--- /dev/null
+From foo@baz Mon Sep 24 09:32:39 CEST 2018
+From: Timo Wischer <twischer@de.adit-jv.com>
+Date: Tue, 10 Jul 2018 17:28:45 +0200
+Subject: ALSA: pcm: Fix snd_interval_refine first/last with open min/max
+
+From: Timo Wischer <twischer@de.adit-jv.com>
+
+[ Upstream commit ff2d6acdf6f13d9f8fdcd890844c6d7535ac1f10 ]
+
+Without this commit the following intervals [x y), (x y) were be
+replaced to (y-1 y) by snd_interval_refine_last(). This was also done
+if y-1 is part of the previous interval.
+With this changes it will be replaced with [y-1 y) in case of y-1 is
+part of the previous interval. A similar behavior will be used for
+snd_interval_refine_first().
+
+This commit adapts the changes for alsa-lib of commit
+9bb985c ("pcm: snd_interval_refine_first/last: exclude value only if
+also excluded before")
+
+Signed-off-by: Timo Wischer <twischer@de.adit-jv.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/core/pcm_lib.c | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+--- a/sound/core/pcm_lib.c
++++ b/sound/core/pcm_lib.c
+@@ -648,27 +648,33 @@ EXPORT_SYMBOL(snd_interval_refine);
+
+ static int snd_interval_refine_first(struct snd_interval *i)
+ {
++ const unsigned int last_max = i->max;
++
+ if (snd_BUG_ON(snd_interval_empty(i)))
+ return -EINVAL;
+ if (snd_interval_single(i))
+ return 0;
+ i->max = i->min;
+- i->openmax = i->openmin;
+- if (i->openmax)
++ if (i->openmin)
+ i->max++;
++ /* only exclude max value if also excluded before refine */
++ i->openmax = (i->openmax && i->max >= last_max);
+ return 1;
+ }
+
+ static int snd_interval_refine_last(struct snd_interval *i)
+ {
++ const unsigned int last_min = i->min;
++
+ if (snd_BUG_ON(snd_interval_empty(i)))
+ return -EINVAL;
+ if (snd_interval_single(i))
+ return 0;
+ i->min = i->max;
+- i->openmin = i->openmax;
+- if (i->openmin)
++ if (i->openmax)
+ i->min--;
++ /* only exclude min value if also excluded before refine */
++ i->openmin = (i->openmin && i->min <= last_min);
+ return 1;
+ }
+
--- /dev/null
+From foo@baz Mon Sep 24 09:32:39 CEST 2018
+From: Nicholas Mc Guire <hofrat@osadl.org>
+Date: Thu, 12 Jul 2018 11:28:23 +0200
+Subject: ARM: hisi: check of_iomap and fix missing of_node_put
+
+From: Nicholas Mc Guire <hofrat@osadl.org>
+
+[ Upstream commit 81646a3d39ef14749301374a3a0b8311384cd412 ]
+
+of_find_compatible_node() returns a device node with refcount incremented
+and thus needs an explicit of_node_put(). Further relying on an unchecked
+of_iomap() which can return NULL is problematic here, after all ctrl_base
+is critical enough for hix5hd2_set_cpu() to call BUG() if not available
+so a check seems mandated here.
+
+Signed-off-by: Nicholas Mc Guire <hofrat@osadl.org>
+0002 Fixes: commit 06cc5c1d4d73 ("ARM: hisi: enable hix5hd2 SoC")
+Signed-off-by: Wei Xu <xuwei5@hisilicon.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/mach-hisi/hotplug.c | 14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+--- a/arch/arm/mach-hisi/hotplug.c
++++ b/arch/arm/mach-hisi/hotplug.c
+@@ -180,11 +180,15 @@ static bool hix5hd2_hotplug_init(void)
+ struct device_node *np;
+
+ np = of_find_compatible_node(NULL, NULL, "hisilicon,cpuctrl");
+- if (np) {
+- ctrl_base = of_iomap(np, 0);
+- return true;
+- }
+- return false;
++ if (!np)
++ return false;
++
++ ctrl_base = of_iomap(np, 0);
++ of_node_put(np);
++ if (!ctrl_base)
++ return false;
++
++ return true;
+ }
+
+ void hix5hd2_set_cpu(int cpu, bool enable)
--- /dev/null
+From foo@baz Mon Sep 24 09:32:39 CEST 2018
+From: Nicholas Mc Guire <hofrat@osadl.org>
+Date: Thu, 12 Jul 2018 11:28:22 +0200
+Subject: ARM: hisi: fix error handling and missing of_node_put
+
+From: Nicholas Mc Guire <hofrat@osadl.org>
+
+[ Upstream commit 9f30b5ae0585ca5234fe979294b8f897299dec99 ]
+
+of_iomap() can return NULL which seems critical here and thus should be
+explicitly flagged so that the cause of system halting can be understood.
+As of_find_compatible_node() is returning a device node with refcount
+incremented it must be explicitly decremented here.
+
+Signed-off-by: Nicholas Mc Guire <hofrat@osadl.org>
+Fixes: commit 7fda91e73155 ("ARM: hisi: enable smp for HiP01")
+Signed-off-by: Wei Xu <xuwei5@hisilicon.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/mach-hisi/hotplug.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/arch/arm/mach-hisi/hotplug.c
++++ b/arch/arm/mach-hisi/hotplug.c
+@@ -226,10 +226,10 @@ void hip01_set_cpu(int cpu, bool enable)
+
+ if (!ctrl_base) {
+ np = of_find_compatible_node(NULL, NULL, "hisilicon,hip01-sysctrl");
+- if (np)
+- ctrl_base = of_iomap(np, 0);
+- else
+- BUG();
++ BUG_ON(!np);
++ ctrl_base = of_iomap(np, 0);
++ of_node_put(np);
++ BUG_ON(!ctrl_base);
+ }
+
+ if (enable) {
--- /dev/null
+From foo@baz Mon Sep 24 09:32:39 CEST 2018
+From: Nicholas Mc Guire <hofrat@osadl.org>
+Date: Thu, 12 Jul 2018 11:28:24 +0200
+Subject: ARM: hisi: handle of_iomap and fix missing of_node_put
+
+From: Nicholas Mc Guire <hofrat@osadl.org>
+
+[ Upstream commit d396cb185c0337aae5664b250cdd9a73f6eb1503 ]
+
+Relying on an unchecked of_iomap() which can return NULL is problematic
+here, an explicit check seems mandatory. Also the call to
+of_find_compatible_node() returns a device node with refcount incremented
+therefor an explicit of_node_put() is needed here.
+
+Signed-off-by: Nicholas Mc Guire <hofrat@osadl.org>
+Fixes: commit 22bae4290457 ("ARM: hi3xxx: add hotplug support")
+Signed-off-by: Wei Xu <xuwei5@hisilicon.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/mach-hisi/hotplug.c | 19 +++++++++++++------
+ 1 file changed, 13 insertions(+), 6 deletions(-)
+
+--- a/arch/arm/mach-hisi/hotplug.c
++++ b/arch/arm/mach-hisi/hotplug.c
+@@ -148,13 +148,20 @@ static int hi3xxx_hotplug_init(void)
+ struct device_node *node;
+
+ node = of_find_compatible_node(NULL, NULL, "hisilicon,sysctrl");
+- if (node) {
+- ctrl_base = of_iomap(node, 0);
+- id = HI3620_CTRL;
+- return 0;
++ if (!node) {
++ id = ERROR_CTRL;
++ return -ENOENT;
+ }
+- id = ERROR_CTRL;
+- return -ENOENT;
++
++ ctrl_base = of_iomap(node, 0);
++ of_node_put(node);
++ if (!ctrl_base) {
++ id = ERROR_CTRL;
++ return -ENOMEM;
++ }
++
++ id = HI3620_CTRL;
++ return 0;
+ }
+
+ void hi3xxx_set_cpu(int cpu, bool enable)
--- /dev/null
+From foo@baz Mon Sep 24 09:32:39 CEST 2018
+From: Ronny Chevalier <ronny.chevalier@hp.com>
+Date: Wed, 11 Jul 2018 14:39:37 +0200
+Subject: audit: fix use-after-free in audit_add_watch
+
+From: Ronny Chevalier <ronny.chevalier@hp.com>
+
+[ Upstream commit baa2a4fdd525c8c4b0f704d20457195b29437839 ]
+
+audit_add_watch stores locally krule->watch without taking a reference
+on watch. Then, it calls audit_add_to_parent, and uses the watch stored
+locally.
+
+Unfortunately, it is possible that audit_add_to_parent updates
+krule->watch.
+When it happens, it also drops a reference of watch which
+could free the watch.
+
+How to reproduce (with KASAN enabled):
+
+ auditctl -w /etc/passwd -F success=0 -k test_passwd
+ auditctl -w /etc/passwd -F success=1 -k test_passwd2
+
+The second call to auditctl triggers the use-after-free, because
+audit_to_parent updates krule->watch to use a previous existing watch
+and drops the reference to the newly created watch.
+
+To fix the issue, we grab a reference of watch and we release it at the
+end of the function.
