]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
Fixes for 4.4
authorSasha Levin <sashal@kernel.org>
Mon, 23 Nov 2020 03:05:57 +0000 (22:05 -0500)
committerSasha Levin <sashal@kernel.org>
Mon, 23 Nov 2020 03:05:57 +0000 (22:05 -0500)
Signed-off-by: Sasha Levin <sashal@kernel.org>
queue-4.4/arm-dts-imx50-evk-fix-the-chip-select-1-iomux.patch [new file with mode: 0644]
queue-4.4/arm-dts-imx6qdl-udoo-fix-rgmii-phy-mode-for-ksz9031-.patch [new file with mode: 0644]
queue-4.4/can-dev-can_restart-post-buffer-from-the-right-conte.patch [new file with mode: 0644]
queue-4.4/can-m_can-m_can_handle_state_change-fix-state-change.patch [new file with mode: 0644]
queue-4.4/can-peak_usb-fix-potential-integer-overflow-on-shift.patch [new file with mode: 0644]
queue-4.4/input-adxl34x-clean-up-a-data-type-in-adxl34x_probe.patch [new file with mode: 0644]
queue-4.4/libfs-fix-error-cast-of-negative-value-in-simple_att.patch [new file with mode: 0644]
queue-4.4/mips-alchemy-fix-memleak-in-alchemy_clk_setup_cpu.patch [new file with mode: 0644]
queue-4.4/perf-lock-don-t-free-lock_seq_stat-if-read_count-isn.patch [new file with mode: 0644]
queue-4.4/regulator-ti-abb-fix-array-out-of-bound-read-access-.patch [new file with mode: 0644]
queue-4.4/series

diff --git a/queue-4.4/arm-dts-imx50-evk-fix-the-chip-select-1-iomux.patch b/queue-4.4/arm-dts-imx50-evk-fix-the-chip-select-1-iomux.patch
new file mode 100644 (file)
index 0000000..1055023
--- /dev/null
@@ -0,0 +1,43 @@
+From d2bcdfff2ee028a712b1a7a6b3a277aae032c9e5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Nov 2020 18:13:20 -0300
+Subject: ARM: dts: imx50-evk: Fix the chip select 1 IOMUX
+
+From: Fabio Estevam <festevam@gmail.com>
+
+[ Upstream commit 33d0d843872c5ddbe28457a92fc6f2487315fb9f ]
+
+The SPI chip selects are represented as:
+
+cs-gpios = <&gpio4 11 GPIO_ACTIVE_LOW>, <&gpio4 13 GPIO_ACTIVE_LOW>;
+
+, which means that they are used in GPIO function instead of native
+SPI mode.
+
+Fix the IOMUX for the chip select 1 to use GPIO4_13 instead of
+the native CSPI_SSI function.
+
+Fixes: c605cbf5e135 ("ARM: dts: imx: add device tree support for Freescale imx50evk board")
+Signed-off-by: Fabio Estevam <festevam@gmail.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx50-evk.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/imx50-evk.dts b/arch/arm/boot/dts/imx50-evk.dts
+index 27d763c7a307d..4dbd180e72ba6 100644
+--- a/arch/arm/boot/dts/imx50-evk.dts
++++ b/arch/arm/boot/dts/imx50-evk.dts
+@@ -66,7 +66,7 @@
+                               MX50_PAD_CSPI_MISO__CSPI_MISO           0x00
+                               MX50_PAD_CSPI_MOSI__CSPI_MOSI           0x00
+                               MX50_PAD_CSPI_SS0__GPIO4_11             0xc4
+-                              MX50_PAD_ECSPI1_MOSI__CSPI_SS1          0xf4
++                              MX50_PAD_ECSPI1_MOSI__GPIO4_13          0x84
+                       >;
+               };
+-- 
+2.27.0
+
diff --git a/queue-4.4/arm-dts-imx6qdl-udoo-fix-rgmii-phy-mode-for-ksz9031-.patch b/queue-4.4/arm-dts-imx6qdl-udoo-fix-rgmii-phy-mode-for-ksz9031-.patch
new file mode 100644 (file)
index 0000000..0db2cc7
--- /dev/null
@@ -0,0 +1,39 @@
+From 323cc5f70ede57240cd0a5ad08b84edbc8bc6b1d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 24 Oct 2020 23:11:20 +0300
+Subject: arm: dts: imx6qdl-udoo: fix rgmii phy-mode for ksz9031 phy
+
+From: Sergey Matyukevich <geomatsi@gmail.com>
+
+[ Upstream commit 7dd8f0ba88fce98e2953267a66af74c6f4792a56 ]
+
+Commit bcf3440c6dd7 ("net: phy: micrel: add phy-mode support for the
+KSZ9031 PHY") fixed micrel phy driver adding proper support for phy
+modes. Adapt imx6q-udoo board phy settings : explicitly set required
+delay configuration using "rgmii-id".
