From: Greg Kroah-Hartman Date: Mon, 15 Jun 2020 15:31:29 +0000 (+0200) Subject: 5.4-stable patches X-Git-Tag: v5.4.47~88 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=78695e5ad8232156f79269cdfb35408523b4eaac;p=thirdparty%2Fkernel%2Fstable-queue.git 5.4-stable patches added patches: acpi-cppc-fix-reference-count-leak-in-acpi_cppc_processor_probe.patch acpi-ged-add-support-for-_exx-_lxx-handler-methods.patch acpi-pm-avoid-using-power-resources-if-there-are-none-for-d0.patch acpi-sysfs-fix-reference-count-leak-in-acpi_sysfs_add_hotplug_profile.patch alsa-es1688-add-the-missed-snd_card_free.patch alsa-fireface-fix-configuration-error-for-nominal-sampling-transfer-frequency.patch alsa-hda-realtek-add-a-pintbl-quirk-for-several-lenovo-machines.patch alsa-pcm-disallow-linking-stream-to-itself.patch alsa-pcm-fix-snd_pcm_link-lockdep-splat.patch alsa-usb-audio-add-vendor-product-and-profile-name-for-hp-thunderbolt-dock.patch alsa-usb-audio-fix-inconsistent-card-pm-state-after-resume.patch arm64-acpi-fix-ubsan-warning.patch lib-lzo-fix-ambiguous-encoding-bug-in-lzo-rle.patch nilfs2-fix-null-pointer-dereference-at-nilfs_segctor_do_construct.patch pm-runtime-clk-fix-clk_pm_runtime_get-error-path.patch smb3-add-indatalen-that-can-be-a-non-zero-value-to-calculation-of-credit-charge-in-smb2-ioctl.patch smb3-fix-incorrect-number-of-credits-when-ioctl-maxoutputresponse-64k.patch spi-bcm-qspi-handle-clock-probe-deferral.patch spi-bcm-qspi-when-tx-rx-buffer-is-null-set-to-0.patch spi-bcm2835-fix-controller-unregister-order.patch spi-bcm2835aux-fix-controller-unregister-order.patch spi-dw-fix-controller-unregister-order.patch spi-fix-controller-unregister-order.patch spi-pxa2xx-fix-controller-unregister-order.patch spi-pxa2xx-fix-runtime-pm-ref-imbalance-on-probe-error.patch watchdog-imx_sc_wdt-fix-reboot-on-crash.patch --- diff --git a/queue-5.4/acpi-cppc-fix-reference-count-leak-in-acpi_cppc_processor_probe.patch b/queue-5.4/acpi-cppc-fix-reference-count-leak-in-acpi_cppc_processor_probe.patch new file mode 100644 index 00000000000..ad344e72395 --- /dev/null +++ b/queue-5.4/acpi-cppc-fix-reference-count-leak-in-acpi_cppc_processor_probe.patch @@ -0,0 +1,34 @@ +From 4d8be4bc94f74bb7d096e1c2e44457b530d5a170 Mon Sep 17 00:00:00 2001 +From: Qiushi Wu +Date: Wed, 27 May 2020 17:35:51 -0500 +Subject: ACPI: CPPC: Fix reference count leak in acpi_cppc_processor_probe() + +From: Qiushi Wu + +commit 4d8be4bc94f74bb7d096e1c2e44457b530d5a170 upstream. + +kobject_init_and_add() takes reference even when it fails. +If this function returns an error, kobject_put() must be called to +properly clean up the memory associated with the object. Previous +commit "b8eb718348b8" fixed a similar problem. + +Fixes: 158c998ea44b ("ACPI / CPPC: add sysfs support to compute delivered performance") +Signed-off-by: Qiushi Wu +Cc: 4.10+ # 4.10+ +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/cppc_acpi.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/acpi/cppc_acpi.c ++++ b/drivers/acpi/cppc_acpi.c +@@ -865,6 +865,7 @@ int acpi_cppc_processor_probe(struct acp + "acpi_cppc"); + if (ret) { + per_cpu(cpc_desc_ptr, pr->id) = NULL; ++ kobject_put(&cpc_ptr->kobj); + goto out_free; + } + diff --git a/queue-5.4/acpi-ged-add-support-for-_exx-_lxx-handler-methods.patch b/queue-5.4/acpi-ged-add-support-for-_exx-_lxx-handler-methods.patch new file mode 100644 index 00000000000..77b21da62fc --- /dev/null +++ b/queue-5.4/acpi-ged-add-support-for-_exx-_lxx-handler-methods.patch @@ -0,0 +1,68 @@ +From ea6f3af4c5e63f6981c0b0ab8ebec438e2d5ef40 Mon Sep 17 00:00:00 2001 +From: Ard Biesheuvel +Date: Fri, 15 May 2020 11:36:13 +0200 +Subject: ACPI: GED: add support for _Exx / _Lxx handler methods + +From: Ard Biesheuvel + +commit ea6f3af4c5e63f6981c0b0ab8ebec438e2d5ef40 upstream. + +Per the ACPI spec, interrupts in the range [0, 255] may be handled +in AML using individual methods whose naming is based on the format +_Exx or _Lxx, where xx is the hex representation of the interrupt +index. + +Add support for this missing feature to our ACPI GED driver. + +Cc: v4.9+ # v4.9+ +Signed-off-by: Ard Biesheuvel +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/evged.c | 22 +++++++++++++++++++--- + 1 file changed, 19 insertions(+), 3 deletions(-) + +--- a/drivers/acpi/evged.c ++++ b/drivers/acpi/evged.c +@@ -79,6 +79,8 @@ static acpi_status acpi_ged_request_inte + struct resource r; + struct acpi_resource_irq *p = &ares->data.irq; + struct acpi_resource_extended_irq *pext = &ares->data.extended_irq; ++ char ev_name[5]; ++ u8 trigger; + + if (ares->type == ACPI_RESOURCE_TYPE_END_TAG) + return AE_OK; +@@ -87,14 +89,28 @@ static acpi_status acpi_ged_request_inte + dev_err(dev, "unable to parse IRQ resource\n"); + return AE_ERROR; + } +- if (ares->type == ACPI_RESOURCE_TYPE_IRQ) ++ if (ares->type == ACPI_RESOURCE_TYPE_IRQ) { + gsi = p->interrupts[0]; +- else ++ trigger = p->triggering; ++ } else { + gsi = pext->interrupts[0]; ++ trigger = p->triggering; ++ } + + irq = r.start; + +- if (ACPI_FAILURE(acpi_get_handle(handle, "_EVT", &evt_handle))) { ++ switch (gsi) { ++ case 0 ... 255: ++ sprintf(ev_name, "_%c%02hhX", ++ trigger == ACPI_EDGE_SENSITIVE ? 'E' : 'L', gsi); ++ ++ if (ACPI_SUCCESS(acpi_get_handle(handle, ev_name, &evt_handle))) ++ break; ++ /* fall through */ ++ default: ++ if (ACPI_SUCCESS(acpi_get_handle(handle, "_EVT", &evt_handle))) ++ break; ++ + dev_err(dev, "cannot locate _EVT method\n"); + return AE_ERROR; + } diff --git a/queue-5.4/acpi-pm-avoid-using-power-resources-if-there-are-none-for-d0.patch b/queue-5.4/acpi-pm-avoid-using-power-resources-if-there-are-none-for-d0.patch new file mode 100644 index 00000000000..604a937c349 --- /dev/null +++ b/queue-5.4/acpi-pm-avoid-using-power-resources-if-there-are-none-for-d0.patch @@ -0,0 +1,121 @@ +From 956ad9d98b73f59e442cc119c98ba1e04e94fe6d Mon Sep 17 00:00:00 2001 +From: "Rafael J. Wysocki" +Date: Thu, 4 Jun 2020 19:22:26 +0200 +Subject: ACPI: PM: Avoid using power resources if there are none for D0 + +From: Rafael J. Wysocki + +commit 956ad9d98b73f59e442cc119c98ba1e04e94fe6d upstream. + +As recently reported, some platforms provide a list of power +resources for device power state D3hot, through the _PR3 object, +but they do not provide a list of power resources for device power +state D0. + +Among other things, this causes acpi_device_get_power() to return +D3hot as the current state of the device in question if all of the +D3hot power resources are "on", because it sees the power_resources +flag set and calls acpi_power_get_inferred_state() which finds that +D3hot is the shallowest power state with all of the associated power +resources turned "on", so that's what it returns. Moreover, that +value takes precedence over the acpi_dev_pm_explicit_get() return +value, because it means a deeper power state. The device may very +well be in D0 physically at that point, however. + +Moreover, the presence of _PR3 without _PR0 for a given device +means that only one D3-level power state can be supported by it. +Namely, because there are no power resources to turn "off" when +transitioning the device from D0 into D3cold (which should be +supported since _PR3 is present), the evaluation of _PS3 should +be sufficient to put it straight into D3cold, but this means that +the effect of turning "on" the _PR3 power resources is unclear, +so it is better to avoid doing that altogether. Consequently, +there is no practical way do distinguish D3cold from D3hot for +the device in question and the power states of it can be labeled +so that D3hot is the deepest supported one (and Linux assumes +that putting a device into D3hot via ACPI may cause power to be +removed from it anyway, for legacy reasons). + +To work around the problem described above modify the ACPI +enumeration of devices so that power resources are only used +for device power management if the list of D0 power resources +is not empty and make it mart D3cold as supported only if that +is the case and the D3hot list of power resources is not empty +too. + +Fixes: ef85bdbec444 ("ACPI / scan: Consolidate extraction of power resources lists") +Link: https://bugzilla.kernel.org/show_bug.cgi?id=205057 +Link: https://lore.kernel.org/linux-acpi/20200603194659.185757-1-hdegoede@redhat.com/ +Reported-by: Hans de Goede +Tested-by: Hans de Goede +Tested-by: youling257@gmail.com +Cc: 3.10+ # 3.10+ +Signed-off-by: Rafael J. Wysocki +Reviewed-by: Hans de Goede +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/device_pm.c | 2 +- + drivers/acpi/scan.c | 28 +++++++++++++++++++--------- + 2 files changed, 20 insertions(+), 10 deletions(-) + +--- a/drivers/acpi/device_pm.c ++++ b/drivers/acpi/device_pm.c +@@ -186,7 +186,7 @@ int acpi_device_set_power(struct acpi_de + * possibly drop references to the power resources in use. + */ + state = ACPI_STATE_D3_HOT; +- /* If _PR3 is not available, use D3hot as the target state. */ ++ /* If D3cold is not supported, use D3hot as the target state. */ + if (!device->power.states[ACPI_STATE_D3_COLD].flags.valid) + target_state = state; + } else if (!device->power.states[state].flags.valid) { +--- a/drivers/acpi/scan.c ++++ b/drivers/acpi/scan.c +@@ -919,12 +919,9 @@ static void acpi_bus_init_power_state(st + + if (buffer.length && package + && package->type == ACPI_TYPE_PACKAGE +- && package->package.count) { +- int err = acpi_extract_power_resources(package, 0, +- &ps->resources); +- if (!err) +- device->power.flags.power_resources = 1; +- } ++ && package->package.count) ++ acpi_extract_power_resources(package, 0, &ps->resources); ++ + ACPI_FREE(buffer.pointer); + } + +@@ -971,14 +968,27 @@ static void acpi_bus_get_power_flags(str + acpi_bus_init_power_state(device, i); + + INIT_LIST_HEAD(&device->power.states[ACPI_STATE_D3_COLD].resources); +- if (!list_empty(&device->power.states[ACPI_STATE_D3_HOT].resources)) +- device->power.states[ACPI_STATE_D3_COLD].flags.valid = 1; + +- /* Set defaults for D0 and D3hot states (always valid) */ ++ /* Set the defaults for D0 and D3hot (always supported). */ + device->power.states[ACPI_STATE_D0].flags.valid = 1; + device->power.states[ACPI_STATE_D0].power = 100; + device->power.states[ACPI_STATE_D3_HOT].flags.valid = 1; + ++ /* ++ * Use power resources only if the D0 list of them is populated, because ++ * some platforms may provide _PR3 only to indicate D3cold support and ++ * in those cases the power resources list returned by it may be bogus. ++ */ ++ if (!list_empty(&device->power.states[ACPI_STATE_D0].resources)) { ++ device->power.flags.power_resources = 1; ++ /* ++ * D3cold is supported if the D3hot list of power resources is ++ * not empty. ++ */ ++ if (!list_empty(&device->power.states[ACPI_STATE_D3_HOT].resources)) ++ device->power.states[ACPI_STATE_D3_COLD].flags.valid = 1; ++ } ++ + if (acpi_bus_init_power(device)) + device->flags.power_manageable = 0; + } diff --git a/queue-5.4/acpi-sysfs-fix-reference-count-leak-in-acpi_sysfs_add_hotplug_profile.patch b/queue-5.4/acpi-sysfs-fix-reference-count-leak-in-acpi_sysfs_add_hotplug_profile.patch new file mode 100644 index 00000000000..b6900570eef --- /dev/null +++ b/queue-5.4/acpi-sysfs-fix-reference-count-leak-in-acpi_sysfs_add_hotplug_profile.patch @@ -0,0 +1,37 @@ +From 6e6c25283dff866308c87b49434c7dbad4774cc0 Mon Sep 17 00:00:00 2001 +From: Qiushi Wu +Date: Wed, 27 May 2020 16:17:17 -0500 +Subject: ACPI: sysfs: Fix reference count leak in acpi_sysfs_add_hotplug_profile() + +From: Qiushi Wu + +commit 6e6c25283dff866308c87b49434c7dbad4774cc0 upstream. + +kobject_init_and_add() takes reference even when it fails. +Thus, when kobject_init_and_add() returns an error, +kobject_put() must be called to properly clean up the kobject. + +Fixes: 3f8055c35836 ("ACPI / hotplug: Introduce user space interface for hotplug profiles") +Signed-off-by: Qiushi Wu +Cc: 3.10+ # 3.10+ +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/sysfs.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/acpi/sysfs.c ++++ b/drivers/acpi/sysfs.c +@@ -993,8 +993,10 @@ void acpi_sysfs_add_hotplug_profile(stru + + error = kobject_init_and_add(&hotplug->kobj, + &acpi_hotplug_profile_ktype, hotplug_kobj, "%s", name); +- if (error) ++ if (error) { ++ kobject_put(&hotplug->kobj); + goto err_out; ++ } + + kobject_uevent(&hotplug->kobj, KOBJ_ADD); + return; diff --git a/queue-5.4/alsa-es1688-add-the-missed-snd_card_free.patch b/queue-5.4/alsa-es1688-add-the-missed-snd_card_free.patch new file mode 100644 index 00000000000..a07c3b522c0 --- /dev/null +++ b/queue-5.4/alsa-es1688-add-the-missed-snd_card_free.patch @@ -0,0 +1,37 @@ +From d9b8fbf15d05350b36081eddafcf7b15aa1add50 Mon Sep 17 00:00:00 2001 +From: Chuhong Yuan +Date: Wed, 3 Jun 2020 17:24:59 +0800 +Subject: ALSA: es1688: Add the missed snd_card_free() + +From: Chuhong Yuan + +commit d9b8fbf15d05350b36081eddafcf7b15aa1add50 upstream. + +snd_es968_pnp_detect() misses a snd_card_free() in a failed path. +Add the missed function call to fix it. + +Fixes: a20971b201ac ("ALSA: Merge es1688 and es968 drivers") +Signed-off-by: Chuhong Yuan +Cc: +Link: https://lore.kernel.org/r/20200603092459.1424093-1-hslester96@gmail.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/isa/es1688/es1688.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/sound/isa/es1688/es1688.c ++++ b/sound/isa/es1688/es1688.c +@@ -267,8 +267,10 @@ static int snd_es968_pnp_detect(struct p + return error; + } + error = snd_es1688_probe(card, dev); +- if (error < 0) ++ if (error < 0) { ++ snd_card_free(card); + return error; ++ } + pnp_set_card_drvdata(pcard, card); + snd_es968_pnp_is_probed = 1; + return 0; diff --git a/queue-5.4/alsa-fireface-fix-configuration-error-for-nominal-sampling-transfer-frequency.patch b/queue-5.4/alsa-fireface-fix-configuration-error-for-nominal-sampling-transfer-frequency.patch new file mode 100644 index 00000000000..5a78a53d641 --- /dev/null +++ b/queue-5.4/alsa-fireface-fix-configuration-error-for-nominal-sampling-transfer-frequency.patch @@ -0,0 +1,67 @@ +From bbd6aac3ae15bef762af03bf62e35ace5c4292bd Mon Sep 17 00:00:00 2001 +From: Takashi Sakamoto +Date: Sun, 10 May 2020 16:42:56 +0900 +Subject: ALSA: fireface: fix configuration error for nominal sampling transfer frequency + +From: Takashi Sakamoto + +commit bbd6aac3ae15bef762af03bf62e35ace5c4292bd upstream. + +128000 and 192000 are congruence modulo 32000, thus it's wrong to +distinguish them as multiple of 32000 and 48000 by modulo 32000 at +first. + +Additionally, used condition statement to detect quadruple speed can +cause missing bit flag. + +Furthermore, counter to ensure the configuration is wrong and it +causes false positive. + +This commit fixes the above three bugs. + +Cc: +Fixes: 60aec494b389 ("ALSA: fireface: support allocate_resources operation in latter protocol") +Signed-off-by: Takashi Sakamoto +Link: https://lore.kernel.org/r/20200510074301.116224-2-o-takashi@sakamocchi.jp +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/firewire/fireface/ff-protocol-latter.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +--- a/sound/firewire/fireface/ff-protocol-latter.c ++++ b/sound/firewire/fireface/ff-protocol-latter.c +@@ -107,18 +107,18 @@ static int latter_allocate_resources(str + int err; + + // Set the number of data blocks transferred in a second. +- if (rate % 32000 == 0) +- code = 0x00; ++ if (rate % 48000 == 0) ++ code = 0x04; + else if (rate % 44100 == 0) + code = 0x02; +- else if (rate % 48000 == 0) +- code = 0x04; ++ else if (rate % 32000 == 0) ++ code = 0x00; + else + return -EINVAL; + + if (rate >= 64000 && rate < 128000) + code |= 0x08; +- else if (rate >= 128000 && rate < 192000) ++ else if (rate >= 128000) + code |= 0x10; + + reg = cpu_to_le32(code); +@@ -140,7 +140,7 @@ static int latter_allocate_resources(str + if (curr_rate == rate) + break; + } +- if (count == 10) ++ if (count > 10) + return -ETIMEDOUT; + + for (i = 0; i < ARRAY_SIZE(amdtp_rate_table); ++i) { diff --git a/queue-5.4/alsa-hda-realtek-add-a-pintbl-quirk-for-several-lenovo-machines.patch b/queue-5.4/alsa-hda-realtek-add-a-pintbl-quirk-for-several-lenovo-machines.patch new file mode 100644 index 00000000000..3b2056b86fe --- /dev/null +++ b/queue-5.4/alsa-hda-realtek-add-a-pintbl-quirk-for-several-lenovo-machines.patch @@ -0,0 +1,39 @@ +From 573fcbfd319ccef26caa3700320242accea7fd5c Mon Sep 17 00:00:00 2001 +From: Hui Wang +Date: Mon, 8 Jun 2020 19:55:41 +0800 +Subject: ALSA: hda/realtek - add a pintbl quirk for several Lenovo machines + +From: Hui Wang + +commit 573fcbfd319ccef26caa3700320242accea7fd5c upstream. + +A couple of Lenovo ThinkCentre machines all have 2 front mics and they +use the same codec alc623 and have the same pin config, so add a +pintbl entry for those machines to apply the fixup +ALC283_FIXUP_HEADSET_MIC. + +Cc: +Signed-off-by: Hui Wang +Link: https://lore.kernel.org/r/20200608115541.9531-1-hui.wang@canonical.