--- /dev/null
+From b410a9307bc3a7cdee3c930c98f6fc9cf1d2c484 Mon Sep 17 00:00:00 2001
+From: Sean Nyekjaer <sean@geanix.com>
+Date: Mon, 5 Jun 2023 12:32:22 +0200
+Subject: iio: accel: fxls8962af: errata bug only applicable for FXLS8962AF
+
+From: Sean Nyekjaer <sean@geanix.com>
+
+commit b410a9307bc3a7cdee3c930c98f6fc9cf1d2c484 upstream.
+
+Remove special errata handling if FXLS8964AF is used.
+
+Fixes: af959b7b96b8 ("iio: accel: fxls8962af: fix errata bug E3 - I2C burst reads")
+Signed-off-by: Sean Nyekjaer <sean@geanix.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20230605103223.1400980-2-sean@geanix.com
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/accel/fxls8962af-core.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/iio/accel/fxls8962af-core.c
++++ b/drivers/iio/accel/fxls8962af-core.c
+@@ -656,9 +656,10 @@ static int fxls8962af_fifo_transfer(stru
+ int total_length = samples * sample_length;
+ int ret;
+
+- if (i2c_verify_client(dev))
++ if (i2c_verify_client(dev) &&
++ data->chip_info->chip_id == FXLS8962AF_DEVICE_ID)
+ /*
+- * Due to errata bug:
++ * Due to errata bug (only applicable on fxls8962af):
+ * E3: FIFO burst read operation error using I2C interface
+ * We have to avoid burst reads on I2C..
+ */
--- /dev/null
+From d1cfbd52ede5e5fabc09992894c5733b4057f159 Mon Sep 17 00:00:00 2001
+From: Sean Nyekjaer <sean@geanix.com>
+Date: Mon, 5 Jun 2023 12:32:21 +0200
+Subject: iio: accel: fxls8962af: fixup buffer scan element type
+
+From: Sean Nyekjaer <sean@geanix.com>
+
+commit d1cfbd52ede5e5fabc09992894c5733b4057f159 upstream.
+
+Scan elements for x,y,z channels is little endian and requires no bit shifts.
+LE vs. BE is controlled in register SENS_CONFIG2 and bit LE_BE, default
+value is LE.
+
+Fixes: a3e0b51884ee ("iio: accel: add support for FXLS8962AF/FXLS8964AF accelerometers")
+Signed-off-by: Sean Nyekjaer <sean@geanix.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20230605103223.1400980-1-sean@geanix.com
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/accel/fxls8962af-core.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/iio/accel/fxls8962af-core.c
++++ b/drivers/iio/accel/fxls8962af-core.c
+@@ -486,8 +486,7 @@ static int fxls8962af_set_watermark(stru
+ .sign = 's', \
+ .realbits = 12, \
+ .storagebits = 16, \
+- .shift = 4, \
+- .endianness = IIO_BE, \
++ .endianness = IIO_LE, \
+ }, \
+ }
+
--- /dev/null
+From f7d9e21dd274b97dc0a8dbc136a2ea8506063a96 Mon Sep 17 00:00:00 2001
+From: Fabrizio Lamarque <fl.scratchpad@gmail.com>
+Date: Tue, 30 May 2023 09:53:08 +0200
+Subject: iio: adc: ad7192: Fix internal/external clock selection
+
+From: Fabrizio Lamarque <fl.scratchpad@gmail.com>
+
+commit f7d9e21dd274b97dc0a8dbc136a2ea8506063a96 upstream.
+
+Fix wrong selection of internal clock when mclk is defined.
+
+Resolve a logical inversion introduced in c9ec2cb328e3.
+
+Fixes: c9ec2cb328e3 ("iio: adc: ad7192: use devm_clk_get_optional() for mclk")
+Signed-off-by: Fabrizio Lamarque <fl.scratchpad@gmail.com>
+Reviewed-by: Nuno Sa <nuno.sa@analog.com>
+Cc: <Stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20230530075311.400686-3-fl.scratchpad@gmail.com
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/adc/ad7192.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/iio/adc/ad7192.c
++++ b/drivers/iio/adc/ad7192.c
+@@ -327,7 +327,7 @@ static int ad7192_of_clock_select(struct
+ clock_sel = AD7192_CLK_INT;
+
+ /* use internal clock */
+- if (st->mclk) {
++ if (!st->mclk) {
+ if (of_property_read_bool(np, "adi,int-clock-output-enable"))
+ clock_sel = AD7192_CLK_INT_CO;
+ } else {
--- /dev/null
+From 9e58e3a6f8e1c483c86a04903b7b7aa0923e4426 Mon Sep 17 00:00:00 2001
+From: Fabrizio Lamarque <fl.scratchpad@gmail.com>
+Date: Tue, 30 May 2023 09:53:07 +0200
+Subject: iio: adc: ad7192: Fix null ad7192_state pointer access
+
+From: Fabrizio Lamarque <fl.scratchpad@gmail.com>
+
+commit 9e58e3a6f8e1c483c86a04903b7b7aa0923e4426 upstream.