+
+Fixes: cbd54fe0b2bc ("ARM: dts: imx6dl-udoo: Add board support based off imx6q-udoo")
+Signed-off-by: Sergey Matyukevich <geomatsi@gmail.com>
+Reviewed-by: Fabio Estevam <festevam@gmail.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx6qdl-udoo.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/imx6qdl-udoo.dtsi b/arch/arm/boot/dts/imx6qdl-udoo.dtsi
+index 1211da894ee99..061e6a00b2557 100644
+--- a/arch/arm/boot/dts/imx6qdl-udoo.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-udoo.dtsi
+@@ -39,7 +39,7 @@
+ &fec {
+       pinctrl-names = "default";
+       pinctrl-0 = <&pinctrl_enet>;
+-      phy-mode = "rgmii";
++      phy-mode = "rgmii-id";
+       status = "okay";
+ };
+-- 
+2.27.0
+
diff --git a/queue-4.4/can-dev-can_restart-post-buffer-from-the-right-conte.patch b/queue-4.4/can-dev-can_restart-post-buffer-from-the-right-conte.patch
new file mode 100644 (file)
index 0000000..9dbd337
--- /dev/null
@@ -0,0 +1,41 @@
+From a884665d7a300e9cc10d81cee15127da7645428f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Nov 2020 21:51:47 +0000
+Subject: can: dev: can_restart(): post buffer from the right context
+
+From: Alejandro Concepcion Rodriguez <alejandro@acoro.eu>
+
+[ Upstream commit a1e654070a60d5d4f7cce59c38f4ca790bb79121 ]
+
+netif_rx() is meant to be called from interrupt contexts. can_restart() may be
+called by can_restart_work(), which is called from a worqueue, so it may run in
+process context. Use netif_rx_ni() instead.
+
+Fixes: 39549eef3587 ("can: CAN Network device driver and Netlink interface")
+Co-developed-by: Loris Fauster <loris.fauster@ttcontrol.com>
+Signed-off-by: Loris Fauster <loris.fauster@ttcontrol.com>
+Signed-off-by: Alejandro Concepcion Rodriguez <alejandro@acoro.eu>
+Link: https://lore.kernel.org/r/4e84162b-fb31-3a73-fa9a-9438b4bd5234@acoro.eu
+[mkl: use netif_rx_ni() instead of netif_rx_any_context()]
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/dev.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
+index 9579dae54af29..52110017fd401 100644
+--- a/drivers/net/can/dev.c
++++ b/drivers/net/can/dev.c
+@@ -525,7 +525,7 @@ static void can_restart(struct net_device *dev)
+       }
+       cf->can_id |= CAN_ERR_RESTARTED;
+-      netif_rx(skb);
++      netif_rx_ni(skb);
+       stats->rx_packets++;
+       stats->rx_bytes += cf->can_dlc;
+-- 
+2.27.0
+
diff --git a/queue-4.4/can-m_can-m_can_handle_state_change-fix-state-change.patch b/queue-4.4/can-m_can-m_can_handle_state_change-fix-state-change.patch
new file mode 100644 (file)
index 0000000..93f5e1b
--- /dev/null
@@ -0,0 +1,51 @@
+From 6744ecbcb4845e54ae6fd9dffe7f96d75dd28c6c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Jan 2020 10:23:30 +0800
+Subject: can: m_can: m_can_handle_state_change(): fix state change
+
+From: Wu Bo <wubo.oduw@gmail.com>
+
+[ Upstream commit cd0d83eab2e0c26fe87a10debfedbb23901853c1 ]
+
+m_can_handle_state_change() is called with the new_state as an argument.
+
+In the switch statements for CAN_STATE_ERROR_ACTIVE, the comment and the
+following code indicate that a CAN_STATE_ERROR_WARNING is handled.
