--- /dev/null
+From efa61248647fc1b8a9236102c16e94984cd2d593 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 May 2021 13:57:02 +0200
+Subject: ALSA: sb8: Add a comment note regarding an unused pointer
+
+From: Atul Gopinathan <atulgopinathan@gmail.com>
+
+[ Upstream commit a28591f61b60fac820c6de59826ffa710e5e314e ]
+
+The field "fm_res" of "struct snd_sb8" is never used/dereferenced
+throughout the sb8.c code. Therefore there is no need for any null value
+check after the "request_region()".
+
+Add a comment note to make developers know about this and prevent any
+"NULL check" patches on this part of code.
+
+Cc: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Atul Gopinathan <atulgopinathan@gmail.com>
+Link: https://lore.kernel.org/r/20210503115736.2104747-36-gregkh@linuxfoundation.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/isa/sb/sb8.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/sound/isa/sb/sb8.c b/sound/isa/sb/sb8.c
+index b8e2391c33ff..4fa3b0f2a270 100644
+--- a/sound/isa/sb/sb8.c
++++ b/sound/isa/sb/sb8.c
+@@ -109,7 +109,11 @@ static int snd_sb8_probe(struct device *pdev, unsigned int dev)
+ acard = card->private_data;
+ card->private_free = snd_sb8_free;
+
+- /* block the 0x388 port to avoid PnP conflicts */
++ /*
++ * Block the 0x388 port to avoid PnP conflicts.
++ * No need to check this value after request_region,
++ * as we never do anything with it.
++ */
+ acard->fm_res = request_region(0x388, 4, "SoundBlaster FM");
+
+ if (port[dev] != SNDRV_AUTO_PORT) {
+--
+2.30.2
+
--- /dev/null
+From 07a01d788f4652fd15bbe7d1b14aebda9935b38a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 May 2021 13:57:10 +0200
+Subject: ath6kl: return error code in ath6kl_wmi_set_roam_lrssi_cmd()
+
+From: Anirudh Rayabharam <mail@anirudhrb.com>
+
+[ Upstream commit fc6a6521556c8250e356ddc6a3f2391aa62dc976 ]
+
+ath6kl_wmi_cmd_send could fail, so let's return its error code upstream.
+
+Signed-off-by: Kangjie Lu <kjlu@umn.edu>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath6kl/debug.c | 5 ++++-
+ drivers/net/wireless/ath/ath6kl/wmi.c | 4 +---
+ 2 files changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath6kl/debug.c b/drivers/net/wireless/ath/ath6kl/debug.c
+index e2b7809d7886..f3a786af7ece 100644
+--- a/drivers/net/wireless/ath/ath6kl/debug.c
++++ b/drivers/net/wireless/ath/ath6kl/debug.c
+@@ -1027,14 +1027,17 @@ static ssize_t ath6kl_lrssi_roam_write(struct file *file,
+ {
+ struct ath6kl *ar = file->private_data;
+ unsigned long lrssi_roam_threshold;
++ int ret;
+
+ if (kstrtoul_from_user(user_buf, count, 0, &lrssi_roam_threshold))
+ return -EINVAL;
+
+ ar->lrssi_roam_threshold = lrssi_roam_threshold;
+
+- ath6kl_wmi_set_roam_lrssi_cmd(ar->wmi, ar->lrssi_roam_threshold);
++ ret = ath6kl_wmi_set_roam_lrssi_cmd(ar->wmi, ar->lrssi_roam_threshold);
+
++ if (ret)
++ return ret;
+ return count;
+ }
+
+diff --git a/drivers/net/wireless/ath/ath6kl/wmi.c b/drivers/net/wireless/ath/ath6kl/wmi.c
+index 7e1010475cfb..4aead53acf38 100644
+--- a/drivers/net/wireless/ath/ath6kl/wmi.c
++++ b/drivers/net/wireless/ath/ath6kl/wmi.c
+@@ -776,10 +776,8 @@ int ath6kl_wmi_set_roam_lrssi_cmd(struct wmi *wmi, u8 lrssi)
+ cmd->info.params.roam_rssi_floor = DEF_LRSSI_ROAM_FLOOR;
+ cmd->roam_ctrl = WMI_SET_LRSSI_SCAN_PARAMS;
+
+- ath6kl_wmi_cmd_send(wmi, 0, skb, WMI_SET_ROAM_CTRL_CMDID,
++ return ath6kl_wmi_cmd_send(wmi, 0, skb, WMI_SET_ROAM_CTRL_CMDID,
+ NO_SYNC_WMIFLAG);
+-
+- return 0;
+ }
+
+ int ath6kl_wmi_force_roam_cmd(struct wmi *wmi, const u8 *bssid)
+--
+2.30.2
+
--- /dev/null
+From 11cc51bf58da1455202ed7ec11fa77d49f5193bb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 May 2021 10:56:16 -0400
+Subject: btrfs: do not BUG_ON in link_to_fixup_dir
+
+From: Josef Bacik <josef@toxicpanda.com>
+
+[ Upstream commit 91df99a6eb50d5a1bc70fff4a09a0b7ae6aab96d ]
+
+While doing error injection testing I got the following panic
+
+ kernel BUG at fs/btrfs/tree-log.c:1862!
