--- /dev/null
+From 58d92a0bf78747d91d88dd90ebe96a8c4326a490 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 May 2020 14:10:26 +0800
+Subject: ALSA: hda/realtek - Add new codec supported for ALC287
+
+From: Kailang Yang <kailang@realtek.com>
+
+[ Upstream commit 630e36126e420e1756378b3427b42711ce0b9ddd ]
+
+Enable new codec supported for ALC287.
+
+Signed-off-by: Kailang Yang <kailang@realtek.com>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/dcf5ce5507104d0589a917cbb71dc3c6@realtek.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_realtek.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index c4e97b3ba1dd..5be3c926364e 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -341,6 +341,7 @@ static void alc_fill_eapd_coef(struct hda_codec *codec)
+ case 0x10ec0282:
+ case 0x10ec0283:
+ case 0x10ec0286:
++ case 0x10ec0287:
+ case 0x10ec0288:
+ case 0x10ec0285:
+ case 0x10ec0298:
+@@ -7290,6 +7291,7 @@ static int patch_alc269(struct hda_codec *codec)
+ case 0x10ec0215:
+ case 0x10ec0245:
+ case 0x10ec0285:
++ case 0x10ec0287:
+ case 0x10ec0289:
+ spec->codec_variant = ALC269_TYPE_ALC215;
+ spec->gen.mixer_nid = 0;
+@@ -8389,6 +8391,7 @@ static const struct hda_device_id snd_hda_id_realtek[] = {
+ HDA_CODEC_ENTRY(0x10ec0284, "ALC284", patch_alc269),
+ HDA_CODEC_ENTRY(0x10ec0285, "ALC285", patch_alc269),
+ HDA_CODEC_ENTRY(0x10ec0286, "ALC286", patch_alc269),
++ HDA_CODEC_ENTRY(0x10ec0287, "ALC287", patch_alc269),
+ HDA_CODEC_ENTRY(0x10ec0288, "ALC288", patch_alc269),
+ HDA_CODEC_ENTRY(0x10ec0289, "ALC289", patch_alc269),
+ HDA_CODEC_ENTRY(0x10ec0290, "ALC290", patch_alc269),
+--
+2.25.1
+
--- /dev/null
+From 1770da18ee4b0347071526c645b1be10d089c857 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 May 2020 00:39:21 +0000
+Subject: ALSA: hwdep: fix a left shifting 1 by 31 UB bug
+
+From: Changming Liu <liu.changm@northeastern.edu>
+
+[ Upstream commit fb8cd6481ffd126f35e9e146a0dcf0c4e8899f2e ]
+
+The "info.index" variable can be 31 in "1 << info.index".
+This might trigger an undefined behavior since 1 is signed.
+
+Fix this by casting 1 to 1u just to be sure "1u << 31" is defined.
+
+Signed-off-by: Changming Liu <liu.changm@northeastern.edu>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/BL0PR06MB4548170B842CB055C9AF695DE5B00@BL0PR06MB4548.namprd06.prod.outlook.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/core/hwdep.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/core/hwdep.c b/sound/core/hwdep.c
+index a73baa1242be..727219f40201 100644
+--- a/sound/core/hwdep.c
++++ b/sound/core/hwdep.c
+@@ -229,14 +229,14 @@ static int snd_hwdep_dsp_load(struct snd_hwdep *hw,
+ if (copy_from_user(&info, _info, sizeof(info)))
+ return -EFAULT;
+ /* check whether the dsp was already loaded */
+- if (hw->dsp_loaded & (1 << info.index))
++ if (hw->dsp_loaded & (1u << info.index))
+ return -EBUSY;
+ if (!access_ok(VERIFY_READ, info.image, info.length))
+ return -EFAULT;
+ err = hw->ops.dsp_load(hw, &info);
+ if (err < 0)
+ return err;
+- hw->dsp_loaded |= (1 << info.index);
++ hw->dsp_loaded |= (1u << info.index);
+ return 0;
+ }
+
+--
+2.25.1
+
--- /dev/null
+From 7fe8bb01ff67340971215f40b02bc27e594207ba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 May 2020 14:26:13 +0800
+Subject: ALSA: usb-audio: mixer: volume quirk for ESS Technology Asus USB DAC
+
+From: Chris Chiu <chiu@endlessm.com>
+
+[ Upstream commit 4020d1ccbe55bdf67b31d718d2400506eaf4b43f ]
+
+The Asus USB DAC is a USB type-C audio dongle for connecting to
+the headset and headphone. The volume minimum value -23040 which
+is 0xa600 in hexadecimal with the resolution value 1 indicates
+this should be endianness issue caused by the firmware bug. Add
+a volume quirk to fix the volume control problem.
+
+Also fixes this warning:
+ Warning! Unlikely big volume range (=23040), cval->res is probably wrong.
+ [5] FU [Headset Capture Volume] ch = 1, val = -23040/0/1
+ Warning! Unlikely big volume range (=23040), cval->res is probably wrong.
+ [7] FU [Headset Playback Volume] ch = 1, val = -23040/0/1
+
+Signed-off-by: Chris Chiu <chiu@endlessm.com>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20200526062613.55401-1-chiu@endlessm.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/mixer.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
+index 7b75208d5cea..dbbc5609b453 100644
+--- a/sound/usb/mixer.c
++++ b/sound/usb/mixer.c
+@@ -986,6 +986,14 @@ static void volume_control_quirks(struct usb_mixer_elem_info *cval,
+ cval->res = 384;
+ }
+ break;
++ case USB_ID(0x0495, 0x3042): /* ESS Technology Asus USB DAC */
++ if ((strstr(kctl->id.name, "Playback Volume") != NULL) ||
++ strstr(kctl->id.name, "Capture Volume") != NULL) {
++ cval->min >>= 8;
++ cval->max = 0;
++ cval->res = 1;
++ }
++ break;
+ }
+ }
+
+--
+2.25.1
+
--- /dev/null
+From b22962c16a61e40d8c8a6c036080699cd43a0229 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Feb 2019 00:56:58 +0100
+Subject: ARM: 8843/1: use unified assembler in headers
+
+From: Stefan Agner <stefan@agner.ch>
+
+[ Upstream commit c001899a5d6c2d7a0f3b75b2307ddef137fb46a6 ]
+
+Use unified assembler syntax (UAL) in headers. Divided syntax is
+considered deprecated. This will also allow to build the kernel
+using LLVM's integrated assembler.
+
+Signed-off-by: Stefan Agner <stefan@agner.ch>
+Acked-by: Nicolas Pitre <nico@linaro.org>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/include/asm/assembler.h | 12 ++++++------
+ arch/arm/include/asm/vfpmacros.h | 8 ++++----
+ arch/arm/lib/bitops.h | 8 ++++----
+ 3 files changed, 14 insertions(+), 14 deletions(-)
+
+diff --git a/arch/arm/include/asm/assembler.h b/arch/arm/include/asm/assembler.h
+index 88286dd483ff..965224d14e6c 100644
+--- a/arch/arm/include/asm/assembler.h
++++ b/arch/arm/include/asm/assembler.h
+@@ -374,9 +374,9 @@ THUMB( orr \reg , \reg , #PSR_T_BIT )
+ .macro usraccoff, instr, reg, ptr, inc, off, cond, abort, t=TUSER()
+ 9999:
+ .if \inc == 1
+- \instr\cond\()b\()\t\().w \reg, [\ptr, #\off]
++ \instr\()b\t\cond\().w \reg, [\ptr, #\off]
+ .elseif \inc == 4
+- \instr\cond\()\t\().w \reg, [\ptr, #\off]
++ \instr\t\cond\().w \reg, [\ptr, #\off]
+ .else
+ .error "Unsupported inc macro argument"
+ .endif
+@@ -415,9 +415,9 @@ THUMB( orr \reg , \reg , #PSR_T_BIT )
+ .rept \rept
+ 9999:
+ .if \inc == 1
+- \instr\cond\()b\()\t \reg, [\ptr], #\inc
++ \instr\()b\t\cond \reg, [\ptr], #\inc
+ .elseif \inc == 4
+- \instr\cond\()\t \reg, [\ptr], #\inc
++ \instr\t\cond \reg, [\ptr], #\inc
+ .else
+ .error "Unsupported inc macro argument"
+ .endif
+@@ -458,7 +458,7 @@ THUMB( orr \reg , \reg , #PSR_T_BIT )
+ .macro check_uaccess, addr:req, size:req, limit:req, tmp:req, bad:req
+ #ifndef CONFIG_CPU_USE_DOMAINS
+ adds \tmp, \addr, #\size - 1
+- sbcccs \tmp, \tmp, \limit
++ sbcscc \tmp, \tmp, \limit
+ bcs \bad
+ #ifdef CONFIG_CPU_SPECTRE
+ movcs \addr, #0
+@@ -472,7 +472,7 @@ THUMB( orr \reg , \reg , #PSR_T_BIT )
+ sub \tmp, \limit, #1
+ subs \tmp, \tmp, \addr @ tmp = limit - 1 - addr
+ addhs \tmp, \tmp, #1 @ if (tmp >= 0) {
+- subhss \tmp, \tmp, \size @ tmp = limit - (addr + size) }
++ subshs \tmp, \tmp, \size @ tmp = limit - (addr + size) }
+ movlo \addr, #0 @ if (tmp < 0) addr = NULL
+ csdb
+ #endif
+diff --git a/arch/arm/include/asm/vfpmacros.h b/arch/arm/include/asm/vfpmacros.h
+index ef5dfedacd8d..628c336e8e3b 100644
+--- a/arch/arm/include/asm/vfpmacros.h
++++ b/arch/arm/include/asm/vfpmacros.h
+@@ -29,13 +29,13 @@
+ ldr \tmp, =elf_hwcap @ may not have MVFR regs
+ ldr \tmp, [\tmp, #0]
+ tst \tmp, #HWCAP_VFPD32
+- ldcnel p11, cr0, [\base],#32*4 @ FLDMIAD \base!, {d16-d31}
++ ldclne p11, cr0, [\base],#32*4 @ FLDMIAD \base!, {d16-d31}
+ addeq \base, \base, #32*4 @ step over unused register space
+ #else
+ VFPFMRX \tmp, MVFR0 @ Media and VFP Feature Register 0
+ and \tmp, \tmp, #MVFR0_A_SIMD_MASK @ A_SIMD field
+ cmp \tmp, #2 @ 32 x 64bit registers?