+
+Pointer to indio_dev structure is obtained via spi_get_drvdata() at
+the beginning of function ad7192_setup(), but the spi->dev->driver_data
+member is not initialized, hence a NULL pointer is returned.
+
+Fix by changing ad7192_setup() signature to take pointer to struct
+iio_dev, and get ad7192_state pointer via st = iio_priv(indio_dev);
+
+Fixes: bd5dcdeb3fd0 ("iio: adc: ad7192: convert to device-managed functions")
+Signed-off-by: Fabrizio Lamarque <fl.scratchpad@gmail.com>
+Reviewed-by: Nuno Sa <nuno.sa@analog.com>
+Cc: <Stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20230530075311.400686-2-fl.scratchpad@gmail.com
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/adc/ad7192.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/iio/adc/ad7192.c
++++ b/drivers/iio/adc/ad7192.c
+@@ -340,9 +340,9 @@ static int ad7192_of_clock_select(struct
+ return clock_sel;
+ }
+
+-static int ad7192_setup(struct ad7192_state *st, struct device_node *np)
++static int ad7192_setup(struct iio_dev *indio_dev, struct device_node *np)
+ {
+- struct iio_dev *indio_dev = spi_get_drvdata(st->sd.spi);
++ struct ad7192_state *st = iio_priv(indio_dev);
+ bool rej60_en, refin2_en;
+ bool buf_en, bipolar, burnout_curr_en;
+ unsigned long long scale_uv;
+@@ -1015,7 +1015,7 @@ static int ad7192_probe(struct spi_devic
+ }
+ }
+
+- ret = ad7192_setup(st, spi->dev.of_node);
++ ret = ad7192_setup(indio_dev, spi->dev.of_node);
+ if (ret)
+ return ret;
+
--- /dev/null
+From dc27db64bb7d431a853e5dcc5da01718b58bdd29 Mon Sep 17 00:00:00 2001
+From: Jens Axboe <axboe@kernel.dk>
+Date: Tue, 11 Jul 2023 09:35:30 -0600
+Subject: io_uring: ensure IOPOLL locks around deferred work
+
+From: Jens Axboe <axboe@kernel.dk>
+
+No direct upstream commit exists for this issue. It was fixed in
+5.18 as part of a larger rework of the completion side.
+
+io_commit_cqring() writes the CQ ring tail to make it visible, but it
+also kicks off any deferred work we have. A ring setup with IOPOLL
+does not need any locking around the CQ ring updates, as we're always
+under the ctx uring_lock. But if we have deferred work that needs
+processing, then io_queue_deferred() assumes that the completion_lock
+is held, as it is for !IOPOLL.
+
+Add a lockdep assertion to check and document this fact, and have
+io_iopoll_complete() check if we have deferred work and run that
+separately with the appropriate lock grabbed.
+
+Cc: stable@vger.kernel.org # 5.10, 5.15
+Reported-by: dghost david <daviduniverse18@gmail.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ io_uring/io_uring.c | 25 +++++++++++++++++++++----
+ 1 file changed, 21 insertions(+), 4 deletions(-)
+
+--- a/io_uring/io_uring.c
++++ b/io_uring/io_uring.c
+@@ -1524,6 +1524,8 @@ static void io_kill_timeout(struct io_ki
+
+ static void io_queue_deferred(struct io_ring_ctx *ctx)
+ {
++ lockdep_assert_held(&ctx->completion_lock);
++
+ while (!list_empty(&ctx->defer_list)) {
+ struct io_defer_entry *de = list_first_entry(&ctx->defer_list,
+ struct io_defer_entry, list);
+@@ -1575,14 +1577,24 @@ static void __io_commit_cqring_flush(str
+ io_queue_deferred(ctx);
+ }
+
+-static inline void io_commit_cqring(struct io_ring_ctx *ctx)
++static inline bool io_commit_needs_flush(struct io_ring_ctx *ctx)
++{
++ return ctx->off_timeout_used || ctx->drain_active;
++}
++
++static inline void __io_commit_cqring(struct io_ring_ctx *ctx)
+ {
+- if (unlikely(ctx->off_timeout_used || ctx->drain_active))