+ invalid opcode: 0000 [#1] SMP NOPTI
+ CPU: 1 PID: 7836 Comm: mount Not tainted 5.13.0-rc1+ #305
+ Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-2.fc32 04/01/2014
+ RIP: 0010:link_to_fixup_dir+0xd5/0xe0
+ RSP: 0018:ffffb5800180fa30 EFLAGS: 00010216
+ RAX: fffffffffffffffb RBX: 00000000fffffffb RCX: ffff8f595287faf0
+ RDX: ffffb5800180fa37 RSI: ffff8f5954978800 RDI: 0000000000000000
+ RBP: ffff8f5953af9450 R08: 0000000000000019 R09: 0000000000000001
+ R10: 000151f408682970 R11: 0000000120021001 R12: ffff8f5954978800
+ R13: ffff8f595287faf0 R14: ffff8f5953c77dd0 R15: 0000000000000065
+ FS: 00007fc5284c8c40(0000) GS:ffff8f59bbd00000(0000) knlGS:0000000000000000
+ CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ CR2: 00007fc5287f47c0 CR3: 000000011275e002 CR4: 0000000000370ee0
+ Call Trace:
+ replay_one_buffer+0x409/0x470
+ ? btree_read_extent_buffer_pages+0xd0/0x110
+ walk_up_log_tree+0x157/0x1e0
+ walk_log_tree+0xa6/0x1d0
+ btrfs_recover_log_trees+0x1da/0x360
+ ? replay_one_extent+0x7b0/0x7b0
+ open_ctree+0x1486/0x1720
+ btrfs_mount_root.cold+0x12/0xea
+ ? __kmalloc_track_caller+0x12f/0x240
+ legacy_get_tree+0x24/0x40
+ vfs_get_tree+0x22/0xb0
+ vfs_kern_mount.part.0+0x71/0xb0
+ btrfs_mount+0x10d/0x380
+ ? vfs_parse_fs_string+0x4d/0x90
+ legacy_get_tree+0x24/0x40
+ vfs_get_tree+0x22/0xb0
+ path_mount+0x433/0xa10
+ __x64_sys_mount+0xe3/0x120
+ do_syscall_64+0x3d/0x80
+ entry_SYSCALL_64_after_hwframe+0x44/0xae
+
+We can get -EIO or any number of legitimate errors from
+btrfs_search_slot(), panicing here is not the appropriate response. The
+error path for this code handles errors properly, simply return the
+error.
+
+Signed-off-by: Josef Bacik <josef@toxicpanda.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/tree-log.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
+index ee26ccd12da8..4cab553c347a 100644
+--- a/fs/btrfs/tree-log.c
++++ b/fs/btrfs/tree-log.c
+@@ -1582,8 +1582,6 @@ static noinline int link_to_fixup_dir(struct btrfs_trans_handle *trans,
+ ret = btrfs_update_inode(trans, root, inode);
+ } else if (ret == -EEXIST) {
+ ret = 0;
+- } else {
+- BUG(); /* Logic Error */
+ }
+ iput(inode);
+
+--
+2.30.2
+
--- /dev/null
+From c88d0d030021b1d2eaaccea9f4d489c597c709ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 May 2021 13:56:56 +0200
+Subject: char: hpet: add checks after calling ioremap
+
+From: Tom Seewald <tseewald@gmail.com>
+
+[ Upstream commit b11701c933112d49b808dee01cb7ff854ba6a77a ]
+
+The function hpet_resources() calls ioremap() two times, but in both
+cases it does not check if ioremap() returned a null pointer. Fix this
+by adding null pointer checks and returning an appropriate error.
+
+Signed-off-by: Tom Seewald <tseewald@gmail.com>
+Link: https://lore.kernel.org/r/20210503115736.2104747-30-gregkh@linuxfoundation.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/hpet.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/char/hpet.c b/drivers/char/hpet.c
+index 5b38d7a8202a..eb205f9173f4 100644
+--- a/drivers/char/hpet.c
++++ b/drivers/char/hpet.c
+@@ -976,6 +976,8 @@ static acpi_status hpet_resources(struct acpi_resource *res, void *data)
+ if (ACPI_SUCCESS(status)) {
+ hdp->hd_phys_address = addr.address.minimum;
+ hdp->hd_address = ioremap(addr.address.minimum, addr.address.address_length);
++ if (!hdp->hd_address)
++ return AE_ERROR;
+
+ if (hpet_is_known(hdp)) {
+ iounmap(hdp->hd_address);
+@@ -989,6 +991,8 @@ static acpi_status hpet_resources(struct acpi_resource *res, void *data)
+ hdp->hd_phys_address = fixmem32->address;
+ hdp->hd_address = ioremap(fixmem32->address,
+ HPET_RANGE_SIZE);
++ if (!hdp->hd_address)
++ return AE_ERROR;
+
+ if (hpet_is_known(hdp)) {
+ iounmap(hdp->hd_address);
+--
+2.30.2
+
--- /dev/null
+From b4ef130580e1c2713e0630523d0f1c6920fdaccf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 May 2021 10:56:07 +0800
+Subject: drm/amdgpu: Fix a use-after-free
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: xinhui pan <xinhui.pan@amd.com>
+
+[ Upstream commit 1e5c37385097c35911b0f8a0c67ffd10ee1af9a2 ]
+
+looks like we forget to set ttm->sg to NULL.
