz) the slave sensor occasionally may need more cycles
+than i2c master timeout (2s/833Hz + 1 ~ 3ms) to apply the configuration
+resulting in an uncomplete slave configuration and a constant reading
+from the i2c slave connected to st_lsm6dsx i2c master.
+
+Fixes: 8f9a5249e3d9 ("iio: imu: st_lsm6dsx: enable 833Hz sample frequency for tagged sensors")
+Fixes: c91c1c844ebd ("iio: imu: st_lsm6dsx: add i2c embedded controller support")
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Cc: <Stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/a69c8236bf16a1569966815ed71710af2722ed7d.1604247274.git.lorenzo@kernel.org
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_shub.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_shub.c
++++ b/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_shub.c
+@@ -156,11 +156,13 @@ static const struct st_lsm6dsx_ext_dev_s
+ static void st_lsm6dsx_shub_wait_complete(struct st_lsm6dsx_hw *hw)
+ {
+ struct st_lsm6dsx_sensor *sensor;
+- u32 odr;
++ u32 odr, timeout;
+
+ sensor = iio_priv(hw->iio_devs[ST_LSM6DSX_ID_ACC]);
+ odr = (hw->enable_mask & BIT(ST_LSM6DSX_ID_ACC)) ? sensor->odr : 12500;
+- msleep((2000000U / odr) + 1);
++ /* set 10ms as minimum timeout for i2c slave configuration */
++ timeout = max_t(u32, 2000000U / odr + 1, 10);
++ msleep(timeout);
+ }
+
+ /*
--- /dev/null
+From 4b639e254d3d4f15ee4ff2b890a447204cfbeea9 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Micha=C5=82=20Miros=C5=82aw?= <mirq-linux@rere.qmqm.pl>
+Date: Fri, 13 Nov 2020 01:20:28 +0100
+Subject: regulator: avoid resolve_supply() infinite recursion
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michał Mirosław <mirq-linux@rere.qmqm.pl>
+
+commit 4b639e254d3d4f15ee4ff2b890a447204cfbeea9 upstream.
+
+When a regulator's name equals its supply's name the
+regulator_resolve_supply() recurses indefinitely. Add a check
+so that debugging the problem is easier. The "fixed" commit
+just exposed the problem.
+
+Fixes: aea6cb99703e ("regulator: resolve supply after creating regulator")
+Cc: stable@vger.kernel.org
+Reported-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
+Signed-off-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
+Tested-by: Ahmad Fatoum <a.fatoum@pengutronix.de> # stpmic1
+Link: https://lore.kernel.org/r/c6171057cfc0896f950c4d8cb82df0f9f1b89ad9.1605226675.git.mirq-linux@rere.qmqm.pl
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/regulator/core.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/regulator/core.c
++++ b/drivers/regulator/core.c
+@@ -1805,6 +1805,12 @@ static int regulator_resolve_supply(stru
+ }
+ }
+
++ if (r == rdev) {
++ dev_err(dev, "Supply for %s (%s) resolved to itself\n",
++ rdev->desc->name, rdev->supply_name);
++ return -EINVAL;
++ }
++
+ /*
+ * If the supply's parent device is not the same as the
+ * regulator's parent device, then ensure the parent device
--- /dev/null
+From 57a6ad482af256b2a13de14194fb8f67c1a65f10 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Micha=C5=82=20Miros=C5=82aw?= <mirq-linux@rere.qmqm.pl>
+Date: Fri, 13 Nov 2020 01:20:27 +0100
+Subject: regulator: fix memory leak with repeated set_machine_constraints()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michał Mirosław <mirq-linux@rere.qmqm.pl>
+
+commit 57a6ad482af256b2a13de14194fb8f67c1a65f10 upstream.
+
+Fixed commit introduced a possible second call to
+set_machine_constraints() and that allocates memory for
+rdev->constraints. Move the allocation to the caller so
+it's easier to manage and done once.