+- __io_commit_cqring_flush(ctx);
+ /* order cqe stores with ring update */
+ smp_store_release(&ctx->rings->cq.tail, ctx->cached_cq_tail);
+ }
+
++static inline void io_commit_cqring(struct io_ring_ctx *ctx)
++{
++ if (unlikely(io_commit_needs_flush(ctx)))
++ __io_commit_cqring_flush(ctx);
++ __io_commit_cqring(ctx);
++}
++
+ static inline bool io_sqring_full(struct io_ring_ctx *ctx)
+ {
+ struct io_rings *r = ctx->rings;
+@@ -2521,7 +2533,12 @@ static void io_iopoll_complete(struct io
+ io_req_free_batch(&rb, req, &ctx->submit_state);
+ }
+
+- io_commit_cqring(ctx);
++ if (io_commit_needs_flush(ctx)) {
++ spin_lock(&ctx->completion_lock);
++ __io_commit_cqring_flush(ctx);
++ spin_unlock(&ctx->completion_lock);
++ }
++ __io_commit_cqring(ctx);
+ io_cqring_ev_posted_iopoll(ctx);
+ io_req_free_batch_finish(ctx, &rb);
+ }
--- /dev/null
+From c0c2fcb1325d0d4f3b322b5ee49385f8eca2560d Mon Sep 17 00:00:00 2001
+From: EJ Hsu <ejh@nvidia.com>
+Date: Fri, 9 Jun 2023 14:29:32 +0800
+Subject: phy: tegra: xusb: Clear the driver reference in usb-phy dev
+
+From: EJ Hsu <ejh@nvidia.com>
+
+commit c0c2fcb1325d0d4f3b322b5ee49385f8eca2560d upstream.
+
+For the dual-role port, it will assign the phy dev to usb-phy dev and
+use the port dev driver as the dev driver of usb-phy.
+
+When we try to destroy the port dev, it will destroy its dev driver
+as well. But we did not remove the reference from usb-phy dev. This
+might cause the use-after-free issue in KASAN.
+
+Fixes: e8f7d2f409a1 ("phy: tegra: xusb: Add usb-phy support")
+Cc: stable@vger.kernel.org
+
+Signed-off-by: EJ Hsu <ejh@nvidia.com>
+Signed-off-by: Haotien Hsu <haotienh@nvidia.com>
+Acked-by: Thierry Reding <treding@nvidia.com>
+Acked-by: Jon Hunter <jonathanh@nvidia.com>
+Link: https://lore.kernel.org/r/20230609062932.3276509-1-haotienh@nvidia.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/phy/tegra/xusb.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/phy/tegra/xusb.c
++++ b/drivers/phy/tegra/xusb.c
+@@ -562,6 +562,7 @@ static void tegra_xusb_port_unregister(s
+ usb_role_switch_unregister(port->usb_role_sw);
+ cancel_work_sync(&port->usb_phy_work);
+ usb_remove_phy(&port->usb_phy);
++ port->usb_phy.dev->driver = NULL;
+ }
+
+ if (port->ops->remove)
ksmbd-avoid-field-overflow-warning.patch
acpi-utils-fix-acpi_evaluate_dsm_typed-redefinition-.patch
bootmem-remove-the-vmemmap-pages-from-kmemleak-in-free_bootmem_page.patch
+io_uring-ensure-iopoll-locks-around-deferred-work.patch
+usb-serial-option-add-lara-r6-01b-pids.patch
+usb-dwc3-gadget-propagate-core-init-errors-to-udc-during-pullup.patch
+phy-tegra-xusb-clear-the-driver-reference-in-usb-phy-dev.patch
+iio-adc-ad7192-fix-null-ad7192_state-pointer-access.patch
+iio-adc-ad7192-fix-internal-external-clock-selection.patch
+iio-accel-fxls8962af-errata-bug-only-applicable-for-fxls8962af.patch
+iio-accel-fxls8962af-fixup-buffer-scan-element-type.patch
--- /dev/null
+From c0aabed9cabe057309779a9e26fe86a113d24dad Mon Sep 17 00:00:00 2001
+From: Krishna Kurapati <quic_kriskura@quicinc.com>
+Date: Sun, 18 Jun 2023 17:39:49 +0530
+Subject: usb: dwc3: gadget: Propagate core init errors to UDC during pullup
+
+From: Krishna Kurapati <quic_kriskura@quicinc.com>
+
+commit c0aabed9cabe057309779a9e26fe86a113d24dad upstream.
+
+In scenarios where pullup relies on resume (get sync) to initialize
+the controller and set the run stop bit, then core_init is followed by
+gadget_resume which will eventually set run stop bit.