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -8156,6 +8156,12 @@ static const struct snd_hda_pin_quirk al + ALC225_STANDARD_PINS, + {0x12, 0xb7a60130}, + {0x17, 0x90170110}), ++ SND_HDA_PIN_QUIRK(0x10ec0623, 0x17aa, "Lenovo", ALC283_FIXUP_HEADSET_MIC, ++ {0x14, 0x01014010}, ++ {0x17, 0x90170120}, ++ {0x18, 0x02a11030}, ++ {0x19, 0x02a1103f}, ++ {0x21, 0x0221101f}), + {} + }; + diff --git a/queue-5.4/alsa-pcm-disallow-linking-stream-to-itself.patch b/queue-5.4/alsa-pcm-disallow-linking-stream-to-itself.patch new file mode 100644 index 00000000000..1beb4dc7794 --- /dev/null +++ b/queue-5.4/alsa-pcm-disallow-linking-stream-to-itself.patch @@ -0,0 +1,42 @@ +From 951e2736f4b11b58dc44d41964fa17c3527d882a Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Micha=C5=82=20Miros=C5=82aw?= +Date: Mon, 8 Jun 2020 18:50:39 +0200 +Subject: ALSA: pcm: disallow linking stream to itself +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michał Mirosław + +commit 951e2736f4b11b58dc44d41964fa17c3527d882a upstream. + +Prevent SNDRV_PCM_IOCTL_LINK linking stream to itself - the code +can't handle it. Fixed commit is not where bug was introduced, but +changes the context significantly. + +Cc: stable@vger.kernel.org +Fixes: 0888c321de70 ("pcm_native: switch to fdget()/fdput()") +Signed-off-by: Michał Mirosław +Link: https://lore.kernel.org/r/89c4a2487609a0ed6af3ecf01cc972bdc59a7a2d.1591634956.git.mirq-linux@rere.qmqm.pl +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/core/pcm_native.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/sound/core/pcm_native.c ++++ b/sound/core/pcm_native.c +@@ -1994,6 +1994,12 @@ static int snd_pcm_link(struct snd_pcm_s + } + pcm_file = f.file->private_data; + substream1 = pcm_file->substream; ++ ++ if (substream == substream1) { ++ res = -EINVAL; ++ goto _badf; ++ } ++ + group = kzalloc(sizeof(*group), GFP_KERNEL); + if (!group) { + res = -ENOMEM; diff --git a/queue-5.4/alsa-pcm-fix-snd_pcm_link-lockdep-splat.patch b/queue-5.4/alsa-pcm-fix-snd_pcm_link-lockdep-splat.patch new file mode 100644 index 00000000000..2e49bf143ce --- /dev/null +++ b/queue-5.4/alsa-pcm-fix-snd_pcm_link-lockdep-splat.patch @@ -0,0 +1,91 @@ +From e18035cf5cb3d2bf8e4f4d350a23608bd208b934 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Micha=C5=82=20Miros=C5=82aw?= +Date: Mon, 8 Jun 2020 12:06:32 +0200 +Subject: ALSA: pcm: fix snd_pcm_link() lockdep splat +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michał Mirosław + +commit e18035cf5cb3d2bf8e4f4d350a23608bd208b934 upstream. + +Add and use snd_pcm_stream_lock_nested() in snd_pcm_link/unlink +implementation. The code is fine, but generates a lockdep complaint: + +============================================ +WARNING: possible recursive locking detected +5.7.1mq+ #381 Tainted: G O +-------------------------------------------- +pulseaudio/4180 is trying to acquire lock: +ffff888402d6f508 (&group->lock){-...}-{2:2}, at: snd_pcm_common_ioctl+0xda8/0xee0 [snd_pcm] + +but task is already holding lock: +ffff8883f7a8cf18 (&group->lock){-...}-{2:2}, at: snd_pcm_common_ioctl+0xe4e/0xee0 [snd_pcm] + +other info that might help us debug this: + Possible unsafe locking scenario: + + CPU0 + ---- + lock(&group->lock); + lock(&group->lock); + + *** DEADLOCK *** + + May be due to missing lock nesting notation + +2 locks held by pulseaudio/4180: + #0: ffffffffa1a05190 (snd_pcm_link_rwsem){++++}-{3:3}, at: snd_pcm_common_ioctl+0xca0/0xee0 [snd_pcm] + #1: ffff8883f7a8cf18 (&group->lock){-...}-{2:2}, at: snd_pcm_common_ioctl+0xe4e/0xee0 [snd_pcm] +[...] + +Cc: stable@vger.kernel.org +Fixes: f57f3df03a8e ("ALSA: pcm: More fine-grained PCM link locking") +Signed-off-by: Michał Mirosław +Link: https://lore.kernel.org/r/37252c65941e58473b1219ca9fab03d48f47e3e3.1591610330.git.mirq-linux@rere.qmqm.pl +Signed-off-by: Greg Kroah-Hartman + +Signed-off-by: Takashi Iwai + +--- + sound/core/pcm_native.c | 14 ++++++++++++-- + 1 file changed, 12 insertions(+), 2 deletions(-) + +--- a/sound/core/pcm_native.c ++++ b/sound/core/pcm_native.c +@@ -136,6 +136,16 @@ void snd_pcm_stream_lock_irq(struct snd_ + } + EXPORT_SYMBOL_GPL(snd_pcm_stream_lock_irq); + ++static void snd_pcm_stream_lock_nested(struct snd_pcm_substream *substream) ++{ ++ struct snd_pcm_group *group = &substream->self_group; ++ ++ if (substream->pcm->nonatomic) ++ mutex_lock_nested(&group->mutex, SINGLE_DEPTH_NESTING); ++ else ++ spin_lock_nested(&group->lock, SINGLE_DEPTH_NESTING); ++} ++ + /** + * snd_pcm_stream_unlock_irq - Unlock the PCM stream + * @substream: PCM substream +@@ -2028,7 +2038,7 @@ static int snd_pcm_link(struct snd_pcm_s + snd_pcm_stream_unlock_irq(substream); + + snd_pcm_group_lock_irq(target_group, nonatomic); +- snd_pcm_stream_lock(substream1); ++ snd_pcm_stream_lock_nested(substream1); + snd_pcm_group_assign(substream1, target_group); + refcount_inc(&target_group->refs); + snd_pcm_stream_unlock(substream1); +@@ -2044,7 +2054,7 @@ static int snd_pcm_link(struct snd_pcm_s + + static void relink_to_local(struct snd_pcm_substream *substream) + { +- snd_pcm_stream_lock(substream); ++ snd_pcm_stream_lock_nested(substream); + snd_pcm_group_assign(substream, &substream->self_group); + snd_pcm_stream_unlock(substream); + } diff --git a/queue-5.4/alsa-usb-audio-add-vendor-product-and-profile-name-for-hp-thunderbolt-dock.patch b/queue-5.4/alsa-usb-audio-add-vendor-product-and-profile-name-for-hp-thunderbolt-dock.patch new file mode 100644 index 00000000000..ac394525734 --- /dev/null +++ b/queue-5.4/alsa-usb-audio-add-vendor-product-and-profile-name-for-hp-thunderbolt-dock.patch @@ -0,0 +1,52 @@ +From 0c5086f5699906ec8e31ea6509239489f060f2dc Mon Sep 17 00:00:00 2001 +From: Kai-Heng Feng +Date: Mon, 8 Jun 2020 14:26:28 +0800 +Subject: ALSA: usb-audio: Add vendor, product and profile name for HP Thunderbolt Dock + +From: Kai-Heng Feng + +commit 0c5086f5699906ec8e31ea6509239489f060f2dc upstream. + +The HP Thunderbolt Dock has two separate USB devices, one is for speaker +and one is for headset. Add names for them so userspace can apply UCM +settings. + +Signed-off-by: Kai-Heng Feng +Cc: +Link: https://lore.kernel.org/r/20200608062630.10806-1-kai.heng.feng@canonical.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/usb/quirks-table.h | 20 ++++++++++++++++++++ + 1 file changed, 20 insertions(+) + +--- a/sound/usb/quirks-table.h ++++ b/sound/usb/quirks-table.h +@@ -25,6 +25,26 @@ + .idProduct = prod, \ + .bInterfaceClass = USB_CLASS_VENDOR_SPEC + ++/* HP Thunderbolt Dock Audio Headset */ ++{ ++ USB_DEVICE(0x03f0, 0x0269), ++ .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) { ++ .vendor_name = "HP", ++ .product_name = "Thunderbolt Dock Audio Headset", ++ .profile_name = "HP-Thunderbolt-Dock-Audio-Headset", ++ .ifnum = QUIRK_NO_INTERFACE ++ } ++}, ++/* HP Thunderbolt Dock Audio Module */ ++{ ++ USB_DEVICE(0x03f0, 0x0567), ++ .