+
+Signed-off-by: Ronny Chevalier <ronny.chevalier@hp.com>
+Reviewed-by: Richard Guy Briggs <rgb@redhat.com>
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/audit_watch.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+--- a/kernel/audit_watch.c
++++ b/kernel/audit_watch.c
+@@ -419,6 +419,13 @@ int audit_add_watch(struct audit_krule *
+ struct path parent_path;
+ int h, ret = 0;
+
++ /*
++ * When we will be calling audit_add_to_parent, krule->watch might have
++ * been updated and watch might have been freed.
++ * So we need to keep a reference of watch.
++ */
++ audit_get_watch(watch);
++
+ mutex_unlock(&audit_filter_mutex);
+
+ /* Avoid calling path_lookup under audit_filter_mutex. */
+@@ -427,8 +434,10 @@ int audit_add_watch(struct audit_krule *
+ /* caller expects mutex locked */
+ mutex_lock(&audit_filter_mutex);
+
+- if (ret)
++ if (ret) {
++ audit_put_watch(watch);
+ return ret;
++ }
+
+ /* either find an old parent or attach a new one */
+ parent = audit_find_parent(d_backing_inode(parent_path.dentry));
+@@ -446,6 +455,7 @@ int audit_add_watch(struct audit_krule *
+ *list = &audit_inode_hash[h];
+ error:
+ path_put(&parent_path);
++ audit_put_watch(watch);
+ return ret;
+ }
+
--- /dev/null
+From foo@baz Mon Sep 24 09:32:39 CEST 2018
+From: "Maciej W. Rozycki" <macro@mips.com>
+Date: Tue, 15 May 2018 23:32:45 +0100
+Subject: binfmt_elf: Respect error return from `regset->active'
+
+From: "Maciej W. Rozycki" <macro@mips.com>
+
+[ Upstream commit 2f819db565e82e5f73cd42b39925098986693378 ]
+
+The regset API documented in <linux/regset.h> defines -ENODEV as the
+result of the `->active' handler to be used where the feature requested
+is not available on the hardware found. However code handling core file
+note generation in `fill_thread_core_info' interpretes any non-zero
+result from the `->active' handler as the regset requested being active.
+Consequently processing continues (and hopefully gracefully fails later
+on) rather than being abandoned right away for the regset requested.
+
+Fix the problem then by making the code proceed only if a positive
+result is returned from the `->active' handler.
+
+Signed-off-by: Maciej W. Rozycki <macro@mips.com>
+Signed-off-by: Paul Burton <paul.burton@mips.com>
+Fixes: 4206d3aa1978 ("elf core dump: notes user_regset")
+Patchwork: https://patchwork.linux-mips.org/patch/19332/
+Cc: Alexander Viro <viro@zeniv.linux.org.uk>
+Cc: James Hogan <jhogan@kernel.org>
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: linux-fsdevel@vger.kernel.org
+Cc: linux-mips@linux-mips.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/binfmt_elf.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/binfmt_elf.c
++++ b/fs/binfmt_elf.c
+@@ -1706,7 +1706,7 @@ static int fill_thread_core_info(struct
+ const struct user_regset *regset = &view->regsets[i];
+ do_thread_regset_writeback(t->task, regset);
+ if (regset->core_note_type && regset->get &&
+- (!regset->active || regset->active(t->task, regset))) {
++ (!regset->active || regset->active(t->task, regset) > 0)) {
+ int ret;
+ size_t size = regset->n * regset->size;
+ void *data = kmalloc(size, GFP_KERNEL);
--- /dev/null
+From foo@baz Mon Sep 24 09:32:39 CEST 2018
+From: Mike Christie <mchristi@redhat.com>
+Date: Sun, 15 Jul 2018 18:16:17 -0500
+Subject: configfs: fix registered group removal
+
+From: Mike Christie <mchristi@redhat.com>
+
+[ Upstream commit cc57c07343bd071cdf1915a91a24ab7d40c9b590 ]
+
+This patch fixes a bug where configfs_register_group had added
+a group in a tree, and userspace has done a rmdir on a dir somewhere
+above that group and we hit a kernel crash. The problem is configfs_rmdir
+will detach everything under it and unlink groups on the default_groups
+list. It will not unlink groups added with configfs_register_group so when
+configfs_unregister_group is called to drop its references to the group/items
+we crash when we try to access the freed dentrys.
+
+The patch just adds a check for if a rmdir has been done above
+us and if so just does the unlink part of unregistration.
+
+Sorry if you are getting this multiple times. I thouhgt I sent
+this to some of you and lkml, but I do not see it.
+
+Signed-off-by: Mike Christie <mchristi@redhat.com>
+Cc: Christoph Hellwig <hch@lst.de>
+Cc: Joel Becker <jlbec@evilplan.org>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/configfs/dir.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/fs/configfs/dir.c
++++ b/fs/configfs/dir.c
+@@ -1777,6 +1777,16 @@ void configfs_unregister_group(struct co
+ struct dentry *dentry = group->cg_item.ci_dentry;
+ struct dentry *parent = group->cg_item.ci_parent->ci_dentry;
+
++ mutex_lock(&subsys->su_mutex);
++ if (!group->cg_item.ci_parent->ci_group) {
++ /*
++ * The parent has already been unlinked and detached
++ * due to a rmdir.
++ */
++ goto unlink_group;
++ }
++ mutex_unlock(&subsys->su_mutex);
++
+ inode_lock_nested(d_inode(parent), I_MUTEX_PARENT);
+ spin_lock(&configfs_dirent_lock);
+ configfs_detach_prep(dentry, NULL);
+@@ -1791,6 +1801,7 @@ void configfs_unregister_group(struct co
+ dput(dentry);
+
+ mutex_lock(&subsys->su_mutex);
++unlink_group:
+ unlink_group(group);
+ mutex_unlock(&subsys->su_mutex);
+ }
--- /dev/null
+From foo@baz Mon Sep 24 09:32:39 CEST 2018
+From: Suzuki K Poulose <suzuki.poulose@arm.com>
+Date: Wed, 11 Jul 2018 13:40:28 -0600
+Subject: coresight: Handle errors in finding input/output ports
+
+From: Suzuki K Poulose <suzuki.poulose@arm.com>
+
+[ Upstream commit fe470f5f7f684ed15bc49b6183a64237547910ff ]
+
+If we fail to find the input / output port for a LINK component
+while enabling a path, we should fail gracefully rather than
+assuming port "0".
+
+Cc: Mathieu Poirier <mathieu.poirier@linaro.org>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hwtracing/coresight/coresight.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/hwtracing/coresight/coresight.c
++++ b/drivers/hwtracing/coresight/coresight.c
+@@ -107,7 +107,7 @@ static int coresight_find_link_inport(st
+ dev_err(&csdev->dev, "couldn't find inport, parent: %s, child: %s\n",
+ dev_name(&parent->dev), dev_name(&csdev->dev));
+
+- return 0;
++ return -ENODEV;
+ }
+
+ static int coresight_find_link_outport(struct coresight_device *csdev,
+@@ -125,7 +125,7 @@ static int coresight_find_link_outport(s
+ dev_err(&csdev->dev, "couldn't find outport, parent: %s, child: %s\n",
+ dev_name(&csdev->dev), dev_name(&child->dev));
+
+- return 0;
++ return -ENODEV;
+ }
+
+ static int coresight_enable_sink(struct coresight_device *csdev, u32 mode)
+@@ -178,6 +178,9 @@ static int coresight_enable_link(struct
+ else
+ refport = 0;
+
++ if (refport < 0)
++ return refport;
++
+ if (atomic_inc_return(&csdev->refcnt[refport]) == 1) {
+ if (link_ops(csdev)->enable) {
+ ret = link_ops(csdev)->enable(csdev, inport, outport);
--- /dev/null
+From foo@baz Mon Sep 24 09:32:39 CEST 2018
+From: Robin Murphy <robin.murphy@arm.com>
+Date: Wed, 11 Jul 2018 13:40:35 -0600
+Subject: coresight: tpiu: Fix disabling timeouts
+
+From: Robin Murphy <robin.murphy@arm.com>
+
+[ Upstream commit ccff2dfaceaca4517432f5c149594215fe9098cc ]
+
+Probing the TPIU driver under UBSan triggers an out-of-bounds shift
+warning in coresight_timeout():
+
+...
+[ 5.677530] UBSAN: Undefined behaviour in drivers/hwtracing/coresight/coresight.c:929:16
+[ 5.685542] shift exponent 64 is too large for 64-bit type 'long unsigned int'
+...
+
+On closer inspection things are exponentially out of whack because we're
+passing a bitmask where a bit number should be. Amusingly, it seems that
+both calls will find their expected values by sheer luck and appear to
+succeed: 1 << FFCR_FON_MAN ends up at bit 64 which whilst undefined
+evaluates as zero in practice, while 1 << FFSR_FT_STOPPED finds bit 2
+(TCPresent) which apparently is usually tied high.
+
+Following the examples of other drivers, define separate FOO and FOO_BIT
+macros for masks vs. indices, and put things right.