+- ldceql p11, cr0, [\base],#32*4 @ FLDMIAD \base!, {d16-d31}
++ ldcleq p11, cr0, [\base],#32*4 @ FLDMIAD \base!, {d16-d31}
+ addne \base, \base, #32*4 @ step over unused register space
+ #endif
+ #endif
+@@ -53,13 +53,13 @@
+ ldr \tmp, =elf_hwcap @ may not have MVFR regs
+ ldr \tmp, [\tmp, #0]
+ tst \tmp, #HWCAP_VFPD32
+- stcnel p11, cr0, [\base],#32*4 @ FSTMIAD \base!, {d16-d31}
++ stclne p11, cr0, [\base],#32*4 @ FSTMIAD \base!, {d16-d31}
+ addeq \base, \base, #32*4 @ step over unused register space
+ #else
+ VFPFMRX \tmp, MVFR0 @ Media and VFP Feature Register 0
+ and \tmp, \tmp, #MVFR0_A_SIMD_MASK @ A_SIMD field
+ cmp \tmp, #2 @ 32 x 64bit registers?
+- stceql p11, cr0, [\base],#32*4 @ FSTMIAD \base!, {d16-d31}
++ stcleq p11, cr0, [\base],#32*4 @ FSTMIAD \base!, {d16-d31}
+ addne \base, \base, #32*4 @ step over unused register space
+ #endif
+ #endif
+diff --git a/arch/arm/lib/bitops.h b/arch/arm/lib/bitops.h
+index 93cddab73072..95bd35991288 100644
+--- a/arch/arm/lib/bitops.h
++++ b/arch/arm/lib/bitops.h
+@@ -7,7 +7,7 @@
+ ENTRY( \name )
+ UNWIND( .fnstart )
+ ands ip, r1, #3
+- strneb r1, [ip] @ assert word-aligned
++ strbne r1, [ip] @ assert word-aligned
+ mov r2, #1
+ and r3, r0, #31 @ Get bit offset
+ mov r0, r0, lsr #5
+@@ -32,7 +32,7 @@ ENDPROC(\name )
+ ENTRY( \name )
+ UNWIND( .fnstart )
+ ands ip, r1, #3
+- strneb r1, [ip] @ assert word-aligned
++ strbne r1, [ip] @ assert word-aligned
+ mov r2, #1
+ and r3, r0, #31 @ Get bit offset
+ mov r0, r0, lsr #5
+@@ -62,7 +62,7 @@ ENDPROC(\name )
+ ENTRY( \name )
+ UNWIND( .fnstart )
+ ands ip, r1, #3
+- strneb r1, [ip] @ assert word-aligned
++ strbne r1, [ip] @ assert word-aligned
+ and r2, r0, #31
+ mov r0, r0, lsr #5
+ mov r3, #1
+@@ -89,7 +89,7 @@ ENDPROC(\name )
+ ENTRY( \name )
+ UNWIND( .fnstart )
+ ands ip, r1, #3
+- strneb r1, [ip] @ assert word-aligned
++ strbne r1, [ip] @ assert word-aligned
+ and r3, r0, #31
+ mov r0, r0, lsr #5
+ save_and_disable_irqs ip
+--
+2.25.1
+
--- /dev/null
+From a15cff56d022c6f4363ee73634169567bb9f302c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 18 Apr 2020 14:35:22 +0200
+Subject: ARM: dts: bcm2835-rpi-zero-w: Fix led polarity
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Vincent Stehlé <vincent.stehle@laposte.net>
+
+[ Upstream commit 58bb90ab415562eededb932455046924e65df342 ]
+
+The status "ACT" led on the Raspberry Pi Zero W is on when GPIO 47 is low.
+
+This has been verified on a board and somewhat confirmed by both the GPIO
+name ("STATUS_LED_N") and the reduced schematics [1].
+
+[1]: https://www.raspberrypi.org/documentation/hardware/raspberrypi/schematics/rpi_SCH_ZeroW_1p1_reduced.pdf
+
+Fixes: 2c7c040c73e9 ("ARM: dts: bcm2835: Add Raspberry Pi Zero W")
+Signed-off-by: Vincent Stehlé <vincent.stehle@laposte.net>
+Cc: Stefan Wahren <stefan.wahren@i2se.com>
+Cc: Florian Fainelli <f.fainelli@gmail.com>
+Tested-by: Stefan Wahren <stefan.wahren@i2se.com>
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/bcm2835-rpi-zero-w.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/bcm2835-rpi-zero-w.dts b/arch/arm/boot/dts/bcm2835-rpi-zero-w.dts
+index e5f2cca86f04..120776d45441 100644
+--- a/arch/arm/boot/dts/bcm2835-rpi-zero-w.dts
++++ b/arch/arm/boot/dts/bcm2835-rpi-zero-w.dts
+@@ -25,7 +25,7 @@
+
+ leds {
+ act {
+- gpios = <&gpio 47 GPIO_ACTIVE_HIGH>;
++ gpios = <&gpio 47 GPIO_ACTIVE_LOW>;
+ };
+ };
+
+--
+2.25.1
+
--- /dev/null
+From 814ba65f64f31e49513331a7227afbe9b882d187 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Jan 2018 16:03:47 +0100
+Subject: ARM: dts: imx6q-bx50v3: Add internal switch
+
+From: Sebastian Reichel <sebastian.reichel@collabora.co.uk>
+
+[ Upstream commit e26dead442689a861358f33126210b0f8de615a9 ]
+
+B850v3, B650v3 and B450v3 all have a GPIO bit banged MDIO bus to
+communicate with a Marvell switch. On all devices the switch is
+connected to a PCI based network card, which needs to be referenced
+by DT, so this also adds the common PCI root node.
+
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.co.uk>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx6q-bx50v3.dtsi | 62 +++++++++++++++++++++++++++++
+ 1 file changed, 62 insertions(+)
+
+diff --git a/arch/arm/boot/dts/imx6q-bx50v3.dtsi b/arch/arm/boot/dts/imx6q-bx50v3.dtsi
+index 1015e55ca8f7..8420378d095d 100644
+--- a/arch/arm/boot/dts/imx6q-bx50v3.dtsi
++++ b/arch/arm/boot/dts/imx6q-bx50v3.dtsi
+@@ -92,6 +92,56 @@
+ mux-int-port = <1>;
+ mux-ext-port = <4>;
+ };
++
++ aliases {
++ mdio-gpio0 = &mdio0;
++ };
++
++ mdio0: mdio-gpio {
++ compatible = "virtual,mdio-gpio";
++ gpios = <&gpio2 5 GPIO_ACTIVE_HIGH>, /* mdc */
++ <&gpio2 7 GPIO_ACTIVE_HIGH>; /* mdio */
++
++ #address-cells = <1>;
++ #size-cells = <0>;
++
++ switch@0 {
++ compatible = "marvell,mv88e6085"; /* 88e6240*/
++ #address-cells = <1>;
++ #size-cells = <0>;
++ reg = <0>;
++
++ switch_ports: ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
++ };
++
++ mdio {
++ #address-cells = <1>;
++ #size-cells = <0>;
++
++ switchphy0: switchphy@0 {
++ reg = <0>;
++ };
++
++ switchphy1: switchphy@1 {
++ reg = <1>;
++ };
++
++ switchphy2: switchphy@2 {
++ reg = <2>;
++ };
++
++ switchphy3: switchphy@3 {
++ reg = <3>;
++ };
++
++ switchphy4: switchphy@4 {
++ reg = <4>;
++ };
++ };
++ };
++ };
+ };
+
+ &ecspi5 {
+@@ -326,3 +376,15 @@
+ tcxo-clock-frequency = <26000000>;
+ };
+ };
++
++&pcie {
++ /* Synopsys, Inc. Device */
++ pci_root: root@0,0 {
++ compatible = "pci16c3,abcd";
++ reg = <0x00000000 0 0 0 0>;
++
++ #address-cells = <3>;
++ #size-cells = <2>;
++ #interrupt-cells = <1>;
++ };
++};
+--
+2.25.1
+
--- /dev/null
+From c44e60a5e2304c0ff17d925760fab2e12f69a2a6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 May 2020 19:02:37 +0200
+Subject: ARM: dts/imx6q-bx50v3: Set display interface clock parents
+
+From: Robert Beckett <bob.beckett@collabora.com>
+
+[ Upstream commit 665e7c73a7724a393b4ec92d1ae1e029925ef2b7 ]
+
+Avoid LDB and IPU DI clocks both using the same parent. LDB requires
+pasthrough clock to avoid breaking timing while IPU DI does not.
+
+Force IPU DI clocks to use IMX6QDL_CLK_PLL2_PFD0_352M as parent
+and LDB to use IMX6QDL_CLK_PLL5_VIDEO_DIV.