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) { ++ .vendor_name = "HP", ++ .product_name = "Thunderbolt Dock Audio Module", ++ .profile_name = "HP-Thunderbolt-Dock-Audio-Module", ++ .ifnum = QUIRK_NO_INTERFACE ++ } ++}, + /* FTDI devices */ + { + USB_DEVICE(0x0403, 0xb8d8), diff --git a/queue-5.4/alsa-usb-audio-fix-inconsistent-card-pm-state-after-resume.patch b/queue-5.4/alsa-usb-audio-fix-inconsistent-card-pm-state-after-resume.patch new file mode 100644 index 00000000000..5f6f2ca32d8 --- /dev/null +++ b/queue-5.4/alsa-usb-audio-fix-inconsistent-card-pm-state-after-resume.patch @@ -0,0 +1,126 @@ +From 862b2509d157c629dd26d7ac6c6cdbf043d332eb Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Wed, 3 Jun 2020 17:37:08 +0200 +Subject: ALSA: usb-audio: Fix inconsistent card PM state after resume + +From: Takashi Iwai + +commit 862b2509d157c629dd26d7ac6c6cdbf043d332eb upstream. + +When a USB-audio interface gets runtime-suspended via auto-pm feature, +the driver suspends all functionality and increment +chip->num_suspended_intf. Later on, when the system gets suspended to +S3, the driver increments chip->num_suspended_intf again, skips the +device changes, and sets the card power state to +SNDRV_CTL_POWER_D3hot. In return, when the system gets resumed from +S3, the resume callback decrements chip->num_suspended_intf. Since +this refcount is still not zero (it's been runtime-suspended), the +whole resume is skipped. But there is a small pitfall here. + +The problem is that the driver doesn't restore the card power state +after this resume call, leaving it as SNDRV_CTL_POWER_D3hot. So, +even after the system resume finishes, the card instance still appears +as if it were system-suspended, and this confuses many ioctl accesses +that are blocked unexpectedly. + +In details, we have two issues behind the scene: one is that the card +power state is changed only when the refcount becomes zero, and +another is that the prior auto-suspend check is kept in a boolean +flag. Although the latter problem is almost negligible since the +auto-pm feature is imposed only on the primary interface, but this can +be a potential problem on the devices with multiple interfaces. + +This patch addresses those issues by the following: + +- Replace chip->autosuspended boolean flag with chip->system_suspend + counter + +- At the first system-suspend, chip->num_suspended_intf is recorded to + chip->system_suspend + +- At system-resume, the card power state is restored when the + chip->num_suspended_intf refcount reaches to chip->system_suspend, + i.e. the state returns to the auto-suspended + +Also, the patch fixes yet another hidden problem by the code +refactoring along with the fixes above: namely, when some resume +procedure failed, the driver left chip->num_suspended_intf that was +already decreased, and it might lead to the refcount unbalance. +In the new code, the refcount decrement is done after the whole resume +procedure, and the problem is avoided as well. + +Fixes: 0662292aec05 ("ALSA: usb-audio: Handle normal and auto-suspend equally") +Reported-and-tested-by: Macpaul Lin +Cc: +Link: https://lore.kernel.org/r/20200603153709.6293-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/usb/card.c | 19 ++++++++++++------- + sound/usb/usbaudio.h | 2 +- + 2 files changed, 13 insertions(+), 8 deletions(-) + +--- a/sound/usb/card.c ++++ b/sound/usb/card.c +@@ -810,9 +810,6 @@ static int usb_audio_suspend(struct usb_ + if (chip == (void *)-1L) + return 0; + +- chip->autosuspended = !!PMSG_IS_AUTO(message); +- if (!chip->autosuspended) +- snd_power_change_state(chip->card, SNDRV_CTL_POWER_D3hot); + if (!chip->num_suspended_intf++) { + list_for_each_entry(as, &chip->pcm_list, list) { + snd_usb_pcm_suspend(as); +@@ -825,6 +822,11 @@ static int usb_audio_suspend(struct usb_ + snd_usb_mixer_suspend(mixer); + } + ++ if (!PMSG_IS_AUTO(message) && !chip->system_suspend) { ++ snd_power_change_state(chip->card, SNDRV_CTL_POWER_D3hot); ++ chip->system_suspend = chip->num_suspended_intf; ++ } ++ + return 0; + } + +@@ -838,10 +840,10 @@ static int __usb_audio_resume(struct usb + + if (chip == (void *)-1L) + return 0; +- if (--chip->num_suspended_intf) +- return 0; + + atomic_inc(&chip->active); /* avoid autopm */ ++ if (chip->num_suspended_intf > 1) ++ goto out; + + list_for_each_entry(as, &chip->pcm_list, list) { + err = snd_usb_pcm_resume(as); +@@ -863,9 +865,12 @@ static int __usb_audio_resume(struct usb + snd_usbmidi_resume(p); + } + +- if (!chip->autosuspended) ++ out: ++ if (chip->num_suspended_intf == chip->system_suspend) { + snd_power_change_state(chip->card, SNDRV_CTL_POWER_D0); +- chip->autosuspended = 0; ++ chip->system_suspend = 0; ++ } ++ chip->num_suspended_intf--; + + err_out: + atomic_dec(&chip->active); /* allow autopm after this point */ +--- a/sound/usb/usbaudio.h ++++ b/sound/usb/usbaudio.h +@@ -26,7 +26,7 @@ struct snd_usb_audio { + struct usb_interface *pm_intf; + u32 usb_id; + struct mutex mutex; +- unsigned int autosuspended:1; ++ unsigned int system_suspend; + atomic_t active; + atomic_t shutdown; + atomic_t usage_count; diff --git a/queue-5.4/arm64-acpi-fix-ubsan-warning.patch b/queue-5.4/arm64-acpi-fix-ubsan-warning.patch new file mode 100644 index 00000000000..052117fe04b --- /dev/null +++ b/queue-5.4/arm64-acpi-fix-ubsan-warning.patch @@ -0,0 +1,76 @@ +From a194c33f45f83068ef13bf1d16e26d4ca3ecc098 Mon Sep 17 00:00:00 2001 +From: Nick Desaulniers +Date: Mon, 8 Jun 2020 13:38:17 -0700 +Subject: arm64: acpi: fix UBSAN warning + +From: Nick Desaulniers + +commit a194c33f45f83068ef13bf1d16e26d4ca3ecc098 upstream. + +Will reported a UBSAN warning: + +UBSAN: null-ptr-deref in arch/arm64/kernel/smp.c:596:6 +member access within null pointer of type 'struct acpi_madt_generic_interrupt' +CPU: 0 PID: 0 Comm: swapper Not tainted 5.7.0-rc6-00124-g96bc42ff0a82 #1 +Call trace: + dump_backtrace+0x0/0x384 + show_stack+0x28/0x38 + dump_stack+0xec/0x174 + handle_null_ptr_deref+0x134/0x174 + __ubsan_handle_type_mismatch_v1+0x84/0xa4 + acpi_parse_gic_cpu_interface+0x60/0xe8 + acpi_parse_entries_array+0x288/0x498 + acpi_table_parse_entries_array+0x178/0x1b4 + acpi_table_parse_madt+0xa4/0x110 + acpi_parse_and_init_cpus+0x38/0x100 + smp_init_cpus+0x74/0x258 + setup_arch+0x350/0x3ec + start_kernel+0x98/0x6f4 + +This is from the use of the ACPI_OFFSET in +arch/arm64/include/asm/acpi.h. Replace its use with offsetof from +include/linux/stddef.h which should implement the same logic using +__builtin_offsetof, so that UBSAN wont warn. + +Reported-by: Will Deacon +Suggested-by: Ard Biesheuvel +Signed-off-by: Nick Desaulniers +Reviewed-by: Jeremy Linton +Acked-by: Lorenzo Pieralisi +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/lkml/20200521100952.GA5360@willie-the-truck/ +Link: https://lore.kernel.org/r/20200608203818.189423-1-ndesaulniers@google.com +Signed-off-by: Will Deacon +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm64/include/asm/acpi.h | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/arch/arm64/include/asm/acpi.h ++++ b/arch/arm64/include/asm/acpi.h +@@ -12,6 +12,7 @@ + #include + #include + #include ++#include + + #include + #include +@@ -31,14 +32,14 @@ + * is therefore used to delimit the MADT GICC structure minimum length + * appropriately. + */ +-#define ACPI_MADT_GICC_MIN_LENGTH ACPI_OFFSET( \ ++#define ACPI_MADT_GICC_MIN_LENGTH offsetof( \ + struct acpi_madt_generic_interrupt, efficiency_class) + + #define BAD_MADT_GICC_ENTRY(entry, end) \ + (!(entry) || (entry)->header.length < ACPI_MADT_GICC_MIN_LENGTH || \ + (unsigned long)(entry) + (entry)->header.length > (end)) + +-#define ACPI_MADT_GICC_SPE (ACPI_OFFSET(struct acpi_madt_generic_interrupt, \ ++#define ACPI_MADT_GICC_SPE (offsetof(struct acpi_madt_generic_interrupt, \ + spe_interrupt) + sizeof(u16)) + + /* Basic configuration for ACPI */ diff --git a/queue-5.4/lib-lzo-fix-ambiguous-encoding-bug-in-lzo-rle.patch b/queue-5.4/lib-lzo-fix-ambiguous-encoding-bug-in-lzo-rle.patch new file mode 100644 index 00000000000..43038242ad4 --- /dev/null +++ b/queue-5.4/lib-lzo-fix-ambiguous-encoding-bug-in-lzo-rle.patch @@ -0,0 +1,97 @@ +From b5265c813ce4efbfa2e46fd27cdf9a7f44a35d2e Mon Sep 17 00:00:00 2001 +From: Dave Rodgman +Date: Thu, 11 Jun 2020 17:34:54 -0700 +Subject: lib/lzo: fix ambiguous encoding bug in lzo-rle + +From: Dave Rodgman + +commit b5265c813ce4efbfa2e46fd27cdf9a7f44a35d2e upstream. + +In some rare cases, for input data over 32 KB, lzo-rle could encode two +different inputs to the same compressed representation, so that +decompression is then ambiguous (i.e. data may be corrupted - although +zram is not affected because it operates over 4 KB pages). + +This modifies the compressor without changing the decompressor or the +bitstream format, such that: + + - there is no change to how data produced by the old compressor is + decompressed + + - an old decompressor will correctly decode data from the updated + compressor + + - performance and compression