+
+CC: Robert Walker <robert.walker@arm.com>
+CC: Mike Leach <mike.leach@linaro.org>
+CC: Mathieu Poirier <mathieu.poirier@linaro.org>
+Fixes: 11595db8e17f ("coresight: Fix disabling of CoreSight TPIU")
+Signed-off-by: Robin Murphy <robin.murphy@arm.com>
+Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hwtracing/coresight/coresight-tpiu.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/hwtracing/coresight/coresight-tpiu.c
++++ b/drivers/hwtracing/coresight/coresight-tpiu.c
+@@ -47,8 +47,9 @@
+
+ /** register definition **/
+ /* FFSR - 0x300 */
+-#define FFSR_FT_STOPPED BIT(1)
++#define FFSR_FT_STOPPED_BIT 1
+ /* FFCR - 0x304 */
++#define FFCR_FON_MAN_BIT 6
+ #define FFCR_FON_MAN BIT(6)
+ #define FFCR_STOP_FI BIT(12)
+
+@@ -93,9 +94,9 @@ static void tpiu_disable_hw(struct tpiu_
+ /* Generate manual flush */
+ writel_relaxed(FFCR_STOP_FI | FFCR_FON_MAN, drvdata->base + TPIU_FFCR);
+ /* Wait for flush to complete */
+- coresight_timeout(drvdata->base, TPIU_FFCR, FFCR_FON_MAN, 0);
++ coresight_timeout(drvdata->base, TPIU_FFCR, FFCR_FON_MAN_BIT, 0);
+ /* Wait for formatter to stop */
+- coresight_timeout(drvdata->base, TPIU_FFSR, FFSR_FT_STOPPED, 1);
++ coresight_timeout(drvdata->base, TPIU_FFSR, FFSR_FT_STOPPED_BIT, 1);
+
+ CS_LOCK(drvdata->base);
+ }
--- /dev/null
+From foo@baz Mon Sep 24 09:32:39 CEST 2018
+From: Wei Lu <wei.lu2@amd.com>
+Date: Wed, 11 Jul 2018 22:32:47 -0400
+Subject: drm/amdkfd: Fix error codes in kfd_get_process
+
+From: Wei Lu <wei.lu2@amd.com>
+
+[ Upstream commit e47cb828eb3fca3e8999a0b9aa053dda18552071 ]
+
+Return ERR_PTR(-EINVAL) if kfd_get_process fails to find the process.
+This fixes kernel oopses when a child process calls KFD ioctls with
+a file descriptor inherited from the parent process.
+
+Signed-off-by: Wei Lu <wei.lu2@amd.com>
+Reviewed-by: Felix Kuehling <Felix.Kuehling@amd.com>
+Signed-off-by: Felix Kuehling <Felix.Kuehling@amd.com>
+Acked-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Oded Gabbay <oded.gabbay@gmail.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_process.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_process.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_process.c
+@@ -124,6 +124,8 @@ struct kfd_process *kfd_get_process(cons
+ return ERR_PTR(-EINVAL);
+
+ process = find_process(thread);
++ if (!process)
++ return ERR_PTR(-EINVAL);
+
+ return process;
+ }
--- /dev/null
+From foo@baz Mon Sep 24 09:32:39 CEST 2018
+From: Thierry Reding <treding@nvidia.com>
+Date: Wed, 30 May 2018 16:06:25 +0200
+Subject: drm/nouveau: tegra: Detach from ARM DMA/IOMMU mapping
+
+From: Thierry Reding <treding@nvidia.com>
+
+[ Upstream commit b59fb482b52269977ee5de205308e5b236a03917 ]
+
+Depending on the kernel configuration, early ARM architecture setup code
+may have attached the GPU to a DMA/IOMMU mapping that transparently uses
+the IOMMU to back the DMA API. Tegra requires special handling for IOMMU
+backed buffers (a special bit in the GPU's MMU page tables indicates the
+memory path to take: via the SMMU or directly to the memory controller).
+Transparently backing DMA memory with an IOMMU prevents Nouveau from
+properly handling such memory accesses and causes memory access faults.
+
+As a side-note: buffers other than those allocated in instance memory
+don't need to be physically contiguous from the GPU's perspective since
+the GPU can map them into contiguous buffers using its own MMU. Mapping
+these buffers through the IOMMU is unnecessary and will even lead to
+performance degradation because of the additional translation. One
+exception to this are compressible buffers which need large pages. In
+order to enable these large pages, multiple small pages will have to be
+combined into one large (I/O virtually contiguous) mapping via the
+IOMMU. However, that is a topic outside the scope of this fix and isn't
+currently supported. An implementation will want to explicitly create
+these large pages in the Nouveau driver, so detaching from a DMA/IOMMU
+mapping would still be required.
+
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Acked-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Robin Murphy <robin.murphy@arm.com>
+Tested-by: Nicolas Chauvet <kwizart@gmail.com>
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/nouveau/nvkm/engine/device/tegra.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+--- a/drivers/gpu/drm/nouveau/nvkm/engine/device/tegra.c
++++ b/drivers/gpu/drm/nouveau/nvkm/engine/device/tegra.c
+@@ -23,6 +23,10 @@
+ #ifdef CONFIG_NOUVEAU_PLATFORM_DRIVER
+ #include "priv.h"
+
++#if IS_ENABLED(CONFIG_ARM_DMA_USE_IOMMU)
++#include <asm/dma-iommu.h>
++#endif
++
+ static int
+ nvkm_device_tegra_power_up(struct nvkm_device_tegra *tdev)
+ {
+@@ -95,6 +99,15 @@ nvkm_device_tegra_probe_iommu(struct nvk
+ unsigned long pgsize_bitmap;
+ int ret;
+
++#if IS_ENABLED(CONFIG_ARM_DMA_USE_IOMMU)
++ if (dev->archdata.mapping) {
++ struct dma_iommu_mapping *mapping = to_dma_iommu_mapping(dev);
++
++ arm_iommu_detach_device(dev);
++ arm_iommu_release_mapping(mapping);
++ }
++#endif
++
+ if (!tdev->func->iommu_bit)
+ return;
+
--- /dev/null
+From foo@baz Mon Sep 24 09:32:39 CEST 2018
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Wed, 4 Jul 2018 12:38:09 +0300
+Subject: drm/panel: type promotion bug in s6e8aa0_read_mtp_id()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit cd0e0ca69109d025b1a1b6609f70682db62138b0 ]
+
+The ARRAY_SIZE() macro is type size_t. If s6e8aa0_dcs_read() returns a
+negative error code, then "ret < ARRAY_SIZE(id)" is false because the
+negative error code is type promoted to a high positive value.
+
+Fixes: 02051ca06371 ("drm/panel: add S6E8AA0 driver")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Andrzej Hajda <a.hajda@samsung.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20180704093807.s3lqsb2v6dg2k43d@kili.mountain
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/panel/panel-samsung-s6e8aa0.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/panel/panel-samsung-s6e8aa0.c
++++ b/drivers/gpu/drm/panel/panel-samsung-s6e8aa0.c
+@@ -823,7 +823,7 @@ static void s6e8aa0_read_mtp_id(struct s
+ int ret, i;
+
+ ret = s6e8aa0_dcs_read(ctx, 0xd1, id, ARRAY_SIZE(id));
+- if (ret < ARRAY_SIZE(id) || id[0] == 0x00) {
++ if (ret < 0 || ret < ARRAY_SIZE(id) || id[0] == 0x00) {
+ dev_err(ctx->dev, "read id failed\n");
+ ctx->error = -EIO;
+ return;
--- /dev/null
+From foo@baz Mon Sep 24 09:32:39 CEST 2018
+From: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Date: Mon, 16 Jul 2018 23:25:07 +0800
+Subject: efi/esrt: Only call efi_mem_reserve() for boot services memory
+
+From: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+
+[ Upstream commit 61f0d55569463a1af897117ff47d202b0ccb2e24 ]
+
+The following commit:
+
+ 7e1550b8f208 ("efi: Drop type and attribute checks in efi_mem_desc_lookup()")
+
+refactored the implementation of efi_mem_desc_lookup() so that the type
+check is moved to the callers, one of which is the x86 version of
+efi_arch_mem_reserve(), where we added a modified check that only takes
+EFI_BOOT_SERVICES_DATA regions into account.
+
+This is reasonable, since it is the only memory type that requires this,
+but doing so uncovered some unexpected behavior in the ESRT code, which
+permits the ESRT table to reside in other types of memory than what the
+UEFI spec mandates (i.e., EFI_BOOT_SERVICES_DATA), and unconditionally
+calls efi_mem_reserve() on the region in question. This may result in
+errors such as
+
+ esrt: Reserving ESRT space from 0x000000009c810318 to 0x000000009c810350.
+ efi: Failed to lookup EFI memory descriptor for 0x000000009c810318
+
+when the ESRT table is not in EFI_BOOT_SERVICES_DATA memory, but we try
+to reserve it nonetheless.
+
+So make the call to efi_mem_reserve() conditional on the memory type.