+
+Fixes: aea6cb99703e ("regulator: resolve supply after creating regulator")
+Cc: stable@vger.kernel.org
+Signed-off-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
+Tested-by: Ahmad Fatoum <a.fatoum@pengutronix.de> # stpmic1
+Link: https://lore.kernel.org/r/78c3d4016cebc08d441aad18cb924b4e4d9cf9df.1605226675.git.mirq-linux@rere.qmqm.pl
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/regulator/core.c | 29 +++++++++++++----------------
+ 1 file changed, 13 insertions(+), 16 deletions(-)
+
+--- a/drivers/regulator/core.c
++++ b/drivers/regulator/core.c
+@@ -1280,7 +1280,6 @@ static int _regulator_do_enable(struct r
+ /**
+ * set_machine_constraints - sets regulator constraints
+ * @rdev: regulator source
+- * @constraints: constraints to apply
+ *
+ * Allows platform initialisation code to define and constrain
+ * regulator circuits e.g. valid voltage/current ranges, etc. NOTE:
+@@ -1288,21 +1287,11 @@ static int _regulator_do_enable(struct r
+ * regulator operations to proceed i.e. set_voltage, set_current_limit,
+ * set_mode.
+ */
+-static int set_machine_constraints(struct regulator_dev *rdev,
+- const struct regulation_constraints *constraints)
++static int set_machine_constraints(struct regulator_dev *rdev)
+ {
+ int ret = 0;
+ const struct regulator_ops *ops = rdev->desc->ops;
+
+- if (constraints)
+- rdev->constraints = kmemdup(constraints, sizeof(*constraints),
+- GFP_KERNEL);
+- else
+- rdev->constraints = kzalloc(sizeof(*constraints),
+- GFP_KERNEL);
+- if (!rdev->constraints)
+- return -ENOMEM;
+-
+ ret = machine_constraints_voltage(rdev, rdev->constraints);
+ if (ret != 0)
+ return ret;
+@@ -5112,7 +5101,6 @@ struct regulator_dev *
+ regulator_register(const struct regulator_desc *regulator_desc,
+ const struct regulator_config *cfg)
+ {
+- const struct regulation_constraints *constraints = NULL;
+ const struct regulator_init_data *init_data;
+ struct regulator_config *config = NULL;
+ static atomic_t regulator_no = ATOMIC_INIT(-1);
+@@ -5251,14 +5239,23 @@ regulator_register(const struct regulato
+
+ /* set regulator constraints */
+ if (init_data)
+- constraints = &init_data->constraints;
++ rdev->constraints = kmemdup(&init_data->constraints,
++ sizeof(*rdev->constraints),
++ GFP_KERNEL);
++ else
++ rdev->constraints = kzalloc(sizeof(*rdev->constraints),
++ GFP_KERNEL);
++ if (!rdev->constraints) {
++ ret = -ENOMEM;
++ goto wash;
++ }
+
+ if (init_data && init_data->supply_regulator)
+ rdev->supply_name = init_data->supply_regulator;
+ else if (regulator_desc->supply_name)
+ rdev->supply_name = regulator_desc->supply_name;
+
+- ret = set_machine_constraints(rdev, constraints);
++ ret = set_machine_constraints(rdev);
+ if (ret == -EPROBE_DEFER) {
+ /* Regulator might be in bypass mode and so needs its supply
+ * to set the constraints */
+@@ -5267,7 +5264,7 @@ regulator_register(const struct regulato
+ * that is just being created */
+ ret = regulator_resolve_supply(rdev);
+ if (!ret)
+- ret = set_machine_constraints(rdev, constraints);
++ ret = set_machine_constraints(rdev);
+ else
+ rdev_dbg(rdev, "unable to resolve supply early: %pe\n",
+ ERR_PTR(ret));
--- /dev/null
+From 365ec8b61689bd64d6a61e129e0319bf71336407 Mon Sep 17 00:00:00 2001
+From: Sean Nyekjaer <sean@geanix.com>
+Date: Tue, 10 Nov 2020 18:41:13 +0100
+Subject: regulator: pfuze100: limit pfuze-support-disable-sw to pfuze{100,200}
+
+From: Sean Nyekjaer <sean@geanix.com>
+
+commit 365ec8b61689bd64d6a61e129e0319bf71336407 upstream.
+
+Limit the fsl,pfuze-support-disable-sw to the pfuze100 and pfuze200
+variants.