+
+This fixes an issue where attempting atomic modeset while using
+HDMI and display port at the same time causes LDB clock programming
+to destroy the programming of HDMI that was done during the same
+modeset.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Robert Beckett <bob.beckett@collabora.com>
+[Use IMX6QDL_CLK_PLL2_PFD0_352M instead of IMX6QDL_CLK_PLL2_PFD2_396M
+ originally chosen by Robert Beckett to avoid affecting eMMC clock
+ by DRM atomic updates]
+Signed-off-by: Ian Ray <ian.ray@ge.com>
+[Squash Robert's and Ian's commits for bisectability, update patch
+ description and add stable tag]
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx6q-b450v3.dts | 7 -------
+ arch/arm/boot/dts/imx6q-b650v3.dts | 7 -------
+ arch/arm/boot/dts/imx6q-b850v3.dts | 11 -----------
+ arch/arm/boot/dts/imx6q-bx50v3.dtsi | 15 +++++++++++++++
+ 4 files changed, 15 insertions(+), 25 deletions(-)
+
+diff --git a/arch/arm/boot/dts/imx6q-b450v3.dts b/arch/arm/boot/dts/imx6q-b450v3.dts
+index 404a93d9596b..dc7d65da7d01 100644
+--- a/arch/arm/boot/dts/imx6q-b450v3.dts
++++ b/arch/arm/boot/dts/imx6q-b450v3.dts
+@@ -65,13 +65,6 @@
+ };
+ };
+
+-&clks {
+- assigned-clocks = <&clks IMX6QDL_CLK_LDB_DI0_SEL>,
+- <&clks IMX6QDL_CLK_LDB_DI1_SEL>;
+- assigned-clock-parents = <&clks IMX6QDL_CLK_PLL3_USB_OTG>,
+- <&clks IMX6QDL_CLK_PLL3_USB_OTG>;
+-};
+-
+ &ldb {
+ status = "okay";
+
+diff --git a/arch/arm/boot/dts/imx6q-b650v3.dts b/arch/arm/boot/dts/imx6q-b650v3.dts
+index 7f9f176901d4..101d61f93070 100644
+--- a/arch/arm/boot/dts/imx6q-b650v3.dts
++++ b/arch/arm/boot/dts/imx6q-b650v3.dts
+@@ -65,13 +65,6 @@
+ };
+ };
+
+-&clks {
+- assigned-clocks = <&clks IMX6QDL_CLK_LDB_DI0_SEL>,
+- <&clks IMX6QDL_CLK_LDB_DI1_SEL>;
+- assigned-clock-parents = <&clks IMX6QDL_CLK_PLL3_USB_OTG>,
+- <&clks IMX6QDL_CLK_PLL3_USB_OTG>;
+-};
+-
+ &ldb {
+ status = "okay";
+
+diff --git a/arch/arm/boot/dts/imx6q-b850v3.dts b/arch/arm/boot/dts/imx6q-b850v3.dts
+index 46bdc6722715..8fc831dc3156 100644
+--- a/arch/arm/boot/dts/imx6q-b850v3.dts
++++ b/arch/arm/boot/dts/imx6q-b850v3.dts
+@@ -53,17 +53,6 @@
+ };
+ };
+
+-&clks {
+- assigned-clocks = <&clks IMX6QDL_CLK_LDB_DI0_SEL>,
+- <&clks IMX6QDL_CLK_LDB_DI1_SEL>,
+- <&clks IMX6QDL_CLK_IPU1_DI0_PRE_SEL>,
+- <&clks IMX6QDL_CLK_IPU2_DI0_PRE_SEL>;
+- assigned-clock-parents = <&clks IMX6QDL_CLK_PLL5_VIDEO_DIV>,
+- <&clks IMX6QDL_CLK_PLL5_VIDEO_DIV>,
+- <&clks IMX6QDL_CLK_PLL2_PFD2_396M>,
+- <&clks IMX6QDL_CLK_PLL2_PFD2_396M>;
+-};
+-
+ &ldb {
+ fsl,dual-channel;
+ status = "okay";
+diff --git a/arch/arm/boot/dts/imx6q-bx50v3.dtsi b/arch/arm/boot/dts/imx6q-bx50v3.dtsi
+index 8420378d095d..f3c2c5587616 100644
+--- a/arch/arm/boot/dts/imx6q-bx50v3.dtsi
++++ b/arch/arm/boot/dts/imx6q-bx50v3.dtsi
+@@ -388,3 +388,18 @@
+ #interrupt-cells = <1>;
+ };
+ };
++
++&clks {
++ assigned-clocks = <&clks IMX6QDL_CLK_LDB_DI0_SEL>,
++ <&clks IMX6QDL_CLK_LDB_DI1_SEL>,
++ <&clks IMX6QDL_CLK_IPU1_DI0_PRE_SEL>,
++ <&clks IMX6QDL_CLK_IPU1_DI1_PRE_SEL>,
++ <&clks IMX6QDL_CLK_IPU2_DI0_PRE_SEL>,
++ <&clks IMX6QDL_CLK_IPU2_DI1_PRE_SEL>;
++ assigned-clock-parents = <&clks IMX6QDL_CLK_PLL5_VIDEO_DIV>,
++ <&clks IMX6QDL_CLK_PLL5_VIDEO_DIV>,
++ <&clks IMX6QDL_CLK_PLL2_PFD0_352M>,
++ <&clks IMX6QDL_CLK_PLL2_PFD0_352M>,
++ <&clks IMX6QDL_CLK_PLL2_PFD0_352M>,
++ <&clks IMX6QDL_CLK_PLL2_PFD0_352M>;
++};
+--
+2.25.1
+
--- /dev/null
+From d42f8b51fda4296096464343c19e20606b2fbcf2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 3 May 2020 13:03:54 +0100
+Subject: ARM: uaccess: consolidate uaccess asm to asm/uaccess-asm.h
+
+From: Russell King <rmk+kernel@armlinux.org.uk>
+
+[ Upstream commit 747ffc2fcf969eff9309d7f2d1d61cb8b9e1bb40 ]
+
+Consolidate the user access assembly code to asm/uaccess-asm.h. This
+moves the csdb, check_uaccess, uaccess_mask_range_ptr, uaccess_enable,
+uaccess_disable, uaccess_save, uaccess_restore macros, and creates two
+new ones for exception entry and exit - uaccess_entry and uaccess_exit.
+
+This makes the uaccess_save and uaccess_restore macros private to
+asm/uaccess-asm.h.
+
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/include/asm/assembler.h | 75 +-------------------
+ arch/arm/include/asm/uaccess-asm.h | 106 +++++++++++++++++++++++++++++
+ arch/arm/kernel/entry-armv.S | 11 +--
+ arch/arm/kernel/entry-header.S | 9 +--
+ 4 files changed, 112 insertions(+), 89 deletions(-)
+ create mode 100644 arch/arm/include/asm/uaccess-asm.h
+
+diff --git a/arch/arm/include/asm/assembler.h b/arch/arm/include/asm/assembler.h
+index 965224d14e6c..1935b580f0e8 100644
+--- a/arch/arm/include/asm/assembler.h
++++ b/arch/arm/include/asm/assembler.h
+@@ -21,11 +21,11 @@
+ #endif
+
+ #include <asm/ptrace.h>
+-#include <asm/domain.h>
+ #include <asm/opcodes-virt.h>
+ #include <asm/asm-offsets.h>
+ #include <asm/page.h>
+ #include <asm/thread_info.h>
++#include <asm/uaccess-asm.h>
+
+ #define IOMEM(x) (x)
+
+@@ -447,79 +447,6 @@ THUMB( orr \reg , \reg , #PSR_T_BIT )
+ .size \name , . - \name
+ .endm
+
+- .macro csdb
+-#ifdef CONFIG_THUMB2_KERNEL
+- .inst.w 0xf3af8014
+-#else
+- .inst 0xe320f014
+-#endif
+- .endm
+-
+- .macro check_uaccess, addr:req, size:req, limit:req, tmp:req, bad:req
+-#ifndef CONFIG_CPU_USE_DOMAINS
+- adds \tmp, \addr, #\size - 1
+- sbcscc \tmp, \tmp, \limit
+- bcs \bad
+-#ifdef CONFIG_CPU_SPECTRE
+- movcs \addr, #0
+- csdb
+-#endif
+-#endif
+- .endm
+-
+- .macro uaccess_mask_range_ptr, addr:req, size:req, limit:req, tmp:req
+-#ifdef CONFIG_CPU_SPECTRE
+- sub \tmp, \limit, #1
+- subs \tmp, \tmp, \addr @ tmp = limit - 1 - addr
+- addhs \tmp, \tmp, #1 @ if (tmp >= 0) {
+- subshs \tmp, \tmp, \size @ tmp = limit - (addr + size) }
+- movlo \addr, #0 @ if (tmp < 0) addr = NULL
+- csdb
+-#endif
+- .endm
+-
+- .macro uaccess_disable, tmp, isb=1
+-#ifdef CONFIG_CPU_SW_DOMAIN_PAN
+- /*
+- * Whenever we re-enter userspace, the domains should always be
+- * set appropriately.
+- */
+- mov \tmp, #DACR_UACCESS_DISABLE
+- mcr p15, 0, \tmp, c3, c0, 0 @ Set domain register
+- .if \isb
+- instr_sync
+- .endif
+-#endif
+- .endm
+-
+- .macro uaccess_enable, tmp, isb=1
+-#ifdef CONFIG_CPU_SW_DOMAIN_PAN
+- /*
+- * Whenever we re-enter userspace, the domains should always be
+- * set appropriately.
+- */
+- mov \tmp, #DACR_UACCESS_ENABLE
+- mcr p15, 0, \tmp, c3, c0, 0
+- .if \isb
+- instr_sync
+- .endif
+-#endif
+- .endm
+-
+- .macro uaccess_save, tmp
+-#ifdef CONFIG_CPU_SW_DOMAIN_PAN
+- mrc p15, 0, \tmp, c3, c0, 0
+- str \tmp, [sp, #SVC_DACR]
+-#endif
+- .endm
+-
+- .macro uaccess_restore
+-#ifdef CONFIG_CPU_SW_DOMAIN_PAN
+- ldr r0, [sp, #SVC_DACR]
+- mcr p15, 0, r0, c3, c0, 0
+-#endif
+- .endm
+-
+ .irp c,,eq,ne,cs,cc,mi,pl,vs,vc,hi,ls,ge,lt,gt,le,hs,lo
+ .macro ret\c, reg
+ #if __LINUX_ARM_ARCH__ < 6
+diff --git a/arch/arm/include/asm/uaccess-asm.h b/arch/arm/include/asm/uaccess-asm.h
+new file mode 100644
+index 000000000000..d475e3e8145d
+--- /dev/null
++++ b/arch/arm/include/asm/uaccess-asm.h
+@@ -0,0 +1,106 @@
++/* SPDX-License-Identifier: GPL-2.0-only */
++
++#ifndef __ASM_UACCESS_ASM_H__
++#define __ASM_UACCESS_ASM_H__
++
++#include <asm/asm-offsets.h>
++#include <asm/domain.h>
++#include <asm/memory.h>
++#include <asm/thread_info.h>
++
++ .macro csdb
++#ifdef CONFIG_THUMB2_KERNEL
++ .inst.w 0xf3af8014
++#else
++ .inst 0xe320f014
++#endif
++ .endm
++
++ .macro check_uaccess, addr:req, size:req, limit:req, tmp:req, bad:req
++#ifndef CONFIG_CPU_USE_DOMAINS
++ adds \tmp, \addr, #\size - 1
++ sbcscc \tmp, \tmp, \limit
++ bcs \bad
++#ifdef CONFIG_CPU_SPECTRE
++ movcs \addr, #0
++ csdb
++#endif
++#endif
++ .endm
++
++ .macro uaccess_mask_range_ptr, addr:req, size:req, limit:req, tmp:req
++#ifdef CONFIG_CPU_SPECTRE
++ sub \tmp, \limit, #1
++ subs \tmp, \tmp, \addr @ tmp = limit - 1 - addr
++ addhs \tmp, \tmp, #1 @ if (tmp >= 0) {
++ subshs \tmp, \tmp, \size @ tmp = limit - (addr + size) }
++ movlo \addr, #0 @ if (tmp < 0) addr = NULL
++ csdb
++#endif
++ .endm
++
++ .macro uaccess_disable, tmp, isb=1
++#ifdef CONFIG_CPU_SW_DOMAIN_PAN
++ /*
++ * Whenever we re-enter userspace, the domains should always be
++ * set appropriately.
++ */
++ mov \tmp, #DACR_UACCESS_DISABLE
++ mcr p15, 0, \tmp, c3, c0, 0 @ Set domain register
++ .if \isb
++ instr_sync
++ .endif
++#endif
++ .endm
++
++ .macro uaccess_enable, tmp, isb=1
++#ifdef CONFIG_CPU_SW_DOMAIN_PAN
++ /*
++ * Whenever we re-enter userspace, the domains should always be
++ * set appropriately.
