From: Greg Kroah-Hartman Date: Mon, 15 Jun 2020 18:38:48 +0000 (+0200) Subject: 4.9-stable patches X-Git-Tag: v5.4.47~86 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=3a024b6e9ef9585bf4ace81ab524aceafdd89b13;p=thirdparty%2Fkernel%2Fstable-queue.git 4.9-stable patches added patches: acpi-cppc-fix-reference-count-leak-in-acpi_cppc_processor_probe.patch acpi-ged-add-support-for-_exx-_lxx-handler-methods.patch acpi-pm-avoid-using-power-resources-if-there-are-none-for-d0.patch acpi-sysfs-fix-reference-count-leak-in-acpi_sysfs_add_hotplug_profile.patch alsa-es1688-add-the-missed-snd_card_free.patch alsa-usb-audio-fix-inconsistent-card-pm-state-after-resume.patch cgroup-blkcg-prepare-some-symbols-for-module-and-config_cgroup-usages.patch nilfs2-fix-null-pointer-dereference-at-nilfs_segctor_do_construct.patch spi-bcm-qspi-when-tx-rx-buffer-is-null-set-to-0.patch spi-bcm2835aux-fix-controller-unregister-order.patch --- diff --git a/queue-4.9/acpi-cppc-fix-reference-count-leak-in-acpi_cppc_processor_probe.patch b/queue-4.9/acpi-cppc-fix-reference-count-leak-in-acpi_cppc_processor_probe.patch new file mode 100644 index 00000000000..88dc6bfb135 --- /dev/null +++ b/queue-4.9/acpi-cppc-fix-reference-count-leak-in-acpi_cppc_processor_probe.patch @@ -0,0 +1,38 @@ +From 4d8be4bc94f74bb7d096e1c2e44457b530d5a170 Mon Sep 17 00:00:00 2001 +From: Qiushi Wu +Date: Wed, 27 May 2020 17:35:51 -0500 +Subject: ACPI: CPPC: Fix reference count leak in acpi_cppc_processor_probe() + +From: Qiushi Wu + +commit 4d8be4bc94f74bb7d096e1c2e44457b530d5a170 upstream. + +kobject_init_and_add() takes reference even when it fails. +If this function returns an error, kobject_put() must be called to +properly clean up the memory associated with the object. Previous +commit "b8eb718348b8" fixed a similar problem. + +Fixes: 158c998ea44b ("ACPI / CPPC: add sysfs support to compute delivered performance") +Signed-off-by: Qiushi Wu +Cc: 4.10+ # 4.10+ +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/cppc_acpi.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/acpi/cppc_acpi.c ++++ b/drivers/acpi/cppc_acpi.c +@@ -793,8 +793,10 @@ int acpi_cppc_processor_probe(struct acp + + ret = kobject_init_and_add(&cpc_ptr->kobj, &cppc_ktype, &cpu_dev->kobj, + "acpi_cppc"); +- if (ret) ++ if (ret) { ++ kobject_put(&cpc_ptr->kobj); + goto out_free; ++ } + + kfree(output.pointer); + return 0; diff --git a/queue-4.9/acpi-ged-add-support-for-_exx-_lxx-handler-methods.patch b/queue-4.9/acpi-ged-add-support-for-_exx-_lxx-handler-methods.patch new file mode 100644 index 00000000000..8a9d553d6ba --- /dev/null +++ b/queue-4.9/acpi-ged-add-support-for-_exx-_lxx-handler-methods.patch @@ -0,0 +1,68 @@ +From ea6f3af4c5e63f6981c0b0ab8ebec438e2d5ef40 Mon Sep 17 00:00:00 2001 +From: Ard Biesheuvel +Date: Fri, 15 May 2020 11:36:13 +0200 +Subject: ACPI: GED: add support for _Exx / _Lxx handler methods + +From: Ard Biesheuvel + +commit ea6f3af4c5e63f6981c0b0ab8ebec438e2d5ef40 upstream. + +Per the ACPI spec, interrupts in the range [0, 255] may be handled +in AML using individual methods whose naming is based on the format +_Exx or _Lxx, where xx is the hex representation of the interrupt +index. + +Add support for this missing feature to our ACPI GED driver. + +Cc: v4.9+ # v4.9+ +Signed-off-by: Ard Biesheuvel +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/evged.c | 22 +++++++++++++++++++--- + 1 file changed, 19 insertions(+), 3 