+When enabling fsl,pfuze-support-disable-sw and using a pfuze3000 or
+pfuze3001, the driver would choose pfuze100_sw_disable_regulator_ops
+instead of the newly introduced and correct pfuze3000_sw_regulator_ops.
+
+Signed-off-by: Sean Nyekjaer <sean@geanix.com>
+Fixes: 6f1cf5257acc ("regualtor: pfuze100: correct sw1a/sw2 on pfuze3000")
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20201110174113.2066534-1-sean@geanix.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/regulator/pfuze100-regulator.c | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+--- a/drivers/regulator/pfuze100-regulator.c
++++ b/drivers/regulator/pfuze100-regulator.c
+@@ -836,11 +836,14 @@ static int pfuze100_regulator_probe(stru
+ * the switched regulator till yet.
+ */
+ if (pfuze_chip->flags & PFUZE_FLAG_DISABLE_SW) {
+- if (pfuze_chip->regulator_descs[i].sw_reg) {
+- desc->ops = &pfuze100_sw_disable_regulator_ops;
+- desc->enable_val = 0x8;
+- desc->disable_val = 0x0;
+- desc->enable_time = 500;
++ if (pfuze_chip->chip_id == PFUZE100 ||
++ pfuze_chip->chip_id == PFUZE200) {
++ if (pfuze_chip->regulator_descs[i].sw_reg) {
++ desc->ops = &pfuze100_sw_disable_regulator_ops;
++ desc->enable_val = 0x8;
++ desc->disable_val = 0x0;
++ desc->enable_time = 500;
++ }
+ }
+ }
+
--- /dev/null
+From f5c042b23f7429e5c2ac987b01a31c69059a978b Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Micha=C5=82=20Miros=C5=82aw?= <mirq-linux@rere.qmqm.pl>
+Date: Fri, 13 Nov 2020 01:20:28 +0100
+Subject: regulator: workaround self-referent regulators
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michał Mirosław <mirq-linux@rere.qmqm.pl>
+
+commit f5c042b23f7429e5c2ac987b01a31c69059a978b upstream.
+
+Workaround regulators whose supply name happens to be the same as its
+own name. This fixes boards that used to work before the early supply
+resolving was removed. The error message is left in place so that
+offending drivers can be detected.
+
+Fixes: aea6cb99703e ("regulator: resolve supply after creating regulator")
+Cc: stable@vger.kernel.org
+Reported-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
+Signed-off-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
+Tested-by: Ahmad Fatoum <a.fatoum@pengutronix.de> # stpmic1
+Link: https://lore.kernel.org/r/d703acde2a93100c3c7a81059d716c50ad1b1f52.1605226675.git.mirq-linux@rere.qmqm.pl
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/regulator/core.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/regulator/core.c
++++ b/drivers/regulator/core.c
+@@ -1808,7 +1808,10 @@ static int regulator_resolve_supply(stru
+ if (r == rdev) {
+ dev_err(dev, "Supply for %s (%s) resolved to itself\n",
+ rdev->desc->name, rdev->supply_name);
+- return -EINVAL;
++ if (!have_full_constraints())
++ return -EINVAL;
++ r = dummy_regulator_rdev;
++ get_device(&r->dev);
+ }
+
+ /*
--- /dev/null
+From 425af483523b76bc78e14674a430579d38b2a593 Mon Sep 17 00:00:00 2001
+From: Zheng Zengkai <zhengzengkai@huawei.com>
+Date: Wed, 11 Nov 2020 20:44:26 +0800
+Subject: serial: ar933x_uart: disable clk on error handling path in probe
+
+From: Zheng Zengkai <zhengzengkai@huawei.com>
+
+commit 425af483523b76bc78e14674a430579d38b2a593 upstream.
+
+ar933x_uart_probe() does not invoke clk_disable_unprepare()
+on one error handling path. This patch fixes that.