+Hit panic below
+
+[ 1235.844104] general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b7b4b: 0000 [#1] SMP DEBUG_PAGEALLOC NOPTI
+[ 1235.989074] Call Trace:
+[ 1235.991751] sg_free_table+0x17/0x20
+[ 1235.995667] amdgpu_ttm_backend_unbind.cold+0x4d/0xf7 [amdgpu]
+[ 1236.002288] amdgpu_ttm_backend_destroy+0x29/0x130 [amdgpu]
+[ 1236.008464] ttm_tt_destroy+0x1e/0x30 [ttm]
+[ 1236.013066] ttm_bo_cleanup_memtype_use+0x51/0xa0 [ttm]
+[ 1236.018783] ttm_bo_release+0x262/0xa50 [ttm]
+[ 1236.023547] ttm_bo_put+0x82/0xd0 [ttm]
+[ 1236.027766] amdgpu_bo_unref+0x26/0x50 [amdgpu]
+[ 1236.032809] amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu+0x7aa/0xd90 [amdgpu]
+[ 1236.040400] kfd_ioctl_alloc_memory_of_gpu+0xe2/0x330 [amdgpu]
+[ 1236.046912] kfd_ioctl+0x463/0x690 [amdgpu]
+
+Signed-off-by: xinhui pan <xinhui.pan@amd.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
+index 6beb3e76e1c9..014b87143837 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
+@@ -737,6 +737,7 @@ static void amdgpu_ttm_tt_unpopulate(struct ttm_tt *ttm)
+
+ if (gtt && gtt->userptr) {
+ kfree(ttm->sg);
++ ttm->sg = NULL;
+ ttm->page_flags &= ~TTM_PAGE_FLAG_SG;
+ return;
+ }
+--
+2.30.2
+
--- /dev/null
+From 013c9d232e871ad33f07c5452932af6330e06e4e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 May 2021 13:57:08 +0200
+Subject: isdn: mISDNinfineon: check/cleanup ioremap failure correctly in
+ setup_io
+
+From: Phillip Potter <phil@philpotter.co.uk>
+
+[ Upstream commit c446f0d4702d316e1c6bf621f70e79678d28830a ]
+
+Move hw->cfg.mode and hw->addr.mode assignments from hw->ci->cfg_mode
+and hw->ci->addr_mode respectively, to be before the subsequent checks
+for memory IO mode (and possible ioremap calls in this case).
+
+Also introduce ioremap error checks at both locations. This allows
+resources to be properly freed on ioremap failure, as when the caller
+of setup_io then subsequently calls release_io via its error path,
+release_io can now correctly determine the mode as it has been set
+before the ioremap call.
+
+Finally, refactor release_io function so that it will call
+release_mem_region in the memory IO case, regardless of whether or not
+hw->cfg.p/hw->addr.p are NULL. This means resources are then properly
+released on failure.
+
+This properly implements the original reverted commit (d721fe99f6ad)
+from the University of Minnesota, whilst also implementing the ioremap
+check for the hw->ci->cfg_mode if block as well.
+
+Cc: David S. Miller <davem@davemloft.net>
+Signed-off-by: Phillip Potter <phil@philpotter.co.uk>
+Link: https://lore.kernel.org/r/20210503115736.2104747-42-gregkh@linuxfoundation.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/isdn/hardware/mISDN/mISDNinfineon.c | 24 ++++++++++++++-------
+ 1 file changed, 16 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/isdn/hardware/mISDN/mISDNinfineon.c b/drivers/isdn/hardware/mISDN/mISDNinfineon.c
+index d5bdbaf93a1a..d0b6377b9834 100644
+--- a/drivers/isdn/hardware/mISDN/mISDNinfineon.c
++++ b/drivers/isdn/hardware/mISDN/mISDNinfineon.c
+@@ -645,17 +645,19 @@ static void
+ release_io(struct inf_hw *hw)
+ {
+ if (hw->cfg.mode) {
+- if (hw->cfg.p) {
++ if (hw->cfg.mode == AM_MEMIO) {
+ release_mem_region(hw->cfg.start, hw->cfg.size);
+- iounmap(hw->cfg.p);
++ if (hw->cfg.p)
++ iounmap(hw->cfg.p);
+ } else
+ release_region(hw->cfg.start, hw->cfg.size);
+ hw->cfg.mode = AM_NONE;
+ }
+ if (hw->addr.mode) {
+- if (hw->addr.p) {
++ if (hw->addr.mode == AM_MEMIO) {
+ release_mem_region(hw->addr.start, hw->addr.size);
+- iounmap(hw->addr.p);
++ if (hw->addr.p)
++ iounmap(hw->addr.p);
+ } else
+ release_region(hw->addr.start, hw->addr.size);
+ hw->addr.mode = AM_NONE;
+@@ -685,9 +687,12 @@ setup_io(struct inf_hw *hw)
+ (ulong)hw->cfg.start, (ulong)hw->cfg.size);
+ return err;
+ }
+- if (hw->ci->cfg_mode == AM_MEMIO)
+- hw->cfg.p = ioremap(hw->cfg.start, hw->cfg.size);
+ hw->cfg.mode = hw->ci->cfg_mode;
++ if (hw->ci->cfg_mode == AM_MEMIO) {
++ hw->cfg.p = ioremap(hw->cfg.start, hw->cfg.size);
++ if (!hw->cfg.p)
++ return -ENOMEM;
++ }
+ if (debug & DEBUG_HW)
+ pr_notice("%s: IO cfg %lx (%lu bytes) mode%d\n",
