From: Greg Kroah-Hartman Date: Mon, 23 Nov 2020 09:33:43 +0000 (+0100) Subject: 5.9-stable patches X-Git-Tag: v4.4.246~11 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=c8180fbfec1b3a9050e95ca5e2915d11d77468ed;p=thirdparty%2Fkernel%2Fstable-queue.git 5.9-stable patches added patches: acpi-fan-initialize-performance-state-sysfs-attribute.patch arm64-dts-agilex-stratix10-fix-qspi-node-compatible.patch ext4-fix-bogus-warning-in-ext4_update_dx_flag.patch iio-accel-kxcjk1013-add-support-for-kiox010a-acpi-dsm-for-setting-tablet-mode.patch iio-accel-kxcjk1013-replace-is_smo8500_device-with-an-acpi_type-enum.patch iio-adc-ingenic-fix-aux-vbat-readings-when-touchscreen-is-used.patch iio-adc-ingenic-fix-battery-vref-for-jz4770-soc.patch iio-adc-mediatek-fix-unset-field.patch iio-adc-stm32-adc-fix-a-regression-when-using-dma-and-irq.patch iio-cros_ec-use-default-frequencies-when-ec-returns-invalid-information.patch iio-imu-st_lsm6dsx-set-10ms-as-min-shub-slave-timeout.patch regulator-avoid-resolve_supply-infinite-recursion.patch regulator-fix-memory-leak-with-repeated-set_machine_constraints.patch regulator-pfuze100-limit-pfuze-support-disable-sw-to-pfuze-100-200.patch regulator-workaround-self-referent-regulators.patch serial-ar933x_uart-disable-clk-on-error-handling-path-in-probe.patch spi-bcm2835aux-fix-use-after-free-on-unbind.patch spi-introduce-device-managed-spi-controller-allocation.patch spi-lpspi-fix-use-after-free-on-unbind.patch spi-npcm-fiu-don-t-leak-spi-master-in-probe-error-path.patch xfs-fix-forkoff-miscalculation-related-to-xfs_litino-mp.patch --- diff --git a/queue-5.9/acpi-fan-initialize-performance-state-sysfs-attribute.patch b/queue-5.9/acpi-fan-initialize-performance-state-sysfs-attribute.patch new file mode 100644 index 00000000000..7c1f5bb028e --- /dev/null +++ b/queue-5.9/acpi-fan-initialize-performance-state-sysfs-attribute.patch @@ -0,0 +1,45 @@ +From 7dc7a8b04f3da8aa3c3be514e155e2fa094e976f Mon Sep 17 00:00:00 2001 +From: Guenter Roeck +Date: Tue, 10 Nov 2020 15:52:01 -0800 +Subject: ACPI: fan: Initialize performance state sysfs attribute + +From: Guenter Roeck + +commit 7dc7a8b04f3da8aa3c3be514e155e2fa094e976f upstream. + +The following warning is reported if lock debugging is enabled. + +DEBUG_LOCKS_WARN_ON(1) +WARNING: CPU: 1 PID: 1 at kernel/locking/lockdep.c:4617 lockdep_init_map_waits+0x141/0x222 +... +Call Trace: + __kernfs_create_file+0x7a/0xd8 + sysfs_add_file_mode_ns+0x135/0x189 + sysfs_create_file_ns+0x70/0xa0 + acpi_fan_probe+0x547/0x621 + platform_drv_probe+0x67/0x8b + ... + +Dynamically allocated sysfs attributes need to be initialized to avoid +the warning. + +Fixes: d19e470b6605 ("ACPI: fan: Expose fan performance state information") +Signed-off-by: Guenter Roeck +Cc: 5.6+ # 5.6+ +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/fan.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/acpi/fan.c ++++ b/drivers/acpi/fan.c +@@ -351,6 +351,7 @@ static int acpi_fan_get_fps(struct acpi_ + struct acpi_fan_fps *fps = &fan->fps[i]; + + snprintf(fps->name, ACPI_FPS_NAME_LEN, "state%d", i); ++ sysfs_attr_init(&fps->dev_attr.attr); + fps->dev_attr.show = show_state; + fps->dev_attr.store = NULL; + fps->dev_attr.attr.name = fps->name; diff --git a/queue-5.9/arm64-dts-agilex-stratix10-fix-qspi-node-compatible.patch b/queue-5.9/arm64-dts-agilex-stratix10-fix-qspi-node-compatible.patch new file mode 100644 index 00000000000..4d787d79590 --- /dev/null +++ b/queue-5.9/arm64-dts-agilex-stratix10-fix-qspi-node-compatible.patch @@ -0,0 +1,57 @@ +From f126b6702e7354d6247a36f20b9172457af5c15a Mon Sep 17 00:00:00 2001 +From: Dinh Nguyen +Date: Sun, 1 Nov 2020 14:02:56 -0600 +Subject: arm64: dts: agilex/stratix10: Fix qspi node compatible + +From: Dinh Nguyen + +commit f126b6702e7354d6247a36f20b9172457af5c15a upstream. + +The QSPI flash node needs to have the required "jedec,spi-nor" +in the compatible string. + +Fixes: 0cb140d07fc7 ("arm64: dts: stratix10: Add QSPI support for Stratix10") +Cc: stable@vger.kernel.org +Suggested-by: Vignesh Raghavendra +Signed-off-by: Dinh Nguyen +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm64/boot/dts/altera/socfpga_stratix10_socdk.dts | 2 +- + arch/arm64/boot/dts/altera/socfpga_stratix10_socdk_nand.dts | 2 +- + arch/arm64/boot/dts/intel/socfpga_agilex_socdk.dts | 2 +- + 3 files changed, 3 insertions(+), 3 deletions(-) + +--- a/arch/arm64/boot/dts/altera/socfpga_stratix10_socdk.dts ++++ b/arch/arm64/boot/dts/altera/socfpga_stratix10_socdk.dts +@@ -159,7 +159,7 @@ + flash@0 { + #address-cells = <1>; + #size-cells = <1>; +- compatible = "n25q00a"; ++ compatible = "micron,mt25qu02g", "jedec,spi-nor"; + reg = <0>; + spi-max-frequency = <100000000>; + +--- a/arch/arm64/boot/dts/altera/socfpga_stratix10_socdk_nand.dts ++++ b/arch/arm64/boot/dts/altera/socfpga_stratix10_socdk_nand.dts +@@ -192,7 +192,7 @@ + flash@0 { + #address-cells = <1>; + #size-cells = <1>; +- compatible = "n25q00a"; ++ compatible = "micron,mt25qu02g", "jedec,spi-nor"; + reg = <0>; + spi-max-frequency = <100000000>; + +--- a/arch/arm64/boot/dts/intel/socfpga_agilex_socdk.dts ++++ b/arch/arm64/boot/dts/intel/socfpga_agilex_socdk.dts +@@ -110,7 +110,7 @@ + flash@0 { + #address-cells = <1>; + #size-cells = <1>; +- compatible = "mt25qu02g"; ++ compatible = "micron,mt25qu02g", "jedec,spi-nor"; + reg = <0>; + spi-max-frequency = <100000000>; + diff --git a/queue-5.9/ext4-fix-bogus-warning-in-ext4_update_dx_flag.patch b/queue-5.9/ext4-fix-bogus-warning-in-ext4_update_dx_flag.patch new file mode 100644 index 00000000000..fd16aa5308b --- /dev/null +++ b/queue-5.9/ext4-fix-bogus-warning-in-ext4_update_dx_flag.patch @@ -0,0 +1,40 @@ +From f902b216501094495ff75834035656e8119c537f Mon Sep 17 00:00:00 2001 +From: Jan Kara +Date: Wed, 18 Nov 2020 16:30:32 +0100 +Subject: ext4: fix bogus warning in ext4_update_dx_flag() + +From: Jan Kara + +commit f902b216501094495ff75834035656e8119c537f upstream. + +The idea of the warning in ext4_update_dx_flag() is that we should warn +when we are clearing EXT4_INODE_INDEX on a filesystem with metadata +checksums enabled since after clearing the flag, checksums for internal +htree nodes will become invalid. So there's no need to warn (or actually +do anything) when EXT4_INODE_INDEX is not set. + +Link: https://lore.kernel.org/r/20201118153032.17281-1-jack@suse.cz +Fixes: 48a34311953d ("ext4: fix checksum errors with indexed dirs") +Reported-by: Eric Biggers +Reviewed-by: Eric Biggers +Signed-off-by: Jan Kara +Signed-off-by: Theodore Ts'o +Cc: stable@kernel.org +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ext4/ext4.h | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/fs/ext4/ext4.h ++++ b/fs/ext4/ext4.h +@@ -2622,7 +2622,8 @@ void ext4_insert_dentry(struct inode *in + struct ext4_filename *fname); + static inline void ext4_update_dx_flag(struct inode *inode) + { +- if (!ext4_has_feature_dir_index(inode->i_sb)) { ++ if (!ext4_has_feature_dir_index(inode->i_sb) && ++ ext4_test_inode_flag(inode, EXT4_INODE_INDEX)) { + /* ext4_iget() should have caught this... */ + WARN_ON_ONCE(ext4_has_feature_metadata_csum(inode->i_sb)); + ext4_clear_inode_flag(inode, EXT4_INODE_INDEX); diff --git a/queue-5.9/iio-accel-kxcjk1013-add-support-for-kiox010a-acpi-dsm-for-setting-tablet-mode.patch b/queue-5.9/iio-accel-kxcjk1013-add-support-for-kiox010a-acpi-dsm-for-setting-tablet-mode.patch new file mode 100644 index 00000000000..f006431fb3c --- /dev/null +++ b/queue-5.9/iio-accel-kxcjk1013-add-support-for-kiox010a-acpi-dsm-for-setting-tablet-mode.patch @@ -0,0 +1,113 @@ +From e5b1032a656e9aa4c7a4df77cb9156a2a651a5f9 Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Tue, 10 Nov 2020 14:38:35 +0100 +Subject: iio: accel: kxcjk1013: Add support for KIOX010A ACPI DSM for setting tablet-mode + +From: Hans de Goede + +commit e5b1032a656e9aa4c7a4df77cb9156a2a651a5f9 