deletions(-) + +--- a/drivers/acpi/evged.c ++++ b/drivers/acpi/evged.c +@@ -82,6 +82,8 @@ static acpi_status acpi_ged_request_inte + struct resource r; + struct acpi_resource_irq *p = &ares->data.irq; + struct acpi_resource_extended_irq *pext = &ares->data.extended_irq; ++ char ev_name[5]; ++ u8 trigger; + + if (ares->type == ACPI_RESOURCE_TYPE_END_TAG) + return AE_OK; +@@ -90,14 +92,28 @@ static acpi_status acpi_ged_request_inte + dev_err(dev, "unable to parse IRQ resource\n"); + return AE_ERROR; + } +- if (ares->type == ACPI_RESOURCE_TYPE_IRQ) ++ if (ares->type == ACPI_RESOURCE_TYPE_IRQ) { + gsi = p->interrupts[0]; +- else ++ trigger = p->triggering; ++ } else { + gsi = pext->interrupts[0]; ++ trigger = p->triggering; ++ } + + irq = r.start; + +- if (ACPI_FAILURE(acpi_get_handle(handle, "_EVT", &evt_handle))) { ++ switch (gsi) { ++ case 0 ... 255: ++ sprintf(ev_name, "_%c%02hhX", ++ trigger == ACPI_EDGE_SENSITIVE ? 'E' : 'L', gsi); ++ ++ if (ACPI_SUCCESS(acpi_get_handle(handle, ev_name, &evt_handle))) ++ break; ++ /* fall through */ ++ default: ++ if (ACPI_SUCCESS(acpi_get_handle(handle, "_EVT", &evt_handle))) ++ break; ++ + dev_err(dev, "cannot locate _EVT method\n"); + return AE_ERROR; + } diff --git a/queue-4.9/acpi-pm-avoid-using-power-resources-if-there-are-none-for-d0.patch b/queue-4.9/acpi-pm-avoid-using-power-resources-if-there-are-none-for-d0.patch new file mode 100644 index 00000000000..8c4fc0aecfa --- /dev/null +++ b/queue-4.9/acpi-pm-avoid-using-power-resources-if-there-are-none-for-d0.patch @@ -0,0 +1,121 @@ +From 956ad9d98b73f59e442cc119c98ba1e04e94fe6d Mon Sep 17 00:00:00 2001 +From: "Rafael J. Wysocki" +Date: Thu, 4 Jun 2020 19:22:26 +0200 +Subject: ACPI: PM: Avoid using power resources if there are none for D0 + +From: Rafael J. Wysocki + +commit 956ad9d98b73f59e442cc119c98ba1e04e94fe6d upstream. + +As recently reported, some platforms provide a list of power +resources for device power state D3hot, through the _PR3 object, +but they do not provide a list of power resources for device power +state D0. + +Among other things, this causes acpi_device_get_power() to return +D3hot as the current state of the device in question if all of the +D3hot power resources are "on", because it sees the power_resources +flag set and calls acpi_power_get_inferred_state() which finds that +D3hot is the shallowest power state with all of the associated power +resources turned "on", so that's what it returns. Moreover, that +value takes precedence over the acpi_dev_pm_explicit_get() return +value, because it means a deeper power state. The device may very +well be in D0 physically at that point, however. + +Moreover, the presence of _PR3 without _PR0 for a given device +means that only one D3-level power state can be supported by it. +Namely, because there are no power resources to turn "off" when +transitioning the device from D0 into D3cold (which should be +supported since _PR3 is present), the evaluation of _PS3 should +be sufficient to put it straight into D3cold, but this means that +the effect of turning "on" the _PR3 power resources is unclear, +so it is better to avoid doing that altogether. Consequently, +there is no practical way do distinguish D3cold from D3hot for +the device in question and the power states of it can be labeled +so that D3hot is the deepest supported one (and Linux assumes +that putting a device into D3hot via ACPI may cause power to be +removed from it anyway, for legacy