+ hw->name, (ulong)hw->cfg.start,
+@@ -712,9 +717,12 @@ setup_io(struct inf_hw *hw)
+ (ulong)hw->addr.start, (ulong)hw->addr.size);
+ return err;
+ }
+- if (hw->ci->addr_mode == AM_MEMIO)
+- hw->addr.p = ioremap(hw->addr.start, hw->addr.size);
+ hw->addr.mode = hw->ci->addr_mode;
++ if (hw->ci->addr_mode == AM_MEMIO) {
++ hw->addr.p = ioremap(hw->addr.start, hw->addr.size);
++ if (!hw->addr.p)
++ return -ENOMEM;
++ }
+ if (debug & DEBUG_HW)
+ pr_notice("%s: IO addr %lx (%lu bytes) mode%d\n",
+ hw->name, (ulong)hw->addr.start,
+--
+2.30.2
+
--- /dev/null
+From 256ac52b02bca2687c06eb52d14809d26f41f46d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 May 2021 13:57:20 +0200
+Subject: libertas: register sysfs groups properly
+
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+[ Upstream commit 7e79b38fe9a403b065ac5915465f620a8fb3de84 ]
+
+The libertas driver was trying to register sysfs groups "by hand" which
+causes them to be created _after_ the device is initialized and
+announced to userspace, which causes races and can prevent userspace
+tools from seeing the sysfs files correctly.
+
+Fix this up by using the built-in sysfs_groups pointers in struct
+net_device which were created for this very reason, fixing the race
+condition, and properly allowing for any error that might have occured
+to be handled properly.
+
+Cc: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210503115736.2104747-54-gregkh@linuxfoundation.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/libertas/mesh.c | 28 ++++------------------------
+ 1 file changed, 4 insertions(+), 24 deletions(-)
+
+diff --git a/drivers/net/wireless/libertas/mesh.c b/drivers/net/wireless/libertas/mesh.c
+index d0c881dd5846..f1e9cbcfdc16 100644
+--- a/drivers/net/wireless/libertas/mesh.c
++++ b/drivers/net/wireless/libertas/mesh.c
+@@ -797,19 +797,6 @@ static const struct attribute_group mesh_ie_group = {
+ .attrs = mesh_ie_attrs,
+ };
+
+-static void lbs_persist_config_init(struct net_device *dev)
+-{
+- int ret;
+- ret = sysfs_create_group(&(dev->dev.kobj), &boot_opts_group);
+- ret = sysfs_create_group(&(dev->dev.kobj), &mesh_ie_group);
+-}
+-
+-static void lbs_persist_config_remove(struct net_device *dev)
+-{
+- sysfs_remove_group(&(dev->dev.kobj), &boot_opts_group);
+- sysfs_remove_group(&(dev->dev.kobj), &mesh_ie_group);
+-}
+-
+
+ /***************************************************************************
+ * Initializing and starting, stopping mesh
+@@ -1021,6 +1008,10 @@ static int lbs_add_mesh(struct lbs_private *priv)
+ SET_NETDEV_DEV(priv->mesh_dev, priv->dev->dev.parent);
+
+ mesh_dev->flags |= IFF_BROADCAST | IFF_MULTICAST;
++ mesh_dev->sysfs_groups[0] = &lbs_mesh_attr_group;
++ mesh_dev->sysfs_groups[1] = &boot_opts_group;
++ mesh_dev->sysfs_groups[2] = &mesh_ie_group;
++
+ /* Register virtual mesh interface */
+ ret = register_netdev(mesh_dev);
+ if (ret) {
+@@ -1028,19 +1019,10 @@ static int lbs_add_mesh(struct lbs_private *priv)
+ goto err_free_netdev;
+ }
+
+- ret = sysfs_create_group(&(mesh_dev->dev.kobj), &lbs_mesh_attr_group);
+- if (ret)
+- goto err_unregister;
+-
+- lbs_persist_config_init(mesh_dev);
+-
+ /* Everything successful */
+ ret = 0;
+ goto done;
+
+-err_unregister:
+- unregister_netdev(mesh_dev);
+-
+ err_free_netdev:
+ free_netdev(mesh_dev);
+
+@@ -1063,8 +1045,6 @@ void lbs_remove_mesh(struct lbs_private *priv)
+ lbs_deb_enter(LBS_DEB_MESH);
+ netif_stop_queue(mesh_dev);
+ netif_carrier_off(mesh_dev);
+- sysfs_remove_group(&(mesh_dev->dev.kobj), &lbs_mesh_attr_group);
+- lbs_persist_config_remove(mesh_dev);
+ unregister_netdev(mesh_dev);
+ priv->mesh_dev = NULL;
+ kfree(mesh_dev->ieee80211_ptr);
+--
+2.30.2
+
--- /dev/null
+From d9736f80e8243e9c4cbe48d87af5bd4749ca251c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 May 2021 13:57:26 +0200
+Subject: media: dvb: Add check on sp8870_readreg return
+
+From: Alaa Emad <alaaemadhossney.ae@gmail.com>
+
+[ Upstream commit c6d822c56e7fd29e6fa1b1bb91b98f6a1e942b3c ]
+
+The function sp8870_readreg returns a negative value when i2c_transfer
+fails so properly check for this and return the error if it happens.