+
+Fixes: 9be1064fe524 ("serial: ar933x_uart: add RS485 support")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Zheng Zengkai <zhengzengkai@huawei.com>
+Link: https://lore.kernel.org/r/20201111124426.42638-1-zhengzengkai@huawei.com
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/ar933x_uart.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/tty/serial/ar933x_uart.c
++++ b/drivers/tty/serial/ar933x_uart.c
+@@ -789,8 +789,10 @@ static int ar933x_uart_probe(struct plat
+ goto err_disable_clk;
+
+ up->gpios = mctrl_gpio_init(port, 0);
+- if (IS_ERR(up->gpios) && PTR_ERR(up->gpios) != -ENOSYS)
+- return PTR_ERR(up->gpios);
++ if (IS_ERR(up->gpios) && PTR_ERR(up->gpios) != -ENOSYS) {
++ ret = PTR_ERR(up->gpios);
++ goto err_disable_clk;
++ }
+
+ up->rts_gpiod = mctrl_gpio_to_gpiod(up->gpios, UART_GPIO_RTS);
+
staging-rtl8723bs-add-024c-0627-to-the-list-of-sdio-device-ids.patch
staging-mt7621-pci-avoid-to-request-pci-bus-resources.patch
iio-light-fix-kconfig-dependency-bug-for-vcnl4035.patch
+ext4-fix-bogus-warning-in-ext4_update_dx_flag.patch
+xfs-fix-forkoff-miscalculation-related-to-xfs_litino-mp.patch
+acpi-fan-initialize-performance-state-sysfs-attribute.patch
+iio-accel-kxcjk1013-replace-is_smo8500_device-with-an-acpi_type-enum.patch
+iio-accel-kxcjk1013-add-support-for-kiox010a-acpi-dsm-for-setting-tablet-mode.patch
+iio-adc-mediatek-fix-unset-field.patch
+iio-cros_ec-use-default-frequencies-when-ec-returns-invalid-information.patch
+iio-imu-st_lsm6dsx-set-10ms-as-min-shub-slave-timeout.patch
+iio-adc-ingenic-fix-aux-vbat-readings-when-touchscreen-is-used.patch
+iio-adc-ingenic-fix-battery-vref-for-jz4770-soc.patch
+iio-adc-stm32-adc-fix-a-regression-when-using-dma-and-irq.patch
+serial-ar933x_uart-disable-clk-on-error-handling-path-in-probe.patch
+arm64-dts-agilex-stratix10-fix-qspi-node-compatible.patch
+spi-lpspi-fix-use-after-free-on-unbind.patch
+spi-introduce-device-managed-spi-controller-allocation.patch
+spi-npcm-fiu-don-t-leak-spi-master-in-probe-error-path.patch
+spi-bcm2835aux-fix-use-after-free-on-unbind.patch
+regulator-pfuze100-limit-pfuze-support-disable-sw-to-pfuze-100-200.patch
+regulator-fix-memory-leak-with-repeated-set_machine_constraints.patch
+regulator-avoid-resolve_supply-infinite-recursion.patch
+regulator-workaround-self-referent-regulators.patch
--- /dev/null
+From e13ee6cc4781edaf8c7321bee19217e3702ed481 Mon Sep 17 00:00:00 2001
+From: Lukas Wunner <lukas@wunner.de>
+Date: Wed, 11 Nov 2020 20:07:30 +0100
+Subject: spi: bcm2835aux: Fix use-after-free on unbind
+
+From: Lukas Wunner <lukas@wunner.de>
+
+commit e13ee6cc4781edaf8c7321bee19217e3702ed481 upstream.
+
+bcm2835aux_spi_remove() accesses the driver's private data after calling
+spi_unregister_master() even though that function releases the last
+reference on the spi_master and thereby frees the private data.
+
+Fix by switching over to the new devm_spi_alloc_master() helper which
+keeps the private data accessible until the driver has unbound.