upstream. + +Some 360 degree hinges (yoga) style 2-in-1 devices use 2 KXCJ91008-s +to allow the OS to determine the angle between the display and the base +of the device, so that the OS can determine if the 2-in-1 is in laptop +or in tablet-mode. + +On Windows both accelerometers are read by a special HingeAngleService +process; and this process calls a DSM (Device Specific Method) on the +ACPI KIOX010A device node for the sensor in the display, to let the +embedded-controller (EC) know about the mode so that it can disable the +kbd and touchpad to avoid spurious input while folded into tablet-mode. + +This notifying of the EC is problematic because sometimes the EC comes up +thinking that device is in tablet-mode and the kbd and touchpad do not +work. This happens for example on Irbis NB111 devices after a suspend / +resume cycle (after a complete battery drain / hard reset without having +booted Windows at least once). Other 2-in-1s which are likely affected +too are e.g. the Teclast F5 and F6 series. + +The kxcjk-1013 driver may seem like a strange place to deal with this, +but since it is *the* driver for the ACPI KIOX010A device, it is also +the driver which has access to the ACPI handle needed by the DSM. + +Add support for calling the DSM and on probe unconditionally tell the +EC that the device is laptop mode, fixing the kbd and touchpad sometimes +not working. + +Fixes: 7f6232e69539 ("iio: accel: kxcjk1013: Add KIOX010A ACPI Hardware-ID") +Reported-and-tested-by: russianneuromancer +Signed-off-by: Hans de Goede +Cc: +Link: https://lore.kernel.org/r/20201110133835.129080-3-hdegoede@redhat.com +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/accel/kxcjk-1013.c | 36 ++++++++++++++++++++++++++++++++++++ + 1 file changed, 36 insertions(+) + +--- a/drivers/iio/accel/kxcjk-1013.c ++++ b/drivers/iio/accel/kxcjk-1013.c +@@ -129,6 +129,7 @@ enum kx_chipset { + enum kx_acpi_type { + ACPI_GENERIC, + ACPI_SMO8500, ++ ACPI_KIOX010A, + }; + + struct kxcjk1013_data { +@@ -275,6 +276,32 @@ static const struct { + {19163, 1, 0}, + {38326, 0, 1} }; + ++#ifdef CONFIG_ACPI ++enum kiox010a_fn_index { ++ KIOX010A_SET_LAPTOP_MODE = 1, ++ KIOX010A_SET_TABLET_MODE = 2, ++}; ++ ++static int kiox010a_dsm(struct device *dev, int fn_index) ++{ ++ acpi_handle handle = ACPI_HANDLE(dev); ++ guid_t kiox010a_dsm_guid; ++ union acpi_object *obj; ++ ++ if (!handle) ++ return -ENODEV; ++ ++ guid_parse("1f339696-d475-4e26-8cad-2e9f8e6d7a91", &kiox010a_dsm_guid); ++ ++ obj = acpi_evaluate_dsm(handle, &kiox010a_dsm_guid, 1, fn_index, NULL); ++ if (!obj) ++ return -EIO; ++ ++ ACPI_FREE(obj); ++ return 0; ++} ++#endif ++ + static int kxcjk1013_set_mode(struct kxcjk1013_data *data, + enum kxcjk1013_mode mode) + { +@@ -352,6 +379,13 @@ static int kxcjk1013_chip_init(struct kx + { + int ret; + ++#ifdef CONFIG_ACPI ++ if (data->acpi_type == ACPI_KIOX010A) { ++ /* Make sure the kbd and touchpad on 2-in-1s using 2 KXCJ91008-s work */ ++ kiox010a_dsm(&data->client->dev, KIOX010A_SET_LAPTOP_MODE); ++ } ++#endif ++ + ret = i2c_smbus_read_byte_data(data->client, KXCJK1013_REG_WHO_AM_I); + if (ret < 0) { + dev_err(&data->client->dev, "Error reading who_am_i\n"); +@@ -1262,6 +1296,8 @@ static const char *kxcjk1013_match_acpi_ + + if (strcmp(id->id, "SMO8500") == 0) + *acpi_type = ACPI_SMO8500; ++ else if (strcmp(id->id, "KIOX010A") == 0) ++ *acpi_type = ACPI_KIOX010A; + + *chipset = (enum kx_chipset)id->driver_data; + diff --git a/queue-5.9/iio-accel-kxcjk1013-replace-is_smo8500_device-with-an-acpi_type-enum.patch b/queue-5.9/iio-accel-kxcjk1013-replace-is_smo8500_device-with-an-acpi_type-enum.patch new file mode 100644 index 00000000000..f0c1b7888bf --- /dev/null +++ b/queue-5.9/iio-accel-kxcjk1013-replace-is_smo8500_device-with-an-acpi_type-enum.patch @@ -0,0 +1,87 @@ +From 11e94f28c3de35d5ad1ac6a242a5b30f4378991a Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Tue, 10 Nov 2020 14:38:34 +0100 +Subject: iio: accel: kxcjk1013: Replace is_smo8500_device with an acpi_type enum + +From: Hans de Goede + +commit 11e94f28c3de35d5ad1ac6a242a5b30f4378991a upstream. + +Replace the boolean is_smo8500_device variable with an acpi_type enum. + +For now this can be either ACPI_GENERIC or ACPI_SMO8500, this is a +preparation patch for adding special handling for the KIOX010A ACPI HID, +which will add a ACPI_KIOX010A acpi_type to the introduced enum. + +For stable as needed as precursor for next patch. + +Signed-off-by: Hans de Goede +Fixes: 7f6232e69539 ("iio: accel: kxcjk1013: Add KIOX010A ACPI Hardware-ID") +Cc: +Link: https://lore.kernel.org/r/20201110133835.129080-2-hdegoede@redhat.com +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/accel/kxcjk-1013.c | 15 ++++++++++----- + 1 file changed, 10 insertions(+), 5 deletions(-) + +--- a/drivers/iio/accel/kxcjk-1013.c ++++ b/drivers/iio/accel/kxcjk-1013.c +@@ -126,6 +126,11 @@ enum kx_chipset { + KX_MAX_CHIPS /* this must be last */ + }; + ++enum kx_acpi_type { ++ ACPI_GENERIC, ++ ACPI_SMO8500, ++}; ++ + struct kxcjk1013_data { + struct i2c_client *client; + struct iio_trigger *dready_trig; +@@ -143,7 +148,7 @@ struct kxcjk1013_data { + bool motion_trigger_on; + int64_t timestamp; + enum kx_chipset chipset; +- bool is_smo8500_device; ++ enum kx_acpi_type acpi_type; + }; + + enum kxcjk1013_axis { +@@ -1247,7 +1252,7 @@ static irqreturn_t kxcjk1013_data_rdy_tr + + static const char *kxcjk1013_match_acpi_device(struct device *dev, + enum kx_chipset *chipset, +- bool *is_smo8500_device) ++ enum kx_acpi_type *acpi_type) + { + const struct acpi_device_id *id; + +@@ -1256,7 +1261,7 @@ static const char *kxcjk1013_match_acpi_ + return NULL; + + if (strcmp(id->id, "SMO8500") == 0) +- *is_smo8500_device = true; ++ *acpi_type = ACPI_SMO8500; + + *chipset = (enum kx_chipset)id->driver_data; + +@@ -1299,7 +1304,7 @@ static int kxcjk1013_probe(struct i2c_cl + } else if (ACPI_HANDLE(&client->dev)) { + name = kxcjk1013_match_acpi_device(&client->dev, + &data->chipset, +- &data->is_smo8500_device); ++ &data->acpi_type); + } else + return -ENODEV; + +@@ -1316,7 +1321,7 @@ static int kxcjk1013_probe(struct i2c_cl + indio_dev->modes = INDIO_DIRECT_MODE; + indio_dev->info = &kxcjk1013_info; + +- if (client->irq > 0 && !data->is_smo8500_device) { ++ if (client->irq > 0 && data->acpi_type != ACPI_SMO8500) { + ret = devm_request_threaded_irq(&client->dev, client->irq, + kxcjk1013_data_rdy_trig_poll, + kxcjk1013_event_handler, diff --git a/queue-5.9/iio-adc-ingenic-fix-aux-vbat-readings-when-touchscreen-is-used.patch b/queue-5.9/iio-adc-ingenic-fix-aux-vbat-readings-when-touchscreen-is-used.patch new file mode 100644 index 00000000000..a4949acbc5d --- /dev/null +++ b/queue-5.9/iio-adc-ingenic-fix-aux-vbat-readings-when-touchscreen-is-used.patch @@ -0,0 +1,97 @@ +From 6d6aa2907d59ddd3c0ebb2b93e1ddc84e474485b Mon Sep 17 00:00:00 2001 +From: Paul Cercueil +Date: Tue, 3 Nov 2020 20:12:38 +0000 +Subject: iio/adc: ingenic: Fix AUX/VBAT readings when touchscreen is used + +From: Paul Cercueil + +commit 6d6aa2907d59ddd3c0ebb2b93e1ddc84e474485b upstream. + +When the command feature of the ADC is used, it is possible to program +the ADC, and specify at each step what input should be processed, and in +comparison to what reference. + +This broke the AUX and battery readings when the touchscreen was +enabled, most likely because the CMD feature would change the VREF all +the time. + +Now, when AUX or battery are read, we temporarily disable the CMD +feature, which means that we won't get touchscreen readings in that time +frame. But it now gives correct values for AUX / battery, and the +touchscreen isn't disabled for long enough to be an actual issue. + +Fixes: b96952f498db ("IIO: Ingenic JZ47xx: Add touchscreen mode.") +Signed-off-by: Paul Cercueil +Acked-by: Artur Rojek +Cc: +Link: https://lore.kernel.org/r/20201103201238.161083-1-paul@crapouillou.net +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/adc/ingenic-adc.c | 32 ++++++++++++++++++++++++++------ + 1 file changed, 26 insertions(+), 6 deletions(-) + +--- a/drivers/iio/adc/ingenic-adc.c ++++ b/drivers/iio/adc/ingenic-adc.c +@@ -177,13 +177,12 @@ static void ingenic_adc_set_config(struc + mutex_unlock(&adc->lock); + } + +-static void ingenic_adc_enable(struct ingenic_adc *adc, +- int engine, +- bool enabled) ++static void ingenic_adc_enable_unlocked(struct ingenic_adc *adc, ++ int engine, ++ bool enabled) + { + u8 val; + +- mutex_lock(&adc->lock); + val = readb(adc->base + JZ_ADC_REG_ENABLE); + + if (enabled) +@@ -192,20 +191,41 @@ static void ingenic_adc_enable(struct in + val &= ~BIT(engine); + + writeb(val, adc->base + JZ_ADC_REG_ENABLE); ++} ++ ++static void ingenic_adc_enable(struct ingenic_adc *adc, ++ int engine, ++ bool enabled) ++{ ++ mutex_lock(&adc->lock); ++ ingenic_adc_enable_unlocked(adc, engine, enabled); + mutex_unlock(&adc->lock); + } + + static int ingenic_adc_capture(struct ingenic_adc *adc, + int engine) + { ++ u32 cfg; + u8 val; + int ret; + +- ingenic_adc_enable(adc, engine, true); ++ /* ++ * Disable CMD_SEL temporarily, because it causes wrong VBAT readings, ++ * probably due to the switch of VREF. We must keep the lock here to ++ * avoid races with the buffer enable/disable functions. ++ */ ++ mutex_lock(&adc->lock); ++ cfg = readl(adc->base + JZ_ADC_REG_CFG); ++ writel(cfg & ~JZ_ADC_REG_CFG_CMD_SEL, adc->base + JZ_ADC_REG_CFG); ++ ++ ingenic_adc_enable_unlocked(adc, engine, true); + ret = readb_poll_timeout(adc->base + JZ_ADC_REG_ENABLE, val, + !(val & BIT(engine)), 250, 1000); + if (ret) +- ingenic_adc_enable(adc, engine, false); ++ ingenic_adc_enable_unlocked(adc, engine, false); ++ ++ writel(cfg, adc->base + JZ_ADC_REG_CFG); ++ mutex_unlock(&adc->lock); + + return ret; + } diff --git a/queue-5.9/iio-adc-ingenic-fix-battery-vref-for-jz4770-soc.patch b/queue-5.9/iio-adc-ingenic-fix-battery-vref-for-jz4770-soc.patch new file mode 100644 index 00000000000..486841dfd41 --- /dev/null +++ b/queue-5.9/iio-adc-ingenic-fix-battery-vref-for-jz4770-soc.patch @@ -0,0 +1,36 @@ +From c91ebcc578e09783cfa4d85c1b437790f140f29a Mon Sep 17 00:00:00 2001 +From: Paul Cercueil +Date: Wed, 4 Nov 2020 19:28:43 +0000 +Subject: iio/adc: ingenic: Fix battery VREF for JZ4770 SoC + +From: Paul Cercueil + +commit c91ebcc578e09783cfa4d85c1b437790f140f29a upstream. + +The reference voltage for the battery is clearly marked as 1.2V in the +programming manual. With this fixed, the battery channel now returns +correct values. + +Fixes: a515d6488505 ("IIO: Ingenic JZ47xx: Add support for JZ4770 SoC ADC.") +Signed-off-by: Paul Cercueil +Acked-by: Artur Rojek +Cc: +Link: https://lore.kernel.org/r/20201104192843.67187-1-paul@crapouillou.net +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/adc/ingenic-adc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iio/adc/ingenic-adc.c ++++ b/drivers/iio/adc/ingenic-adc.c +@@ -71,7 +71,7 @@ + #define JZ4725B_ADC_BATTERY_HIGH_VREF_BITS 10 + #define JZ4740_ADC_BATTERY_HIGH_VREF (7500 * 0.986) + #define JZ4740_ADC_BATTERY_HIGH_VREF_BITS 12 +-#define JZ4770_ADC_BATTERY_VREF 6600 ++#define JZ4770_ADC_BATTERY_VREF 1200 + #define JZ4770_ADC_BATTERY_VREF_BITS 12 + + #define JZ_ADC_IRQ_AUX BIT(0) diff --git a/queue-5.9/iio-adc-mediatek-fix-unset-field.patch b/queue-5.9/iio-adc-mediatek-fix-unset-field.patch new file mode 100644 index 00000000000..7acb0df2a6c --- /dev/null +++ b/queue-5.9/iio-adc-mediatek-fix-unset-field.patch @@ -0,0 +1,48 @@ +From 15207a92e019803d62687455d8aa2ff9eb3dc82c Mon Sep 17 00:00:00 2001 +From: Fabien Parent +Date: Sun, 18 Oct 2020 21:46:44 +0200 +Subject: iio: adc: mediatek: fix unset field + +From: Fabien Parent + +commit 15207a92e019803d62687455d8aa2ff9eb3dc82c upstream. + +dev_comp field is used in a couple of places but it is never set. This +results in kernel oops when dereferencing a NULL pointer. Set the +`dev_comp` field correctly in the probe function. + +Fixes: 6d97024dce23 ("iio: adc: mediatek: mt6577-auxadc, add mt6765 support") +Signed-off-by: Fabien Parent +Reviewed-by: Matthias Brugger +Cc: +Link: https://lore.kernel.org/r/20201018194644.3366846-1-fparent@baylibre.com +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/adc/mt6577_auxadc.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/iio/adc/mt6577_auxadc.c ++++ b/drivers/iio/adc/mt6577_auxadc.c +@@ -9,9 +9,9 @@ + #include + #include + #include +-#include +-#include ++#include + #include ++#include + #include + #include + #include +@@ -276,6 +276,8 @@ static int mt6577_auxadc_probe(struct pl + goto err_disable_clk; + } + ++ adc_dev->dev_comp = device_get_match_data(&pdev->dev); ++ + mutex_init(&adc_dev->lock); + + mt6577_auxadc_mod_reg(adc_dev->reg_base + MT6577_AUXADC_MISC, diff --git a/queue-5.9/iio-adc-stm32-adc-fix-a-regression-when-using-dma-and-irq.patch b/queue-5.9/iio-adc-stm32-adc-fix-a-regression-when-using-dma-and-irq.patch new file mode 100644 index 00000000000..05542c521b9 --- /dev/null +++ b/queue-5.9/iio-adc-stm32-adc-fix-a-regression-when-using-dma-and-irq.patch @@ -0,0 +1,253 @@ +From 695e2f5c289bb7f8b85351dcfa35fa236e0200a4 Mon Sep 17 00:00:00 2001 +From: Olivier Moysan +Date: Wed, 21 Oct 2020 10:53:13 +0200 +Subject: iio: adc: stm32-adc: fix a regression when using dma and irq + +From: Olivier Moysan + +commit 695e2f5c289bb7f8b85351dcfa35fa236e0200a4 upstream. + +Since overrun interrupt support has been added, there's a regression when +two ADCs are used at the same time, with: +- an ADC configured to use IRQs. EOCIE bit is set. The handler is normally + called in this case. +- an ADC configured to use DMA. EOCIE bit isn't set. EOC triggers the DMA + request. It's then automatically cleared by DMA read. But the handler + gets called due to status bit is temporarily set (IRQ triggered by the + other ADC). + +This is a regression as similar issue had been fixed earlier by +commit dcb10920179a ("iio: adc: stm32-adc: +fix a race when using several adcs with dma and irq"). +Issue is that stm32_adc_eoc_enabled() returns non-zero value (always) +since OVR bit has been added and enabled for both DMA and IRQ case. + +Remove OVR mask in IER register, and rely only on CSR status for overrun. +To avoid subsequent calls to interrupt routine on overrun, CSR OVR bit has +to be cleared. CSR OVR bit cannot be cleared directly by software. +To do this ADC must be stopped first, and OVR bit in ADC ISR has +to be cleared. +Also add a check in ADC IRQ handler to report spurious IRQs. + +Fixes: cc06e67d8fa5 ("iio: adc: stm32-adc: Add check on overrun interrupt") +Signed-off-by: Olivier Moysan +Signed-off-by: Fabrice Gasnier +Cc: +Link: https://lore.kernel.org/r/20201021085313.5335-1-olivier.moysan@st.com +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/adc/stm32-adc-core.c | 41 +++++++++++++------------------ + drivers/iio/adc/stm32-adc.c | 50 +++++++++++++++++++++++++++++++++++++-- + 2 files changed, 65 insertions(+), 26 deletions(-) + +--- a/drivers/iio/adc/stm32-adc-core.c ++++ b/drivers/iio/adc/stm32-adc-core.c +@@ -41,18 +41,16 @@ + * struct stm32_adc_common_regs - stm32 common registers + * @csr: common status register offset + * @ccr: common control register offset +- * @eoc1_msk: adc1 end of conversion flag in @csr +- * @eoc2_msk: adc2 end of conversion flag in @csr +- * @eoc3_msk: adc3 end of conversion flag in @csr ++ * @eoc_msk: array of eoc (end of conversion flag) masks in csr for adc1..n ++ * @ovr_msk: array of ovr (overrun flag) masks in csr for adc1..n + * @ier: interrupt enable register offset for each adc + * @eocie_msk: end of conversion interrupt enable mask in @ier + */ + struct stm32_adc_common_regs { + u32 csr; + u32 ccr; +- u32 eoc1_msk; +- u32 eoc2_msk; +- u32 eoc3_msk; ++ u32 eoc_msk[STM32_ADC_MAX_ADCS]; ++ u32 