+
+Cc: Sean Young <sean@mess.org>
+Cc: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Alaa Emad <alaaemadhossney.ae@gmail.com>
+Link: https://lore.kernel.org/r/20210503115736.2104747-60-gregkh@linuxfoundation.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/dvb-frontends/sp8870.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/dvb-frontends/sp8870.c b/drivers/media/dvb-frontends/sp8870.c
+index e87ac30d7fb8..b43135c5a960 100644
+--- a/drivers/media/dvb-frontends/sp8870.c
++++ b/drivers/media/dvb-frontends/sp8870.c
+@@ -293,7 +293,9 @@ static int sp8870_set_frontend_parameters(struct dvb_frontend *fe)
+ sp8870_writereg(state, 0xc05, reg0xc05);
+
+ // read status reg in order to clear pending irqs
+- sp8870_readreg(state, 0x200);
++ err = sp8870_readreg(state, 0x200);
++ if (err < 0)
++ return err;
+
+ // system controller start
+ sp8870_microcontroller_start(state);
+--
+2.30.2
+
--- /dev/null
+From 2e88e9fb46605400a624ba9e4a65982d5b0e861d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 May 2021 13:57:28 +0200
+Subject: media: gspca: mt9m111: Check write_bridge for timeout
+
+From: Alaa Emad <alaaemadhossney.ae@gmail.com>
+
+[ Upstream commit 656025850074f5c1ba2e05be37bda57ba2b8d491 ]
+
+In mt9m111_probe, m5602_write_bridge can timeout and return a negative
+error value. The fix checks for this error and passes it upstream.
+
+Signed-off-by: Aditya Pakki <pakki001@umn.edu>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/gspca/m5602/m5602_mt9m111.c | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/media/usb/gspca/m5602/m5602_mt9m111.c b/drivers/media/usb/gspca/m5602/m5602_mt9m111.c
+index 27fcef11aef4..67bb207f4eb2 100644
+--- a/drivers/media/usb/gspca/m5602/m5602_mt9m111.c
++++ b/drivers/media/usb/gspca/m5602/m5602_mt9m111.c
+@@ -55,7 +55,7 @@ static const struct v4l2_ctrl_config mt9m111_greenbal_cfg = {
+ int mt9m111_probe(struct sd *sd)
+ {
+ u8 data[2] = {0x00, 0x00};
+- int i;
++ int i, err;
+ struct gspca_dev *gspca_dev = (struct gspca_dev *)sd;
+
+ if (force_sensor) {
+@@ -73,15 +73,17 @@ int mt9m111_probe(struct sd *sd)
+ /* Do the preinit */
+ for (i = 0; i < ARRAY_SIZE(preinit_mt9m111); i++) {
+ if (preinit_mt9m111[i][0] == BRIDGE) {
+- m5602_write_bridge(sd,
+- preinit_mt9m111[i][1],
+- preinit_mt9m111[i][2]);
++ err = m5602_write_bridge(sd,
++ preinit_mt9m111[i][1],
++ preinit_mt9m111[i][2]);
+ } else {
+ data[0] = preinit_mt9m111[i][2];
+ data[1] = preinit_mt9m111[i][3];
+- m5602_write_sensor(sd,
+- preinit_mt9m111[i][1], data, 2);
++ err = m5602_write_sensor(sd,
++ preinit_mt9m111[i][1], data, 2);
+ }
++ if (err < 0)
++ return err;
+ }
+
+ if (m5602_read_sensor(sd, MT9M111_SC_CHIPVER, data, 2))
+--
+2.30.2
+
--- /dev/null
+From a94b1eb577160ed06e55c79f28790ecccf37e332 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 May 2021 13:57:30 +0200
+Subject: media: gspca: properly check for errors in po1030_probe()
+
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+[ Upstream commit dacb408ca6f0e34df22b40d8dd5fae7f8e777d84 ]
+
+If m5602_write_sensor() or m5602_write_bridge() fail, do not continue to
+initialize the device but return the error to the calling funtion.