reasons). + +To work around the problem described above modify the ACPI +enumeration of devices so that power resources are only used +for device power management if the list of D0 power resources +is not empty and make it mart D3cold as supported only if that +is the case and the D3hot list of power resources is not empty +too. + +Fixes: ef85bdbec444 ("ACPI / scan: Consolidate extraction of power resources lists") +Link: https://bugzilla.kernel.org/show_bug.cgi?id=205057 +Link: https://lore.kernel.org/linux-acpi/20200603194659.185757-1-hdegoede@redhat.com/ +Reported-by: Hans de Goede +Tested-by: Hans de Goede +Tested-by: youling257@gmail.com +Cc: 3.10+ # 3.10+ +Signed-off-by: Rafael J. Wysocki +Reviewed-by: Hans de Goede +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/device_pm.c | 2 +- + drivers/acpi/scan.c | 28 +++++++++++++++++++--------- + 2 files changed, 20 insertions(+), 10 deletions(-) + +--- a/drivers/acpi/device_pm.c ++++ b/drivers/acpi/device_pm.c +@@ -171,7 +171,7 @@ int acpi_device_set_power(struct acpi_de + * possibly drop references to the power resources in use. + */ + state = ACPI_STATE_D3_HOT; +- /* If _PR3 is not available, use D3hot as the target state. */ ++ /* If D3cold is not supported, use D3hot as the target state. */ + if (!device->power.states[ACPI_STATE_D3_COLD].flags.valid) + target_state = state; + } else if (!device->power.states[state].flags.valid) { +--- a/drivers/acpi/scan.c ++++ b/drivers/acpi/scan.c +@@ -927,12 +927,9 @@ static void acpi_bus_init_power_state(st + + if (buffer.length && package + && package->type == ACPI_TYPE_PACKAGE +- && package->package.count) { +- int err = acpi_extract_power_resources(package, 0, +- &ps->resources); +- if (!err) +- device->power.flags.power_resources = 1; +- } ++ && package->package.count) ++ acpi_extract_power_resources(package, 0, &ps->resources); ++ + ACPI_FREE(buffer.pointer); + } + +@@ -979,14 +976,27 @@ static void acpi_bus_get_power_flags(str + acpi_bus_init_power_state(device, i); + + INIT_LIST_HEAD(&device->power.states[ACPI_STATE_D3_COLD].resources); +- if (!list_empty(&device->power.states[ACPI_STATE_D3_HOT].resources)) +- device->power.states[ACPI_STATE_D3_COLD].flags.valid = 1; + +- /* Set defaults for D0 and D3hot states (always valid) */ ++ /* Set the defaults for D0 and D3hot (always supported). */ + device->power.states[ACPI_STATE_D0].flags.valid = 1; + device->power.states[ACPI_STATE_D0].power = 100; + device->power.states[ACPI_STATE_D3_HOT].flags.valid = 1; + ++ /* ++ * Use power resources only if the D0 list of them is populated, because ++ * some platforms may provide _PR3 only to indicate D3cold support and ++ * in those cases the power resources list returned by it may be bogus. ++ */ ++ if (!list_empty(&device->power.states[ACPI_STATE_D0].resources)) { ++ device->power.flags.power_resources = 1; ++ /* ++ * D3cold is supported if the D3hot list of power resources is ++ * not empty. ++ */ ++ if (!list_empty(&device->power.states[ACPI_STATE_D3_HOT].resources)) ++ device->power.states[ACPI_STATE_D3_COLD].flags.valid = 1; ++ } ++ + if (acpi_bus_init_power(device)) + device->flags.power_manageable = 0; + } diff --git a/queue-4.9/acpi-sysfs-fix-reference-count-leak-in-acpi_sysfs_add_hotplug_profile.patch b/queue-4.9/acpi-sysfs-fix-reference-count-leak-in-acpi_sysfs_add_hotplug_profile.patch new file mode 100644 index 00000000000..30f15e415cd --- /dev/null +++ b/queue-4.9/acpi-sysfs-fix-reference-count-leak-in-acpi_sysfs_add_hotplug_profile.patch @@ -0,0 +1,37 @@ +From 6e6c25283dff866308c87b49434c7dbad4774cc0 Mon Sep 17 00:00:00 2001 +From: Qiushi Wu +Date: Wed, 27 May 2020 16:17:17 -0500 +Subject: ACPI: sysfs: Fix reference count leak in acpi_sysfs_add_hotplug_profile() + +From: Qiushi Wu + +commit 6e6c25283dff866308c87b49434c7dbad4774cc0 upstream. + +kobject_init_and_add() takes reference even when it fails. +Thus, when kobject_init_and_add() returns an error, +kobject_put() must be called to properly clean up the kobject. + +Fixes: 3f8055c35836 ("ACPI / hotplug: Introduce user space interface for hotplug profiles") +Signed-off-by: Qiushi Wu +Cc: 3.10+ # 3.10+ +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/sysfs.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/acpi/sysfs.c ++++ b/drivers/acpi/sysfs.c +@@ -898,8 +898,10 @@ void acpi_sysfs_add_hotplug_profile(stru + + error = kobject_init_and_add(&hotplug->kobj, + &acpi_hotplug_profile_ktype, hotplug_kobj, "%s", name); +- if (error) ++ if (error) { ++ kobject_put(&hotplug->kobj); + goto err_out; ++ } + + kobject_uevent(&hotplug->kobj, KOBJ_ADD); + return; diff --git a/queue-4.9/alsa-es1688-add-the-missed-snd_card_free.patch b/queue-4.9/alsa-es1688-add-the-missed-snd_card_free.patch new file mode 100644 index 00000000000..98219f3e537 --- /dev/null +++ b/queue-4.9/alsa-es1688-add-the-missed-snd_card_free.patch @@ -0,0 +1,37 @@ +From d9b8fbf15d05350b36081eddafcf7b15aa1add50 Mon Sep 17 00:00:00 2001 +From: Chuhong Yuan +Date: Wed, 3 Jun 2020 17:24:59 +0800 +Subject: ALSA: es1688: Add the missed snd_card_free() + +From: Chuhong Yuan + +commit d9b8fbf15d05350b36081eddafcf7b15aa1add50 upstream. + +snd_es968_pnp_detect() misses a snd_card_free() in a failed path. +Add the missed function call to fix it. + +Fixes: a20971b201ac ("ALSA: Merge es1688 and es968 drivers") +Signed-off-by: Chuhong Yuan +Cc: +Link: https://lore.kernel.org/r/20200603092459.1424093-1-hslester96@gmail.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/isa/es1688/es1688.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/sound/isa/es1688/es1688.c ++++ b/sound/isa/es1688/es1688.c +@@ -284,8 +284,10 @@ static int snd_es968_pnp_detect(struct p + return error; + } + error = snd_es1688_probe(card, dev); +- if (error < 0) ++ if (error < 0) { ++ snd_card_free(card); + return error; ++ } + pnp_set_card_drvdata(pcard, card); + snd_es968_pnp_is_probed = 1; + return 0; diff --git a/queue-4.9/alsa-usb-audio-fix-inconsistent-card-pm-state-after-resume.patch b/queue-4.9/alsa-usb-audio-fix-inconsistent-card-pm-state-after-resume.patch new file mode 100644 index 00000000000..8cbcf50f7ec --- /dev/null +++ b/queue-4.9/alsa-usb-audio-fix-inconsistent-card-pm-state-after-resume.patch @@ -0,0 +1,127 @@ +From 862b2509d157c629dd26d7ac6c6cdbf043d332eb Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Wed, 3 Jun 2020 17:37:08 +0200 +Subject: ALSA: usb-audio: Fix inconsistent card PM state after resume + +From: Takashi Iwai + +commit 862b2509d157c629dd26d7ac6c6cdbf043d332eb upstream. + +When a USB-audio interface gets runtime-suspended via auto-pm feature, +the driver suspends all functionality and increment +chip->num_suspended_intf. Later on, when the system gets suspended to +S3, the driver increments chip->num_suspended_intf again, skips the +device changes, and sets the card power state to +SNDRV_CTL_POWER_D3hot. In return, when the system gets resumed from +S3, the resume