+
+This patch fixes this problem by changing the case to CAN_STATE_ERROR_WARNING.
+
+Signed-off-by: Wu Bo <wubo.oduw@gmail.com>
+Link: http://lore.kernel.org/r/20200129022330.21248-2-wubo.oduw@gmail.com
+Cc: Dan Murphy <dmurphy@ti.com>
+Fixes: e0d1f4816f2a ("can: m_can: add Bosch M_CAN controller support")
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/m_can/m_can.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c
+index 195f15edb32e3..0bd7e71647964 100644
+--- a/drivers/net/can/m_can/m_can.c
++++ b/drivers/net/can/m_can/m_can.c
+@@ -572,7 +572,7 @@ static int m_can_handle_state_change(struct net_device *dev,
+       unsigned int ecr;
+       switch (new_state) {
+-      case CAN_STATE_ERROR_ACTIVE:
++      case CAN_STATE_ERROR_WARNING:
+               /* error warning state */
+               priv->can.can_stats.error_warning++;
+               priv->can.state = CAN_STATE_ERROR_WARNING;
+@@ -601,7 +601,7 @@ static int m_can_handle_state_change(struct net_device *dev,
+       __m_can_get_berr_counter(dev, &bec);
+       switch (new_state) {
+-      case CAN_STATE_ERROR_ACTIVE:
++      case CAN_STATE_ERROR_WARNING:
+               /* error warning state */
+               cf->can_id |= CAN_ERR_CRTL;
+               cf->data[1] = (bec.txerr > bec.rxerr) ?
+-- 
+2.27.0
+
diff --git a/queue-4.4/can-peak_usb-fix-potential-integer-overflow-on-shift.patch b/queue-4.4/can-peak_usb-fix-potential-integer-overflow-on-shift.patch
new file mode 100644 (file)
index 0000000..5aac808
--- /dev/null
@@ -0,0 +1,48 @@
+From 04d37605580bb6cde1feb975acd3b786ac6d0ed6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Nov 2020 11:24:27 +0000
+Subject: can: peak_usb: fix potential integer overflow on shift of a int
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 8a68cc0d690c9e5730d676b764c6f059343b842c ]
+
+The left shift of int 32 bit integer constant 1 is evaluated using 32 bit
+arithmetic and then assigned to a signed 64 bit variable. In the case where
+time_ref->adapter->ts_used_bits is 32 or more this can lead to an oveflow.
+Avoid this by shifting using the BIT_ULL macro instead.
+
+Fixes: bb4785551f64 ("can: usb: PEAK-System Technik USB adapters driver core")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Link: https://lore.kernel.org/r/20201105112427.40688-1-colin.king@canonical.com
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/usb/peak_usb/pcan_usb_core.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_core.c b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
+index 22deddb2dbf5a..7b148174eb760 100644
+--- a/drivers/net/can/usb/peak_usb/pcan_usb_core.c
++++ b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
+@@ -176,7 +176,7 @@ void peak_usb_get_ts_tv(struct peak_time_ref *time_ref, u32 ts,
+               if (time_ref->ts_dev_1 < time_ref->ts_dev_2) {
+                       /* case when event time (tsw) wraps */
+                       if (ts < time_ref->ts_dev_1)
+-                              delta_ts = 1 << time_ref->adapter->ts_used_bits;
++                              delta_ts = BIT_ULL(time_ref->adapter->ts_used_bits);
+               /* Otherwise, sync time counter (ts_dev_2) has wrapped:
+                * handle case when event time (tsn) hasn't.
+@@ -188,7 +188,7 @@ void peak_usb_get_ts_tv(struct peak_time_ref *time_ref, u32 ts,
+                *              tsn            ts
+                */
+               } else if (time_ref->ts_dev_1 < ts) {
+-                      delta_ts = -(1 << time_ref->adapter->ts_used_bits);
++                      delta_ts = -BIT_ULL(time_ref->adapter->ts_used_bits);
+               }
+               /* add delay between last sync and event timestamps */
+-- 
+2.27.0
+
diff --git a/queue-4.4/input-adxl34x-clean-up-a-data-type-in-adxl34x_probe.patch b/queue-4.4/input-adxl34x-clean-up-a-data-type-in-adxl34x_probe.patch
new file mode 100644 (file)
index 0000000..32cdeb9
--- /dev/null
@@ -0,0 +1,38 @@
+From fafaf966b9793a1537ccf5ade9c5904d133dcc73 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Oct 2020 17:10:09 -0700
+Subject: Input: adxl34x - clean up a data type in adxl34x_probe()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 33b6c39e747c552fa770eecebd1776f1f4a222b1 ]
+
+The "revid" is used to store negative error codes so it should be an int
+type.
