--- /dev/null
+From e097eb7473d9e70da9e03276f61cd392ccb9d79f Mon Sep 17 00:00:00 2001
+From: Yu Kuai <yukuai3@huawei.com>
+Date: Mon, 17 Aug 2020 19:57:28 +0800
+Subject: dmaengine: at_hdmac: add missing kfree() call in at_dma_xlate()
+
+From: Yu Kuai <yukuai3@huawei.com>
+
+commit e097eb7473d9e70da9e03276f61cd392ccb9d79f upstream.
+
+If memory allocation for 'atslave' succeed, at_dma_xlate() doesn't have a
+corresponding kfree() in exception handling. Thus add kfree() for this
+function implementation.
+
+Fixes: bbe89c8e3d59 ("at_hdmac: move to generic DMA binding")
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Link: https://lore.kernel.org/r/20200817115728.1706719-4-yukuai3@huawei.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/dma/at_hdmac.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/dma/at_hdmac.c
++++ b/drivers/dma/at_hdmac.c
+@@ -1718,6 +1718,7 @@ static struct dma_chan *at_dma_xlate(str
+ chan = dma_request_channel(mask, at_dma_filter, atslave);
+ if (!chan) {
+ put_device(&dmac_pdev->dev);
++ kfree(atslave);
+ return NULL;
+ }
+
--- /dev/null
+From 3832b78b3ec2cf51e07102f9b4480e343459b20f Mon Sep 17 00:00:00 2001
+From: Yu Kuai <yukuai3@huawei.com>
+Date: Mon, 17 Aug 2020 19:57:27 +0800
+Subject: dmaengine: at_hdmac: add missing put_device() call in at_dma_xlate()
+
+From: Yu Kuai <yukuai3@huawei.com>
+
+commit 3832b78b3ec2cf51e07102f9b4480e343459b20f upstream.
+
+If of_find_device_by_node() succeed, at_dma_xlate() doesn't have a
+corresponding put_device(). Thus add put_device() to fix the exception
+handling for this function implementation.
+
+Fixes: bbe89c8e3d59 ("at_hdmac: move to generic DMA binding")
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Link: https://lore.kernel.org/r/20200817115728.1706719-3-yukuai3@huawei.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/dma/at_hdmac.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/drivers/dma/at_hdmac.c
++++ b/drivers/dma/at_hdmac.c
+@@ -1684,8 +1684,10 @@ static struct dma_chan *at_dma_xlate(str
+ dma_cap_set(DMA_SLAVE, mask);
+
+ atslave = kmalloc(sizeof(*atslave), GFP_KERNEL);
+- if (!atslave)
++ if (!atslave) {
++ put_device(&dmac_pdev->dev);
+ return NULL;
++ }
+
+ atslave->cfg = ATC_DST_H2SEL_HW | ATC_SRC_H2SEL_HW;
+ /*
+@@ -1714,8 +1716,10 @@ static struct dma_chan *at_dma_xlate(str
+ atslave->dma_dev = &dmac_pdev->dev;
+
+ chan = dma_request_channel(mask, at_dma_filter, atslave);
+- if (!chan)
++ if (!chan) {
++ put_device(&dmac_pdev->dev);
+ return NULL;
++ }
+
+ atchan = to_at_dma_chan(chan);
+ atchan->per_if = dma_spec->args[0] & 0xff;
--- /dev/null
+From a6e7f19c910068cb54983f36acebedb376f3a9ac Mon Sep 17 00:00:00 2001
+From: Tudor Ambarus <tudor.ambarus@microchip.com>
+Date: Thu, 23 Jan 2020 14:03:02 +0000
+Subject: dmaengine: at_hdmac: Substitute kzalloc with kmalloc
+
+From: Tudor Ambarus <tudor.ambarus@microchip.com>
+
+commit a6e7f19c910068cb54983f36acebedb376f3a9ac upstream.
+
+All members of the structure are initialized below in the function,
+there is no need to use kzalloc.
+
+Signed-off-by: Tudor Ambarus <tudor.ambarus@microchip.com>
+Acked-by: Ludovic Desroches <ludovic.desroches@microchip.com>
+Link: https://lore.kernel.org/r/20200123140237.125799-1-tudor.ambarus@microchip.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/dma/at_hdmac.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/dma/at_hdmac.c
++++ b/drivers/dma/at_hdmac.c
+@@ -1683,7 +1683,7 @@ static struct dma_chan *at_dma_xlate(str
+ dma_cap_zero(mask);
+ dma_cap_set(DMA_SLAVE, mask);
+
+- atslave = kzalloc(sizeof(*atslave), GFP_KERNEL);
++ atslave = kmalloc(sizeof(*atslave), GFP_KERNEL);
+ if (!atslave)
+ return NULL;
+
--- /dev/null
+From aa8c7db494d0a83ecae583aa193f1134ef25d506 Mon Sep 17 00:00:00 2001
+From: Josh Poimboeuf <jpoimboe@redhat.com>
+Date: Tue, 29 Dec 2020 15:14:55 -0800
+Subject: kdev_t: always inline major/minor helper functions
+
+From: Josh Poimboeuf <jpoimboe@redhat.com>
+
+commit aa8c7db494d0a83ecae583aa193f1134ef25d506 upstream.
+
+Silly GCC doesn't always inline these trivial functions.