+
+Fixes: b9dd3f6d4172 ("spi: bcm2835aux: Fix controller unregister order")
+Signed-off-by: Lukas Wunner <lukas@wunner.de>
+Cc: <stable@vger.kernel.org> # v4.4+: 123456789abc: spi: Introduce device-managed SPI controller allocation
+Cc: <stable@vger.kernel.org> # v4.4+: b9dd3f6d4172: spi: bcm2835aux: Fix controller unregister order
+Cc: <stable@vger.kernel.org> # v4.4+
+Link: https://lore.kernel.org/r/b290b06357d0c0bdee9cecc539b840a90630f101.1605121038.git.lukas@wunner.de
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/spi/spi-bcm2835aux.c | 21 +++++++--------------
+ 1 file changed, 7 insertions(+), 14 deletions(-)
+
+--- a/drivers/spi/spi-bcm2835aux.c
++++ b/drivers/spi/spi-bcm2835aux.c
+@@ -494,7 +494,7 @@ static int bcm2835aux_spi_probe(struct p
+ unsigned long clk_hz;
+ int err;
+
+- master = spi_alloc_master(&pdev->dev, sizeof(*bs));
++ master = devm_spi_alloc_master(&pdev->dev, sizeof(*bs));
+ if (!master)
+ return -ENOMEM;
+
+@@ -524,29 +524,24 @@ static int bcm2835aux_spi_probe(struct p
+
+ /* the main area */
+ bs->regs = devm_platform_ioremap_resource(pdev, 0);
+- if (IS_ERR(bs->regs)) {
+- err = PTR_ERR(bs->regs);
+- goto out_master_put;
+- }
++ if (IS_ERR(bs->regs))
++ return PTR_ERR(bs->regs);
+
+ bs->clk = devm_clk_get(&pdev->dev, NULL);
+ if (IS_ERR(bs->clk)) {
+- err = PTR_ERR(bs->clk);
+ dev_err(&pdev->dev, "could not get clk: %d\n", err);
+- goto out_master_put;
++ return PTR_ERR(bs->clk);
+ }
+
+ bs->irq = platform_get_irq(pdev, 0);
+- if (bs->irq <= 0) {
+- err = bs->irq ? bs->irq : -ENODEV;
+- goto out_master_put;
+- }
++ if (bs->irq <= 0)
++ return bs->irq ? bs->irq : -ENODEV;
+
+ /* this also enables the HW block */
+ err = clk_prepare_enable(bs->clk);
+ if (err) {
+ dev_err(&pdev->dev, "could not prepare clock: %d\n", err);
+- goto out_master_put;
++ return err;
+ }
+
+ /* just checking if the clock returns a sane value */
+@@ -581,8 +576,6 @@ static int bcm2835aux_spi_probe(struct p
+
+ out_clk_disable:
+ clk_disable_unprepare(bs->clk);
+-out_master_put:
+- spi_master_put(master);
+ return err;
+ }
+
--- /dev/null
+From 5e844cc37a5cbaa460e68f9a989d321d63088a89 Mon Sep 17 00:00:00 2001
+From: Lukas Wunner <lukas@wunner.de>
+Date: Wed, 11 Nov 2020 20:07:10 +0100
+Subject: spi: Introduce device-managed SPI controller allocation
+
+From: Lukas Wunner <lukas@wunner.de>
+
+commit 5e844cc37a5cbaa460e68f9a989d321d63088a89 upstream.
+
+SPI driver probing currently comprises two steps, whereas removal
+comprises only one step:
+
+ spi_alloc_master()
+ spi_register_controller()
+
+ spi_unregister_controller()
+
+That's because spi_unregister_controller() calls device_unregister()
+instead of device_del(), thereby releasing the reference on the
+spi_controller which was obtained by spi_alloc_master().
+
+An SPI driver's private data is contained in the same memory allocation
+as the spi_controller struct. Thus, once spi_unregister_controller()
+has been called, the private data is inaccessible. But some drivers
+need to access it after spi_unregister_controller() to perform further
+teardown steps.
+
+Introduce devm_spi_alloc_master() and devm_spi_alloc_slave(), which
+release a reference on the spi_controller struct only after the driver
+has unbound, thereby keeping the memory allocation accessible. Change
+spi_unregister_controller() to not release a reference if the
+spi_controller was allocated by one of these new devm functions.
+
+The present commit is small enough to be backportable to stable.
+It allows fixing drivers which use the private data in their ->remove()
+hook after it's been freed. It also allows fixing drivers which neglect
+to release a reference on the spi_controller in the probe error path.