+
+Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Jones <pjones@redhat.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: linux-efi@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/firmware/efi/esrt.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/firmware/efi/esrt.c
++++ b/drivers/firmware/efi/esrt.c
+@@ -333,7 +333,8 @@ void __init efi_esrt_init(void)
+
+ end = esrt_data + size;
+ pr_info("Reserving ESRT space from %pa to %pa.\n", &esrt_data, &end);
+- efi_mem_reserve(esrt_data, esrt_data_size);
++ if (md.type == EFI_BOOT_SERVICES_DATA)
++ efi_mem_reserve(esrt_data, esrt_data_size);
+
+ pr_debug("esrt-init: loaded.\n");
+ err_memunmap:
--- /dev/null
+From foo@baz Mon Sep 24 09:32:39 CEST 2018
+From: Matthew Garrett <mjg59@google.com>
+Date: Fri, 8 Jun 2018 14:57:42 -0700
+Subject: evm: Don't deadlock if a crypto algorithm is unavailable
+
+From: Matthew Garrett <mjg59@google.com>
+
+[ Upstream commit e2861fa71641c6414831d628a1f4f793b6562580 ]
+
+When EVM attempts to appraise a file signed with a crypto algorithm the
+kernel doesn't have support for, it will cause the kernel to trigger a
+module load. If the EVM policy includes appraisal of kernel modules this
+will in turn call back into EVM - since EVM is holding a lock until the
+crypto initialisation is complete, this triggers a deadlock. Add a
+CRYPTO_NOLOAD flag and skip module loading if it's set, and add that flag
+in the EVM case in order to fail gracefully with an error message
+instead of deadlocking.
+
+Signed-off-by: Matthew Garrett <mjg59@google.com>
+Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ crypto/api.c | 2 +-
+ include/linux/crypto.h | 5 +++++
+ security/integrity/evm/evm_crypto.c | 3 ++-
+ 3 files changed, 8 insertions(+), 2 deletions(-)
+
+--- a/crypto/api.c
++++ b/crypto/api.c
+@@ -215,7 +215,7 @@ struct crypto_alg *crypto_larval_lookup(
+ type &= mask;
+
+ alg = crypto_alg_lookup(name, type, mask);
+- if (!alg) {
++ if (!alg && !(mask & CRYPTO_NOLOAD)) {
+ request_module("crypto-%s", name);
+
+ if (!((type ^ CRYPTO_ALG_NEED_FALLBACK) & mask &
+--- a/include/linux/crypto.h
++++ b/include/linux/crypto.h
+@@ -109,6 +109,11 @@
+ #define CRYPTO_ALG_OPTIONAL_KEY 0x00004000
+
+ /*
++ * Don't trigger module loading
++ */
++#define CRYPTO_NOLOAD 0x00008000
++
++/*
+ * Transform masks and values (for crt_flags).
+ */
+ #define CRYPTO_TFM_NEED_KEY 0x00000001
+--- a/security/integrity/evm/evm_crypto.c
++++ b/security/integrity/evm/evm_crypto.c
+@@ -94,7 +94,8 @@ static struct shash_desc *init_desc(char
+ mutex_lock(&mutex);
+ if (*tfm)
+ goto out;
+- *tfm = crypto_alloc_shash(algo, 0, CRYPTO_ALG_ASYNC);
++ *tfm = crypto_alloc_shash(algo, 0,
++ CRYPTO_ALG_ASYNC | CRYPTO_NOLOAD);
+ if (IS_ERR(*tfm)) {
+ rc = PTR_ERR(*tfm);
+ pr_err("Can not allocate %s (reason: %ld)\n", algo, rc);
--- /dev/null
+From foo@baz Mon Sep 24 09:32:39 CEST 2018
+From: Wei Yongjun <weiyongjun1@huawei.com>
+Date: Wed, 11 Jul 2018 13:19:38 +0000
+Subject: gpio: pxa: Fix potential NULL dereference
+
+From: Wei Yongjun <weiyongjun1@huawei.com>
+
+[ Upstream commit 9506755633d0b32ef76f67c345000178e9b0dfc4 ]
+
+platform_get_resource() may fail and return NULL, so we should
+better check it's return value to avoid a NULL pointer dereference
+a bit later in the code.
+
+This is detected by Coccinelle semantic patch.
+
+@@
+expression pdev, res, n, t, e, e1, e2;
+@@
+
+res = platform_get_resource(pdev, t, n);
++ if (!res)
++ return -EINVAL;
+... when != res == NULL
+e = devm_ioremap(e1, res->start, e2);
+
+Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
+Acked-by: Robert Jarzmik <robert.jarzmik@free.fr>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpio/gpio-pxa.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/gpio/gpio-pxa.c
++++ b/drivers/gpio/gpio-pxa.c
+@@ -660,6 +660,8 @@ static int pxa_gpio_probe(struct platfor
+ pchip->irq0 = irq0;
+ pchip->irq1 = irq1;
+ res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
++ if (!res)
++ return -EINVAL;
+ gpio_reg_base = devm_ioremap(&pdev->dev, res->start,
+ resource_size(res));
+ if (!gpio_reg_base)
--- /dev/null
+From foo@baz Mon Sep 24 09:32:39 CEST 2018
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Date: Mon, 9 Jul 2018 21:47:27 +0300
+Subject: gpiolib: Mark gpio_suffixes array with __maybe_unused
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit b23ec59926faf05b0c43680d05671c484e810ac4 ]
+
+Since we put static variable to a header file it's copied to each module
+that includes the header. But not all of them are actually used it.
+
+Mark gpio_suffixes array with __maybe_unused to hide a compiler warning:
+
+In file included from
+drivers/gpio/gpiolib-legacy.c:6:0:
+drivers/gpio/gpiolib.h:95:27: warning: ‘gpio_suffixes’ defined but not used [-Wunused-const-variable=]
+ static const char * const gpio_suffixes[] = { "gpios", "gpio" };
+ ^~~~~~~~~~~~~
+In file included from drivers/gpio/gpiolib-devprop.c:17:0:
+drivers/gpio/gpiolib.h:95:27: warning: ‘gpio_suffixes’ defined but not used [-Wunused-const-variable=]
+ static const char * const gpio_suffixes[] = { "gpios", "gpio" };
+ ^~~~~~~~~~~~~
+
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpio/gpiolib.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpio/gpiolib.h
++++ b/drivers/gpio/gpiolib.h
+@@ -85,7 +85,7 @@ struct acpi_gpio_info {
+ };
+
+ /* gpio suffixes used for ACPI and device tree lookup */
+-static const char * const gpio_suffixes[] = { "gpios", "gpio" };
++static __maybe_unused const char * const gpio_suffixes[] = { "gpios", "gpio" };
+
+ #ifdef CONFIG_OF_GPIO
+ struct gpio_desc *of_find_gpio(struct device *dev,
--- /dev/null
+From foo@baz Mon Sep 24 09:32:39 CEST 2018
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Date: Tue, 3 Jul 2018 03:38:31 +0300
+Subject: gpiolib: Respect error code of ->get_direction()
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 36b312792b97933dc07abe074f50941199bd357c ]
+
+In case we try to lock GPIO pin as IRQ when something going wrong
+we print a misleading message.
+
+Correct this by checking an error code from ->get_direction() in
+gpiochip_lock_as_irq() and printing a corresponding message.
+
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Cc: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpio/gpiolib.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/gpio/gpiolib.c
++++ b/drivers/gpio/gpiolib.c
+@@ -2749,6 +2749,12 @@ int gpiochip_lock_as_irq(struct gpio_chi
+ if (!chip->can_sleep && chip->get_direction) {
+ int dir = chip->get_direction(chip, offset);
+
++ if (dir < 0) {
++ chip_err(chip, "%s: cannot get GPIO direction\n",
++ __func__);
++ return dir;
++ }
++
+ if (dir)
+ clear_bit(FLAG_IS_OUT, &desc->flags);
+ else
--- /dev/null
+From foo@baz Mon Sep 24 09:32:39 CEST 2018
+From: Enrico Scholz <enrico.scholz@sigma-chemnitz.de>
+Date: Thu, 3 May 2018 18:29:36 +0200
+Subject: gpu: ipu-v3: csi: pass back mbus_code_to_bus_cfg error codes
+
+From: Enrico Scholz <enrico.scholz@sigma-chemnitz.de>
+
+[ Upstream commit d36d0e6309dd8137cf438cbb680e72eb63c81425 ]
+
+mbus_code_to_bus_cfg() can fail on unknown mbus codes; pass back the
+error to the caller.
+
+Signed-off-by: Enrico Scholz <enrico.scholz@sigma-chemnitz.de>
+Signed-off-by: Jan Luebbe <jlu@pengutronix.de>
+[p.zabel@pengutronix.de - renamed rc to ret for consistency]
+Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/ipu-v3/ipu-csi.c | 20 ++++++++++++++++----
+ 1 file changed, 16 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/ipu-v3/ipu-csi.c
++++ b/drivers/gpu/ipu-v3/ipu-csi.c
+@@ -316,13 +316,17 @@ static int mbus_code_to_bus_cfg(struct i
+ /*
+ * Fill a CSI bus config struct from mbus_config and mbus_framefmt.