ovr_msk[STM32_ADC_MAX_ADCS]; + u32 ier; + u32 eocie_msk; + }; +@@ -282,21 +280,20 @@ out: + static const struct stm32_adc_common_regs stm32f4_adc_common_regs = { + .csr = STM32F4_ADC_CSR, + .ccr = STM32F4_ADC_CCR, +- .eoc1_msk = STM32F4_EOC1 | STM32F4_OVR1, +- .eoc2_msk = STM32F4_EOC2 | STM32F4_OVR2, +- .eoc3_msk = STM32F4_EOC3 | STM32F4_OVR3, ++ .eoc_msk = { STM32F4_EOC1, STM32F4_EOC2, STM32F4_EOC3}, ++ .ovr_msk = { STM32F4_OVR1, STM32F4_OVR2, STM32F4_OVR3}, + .ier = STM32F4_ADC_CR1, +- .eocie_msk = STM32F4_EOCIE | STM32F4_OVRIE, ++ .eocie_msk = STM32F4_EOCIE, + }; + + /* STM32H7 common registers definitions */ + static const struct stm32_adc_common_regs stm32h7_adc_common_regs = { + .csr = STM32H7_ADC_CSR, + .ccr = STM32H7_ADC_CCR, +- .eoc1_msk = STM32H7_EOC_MST | STM32H7_OVR_MST, +- .eoc2_msk = STM32H7_EOC_SLV | STM32H7_OVR_SLV, ++ .eoc_msk = { STM32H7_EOC_MST, STM32H7_EOC_SLV}, ++ .ovr_msk = { STM32H7_OVR_MST, STM32H7_OVR_SLV}, + .ier = STM32H7_ADC_IER, +- .eocie_msk = STM32H7_EOCIE | STM32H7_OVRIE, ++ .eocie_msk = STM32H7_EOCIE, + }; + + static const unsigned int stm32_adc_offset[STM32_ADC_MAX_ADCS] = { +@@ -318,6 +315,7 @@ static void stm32_adc_irq_handler(struct + { + struct stm32_adc_priv *priv = irq_desc_get_handler_data(desc); + struct irq_chip *chip = irq_desc_get_chip(desc); ++ int i; + u32 status; + + chained_irq_enter(chip, desc); +@@ -335,17 +333,12 @@ static void stm32_adc_irq_handler(struct + * before invoking the interrupt handler (e.g. call ISR only for + * IRQ-enabled ADCs). + */ +- if (status & priv->cfg->regs->eoc1_msk && +- stm32_adc_eoc_enabled(priv, 0)) +- generic_handle_irq(irq_find_mapping(priv->domain, 0)); +- +- if (status & priv->cfg->regs->eoc2_msk && +- stm32_adc_eoc_enabled(priv, 1)) +- generic_handle_irq(irq_find_mapping(priv->domain, 1)); +- +- if (status & priv->cfg->regs->eoc3_msk && +- stm32_adc_eoc_enabled(priv, 2)) +- generic_handle_irq(irq_find_mapping(priv->domain, 2)); ++ for (i = 0; i < priv->cfg->num_irqs; i++) { ++ if ((status & priv->cfg->regs->eoc_msk[i] && ++ stm32_adc_eoc_enabled(priv, i)) || ++ (status & priv->cfg->regs->ovr_msk[i])) ++ generic_handle_irq(irq_find_mapping(priv->domain, i)); ++ } + + chained_irq_exit(chip, desc); + }; +--- a/drivers/iio/adc/stm32-adc.c ++++ b/drivers/iio/adc/stm32-adc.c +@@ -154,6 +154,7 @@ struct stm32_adc; + * @start_conv: routine to start conversions + * @stop_conv: routine to stop conversions + * @unprepare: optional unprepare routine (disable, power-down) ++ * @irq_clear: routine to clear irqs + * @smp_cycles: programmable sampling time (ADC clock cycles) + */ + struct stm32_adc_cfg { +@@ -166,6 +167,7 @@ struct stm32_adc_cfg { + void (*start_conv)(struct iio_dev *, bool dma); + void (*stop_conv)(struct iio_dev *); + void (*unprepare)(struct iio_dev *); ++ void (*irq_clear)(struct iio_dev *indio_dev, u32 msk); + const unsigned int *smp_cycles; + }; + +@@ -621,6 +623,13 @@ static void stm32f4_adc_stop_conv(struct + STM32F4_ADON | STM32F4_DMA | STM32F4_DDS); + } + ++static void stm32f4_adc_irq_clear(struct iio_dev *indio_dev, u32 msk) ++{ ++ struct stm32_adc *adc = iio_priv(indio_dev); ++ ++ stm32_adc_clr_bits(adc, adc->cfg->regs->isr_eoc.reg, msk); ++} ++ + static void stm32h7_adc_start_conv(struct iio_dev *indio_dev, bool dma) + { + struct stm32_adc *adc = iio_priv(indio_dev); +@@ -659,6 +668,13 @@ static void stm32h7_adc_stop_conv(struct + stm32_adc_clr_bits(adc, STM32H7_ADC_CFGR, STM32H7_DMNGT_MASK); + } + ++static void stm32h7_adc_irq_clear(struct iio_dev *indio_dev, u32 msk) ++{ ++ struct stm32_adc *adc = iio_priv(indio_dev); ++ /* On STM32H7 IRQs are cleared by writing 1 into ISR register */ ++ stm32_adc_set_bits(adc, adc->cfg->regs->isr_eoc.reg, msk); ++} ++ + static int stm32h7_adc_exit_pwr_down(struct iio_dev *indio_dev) + { + struct stm32_adc *adc = iio_priv(indio_dev); +@@ -1235,17 +1251,40 @@ static int stm32_adc_read_raw(struct iio + } + } + ++static void stm32_adc_irq_clear(struct iio_dev *indio_dev, u32 msk) ++{ ++ struct stm32_adc *adc = iio_priv(indio_dev); ++ ++ adc->cfg->irq_clear(indio_dev, msk); ++} ++ + static irqreturn_t stm32_adc_threaded_isr(int irq, void *data) + { + struct iio_dev *indio_dev = data; + struct stm32_adc *adc = iio_priv(indio_dev); + const struct stm32_adc_regspec *regs = adc->cfg->regs; + u32 status = stm32_adc_readl(adc, regs->isr_eoc.reg); ++ u32 mask = stm32_adc_readl(adc, regs->ier_eoc.reg); + +- if (status & regs->isr_ovr.mask) ++ /* Check ovr status right now, as ovr mask should be already disabled */ ++ if (status & regs->isr_ovr.mask) { ++ /* ++ * Clear ovr bit to avoid subsequent calls to IRQ handler. ++ * This requires to stop ADC first. OVR bit state in ISR, ++ * is propaged to CSR register by hardware. ++ */ ++ adc->cfg->stop_conv(indio_dev); ++ stm32_adc_irq_clear(indio_dev, regs->isr_ovr.mask); + dev_err(&indio_dev->dev, "Overrun, stopping: restart needed\n"); ++ return IRQ_HANDLED; ++ } + +- return IRQ_HANDLED; ++ if (!(status & mask)) ++ dev_err_ratelimited(&indio_dev->dev, ++ "Unexpected IRQ: IER=0x%08x, ISR=0x%08x\n", ++ mask, status); ++ ++ return IRQ_NONE; + } + + static irqreturn_t stm32_adc_isr(int irq, void *data) +@@ -1254,6 +1293,10 @@ static irqreturn_t stm32_adc_isr(int irq + struct stm32_adc *adc = iio_priv(indio_dev); + const struct stm32_adc_regspec *regs = adc->cfg->regs; + u32 status = stm32_adc_readl(adc, regs->isr_eoc.reg); ++ u32 mask = stm32_adc_readl(adc, regs->ier_eoc.reg); ++ ++ if (!(status & mask)) ++ return IRQ_WAKE_THREAD; + + if (status & regs->isr_ovr.mask) { + /* +@@ -2050,6 +2093,7 @@ static const struct stm32_adc_cfg stm32f + .start_conv = stm32f4_adc_start_conv, + .stop_conv = stm32f4_adc_stop_conv, + .smp_cycles = stm32f4_adc_smp_cycles, ++ .irq_clear = stm32f4_adc_irq_clear, + }; + + static const struct stm32_adc_cfg stm32h7_adc_cfg = { +@@ -2061,6 +2105,7 @@ static const struct stm32_adc_cfg stm32h + .prepare = stm32h7_adc_prepare, + .unprepare = stm32h7_adc_unprepare, + .smp_cycles = stm32h7_adc_smp_cycles, ++ .irq_clear = stm32h7_adc_irq_clear, + }; + + static const struct stm32_adc_cfg stm32mp1_adc_cfg = { +@@ -2073,6 +2118,7 @@ static const struct stm32_adc_cfg stm32m + .prepare = stm32h7_adc_prepare, + .unprepare = stm32h7_adc_unprepare, + .smp_cycles = stm32h7_adc_smp_cycles, ++ .irq_clear = stm32h7_adc_irq_clear, + }; + + static const struct of_device_id stm32_adc_of_match[] = { diff --git a/queue-5.9/iio-cros_ec-use-default-frequencies-when-ec-returns-invalid-information.patch b/queue-5.9/iio-cros_ec-use-default-frequencies-when-ec-returns-invalid-information.patch new file mode 100644 index 00000000000..a6beba2d0d3 --- /dev/null +++ b/queue-5.9/iio-cros_ec-use-default-frequencies-when-ec-returns-invalid-information.patch @@ -0,0 +1,59 @@ +From 56e4f2dda23c6d39d327944faa89efaa4eb290d1 Mon Sep 17 00:00:00 2001 +From: Gwendal Grignou +Date: Tue, 30 Jun 2020 08:37:30 -0700 +Subject: iio: cros_ec: Use default frequencies when EC returns invalid information + +From: Gwendal Grignou + +commit 56e4f2dda23c6d39d327944faa89efaa4eb290d1 upstream. + +Minimal and maximal frequencies supported by a sensor is queried. +On some older machines, these frequencies are not returned properly and +the EC returns 0 instead. +When returned maximal frequency is 0, ignore the information and use +default frequencies instead. + +Fixes: ae7b02ad2f32 ("iio: common: cros_ec_sensors: Expose cros_ec_sensors frequency range via iio sysfs") +Signed-off-by: Gwendal Grignou +Reviewed-by: Enric Balletbo i Serra +Link: https://lore.kernel.org/r/20200630153730.3302889-1-gwendal@chromium.org +CC: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/common/cros_ec_sensors/cros_ec_sensors_core.c | 16 +++++++++----- + 1 file changed, 11 insertions(+), 5 deletions(-) + +--- a/drivers/iio/common/cros_ec_sensors/cros_ec_sensors_core.c ++++ b/drivers/iio/common/cros_ec_sensors/cros_ec_sensors_core.c +@@ -255,7 +255,7 @@ int cros_ec_sensors_core_init(struct pla + struct cros_ec_sensorhub *sensor_hub = dev_get_drvdata(dev->parent); + struct cros_ec_dev *ec = sensor_hub->ec; + struct cros_ec_sensor_platform *sensor_platform = dev_get_platdata(dev); +- u32 ver_mask; ++ u32 ver_mask, temp; + int frequencies[ARRAY_SIZE(state->frequencies) / 2] = { 0 }; + int ret, i; + +@@ -310,10 +310,16 @@ int cros_ec_sensors_core_init(struct pla + &frequencies[2], + &state->fifo_max_event_count); + } else { +- frequencies[1] = state->resp->info_3.min_frequency; +- frequencies[2] = state->resp->info_3.max_frequency; +- state->fifo_max_event_count = +- state->resp->info_3.fifo_max_event_count; ++ if (state->resp->info_3.max_frequency == 0) { ++ get_default_min_max_freq(state->resp->info.type, ++ &frequencies[1], ++ &frequencies[2], ++ &temp); ++ } else { ++ frequencies[1] = state->resp->info_3.min_frequency; ++ frequencies[2] = state->resp->info_3.max_frequency; ++ } ++ state->fifo_max_event_count = state->resp->info_3.fifo_max_event_count; + } + for (i = 0; i < ARRAY_SIZE(frequencies); i++) { + state->frequencies[2 * i] = frequencies[i] / 1000; diff --git a/queue-5.9/iio-imu-st_lsm6dsx-set-10ms-as-min-shub-slave-timeout.patch b/queue-5.9/iio-imu-st_lsm6dsx-set-10ms-as-min-shub-slave-timeout.patch new file mode 100644 index 00000000000..3ff893cef54 --- /dev/null +++ b/queue-5.9/iio-imu-st_lsm6dsx-set-10ms-as-min-shub-slave-timeout.patch @@ -0,0 +1,46 @@ +From fe0b980ffd1dd8b10c09f82385514819ba2a661d Mon Sep 17 00:00:00 2001 +From: Lorenzo Bianconi +Date: Sun, 1 Nov 2020 17:21:18 +0100 +Subject: iio: imu: st_lsm6dsx: set 10ms as min shub slave timeout + +From: Lorenzo Bianconi + +commit fe0b980ffd1dd8b10c09f82385514819ba2a661d upstream. + +Set 10ms as minimum i2c slave configuration timeout since st_lsm6dsx +relies on accel ODR for i2c master clock and at high sample rates +(e.g. 833Hz or 416Hz) the slave sensor occasionally may need more cycles +than i2c master timeout (2s/833Hz + 1 ~ 3ms) to apply the configuration +resulting in an uncomplete slave configuration and a constant reading +from the i2c slave connected to st_lsm6dsx i2c master. + +Fixes: 8f9a5249e3d9 ("iio: imu: st_lsm6dsx: enable 833Hz sample frequency for tagged sensors") +Fixes: c91c1c844ebd ("iio: imu: st_lsm6dsx: add i2c embedded controller support") +Signed-off-by: Lorenzo Bianconi +Cc: +Link: https://lore.kernel.org/r/a69c8236bf16a1569966815ed71710af2722ed7d.1604247274.git.lorenzo@kernel.org +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_shub.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_shub.c ++++ b/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_shub.c +@@ -156,11 +156,13 @@ static const struct st_lsm6dsx_ext_dev_s + static void st_lsm6dsx_shub_wait_complete(struct st_lsm6dsx_hw *hw) + { + struct st_lsm6dsx_sensor *sensor; +- u32 odr; ++ u32 odr, timeout; + + sensor = iio_priv(hw->iio_devs[ST_LSM6DSX_ID_ACC]); + odr = (hw->enable_mask & BIT(ST_LSM6DSX_ID_ACC)) ? sensor->odr : 12500; +- msleep((2000000U / odr) + 1); ++ /* set 10ms as minimum timeout for i2c slave configuration */ ++ timeout = max_t(u32, 2000000U / odr + 1, 10); ++ msleep(timeout); + } + + /* diff --git a/queue-5.9/regulator-avoid-resolve_supply-infinite-recursion.patch b/queue-5.9/regulator-avoid-resolve_supply-infinite-recursion.patch new file mode 100644 index 00000000000..f03e1cc4b22 --- /dev/null +++ b/queue-5.9/regulator-avoid-resolve_supply-infinite-recursion.patch @@ -0,0 +1,45 @@ +From 4b639e254d3d4f15ee4ff2b890a447204cfbeea9 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Micha=C5=82=20Miros=C5=82aw?= +Date: Fri, 13 Nov 2020 01:20:28 +0100 +Subject: regulator: avoid resolve_supply() infinite recursion +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michał Mirosław + +commit 4b639e254d3d4f15ee4ff2b890a447204cfbeea9 upstream. + +When a regulator's name equals its supply's name the +regulator_resolve_supply() recurses indefinitely. Add a check +so that debugging the problem is easier. The "fixed" commit +just exposed the problem. + +Fixes: aea6cb99703e ("regulator: resolve supply after creating regulator") +Cc: stable@vger.kernel.org +Reported-by: Ahmad Fatoum +Signed-off-by: Michał Mirosław +Tested-by: Ahmad Fatoum # stpmic1 +Link: https://lore.kernel.org/r/c6171057cfc0896f950c4d8cb82df0f9f1b89ad9.1605226675.git.mirq-linux@rere.qmqm.pl +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/regulator/core.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/regulator/core.c ++++ b/drivers/regulator/core.c +@@ -1805,6 +1805,12 @@ static int regulator_resolve_supply(stru + } + } + ++ if (r == rdev) { ++ dev_err(dev, "Supply for %s (%s) resolved to itself\n", ++ rdev->desc->name, rdev->supply_name); ++ return -EINVAL; ++ } ++ + /* + * If the supply's parent device is not the same as the + * regulator's parent device, then ensure the parent device diff --git a/queue-5.9/regulator-fix-memory-leak-with-repeated-set_machine_constraints.patch b/queue-5.9/regulator-fix-memory-leak-with-repeated-set_machine_constraints.patch new file mode 100644 index 00000000000..0a6cc4637f9 --- /dev/null +++ b/queue-5.9/regulator-fix-memory-leak-with-repeated-set_machine_constraints.patch @@ -0,0 +1,105 @@ +From 57a6ad482af256b2a13de14194fb8f67c1a65f10 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Micha=C5=82=20Miros=C5=82aw?= +Date: Fri, 13 Nov 2020 01:20:27 +0100 +Subject: regulator: fix memory leak with repeated set_machine_constraints() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michał Mirosław + +commit 57a6ad482af256b2a13de14194fb8f67c1a65f10 upstream. + +Fixed commit introduced a possible second call to +set_machine_constraints() and that allocates memory for +rdev->constraints. Move the allocation to the caller so +it's easier to manage and done once. + +Fixes: aea6cb99703e ("regulator: resolve supply after creating regulator") +Cc: stable@vger.kernel.org +Signed-off-by: Michał Mirosław +Tested-by: Ahmad Fatoum # stpmic1 +Link: https://lore.kernel.org/r/78c3d4016cebc08d441aad18cb924b4e4d9cf9df.1605226675.git.mirq-linux@rere.qmqm.pl +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/regulator/core.c | 29 +++++++++++++---------------- + 1 file changed, 13 insertions(+), 16 deletions(-) + +--- a/drivers/regulator/core.c ++++ b/drivers/regulator/core.c +@@ -1280,7 +1280,6 @@ static int _regulator_do_enable(struct r + /** + * set_machine_constraints - sets regulator constraints + * @rdev: regulator source +- * @constraints: constraints to apply + * + * Allows platform initialisation code to define and constrain + * regulator circuits e.g. valid voltage/current ranges, etc. NOTE: +@@ -1288,21 +1287,11 @@ static int _regulator_do_enable(struct r + * regulator operations to proceed i.e. set_voltage, set_current_limit, + * set_mode. + */ +-static int set_machine_constraints(struct regulator_dev *rdev, +- const struct regulation_constraints *constraints) ++static int set_machine_constraints(struct regulator_dev *rdev) + { + int ret = 0; + const struct regulator_ops *ops = rdev->desc->ops; + +- if (constraints) +- rdev->constraints = kmemdup(constraints, sizeof(*constraints), +- GFP_KERNEL); +- else +- rdev->constraints = kzalloc(sizeof(*constraints), +- GFP_KERNEL); +- if (!rdev->constraints) +- return -ENOMEM; +- + ret = machine_constraints_voltage(rdev, rdev->constraints); + if (ret != 0) + return ret; +@@ -5112,7 +5101,6 @@ struct regulator_dev * + regulator_register(const struct regulator_desc *regulator_desc, + const struct regulator_config *cfg) + { +- const struct regulation_constraints *constraints = NULL; + const struct regulator_init_data *init_data; + struct regulator_config *config = NULL; + static atomic_t regulator_no = ATOMIC_INIT(-1); +@@ -5251,14 +5239,23 @@ regulator_register(const struct regulato + + /* set regulator