++ */
++ mov \tmp, #DACR_UACCESS_ENABLE
++ mcr p15, 0, \tmp, c3, c0, 0
++ .if \isb
++ instr_sync
++ .endif
++#endif
++ .endm
++
++ .macro uaccess_save, tmp
++#ifdef CONFIG_CPU_SW_DOMAIN_PAN
++ mrc p15, 0, \tmp, c3, c0, 0
++ str \tmp, [sp, #SVC_DACR]
++#endif
++ .endm
++
++ .macro uaccess_restore
++#ifdef CONFIG_CPU_SW_DOMAIN_PAN
++ ldr r0, [sp, #SVC_DACR]
++ mcr p15, 0, r0, c3, c0, 0
++#endif
++ .endm
++
++ /*
++ * Save the address limit on entry to a privileged exception and
++ * if using PAN, save and disable usermode access.
++ */
++ .macro uaccess_entry, tsk, tmp0, tmp1, tmp2, disable
++ ldr \tmp0, [\tsk, #TI_ADDR_LIMIT]
++ mov \tmp1, #TASK_SIZE
++ str \tmp1, [\tsk, #TI_ADDR_LIMIT]
++ str \tmp0, [sp, #SVC_ADDR_LIMIT]
++ uaccess_save \tmp0
++ .if \disable
++ uaccess_disable \tmp0
++ .endif
++ .endm
++
++ /* Restore the user access state previously saved by uaccess_entry */
++ .macro uaccess_exit, tsk, tmp0, tmp1
++ ldr \tmp1, [sp, #SVC_ADDR_LIMIT]
++ uaccess_restore
++ str \tmp1, [\tsk, #TI_ADDR_LIMIT]
++ .endm
++
++#endif /* __ASM_UACCESS_ASM_H__ */
+diff --git a/arch/arm/kernel/entry-armv.S b/arch/arm/kernel/entry-armv.S
+index fbc707626b3e..f3de76f7ad43 100644
+--- a/arch/arm/kernel/entry-armv.S
++++ b/arch/arm/kernel/entry-armv.S
+@@ -30,6 +30,7 @@
+ #include <asm/unistd.h>
+ #include <asm/tls.h>
+ #include <asm/system_info.h>
++#include <asm/uaccess-asm.h>
+
+ #include "entry-header.S"
+ #include <asm/entry-macro-multi.S>
+@@ -186,15 +187,7 @@ ENDPROC(__und_invalid)
+ stmia r7, {r2 - r6}
+
+ get_thread_info tsk
+- ldr r0, [tsk, #TI_ADDR_LIMIT]
+- mov r1, #TASK_SIZE
+- str r1, [tsk, #TI_ADDR_LIMIT]
+- str r0, [sp, #SVC_ADDR_LIMIT]
+-
+- uaccess_save r0
+- .if \uaccess
+- uaccess_disable r0
+- .endif
++ uaccess_entry tsk, r0, r1, r2, \uaccess
+
+ .if \trace
+ #ifdef CONFIG_TRACE_IRQFLAGS
+diff --git a/arch/arm/kernel/entry-header.S b/arch/arm/kernel/entry-header.S
+index 62db1c9746cb..7b595f2d4a28 100644
+--- a/arch/arm/kernel/entry-header.S
++++ b/arch/arm/kernel/entry-header.S
+@@ -6,6 +6,7 @@
+ #include <asm/asm-offsets.h>
+ #include <asm/errno.h>
+ #include <asm/thread_info.h>
++#include <asm/uaccess-asm.h>
+ #include <asm/v7m.h>
+
+ @ Bad Abort numbers
+@@ -217,9 +218,7 @@
+ blne trace_hardirqs_off
+ #endif
+ .endif
+- ldr r1, [sp, #SVC_ADDR_LIMIT]
+- uaccess_restore
+- str r1, [tsk, #TI_ADDR_LIMIT]
++ uaccess_exit tsk, r0, r1
+
+ #ifndef CONFIG_THUMB2_KERNEL
+ @ ARM mode SVC restore
+@@ -263,9 +262,7 @@
+ @ on the stack remains correct).
+ @
+ .macro svc_exit_via_fiq
+- ldr r1, [sp, #SVC_ADDR_LIMIT]
+- uaccess_restore
+- str r1, [tsk, #TI_ADDR_LIMIT]
++ uaccess_exit tsk, r0, r1
+ #ifndef CONFIG_THUMB2_KERNEL
+ @ ARM mode restore
+ mov r0, sp
+--
+2.25.1
+
--- /dev/null
+From c94f96e2798bbea6b60f36aa60a2d4be7b93b1ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 3 May 2020 13:24:07 +0100
+Subject: ARM: uaccess: fix DACR mismatch with nested exceptions
+
+From: Russell King <rmk+kernel@armlinux.org.uk>
+
+[ Upstream commit 71f8af1110101facfad68989ff91f88f8e2c3e22 ]
+
+Tomas Paukrt reports that his SAM9X60 based system (ARM926, ARMv5TJ)
+fails to fix up alignment faults, eventually resulting in a kernel
+oops.
+
+The problem occurs when using CONFIG_CPU_USE_DOMAINS with commit
+e6978e4bf181 ("ARM: save and reset the address limit when entering an
+exception"). This is because the address limit is set back to
+TASK_SIZE on exception entry, and, although it is restored on exception
+exit, the domain register is not.
+
+Hence, this sequence can occur:
+
+ interrupt
+ pt_regs->addr_limit = addr_limit // USER_DS
+ addr_limit = USER_DS
+ alignment exception
+ __probe_kernel_read()
+ old_fs = get_fs() // USER_DS
+ set_fs(KERNEL_DS)
+ addr_limit = KERNEL_DS
+ dacr.kernel = DOMAIN_MANAGER
+ interrupt
+ pt_regs->addr_limit = addr_limit // KERNEL_DS
+ addr_limit = USER_DS
+ alignment exception
+ __probe_kernel_read()
+ old_fs = get_fs() // USER_DS
+ set_fs(KERNEL_DS)
+ addr_limit = KERNEL_DS
+ dacr.kernel = DOMAIN_MANAGER
+ ...
+ set_fs(old_fs)
+ addr_limit = USER_DS
+ dacr.kernel = DOMAIN_CLIENT
+ ...
+ addr_limit = pt_regs->addr_limit // KERNEL_DS
+ interrupt returns
+
+At this point, addr_limit is correctly restored to KERNEL_DS for
+__probe_kernel_read() to continue execution, but dacr.kernel is not,
+it has been reset by the set_fs(old_fs) to DOMAIN_CLIENT.
+
+This would not have happened prior to the mentioned commit, because
+addr_limit would remain KERNEL_DS, so get_fs() would have returned
+KERNEL_DS, and so would correctly nest.
+
+This commit fixes the problem by also saving the DACR on exception
+entry if either CONFIG_CPU_SW_DOMAIN_PAN or CONFIG_CPU_USE_DOMAINS are
+enabled, and resetting the DACR appropriately on exception entry to
+match addr_limit and PAN settings.
+
+Fixes: e6978e4bf181 ("ARM: save and reset the address limit when entering an exception")
+Reported-by: Tomas Paukrt <tomas.paukrt@advantech.cz>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/include/asm/uaccess-asm.h | 25 ++++++++++++++++++++-----
+ 1 file changed, 20 insertions(+), 5 deletions(-)
+
+diff --git a/arch/arm/include/asm/uaccess-asm.h b/arch/arm/include/asm/uaccess-asm.h
+index e46468b91eaa..907571fd05c6 100644
+--- a/arch/arm/include/asm/uaccess-asm.h
++++ b/arch/arm/include/asm/uaccess-asm.h
+@@ -67,15 +67,21 @@
+ #endif
+ .endm
+
+-#ifdef CONFIG_CPU_SW_DOMAIN_PAN
++#if defined(CONFIG_CPU_SW_DOMAIN_PAN) || defined(CONFIG_CPU_USE_DOMAINS)
+ #define DACR(x...) x
+ #else
+ #define DACR(x...)
+ #endif
+
+ /*
+- * Save the address limit on entry to a privileged exception and
+- * if using PAN, save and disable usermode access.
++ * Save the address limit on entry to a privileged exception.
++ *
++ * If we are using the DACR for kernel access by the user accessors
++ * (CONFIG_CPU_USE_DOMAINS=y), always reset the DACR kernel domain
++ * back to client mode, whether or not \disable is set.
++ *
++ * If we are using SW PAN, set the DACR user domain to no access
++ * if \disable is set.
+ */
+ .macro uaccess_entry, tsk, tmp0, tmp1, tmp2, disable
+ ldr \tmp1, [\tsk, #TI_ADDR_LIMIT]
+@@ -84,8 +90,17 @@
+ DACR( mrc p15, 0, \tmp0, c3, c0, 0)
+ DACR( str \tmp0, [sp, #SVC_DACR])
+ str \tmp1, [sp, #SVC_ADDR_LIMIT]
+- .if \disable
+- uaccess_disable \tmp0
++ .if \disable && IS_ENABLED(CONFIG_CPU_SW_DOMAIN_PAN)
++ /* kernel=client, user=no access */
++ mov \tmp2, #DACR_UACCESS_DISABLE
++ mcr p15, 0, \tmp2, c3, c0, 0
++ instr_sync
++ .elseif IS_ENABLED(CONFIG_CPU_USE_DOMAINS)
++ /* kernel=client */
++ bic \tmp2, \tmp0, #domain_mask(DOMAIN_KERNEL)
++ orr \tmp2, \tmp2, #domain_val(DOMAIN_KERNEL, DOMAIN_CLIENT)
++ mcr p15, 0, \tmp2, c3, c0, 0
++ instr_sync
+ .endif
+ .endm
+
+--
+2.25.1
+
--- /dev/null
+From 1f60424971c0e725ccc476b7f9ea18180de95152 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 3 May 2020 13:14:09 +0100
+Subject: ARM: uaccess: integrate uaccess_save and uaccess_restore
+
+From: Russell King <rmk+kernel@armlinux.org.uk>
+
+[ Upstream commit 8ede890b0bcebe8c760aacfe20e934d98c3dc6aa ]
+
+Integrate uaccess_save / uaccess_restore macros into the new
+uaccess_entry / uaccess_exit macros respectively.
+
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/include/asm/uaccess-asm.h | 30 +++++++++++++-----------------
+ 1 file changed, 13 insertions(+), 17 deletions(-)
+
+diff --git a/arch/arm/include/asm/uaccess-asm.h b/arch/arm/include/asm/uaccess-asm.h
+index d475e3e8145d..e46468b91eaa 100644
+--- a/arch/arm/include/asm/uaccess-asm.h
++++ b/arch/arm/include/asm/uaccess-asm.h
+@@ -67,30 +67,23 @@
+ #endif
+ .endm
+
+- .macro uaccess_save, tmp
+ #ifdef CONFIG_CPU_SW_DOMAIN_PAN
+- mrc p15, 0, \tmp, c3, c0, 0
+- str \tmp, [sp, #SVC_DACR]
+-#endif
+- .endm
+-
+- .macro uaccess_restore
+-#ifdef CONFIG_CPU_SW_DOMAIN_PAN
+- ldr r0, [sp, #SVC_DACR]
+- mcr p15, 0, r0, c3, c0, 0
++#define DACR(x...) x
++#else
++#define DACR(x...)