ratio are not affected + + - we avoid introducing a new bitstream format + +In testing over 12.8M real-world files totalling 903 GB, three files +were affected by this bug. I also constructed 37M semi-random 64 KB +files totalling 2.27 TB, and saw no affected files. Finally I tested +over files constructed to contain each of the ~1024 possible bad input +sequences; for all of these cases, updated lzo-rle worked correctly. + +There is no significant impact to performance or compression ratio. + +Signed-off-by: Dave Rodgman +Signed-off-by: Andrew Morton +Cc: Mark Rutland +Cc: Dave Rodgman +Cc: Willy Tarreau +Cc: Sergey Senozhatsky +Cc: Markus F.X.J. Oberhumer +Cc: Minchan Kim +Cc: Nitin Gupta +Cc: Chao Yu +Cc: +Link: http://lkml.kernel.org/r/20200507100203.29785-1-dave.rodgman@arm.com +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + Documentation/lzo.txt | 8 ++++++-- + lib/lzo/lzo1x_compress.c | 13 +++++++++++++ + 2 files changed, 19 insertions(+), 2 deletions(-) + +--- a/Documentation/lzo.txt ++++ b/Documentation/lzo.txt +@@ -159,11 +159,15 @@ Byte sequences + distance = 16384 + (H << 14) + D + state = S (copy S literals after this block) + End of stream is reached if distance == 16384 ++ In version 1 only, to prevent ambiguity with the RLE case when ++ ((distance & 0x803f) == 0x803f) && (261 <= length <= 264), the ++ compressor must not emit block copies where distance and length ++ meet these conditions. + + In version 1 only, this instruction is also used to encode a run of +- zeros if distance = 0xbfff, i.e. H = 1 and the D bits are all 1. ++ zeros if distance = 0xbfff, i.e. H = 1 and the D bits are all 1. + In this case, it is followed by a fourth byte, X. +- run length = ((X << 3) | (0 0 0 0 0 L L L)) + 4. ++ run length = ((X << 3) | (0 0 0 0 0 L L L)) + 4 + + 0 0 1 L L L L L (32..63) + Copy of small block within 16kB distance (preferably less than 34B) +--- a/lib/lzo/lzo1x_compress.c ++++ b/lib/lzo/lzo1x_compress.c +@@ -268,6 +268,19 @@ m_len_done: + *op++ = (M4_MARKER | ((m_off >> 11) & 8) + | (m_len - 2)); + else { ++ if (unlikely(((m_off & 0x403f) == 0x403f) ++ && (m_len >= 261) ++ && (m_len <= 264)) ++ && likely(bitstream_version)) { ++ // Under lzo-rle, block copies ++ // for 261 <= length <= 264 and ++ // (distance & 0x80f3) == 0x80f3 ++ // can result in ambiguous ++ // output. Adjust length ++ // to 260 to prevent ambiguity. ++ ip -= m_len - 260; ++ m_len = 260; ++ } + m_len -= M4_MAX_LEN; + *op++ = (M4_MARKER | ((m_off >> 11) & 8)); + while (unlikely(m_len > 255)) { diff --git a/queue-5.4/nilfs2-fix-null-pointer-dereference-at-nilfs_segctor_do_construct.patch b/queue-5.4/nilfs2-fix-null-pointer-dereference-at-nilfs_segctor_do_construct.patch new file mode 100644 index 00000000000..219c71ee4d2 --- /dev/null +++ b/queue-5.4/nilfs2-fix-null-pointer-dereference-at-nilfs_segctor_do_construct.patch @@ -0,0 +1,67 @@ +From 8301c719a2bd131436438e49130ee381d30933f5 Mon Sep 17 00:00:00 2001 +From: Ryusuke Konishi +Date: Wed, 10 Jun 2020 18:41:35 -0700 +Subject: nilfs2: fix null pointer dereference at nilfs_segctor_do_construct() + +From: Ryusuke Konishi + +commit 8301c719a2bd131436438e49130ee381d30933f5 upstream. + +After commit c3aab9a0bd91 ("mm/filemap.c: don't initiate writeback if +mapping has no dirty pages"), the following null pointer dereference has +been reported on nilfs2: + + BUG: kernel NULL pointer dereference, address: 00000000000000a8 + #PF: supervisor read access in kernel mode + #PF: error_code(0x0000) - not-present page + PGD 0 P4D 0 + Oops: 0000 [#1] SMP PTI + ... + RIP: 0010:percpu_counter_add_batch+0xa/0x60 + ... + Call Trace: + __test_set_page_writeback+0x2d3/0x330 + nilfs_segctor_do_construct+0x10d3/0x2110 [nilfs2] + nilfs_segctor_construct+0x168/0x260 [nilfs2] + nilfs_segctor_thread+0x127/0x3b0 [nilfs2] + kthread+0xf8/0x130 + ... + +This crash turned out to be caused by set_page_writeback() call for +segment summary buffers at nilfs_segctor_prepare_write(). + +set_page_writeback() can call inc_wb_stat(inode_to_wb(inode), +WB_WRITEBACK) where inode_to_wb(inode) is NULL if the inode of +underlying block device does not have an associated wb. + +This fixes the issue by calling inode_attach_wb() in advance to ensure +to associate the bdev inode with its wb. + +Fixes: c3aab9a0bd91 ("mm/filemap.c: don't initiate writeback if mapping has no dirty pages") +Reported-by: Walton Hoops +Reported-by: Tomas Hlavaty +Reported-by: ARAI Shun-ichi +Reported-by: Hideki EIRAKU +Signed-off-by: Ryusuke Konishi +Signed-off-by: Andrew Morton +Tested-by: Ryusuke Konishi +Cc: [5.4+] +Link: http://lkml.kernel.org/r/20200608.011819.1399059588922299158.konishi.ryusuke@gmail.com +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nilfs2/segment.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/fs/nilfs2/segment.c ++++ b/fs/nilfs2/segment.c +@@ -2780,6 +2780,8 @@ int nilfs_attach_log_writer(struct super + if (!nilfs->ns_writer) + return -ENOMEM; + ++ inode_attach_wb(nilfs->ns_bdev->bd_inode, NULL); ++ + err = nilfs_segctor_start_thread(nilfs->ns_writer); + if (err) { + kfree(nilfs->ns_writer); diff --git a/queue-5.4/pm-runtime-clk-fix-clk_pm_runtime_get-error-path.patch b/queue-5.4/pm-runtime-clk-fix-clk_pm_runtime_get-error-path.patch new file mode 100644 index 00000000000..849225b609f --- /dev/null +++ b/queue-5.4/pm-runtime-clk-fix-clk_pm_runtime_get-error-path.patch @@ -0,0 +1,42 @@ +From 64c7d7ea22d86cacb65d0c097cc447bc0e6d8abd Mon Sep 17 00:00:00 2001 +From: "Rafael J. Wysocki" +Date: Thu, 21 May 2020 19:08:09 +0200 +Subject: PM: runtime: clk: Fix clk_pm_runtime_get() error path + +From: Rafael J. Wysocki + +commit 64c7d7ea22d86cacb65d0c097cc447bc0e6d8abd upstream. + +clk_pm_runtime_get() assumes that the PM-runtime usage counter will +be dropped by pm_runtime_get_sync() on errors, which is not the case, +so PM-runtime references to devices acquired by the former are leaked +on errors returned by the latter. + +Fix this by modifying clk_pm_runtime_get() to drop the reference if +pm_runtime_get_sync() returns an error. + +Fixes: 9a34b45397e5 clk: Add support for runtime PM +Cc: 4.15+ # 4.15+ +Signed-off-by: Rafael J. Wysocki +Reviewed-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/clk/clk.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/clk/clk.c ++++ b/drivers/clk/clk.c +@@ -114,7 +114,11 @@ static int clk_pm_runtime_get(struct clk + return 0; + + ret = pm_runtime_get_sync(core->dev); +- return ret < 0 ? ret : 0; ++ if (ret < 0) { ++ pm_runtime_put_noidle(core->dev); ++ return ret; ++ } ++ return 0; + } + + static void clk_pm_runtime_put(struct clk_core *core) diff --git a/queue-5.4/series b/queue-5.4/series index 6da7c2a94f9..c6dd22a25c4 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -49,3 +49,29 @@ powerpc-ptdump-properly-handle-non-standard-page-size.patch asoc-max9867-fix-volume-controls.patch io_uring-use-kvfree-in-io_sqe_buffer_register.patch efi-efivars-add-missing-kobject_put-in-sysfs-entry-creation-error-path.patch +smb3-fix-incorrect-number-of-credits-when-ioctl-maxoutputresponse-64k.patch +smb3-add-indatalen-that-can-be-a-non-zero-value-to-calculation-of-credit-charge-in-smb2-ioctl.patch +watchdog-imx_sc_wdt-fix-reboot-on-crash.patch +alsa-es1688-add-the-missed-snd_card_free.patch +alsa-fireface-fix-configuration-error-for-nominal-sampling-transfer-frequency.patch +alsa-hda-realtek-add-a-pintbl-quirk-for-several-lenovo-machines.patch +alsa-pcm-disallow-linking-stream-to-itself.patch +alsa-pcm-fix-snd_pcm_link-lockdep-splat.patch +alsa-usb-audio-fix-inconsistent-card-pm-state-after-resume.patch +alsa-usb-audio-add-vendor-product-and-profile-name-for-hp-thunderbolt-dock.patch +acpi-sysfs-fix-reference-count-leak-in-acpi_sysfs_add_hotplug_profile.patch +acpi-cppc-fix-reference-count-leak-in-acpi_cppc_processor_probe.patch +acpi-ged-add-support-for-_exx-_lxx-handler-methods.patch +acpi-pm-avoid-using-power-resources-if-there-are-none-for-d0.patch +arm64-acpi-fix-ubsan-warning.patch +lib-lzo-fix-ambiguous-encoding-bug-in-lzo-rle.patch +nilfs2-fix-null-pointer-dereference-at-nilfs_segctor_do_construct.patch +spi-dw-fix-controller-unregister-order.patch +spi-fix-controller-unregister-order.patch +spi-pxa2xx-fix-controller-unregister-order.patch +spi-pxa2xx-fix-runtime-pm-ref-imbalance-on-probe-error.patch +spi-bcm2835-fix-controller-unregister-order.patch +spi-bcm2835aux-fix-controller-unregister-order.patch +spi-bcm-qspi-handle-clock-probe-deferral.patch +spi-bcm-qspi-when-tx-rx-buffer-is-null-set-to-0.patch +pm-runtime-clk-fix-clk_pm_runtime_get-error-path.patch diff --git a/queue-5.4/smb3-add-indatalen-that-can-be-a-non-zero-value-to-calculation-of-credit-charge-in-smb2-ioctl.patch b/queue-5.4/smb3-add-indatalen-that-can-be-a-non-zero-value-to-calculation-of-credit-charge-in-smb2-ioctl.patch new file mode 100644 index 00000000000..b3362edf282 --- /dev/null +++ b/queue-5.4/smb3-add-indatalen-that-can-be-a-non-zero-value-to-calculation-of-credit-charge-in-smb2-ioctl.patch @@ -0,0 +1,51 @@ +From ebf57440ec59a36e1fc5fe91e31d66ae0d1662d0 Mon Sep 17 00:00:00 2001 +From: Namjae Jeon +Date: Thu, 11 Jun 2020 11:21:19 +0900 +Subject: smb3: add indatalen that can be a non-zero value to calculation of credit charge in smb2 ioctl + +From: Namjae Jeon + +commit ebf57440ec59a36e1fc5fe91e31d66ae0d1662d0 upstream. + +Some of tests in xfstests failed with cifsd kernel server since commit +e80ddeb2f70e. cifsd kernel server validates credit charge from client +by calculating it base on max((InputCount + OutputCount) and +(MaxInputResponse + MaxOutputResponse)) according to specification. + +MS-SMB2 specification describe credit charge calculation of smb2 ioctl : + +If Connection.SupportsMultiCredit is TRUE, the server MUST validate +CreditCharge based on the maximum of (InputCount + OutputCount) and +(MaxInputResponse + MaxOutputResponse), as specified in section 3.3.5.2.5. +If the validation fails, it MUST fail the IOCTL request with +STATUS_INVALID_PARAMETER. + +This patch add indatalen that can be a non-zero value to calculation of +credit charge in SMB2_ioctl_init(). + +Fixes: e80ddeb2f70e ("smb3: fix incorrect number of credits when ioctl +MaxOutputResponse > 64K") +Cc: Stable +Reviewed-by: Aurelien Aptel +Cc: Steve French +Signed-off-by: Namjae Jeon +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman + +--- + fs/cifs/smb2pdu.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/fs/cifs/smb2pdu.c ++++ b/fs/cifs/smb2pdu.c +@@ -2747,7 +2747,9 @@ SMB2_ioctl_init(struct cifs_tcon *tcon, + * response size smaller. + */ + req->MaxOutputResponse = cpu_to_le32(max_response_size); +- req->sync_hdr.CreditCharge = cpu_to_le16(DIV_ROUND_UP(max_response_size, SMB2_MAX_BUFFER_SIZE)); ++ req->sync_hdr.CreditCharge = ++ cpu_to_le16(DIV_ROUND_UP(max(indatalen, max_response_size), ++ SMB2_MAX_BUFFER_SIZE)); + if (is_fsctl) + req->Flags = cpu_to_le32(SMB2_0_IOCTL_IS_FSCTL); + else diff --git a/queue-5.4/smb3-fix-incorrect-number-of-credits-when-ioctl-maxoutputresponse-64k.patch b/queue-5.4/smb3-fix-incorrect-number-of-credits-when-ioctl-maxoutputresponse-64k.patch new file mode 100644 index 00000000000..3d407ac128e --- /dev/null +++ b/queue-5.4/smb3-fix-incorrect-number-of-credits-when-ioctl-maxoutputresponse-64k.patch @@ -0,0 +1,35 @@ +From e80ddeb2f70ebd0786aa7cdba3e58bc931fa0bb5 Mon Sep 17 00:00:00 2001 +From: Steve French +Date: Wed, 3 Jun 2020 01:33:58 -0500 +Subject: smb3: fix incorrect number of credits when ioctl MaxOutputResponse > 64K + +From: Steve French + +commit e80ddeb2f70ebd0786aa7cdba3e58bc931fa0bb5 upstream. + +We were not checking to see if ioctl requests asked for more than +64K (ie when CIFSMaxBufSize was > 64K) so when setting larger +CIFSMaxBufSize then ioctls would fail with invalid parameter errors. +When requests ask for more than 64K in MaxOutputResponse then we +need to ask for more than 1 credit. + +Signed-off-by: Steve French +CC: Stable +Reviewed-by: Aurelien Aptel +Signed-off-by: Greg Kroah-Hartman + +--- + fs/cifs/smb2pdu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/cifs/smb2pdu.c ++++ b/fs/cifs/smb2pdu.c +@@ -2747,7 +2747,7 @@ SMB2_ioctl_init(struct cifs_tcon *tcon, + * response size smaller. + */ + req->MaxOutputResponse = cpu_to_le32(max_response_size); +- ++ req->sync_hdr.CreditCharge = cpu_to_le16(DIV_ROUND_UP(max_response_size, SMB2_MAX_BUFFER_SIZE)); + if (is_fsctl) + req->Flags = cpu_to_le32(SMB2_0_IOCTL_IS_FSCTL); + else diff --git a/queue-5.4/spi-bcm-qspi-handle-clock-probe-deferral.patch b/queue-5.4/spi-bcm-qspi-handle-clock-probe-deferral.patch new file mode 100644 index 00000000000..a7367dc1a71 --- /dev/null +++ b/queue-5.4/spi-bcm-qspi-handle-clock-probe-deferral.patch @@ -0,0 +1,51 @@ +From 0392727c261bab65a35cd4f82ee9459bc237591d Mon Sep 17 00:00:00 2001 +From: Florian Fainelli +Date: Mon, 20 Apr 2020 15:08:45 -0400 +Subject: spi: bcm-qspi: Handle clock probe deferral + +From: Florian Fainelli + +commit 0392727c261bab65a35cd4f82ee9459bc237591d upstream. + +The clock provider may not be ready by the time spi-bcm-qspi gets +probed, handle probe deferral using devm_clk_get_optional(). + +Signed-off-by: Florian Fainelli +Signed-off-by: Kamal Dasu +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20200420190853.45614-2-kdasu.kdev@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/spi/spi-bcm-qspi.c | 12 +++++------- + 1 file changed, 5 insertions(+), 7 deletions(-) + +--- a/drivers/spi/spi-bcm-qspi.c ++++ b/drivers/spi/spi-bcm-qspi.c +@@ -1220,6 +1220,11 @@ int bcm_qspi_probe(struct platform_devic + } + + qspi = spi_master_get_devdata(master); ++ ++ qspi->clk = devm_clk_get_optional(&pdev->dev, NULL); ++ if (IS_ERR(qspi->clk)) ++ return PTR_ERR(qspi->clk); ++ + qspi->pdev = pdev; + qspi->trans_pos.trans = NULL; + qspi->trans_pos.byte = 0; +@@ -1332,13 +1337,6 @@ int bcm_qspi_probe(struct platform_devic + qspi->soc_intc = NULL; + } + +- qspi->clk = devm_clk_get(&pdev->dev, NULL); +- if (IS_ERR(qspi->clk)) { +- dev_warn(dev, "unable to get clock\n"); +- ret = PTR_ERR(qspi->clk); +- goto qspi_probe_err; +- } +- + ret = clk_prepare_enable(qspi->clk); + if (ret) { + dev_err(dev, "failed to prepare clock\n"); diff --git a/queue-5.4/spi-bcm-qspi-when-tx-rx-buffer-is-null-set-to-0.patch b/queue-5.4/spi-bcm-qspi-when-tx-rx-buffer-is-null-set-to-0.patch new file mode 100644 index 00000000000..b3c1b01c566 --- /dev/null +++ b/queue-5.4/spi-bcm-qspi-when-tx-rx-buffer-is-null-set-to-0.patch @@ -0,0 +1,62 @@ +From 4df3bea7f9d2ddd9ac2c29ba945c7c4db2def29c Mon Sep 17 00:00:00 2001 +From: Justin Chen +Date: Mon, 20 Apr 2020 15:08:49 -0400 +Subject: spi: bcm-qspi: when tx/rx buffer is NULL set to 0 + +From: Justin Chen + +commit 4df3bea7f9d2ddd9ac2c29ba945c7c4db2def29c upstream. + +Currently we set the tx/rx buffer to 0xff when NULL. This causes +problems with some spi slaves where 0xff is a valid command. Looking +at other drivers, the tx/rx buffer is usually set to 0x00 when NULL. +Following this convention solves the issue. + +Fixes: fa236a7ef240 ("spi: bcm-qspi: Add Broadcom MSPI driver") +Signed-off-by: Justin Chen +Signed-off-by: Kamal Dasu +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20200420190853.45614-6-kdasu.kdev@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/spi/spi-bcm-qspi.