+
+Fixes: e27c729219ad ("Input: add driver for ADXL345/346 Digital Accelerometers")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Acked-by: Michael Hennerich <michael.hennerich@analog.com>
+Link: https://lore.kernel.org/r/20201026072824.GA1620546@mwanda
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/misc/adxl34x.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/input/misc/adxl34x.c b/drivers/input/misc/adxl34x.c
+index 2b2d02f408bbb..2e189646d8fe2 100644
+--- a/drivers/input/misc/adxl34x.c
++++ b/drivers/input/misc/adxl34x.c
+@@ -696,7 +696,7 @@ struct adxl34x *adxl34x_probe(struct device *dev, int irq,
+       struct input_dev *input_dev;
+       const struct adxl34x_platform_data *pdata;
+       int err, range, i;
+-      unsigned char revid;
++      int revid;
+       if (!irq) {
+               dev_err(dev, "no IRQ?\n");
+-- 
+2.27.0
+
diff --git a/queue-4.4/libfs-fix-error-cast-of-negative-value-in-simple_att.patch b/queue-4.4/libfs-fix-error-cast-of-negative-value-in-simple_att.patch
new file mode 100644 (file)
index 0000000..b43fddb
--- /dev/null
@@ -0,0 +1,57 @@
+From 57a036c03c2180c8424bc80d9f0537266734db9e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 21 Nov 2020 22:17:19 -0800
+Subject: libfs: fix error cast of negative value in simple_attr_write()
+
+From: Yicong Yang <yangyicong@hisilicon.com>
+
+[ Upstream commit 488dac0c9237647e9b8f788b6a342595bfa40bda ]
+
+The attr->set() receive a value of u64, but simple_strtoll() is used for
+doing the conversion.  It will lead to the error cast if user inputs a
+negative value.
+
+Use kstrtoull() instead of simple_strtoll() to convert a string got from
+the user to an unsigned value.  The former will return '-EINVAL' if it
+gets a negetive value, but the latter can't handle the situation
+correctly.  Make 'val' unsigned long long as what kstrtoull() takes,
+this will eliminate the compile warning on no 64-bit architectures.
+
+Fixes: f7b88631a897 ("fs/libfs.c: fix simple_attr_write() on 32bit machines")
+Signed-off-by: Yicong Yang <yangyicong@hisilicon.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Cc: Al Viro <viro@zeniv.linux.org.uk>
+Link: https://lkml.kernel.org/r/1605341356-11872-1-git-send-email-yangyicong@hisilicon.com
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/libfs.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/fs/libfs.c b/fs/libfs.c
+index a33e95f8729bf..01e9cae5b1601 100644
+--- a/fs/libfs.c
++++ b/fs/libfs.c
+@@ -827,7 +827,7 @@ ssize_t simple_attr_write(struct file *file, const char __user *buf,
+                         size_t len, loff_t *ppos)
+ {
+       struct simple_attr *attr;
+-      u64 val;
++      unsigned long long val;
+       size_t size;
+       ssize_t ret;
+@@ -845,7 +845,9 @@ ssize_t simple_attr_write(struct file *file, const char __user *buf,
+               goto out;
+       attr->set_buf[size] = '\0';
+-      val = simple_strtoll(attr->set_buf, NULL, 0);
++      ret = kstrtoull(attr->set_buf, 0, &val);
++      if (ret)
++              goto out;
+       ret = attr->set(attr->data, val);
+       if (ret == 0)
+               ret = len; /* on success, claim we got the whole input */
+-- 
+2.27.0
+
diff --git a/queue-4.4/mips-alchemy-fix-memleak-in-alchemy_clk_setup_cpu.patch b/queue-4.4/mips-alchemy-fix-memleak-in-alchemy_clk_setup_cpu.patch
new file mode 100644 (file)
index 0000000..1af6042
--- /dev/null
@@ -0,0 +1,51 @@
+From ae5cbb31a5ac29c66e7fae609b268350b92b1b50 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Nov 2020 21:18:56 +0800
+Subject: MIPS: Alchemy: Fix memleak in alchemy_clk_setup_cpu
+
+From: Zhang Qilong <zhangqilong3@huawei.com>
+
+[ Upstream commit ac3b57adf87ad9bac7e33ca26bbbb13fae1ed62b ]
+
+If the clk_register fails, we should free h before
+function returns to prevent memleak.