+ */
+-static void fill_csi_bus_cfg(struct ipu_csi_bus_config *csicfg,
++static int fill_csi_bus_cfg(struct ipu_csi_bus_config *csicfg,
+ struct v4l2_mbus_config *mbus_cfg,
+ struct v4l2_mbus_framefmt *mbus_fmt)
+ {
++ int ret;
++
+ memset(csicfg, 0, sizeof(*csicfg));
+
+- mbus_code_to_bus_cfg(csicfg, mbus_fmt->code);
++ ret = mbus_code_to_bus_cfg(csicfg, mbus_fmt->code);
++ if (ret < 0)
++ return ret;
+
+ switch (mbus_cfg->type) {
+ case V4L2_MBUS_PARALLEL:
+@@ -353,6 +357,8 @@ static void fill_csi_bus_cfg(struct ipu_
+ /* will never get here, keep compiler quiet */
+ break;
+ }
++
++ return 0;
+ }
+
+ int ipu_csi_init_interface(struct ipu_csi *csi,
+@@ -362,8 +368,11 @@ int ipu_csi_init_interface(struct ipu_cs
+ struct ipu_csi_bus_config cfg;
+ unsigned long flags;
+ u32 width, height, data = 0;
++ int ret;
+
+- fill_csi_bus_cfg(&cfg, mbus_cfg, mbus_fmt);
++ ret = fill_csi_bus_cfg(&cfg, mbus_cfg, mbus_fmt);
++ if (ret < 0)
++ return ret;
+
+ /* set default sensor frame width and height */
+ width = mbus_fmt->width;
+@@ -567,11 +576,14 @@ int ipu_csi_set_mipi_datatype(struct ipu
+ struct ipu_csi_bus_config cfg;
+ unsigned long flags;
+ u32 temp;
++ int ret;
+
+ if (vc > 3)
+ return -EINVAL;
+
+- mbus_code_to_bus_cfg(&cfg, mbus_fmt->code);
++ ret = mbus_code_to_bus_cfg(&cfg, mbus_fmt->code);
++ if (ret < 0)
++ return ret;
+
+ spin_lock_irqsave(&csi->lock, flags);
+
--- /dev/null
+From foo@baz Mon Sep 24 09:32:39 CEST 2018
+From: Bart Van Assche <bart.vanassche@wdc.com>
+Date: Thu, 5 Jul 2018 10:51:35 -0700
+Subject: IB/nes: Fix a compiler warning
+
+From: Bart Van Assche <bart.vanassche@wdc.com>
+
+[ Upstream commit 4c5743bc4fe3233cecc1c184a773c79c8ee45bbe ]
+
+Avoid that the following compiler warning is reported when building with
+W=1:
+
+drivers/infiniband/hw/nes/nes_hw.c:646:51: warning: suggest braces around empty body in an 'if' statement [-Wempty-body]
+
+Signed-off-by: Bart Van Assche <bart.vanassche@wdc.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/infiniband/hw/nes/nes.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/infiniband/hw/nes/nes.h
++++ b/drivers/infiniband/hw/nes/nes.h
+@@ -156,7 +156,7 @@ do { \
+
+ #define NES_EVENT_TIMEOUT 1200000
+ #else
+-#define nes_debug(level, fmt, args...)
++#define nes_debug(level, fmt, args...) do {} while (0)
+ #define assert(expr) do {} while (0)
+
+ #define NES_EVENT_TIMEOUT 100000
--- /dev/null
+From foo@baz Mon Sep 24 09:32:39 CEST 2018
+From: Peter Rosin <peda@axentia.se>
+Date: Wed, 20 Jun 2018 07:17:56 +0200
+Subject: input: rohm_bu21023: switch to i2c_lock_bus(..., I2C_LOCK_SEGMENT)
+
+From: Peter Rosin <peda@axentia.se>
+
+[ Upstream commit 193c2a07cfaacb9249ab0e3d34bce32490879355 ]
+
+Locking the root adapter for __i2c_transfer will deadlock if the
+device sits behind a mux-locked I2C mux. Switch to the finer-grained
+i2c_lock_bus with the I2C_LOCK_SEGMENT flag. If the device does not
+sit behind a mux-locked mux, the two locking variants are equivalent.
+
+Signed-off-by: Peter Rosin <peda@axentia.se>
+Acked-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/input/touchscreen/rohm_bu21023.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/input/touchscreen/rohm_bu21023.c
++++ b/drivers/input/touchscreen/rohm_bu21023.c
+@@ -304,7 +304,7 @@ static int rohm_i2c_burst_read(struct i2
+ msg[1].len = len;
+ msg[1].buf = buf;
+
+- i2c_lock_adapter(adap);
++ i2c_lock_bus(adap, I2C_LOCK_SEGMENT);
+
+ for (i = 0; i < 2; i++) {
+ if (__i2c_transfer(adap, &msg[i], 1) < 0) {
+@@ -313,7 +313,7 @@ static int rohm_i2c_burst_read(struct i2
+ }
+ }
+
+- i2c_unlock_adapter(adap);
++ i2c_unlock_bus(adap, I2C_LOCK_SEGMENT);
+
+ return ret;
+ }
--- /dev/null
+From foo@baz Mon Sep 24 09:32:39 CEST 2018
+From: Peter Rosin <peda@axentia.se>
+Date: Wed, 20 Jun 2018 07:18:02 +0200
+Subject: mfd: 88pm860x-i2c: switch to i2c_lock_bus(..., I2C_LOCK_SEGMENT)
+
+From: Peter Rosin <peda@axentia.se>
+
+[ Upstream commit 8c8f74f327a76604a499fad8c54c15e1c0ee8051 ]
+
+Locking the root adapter for __i2c_transfer will deadlock if the
+device sits behind a mux-locked I2C mux. Switch to the finer-grained
+i2c_lock_bus with the I2C_LOCK_SEGMENT flag. If the device does not
+sit behind a mux-locked mux, the two locking variants are equivalent.
+
+Signed-off-by: Peter Rosin <peda@axentia.se>
+Acked-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mfd/88pm860x-i2c.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/mfd/88pm860x-i2c.c
++++ b/drivers/mfd/88pm860x-i2c.c
+@@ -146,14 +146,14 @@ int pm860x_page_reg_write(struct i2c_cli
+ unsigned char zero;
+ int ret;
+
+- i2c_lock_adapter(i2c->adapter);
++ i2c_lock_bus(i2c->adapter, I2C_LOCK_SEGMENT);
+ read_device(i2c, 0xFA, 0, &zero);
+ read_device(i2c, 0xFB, 0, &zero);
+ read_device(i2c, 0xFF, 0, &zero);
+ ret = write_device(i2c, reg, 1, &data);
+ read_device(i2c, 0xFE, 0, &zero);
+ read_device(i2c, 0xFC, 0, &zero);
+- i2c_unlock_adapter(i2c->adapter);
++ i2c_unlock_bus(i2c->adapter, I2C_LOCK_SEGMENT);
+ return ret;
+ }
+ EXPORT_SYMBOL(pm860x_page_reg_write);
+@@ -164,14 +164,14 @@ int pm860x_page_bulk_read(struct i2c_cli
+ unsigned char zero = 0;
+ int ret;
+
+- i2c_lock_adapter(i2c->adapter);
++ i2c_lock_bus(i2c->adapter, I2C_LOCK_SEGMENT);
+ read_device(i2c, 0xfa, 0, &zero);
+ read_device(i2c, 0xfb, 0, &zero);
+ read_device(i2c, 0xff, 0, &zero);
+ ret = read_device(i2c, reg, count, buf);
+ read_device(i2c, 0xFE, 0, &zero);
+ read_device(i2c, 0xFC, 0, &zero);
+- i2c_unlock_adapter(i2c->adapter);
++ i2c_unlock_bus(i2c->adapter, I2C_LOCK_SEGMENT);
+ return ret;
+ }
+ EXPORT_SYMBOL(pm860x_page_bulk_read);
--- /dev/null
+From foo@baz Mon Sep 24 09:32:39 CEST 2018
+From: Paul Burton <paul.burton@mips.com>
+Date: Mon, 16 Jul 2018 08:26:36 -0700
+Subject: MIPS: loongson64: cs5536: Fix PCI_OHCI_INT_REG reads
+
+From: Paul Burton <paul.burton@mips.com>
+
+[ Upstream commit cd87668d601f622e0ebcfea4f78d116d5f572f4d ]
+
+The PCI_OHCI_INT_REG case in pci_ohci_read_reg() contains the following
+if statement:
+
+ if ((lo & 0x00000f00) == CS5536_USB_INTR)
+
+CS5536_USB_INTR expands to the constant 11, which gives us the following
+condition which can never evaluate true:
+
+ if ((lo & 0xf00) == 11)
+
+At least when using GCC 8.1.0 this falls foul of the tautoligcal-compare
+warning, and since the code is built with the -Werror flag the build
+fails.
+
+Fix this by shifting lo right by 8 bits in order to match the
+corresponding PCI_OHCI_INT_REG case in pci_ohci_write_reg().