+
+Long-term, most SPI drivers shall be moved over to the devm functions
+introduced herein. The few that can't shall be changed in a treewide
+commit to explicitly release the last reference on the controller.
+That commit shall amend spi_unregister_controller() to no longer release
+a reference, thereby completing the migration.
+
+As a result, the behaviour will be less surprising and more consistent
+with subsystems such as IIO, which also includes the private data in the
+allocation of the generic iio_dev struct, but calls device_del() in
+iio_device_unregister().
+
+Signed-off-by: Lukas Wunner <lukas@wunner.de>
+Link: https://lore.kernel.org/r/272bae2ef08abd21388c98e23729886663d19192.1605121038.git.lukas@wunner.de
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/spi/spi.c | 58 +++++++++++++++++++++++++++++++++++++++++++++++-
+ include/linux/spi/spi.h | 19 +++++++++++++++
+ 2 files changed, 76 insertions(+), 1 deletion(-)
+
+--- a/drivers/spi/spi.c
++++ b/drivers/spi/spi.c
+@@ -2442,6 +2442,49 @@ struct spi_controller *__spi_alloc_contr
+ }
+ EXPORT_SYMBOL_GPL(__spi_alloc_controller);
+
++static void devm_spi_release_controller(struct device *dev, void *ctlr)
++{
++ spi_controller_put(*(struct spi_controller **)ctlr);
++}
++
++/**
++ * __devm_spi_alloc_controller - resource-managed __spi_alloc_controller()
++ * @dev: physical device of SPI controller
++ * @size: how much zeroed driver-private data to allocate
++ * @slave: whether to allocate an SPI master (false) or SPI slave (true)
++ * Context: can sleep
++ *
++ * Allocate an SPI controller and automatically release a reference on it
++ * when @dev is unbound from its driver. Drivers are thus relieved from
++ * having to call spi_controller_put().
++ *
++ * The arguments to this function are identical to __spi_alloc_controller().
++ *
++ * Return: the SPI controller structure on success, else NULL.
++ */
++struct spi_controller *__devm_spi_alloc_controller(struct device *dev,
++ unsigned int size,
++ bool slave)
++{
++ struct spi_controller **ptr, *ctlr;
++
++ ptr = devres_alloc(devm_spi_release_controller, sizeof(*ptr),
++ GFP_KERNEL);
++ if (!ptr)
++ return NULL;
++
++ ctlr = __spi_alloc_controller(dev, size, slave);
++ if (ctlr) {
++ *ptr = ctlr;
++ devres_add(dev, ptr);
++ } else {
++ devres_free(ptr);
++ }
++
++ return ctlr;
++}
++EXPORT_SYMBOL_GPL(__devm_spi_alloc_controller);
++
+ #ifdef CONFIG_OF
+ static int of_spi_get_gpio_numbers(struct spi_controller *ctlr)
+ {
+@@ -2778,6 +2821,11 @@ int devm_spi_register_controller(struct
+ }
+ EXPORT_SYMBOL_GPL(devm_spi_register_controller);
+
++static int devm_spi_match_controller(struct device *dev, void *res, void *ctlr)
++{
++ return *(struct spi_controller **)res == ctlr;
++}
++
+ static int __unregister(struct device *dev, void *null)
+ {
+ spi_unregister_device(to_spi_device(dev));
+@@ -2819,7 +2867,15 @@ void spi_unregister_controller(struct sp
+ list_del(&ctlr->list);
+ mutex_unlock(&board_lock);
+
+- device_unregister(&ctlr->dev);
++ device_del(&ctlr->dev);
++
++ /* Release the last reference on the controller if its driver
++ * has not yet been converted to devm_spi_alloc_master/slave().