+
+Fixes: 474402291a0ad ("MIPS: Alchemy: clock framework integration of onchip clocks")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/alchemy/common/clock.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/arch/mips/alchemy/common/clock.c b/arch/mips/alchemy/common/clock.c
+index bd34f4093cd9f..7b0dec333c964 100644
+--- a/arch/mips/alchemy/common/clock.c
++++ b/arch/mips/alchemy/common/clock.c
+@@ -151,6 +151,7 @@ static struct clk __init *alchemy_clk_setup_cpu(const char *parent_name,
+ {
+       struct clk_init_data id;
+       struct clk_hw *h;
++      struct clk *clk;
+       h = kzalloc(sizeof(*h), GFP_KERNEL);
+       if (!h)
+@@ -163,7 +164,13 @@ static struct clk __init *alchemy_clk_setup_cpu(const char *parent_name,
+       id.ops = &alchemy_clkops_cpu;
+       h->init = &id;
+-      return clk_register(NULL, h);
++      clk = clk_register(NULL, h);
++      if (IS_ERR(clk)) {
++              pr_err("failed to register clock\n");
++              kfree(h);
++      }
++
++      return clk;
+ }
+ /* AUXPLLs ************************************************************/
+-- 
+2.27.0
+
diff --git a/queue-4.4/perf-lock-don-t-free-lock_seq_stat-if-read_count-isn.patch b/queue-4.4/perf-lock-don-t-free-lock_seq_stat-if-read_count-isn.patch
new file mode 100644 (file)
index 0000000..3a64982
--- /dev/null
@@ -0,0 +1,54 @@
+From fb50a7e8480f37ea28c0ed21357254401bc7a4f1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Nov 2020 17:42:29 +0800
+Subject: perf lock: Don't free "lock_seq_stat" if read_count isn't zero
+
+From: Leo Yan <leo.yan@linaro.org>
+
+[ Upstream commit b0e5a05cc9e37763c7f19366d94b1a6160c755bc ]
+
+When execute command "perf lock report", it hits failure and outputs log
+as follows:
+
+  perf: builtin-lock.c:623: report_lock_release_event: Assertion `!(seq->read_count < 0)' failed.
+  Aborted
+
+This is an imbalance issue.  The locking sequence structure
+"lock_seq_stat" contains the reader counter and it is used to check if
+the locking sequence is balance or not between acquiring and releasing.
+
+If the tool wrongly frees "lock_seq_stat" when "read_count" isn't zero,
+the "read_count" will be reset to zero when allocate a new structure at
+the next time; thus it causes the wrong counting for reader and finally
+results in imbalance issue.
+
+To fix this issue, if detects "read_count" is not zero (means still have
+read user in the locking sequence), goto the "end" tag to skip freeing
+structure "lock_seq_stat".
+
+Fixes: e4cef1f65061 ("perf lock: Fix state machine to recognize lock sequence")
+Signed-off-by: Leo Yan <leo.yan@linaro.org>
+Acked-by: Jiri Olsa <jolsa@redhat.com>
+Link: https://lore.kernel.org/r/20201104094229.17509-2-leo.yan@linaro.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/builtin-lock.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/perf/builtin-lock.c b/tools/perf/builtin-lock.c
+index de16aaed516e6..daf2dc0232450 100644
+--- a/tools/perf/builtin-lock.c
++++ b/tools/perf/builtin-lock.c
+@@ -616,7 +616,7 @@ static int report_lock_release_event(struct perf_evsel *evsel,
+       case SEQ_STATE_READ_ACQUIRED:
+               seq->read_count--;
+               BUG_ON(seq->read_count < 0);
+-              if (!seq->read_count) {
++              if (seq->read_count) {
+                       ls->nr_release++;
+                       goto end;
+               }
+-- 
+2.27.0
+
diff --git a/queue-4.4/regulator-ti-abb-fix-array-out-of-bound-read-access-.patch b/queue-4.4/regulator-ti-abb-fix-array-out-of-bound-read-access-.patch
new file mode 100644 (file)
index 0000000..e8a8994
--- /dev/null
@@ -0,0 +1,71 @@
+From bd1fb222ddfc64d2bfdf8058b4d24c5e75b679c1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Nov 2020 08:50:09 -0600
+Subject: regulator: ti-abb: Fix array out of bound read access on the first
+ transition
+
+From: Nishanth Menon <nm@ti.com>
+
+[ Upstream commit 2ba546ebe0ce2af47833d8912ced9b4a579f13cb ]
+
+At the start of driver initialization, we do not know what bias
+setting the bootloader has configured the system for and we only know
+for certain the very first time we do a transition.