+
+Signed-off-by: Paul Burton <paul.burton@mips.com>
+Patchwork: https://patchwork.linux-mips.org/patch/19861/
+Cc: Huacai Chen <chenhc@lemote.com>
+Cc: James Hogan <jhogan@kernel.org>
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: linux-mips@linux-mips.org
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/mips/loongson64/common/cs5536/cs5536_ohci.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/mips/loongson64/common/cs5536/cs5536_ohci.c
++++ b/arch/mips/loongson64/common/cs5536/cs5536_ohci.c
+@@ -138,7 +138,7 @@ u32 pci_ohci_read_reg(int reg)
+ break;
+ case PCI_OHCI_INT_REG:
+ _rdmsr(DIVIL_MSR_REG(PIC_YSEL_LOW), &hi, &lo);
+- if ((lo & 0x00000f00) == CS5536_USB_INTR)
++ if (((lo >> PIC_YSEL_LOW_USB_SHIFT) & 0xf) == CS5536_USB_INTR)
+ conf_data = 1;
+ break;
+ default:
--- /dev/null
+From foo@baz Mon Sep 24 09:32:39 CEST 2018
+From: Stefan Agner <stefan@agner.ch>
+Date: Thu, 5 Jul 2018 14:18:19 +0200
+Subject: mmc: sdhci: do not try to use 3.3V signaling if not supported
+
+From: Stefan Agner <stefan@agner.ch>
+
+[ Upstream commit 1b5190c2e74c47ebe4bcecf7a072358ad9f1feaa ]
+
+For eMMC devices it is valid to only support 1.8V signaling. When
+vqmmc is set to a fixed 1.8V regulator the stack tries to set 3.3V
+initially and prints the following warning:
+ mmc1: Switching to 3.3V signalling voltage failed
+
+Clear the MMC_SIGNAL_VOLTAGE_330 flag in case 3.3V is signaling is
+not available. This prevents the stack from even trying to use
+3.3V signaling and avoids the above warning.
+
+Signed-off-by: Stefan Agner <stefan@agner.ch>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mmc/host/sdhci.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/drivers/mmc/host/sdhci.c
++++ b/drivers/mmc/host/sdhci.c
+@@ -3328,14 +3328,21 @@ int sdhci_setup_host(struct sdhci_host *
+ mmc_gpio_get_cd(host->mmc) < 0)
+ mmc->caps |= MMC_CAP_NEEDS_POLL;
+
+- /* If vqmmc regulator and no 1.8V signalling, then there's no UHS */
+ if (!IS_ERR(mmc->supply.vqmmc)) {
+ ret = regulator_enable(mmc->supply.vqmmc);
++
++ /* If vqmmc provides no 1.8V signalling, then there's no UHS */
+ if (!regulator_is_supported_voltage(mmc->supply.vqmmc, 1700000,
+ 1950000))
+ host->caps1 &= ~(SDHCI_SUPPORT_SDR104 |
+ SDHCI_SUPPORT_SDR50 |
+ SDHCI_SUPPORT_DDR50);
++
++ /* In eMMC case vqmmc might be a fixed 1.8V regulator */
++ if (!regulator_is_supported_voltage(mmc->supply.vqmmc, 2700000,
++ 3600000))
++ host->flags &= ~SDHCI_SIGNALING_330;
++
+ if (ret) {
+ pr_warn("%s: Failed to enable vqmmc regulator: %d\n",
+ mmc_hostname(mmc), ret);
--- /dev/null
+From foo@baz Mon Sep 24 09:32:39 CEST 2018
+From: Stefan Agner <stefan@agner.ch>
+Date: Thu, 12 Jul 2018 09:39:02 +0200
+Subject: mmc: tegra: prevent HS200 on Tegra 3
+
+From: Stefan Agner <stefan@agner.ch>
+
+[ Upstream commit 127407e36f4fe3a1d5e8b9998b479956ce83a7dc ]
+
+The stack assumes that SDHC controller which support SD3.0 (SDR104) do
+support HS200. This is not the case for Tegra 3, which does support SD
+3.0
+but only supports eMMC spec 4.41.
+
+Use SDHCI_QUIRK2_BROKEN_HS200 to indicate that the controller does not
+support HS200.
+
+Note that commit 156e14b126ff ("mmc: sdhci: fix caps2 for HS200") added
+the tie between SD3.0 (SDR104) and HS200. I don't think that this is
+necessarly true. It is fully legitimate to support SD3.0 and not support
+HS200. The quirk naming suggests something is broken in the controller,
+but this is not the case: The controller simply does not support HS200.
+
+Fixes: 7ad2ed1dfcbe ("mmc: tegra: enable UHS-I modes")
+Signed-off-by: Stefan Agner <stefan@agner.ch>
+Tested-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mmc/host/sdhci-tegra.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/mmc/host/sdhci-tegra.c
++++ b/drivers/mmc/host/sdhci-tegra.c
+@@ -350,7 +350,8 @@ static const struct sdhci_pltfm_data sdh
+ SDHCI_QUIRK_NO_HISPD_BIT |
+ SDHCI_QUIRK_BROKEN_ADMA_ZEROLEN_DESC |
+ SDHCI_QUIRK_CAP_CLOCK_BASE_BROKEN,
+- .quirks2 = SDHCI_QUIRK2_PRESET_VALUE_BROKEN,
++ .quirks2 = SDHCI_QUIRK2_PRESET_VALUE_BROKEN |
++ SDHCI_QUIRK2_BROKEN_HS200,
+ .ops = &tegra_sdhci_ops,
+ };
+
--- /dev/null
+From foo@baz Mon Sep 24 09:32:39 CEST 2018
+From: Jann Horn <jannh@google.com>
+Date: Sat, 7 Jul 2018 05:37:22 +0200
+Subject: mtdchar: fix overflows in adjustment of `count`
+
+From: Jann Horn <jannh@google.com>
+
+[ Upstream commit 6c6bc9ea84d0008024606bf5ba10519e20d851bf ]
+
+The first checks in mtdchar_read() and mtdchar_write() attempt to limit
+`count` such that `*ppos + count <= mtd->size`. However, they ignore the
+possibility of `*ppos > mtd->size`, allowing the calculation of `count` to
+wrap around. `mtdchar_lseek()` prevents seeking beyond mtd->size, but the
+pread/pwrite syscalls bypass this.
+
+I haven't found any codepath on which this actually causes dangerous
+behavior, but it seems like a sensible change anyway.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Jann Horn <jannh@google.com>
+Signed-off-by: Boris Brezillon <boris.brezillon@bootlin.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mtd/mtdchar.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+--- a/drivers/mtd/mtdchar.c
++++ b/drivers/mtd/mtdchar.c
+@@ -160,8 +160,12 @@ static ssize_t mtdchar_read(struct file
+
+ pr_debug("MTD_read\n");
+
+- if (*ppos + count > mtd->size)
+- count = mtd->size - *ppos;
++ if (*ppos + count > mtd->size) {
++ if (*ppos < mtd->size)
++ count = mtd->size - *ppos;
++ else
++ count = 0;
++ }
+
+ if (!count)
+ return 0;
+@@ -246,7 +250,7 @@ static ssize_t mtdchar_write(struct file
+
+ pr_debug("MTD_write\n");
+
+- if (*ppos == mtd->size)
++ if (*ppos >= mtd->size)
+ return -ENOSPC;
+
+ if (*ppos + count > mtd->size)
--- /dev/null
+From foo@baz Mon Sep 24 09:32:39 CEST 2018
+From: Julia Lawall <Julia.Lawall@lip6.fr>
+Date: Thu, 12 Jul 2018 22:29:55 +0100
+Subject: parport: sunbpp: fix error return code
+
+From: Julia Lawall <Julia.Lawall@lip6.fr>
+
+[ Upstream commit faa1a47388b33623e4d504c23569188907b039a0 ]
+
+Return an error code on failure. Change leading spaces to tab on the
+first if.
+
+Problem found using Coccinelle.
+
+Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
+Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/parport/parport_sunbpp.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/drivers/parport/parport_sunbpp.c
++++ b/drivers/parport/parport_sunbpp.c
+@@ -286,12 +286,16 @@ static int bpp_probe(struct platform_dev
+
+ ops = kmemdup(&parport_sunbpp_ops, sizeof(struct parport_operations),
+ GFP_KERNEL);
+- if (!ops)
++ if (!ops) {
++ err = -ENOMEM;
+ goto out_unmap;
++ }
+
+ dprintk(("register_port\n"));
+- if (!(p = parport_register_port((unsigned long)base, irq, dma, ops)))
++ if (!(p = parport_register_port((unsigned long)base, irq, dma, ops))) {
++ err = -ENOMEM;
+ goto out_free_ops;
++ }
+
+ p->size = size;
+ p->dev = &op->dev;
--- /dev/null
+From foo@baz Mon Sep 24 09:32:39 CEST 2018
+From: Douglas Anderson <dianders@chromium.org>
+Date: Mon, 2 Jul 2018 15:59:39 -0700
+Subject: pinctrl: qcom: spmi-gpio: Fix pmic_gpio_config_get() to be compliant
+
+From: Douglas Anderson <dianders@chromium.org>
+
+[ Upstream commit 1cf86bc21257a330e3af51f2a4e885f1a705f6a5 ]
+
+If you do this on an sdm845 board:
+ grep "" /sys/kernel/debug/pinctrl/*spmi:pmic*/pinconf-groups
+
+...it looks like nonsense. For every pin you see listed:
+ input bias disabled, input bias high impedance, input bias pull down, input bias pull up, ...