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/spi/spi-bcm-qspi.c ++++ b/drivers/spi/spi-bcm-qspi.c +@@ -670,7 +670,7 @@ static void read_from_hw(struct bcm_qspi + if (buf) + buf[tp.byte] = read_rxram_slot_u8(qspi, slot); + dev_dbg(&qspi->pdev->dev, "RD %02x\n", +- buf ? buf[tp.byte] : 0xff); ++ buf ? buf[tp.byte] : 0x0); + } else { + u16 *buf = tp.trans->rx_buf; + +@@ -678,7 +678,7 @@ static void read_from_hw(struct bcm_qspi + buf[tp.byte / 2] = read_rxram_slot_u16(qspi, + slot); + dev_dbg(&qspi->pdev->dev, "RD %04x\n", +- buf ? buf[tp.byte] : 0xffff); ++ buf ? buf[tp.byte / 2] : 0x0); + } + + update_qspi_trans_byte_count(qspi, &tp, +@@ -733,13 +733,13 @@ static int write_to_hw(struct bcm_qspi * + while (!tstatus && slot < MSPI_NUM_CDRAM) { + if (tp.trans->bits_per_word <= 8) { + const u8 *buf = tp.trans->tx_buf; +- u8 val = buf ? buf[tp.byte] : 0xff; ++ u8 val = buf ? buf[tp.byte] : 0x00; + + write_txram_slot_u8(qspi, slot, val); + dev_dbg(&qspi->pdev->dev, "WR %02x\n", val); + } else { + const u16 *buf = tp.trans->tx_buf; +- u16 val = buf ? buf[tp.byte / 2] : 0xffff; ++ u16 val = buf ? buf[tp.byte / 2] : 0x0000; + + write_txram_slot_u16(qspi, slot, val); + dev_dbg(&qspi->pdev->dev, "WR %04x\n", val); diff --git a/queue-5.4/spi-bcm2835-fix-controller-unregister-order.patch b/queue-5.4/spi-bcm2835-fix-controller-unregister-order.patch new file mode 100644 index 00000000000..8e352b187f2 --- /dev/null +++ b/queue-5.4/spi-bcm2835-fix-controller-unregister-order.patch @@ -0,0 +1,62 @@ +From 9dd277ff92d06f6aa95b39936ad83981d781f49b Mon Sep 17 00:00:00 2001 +From: Lukas Wunner +Date: Fri, 15 May 2020 17:58:02 +0200 +Subject: spi: bcm2835: Fix controller unregister order + +From: Lukas Wunner + +commit 9dd277ff92d06f6aa95b39936ad83981d781f49b upstream. + +The BCM2835 SPI driver uses devm_spi_register_controller() on bind. +As a consequence, on unbind, __device_release_driver() first invokes +bcm2835_spi_remove() before unregistering the SPI controller via +devres_release_all(). + +This order is incorrect: bcm2835_spi_remove() tears down the DMA +channels and turns off the SPI controller, including its interrupts +and clock. The SPI controller is thus no longer usable. + +When the SPI controller is subsequently unregistered, it unbinds all +its slave devices. If their drivers need to access the SPI bus, +e.g. to quiesce their interrupts, unbinding will fail. + +As a rule, devm_spi_register_controller() must not be used if the +->remove() hook performs teardown steps which shall be performed +after unbinding of slaves. + +Fix by using the non-devm variant spi_register_controller(). Note that +the struct spi_controller as well as the driver-private data are not +freed until after bcm2835_spi_remove() has finished, so accessing them +is safe. + +Fixes: 247263dba208 ("spi: bcm2835: use devm_spi_register_master()") +Signed-off-by: Lukas Wunner +Cc: stable@vger.kernel.org # v3.13+ +Link: https://lore.kernel.org/r/2397dd70cdbe95e0bc4da2b9fca0f31cb94e5aed.1589557526.git.lukas@wunner.de +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/spi/spi-bcm2835.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/spi/spi-bcm2835.c ++++ b/drivers/spi/spi-bcm2835.c +@@ -1330,7 +1330,7 @@ static int bcm2835_spi_probe(struct plat + goto out_clk_disable; + } + +- err = devm_spi_register_controller(&pdev->dev, ctlr); ++ err = spi_register_controller(ctlr); + if (err) { + dev_err(&pdev->dev, "could not register SPI controller: %d\n", + err); +@@ -1355,6 +1355,8 @@ static int bcm2835_spi_remove(struct pla + + bcm2835_debugfs_remove(bs); + ++ spi_unregister_controller(ctlr); ++ + /* Clear FIFOs, and disable the HW block */ + bcm2835_wr(bs, BCM2835_SPI_CS, + BCM2835_SPI_CS_CLEAR_RX | BCM2835_SPI_CS_CLEAR_TX); diff --git a/queue-5.4/spi-bcm2835aux-fix-controller-unregister-order.patch b/queue-5.4/spi-bcm2835aux-fix-controller-unregister-order.patch new file mode 100644 index 00000000000..1d766570419 --- /dev/null +++ b/queue-5.4/spi-bcm2835aux-fix-controller-unregister-order.patch @@ -0,0 +1,62 @@ +From b9dd3f6d417258ad0beeb292a1bc74200149f15d Mon Sep 17 00:00:00 2001 +From: Lukas Wunner +Date: Fri, 15 May 2020 17:58:03 +0200 +Subject: spi: bcm2835aux: Fix controller unregister order + +From: Lukas Wunner + +commit b9dd3f6d417258ad0beeb292a1bc74200149f15d upstream. + +The BCM2835aux SPI driver uses devm_spi_register_master() on bind. +As a consequence, on unbind, __device_release_driver() first invokes +bcm2835aux_spi_remove() before unregistering the SPI controller via +devres_release_all(). + +This order is incorrect: bcm2835aux_spi_remove() turns off the SPI +controller, including its interrupts and clock. The SPI controller +is thus no longer usable. + +When the SPI controller is subsequently unregistered, it unbinds all +its slave devices. If their drivers need to access the SPI bus, +e.g. to quiesce their interrupts, unbinding will fail. + +As a rule, devm_spi_register_master() must not be used if the +->remove() hook performs teardown steps which shall be performed +after unbinding of slaves. + +Fix by using the non-devm variant spi_register_master(). Note that the +struct spi_master as well as the driver-private data are not freed until +after bcm2835aux_spi_remove() has finished, so accessing them is safe. + +Fixes: 1ea29b39f4c8 ("spi: bcm2835aux: add bcm2835 auxiliary spi device driver") +Signed-off-by: Lukas Wunner +Cc: stable@vger.kernel.org # v4.4+ +Cc: Martin Sperl +Link: https://lore.kernel.org/r/32f27f4d8242e4d75f9a53f7e8f1f77483b08669.1589557526.git.lukas@wunner.de +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/spi/spi-bcm2835aux.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/spi/spi-bcm2835aux.c ++++ b/drivers/spi/spi-bcm2835aux.c +@@ -569,7 +569,7 @@ static int bcm2835aux_spi_probe(struct p + goto out_clk_disable; + } + +- err = devm_spi_register_master(&pdev->dev, master); ++ err = spi_register_master(master); + if (err) { + dev_err(&pdev->dev, "could not register SPI master: %d\n", err); + goto out_clk_disable; +@@ -593,6 +593,8 @@ static int bcm2835aux_spi_remove(struct + + bcm2835aux_debugfs_remove(bs); + ++ spi_unregister_master(master); ++ + bcm2835aux_spi_reset_hw(bs); + + /* disable the HW block by releasing the clock */ diff --git a/queue-5.4/spi-dw-fix-controller-unregister-order.patch b/queue-5.4/spi-dw-fix-controller-unregister-order.patch new file mode 100644 index 00000000000..d9e0267700e --- /dev/null +++ b/queue-5.4/spi-dw-fix-controller-unregister-order.patch @@ -0,0 +1,65 @@ +From ca8b19d61e3fce5d2d7790cde27a0b57bcb3f341 Mon Sep 17 00:00:00 2001 +From: Lukas Wunner +Date: Mon, 25 May 2020 14:25:01 +0200 +Subject: spi: dw: Fix controller unregister order + +From: Lukas Wunner + +commit ca8b19d61e3fce5d2d7790cde27a0b57bcb3f341 upstream. + +The Designware SPI driver uses devm_spi_register_controller() on bind. +As a consequence, on unbind, __device_release_driver() first invokes +dw_spi_remove_host() before unregistering the SPI controller via +devres_release_all(). + +This order is incorrect: dw_spi_remove_host() shuts down the chip, +rendering the SPI bus inaccessible even though the SPI controller is +still registered. When the SPI controller is subsequently unregistered, +it unbinds all its slave devices. Because their drivers cannot access +the SPI bus, e.g. to quiesce interrupts, the slave devices may be left +in an improper state. + +As a rule, devm_spi_register_controller() must not be used if the +->remove() hook performs teardown steps which shall be performed after +unregistering the controller and specifically after unbinding of slaves. + +Fix by reverting to the non-devm variant of spi_register_controller(). + +An alternative approach would be to use device-managed functions for all +steps in dw_spi_remove_host(), e.g. by calling devm_add_action_or_reset() +on probe. However that approach would add more LoC to the driver and +it wouldn't lend itself as well to backporting to stable. + +Fixes: 04f421e7b0b1 ("spi: dw: use managed resources") +Signed-off-by: Lukas Wunner +Reviewed-by: Andy Shevchenko +Cc: stable@vger.kernel.org # v3.14+ +Cc: Baruch Siach +Link: https://lore.kernel.org/r/3fff8cb8ae44a9893840d0688be15bb88c090a14.1590408496.git.lukas@wunner.de +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/spi/spi-dw.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/spi/spi-dw.c ++++ b/drivers/spi/spi-dw.c +@@ -532,7 +532,7 @@ int dw_spi_add_host(struct device *dev, + } + } + +- ret = devm_spi_register_controller(dev, master); ++ ret = spi_register_controller(master); + if (ret) { + dev_err(&master->dev, "problem registering spi master\n"); + goto err_dma_exit; +@@ -556,6 +556,8 @@ void dw_spi_remove_host(struct dw_spi *d + { + dw_spi_debugfs_remove(dws); + ++ spi_unregister_controller(dws->master); ++ + if (dws->dma_ops && dws->dma_ops->dma_exit) + dws->dma_ops->dma_exit(dws); + diff --git a/queue-5.4/spi-fix-controller-unregister-order.patch b/queue-5.4/spi-fix-controller-unregister-order.patch new file mode 100644 index 00000000000..01d6a74db8a --- /dev/null +++ b/queue-5.4/spi-fix-controller-unregister-order.patch @@ -0,0 +1,51 @@ +From 84855678add8aba927faf76bc2f130a40f94b6f7 Mon Sep 17 00:00:00 2001 +From: Lukas Wunner +Date: Fri, 15 May 2020 17:58:01 +0200 +Subject: spi: Fix controller unregister order + +From: Lukas Wunner + +commit 84855678add8aba927faf76bc2f130a40f94b6f7 upstream. + +When an SPI controller unregisters, it unbinds all its slave devices. +For this, their drivers may need to access the SPI bus, e.g. to quiesce +interrupts. + +However since commit ffbbdd21329f ("spi: create a message queueing +infrastructure"), spi_destroy_queue() is executed before unbinding the +slaves. It sets ctlr->running = false, thereby preventing SPI bus +access and causing unbinding of slave devices to fail. + +Fix by unbinding slaves before calling spi_destroy_queue(). + +Fixes: ffbbdd21329f ("spi: create a message queueing infrastructure") +Signed-off-by: Lukas Wunner +Cc: stable@vger.kernel.org # v3.4+ +Cc: Linus Walleij +Link: https://lore.kernel.org/r/8aaf9d44c153fe233b17bc2dec4eb679898d7e7b.1589557526.git.lukas@wunner.de +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/spi/spi.