++ */
++ if (!devres_find(ctlr->dev.parent, devm_spi_release_controller,
++ devm_spi_match_controller, ctlr))
++ put_device(&ctlr->dev);
++
+ /* free bus id */
+ mutex_lock(&board_lock);
+ if (found == ctlr)
+--- a/include/linux/spi/spi.h
++++ b/include/linux/spi/spi.h
+@@ -734,6 +734,25 @@ static inline struct spi_controller *spi
+ return __spi_alloc_controller(host, size, true);
+ }
+
++struct spi_controller *__devm_spi_alloc_controller(struct device *dev,
++ unsigned int size,
++ bool slave);
++
++static inline struct spi_controller *devm_spi_alloc_master(struct device *dev,
++ unsigned int size)
++{
++ return __devm_spi_alloc_controller(dev, size, false);
++}
++
++static inline struct spi_controller *devm_spi_alloc_slave(struct device *dev,
++ unsigned int size)
++{
++ if (!IS_ENABLED(CONFIG_SPI_SLAVE))
++ return NULL;
++
++ return __devm_spi_alloc_controller(dev, size, true);
++}
++
+ extern int spi_register_controller(struct spi_controller *ctlr);
+ extern int devm_spi_register_controller(struct device *dev,
+ struct spi_controller *ctlr);
--- /dev/null
+From 4def49da620c84a682d9361d6bef0a97eed46fe0 Mon Sep 17 00:00:00 2001
+From: Lukas Wunner <lukas@wunner.de>
+Date: Sun, 8 Nov 2020 23:41:00 +0100
+Subject: spi: lpspi: Fix use-after-free on unbind
+
+From: Lukas Wunner <lukas@wunner.de>
+
+commit 4def49da620c84a682d9361d6bef0a97eed46fe0 upstream.
+
+Normally the last reference on an spi_controller is released by
+spi_unregister_controller(). In the case of the i.MX lpspi driver,
+the spi_controller is registered with devm_spi_register_controller(),
+so spi_unregister_controller() is invoked automatically after the driver
+has unbound.
+
+However the driver already releases the last reference in
+fsl_lpspi_remove() through a gratuitous call to spi_master_put(),
+causing a use-after-free when spi_unregister_controller() is
+subsequently invoked by the devres framework.
+
+Fix by dropping the superfluous spi_master_put().
+
+Fixes: 944c01a889d9 ("spi: lpspi: enable runtime pm for lpspi")
+Signed-off-by: Lukas Wunner <lukas@wunner.de>
+Cc: <stable@vger.kernel.org> # v5.2+
+Cc: Han Xu <han.xu@nxp.com>
+Link: https://lore.kernel.org/r/ab3c0b18bd820501a12c85e440006e09ec0e275f.1604874488.git.lukas@wunner.de
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/spi/spi-fsl-lpspi.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+--- a/drivers/spi/spi-fsl-lpspi.c
++++ b/drivers/spi/spi-fsl-lpspi.c
+@@ -938,9 +938,6 @@ static int fsl_lpspi_remove(struct platf
+ spi_controller_get_devdata(controller);
+
+ pm_runtime_disable(fsl_lpspi->dev);
+-
+- spi_master_put(controller);
+-
+ return 0;
+ }
+
--- /dev/null
+From 04a9cd51d3f3308a98cbc6adc07acb12fbade011 Mon Sep 17 00:00:00 2001
+From: Lukas Wunner <lukas@wunner.de>
+Date: Mon, 16 Nov 2020 09:23:10 +0100
+Subject: spi: npcm-fiu: Don't leak SPI master in probe error path
+
+From: Lukas Wunner <lukas@wunner.de>
+
+commit 04a9cd51d3f3308a98cbc6adc07acb12fbade011 upstream.
+
+If the calls to of_match_device(), of_alias_get_id(),
+devm_ioremap_resource(), devm_regmap_init_mmio() or devm_clk_get()
+fail on probe of the NPCM FIU SPI driver, the spi_controller struct is
+erroneously not freed.
+
+Fix by switching over to the new devm_spi_alloc_master() helper.