constraints */ + if (init_data) +- constraints = &init_data->constraints; ++ rdev->constraints = kmemdup(&init_data->constraints, ++ sizeof(*rdev->constraints), ++ GFP_KERNEL); ++ else ++ rdev->constraints = kzalloc(sizeof(*rdev->constraints), ++ GFP_KERNEL); ++ if (!rdev->constraints) { ++ ret = -ENOMEM; ++ goto wash; ++ } + + if (init_data && init_data->supply_regulator) + rdev->supply_name = init_data->supply_regulator; + else if (regulator_desc->supply_name) + rdev->supply_name = regulator_desc->supply_name; + +- ret = set_machine_constraints(rdev, constraints); ++ ret = set_machine_constraints(rdev); + if (ret == -EPROBE_DEFER) { + /* Regulator might be in bypass mode and so needs its supply + * to set the constraints */ +@@ -5267,7 +5264,7 @@ regulator_register(const struct regulato + * that is just being created */ + ret = regulator_resolve_supply(rdev); + if (!ret) +- ret = set_machine_constraints(rdev, constraints); ++ ret = set_machine_constraints(rdev); + else + rdev_dbg(rdev, "unable to resolve supply early: %pe\n", + ERR_PTR(ret)); diff --git a/queue-5.9/regulator-pfuze100-limit-pfuze-support-disable-sw-to-pfuze-100-200.patch b/queue-5.9/regulator-pfuze100-limit-pfuze-support-disable-sw-to-pfuze-100-200.patch new file mode 100644 index 00000000000..6723ac9c601 --- /dev/null +++ b/queue-5.9/regulator-pfuze100-limit-pfuze-support-disable-sw-to-pfuze-100-200.patch @@ -0,0 +1,48 @@ +From 365ec8b61689bd64d6a61e129e0319bf71336407 Mon Sep 17 00:00:00 2001 +From: Sean Nyekjaer +Date: Tue, 10 Nov 2020 18:41:13 +0100 +Subject: regulator: pfuze100: limit pfuze-support-disable-sw to pfuze{100,200} + +From: Sean Nyekjaer + +commit 365ec8b61689bd64d6a61e129e0319bf71336407 upstream. + +Limit the fsl,pfuze-support-disable-sw to the pfuze100 and pfuze200 +variants. +When enabling fsl,pfuze-support-disable-sw and using a pfuze3000 or +pfuze3001, the driver would choose pfuze100_sw_disable_regulator_ops +instead of the newly introduced and correct pfuze3000_sw_regulator_ops. + +Signed-off-by: Sean Nyekjaer +Fixes: 6f1cf5257acc ("regualtor: pfuze100: correct sw1a/sw2 on pfuze3000") +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20201110174113.2066534-1-sean@geanix.com +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/regulator/pfuze100-regulator.c | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +--- a/drivers/regulator/pfuze100-regulator.c ++++ b/drivers/regulator/pfuze100-regulator.c +@@ -836,11 +836,14 @@ static int pfuze100_regulator_probe(stru + * the switched regulator till yet. + */ + if (pfuze_chip->flags & PFUZE_FLAG_DISABLE_SW) { +- if (pfuze_chip->regulator_descs[i].sw_reg) { +- desc->ops = &pfuze100_sw_disable_regulator_ops; +- desc->enable_val = 0x8; +- desc->disable_val = 0x0; +- desc->enable_time = 500; ++ if (pfuze_chip->chip_id == PFUZE100 || ++ pfuze_chip->chip_id == PFUZE200) { ++ if (pfuze_chip->regulator_descs[i].sw_reg) { ++ desc->ops = &pfuze100_sw_disable_regulator_ops; ++ desc->enable_val = 0x8; ++ desc->disable_val = 0x0; ++ desc->enable_time = 500; ++ } + } + } + diff --git a/queue-5.9/regulator-workaround-self-referent-regulators.patch b/queue-5.9/regulator-workaround-self-referent-regulators.patch new file mode 100644 index 00000000000..9c122fca47f --- /dev/null +++ b/queue-5.9/regulator-workaround-self-referent-regulators.patch @@ -0,0 +1,44 @@ +From f5c042b23f7429e5c2ac987b01a31c69059a978b Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Micha=C5=82=20Miros=C5=82aw?= +Date: Fri, 13 Nov 2020 01:20:28 +0100 +Subject: regulator: workaround self-referent regulators +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michał Mirosław + +commit f5c042b23f7429e5c2ac987b01a31c69059a978b upstream. + +Workaround regulators whose supply name happens to be the same as its +own name. This fixes boards that used to work before the early supply +resolving was removed. The error message is left in place so that +offending drivers can be detected. + +Fixes: aea6cb99703e ("regulator: resolve supply after creating regulator") +Cc: stable@vger.kernel.org +Reported-by: Ahmad Fatoum +Signed-off-by: Michał Mirosław +Tested-by: Ahmad Fatoum # stpmic1 +Link: https://lore.kernel.org/r/d703acde2a93100c3c7a81059d716c50ad1b1f52.1605226675.git.mirq-linux@rere.qmqm.pl +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/regulator/core.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/regulator/core.c ++++ b/drivers/regulator/core.c +@@ -1808,7 +1808,10 @@ static int regulator_resolve_supply(stru + if (r == rdev) { + dev_err(dev, "Supply for %s (%s) resolved to itself\n", + rdev->desc->name, rdev->supply_name); +- return -EINVAL; ++ if (!have_full_constraints()) ++ return -EINVAL; ++ r = dummy_regulator_rdev; ++ get_device(&r->dev); + } + + /* diff --git a/queue-5.9/serial-ar933x_uart-disable-clk-on-error-handling-path-in-probe.patch b/queue-5.9/serial-ar933x_uart-disable-clk-on-error-handling-path-in-probe.patch new file mode 100644 index 00000000000..a8659173333 --- /dev/null +++ b/queue-5.9/serial-ar933x_uart-disable-clk-on-error-handling-path-in-probe.patch @@ -0,0 +1,38 @@ +From 425af483523b76bc78e14674a430579d38b2a593 Mon Sep 17 00:00:00 2001 +From: Zheng Zengkai +Date: Wed, 11 Nov 2020 20:44:26 +0800 +Subject: serial: ar933x_uart: disable clk on error handling path in probe + +From: Zheng Zengkai + +commit 425af483523b76bc78e14674a430579d38b2a593 upstream. + +ar933x_uart_probe() does not invoke clk_disable_unprepare() +on one error handling path. This patch fixes that. + +Fixes: 9be1064fe524 ("serial: ar933x_uart: add RS485 support") +Reported-by: Hulk Robot +Signed-off-by: Zheng Zengkai +Link: https://lore.kernel.org/r/20201111124426.42638-1-zhengzengkai@huawei.com +Cc: stable +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/serial/ar933x_uart.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/tty/serial/ar933x_uart.c ++++ b/drivers/tty/serial/ar933x_uart.c +@@ -789,8 +789,10 @@ static int ar933x_uart_probe(struct plat + goto err_disable_clk; + + up->gpios = mctrl_gpio_init(port, 0); +- if (IS_ERR(up->gpios) && PTR_ERR(up->gpios) != -ENOSYS) +- return PTR_ERR(up->gpios); ++ if (IS_ERR(up->gpios) && PTR_ERR(up->gpios) != -ENOSYS) { ++ ret = PTR_ERR(up->gpios); ++ goto err_disable_clk; ++ } + + up->rts_gpiod = mctrl_gpio_to_gpiod(up->gpios, UART_GPIO_RTS); + diff --git a/queue-5.9/series b/queue-5.9/series index bbd252ee500..fe8338585a9 100644 --- a/queue-5.9/series +++ b/queue-5.9/series @@ -202,3 +202,24 @@ efivarfs-fix-memory-leak-in-efivarfs_create.patch staging-rtl8723bs-add-024c-0627-to-the-list-of-sdio-device-ids.patch staging-mt7621-pci-avoid-to-request-pci-bus-resources.patch iio-light-fix-kconfig-dependency-bug-for-vcnl4035.patch +ext4-fix-bogus-warning-in-ext4_update_dx_flag.patch +xfs-fix-forkoff-miscalculation-related-to-xfs_litino-mp.patch +acpi-fan-initialize-performance-state-sysfs-attribute.patch +iio-accel-kxcjk1013-replace-is_smo8500_device-with-an-acpi_type-enum.patch +iio-accel-kxcjk1013-add-support-for-kiox010a-acpi-dsm-for-setting-tablet-mode.patch +iio-adc-mediatek-fix-unset-field.patch +iio-cros_ec-use-default-frequencies-when-ec-returns-invalid-information.patch +iio-imu-st_lsm6dsx-set-10ms-as-min-shub-slave-timeout.patch +iio-adc-ingenic-fix-aux-vbat-readings-when-touchscreen-is-used.patch +iio-adc-ingenic-fix-battery-vref-for-jz4770-soc.patch +iio-adc-stm32-adc-fix-a-regression-when-using-dma-and-irq.patch +serial-ar933x_uart-disable-clk-on-error-handling-path-in-probe.patch +arm64-dts-agilex-stratix10-fix-qspi-node-compatible.patch +spi-lpspi-fix-use-after-free-on-unbind.patch +spi-introduce-device-managed-spi-controller-allocation.patch +spi-npcm-fiu-don-t-leak-spi-master-in-probe-error-path.patch +spi-bcm2835aux-fix-use-after-free-on-unbind.patch +regulator-pfuze100-limit-pfuze-support-disable-sw-to-pfuze-100-200.patch +regulator-fix-memory-leak-with-repeated-set_machine_constraints.patch +regulator-avoid-resolve_supply-infinite-recursion.patch +regulator-workaround-self-referent-regulators.patch diff --git a/queue-5.9/spi-bcm2835aux-fix-use-after-free-on-unbind.patch b/queue-5.9/spi-bcm2835aux-fix-use-after-free-on-unbind.patch new file mode 100644 index 00000000000..638f7a1994a --- /dev/null +++ b/queue-5.9/spi-bcm2835aux-fix-use-after-free-on-unbind.patch @@ -0,0 +1,85 @@ +From e13ee6cc4781edaf8c7321bee19217e3702ed481 Mon Sep 17 00:00:00 2001 +From: Lukas Wunner +Date: Wed, 11 Nov 2020 20:07:30 +0100 +Subject: spi: bcm2835aux: Fix use-after-free on unbind + +From: Lukas Wunner + +commit e13ee6cc4781edaf8c7321bee19217e3702ed481 upstream. + +bcm2835aux_spi_remove() accesses the driver's private data after calling +spi_unregister_master() even though that function releases the last +reference on the spi_master and thereby frees the private data. + +Fix by switching over to the new devm_spi_alloc_master() helper which +keeps the private data accessible until the driver has unbound. + +Fixes: b9dd3f6d4172 ("spi: bcm2835aux: Fix controller unregister order") +Signed-off-by: Lukas Wunner +Cc: # v4.4+: 123456789abc: spi: Introduce device-managed SPI controller allocation +Cc: # v4.4+: b9dd3f6d4172: spi: bcm2835aux: Fix controller unregister order +Cc: # v4.4+ +Link: https://lore.kernel.org/r/b290b06357d0c0bdee9cecc539b840a90630f101.1605121038.git.lukas@wunner.de +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/spi/spi-bcm2835aux.c | 21 +++++++-------------- + 1 file changed, 7 insertions(+), 14 deletions(-) + +--- a/drivers/spi/spi-bcm2835aux.c ++++ b/drivers/spi/spi-bcm2835aux.c +@@ -494,7 +494,7 @@ static int bcm2835aux_spi_probe(struct p + unsigned long clk_hz; + int err; + +- master = spi_alloc_master(&pdev->dev, sizeof(*bs)); ++ master = devm_spi_alloc_master(&pdev->dev, sizeof(*bs)); + if (!master) + return -ENOMEM; + +@@ -524,29 +524,24 @@ static int bcm2835aux_spi_probe(struct p + + /* the main area */ + bs->regs = devm_platform_ioremap_resource(pdev, 0); +- if (IS_ERR(bs->regs)) { +- err = PTR_ERR(bs->regs); +- goto out_master_put; +- } ++ if (IS_ERR(bs->regs)) ++ return PTR_ERR(bs->regs); + + bs->clk = devm_clk_get(&pdev->dev, NULL); + if (IS_ERR(bs->clk)) { +- err = PTR_ERR(bs->clk); + dev_err(&pdev->dev, "could not get clk: %d\n", err); +- goto out_master_put; ++ return PTR_ERR(bs->clk); + } + + bs->irq = platform_get_irq(pdev, 0); +- if (bs->irq <= 0) { +- err = bs->irq ? bs->irq : -ENODEV; +- goto out_master_put; +- } ++ if (bs->irq <= 0) ++ return bs->irq ? bs->irq : -ENODEV; + + /* this also enables the HW block */ + err = clk_prepare_enable(bs->clk); + if (err) { + dev_err(&pdev->dev, "could not prepare clock: %d\n", err); +- goto out_master_put; ++ return err; + } + + /* just checking if the clock returns a sane value */ +@@ -581,8 +576,6 @@ static int bcm2835aux_spi_probe(struct p + + out_clk_disable: + clk_disable_unprepare(bs->clk); +-out_master_put: +- spi_master_put(master); + return err; + } + diff --git a/queue-5.9/spi-introduce-device-managed-spi-controller-allocation.patch b/queue-5.9/spi-introduce-device-managed-spi-controller-allocation.patch new file mode 100644 index 00000000000..7754c15f7d6 --- /dev/null +++ b/queue-5.9/spi-introduce-device-managed-spi-controller-allocation.patch @@ -0,0 +1,168 @@ +From 5e844cc37a5cbaa460e68f9a989d321d63088a89 Mon Sep 17 00:00:00 2001 +From: Lukas Wunner +Date: Wed, 11 Nov 2020 20:07:10 +0100 +Subject: spi: Introduce device-managed SPI controller allocation + +From: Lukas Wunner + +commit 5e844cc37a5cbaa460e68f9a989d321d63088a89 upstream. + +SPI driver probing currently comprises two steps, whereas removal +comprises only one step: + + spi_alloc_master() + spi_register_controller() + + spi_unregister_controller() + +That's because spi_unregister_controller() calls device_unregister() +instead of device_del(), thereby releasing the reference on the +spi_controller which was obtained by spi_alloc_master(). + +An SPI driver's private data is contained in the same memory allocation +as the spi_controller struct. Thus, once spi_unregister_controller() +has been called, the private data is inaccessible. But some drivers +need to access it after spi_unregister_controller() to perform further +teardown steps. + +Introduce devm_spi_alloc_master() and devm_spi_alloc_slave(), which +release a reference on the spi_controller struct only after the driver +has unbound, thereby keeping the memory allocation accessible. Change +spi_unregister_controller() to not release a reference if the +spi_controller was allocated by one of these new devm functions. + +The present commit is small enough to be backportable to stable. +It allows fixing drivers which use the private data in their ->remove() +hook after it's been freed. It also allows fixing drivers which neglect +to release a reference on the spi_controller in the probe error path. + +Long-term, most SPI drivers shall be moved over to the devm functions +introduced herein. The few that can't shall be changed in a treewide +commit to explicitly release the last reference on the controller. +That commit shall amend spi_unregister_controller() to no longer release +a reference, thereby completing the migration. + +As a result, the behaviour will be less surprising and more consistent +with subsystems such as IIO, which also includes the private data in the +allocation of the generic iio_dev struct, but calls device_del() in +iio_device_unregister(). + +Signed-off-by: Lukas Wunner +Link: https://lore.kernel.org/r/272bae2ef08abd21388c98e23729886663d19192.1605121038.git.lukas@wunner.de +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/spi/spi.c | 58 +++++++++++++++++++++++++++++++++++++++++++++++- + include/linux/spi/spi.h | 19 +++++++++++++++ + 2 files changed, 76 insertions(+), 1 deletion(-) + +--- a/drivers/spi/spi.c ++++ b/drivers/spi/spi.c +@@ -2442,6 +2442,49 @@ struct spi_controller *__spi_alloc_contr + } + EXPORT_SYMBOL_GPL(__spi_alloc_controller); + ++static void devm_spi_release_controller(struct device *dev, void *ctlr) ++{ ++ spi_controller_put(*(struct spi_controller **)ctlr); ++} ++ ++/** ++ * __devm_spi_alloc_controller - resource-managed __spi_alloc_controller() ++ * @dev: physical device of SPI controller ++ * @size: how much zeroed driver-private data to allocate ++ * @slave: whether to allocate an SPI master (false) or SPI slave (true) ++ * Context: can sleep ++ * ++ * Allocate an SPI controller and automatically release a reference on it ++ * when @dev is unbound from its driver. Drivers are thus relieved from ++ * having to call spi_controller_put(). ++ * ++ * The arguments to this function are identical to __spi_alloc_controller(). ++ * ++ * Return: the SPI controller structure on success, else NULL. ++ */ ++struct spi_controller *__devm_spi_alloc_controller(struct device *dev, ++ unsigned int size, ++ bool slave) ++{ ++ struct spi_controller **ptr, *ctlr; ++ ++ ptr = devres_alloc(devm_spi_release_controller, sizeof(*ptr), ++ GFP_KERNEL); ++ if (!ptr) ++ return NULL; ++ ++ ctlr = __spi_alloc_controller(dev, size, slave); ++ if (ctlr) { ++ *ptr = ctlr; ++ devres_add(dev, ptr); ++ } else { ++ devres_free(ptr); ++ } ++ ++ return ctlr; ++} ++EXPORT_SYMBOL_GPL(__devm_spi_alloc_controller); ++ + #ifdef CONFIG_OF + static int of_spi_get_gpio_numbers(struct spi_controller *ctlr) + { +@@ -2778,6 +2821,11 @@ int devm_spi_register_controller(struct + } + EXPORT_SYMBOL_GPL(devm_spi_register_controller); + ++static int devm_spi_match_controller(struct device *dev, void *res, void *ctlr) ++{ ++ return *(struct spi_controller **)res == ctlr; ++} ++ + static int __unregister(struct device *dev, void *null) + { + spi_unregister_device(to_spi_device(dev)); +@@ -2819,7 +2867,15 @@ void spi_unregister_controller(struct sp + list_del(&ctlr->list); + mutex_unlock(&board_lock); + +- device_unregister(&ctlr->dev); ++ device_del(&ctlr->dev); ++ ++ /* Release the last reference on the controller if its driver ++ * has not yet been converted to devm_spi_alloc_master/slave(). ++ */ ++ if (!devres_find(ctlr->dev.parent, devm_spi_release_controller, ++ devm_spi_match_controller, ctlr)) ++ put_device(&ctlr->dev); ++ + /* free bus id */ + mutex_lock(&board_lock); + if (found == ctlr) +--- a/include/linux/spi/spi.h ++++ b/include/linux/spi/spi.h +@@ -734,6 +734,25 @@ static inline struct spi_controller *spi + return __spi_alloc_controller(host, size, true); + } + ++struct spi_controller *__devm_spi_alloc_controller(struct device *dev, ++ unsigned int size, ++ bool slave); ++ ++static inline struct spi_controller *devm_spi_alloc_master(struct device *dev, ++ unsigned int size) ++{ ++ return __devm_spi_alloc_controller(dev, size, false); ++} ++ ++static inline struct spi_controller *devm_spi_alloc_slave(struct device *dev, ++ unsigned int size) ++{ ++ if (!IS_ENABLED(CONFIG_SPI_SLAVE)) ++ return NULL; ++ ++ return __devm_spi_alloc_controller(dev, size, true); ++} ++ + extern int spi_register_controller(struct spi_controller *ctlr); + extern int devm_spi_register_controller(struct device *dev, + struct spi_controller *ctlr); diff --git a/queue-5.9/spi-lpspi-fix-use-after-free-on-unbind.patch b/queue-5.9/spi-lpspi-fix-use-after-free-on-unbind.patch new file mode 100644 index 00000000000..d7c453ea64c --- /dev/null +++ b/queue-5.9/spi-lpspi-fix-use-after-free-on-unbind.patch @@ -0,0 +1,46 @@ +From 4def49da620c84a682d9361d6bef0a97eed46fe0 Mon Sep 17 00:00:00 2001 +From: Lukas Wunner +Date: Sun, 8 Nov 2020 23:41:00 +0100 +Subject: spi: lpspi: Fix use-after-free on unbind + +From: Lukas Wunner + +commit 4def49da620c84a682d9361d6bef0a97eed46fe0 upstream. + +Normally the last reference on an spi_controller is released by +spi_unregister_controller(). In the case of the i.MX lpspi driver, +the spi_controller is registered with devm_spi_register_controller(), +so spi_unregister_controller() is invoked automatically after the driver +has unbound. + +However the driver already releases the last reference in +fsl_lpspi_remove() through a gratuitous call to spi_master_put(), +causing a use-after-free when spi_unregister_controller() is +subsequently invoked by the devres framework. + +Fix by dropping the superfluous spi_master_put(). + +Fixes: 944c01a889d9 ("spi: lpspi: enable runtime pm for lpspi") +Signed-off-by: Lukas Wunner +Cc: # v5.2+ +Cc: Han Xu +Link: https://lore.kernel.org/r/ab3c0b18bd820501a12c85e440006e09ec0e275f.1604874488.git.lukas@wunner.de +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/spi/spi-fsl-lpspi.c | 3 --- + 1 file changed, 3 deletions(-) + +--- a/drivers/spi/spi-fsl-lpspi.c ++++ b/drivers/spi/spi-fsl-lpspi.c +@@ -938,9 +938,6 @@ static int fsl_lpspi_remove(struct platf + spi_controller_get_devdata(controller); + + pm_runtime_disable(fsl_lpspi->dev); +- +- spi_master_put(controller); +- + return 0; + } + diff --git a/queue-5.9/spi-npcm-fiu-don-t-leak-spi-master-in-probe-error-path.patch b/queue-5.9/spi-npcm-fiu-don-t-leak-spi-master-in-probe-error-path.patch new file mode 100644 index 00000000000..c881985d693 --- /dev/null +++ b/queue-5.9/spi-npcm-fiu-don-t-leak-spi-master-in-probe-error-path.patch @@ -0,0 +1,40 @@ +From 04a9cd51d3f3308a98cbc6adc07acb12fbade011 Mon Sep 17 00:00:00 2001 +From: Lukas Wunner +Date: Mon, 16 Nov 2020 09:23:10 +0100 +Subject: spi: npcm-fiu: Don't leak SPI master in probe error path + +From: Lukas Wunner + +commit 04a9cd51d3f3308a98cbc6adc07acb12fbade011 upstream. + +If the calls to of_match_device(), of_alias_get_id(), +devm_ioremap_resource(), devm_regmap_init_mmio() or devm_clk_get() +fail on probe of the NPCM FIU SPI driver, the spi_controller struct is +erroneously not freed. + +Fix by switching over to the new devm_spi_alloc_master() helper. + +Fixes: ace55c411b11 ("spi: npcm-fiu: add NPCM FIU controller driver") +Signed-off-by: Lukas Wunner +Cc: # v5.4+: 5e844cc37a5c: spi: Introduce device-managed SPI controller allocation +Cc: # v5.4+ +Cc: Tomer Maimon +Link: https://lore.kernel.org/r/a420c23a363a3bc9aa684c6e790c32a8af106d17.1605512876.git.lukas@wunner.de +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/spi/spi-npcm-fiu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/spi/spi-npcm-fiu.c ++++ b/drivers/spi/spi-npcm-fiu.c +@@ -680,7 +680,7 @@ static int npcm_fiu_probe(struct platfor + int ret; + int id; + +- ctrl = spi_alloc_master(dev, sizeof(*fiu)); ++ ctrl = devm_spi_alloc_master(dev, sizeof(*fiu)); + if (!ctrl) + return -ENOMEM; + diff --git a/queue-5.9/xfs-fix-forkoff-miscalculation-related-to-xfs_litino-mp.patch b/queue-5.9/xfs-fix-forkoff-miscalculation-related-to-xfs_litino-mp.patch new file mode 100644 index 00000000000..72732973b5d --- /dev/null +++ b/queue-5.9/xfs-fix-forkoff-miscalculation-related-to-xfs_litino-mp.patch @@ -0,0 +1,87 @@ +From ada49d64fb3538144192181db05de17e2ffc3551 Mon Sep 17 00:00:00 2001 +From: Gao Xiang +Date: Sat, 14 Nov 2020 11:06:01 -0800 +Subject: xfs: fix forkoff miscalculation related to XFS_LITINO(mp) + +From: Gao Xiang + +commit ada49d64fb3538144192181db05de17e2ffc3551 upstream. + +Currently, commit e9e2eae89ddb dropped a (int) decoration from +XFS_LITINO(mp), and since sizeof() expression is also involved, +the result of XFS_LITINO(mp) is simply as the size_t type +(commonly unsigned long). + +Considering the expression in xfs_attr_shortform_bytesfit(): + offset = (XFS_LITINO(mp) - bytes) >> 3; +let "bytes" be (int)340, and + "XFS_LITINO(mp)" be (unsigned long)336. + +on 64-bit platform, the expression is + offset = ((unsigned long)336 - (int)340) >> 3 = + (int)(0xfffffffffffffffcUL >> 3) = -1 + +but on 32-bit platform, the expression is + offset = ((unsigned long)336 - (int)340) >> 3 = + (int)(0xfffffffcUL >> 3) = 0x1fffffff +instead. + +so offset becomes a large positive number on 32-bit platform, and +cause xfs_attr_shortform_bytesfit() returns maxforkoff rather than 0. + +Therefore, one result is + "ASSERT(new_size <= XFS_IFORK_SIZE(ip, whichfork));" + +assertion failure in xfs_idata_realloc(), which was also the root +cause of the original bugreport from Dennis, see: + https://bugzilla.redhat.com/show_bug.cgi?id=1894177 + +And it can also be manually triggered with the following commands: + $ touch a; + $ setfattr -n user.0 -v "`seq 0 80`" a; + $ setfattr -n user.1 -v "`seq 0 80`" a + +on 32-bit platform. + +Fix the case in xfs_attr_shortform_bytesfit() by bailing out +"XFS_LITINO(mp) < bytes" in advance suggested by Eric and a misleading +comment together with this bugfix suggested by Darrick. It seems the +other users of XFS_LITINO(mp) are not impacted. + +Fixes: e9e2eae89ddb ("xfs: only check the superblock version for dinode size calculation") +Cc: # 5.7+ +Reported-and-tested-by: Dennis Gilmore +Reviewed-by: Christoph Hellwig +Signed-off-by: Gao Xiang +Reviewed-by: Darrick J. Wong +Signed-off-by: Darrick J. Wong +Signed-off-by: Greg Kroah-Hartman + +--- + fs/xfs/libxfs/xfs_attr_leaf.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/fs/xfs/libxfs/xfs_attr_leaf.c ++++ b/fs/xfs/libxfs/xfs_attr_leaf.c +@@ -515,7 +515,7 @@ xfs_attr_copy_value( + *========================================================================*/ + + /* +- * Query whether the requested number of additional bytes of extended ++ * Query whether the total requested number of attr fork bytes of extended + * attribute space will be able to fit inline. + * + * Returns zero if not, else the di_forkoff fork offset to be used in the +@@ -535,6 +535,12 @@ xfs_attr_shortform_bytesfit( + int maxforkoff; + int offset; + ++ /* ++ * Check if the new size could fit at all first: ++ */ ++ if (bytes > XFS_LITINO(mp)) ++ return 0; ++ + /* rounded down */ + offset = (XFS_LITINO(mp) - bytes) >> 3; +