+
+But in cases where the core_init fails, the return value is not sent
+back to udc appropriately. So according to UDC the controller has
+started but in reality we never set the run stop bit.
+
+On systems like Android, there are uevents sent to HAL depending on
+whether the configfs_bind / configfs_disconnect were invoked. In the
+above mentioned scnenario, if the core init fails, the run stop won't
+be set and the cable plug-out won't result in generation of any
+disconnect event and userspace would never get any uevent regarding
+cable plug out and we never call pullup(0) again. Furthermore none of
+the next Plug-In/Plug-Out's would be known to configfs.
+
+Return back the appropriate result to UDC to let the userspace/
+configfs know that the pullup failed so they can take appropriate
+action.
+
+Fixes: 77adb8bdf422 ("usb: dwc3: gadget: Allow runtime suspend if UDC unbinded")
+Cc: stable <stable@kernel.org>
+Signed-off-by: Krishna Kurapati <quic_kriskura@quicinc.com>
+Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+Message-ID: <20230618120949.14868-1-quic_kriskura@quicinc.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc3/gadget.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -2530,7 +2530,9 @@ static int dwc3_gadget_pullup(struct usb
+ ret = pm_runtime_get_sync(dwc->dev);
+ if (!ret || ret < 0) {
+ pm_runtime_put(dwc->dev);
+- return 0;
++ if (ret < 0)
++ pm_runtime_set_suspended(dwc->dev);
++ return ret;
+ }
+
+ if (dwc->pullups_connected == is_on) {
--- /dev/null
+From ffa5f7a3bf28c1306eef85d4056539c2d4b8eb09 Mon Sep 17 00:00:00 2001
+From: Davide Tronchin <davide.tronchin.94@gmail.com>
+Date: Thu, 22 Jun 2023 11:29:21 +0200
+Subject: USB: serial: option: add LARA-R6 01B PIDs
+
+From: Davide Tronchin <davide.tronchin.94@gmail.com>
+
+commit ffa5f7a3bf28c1306eef85d4056539c2d4b8eb09 upstream.
+
+The new LARA-R6 product variant identified by the "01B" string can be
+configured (by AT interface) in three different USB modes:
+
+* Default mode (Vendor ID: 0x1546 Product ID: 0x1311) with 4 serial
+interfaces
+
+* RmNet mode (Vendor ID: 0x1546 Product ID: 0x1312) with 4 serial
+interfaces and 1 RmNet virtual network interface
+
+* CDC-ECM mode (Vendor ID: 0x1546 Product ID: 0x1313) with 4 serial
+interface and 1 CDC-ECM virtual network interface
+The first 4 interfaces of all the 3 USB configurations (default, RmNet,
+CDC-ECM) are the same.
+
+In default mode LARA-R6 01B exposes the following interfaces:
+If 0: Diagnostic
+If 1: AT parser
+If 2: AT parser
+If 3: AT parser/alternative functions
+
+In RmNet mode LARA-R6 01B exposes the following interfaces:
+If 0: Diagnostic
+If 1: AT parser
+If 2: AT parser
+If 3: AT parser/alternative functions
+If 4: RMNET interface
+
+In CDC-ECM mode LARA-R6 01B exposes the following interfaces:
+If 0: Diagnostic
+If 1: AT parser
+If 2: AT parser
+If 3: AT parser/alternative functions
+If 4: CDC-ECM interface
+
+Signed-off-by: Davide Tronchin <davide.tronchin.94@gmail.com>
+Link: https://lore.kernel.org/r/20230622092921.12651-1-davide.tronchin.94@gmail.com
+Cc: stable@vger.kernel.org
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/serial/option.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1151,6 +1151,10 @@ static const struct usb_device_id option
+ { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x90fa),
+ .driver_info = RSVD(3) },
+ /* u-blox products */
++ { USB_DEVICE(UBLOX_VENDOR_ID, 0x1311) }, /* u-blox LARA-R6 01B */
++ { USB_DEVICE(UBLOX_VENDOR_ID, 0x1312), /* u-blox LARA-R6 01B (RMNET) */
++ .driver_info = RSVD(4) },
++ { USB_DEVICE_INTERFACE_CLASS(UBLOX_VENDOR_ID, 0x1313, 0xff) }, /* u-blox LARA-R6 01B (ECM) */
+ { USB_DEVICE(UBLOX_VENDOR_ID, 0x1341) }, /* u-blox LARA-L6 */
+ { USB_DEVICE(UBLOX_VENDOR_ID, 0x1342), /* u-blox LARA-L6 (RMNET) */
+ .driver_info = RSVD(4) },
projects / thirdparty / kernel / stable-queue.git / commitdiff