+
+However, since the initial value of the comparison index is -EINVAL,
+this negative value results in an array out of bound access on the
+very first transition.
+
+Since we don't know what the setting is, we just set the bias
+configuration as there is nothing to compare against. This prevents
+the array out of bound access.
+
+NOTE: Even though we could use a more relaxed check of "< 0" the only
+valid values(ignoring cosmic ray induced bitflips) are -EINVAL, 0+.
+
+Fixes: 40b1936efebd ("regulator: Introduce TI Adaptive Body Bias(ABB) on-chip LDO driver")
+Link: https://lore.kernel.org/linux-mm/CA+G9fYuk4imvhyCN7D7T6PMDH6oNp6HDCRiTUKMQ6QXXjBa4ag@mail.gmail.com/
+Reported-by: Naresh Kamboju <naresh.kamboju@linaro.org>
+Reviewed-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Nishanth Menon <nm@ti.com>
+Link: https://lore.kernel.org/r/20201118145009.10492-1-nm@ti.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/ti-abb-regulator.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/regulator/ti-abb-regulator.c b/drivers/regulator/ti-abb-regulator.c
+index 6d17357b3a248..5f5f63eb8c762 100644
+--- a/drivers/regulator/ti-abb-regulator.c
++++ b/drivers/regulator/ti-abb-regulator.c
+@@ -342,8 +342,17 @@ static int ti_abb_set_voltage_sel(struct regulator_dev *rdev, unsigned sel)
+               return ret;
+       }
+-      /* If data is exactly the same, then just update index, no change */
+       info = &abb->info[sel];
++      /*
++       * When Linux kernel is starting up, we are'nt sure of the
++       * Bias configuration that bootloader has configured.
++       * So, we get to know the actual setting the first time
++       * we are asked to transition.
++       */
++      if (abb->current_info_idx == -EINVAL)
++              goto just_set_abb;
++
++      /* If data is exactly the same, then just update index, no change */
+       oinfo = &abb->info[abb->current_info_idx];
+       if (!memcmp(info, oinfo, sizeof(*info))) {
+               dev_dbg(dev, "%s: Same data new idx=%d, old idx=%d\n", __func__,
+@@ -351,6 +360,7 @@ static int ti_abb_set_voltage_sel(struct regulator_dev *rdev, unsigned sel)
+               goto out;
+       }
++just_set_abb:
+       ret = ti_abb_set_opp(rdev, abb, info);
+ out:
+-- 
+2.27.0
+
index e321c5bfc3df09c9623bbc21d95c1cb032f3da03..b342b5061308e629c648b1cb48c36f1adb533ed6 100644 (file)
@@ -13,3 +13,13 @@ net-have-netpoll-bring-up-dsa-management-interface.patch
 pinctrl-rockchip-enable-gpio-pclk-for-rockchip_gpio_.patch
 arm64-psci-avoid-printing-in-cpu_psci_cpu_die.patch
 mips-fix-build_rollback_prologue-for-micromips.patch
+input-adxl34x-clean-up-a-data-type-in-adxl34x_probe.patch
+arm-dts-imx6qdl-udoo-fix-rgmii-phy-mode-for-ksz9031-.patch
+arm-dts-imx50-evk-fix-the-chip-select-1-iomux.patch
+perf-lock-don-t-free-lock_seq_stat-if-read_count-isn.patch
+can-dev-can_restart-post-buffer-from-the-right-conte.patch
+can-peak_usb-fix-potential-integer-overflow-on-shift.patch
+can-m_can-m_can_handle_state_change-fix-state-change.patch
+mips-alchemy-fix-memleak-in-alchemy_clk_setup_cpu.patch
+regulator-ti-abb-fix-array-out-of-bound-read-access-.patch
+libfs-fix-error-cast-of-negative-value-in-simple_att.patch