+
+Fixes the following warning:
+
+ arch/x86/kernel/sys_ia32.o: warning: objtool: cp_stat64()+0xd8: call to new_encode_dev() with UACCESS enabled
+
+Link: https://lkml.kernel.org/r/984353b44a4484d86ba9f73884b7306232e25e30.1608737428.git.jpoimboe@redhat.com
+Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com>
+Reported-by: Randy Dunlap <rdunlap@infradead.org>
+Acked-by: Randy Dunlap <rdunlap@infradead.org> [build-tested]
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/linux/kdev_t.h | 22 +++++++++++-----------
+ 1 file changed, 11 insertions(+), 11 deletions(-)
+
+--- a/include/linux/kdev_t.h
++++ b/include/linux/kdev_t.h
+@@ -21,61 +21,61 @@
+ })
+
+ /* acceptable for old filesystems */
+-static inline bool old_valid_dev(dev_t dev)
++static __always_inline bool old_valid_dev(dev_t dev)
+ {
+ return MAJOR(dev) < 256 && MINOR(dev) < 256;
+ }
+
+-static inline u16 old_encode_dev(dev_t dev)
++static __always_inline u16 old_encode_dev(dev_t dev)
+ {
+ return (MAJOR(dev) << 8) | MINOR(dev);
+ }
+
+-static inline dev_t old_decode_dev(u16 val)
++static __always_inline dev_t old_decode_dev(u16 val)
+ {
+ return MKDEV((val >> 8) & 255, val & 255);
+ }
+
+-static inline u32 new_encode_dev(dev_t dev)
++static __always_inline u32 new_encode_dev(dev_t dev)
+ {
+ unsigned major = MAJOR(dev);
+ unsigned minor = MINOR(dev);
+ return (minor & 0xff) | (major << 8) | ((minor & ~0xff) << 12);
+ }
+
+-static inline dev_t new_decode_dev(u32 dev)
++static __always_inline dev_t new_decode_dev(u32 dev)
+ {
+ unsigned major = (dev & 0xfff00) >> 8;
+ unsigned minor = (dev & 0xff) | ((dev >> 12) & 0xfff00);
+ return MKDEV(major, minor);
+ }
+
+-static inline u64 huge_encode_dev(dev_t dev)
++static __always_inline u64 huge_encode_dev(dev_t dev)
+ {
+ return new_encode_dev(dev);
+ }
+
+-static inline dev_t huge_decode_dev(u64 dev)
++static __always_inline dev_t huge_decode_dev(u64 dev)
+ {
+ return new_decode_dev(dev);
+ }
+
+-static inline int sysv_valid_dev(dev_t dev)
++static __always_inline int sysv_valid_dev(dev_t dev)
+ {
+ return MAJOR(dev) < (1<<14) && MINOR(dev) < (1<<18);
+ }
+
+-static inline u32 sysv_encode_dev(dev_t dev)
++static __always_inline u32 sysv_encode_dev(dev_t dev)
+ {
+ return MINOR(dev) | (MAJOR(dev) << 18);
+ }
+
+-static inline unsigned sysv_major(u32 dev)
++static __always_inline unsigned sysv_major(u32 dev)
+ {
+ return (dev >> 18) & 0x3fff;
+ }
+
+-static inline unsigned sysv_minor(u32 dev)
++static __always_inline unsigned sysv_minor(u32 dev)
+ {
+ return dev & 0x3ffff;
+ }
--- /dev/null
+From nbd@nbd.name Wed Jan 6 17:49:44 2021
+From: Felix Fietkau <nbd@nbd.name>
+Date: Tue, 5 Jan 2021 11:18:21 +0100
+Subject: Revert "mtd: spinand: Fix OOB read"
+To: stable@vger.kernel.org
+Cc: gregkh@linuxfoundation.org, Miquel Raynal <miquel.raynal@bootlin.com>
+Message-ID: <20210105101821.47138-1-nbd@nbd.name>
+
+From: Felix Fietkau <nbd@nbd.name>
+
+This reverts stable commit baad618d078c857f99cc286ea249e9629159901f.
+
+This commit is adding lines to spinand_write_to_cache_op, wheras the upstream
+commit 868cbe2a6dcee451bd8f87cbbb2a73cf463b57e5 that this was supposed to
+backport was touching spinand_read_from_cache_op.
+It causes a crash on writing OOB data by attempting to write to read-only
+kernel memory.
+
+Cc: Miquel Raynal <miquel.raynal@bootlin.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mtd/nand/spi/core.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+--- a/drivers/mtd/nand/spi/core.c
++++ b/drivers/mtd/nand/spi/core.c
+@@ -378,10 +378,6 @@ static int spinand_write_to_cache_op(str
+ }
+ }
+
+- if (req->ooblen)
+- memcpy(req->oobbuf.in, spinand->oobbuf + req->ooboffs,
+- req->ooblen);
+-
+ return 0;
+ }
+
revert-mtd-spinand-fix-oob-read.patch
+dmaengine-at_hdmac-substitute-kzalloc-with-kmalloc.patch
+dmaengine-at_hdmac-add-missing-put_device-call-in-at_dma_xlate.patch
+dmaengine-at_hdmac-add-missing-kfree-call-in-at_dma_xlate.patch
+kdev_t-always-inline-major-minor-helper-functions.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