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/spi/spi.c ++++ b/drivers/spi/spi.c +@@ -2581,6 +2581,8 @@ void spi_unregister_controller(struct sp + struct spi_controller *found; + int id = ctlr->bus_num; + ++ device_for_each_child(&ctlr->dev, NULL, __unregister); ++ + /* First make sure that this controller was ever added */ + mutex_lock(&board_lock); + found = idr_find(&spi_master_idr, id); +@@ -2593,7 +2595,6 @@ void spi_unregister_controller(struct sp + list_del(&ctlr->list); + mutex_unlock(&board_lock); + +- device_for_each_child(&ctlr->dev, NULL, __unregister); + device_unregister(&ctlr->dev); + /* free bus id */ + mutex_lock(&board_lock); diff --git a/queue-5.4/spi-pxa2xx-fix-controller-unregister-order.patch b/queue-5.4/spi-pxa2xx-fix-controller-unregister-order.patch new file mode 100644 index 00000000000..eaa5bce7f55 --- /dev/null +++ b/queue-5.4/spi-pxa2xx-fix-controller-unregister-order.patch @@ -0,0 +1,72 @@ +From 32e5b57232c0411e7dea96625c415510430ac079 Mon Sep 17 00:00:00 2001 +From: Lukas Wunner +Date: Mon, 25 May 2020 14:25:02 +0200 +Subject: spi: pxa2xx: Fix controller unregister order + +From: Lukas Wunner + +commit 32e5b57232c0411e7dea96625c415510430ac079 upstream. + +The PXA2xx SPI driver uses devm_spi_register_controller() on bind. +As a consequence, on unbind, __device_release_driver() first invokes +pxa2xx_spi_remove() before unregistering the SPI controller via +devres_release_all(). + +This order is incorrect: pxa2xx_spi_remove() disables the chip, +rendering the SPI bus inaccessible even though the SPI controller is +still registered. When the SPI controller is subsequently unregistered, +it unbinds all its slave devices. Because their drivers cannot access +the SPI bus, e.g. to quiesce interrupts, the slave devices may be left +in an improper state. + +As a rule, devm_spi_register_controller() must not be used if the +->remove() hook performs teardown steps which shall be performed after +unregistering the controller and specifically after unbinding of slaves. + +Fix by reverting to the non-devm variant of spi_register_controller(). + +An alternative approach would be to use device-managed functions for all +steps in pxa2xx_spi_remove(), e.g. by calling devm_add_action_or_reset() +on probe. However that approach would add more LoC to the driver and +it wouldn't lend itself as well to backporting to stable. + +The improper use of devm_spi_register_controller() was introduced in 2013 +by commit a807fcd090d6 ("spi: pxa2xx: use devm_spi_register_master()"), +but all earlier versions of the driver going back to 2006 were likewise +broken because they invoked spi_unregister_master() at the end of +pxa2xx_spi_remove(), rather than at the beginning. + +Fixes: e0c9905e87ac ("[PATCH] SPI: add PXA2xx SSP SPI Driver") +Signed-off-by: Lukas Wunner +Reviewed-by: Andy Shevchenko +Cc: stable@vger.kernel.org # v2.6.17+ +Cc: Tsuchiya Yuto +Link: https://bugzilla.kernel.org/show_bug.cgi?id=206403#c1 +Link: https://lore.kernel.org/r/834c446b1cf3284d2660f1bee1ebe3e737cd02a9.1590408496.git.lukas@wunner.de +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/spi/spi-pxa2xx.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/spi/spi-pxa2xx.c ++++ b/drivers/spi/spi-pxa2xx.c +@@ -1880,7 +1880,7 @@ static int pxa2xx_spi_probe(struct platf + + /* Register with the SPI framework */ + platform_set_drvdata(pdev, drv_data); +- status = devm_spi_register_controller(&pdev->dev, controller); ++ status = spi_register_controller(controller); + if (status != 0) { + dev_err(&pdev->dev, "problem registering spi controller\n"); + goto out_error_pm_runtime_enabled; +@@ -1916,6 +1916,8 @@ static int pxa2xx_spi_remove(struct plat + + pm_runtime_get_sync(&pdev->dev); + ++ spi_unregister_controller(drv_data->controller); ++ + /* Disable the SSP at the peripheral and SOC level */ + pxa2xx_spi_write(drv_data, SSCR0, 0); + clk_disable_unprepare(ssp->clk); diff --git a/queue-5.4/spi-pxa2xx-fix-runtime-pm-ref-imbalance-on-probe-error.patch b/queue-5.4/spi-pxa2xx-fix-runtime-pm-ref-imbalance-on-probe-error.patch new file mode 100644 index 00000000000..c785e8854bd --- /dev/null +++ b/queue-5.4/spi-pxa2xx-fix-runtime-pm-ref-imbalance-on-probe-error.patch @@ -0,0 +1,41 @@ +From 65e318e17358a3fd4fcb5a69d89b14016dee2f06 Mon Sep 17 00:00:00 2001 +From: Lukas Wunner +Date: Mon, 25 May 2020 14:25:03 +0200 +Subject: spi: pxa2xx: Fix runtime PM ref imbalance on probe error + +From: Lukas Wunner + +commit 65e318e17358a3fd4fcb5a69d89b14016dee2f06 upstream. + +The PXA2xx SPI driver releases a runtime PM ref in the probe error path +even though it hasn't acquired a ref earlier. + +Apparently commit e2b714afee32 ("spi: pxa2xx: Disable runtime PM if +controller registration fails") sought to copy-paste the invocation of +pm_runtime_disable() from pxa2xx_spi_remove(), but erroneously copied +the call to pm_runtime_put_noidle() as well. Drop it. + +Fixes: e2b714afee32 ("spi: pxa2xx: Disable runtime PM if controller registration fails") +Signed-off-by: Lukas Wunner +Reviewed-by: Jarkko Nikula +Reviewed-by: Andy Shevchenko +Cc: stable@vger.kernel.org # v4.17+ +Cc: Jarkko Nikula +Link: https://lore.kernel.org/r/58b2ac6942ca1f91aaeeafe512144bc5343e1d84.1590408496.git.lukas@wunner.de +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/spi/spi-pxa2xx.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/drivers/spi/spi-pxa2xx.c ++++ b/drivers/spi/spi-pxa2xx.c +@@ -1889,7 +1889,6 @@ static int pxa2xx_spi_probe(struct platf + return status; + + out_error_pm_runtime_enabled: +- pm_runtime_put_noidle(&pdev->dev); + pm_runtime_disable(&pdev->dev); + + out_error_clock_enabled: diff --git a/queue-5.4/watchdog-imx_sc_wdt-fix-reboot-on-crash.patch b/queue-5.4/watchdog-imx_sc_wdt-fix-reboot-on-crash.patch new file mode 100644 index 00000000000..bb50ae5ac62 --- /dev/null +++ b/queue-5.4/watchdog-imx_sc_wdt-fix-reboot-on-crash.patch @@ -0,0 +1,49 @@ +From e56d48e92b1017b6a8dbe64923a889283733fd96 Mon Sep 17 00:00:00 2001 +From: Fabio Estevam +Date: Sun, 12 Apr 2020 20:01:22 -0300 +Subject: watchdog: imx_sc_wdt: Fix reboot on crash + +From: Fabio Estevam + +commit e56d48e92b1017b6a8dbe64923a889283733fd96 upstream. + +Currently when running the samples/watchdog/watchdog-simple.c +application and forcing a kernel crash by doing: + +# ./watchdog-simple & +# echo c > /proc/sysrq-trigger + +The system does not reboot as expected. + +Fix it by calling imx_sc_wdt_set_timeout() to configure the i.MX8QXP +watchdog with a proper timeout. + +Cc: +Fixes: 986857acbc9a ("watchdog: imx_sc: Add i.MX system controller watchdog support") +Reported-by: Breno Lima +Signed-off-by: Fabio Estevam +Reviewed-by: Guenter Roeck +Tested-by: Breno Lima +Link: https://lore.kernel.org/r/20200412230122.5601-1-festevam@gmail.com +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/watchdog/imx_sc_wdt.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/watchdog/imx_sc_wdt.c ++++ b/drivers/watchdog/imx_sc_wdt.c +@@ -177,6 +177,11 @@ static int imx_sc_wdt_probe(struct platf + wdog->timeout = DEFAULT_TIMEOUT; + + watchdog_init_timeout(wdog, 0, dev); ++ ++ ret = imx_sc_wdt_set_timeout(wdog, wdog->timeout); ++ if (ret) ++ return ret; ++ + watchdog_stop_on_reboot(wdog); + watchdog_stop_on_unregister(wdog); +