+
+That's because pmic_gpio_config_get() isn't complying with the rules
+that pinconf_generic_dump_one() expects. Specifically for boolean
+parameters (anything with a "struct pin_config_item" where has_arg is
+false) the function expects that the function should return its value
+not through the "config" parameter but should return "0" if the value
+is set and "-EINVAL" if the value isn't set.
+
+Let's fix this.
+
+>From a quick sample of other pinctrl drivers, it appears to be
+tradition to also return 1 through the config parameter for these
+boolean parameters when they exist. I'm not one to knock tradition,
+so I'll follow tradition and return 1 in these cases. While I'm at
+it, I'll also continue searching for four leaf clovers, kocking on
+wood three times, and trying not to break mirrors.
+
+NOTE: This also fixes an apparent typo for reading
+PIN_CONFIG_BIAS_DISABLE where the old driver was accidentally
+using "=" instead of "==" and thus was setting some internal
+state when you tried to query PIN_CONFIG_BIAS_DISABLE. Oops.
+
+Fixes: eadff3024472 ("pinctrl: Qualcomm SPMI PMIC GPIO pin controller driver")
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pinctrl/qcom/pinctrl-spmi-gpio.c | 32 +++++++++++++++++++++++--------
+ 1 file changed, 24 insertions(+), 8 deletions(-)
+
+--- a/drivers/pinctrl/qcom/pinctrl-spmi-gpio.c
++++ b/drivers/pinctrl/qcom/pinctrl-spmi-gpio.c
+@@ -287,31 +287,47 @@ static int pmic_gpio_config_get(struct p
+
+ switch (param) {
+ case PIN_CONFIG_DRIVE_PUSH_PULL:
+- arg = pad->buffer_type == PMIC_GPIO_OUT_BUF_CMOS;
++ if (pad->buffer_type != PMIC_GPIO_OUT_BUF_CMOS)
++ return -EINVAL;
++ arg = 1;
+ break;
+ case PIN_CONFIG_DRIVE_OPEN_DRAIN:
+- arg = pad->buffer_type == PMIC_GPIO_OUT_BUF_OPEN_DRAIN_NMOS;
++ if (pad->buffer_type != PMIC_GPIO_OUT_BUF_OPEN_DRAIN_NMOS)
++ return -EINVAL;
++ arg = 1;
+ break;
+ case PIN_CONFIG_DRIVE_OPEN_SOURCE:
+- arg = pad->buffer_type == PMIC_GPIO_OUT_BUF_OPEN_DRAIN_PMOS;
++ if (pad->buffer_type != PMIC_GPIO_OUT_BUF_OPEN_DRAIN_PMOS)
++ return -EINVAL;
++ arg = 1;
+ break;
+ case PIN_CONFIG_BIAS_PULL_DOWN:
+- arg = pad->pullup == PMIC_GPIO_PULL_DOWN;
++ if (pad->pullup != PMIC_GPIO_PULL_DOWN)
++ return -EINVAL;
++ arg = 1;
+ break;
+ case PIN_CONFIG_BIAS_DISABLE:
+- arg = pad->pullup = PMIC_GPIO_PULL_DISABLE;
++ if (pad->pullup != PMIC_GPIO_PULL_DISABLE)
++ return -EINVAL;
++ arg = 1;
+ break;
+ case PIN_CONFIG_BIAS_PULL_UP:
+- arg = pad->pullup == PMIC_GPIO_PULL_UP_30;
++ if (pad->pullup != PMIC_GPIO_PULL_UP_30)
++ return -EINVAL;
++ arg = 1;
+ break;
+ case PIN_CONFIG_BIAS_HIGH_IMPEDANCE:
+- arg = !pad->is_enabled;
++ if (pad->is_enabled)
++ return -EINVAL;
++ arg = 1;
+ break;
+ case PIN_CONFIG_POWER_SOURCE:
+ arg = pad->power_source;
+ break;
+ case PIN_CONFIG_INPUT_ENABLE:
+- arg = pad->input_enabled;
++ if (!pad->input_enabled)
++ return -EINVAL;
++ arg = 1;
+ break;
+ case PIN_CONFIG_OUTPUT:
+ arg = pad->out_value;
--- /dev/null
+From foo@baz Mon Sep 24 09:32:39 CEST 2018
+From: Arvind Yadav <arvind.yadav.cs@gmail.com>
+Date: Fri, 30 Mar 2018 17:14:03 +0530
+Subject: PM / devfreq: use put_device() instead of kfree()
+
+From: Arvind Yadav <arvind.yadav.cs@gmail.com>
+
+[ Upstream commit 2d803dc8f7a5f622ac47c3b650834ada3a2659b9 ]
+
+Never directly free @dev after calling device_register() or
+device_unregister(), even if device_register() returned an error.
+Always use put_device() to give up the reference initialized.
+
+Signed-off-by: Arvind Yadav <arvind.yadav.cs@gmail.com>
+Reviewed-by: Chanwoo Choi <cw00.choi@samsung.com>
+Signed-off-by: MyungJoo Ham <myungjoo.ham@samsung.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/devfreq/devfreq.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/devfreq/devfreq.c
++++ b/drivers/devfreq/devfreq.c
+@@ -574,7 +574,8 @@ struct devfreq *devfreq_add_device(struc
+ err = device_register(&devfreq->dev);
+ if (err) {
+ mutex_unlock(&devfreq->lock);
+- goto err_dev;
++ put_device(&devfreq->dev);
++ goto err_out;
+ }
+
+ devfreq->trans_table = devm_kzalloc(&devfreq->dev, sizeof(unsigned int) *
+@@ -618,6 +619,7 @@ err_init:
+ mutex_unlock(&devfreq_list_lock);
+
+ device_unregister(&devfreq->dev);
++ devfreq = NULL;
+ err_dev:
+ if (devfreq)
+ kfree(devfreq);
--- /dev/null
+From foo@baz Mon Sep 24 09:32:39 CEST 2018
+From: "Paul E. McKenney" <paulmck@linux.vnet.ibm.com>
+Date: Fri, 25 May 2018 19:23:09 -0700
+Subject: rcu: Fix grace-period hangs due to race with CPU offline
+
+From: "Paul E. McKenney" <paulmck@linux.vnet.ibm.com>
+
+[ Upstream commit 1e64b15a4b102e1cd059d4d798b7a78f93341333 ]
+
+Without special fail-safe quiescent-state-propagation checks, grace-period
+hangs can result from the following scenario:
+
+1. CPU 1 goes offline.
+
+2. Because CPU 1 is the only CPU in the system blocking the current
+ grace period, the grace period ends as soon as
+ rcu_cleanup_dying_idle_cpu()'s call to rcu_report_qs_rnp()
+ returns.
+
+3. At this point, the leaf rcu_node structure's ->lock is no longer
+ held: rcu_report_qs_rnp() has released it, as it must in order
+ to awaken the RCU grace-period kthread.
+
+4. At this point, that same leaf rcu_node structure's ->qsmaskinitnext
+ field still records CPU 1 as being online. This is absolutely
+ necessary because the scheduler uses RCU (in this case on the
+ wake-up path while awakening RCU's grace-period kthread), and
+ ->qsmaskinitnext contains RCU's idea as to which CPUs are online.
+ Therefore, invoking rcu_report_qs_rnp() after clearing CPU 1's
+ bit from ->qsmaskinitnext would result in a lockdep-RCU splat
+ due to RCU being used from an offline CPU.
+
+5. RCU's grace-period kthread awakens, sees that the old grace period
+ has completed and that a new one is needed. It therefore starts
+ a new grace period, but because CPU 1's leaf rcu_node structure's
+ ->qsmaskinitnext field still shows CPU 1 as being online, this new
+ grace period is initialized to wait for a quiescent state from the
+ now-offline CPU 1.
+
+6. Without the fail-safe force-quiescent-state checks, there would
+ be no quiescent state from the now-offline CPU 1, which would
+ eventually result in RCU CPU stall warnings and memory exhaustion.
+
+It would be good to get rid of the special fail-safe quiescent-state
+propagation checks, and thus it would be good to fix things so that
+the above scenario cannot happen. This commit therefore adds a new
+->ofl_lock to the rcu_state structure. This lock is held by rcu_gp_init()
+across the applying of buffered online and offline operations to the
+rcu_node tree, and it is also held by rcu_cleanup_dying_idle_cpu()
+when buffering a new offline operation. This prevents rcu_gp_init()
+from acquiring the leaf rcu_node structure's lock during the interval
+between when rcu_cleanup_dying_idle_cpu() invokes rcu_report_qs_rnp(),
+which releases ->lock and the re-acquisition of that same lock.
+This in turn prevents the failure scenario outlined above, and will
+hopefully eventually allow removal of the offline-CPU checks from the
+force-quiescent-state code path.