+
+Cc: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Link: https://lore.kernel.org/r/20210503115736.2104747-64-gregkh@linuxfoundation.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/gspca/m5602/m5602_po1030.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/media/usb/gspca/m5602/m5602_po1030.c b/drivers/media/usb/gspca/m5602/m5602_po1030.c
+index 4bf5c43424b7..971253dafb57 100644
+--- a/drivers/media/usb/gspca/m5602/m5602_po1030.c
++++ b/drivers/media/usb/gspca/m5602/m5602_po1030.c
+@@ -55,6 +55,7 @@ static const struct v4l2_ctrl_config po1030_greenbal_cfg = {
+ int po1030_probe(struct sd *sd)
+ {
+ u8 dev_id_h = 0, i;
++ int err;
+ struct gspca_dev *gspca_dev = (struct gspca_dev *)sd;
+
+ if (force_sensor) {
+@@ -73,10 +74,13 @@ int po1030_probe(struct sd *sd)
+ for (i = 0; i < ARRAY_SIZE(preinit_po1030); i++) {
+ u8 data = preinit_po1030[i][2];
+ if (preinit_po1030[i][0] == SENSOR)
+- m5602_write_sensor(sd,
+- preinit_po1030[i][1], &data, 1);
++ err = m5602_write_sensor(sd, preinit_po1030[i][1],
++ &data, 1);
+ else
+- m5602_write_bridge(sd, preinit_po1030[i][1], data);
++ err = m5602_write_bridge(sd, preinit_po1030[i][1],
++ data);
++ if (err < 0)
++ return err;
+ }
+
+ if (m5602_read_sensor(sd, PO1030_DEVID_H, &dev_id_h, 1))
+--
+2.30.2
+
--- /dev/null
+From 2352a462af038ae96527c0b62a82bc6ec0910901 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 May 2021 13:56:46 +0200
+Subject: net: caif: remove BUG_ON(dev == NULL) in caif_xmit
+
+From: Du Cheng <ducheng2@gmail.com>
+
+[ Upstream commit 65a67792e3416f7c5d7daa47d99334cbb19a7449 ]
+
+The condition of dev == NULL is impossible in caif_xmit(), hence it is
+for the removal.
+
+Explanation:
+The static caif_xmit() is only called upon via a function pointer
+`ndo_start_xmit` defined in include/linux/netdevice.h:
+```
+struct net_device_ops {
+ ...
+ netdev_tx_t (*ndo_start_xmit)(struct sk_buff *skb, struct net_device *dev);
+ ...
+}
+```
+
+The exhausive list of call points are:
+```
+drivers/net/ethernet/qualcomm/rmnet/rmnet_map_command.c
+ dev->netdev_ops->ndo_start_xmit(skb, dev);
+ ^ ^
+
+drivers/infiniband/ulp/opa_vnic/opa_vnic_netdev.c
+ struct opa_vnic_adapter *adapter = opa_vnic_priv(netdev);
+ ^ ^
+ return adapter->rn_ops->ndo_start_xmit(skb, netdev); // adapter would crash first
+ ^ ^
+
+drivers/usb/gadget/function/f_ncm.c
+ ncm->netdev->netdev_ops->ndo_start_xmit(NULL, ncm->netdev);
+ ^ ^
+
+include/linux/netdevice.h
+static inline netdev_tx_t __netdev_start_xmit(...
+{
+ return ops->ndo_start_xmit(skb, dev);
+ ^
+}
+
+ const struct net_device_ops *ops = dev->netdev_ops;
+ ^
+ rc = __netdev_start_xmit(ops, skb, dev, more);
+ ^
+```
+
+In each of the enumerated scenarios, it is impossible for the NULL-valued dev to
+reach the caif_xmit() without crashing the kernel earlier, therefore `BUG_ON(dev ==
+NULL)` is rather useless, hence the removal.
+
+Cc: David S. Miller <davem@davemloft.net>
+Signed-off-by: Du Cheng <ducheng2@gmail.com>
+Link: https://lore.kernel.org/r/20210503115736.2104747-20-gregkh@linuxfoundation.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/caif/caif_serial.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/net/caif/caif_serial.c b/drivers/net/caif/caif_serial.c
+index c2dea4916e5d..32834dad0b83 100644
+--- a/drivers/net/caif/caif_serial.c
++++ b/drivers/net/caif/caif_serial.c
+@@ -281,7 +281,6 @@ static int caif_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct ser_device *ser;
+
+- BUG_ON(dev == NULL);
+ ser = netdev_priv(dev);
+
+ /* Send flow off once, on high water mark */
+--
+2.30.2
+
--- /dev/null
+From aafeab6c3ae8ed6818e6089c17b90fa2448ebf27 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 May 2021 13:56:42 +0200
+Subject: net: fujitsu: fix potential null-ptr-deref
+
+From: Anirudh Rayabharam <mail@anirudhrb.com>
+
+[ Upstream commit 52202be1cd996cde6e8969a128dc27ee45a7cb5e ]
+
+In fmvj18x_get_hwinfo(), if ioremap fails there will be NULL pointer
+deref. To fix this, check the return value of ioremap and return -1
+to the caller in case of failure.
+
+Cc: "David S. Miller" <davem@davemloft.net>
+Acked-by: Dominik Brodowski <linux@dominikbrodowski.net>
+Signed-off-by: Anirudh Rayabharam <mail@anirudhrb.com>
+Link: https://lore.kernel.org/r/20210503115736.2104747-16-gregkh@linuxfoundation.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/fujitsu/fmvj18x_cs.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/net/ethernet/fujitsu/fmvj18x_cs.c b/drivers/net/ethernet/fujitsu/fmvj18x_cs.c
+index a7139f588ad2..fb1a9bd24660 100644
+--- a/drivers/net/ethernet/fujitsu/fmvj18x_cs.c
++++ b/drivers/net/ethernet/fujitsu/fmvj18x_cs.c
+@@ -548,6 +548,11 @@ static int fmvj18x_get_hwinfo(struct pcmcia_device *link, u_char *node_id)
+ return -1;
+
+ base = ioremap(link->resource[2]->start, resource_size(link->resource[2]));
++ if (!base) {
++ pcmcia_release_window(link, link->resource[2]);
++ return -1;
++ }
++
+ pcmcia_map_mem_page(link, link->resource[2], 0);
+
+ /*
+--
+2.30.2
+
--- /dev/null
+From af538ed1a950966c0c48eb4d04a8a17be93189d9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Apr 2021 14:45:43 +0200
+Subject: openrisc: Define memory barrier mb
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+[ Upstream commit 8b549c18ae81dbc36fb11e4aa08b8378c599ca95 ]
+
+This came up in the discussion of the requirements of qspinlock on an
+architecture. OpenRISC uses qspinlock, but it was noticed that the
+memmory barrier was not defined.