callback decrements chip->num_suspended_intf. Since +this refcount is still not zero (it's been runtime-suspended), the +whole resume is skipped. But there is a small pitfall here. + +The problem is that the driver doesn't restore the card power state +after this resume call, leaving it as SNDRV_CTL_POWER_D3hot. So, +even after the system resume finishes, the card instance still appears +as if it were system-suspended, and this confuses many ioctl accesses +that are blocked unexpectedly. + +In details, we have two issues behind the scene: one is that the card +power state is changed only when the refcount becomes zero, and +another is that the prior auto-suspend check is kept in a boolean +flag. Although the latter problem is almost negligible since the +auto-pm feature is imposed only on the primary interface, but this can +be a potential problem on the devices with multiple interfaces. + +This patch addresses those issues by the following: + +- Replace chip->autosuspended boolean flag with chip->system_suspend + counter + +- At the first system-suspend, chip->num_suspended_intf is recorded to + chip->system_suspend + +- At system-resume, the card power state is restored when the + chip->num_suspended_intf refcount reaches to chip->system_suspend, + i.e. the state returns to the auto-suspended + +Also, the patch fixes yet another hidden problem by the code +refactoring along with the fixes above: namely, when some resume +procedure failed, the driver left chip->num_suspended_intf that was +already decreased, and it might lead to the refcount unbalance. +In the new code, the refcount decrement is done after the whole resume +procedure, and the problem is avoided as well. + +Fixes: 0662292aec05 ("ALSA: usb-audio: Handle normal and auto-suspend equally") +Reported-and-tested-by: Macpaul Lin +Cc: +Link: https://lore.kernel.org/r/20200603153709.6293-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/usb/card.c | 20 +++++++++++++------- + sound/usb/usbaudio.h | 2 +- + 2 files changed, 14 insertions(+), 8 deletions(-) + +--- a/sound/usb/card.c ++++ b/sound/usb/card.c +@@ -768,9 +768,6 @@ static int usb_audio_suspend(struct usb_ + if (chip == (void *)-1L) + return 0; + +- chip->autosuspended = !!PMSG_IS_AUTO(message); +- if (!chip->autosuspended) +- snd_power_change_state(chip->card, SNDRV_CTL_POWER_D3hot); + if (!chip->num_suspended_intf++) { + list_for_each_entry(as, &chip->pcm_list, list) { + snd_pcm_suspend_all(as->pcm); +@@ -783,6 +780,11 @@ static int usb_audio_suspend(struct usb_ + snd_usb_mixer_suspend(mixer); + } + ++ if (!PMSG_IS_AUTO(message) && !chip->system_suspend) { ++ snd_power_change_state(chip->card, SNDRV_CTL_POWER_D3hot); ++ chip->system_suspend = chip->num_suspended_intf; ++ } ++ + return 0; + } + +@@ -795,10 +797,11 @@ static int __usb_audio_resume(struct usb + + if (chip == (void *)-1L) + return 0; +- if (--chip->num_suspended_intf) +- return 0; + + atomic_inc(&chip->active); /* avoid autopm */ ++ if (chip->num_suspended_intf > 1) ++ goto out; ++ + /* + * ALSA leaves material resumption to user space + * we just notify and restart the mixers +@@ -813,9 +816,12 @@ static int __usb_audio_resume(struct usb + snd_usbmidi_resume(p); + } + +- if (!chip->autosuspended) ++ out: ++ if (chip->num_suspended_intf == chip->system_suspend) { + snd_power_change_state(chip->card, SNDRV_CTL_POWER_D0); +- chip->autosuspended = 0; ++ chip->system_suspend = 0; ++ } ++ chip->num_suspended_intf--; + + err_out: + atomic_dec(&chip->active); /* allow autopm after this point */ +--- a/sound/usb/usbaudio.h ++++ b/sound/usb/usbaudio.h +@@ -37,7 +37,7 @@ struct snd_usb_audio { + struct usb_interface *pm_intf; + u32 usb_id; + struct mutex mutex; +- unsigned int autosuspended:1; ++ unsigned int system_suspend; + atomic_t active; + atomic_t shutdown; + atomic_t usage_count; diff --git a/queue-4.9/cgroup-blkcg-prepare-some-symbols-for-module-and-config_cgroup-usages.patch b/queue-4.9/cgroup-blkcg-prepare-some-symbols-for-module-and-config_cgroup-usages.patch new file mode 100644 index 00000000000..b5f187f0940 --- /dev/null +++ b/queue-4.9/cgroup-blkcg-prepare-some-symbols-for-module-and-config_cgroup-usages.patch @@ -0,0 +1,35 @@ +From 9b0eb69b75bccada2d341d7e7ca342f0cb1c9a6a Mon Sep 17 00:00:00 2001 +From: Tejun Heo +Date: Thu, 27 Jun 2019 13:39:48 -0700 +Subject: cgroup, blkcg: Prepare some symbols for module and !CONFIG_CGROUP usages + +From: Tejun Heo + +commit 9b0eb69b75bccada2d341d7e7ca342f0cb1c9a6a upstream. + +btrfs is going to use css_put() and wbc helpers to improve cgroup +writeback support. Add dummy css_get() definition and export wbc +helpers to prepare for module and !CONFIG_CGROUP builds. + +[only backport the export of __inode_attach_wb for stable kernels - gregkh] + +Reported-by: kbuild test robot +Reviewed-by: Jan Kara +Signed-off-by: Tejun Heo +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + fs/fs-writeback.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/fs/fs-writeback.c ++++ b/fs/fs-writeback.c +@@ -269,6 +269,7 @@ void __inode_attach_wb(struct inode *ino + if (unlikely(cmpxchg(&inode->i_wb, NULL, wb))) + wb_put(wb); + } ++EXPORT_SYMBOL_GPL(__inode_attach_wb); + + /** + * locked_inode_to_wb_and_lock_list - determine a locked inode's wb and lock it diff --git a/queue-4.9/nilfs2-fix-null-pointer-dereference-at-nilfs_segctor_do_construct.patch b/queue-4.9/nilfs2-fix-null-pointer-dereference-at-nilfs_segctor_do_construct.patch new file mode 100644 index 00000000000..d70b306b439 --- /dev/null +++ b/queue-4.9/nilfs2-fix-null-pointer-dereference-at-nilfs_segctor_do_construct.patch @@ -0,0 +1,67 @@ +From 8301c719a2bd131436438e49130ee381d30933f5 Mon Sep 17 00:00:00 2001 +From: Ryusuke Konishi +Date: Wed, 10 Jun 2020 18:41:35 -0700 +Subject: nilfs2: fix null pointer dereference at nilfs_segctor_do_construct() + +From: Ryusuke Konishi + +commit 8301c719a2bd131436438e49130ee381d30933f5 upstream. + +After commit c3aab9a0bd91 ("mm/filemap.c: don't initiate writeback if +mapping has no dirty pages"), the following null pointer dereference has +been reported on nilfs2: + + BUG: kernel NULL pointer dereference, address: 00000000000000a8 + #PF: supervisor read access in kernel mode + #PF: error_code(0x0000) - not-present page + PGD 0 P4D 0 + Oops: 0000 [#1] SMP PTI + ... + RIP: 0010:percpu_counter_add_batch+0xa/0x60 + ... + Call Trace: + __test_set_page_writeback+0x2d3/0x330 + nilfs_segctor_do_construct+0x10d3/0x2110 [nilfs2] + nilfs_segctor_construct+0x168/0x260 [nilfs2] + nilfs_segctor_thread+0x127/0x3b0 [nilfs2] + kthread+0xf8/0x130 + ... + +This crash turned out to be caused by set_page_writeback() call for +segment summary buffers at nilfs_segctor_prepare_write(). + +set_page_writeback() can call inc_wb_stat(inode_to_wb(inode), +WB_WRITEBACK) where inode_to_wb(inode) is NULL if the inode of +underlying block device does not have an associated wb. + +This fixes