+
+Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/rcu/tree.c | 6 ++++++
+ kernel/rcu/tree.h | 4 ++++
+ 2 files changed, 10 insertions(+)
+
+--- a/kernel/rcu/tree.c
++++ b/kernel/rcu/tree.c
+@@ -102,6 +102,7 @@ struct rcu_state sname##_state = { \
+ .abbr = sabbr, \
+ .exp_mutex = __MUTEX_INITIALIZER(sname##_state.exp_mutex), \
+ .exp_wake_mutex = __MUTEX_INITIALIZER(sname##_state.exp_wake_mutex), \
++ .ofl_lock = __SPIN_LOCK_UNLOCKED(sname##_state.ofl_lock), \
+ }
+
+ RCU_STATE_INITIALIZER(rcu_sched, 's', call_rcu_sched);
+@@ -1966,11 +1967,13 @@ static bool rcu_gp_init(struct rcu_state
+ */
+ rcu_for_each_leaf_node(rsp, rnp) {
+ rcu_gp_slow(rsp, gp_preinit_delay);
++ spin_lock(&rsp->ofl_lock);
+ raw_spin_lock_irq_rcu_node(rnp);
+ if (rnp->qsmaskinit == rnp->qsmaskinitnext &&
+ !rnp->wait_blkd_tasks) {
+ /* Nothing to do on this leaf rcu_node structure. */
+ raw_spin_unlock_irq_rcu_node(rnp);
++ spin_unlock(&rsp->ofl_lock);
+ continue;
+ }
+
+@@ -2005,6 +2008,7 @@ static bool rcu_gp_init(struct rcu_state
+ }
+
+ raw_spin_unlock_irq_rcu_node(rnp);
++ spin_unlock(&rsp->ofl_lock);
+ }
+
+ /*
+@@ -3915,9 +3919,11 @@ static void rcu_cleanup_dying_idle_cpu(i
+
+ /* Remove outgoing CPU from mask in the leaf rcu_node structure. */
+ mask = rdp->grpmask;
++ spin_lock(&rsp->ofl_lock);
+ raw_spin_lock_irqsave_rcu_node(rnp, flags); /* Enforce GP memory-order guarantee. */
+ rnp->qsmaskinitnext &= ~mask;
+ raw_spin_unlock_irqrestore_rcu_node(rnp, flags);
++ spin_unlock(&rsp->ofl_lock);
+ }
+
+ void rcu_report_dead(unsigned int cpu)
+--- a/kernel/rcu/tree.h
++++ b/kernel/rcu/tree.h
+@@ -550,6 +550,10 @@ struct rcu_state {
+ const char *name; /* Name of structure. */
+ char abbr; /* Abbreviated name. */
+ struct list_head flavors; /* List of RCU flavors. */
++
++ spinlock_t ofl_lock ____cacheline_internodealigned_in_smp;
++ /* Synchronize offline with */
++ /* GP pre-initialization. */
+ };
+
+ /* Values for rcu_state structure's gp_flags field. */
--- /dev/null
+From foo@baz Mon Sep 24 09:32:39 CEST 2018
+From: Zhouyang Jia <jiazhouyang09@gmail.com>
+Date: Tue, 12 Jun 2018 12:40:03 +0800
+Subject: rtc: bq4802: add error handling for devm_ioremap
+
+From: Zhouyang Jia <jiazhouyang09@gmail.com>
+
+[ Upstream commit 7874b919866ba91bac253fa219d3d4c82bb944df ]
+
+When devm_ioremap fails, the lack of error-handling code may
+cause unexpected results.
+
+This patch adds error-handling code after calling devm_ioremap.
+
+Signed-off-by: Zhouyang Jia <jiazhouyang09@gmail.com>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/rtc/rtc-bq4802.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/rtc/rtc-bq4802.c
++++ b/drivers/rtc/rtc-bq4802.c
+@@ -164,6 +164,10 @@ static int bq4802_probe(struct platform_
+ } else if (p->r->flags & IORESOURCE_MEM) {
+ p->regs = devm_ioremap(&pdev->dev, p->r->start,
+ resource_size(p->r));
++ if (!p->regs){
++ err = -ENOMEM;
++ goto out;
++ }
+ p->read = bq4802_read_mem;
+ p->write = bq4802_write_mem;
+ } else {
--- /dev/null
+From foo@baz Mon Sep 24 09:32:39 CEST 2018
+From: John Stultz <john.stultz@linaro.org>
+Date: Tue, 29 May 2018 19:12:18 -0700
+Subject: selftest: timers: Tweak raw_skew to SKIP when ADJ_OFFSET/other clock adjustments are in progress
+
+From: John Stultz <john.stultz@linaro.org>
+
+[ Upstream commit 1416270f4a1ae83ea84156ceba19a66a8f88be1f ]
+
+In the past we've warned when ADJ_OFFSET was in progress, usually
+caused by ntpd or some other time adjusting daemon running in non
+steady sate, which can cause the skew calculations to be
+incorrect.
+
+Thus, this patch checks to see if the clock was being adjusted
+when we fail so that we don't cause false negatives.
+
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Ingo Molnar <mingo@kernel.org>
+Cc: Miroslav Lichvar <mlichvar@redhat.com>
+Cc: Richard Cochran <richardcochran@gmail.com>
+Cc: Prarit Bhargava <prarit@redhat.com>
+Cc: Stephen Boyd <sboyd@kernel.org>
+Cc: Shuah Khan <shuah@kernel.org>
+Cc: linux-kselftest@vger.kernel.org
+Suggested-by: Miroslav Lichvar <mlichvar@redhat.com>
+Signed-off-by: John Stultz <john.stultz@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+v2: Widened the checks to look for other clock adjustments that
+ could happen, as suggested by Miroslav
+v3: Fixed up commit message
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/timers/raw_skew.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/tools/testing/selftests/timers/raw_skew.c
++++ b/tools/testing/selftests/timers/raw_skew.c
+@@ -146,6 +146,11 @@ int main(int argv, char **argc)
+ printf(" %lld.%i(act)", ppm/1000, abs((int)(ppm%1000)));
+
+ if (llabs(eppm - ppm) > 1000) {
++ if (tx1.offset || tx2.offset ||
++ tx1.freq != tx2.freq || tx1.tick != tx2.tick) {
++ printf(" [SKIP]\n");
++ return ksft_exit_skip("The clock was adjusted externally. Shutdown NTPd or other time sync daemons\n");
++ }
+ printf(" [FAILED]\n");
+ return ksft_exit_fail();
+ }
cifs-fix-wrapping-bugs-in-num_entries.patch
perf-core-force-user_ds-when-recording-user-stack-data.patch
nfsv4.1-fix-infinite-loop-on-i-o.patch
+binfmt_elf-respect-error-return-from-regset-active.patch
+audit-fix-use-after-free-in-audit_add_watch.patch
+mtdchar-fix-overflows-in-adjustment-of-count.patch
+evm-don-t-deadlock-if-a-crypto-algorithm-is-unavailable.patch
+pm-devfreq-use-put_device-instead-of-kfree.patch
+mips-loongson64-cs5536-fix-pci_ohci_int_reg-reads.patch
+configfs-fix-registered-group-removal.patch
+efi-esrt-only-call-efi_mem_reserve-for-boot-services-memory.patch
+arm-hisi-handle-of_iomap-and-fix-missing-of_node_put.patch
+arm-hisi-fix-error-handling-and-missing-of_node_put.patch
+arm-hisi-check-of_iomap-and-fix-missing-of_node_put.patch
+gpu-ipu-v3-csi-pass-back-mbus_code_to_bus_cfg-error-codes.patch
+mmc-tegra-prevent-hs200-on-tegra-3.patch
+mmc-sdhci-do-not-try-to-use-3.3v-signaling-if-not-supported.patch
+drm-nouveau-tegra-detach-from-arm-dma-iommu-mapping.patch
+parport-sunbpp-fix-error-return-code.patch
+coresight-handle-errors-in-finding-input-output-ports.patch
+coresight-tpiu-fix-disabling-timeouts.patch
+gpio-pxa-fix-potential-null-dereference.patch
+gpiolib-mark-gpio_suffixes-array-with-__maybe_unused.patch
+mfd-88pm860x-i2c-switch-to-i2c_lock_bus-...-i2c_lock_segment.patch
+input-rohm_bu21023-switch-to-i2c_lock_bus-...-i2c_lock_segment.patch
+rcu-fix-grace-period-hangs-due-to-race-with-cpu-offline.patch
+drm-amdkfd-fix-error-codes-in-kfd_get_process.patch
+rtc-bq4802-add-error-handling-for-devm_ioremap.patch
+alsa-pcm-fix-snd_interval_refine-first-last-with-open-min-max.patch
+selftest-timers-tweak-raw_skew-to-skip-when-adj_offset-other-clock-adjustments-are-in-progress.patch
+drm-panel-type-promotion-bug-in-s6e8aa0_read_mtp_id.patch
+ib-nes-fix-a-compiler-warning.patch
+gpiolib-respect-error-code-of-get_direction.patch
+pinctrl-qcom-spmi-gpio-fix-pmic_gpio_config_get-to-be-compliant.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