+
+Peter defined it in the mail thread writing:
+
+ As near as I can tell this should do. The arch spec only lists
+ this one instruction and the text makes it sound like a completion
+ barrier.
+
+This is correct so applying this patch.
+
+Signed-off-by: Peter Zijlstra <peterz@infradead.org>
+[shorne@gmail.com:Turned the mail into a patch]
+Signed-off-by: Stafford Horne <shorne@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/openrisc/include/asm/barrier.h | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+ create mode 100644 arch/openrisc/include/asm/barrier.h
+
+diff --git a/arch/openrisc/include/asm/barrier.h b/arch/openrisc/include/asm/barrier.h
+new file mode 100644
+index 000000000000..7538294721be
+--- /dev/null
++++ b/arch/openrisc/include/asm/barrier.h
+@@ -0,0 +1,9 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++#ifndef __ASM_BARRIER_H
++#define __ASM_BARRIER_H
++
++#define mb() asm volatile ("l.msync" ::: "memory")
++
++#include <asm-generic/barrier.h>
++
++#endif /* __ASM_BARRIER_H */
+--
+2.30.2
+
--- /dev/null
+From cc014e2a223f9476e12d2c41a6d2f58b13e4840b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Apr 2021 14:07:35 +0800
+Subject: platform/x86: hp_accel: Avoid invoking _INI to speed up resume
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Kai-Heng Feng <kai.heng.feng@canonical.com>
+
+[ Upstream commit 79d341e26ebcdbc622348aaaab6f8f89b6fdb25f ]
+
+hp_accel can take almost two seconds to resume on some HP laptops.
+
+The bottleneck is on evaluating _INI, which is only needed to run once.
+
+Resolve the issue by only invoking _INI when it's necessary. Namely, on
+probe and on hibernation restore.
+
+Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Acked-by: Éric Piel <eric.piel@trempplin-utc.net>
+Link: https://lore.kernel.org/r/20210430060736.590321-1-kai.heng.feng@canonical.com
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/lis3lv02d/lis3lv02d.h | 1 +
+ drivers/platform/x86/hp_accel.c | 22 +++++++++++++++++++++-
+ 2 files changed, 22 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/misc/lis3lv02d/lis3lv02d.h b/drivers/misc/lis3lv02d/lis3lv02d.h
+index c439c827eea8..0ef759671b54 100644
+--- a/drivers/misc/lis3lv02d/lis3lv02d.h
++++ b/drivers/misc/lis3lv02d/lis3lv02d.h
+@@ -284,6 +284,7 @@ struct lis3lv02d {
+ int regs_size;
+ u8 *reg_cache;
+ bool regs_stored;
++ bool init_required;
+ u8 odr_mask; /* ODR bit mask */
+ u8 whoami; /* indicates measurement precision */
+ s16 (*read_data) (struct lis3lv02d *lis3, int reg);
+diff --git a/drivers/platform/x86/hp_accel.c b/drivers/platform/x86/hp_accel.c
+index 10ce6cba4455..a06262e91a93 100644
+--- a/drivers/platform/x86/hp_accel.c
++++ b/drivers/platform/x86/hp_accel.c
+@@ -101,6 +101,9 @@ MODULE_DEVICE_TABLE(acpi, lis3lv02d_device_ids);
+ static int lis3lv02d_acpi_init(struct lis3lv02d *lis3)
+ {
+ struct acpi_device *dev = lis3->bus_priv;
++ if (!lis3->init_required)
++ return 0;
++
+ if (acpi_evaluate_object(dev->handle, METHOD_NAME__INI,
+ NULL, NULL) != AE_OK)
+ return -EINVAL;
+@@ -361,6 +364,7 @@ static int lis3lv02d_add(struct acpi_device *device)
+ }
+
+ /* call the core layer do its init */
++ lis3_dev.init_required = true;
+ ret = lis3lv02d_init_device(&lis3_dev);
+ if (ret)
+ return ret;
+@@ -408,11 +412,27 @@ static int lis3lv02d_suspend(struct device *dev)
+
+ static int lis3lv02d_resume(struct device *dev)
+ {
++ lis3_dev.init_required = false;
++ lis3lv02d_poweron(&lis3_dev);
++ return 0;
++}
++
++static int lis3lv02d_restore(struct device *dev)
++{
++ lis3_dev.init_required = true;
+ lis3lv02d_poweron(&lis3_dev);
+ return 0;
+ }
+
+-static SIMPLE_DEV_PM_OPS(hp_accel_pm, lis3lv02d_suspend, lis3lv02d_resume);
++static const struct dev_pm_ops hp_accel_pm = {
++ .suspend = lis3lv02d_suspend,
++ .resume = lis3lv02d_resume,
++ .freeze = lis3lv02d_suspend,
++ .thaw = lis3lv02d_resume,
++ .poweroff = lis3lv02d_suspend,
++ .restore = lis3lv02d_restore,
++};
++
+ #define HP_ACCEL_PM (&hp_accel_pm)
+ #else
+ #define HP_ACCEL_PM NULL
+--
+2.30.2
+
--- /dev/null
+From 49fbb3ad74d4c2b3264a04900d3c68df4549ee6b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 May 2021 03:04:37 +0000
+Subject: scsi: BusLogic: Fix 64-bit system enumeration error for Buslogic
+
+From: Matt Wang <wwentao@vmware.com>
+
+[ Upstream commit 56f396146af278135c0ff958c79b5ee1bd22453d ]
+
+Commit 391e2f25601e ("[SCSI] BusLogic: Port driver to 64-bit")
+introduced a serious issue for 64-bit systems. With this commit,
+64-bit kernel will enumerate 8*15 non-existing disks. This is caused
+by the broken CCB structure. The change from u32 data to void *data
+increased CCB length on 64-bit system, which introduced an extra 4
+byte offset of the CDB. This leads to incorrect response to INQUIRY
+commands during enumeration.