the issue by calling inode_attach_wb() in advance to ensure +to associate the bdev inode with its wb. + +Fixes: c3aab9a0bd91 ("mm/filemap.c: don't initiate writeback if mapping has no dirty pages") +Reported-by: Walton Hoops +Reported-by: Tomas Hlavaty +Reported-by: ARAI Shun-ichi +Reported-by: Hideki EIRAKU +Signed-off-by: Ryusuke Konishi +Signed-off-by: Andrew Morton +Tested-by: Ryusuke Konishi +Cc: [5.4+] +Link: http://lkml.kernel.org/r/20200608.011819.1399059588922299158.konishi.ryusuke@gmail.com +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nilfs2/segment.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/fs/nilfs2/segment.c ++++ b/fs/nilfs2/segment.c +@@ -2793,6 +2793,8 @@ int nilfs_attach_log_writer(struct super + if (!nilfs->ns_writer) + return -ENOMEM; + ++ inode_attach_wb(nilfs->ns_bdev->bd_inode, NULL); ++ + err = nilfs_segctor_start_thread(nilfs->ns_writer); + if (err) { + kfree(nilfs->ns_writer); diff --git a/queue-4.9/series b/queue-4.9/series index f241fdeb06a..dfbf5f37c5e 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -11,3 +11,13 @@ x86-pci-mark-intel-c620-mroms-as-having-non-compliant-bars.patch x86-speculation-prevent-rogue-cross-process-ssbd-shutdown.patch x86-reboot-quirks-add-macbook6-1-reboot-quirk.patch efi-efivars-add-missing-kobject_put-in-sysfs-entry-creation-error-path.patch +alsa-es1688-add-the-missed-snd_card_free.patch +alsa-usb-audio-fix-inconsistent-card-pm-state-after-resume.patch +acpi-sysfs-fix-reference-count-leak-in-acpi_sysfs_add_hotplug_profile.patch +acpi-cppc-fix-reference-count-leak-in-acpi_cppc_processor_probe.patch +acpi-ged-add-support-for-_exx-_lxx-handler-methods.patch +acpi-pm-avoid-using-power-resources-if-there-are-none-for-d0.patch +cgroup-blkcg-prepare-some-symbols-for-module-and-config_cgroup-usages.patch +nilfs2-fix-null-pointer-dereference-at-nilfs_segctor_do_construct.patch +spi-bcm2835aux-fix-controller-unregister-order.patch +spi-bcm-qspi-when-tx-rx-buffer-is-null-set-to-0.patch diff --git a/queue-4.9/spi-bcm-qspi-when-tx-rx-buffer-is-null-set-to-0.patch b/queue-4.9/spi-bcm-qspi-when-tx-rx-buffer-is-null-set-to-0.patch new file mode 100644 index 00000000000..52961a25ad7 --- /dev/null +++ b/queue-4.9/spi-bcm-qspi-when-tx-rx-buffer-is-null-set-to-0.patch @@ -0,0 +1,62 @@ +From 4df3bea7f9d2ddd9ac2c29ba945c7c4db2def29c Mon Sep 17 00:00:00 2001 +From: Justin Chen +Date: Mon, 20 Apr 2020 15:08:49 -0400 +Subject: spi: bcm-qspi: when tx/rx buffer is NULL set to 0 + +From: Justin Chen + +commit 4df3bea7f9d2ddd9ac2c29ba945c7c4db2def29c upstream. + +Currently we set the tx/rx buffer to 0xff when NULL. This causes +problems with some spi slaves where 0xff is a valid command. Looking +at other drivers, the tx/rx buffer is usually set to 0x00 when NULL. +Following this convention solves the issue. + +Fixes: fa236a7ef240 ("spi: bcm-qspi: Add Broadcom MSPI driver") +Signed-off-by: Justin Chen +Signed-off-by: Kamal Dasu +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20200420190853.45614-6-kdasu.kdev@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/spi/spi-bcm-qspi.