+ #endif
+- .endm
+
+ /*
+ * Save the address limit on entry to a privileged exception and
+ * if using PAN, save and disable usermode access.
+ */
+ .macro uaccess_entry, tsk, tmp0, tmp1, tmp2, disable
+- ldr \tmp0, [\tsk, #TI_ADDR_LIMIT]
+- mov \tmp1, #TASK_SIZE
+- str \tmp1, [\tsk, #TI_ADDR_LIMIT]
+- str \tmp0, [sp, #SVC_ADDR_LIMIT]
+- uaccess_save \tmp0
++ ldr \tmp1, [\tsk, #TI_ADDR_LIMIT]
++ mov \tmp2, #TASK_SIZE
++ str \tmp2, [\tsk, #TI_ADDR_LIMIT]
++ DACR( mrc p15, 0, \tmp0, c3, c0, 0)
++ DACR( str \tmp0, [sp, #SVC_DACR])
++ str \tmp1, [sp, #SVC_ADDR_LIMIT]
+ .if \disable
+ uaccess_disable \tmp0
+ .endif
+@@ -99,8 +92,11 @@
+ /* Restore the user access state previously saved by uaccess_entry */
+ .macro uaccess_exit, tsk, tmp0, tmp1
+ ldr \tmp1, [sp, #SVC_ADDR_LIMIT]
+- uaccess_restore
++ DACR( ldr \tmp0, [sp, #SVC_DACR])
+ str \tmp1, [\tsk, #TI_ADDR_LIMIT]
++ DACR( mcr p15, 0, \tmp0, c3, c0, 0)
+ .endm
+
++#undef DACR
++
+ #endif /* __ASM_UACCESS_ASM_H__ */
+--
+2.25.1
+
--- /dev/null
+From c34aa1f523c956c04692ee73b61f38ca37d5a5c0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 May 2020 12:56:15 -0500
+Subject: exec: Always set cap_ambient in cap_bprm_set_creds
+
+From: Eric W. Biederman <ebiederm@xmission.com>
+
+[ Upstream commit a4ae32c71fe90794127b32d26d7ad795813b502e ]
+
+An invariant of cap_bprm_set_creds is that every field in the new cred
+structure that cap_bprm_set_creds might set, needs to be set every
+time to ensure the fields does not get a stale value.
+
+The field cap_ambient is not set every time cap_bprm_set_creds is
+called, which means that if there is a suid or sgid script with an
+interpreter that has neither the suid nor the sgid bits set the
+interpreter should be able to accept ambient credentials.
+Unfortuantely because cap_ambient is not reset to it's original value
+the interpreter can not accept ambient credentials.
+
+Given that the ambient capability set is expected to be controlled by
+the caller, I don't think this is particularly serious. But it is
+definitely worth fixing so the code works correctly.
+
+I have tested to verify my reading of the code is correct and the
+interpreter of a sgid can receive ambient capabilities with this
+change and cannot receive ambient capabilities without this change.
+
+Cc: stable@vger.kernel.org
+Cc: Andy Lutomirski <luto@kernel.org>
+Fixes: 58319057b784 ("capabilities: ambient capabilities")
+Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/commoncap.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/security/commoncap.c b/security/commoncap.c
+index ae26ef006988..ac031fa39190 100644
+--- a/security/commoncap.c
++++ b/security/commoncap.c
+@@ -711,6 +711,7 @@ int cap_bprm_set_creds(struct linux_binprm *bprm)
+ int ret;
+ kuid_t root_uid;
+
++ new->cap_ambient = old->cap_ambient;
+ if (WARN_ON(!cap_ambient_invariant_ok(old)))
+ return -EPERM;
+
+--
+2.25.1
+
--- /dev/null
+From 26778ad2db89cc78c5fc2d68832baa44fc8478b6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 May 2020 22:20:52 -0700
+Subject: fs/binfmt_elf.c: allocate initialized memory in
+ fill_thread_core_info()
+
+From: Alexander Potapenko <glider@google.com>
+
+[ Upstream commit 1d605416fb7175e1adf094251466caa52093b413 ]
+
+KMSAN reported uninitialized data being written to disk when dumping
+core. As a result, several kilobytes of kmalloc memory may be written
+to the core file and then read by a non-privileged user.
+
+Reported-by: sam <sunhaoyl@outlook.com>
+Signed-off-by: Alexander Potapenko <glider@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Acked-by: Kees Cook <keescook@chromium.org>
+Cc: Al Viro <viro@zeniv.linux.org.uk>
+Cc: Alexey Dobriyan <adobriyan@gmail.com>
+Cc: <stable@vger.kernel.org>
+Link: http://lkml.kernel.org/r/20200419100848.63472-1-glider@google.com
+Link: https://github.com/google/kmsan/issues/76
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/binfmt_elf.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
+index 166846a40078..2c433c95adb5 100644
+--- a/fs/binfmt_elf.c
++++ b/fs/binfmt_elf.c
+@@ -1740,7 +1740,7 @@ static int fill_thread_core_info(struct elf_thread_core_info *t,
+ (!regset->active || regset->active(t->task, regset) > 0)) {
+ int ret;
+ size_t size = regset->n * regset->size;
+- void *data = kmalloc(size, GFP_KERNEL);
++ void *data = kzalloc(size, GFP_KERNEL);
+ if (unlikely(!data))
+ return 0;
+ ret = regset->get(t->task, regset,
+--
+2.25.1
+
--- /dev/null
+From d99dc75869786a88428c9a7ea702cfc9593b7656 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Apr 2020 15:56:54 +0200
+Subject: gpio: exar: Fix bad handling for ida_simple_get error path
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 333830aa149a87cabeb5d30fbcf12eecc8040d2c ]
+
+The commit 7ecced0934e5 ("gpio: exar: add a check for the return value
+of ida_simple_get fails") added a goto jump to the common error
+handler for ida_simple_get() error, but this is wrong in two ways:
+it doesn't set the proper return code and, more badly, it invokes
+ida_simple_remove() with a negative index that shall lead to a kernel
+panic via BUG_ON().
+
+This patch addresses those two issues.
+
+Fixes: 7ecced0934e5 ("gpio: exar: add a check for the return value of ida_simple_get fails")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-exar.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpio/gpio-exar.c b/drivers/gpio/gpio-exar.c
+index a09d2f9ebacc..695c19901eff 100644
+--- a/drivers/gpio/gpio-exar.c
++++ b/drivers/gpio/gpio-exar.c
+@@ -148,8 +148,10 @@ static int gpio_exar_probe(struct platform_device *pdev)
+ mutex_init(&exar_gpio->lock);
+
+ index = ida_simple_get(&ida_index, 0, 0, GFP_KERNEL);
+- if (index < 0)
+- goto err_destroy;
++ if (index < 0) {
++ ret = index;
++ goto err_mutex_destroy;
++ }
+
+ sprintf(exar_gpio->name, "exar_gpio%d", index);
+ exar_gpio->gpio_chip.label = exar_gpio->name;
+@@ -176,6 +178,7 @@ static int gpio_exar_probe(struct platform_device *pdev)
+
+ err_destroy:
+ ida_simple_remove(&ida_index, index);
++err_mutex_destroy:
+ mutex_destroy(&exar_gpio->lock);
+ return ret;
+ }
+--
+2.25.1
+
--- /dev/null
+From 1d4bc724bdde1efaa2decb78d1be5e567db18791 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 May 2020 23:13:28 -0400
+Subject: IB/qib: Call kobject_put() when kobject_init_and_add() fails
+
+From: Kaike Wan <kaike.wan@intel.com>
+
+[ Upstream commit a35cd6447effd5c239b564c80fa109d05ff3d114 ]
+
+When kobject_init_and_add() returns an error in the function
+qib_create_port_files(), the function kobject_put() is not called for the
+corresponding kobject, which potentially leads to memory leak.
+
+This patch fixes the issue by calling kobject_put() even if
+kobject_init_and_add() fails. In addition, the ppd->diagc_kobj is released
+along with other kobjects when the sysfs is unregistered.