+
+Fixes: ace55c411b11 ("spi: npcm-fiu: add NPCM FIU controller driver")
+Signed-off-by: Lukas Wunner <lukas@wunner.de>
+Cc: <stable@vger.kernel.org> # v5.4+: 5e844cc37a5c: spi: Introduce device-managed SPI controller allocation
+Cc: <stable@vger.kernel.org> # v5.4+
+Cc: Tomer Maimon <tmaimon77@gmail.com>
+Link: https://lore.kernel.org/r/a420c23a363a3bc9aa684c6e790c32a8af106d17.1605512876.git.lukas@wunner.de
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/spi/spi-npcm-fiu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/spi/spi-npcm-fiu.c
++++ b/drivers/spi/spi-npcm-fiu.c
+@@ -680,7 +680,7 @@ static int npcm_fiu_probe(struct platfor
+ int ret;
+ int id;
+
+- ctrl = spi_alloc_master(dev, sizeof(*fiu));
++ ctrl = devm_spi_alloc_master(dev, sizeof(*fiu));
+ if (!ctrl)
+ return -ENOMEM;
+
--- /dev/null
+From ada49d64fb3538144192181db05de17e2ffc3551 Mon Sep 17 00:00:00 2001
+From: Gao Xiang <hsiangkao@redhat.com>
+Date: Sat, 14 Nov 2020 11:06:01 -0800
+Subject: xfs: fix forkoff miscalculation related to XFS_LITINO(mp)
+
+From: Gao Xiang <hsiangkao@redhat.com>
+
+commit ada49d64fb3538144192181db05de17e2ffc3551 upstream.
+
+Currently, commit e9e2eae89ddb dropped a (int) decoration from
+XFS_LITINO(mp), and since sizeof() expression is also involved,
+the result of XFS_LITINO(mp) is simply as the size_t type
+(commonly unsigned long).
+
+Considering the expression in xfs_attr_shortform_bytesfit():
+ offset = (XFS_LITINO(mp) - bytes) >> 3;
+let "bytes" be (int)340, and
+ "XFS_LITINO(mp)" be (unsigned long)336.
+
+on 64-bit platform, the expression is
+ offset = ((unsigned long)336 - (int)340) >> 3 =
+ (int)(0xfffffffffffffffcUL >> 3) = -1
+
+but on 32-bit platform, the expression is
+ offset = ((unsigned long)336 - (int)340) >> 3 =
+ (int)(0xfffffffcUL >> 3) = 0x1fffffff
+instead.
+
+so offset becomes a large positive number on 32-bit platform, and
+cause xfs_attr_shortform_bytesfit() returns maxforkoff rather than 0.
+
+Therefore, one result is
+ "ASSERT(new_size <= XFS_IFORK_SIZE(ip, whichfork));"
+
+assertion failure in xfs_idata_realloc(), which was also the root
+cause of the original bugreport from Dennis, see:
+ https://bugzilla.redhat.com/show_bug.cgi?id=1894177
+
+And it can also be manually triggered with the following commands:
+ $ touch a;
+ $ setfattr -n user.0 -v "`seq 0 80`" a;
+ $ setfattr -n user.1 -v "`seq 0 80`" a
+
+on 32-bit platform.
+
+Fix the case in xfs_attr_shortform_bytesfit() by bailing out
+"XFS_LITINO(mp) < bytes" in advance suggested by Eric and a misleading
+comment together with this bugfix suggested by Darrick. It seems the
+other users of XFS_LITINO(mp) are not impacted.
+
+Fixes: e9e2eae89ddb ("xfs: only check the superblock version for dinode size calculation")
+Cc: <stable@vger.kernel.org> # 5.7+
+Reported-and-tested-by: Dennis Gilmore <dgilmore@redhat.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Gao Xiang <hsiangkao@redhat.com>
+Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/xfs/libxfs/xfs_attr_leaf.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/fs/xfs/libxfs/xfs_attr_leaf.c
++++ b/fs/xfs/libxfs/xfs_attr_leaf.c
+@@ -515,7 +515,7 @@ xfs_attr_copy_value(
+ *========================================================================*/
+
+ /*
+- * Query whether the requested number of additional bytes of extended
++ * Query whether the total requested number of attr fork bytes of extended
+ * attribute space will be able to fit inline.
+ *
+ * Returns zero if not, else the di_forkoff fork offset to be used in the
+@@ -535,6 +535,12 @@ xfs_attr_shortform_bytesfit(
+ int maxforkoff;
+ int offset;
+
++ /*
++ * Check if the new size could fit at all first:
++ */
++ if (bytes > XFS_LITINO(mp))
++ return 0;
++
+ /* rounded down */
+ offset = (XFS_LITINO(mp) - bytes) >> 3;
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