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/spi/spi-bcm-qspi.c ++++ b/drivers/spi/spi-bcm-qspi.c +@@ -698,7 +698,7 @@ static void read_from_hw(struct bcm_qspi + if (buf) + buf[tp.byte] = read_rxram_slot_u8(qspi, slot); + dev_dbg(&qspi->pdev->dev, "RD %02x\n", +- buf ? buf[tp.byte] : 0xff); ++ buf ? buf[tp.byte] : 0x0); + } else { + u16 *buf = tp.trans->rx_buf; + +@@ -706,7 +706,7 @@ static void read_from_hw(struct bcm_qspi + buf[tp.byte / 2] = read_rxram_slot_u16(qspi, + slot); + dev_dbg(&qspi->pdev->dev, "RD %04x\n", +- buf ? buf[tp.byte] : 0xffff); ++ buf ? buf[tp.byte / 2] : 0x0); + } + + update_qspi_trans_byte_count(qspi, &tp, +@@ -761,13 +761,13 @@ static int write_to_hw(struct bcm_qspi * + while (!tstatus && slot < MSPI_NUM_CDRAM) { + if (tp.trans->bits_per_word <= 8) { + const u8 *buf = tp.trans->tx_buf; +- u8 val = buf ? buf[tp.byte] : 0xff; ++ u8 val = buf ? buf[tp.byte] : 0x00; + + write_txram_slot_u8(qspi, slot, val); + dev_dbg(&qspi->pdev->dev, "WR %02x\n", val); + } else { + const u16 *buf = tp.trans->tx_buf; +- u16 val = buf ? buf[tp.byte / 2] : 0xffff; ++ u16 val = buf ? buf[tp.byte / 2] : 0x0000; + + write_txram_slot_u16(qspi, slot, val); + dev_dbg(&qspi->pdev->dev, "WR %04x\n", val); diff --git a/queue-4.9/spi-bcm2835aux-fix-controller-unregister-order.patch b/queue-4.9/spi-bcm2835aux-fix-controller-unregister-order.patch new file mode 100644 index 00000000000..f455b6093af --- /dev/null +++ b/queue-4.9/spi-bcm2835aux-fix-controller-unregister-order.patch @@ -0,0 +1,62 @@ +From b9dd3f6d417258ad0beeb292a1bc74200149f15d Mon Sep 17 00:00:00 2001 +From: Lukas Wunner +Date: Fri, 15 May 2020 17:58:03 +0200 +Subject: spi: bcm2835aux: Fix controller unregister order + +From: Lukas Wunner + +commit b9dd3f6d417258ad0beeb292a1bc74200149f15d upstream. + +The BCM2835aux SPI driver uses devm_spi_register_master() on bind. +As a consequence, on unbind, __device_release_driver() first invokes +bcm2835aux_spi_remove() before unregistering the SPI controller via +devres_release_all(). + +This order is incorrect: bcm2835aux_spi_remove() turns off the SPI +controller, including its interrupts and clock. The SPI controller +is thus no longer usable. + +When the SPI controller is subsequently unregistered, it unbinds all +its slave devices. If their drivers need to access the SPI bus, +e.g. to quiesce their interrupts, unbinding will fail. + +As a rule, devm_spi_register_master() must not be used if the +->remove() hook performs teardown steps which shall be performed +after unbinding of slaves. + +Fix by using the non-devm variant spi_register_master(). Note that the +struct spi_master as well as the driver-private data are not freed until +after bcm2835aux_spi_remove() has finished, so accessing them is safe. + +Fixes: 1ea29b39f4c8 ("spi: bcm2835aux: add bcm2835 auxiliary spi device driver") +Signed-off-by: Lukas Wunner +Cc: stable@vger.kernel.org # v4.4+ +Cc: Martin Sperl +Link: https://lore.kernel.org/r/32f27f4d8242e4d75f9a53f7e8f1f77483b08669.1589557526.git.lukas@wunner.de +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/spi/spi-bcm2835aux.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/spi/spi-bcm2835aux.c ++++ b/drivers/spi/spi-bcm2835aux.c +@@ -485,7 +485,7 @@ static int bcm2835aux_spi_probe(struct p + goto out_clk_disable; + } + +- err = devm_spi_register_master(&pdev->dev, master); ++ err = spi_register_master(master); + if (err) { + dev_err(&pdev->dev, "could not register SPI master: %d\n", err); + goto out_clk_disable; +@@ -505,6 +505,8 @@ static int bcm2835aux_spi_remove(struct + struct spi_master *master = platform_get_drvdata(pdev); + struct bcm2835aux_spi *bs = spi_master_get_devdata(master); + ++ spi_unregister_master(master); ++ + bcm2835aux_spi_reset_hw(bs); + + /* disable the HW block by releasing the clock */