+
+Fixes: f931551bafe1 ("IB/qib: Add new qib driver for QLogic PCIe InfiniBand adapters")
+Link: https://lore.kernel.org/r/20200512031328.189865.48627.stgit@awfm-01.aw.intel.com
+Cc: <stable@vger.kernel.org>
+Suggested-by: Lin Yi <teroincn@gmail.com>
+Reviewed-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
+Signed-off-by: Kaike Wan <kaike.wan@intel.com>
+Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
+Reviewed-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/qib/qib_sysfs.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/infiniband/hw/qib/qib_sysfs.c b/drivers/infiniband/hw/qib/qib_sysfs.c
+index d831f3e61ae8..2626205780ee 100644
+--- a/drivers/infiniband/hw/qib/qib_sysfs.c
++++ b/drivers/infiniband/hw/qib/qib_sysfs.c
+@@ -756,7 +756,7 @@ int qib_create_port_files(struct ib_device *ibdev, u8 port_num,
+ qib_dev_err(dd,
+ "Skipping linkcontrol sysfs info, (err %d) port %u\n",
+ ret, port_num);
+- goto bail;
++ goto bail_link;
+ }
+ kobject_uevent(&ppd->pport_kobj, KOBJ_ADD);
+
+@@ -766,7 +766,7 @@ int qib_create_port_files(struct ib_device *ibdev, u8 port_num,
+ qib_dev_err(dd,
+ "Skipping sl2vl sysfs info, (err %d) port %u\n",
+ ret, port_num);
+- goto bail_link;
++ goto bail_sl;
+ }
+ kobject_uevent(&ppd->sl2vl_kobj, KOBJ_ADD);
+
+@@ -776,7 +776,7 @@ int qib_create_port_files(struct ib_device *ibdev, u8 port_num,
+ qib_dev_err(dd,
+ "Skipping diag_counters sysfs info, (err %d) port %u\n",
+ ret, port_num);
+- goto bail_sl;
++ goto bail_diagc;
+ }
+ kobject_uevent(&ppd->diagc_kobj, KOBJ_ADD);
+
+@@ -789,7 +789,7 @@ int qib_create_port_files(struct ib_device *ibdev, u8 port_num,
+ qib_dev_err(dd,
+ "Skipping Congestion Control sysfs info, (err %d) port %u\n",
+ ret, port_num);
+- goto bail_diagc;
++ goto bail_cc;
+ }
+
+ kobject_uevent(&ppd->pport_cc_kobj, KOBJ_ADD);
+@@ -871,6 +871,7 @@ void qib_verbs_unregister_sysfs(struct qib_devdata *dd)
+ &cc_table_bin_attr);
+ kobject_put(&ppd->pport_cc_kobj);
+ }
++ kobject_put(&ppd->diagc_kobj);
+ kobject_put(&ppd->sl2vl_kobj);
+ kobject_put(&ppd->pport_kobj);
+ }
+--
+2.25.1
+
--- /dev/null
+From cc7e9e7deb78584a5530877f69f4cb3bd995436d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 May 2020 22:20:55 -0700
+Subject: include/asm-generic/topology.h: guard cpumask_of_node() macro
+ argument
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 4377748c7b5187c3342a60fa2ceb60c8a57a8488 ]
+
+drivers/hwmon/amd_energy.c:195:15: error: invalid operands to binary expression ('void' and 'int')
+ (channel - data->nr_cpus));
+ ~~~~~~~~~^~~~~~~~~~~~~~~~~
+include/asm-generic/topology.h:51:42: note: expanded from macro 'cpumask_of_node'
+ #define cpumask_of_node(node) ((void)node, cpu_online_mask)
+ ^~~~
+include/linux/cpumask.h:618:72: note: expanded from macro 'cpumask_first_and'
+ #define cpumask_first_and(src1p, src2p) cpumask_next_and(-1, (src1p), (src2p))
+ ^~~~~
+
+Fixes: f0b848ce6fe9 ("cpumask: Introduce cpumask_of_{node,pcibus} to replace {node,pcibus}_to_cpumask")
+Fixes: 8abee9566b7e ("hwmon: Add amd_energy driver to report energy counters")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Acked-by: Guenter Roeck <linux@roeck-us.net>
+Link: http://lkml.kernel.org/r/20200527134623.930247-1-arnd@arndb.de
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/asm-generic/topology.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/asm-generic/topology.h b/include/asm-generic/topology.h
+index 5d2add1a6c96..864fcfa1df41 100644
+--- a/include/asm-generic/topology.h
++++ b/include/asm-generic/topology.h
+@@ -51,7 +51,7 @@
+ #ifdef CONFIG_NEED_MULTIPLE_NODES
+ #define cpumask_of_node(node) ((node) == 0 ? cpu_online_mask : cpu_none_mask)
+ #else
+- #define cpumask_of_node(node) ((void)node, cpu_online_mask)
++ #define cpumask_of_node(node) ((void)(node), cpu_online_mask)
+ #endif
+ #endif
+ #ifndef pcibus_to_node
+--
+2.25.1
+
--- /dev/null
+From 8aea8558f6c7a5469276ec68bff6144db7d1c943 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Apr 2020 13:58:42 -0700
+Subject: Input: dlink-dir685-touchkeys - fix a typo in driver name
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 38347374ae3f1ec4df56dd688bd603a64e79a0ed ]
+
+According to the file name and Kconfig, a 'k' is missing in this driver
+name. It should be "dlink-dir685-touchkeys".
+
+Fixes: 131b3de7016b ("Input: add D-Link DIR-685 touchkeys driver")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Link: https://lore.kernel.org/r/20200412213937.5287-1-christophe.jaillet@wanadoo.fr
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/keyboard/dlink-dir685-touchkeys.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/input/keyboard/dlink-dir685-touchkeys.c b/drivers/input/keyboard/dlink-dir685-touchkeys.c
+index 88e321b76397..6fe4062e3ac2 100644
+--- a/drivers/input/keyboard/dlink-dir685-touchkeys.c
++++ b/drivers/input/keyboard/dlink-dir685-touchkeys.c
+@@ -142,7 +142,7 @@ MODULE_DEVICE_TABLE(of, dir685_tk_of_match);
+
+ static struct i2c_driver dir685_tk_i2c_driver = {
+ .driver = {
+- .name = "dlin-dir685-touchkeys",
++ .name = "dlink-dir685-touchkeys",
+ .of_match_table = of_match_ptr(dir685_tk_of_match),
+ },
+ .probe = dir685_tk_probe,
+--
+2.25.1
+
--- /dev/null
+From 9bd255f71fb03dbfca8b04d32075e0dd309ef3c9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Apr 2020 13:45:12 -0700
+Subject: Input: evdev - call input_flush_device() on release(), not flush()
+
+From: Brendan Shanks <bshanks@codeweavers.com>
+
+[ Upstream commit 09264098ff153f60866039d60b31d39b66f55a31 ]
+
+input_flush_device() should only be called once the struct file is being
+released and no open descriptors remain, but evdev_flush() was calling
+it whenever a file descriptor was closed.
+
+This caused uploaded force-feedback effects to be erased when a process
+did a dup()/close() on the event FD, called system(), etc.
+
+Call input_flush_device() from evdev_release() instead.
+
+Reported-by: Mathieu Maret <mathieu.maret@gmail.com>
+Signed-off-by: Brendan Shanks <bshanks@codeweavers.com>
+Link: https://lore.kernel.org/r/20200421231003.7935-1-bshanks@codeweavers.com
+Cc: stable@vger.kernel.org
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/evdev.c | 19 ++++---------------
+ 1 file changed, 4 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/input/evdev.c b/drivers/input/evdev.c
+index 925571475005..2463d02e3f99 100644
+--- a/drivers/input/evdev.c
++++ b/drivers/input/evdev.c
+@@ -342,20 +342,6 @@ static int evdev_fasync(int fd, struct file *file, int on)
+ return fasync_helper(fd, file, on, &client->fasync);
+ }
+
+-static int evdev_flush(struct file *file, fl_owner_t id)
+-{
+- struct evdev_client *client = file->private_data;
+- struct evdev *evdev = client->evdev;
+-
+- mutex_lock(&evdev->mutex);
+-
+- if (evdev->exist && !client->revoked)
+- input_flush_device(&evdev->handle, file);
+-
+- mutex_unlock(&evdev->mutex);
+- return 0;
+-}
+-
+ static void evdev_free(struct device *dev)
+ {
+ struct evdev *evdev = container_of(dev, struct evdev, dev);
+@@ -469,6 +455,10 @@ static int evdev_release(struct inode *inode, struct file *file)
+ unsigned int i;
+
+ mutex_lock(&evdev->mutex);
++
++ if (evdev->exist && !client->revoked)
++ input_flush_device(&evdev->handle, file);
++
+ evdev_ungrab(evdev, client);
+ mutex_unlock(&evdev->mutex);
+
+@@ -1331,7 +1321,6 @@ static const struct file_operations evdev_fops = {
+ .compat_ioctl = evdev_ioctl_compat,
+ #endif
+ .fasync = evdev_fasync,
+- .flush = evdev_flush,
+ .llseek = no_llseek,
+ };
+
+--
+2.25.1
+
--- /dev/null
+From c22549a00f0614ed49b1a7f0d7a7f1e10d111661 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Apr 2020 10:02:19 -0700
+Subject: Input: i8042 - add ThinkPad S230u to i8042 nomux list
+
+From: Kevin Locke <kevin@kevinlocke.name>
+
+[ Upstream commit 18931506465a762ffd3f4803d36a18d336a67da9 ]
+
+On the Lenovo ThinkPad Twist S230u (3347-4HU) with BIOS version
+"GDETC1WW (1.81 ) 06/27/2019", whether booted in UEFI or Legacy/CSM mode
+the keyboard, Synaptics TouchPad, and TrackPoint either do not function
+or stop functioning a few minutes after boot. This problem has been
+noted before, perhaps only occurring on BIOS 1.57 and
+later.[1][2][3][4][5]
+
+This model does not have an external PS/2 port, so mux does not appear
+to be useful.
+
+Odds of a BIOS fix appear to be low: 1.57 was released over 6 years ago
+and although the [BIOS changelog] notes "Fixed an issue of UEFI
+touchpad/trackpoint/keyboard/touchscreen" in 1.58, it appears to be
+insufficient.
+
+Adding 33474HU to the nomux list avoids the issue on my system.
+
+[1]: https://bugs.launchpad.net/bugs/1210748
+[2]: https://bbs.archlinux.org/viewtopic.php?pid=1360425
+[3]: https://forums.linuxmint.com/viewtopic.php?f=46&t=41200
+[4]: https://forums.linuxmint.com/viewtopic.php?f=49&t=157115
+[5]: https://forums.lenovo.com/topic/findpost/27/1337119
+[BIOS changelog]: https://download.lenovo.com/pccbbs/mobiles/gduj33uc.txt
+
+Signed-off-by: Kevin Locke <kevin@kevinlocke.name>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/feb8a8339a67025dab3850e6377eb6f3a0e782ba.1587400635.git.kevin@kevinlocke.name
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/serio/i8042-x86ia64io.h | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
+index 0d0f977a2f39..8bf38eded1ef 100644
+--- a/drivers/input/serio/i8042-x86ia64io.h
++++ b/drivers/input/serio/i8042-x86ia64io.h
+@@ -545,6 +545,13 @@ static const struct dmi_system_id __initconst i8042_dmi_nomux_table[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 5738"),
+ },
+ },
++ {
++ /* Lenovo ThinkPad Twist S230u */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "33474HU"),
++ },
++ },
+ { }
+ };
+
+--
+2.25.1
+
--- /dev/null
+From 891bf7ff470b4358eb210f92e02adaf31d1a7ede Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Apr 2020 18:07:20 -0700
+Subject: Input: i8042 - add ThinkPad S230u to i8042 reset list
+
+From: Kevin Locke <kevin@kevinlocke.name>
+
+[ Upstream commit 2712c91a54a1058d55c284152b4d93c979b67be6 ]
+
+On the Lenovo ThinkPad Twist S230u (3347-4HU) with BIOS version
+"GDETC1WW (1.81 ) 06/27/2019", the keyboard, Synaptics TouchPad, and
+TrackPoint either do not function or stop functioning a few minutes
+after boot. This problem has been noted before, perhaps only occurring
+with BIOS 1.57 and later.[1][2][3][4][5]
+
+Odds of a BIOS fix appear to be low: 1.57 was released over 6 years ago
+and although the [BIOS changelog] notes "Fixed an issue of UEFI
+touchpad/trackpoint/keyboard/touchscreen" in 1.58, it appears to be
+insufficient.
+
+Setting i8042.reset=1 or adding 33474HU to the reset list avoids the
+issue on my system from either warm or cold boot.