+
+Fix disk enumeration failure by reverting the portion of the commit
+above which switched the data pointer from u32 to void.
+
+Link: https://lore.kernel.org/r/C325637F-1166-4340-8F0F-3BCCD59D4D54@vmware.com
+Acked-by: Khalid Aziz <khalid@gonehiking.org>
+Signed-off-by: Matt Wang <wwentao@vmware.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/BusLogic.c | 6 +++---
+ drivers/scsi/BusLogic.h | 2 +-
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/scsi/BusLogic.c b/drivers/scsi/BusLogic.c
+index c7be7bb37209..b9b4491d732a 100644
+--- a/drivers/scsi/BusLogic.c
++++ b/drivers/scsi/BusLogic.c
+@@ -3081,11 +3081,11 @@ static int blogic_qcmd_lck(struct scsi_cmnd *command,
+ ccb->opcode = BLOGIC_INITIATOR_CCB_SG;
+ ccb->datalen = count * sizeof(struct blogic_sg_seg);
+ if (blogic_multimaster_type(adapter))
+- ccb->data = (void *)((unsigned int) ccb->dma_handle +
++ ccb->data = (unsigned int) ccb->dma_handle +
+ ((unsigned long) &ccb->sglist -
+- (unsigned long) ccb));
++ (unsigned long) ccb);
+ else
+- ccb->data = ccb->sglist;
++ ccb->data = virt_to_32bit_virt(ccb->sglist);
+
+ scsi_for_each_sg(command, sg, count, i) {
+ ccb->sglist[i].segbytes = sg_dma_len(sg);
+diff --git a/drivers/scsi/BusLogic.h b/drivers/scsi/BusLogic.h
+index b53ec2f1e8cd..5c950a7a1b1c 100644
+--- a/drivers/scsi/BusLogic.h
++++ b/drivers/scsi/BusLogic.h
+@@ -821,7 +821,7 @@ struct blogic_ccb {
+ unsigned char cdblen; /* Byte 2 */
+ unsigned char sense_datalen; /* Byte 3 */
+ u32 datalen; /* Bytes 4-7 */
+- void *data; /* Bytes 8-11 */
++ u32 data; /* Bytes 8-11 */
+ unsigned char:8; /* Byte 12 */
+ unsigned char:8; /* Byte 13 */
+ enum blogic_adapter_status adapter_status; /* Byte 14 */
+--
+2.30.2
+
tipc-skb_linearize-the-head-skb-when-reassembling-msgs.patch
i2c-s3c2410-fix-possible-null-pointer-deref-on-read-message-after-write.patch
i2c-i801-don-t-generate-an-interrupt-on-bus-reset.patch
+platform-x86-hp_accel-avoid-invoking-_ini-to-speed-u.patch
+net-fujitsu-fix-potential-null-ptr-deref.patch
+net-caif-remove-bug_on-dev-null-in-caif_xmit.patch
+char-hpet-add-checks-after-calling-ioremap.patch
+alsa-sb8-add-a-comment-note-regarding-an-unused-poin.patch
+isdn-misdninfineon-check-cleanup-ioremap-failure-cor.patch
+ath6kl-return-error-code-in-ath6kl_wmi_set_roam_lrss.patch
+libertas-register-sysfs-groups-properly.patch
+media-dvb-add-check-on-sp8870_readreg-return.patch
+media-gspca-mt9m111-check-write_bridge-for-timeout.patch
+media-gspca-properly-check-for-errors-in-po1030_prob.patch
+scsi-buslogic-fix-64-bit-system-enumeration-error-fo.patch
+openrisc-define-memory-barrier-mb.patch
+btrfs-do-not-bug_on-in-link_to_fixup_dir.patch
+drm-amdgpu-fix-a-use-after-free.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