+
+[1]: https://bugs.launchpad.net/bugs/1210748
+[2]: https://bbs.archlinux.org/viewtopic.php?pid=1360425
+[3]: https://forums.linuxmint.com/viewtopic.php?f=46&t=41200
+[4]: https://forums.linuxmint.com/viewtopic.php?f=49&t=157115
+[5]: https://forums.lenovo.com/topic/findpost/27/1337119
+[BIOS changelog]: https://download.lenovo.com/pccbbs/mobiles/gduj33uc.txt
+
+Signed-off-by: Kevin Locke <kevin@kevinlocke.name>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/94f384b0f75f90f71425d7dce7ac82c59ddb87a8.1587702636.git.kevin@kevinlocke.name
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/serio/i8042-x86ia64io.h | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
+index 8bf38eded1ef..ad357f79c7d6 100644
+--- a/drivers/input/serio/i8042-x86ia64io.h
++++ b/drivers/input/serio/i8042-x86ia64io.h
+@@ -673,6 +673,13 @@ static const struct dmi_system_id __initconst i8042_dmi_reset_table[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "P65xRP"),
+ },
+ },
++ {
++ /* Lenovo ThinkPad Twist S230u */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "33474HU"),
++ },
++ },
+ { }
+ };
+
+--
+2.25.1
+
--- /dev/null
+From d6e3fe6a8fde7c5e4339794df19ebd71e8cb8f1a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Apr 2020 16:09:53 -0700
+Subject: Input: synaptics-rmi4 - fix error return code in rmi_driver_probe()
+
+From: Wei Yongjun <weiyongjun1@huawei.com>
+
+[ Upstream commit 5caab2da63207d6d631007f592f5219459e3454d ]
+
+Fix to return a negative error code from the input_register_device()
+error handling case instead of 0, as done elsewhere in this function.
+
+Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
+Link: https://lore.kernel.org/r/20200428134948.78343-1-weiyongjun1@huawei.com
+Cc: stable@vger.kernel.org
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/rmi4/rmi_driver.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/input/rmi4/rmi_driver.c b/drivers/input/rmi4/rmi_driver.c
+index 633fd0d660c1..30a8d816c45c 100644
+--- a/drivers/input/rmi4/rmi_driver.c
++++ b/drivers/input/rmi4/rmi_driver.c
+@@ -1220,7 +1220,8 @@ static int rmi_driver_probe(struct device *dev)
+ if (data->input) {
+ rmi_driver_set_input_name(rmi_dev, data->input);
+ if (!rmi_dev->xport->input) {
+- if (input_register_device(data->input)) {
++ retval = input_register_device(data->input);
++ if (retval) {
+ dev_err(dev, "%s: Failed to register input device.\n",
+ __func__);
+ goto err_destroy_functions;
+--
+2.25.1
+
--- /dev/null
+From 2cb4e7a505d3b6ee61c4f77fb06778c55c5c49cf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Apr 2020 18:08:58 -0700
+Subject: Input: synaptics-rmi4 - really fix attn_data use-after-free
+
+From: Evan Green <evgreen@chromium.org>
+
+[ Upstream commit d5a5e5b5fa7b86c05bf073acc0ba98fa280174ec ]
+
+Fix a use-after-free noticed by running with KASAN enabled. If
+rmi_irq_fn() is run twice in a row, then rmi_f11_attention() (among
+others) will end up reading from drvdata->attn_data.data, which was
+freed and left dangling in rmi_irq_fn().
+
+Commit 55edde9fff1a ("Input: synaptics-rmi4 - prevent UAF reported by
+KASAN") correctly identified and analyzed this bug. However the attempted
+fix only NULLed out a local variable, missing the fact that
+drvdata->attn_data is a struct, not a pointer.
+
+NULL out the correct pointer in the driver data to prevent the attention
+functions from copying from it.
+
+Fixes: 55edde9fff1a ("Input: synaptics-rmi4 - prevent UAF reported by KASAN")
+Fixes: b908d3cd812a ("Input: synaptics-rmi4 - allow to add attention data")
+Signed-off-by: Evan Green <evgreen@chromium.org>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20200427145537.1.Ic8f898e0147beeee2c005ee7b20f1aebdef1e7eb@changeid
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/rmi4/rmi_driver.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/input/rmi4/rmi_driver.c b/drivers/input/rmi4/rmi_driver.c
+index 997ccae7ee05..633fd0d660c1 100644
+--- a/drivers/input/rmi4/rmi_driver.c
++++ b/drivers/input/rmi4/rmi_driver.c
+@@ -232,7 +232,7 @@ static irqreturn_t rmi_irq_fn(int irq, void *dev_id)
+
+ if (count) {
+ kfree(attn_data.data);
+- attn_data.data = NULL;
++ drvdata->attn_data.data = NULL;
+ }
+
+ if (!kfifo_is_empty(&drvdata->attn_fifo))
+--
+2.25.1
+
--- /dev/null
+From 4d6f0570ef2292952bcdddafeeb26f7aa0192b5d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 18 Apr 2020 21:17:12 -0700
+Subject: Input: usbtouchscreen - add support for BonXeon TP
+
+From: James Hilliard <james.hilliard1@gmail.com>
+
+[ Upstream commit e3b4f94ef52ae1592cbe199bd38dbdc0d58b2217 ]
+
+Based on available information this uses the singletouch irtouch
+protocol. This is tested and confirmed to be fully functional on
+the BonXeon TP hardware I have.
+
+Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
+Link: https://lore.kernel.org/r/20200413184217.55700-1-james.hilliard1@gmail.com
+Cc: stable@vger.kernel.org
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/touchscreen/usbtouchscreen.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/input/touchscreen/usbtouchscreen.c b/drivers/input/touchscreen/usbtouchscreen.c
+index 2c41107240de..499402a975b3 100644
+--- a/drivers/input/touchscreen/usbtouchscreen.c
++++ b/drivers/input/touchscreen/usbtouchscreen.c
+@@ -197,6 +197,7 @@ static const struct usb_device_id usbtouch_devices[] = {
+ #endif
+
+ #ifdef CONFIG_TOUCHSCREEN_USB_IRTOUCH
++ {USB_DEVICE(0x255e, 0x0001), .driver_info = DEVTYPE_IRTOUCH},
+ {USB_DEVICE(0x595a, 0x0001), .driver_info = DEVTYPE_IRTOUCH},
+ {USB_DEVICE(0x6615, 0x0001), .driver_info = DEVTYPE_IRTOUCH},
+ {USB_DEVICE(0x6615, 0x0012), .driver_info = DEVTYPE_IRTOUCH_HIRES},
+--
+2.25.1
+
--- /dev/null
+From 8cd5d990993860e7563eb0a2ea92fb730bd5e9d6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Apr 2020 14:13:09 -0700
+Subject: Input: xpad - add custom init packet for Xbox One S controllers
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Łukasz Patron <priv.luk@gmail.com>
+
+[ Upstream commit 764f7f911bf72450c51eb74cbb262ad9933741d8 ]
+
+Sending [ 0x05, 0x20, 0x00, 0x0f, 0x06 ] packet for Xbox One S controllers
+fixes an issue where controller is stuck in Bluetooth mode and not sending
+any inputs.
+
+Signed-off-by: Łukasz Patron <priv.luk@gmail.com>
+Reviewed-by: Cameron Gutman <aicommander@gmail.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20200422075206.18229-1-priv.luk@gmail.com
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/joystick/xpad.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
+index 26476a64e663..54a6691d7d87 100644
+--- a/drivers/input/joystick/xpad.c
++++ b/drivers/input/joystick/xpad.c
+@@ -475,6 +475,16 @@ static const u8 xboxone_fw2015_init[] = {
+ 0x05, 0x20, 0x00, 0x01, 0x00
+ };
+
++/*
++ * This packet is required for Xbox One S (0x045e:0x02ea)
++ * and Xbox One Elite Series 2 (0x045e:0x0b00) pads to
++ * initialize the controller that was previously used in
++ * Bluetooth mode.
++ */
++static const u8 xboxone_s_init[] = {
++ 0x05, 0x20, 0x00, 0x0f, 0x06
++};
++
+ /*
+ * This packet is required for the Titanfall 2 Xbox One pads
+ * (0x0e6f:0x0165) to finish initialization and for Hori pads
+@@ -533,6 +543,8 @@ static const struct xboxone_init_packet xboxone_init_packets[] = {
+ XBOXONE_INIT_PKT(0x0e6f, 0x0165, xboxone_hori_init),
+ XBOXONE_INIT_PKT(0x0f0d, 0x0067, xboxone_hori_init),
+ XBOXONE_INIT_PKT(0x0000, 0x0000, xboxone_fw2015_init),
++ XBOXONE_INIT_PKT(0x045e, 0x02ea, xboxone_s_init),
++ XBOXONE_INIT_PKT(0x045e, 0x0b00, xboxone_s_init),
+ XBOXONE_INIT_PKT(0x0e6f, 0x0000, xboxone_pdp_init1),
+ XBOXONE_INIT_PKT(0x0e6f, 0x0000, xboxone_pdp_init2),
+ XBOXONE_INIT_PKT(0x24c6, 0x541a, xboxone_rumblebegin_init),
+--
+2.25.1
+
--- /dev/null
+From 868a2e9d29a60ef329c0d3733a7bd37fe6634d35 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 May 2020 16:00:19 -0500
+Subject: iommu: Fix reference count leak in iommu_group_alloc.
+
+From: Qiushi Wu <wu000273@umn.edu>
+
+[ Upstream commit 7cc31613734c4870ae32f5265d576ef296621343 ]
+
+kobject_init_and_add() takes reference even when it fails.
+Thus, when kobject_init_and_add() returns an error,
+kobject_put() must be called to properly clean up the kobject.
+
+Fixes: d72e31c93746 ("iommu: IOMMU Groups")
+Signed-off-by: Qiushi Wu <wu000273@umn.edu>
+Link: https://lore.kernel.org/r/20200527210020.6522-1-wu000273@umn.edu
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/iommu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c
+index 2c48a9d6d91e..e0a6ae6a5796 100644
+--- a/drivers/iommu/iommu.c
++++ b/drivers/iommu/iommu.c
+@@ -359,7 +359,7 @@ struct iommu_group *iommu_group_alloc(void)
+ NULL, "%d", group->id);
+ if (ret) {
+ ida_simple_remove(&iommu_group_ida, group->id);
+- kfree(group);
++ kobject_put(&group->kobj);
+ return ERR_PTR(ret);
+ }
+
+--
+2.25.1
+
--- /dev/null
+From dd4295585959e01af31af2f1eecb238d6922c3f6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 May 2020 16:03:09 +0800
+Subject: libceph: ignore pool overlay and cache logic on redirects
+
+From: Jerry Lee <leisurelysw24@gmail.com>
+
+[ Upstream commit 890bd0f8997ae6ac0a367dd5146154a3963306dd ]
+
+OSD client should ignore cache/overlay flag if got redirect reply.
+Otherwise, the client hangs when the cache tier is in forward mode.
+
+[ idryomov: Redirects are effectively deprecated and no longer
+ used or tested. The original tiering modes based on redirects
+ are inherently flawed because redirects can race and reorder,
+ potentially resulting in data corruption. The new proxy and
+ readproxy tiering modes should be used instead of forward and
+ readforward. Still marking for stable as obviously correct,
+ though. ]
+
+Cc: stable@vger.kernel.org
+URL: https://tracker.ceph.com/issues/23296
+URL: https://tracker.ceph.com/issues/36406
+Signed-off-by: Jerry Lee <leisurelysw24@gmail.com>
+Reviewed-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ceph/osd_client.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c
+index 92b2641ab93b..753cbfd32dab 100644
+--- a/net/ceph/osd_client.c
++++ b/net/ceph/osd_client.c
+@@ -3444,7 +3444,9 @@ static void handle_reply(struct ceph_osd *osd, struct ceph_msg *msg)
+ * supported.
+ */
+ req->r_t.target_oloc.pool = m.redirect.oloc.pool;
+- req->r_flags |= CEPH_OSD_FLAG_REDIRECTED;
++ req->r_flags |= CEPH_OSD_FLAG_REDIRECTED |
++ CEPH_OSD_FLAG_IGNORE_OVERLAY |
++ CEPH_OSD_FLAG_IGNORE_CACHE;
+ req->r_tid = 0;
+ __submit_request(req, false);
+ goto out_unlock_osdc;
+--
+2.25.1
+
--- /dev/null
+From abfebe85e42940262a344831e8332fb4bf115559 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 May 2020 22:20:47 -0700
+Subject: mm: remove VM_BUG_ON(PageSlab()) from page_mapcount()
+
+From: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
+
+[ Upstream commit 6988f31d558aa8c744464a7f6d91d34ada48ad12 ]
+
+Replace superfluous VM_BUG_ON() with comment about correct usage.
+
+Technically reverts commit 1d148e218a0d ("mm: add VM_BUG_ON_PAGE() to
+page_mapcount()"), but context lines have changed.
+
+Function isolate_migratepages_block() runs some checks out of lru_lock
+when choose pages for migration. After checking PageLRU() it checks
+extra page references by comparing page_count() and page_mapcount().
+Between these two checks page could be removed from lru, freed and taken
+by slab.
+
+As a result this race triggers VM_BUG_ON(PageSlab()) in page_mapcount().
+Race window is tiny. For certain workload this happens around once a
+year.
+
+ page:ffffea0105ca9380 count:1 mapcount:0 mapping:ffff88ff7712c180 index:0x0 compound_mapcount: 0
+ flags: 0x500000000008100(slab|head)
+ raw: 0500000000008100 dead000000000100 dead000000000200 ffff88ff7712c180
+ raw: 0000000000000000 0000000080200020 00000001ffffffff 0000000000000000
+ page dumped because: VM_BUG_ON_PAGE(PageSlab(page))
+ ------------[ cut here ]------------
+ kernel BUG at ./include/linux/mm.h:628!
+ invalid opcode: 0000 [#1] SMP NOPTI
+ CPU: 77 PID: 504 Comm: kcompactd1 Tainted: G W 4.19.109-27 #1
+ Hardware name: Yandex T175-N41-Y3N/MY81-EX0-Y3N, BIOS R05 06/20/2019
+ RIP: 0010:isolate_migratepages_block+0x986/0x9b0
+
+The code in isolate_migratepages_block() was added in commit
+119d6d59dcc0 ("mm, compaction: avoid isolating pinned pages") before
+adding VM_BUG_ON into page_mapcount().
+
+This race has been predicted in 2015 by Vlastimil Babka (see link
+below).
+
+[akpm@linux-foundation.org: comment tweaks, per Hugh]
+Fixes: 1d148e218a0d ("mm: add VM_BUG_ON_PAGE() to page_mapcount()")
+Signed-off-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Acked-by: Hugh Dickins <hughd@google.com>
+Acked-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
+Acked-by: Vlastimil Babka <vbabka@suse.cz>
+Cc: David Rientjes <rientjes@google.com>
+Cc: <stable@vger.kernel.org>
+Link: http://lkml.kernel.org/r/159032779896.957378.7852761411265662220.stgit@buzz
+Link: https://lore.kernel.org/lkml/557710E1.6060103@suse.cz/
+Link: https://lore.kernel.org/linux-mm/158937872515.474360.5066096871639561424.stgit@buzz/T/ (v1)
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/mm.h | 15 +++++++++++++--
+ 1 file changed, 13 insertions(+), 2 deletions(-)
+
+diff --git a/include/linux/mm.h b/include/linux/mm.h
+index 858ce84ac7c5..6f852d5fbada 100644
+--- a/include/linux/mm.h
++++ b/include/linux/mm.h
+@@ -549,6 +549,11 @@ static inline void *kvmalloc_array(size_t n, size_t size, gfp_t flags)
+
+ extern void kvfree(const void *addr);
+
++/*
++ * Mapcount of compound page as a whole, does not include mapped sub-pages.
++ *
++ * Must be called only for compound pages or any their tail sub-pages.
++ */
+ static inline int compound_mapcount(struct page *page)
+ {
+ VM_BUG_ON_PAGE(!PageCompound(page), page);
+@@ -568,10 +573,16 @@ static inline void page_mapcount_reset(struct page *page)
+
+ int __page_mapcount(struct page *page);
+
++/*
++ * Mapcount of 0-order page; when compound sub-page, includes
++ * compound_mapcount().
++ *
++ * Result is undefined for pages which cannot be mapped into userspace.
++ * For example SLAB or special types of pages. See function page_has_type().
++ * They use this place in struct page differently.
++ */
+ static inline int page_mapcount(struct page *page)
+ {
+- VM_BUG_ON_PAGE(PageSlab(page), page);
+-
+ if (unlikely(PageCompound(page)))
+ return __page_mapcount(page);
+ return atomic_read(&page->_mapcount) + 1;
+--
+2.25.1
+
--- /dev/null
+From db7703b7afdc0903c25ba5591f3a397e3f3ab038 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 May 2020 09:29:25 +0000
+Subject: mmc: block: Fix use-after-free issue for rpmb
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Peng Hao <richard.peng@oppo.com>
+
+[ Upstream commit 202500d21654874aa03243e91f96de153ec61860 ]
+
+The data structure member “rpmb->md” was passed to a call of the function
+“mmc_blk_put” after a call of the function “put_device”. Reorder these
+function calls to keep the data accesses consistent.
+
+Fixes: 1c87f7357849 ("mmc: block: Fix bug when removing RPMB chardev ")
+Signed-off-by: Peng Hao <richard.peng@oppo.com>
+Cc: stable@vger.kernel.org
+[Uffe: Fixed up mangled patch and updated commit message]
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/core/block.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c
+index 916b88ee2de4..cbb72b460755 100644
+--- a/drivers/mmc/core/block.c
++++ b/drivers/mmc/core/block.c
+@@ -2333,8 +2333,8 @@ static int mmc_rpmb_chrdev_release(struct inode *inode, struct file *filp)
+ struct mmc_rpmb_data *rpmb = container_of(inode->i_cdev,
+ struct mmc_rpmb_data, chrdev);
+
+- put_device(&rpmb->dev);
+ mmc_blk_put(rpmb->md);
++ put_device(&rpmb->dev);
+
+ return 0;
+ }
+--
+2.25.1
+
--- /dev/null
+From 881df9d2307b5cba4ca08adb2584f7fb795b0260 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 May 2020 22:04:57 -0500
+Subject: RDMA/pvrdma: Fix missing pci disable in pvrdma_pci_probe()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Qiushi Wu <wu000273@umn.edu>
+
+[ Upstream commit db857e6ae548f0f4f4a0f63fffeeedf3cca21f9d ]
+
+In function pvrdma_pci_probe(), pdev was not disabled in one error
+path. Thus replace the jump target “err_free_device” by
+"err_disable_pdev".
+
+Fixes: 29c8d9eba550 ("IB: Add vmw_pvrdma driver")
+Link: https://lore.kernel.org/r/20200523030457.16160-1-wu000273@umn.edu
+Signed-off-by: Qiushi Wu <wu000273@umn.edu>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c
+index d549c9ffadcb..867303235f57 100644
+--- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c
++++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c
+@@ -774,7 +774,7 @@ static int pvrdma_pci_probe(struct pci_dev *pdev,
+ !(pci_resource_flags(pdev, 1) & IORESOURCE_MEM)) {
+ dev_err(&pdev->dev, "PCI BAR region not MMIO\n");
+ ret = -ENOMEM;
+- goto err_free_device;
++ goto err_disable_pdev;
+ }
+
+ ret = pci_request_regions(pdev, DRV_NAME);
+--
+2.25.1
+
net-freescale-select-config_fixed_phy-where-needed.patch
cifs-fix-null-pointer-check-in-cifs_read.patch
samples-bpf-fix-build-error.patch
+input-usbtouchscreen-add-support-for-bonxeon-tp.patch
+input-i8042-add-thinkpad-s230u-to-i8042-nomux-list.patch
+input-evdev-call-input_flush_device-on-release-not-f.patch
+input-xpad-add-custom-init-packet-for-xbox-one-s-con.patch
+input-dlink-dir685-touchkeys-fix-a-typo-in-driver-na.patch
+input-i8042-add-thinkpad-s230u-to-i8042-reset-list.patch
+input-synaptics-rmi4-really-fix-attn_data-use-after-.patch
+input-synaptics-rmi4-fix-error-return-code-in-rmi_dr.patch
+arm-8843-1-use-unified-assembler-in-headers.patch
+arm-uaccess-consolidate-uaccess-asm-to-asm-uaccess-a.patch
+arm-uaccess-integrate-uaccess_save-and-uaccess_resto.patch
+arm-uaccess-fix-dacr-mismatch-with-nested-exceptions.patch
+gpio-exar-fix-bad-handling-for-ida_simple_get-error-.patch
+ib-qib-call-kobject_put-when-kobject_init_and_add-fa.patch
+arm-dts-imx6q-bx50v3-add-internal-switch.patch
+arm-dts-imx6q-bx50v3-set-display-interface-clock-par.patch
+arm-dts-bcm2835-rpi-zero-w-fix-led-polarity.patch
+mmc-block-fix-use-after-free-issue-for-rpmb.patch
+rdma-pvrdma-fix-missing-pci-disable-in-pvrdma_pci_pr.patch
+alsa-hwdep-fix-a-left-shifting-1-by-31-ub-bug.patch
+alsa-usb-audio-mixer-volume-quirk-for-ess-technology.patch
+exec-always-set-cap_ambient-in-cap_bprm_set_creds.patch
+alsa-hda-realtek-add-new-codec-supported-for-alc287.patch
+libceph-ignore-pool-overlay-and-cache-logic-on-redir.patch
+mm-remove-vm_bug_on-pageslab-from-page_mapcount.patch
+fs-binfmt_elf.c-allocate-initialized-memory-in-fill_.patch
+include-asm-generic-topology.h-guard-cpumask_of_node.patch
+iommu-fix-reference-count-leak-in-iommu_group_alloc.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
