Commit Graph

4401 Commits

Author SHA1 Message Date
Tao Huang
b50aca0c9a Merge tag 'ASB-2021-02-05_4.19-stable' of https://android.googlesource.com/kernel/common
https://source.android.com/security/bulletin/2021-02-01
CVE-2017-18509
CVE-2020-10767

* tag 'ASB-2021-02-05_4.19-stable': (809 commits)
  ANDROID: GKI: fix up abi issues with 4.19.172
  Linux 4.19.172
  fs: fix lazytime expiration handling in __writeback_single_inode()
  writeback: Drop I_DIRTY_TIME_EXPIRE
  dm integrity: conditionally disable "recalculate" feature
  tools: Factor HOSTCC, HOSTLD, HOSTAR definitions
  tracing: Fix race in trace_open and buffer resize call
  HID: wacom: Correct NULL dereference on AES pen proximity
  futex: Handle faults correctly for PI futexes
  futex: Simplify fixup_pi_state_owner()
  futex: Use pi_state_update_owner() in put_pi_state()
  rtmutex: Remove unused argument from rt_mutex_proxy_unlock()
  futex: Provide and use pi_state_update_owner()
  futex: Replace pointless printk in fixup_owner()
  futex: Ensure the correct return value from futex_lock_pi()
  futex: Prevent exit livelock
  futex: Provide distinct return value when owner is exiting
  futex: Add mutex around futex exit
  futex: Provide state handling for exec() as well
  futex: Sanitize exit state handling
  ...

Change-Id: Ieba6ee3a91a05d504e1f829a84e7d364e7d983f2

Conflicts:
	arch/arm64/boot/dts/rockchip/rk3328.dtsi
	drivers/md/Kconfig
	drivers/usb/gadget/function/f_uac2.c
2021-02-26 15:30:04 +08:00
Greg Kroah-Hartman
d084fe8b5d This is the 4.19.170 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmAMODkACgkQONu9yGCS
 aT5y5w/+IcTYjUeozem90e811yy0V17All0NvJyYovwvs8Jr4aapV2/P4hTAFKjl
 VbmUGHTsRq0yygv0Sqz7SqOw0C9F+pxZmCmG5SZzmfXV4IGSv9sT94cX1PI/Sqhn
 1zes2C3AYOAmypBGV27XVMFgQNH3JkqwaFmvfyYTH+YSdCPncI3mkNsQbL3J4luT
 XdZ8mlg1uiHYwTm2aeM/8eFhgK01qXpUDCJXCoxx2gm4xQjX8pnqq5xJdh8iOlpH
 6VPcuiPAFYlTaYyW2U8/tnQE9XmL+nrQh3QSFP638sSMdkCGEuTM3upUk+1QjC56
 GQSnERDR7zt4B8l414MSZOmGHMKqwXJ585Bwx6ZZW+RWlp/vDAgxUhfjoh4Ep7CM
 Zb0Ydzv/AB3zuMDxudcUBuNf1xTGd8YR39ODjWCkk2qmJORgiDNLtMcacJQmjQRo
 SjUa4BooaeOYpJ/N8L0BXkWl32AOP04VKldO0jczhtPLwZZWRHPnw+IWVRL6W91Y
 H9eElJxDQvymGRJ6H4+7Q6l7qtP3QjGHyX4gTq7Ucbn/cIJvdZmH5ooIsiOGTchn
 GWOx2lStW7fgUd+IY3Hr+LVIa9yvnXra4RIZAD9v5X8aIJ6ol6b8F9GAmrZMyP2O
 SU+z4UIs9/XG2GHenQFZDeZ9wj8p7o1PaT+D9u5z9xteje2Bqfk=
 =ptN/
 -----END PGP SIGNATURE-----

Merge 4.19.170 into android-4.19-stable

Changes in 4.19.170
	usb: ohci: Make distrust_firmware param default to false
	compiler.h: Raise minimum version of GCC to 5.1 for arm64
	dm integrity: fix flush with external metadata device
	crypto: x86/crc32c - fix building with clang ias
	nfsd4: readdirplus shouldn't return parent of export
	udp: Prevent reuseport_select_sock from reading uninitialized socks
	netxen_nic: fix MSI/MSI-x interrupts
	net: mvpp2: Remove Pause and Asym_Pause support
	rndis_host: set proper input size for OID_GEN_PHYSICAL_MEDIUM request
	esp: avoid unneeded kmap_atomic call
	net: dcb: Validate netlink message in DCB handler
	net: dcb: Accept RTM_GETDCB messages carrying set-like DCB commands
	rxrpc: Call state should be read with READ_ONCE() under some circumstances
	net: stmmac: Fixed mtu channged by cache aligned
	net: sit: unregister_netdevice on newlink's error path
	net: avoid 32 x truesize under-estimation for tiny skbs
	rxrpc: Fix handling of an unsupported token type in rxrpc_read()
	tipc: fix NULL deref in tipc_link_xmit()
	net: introduce skb_list_walk_safe for skb segment walking
	net: skbuff: disambiguate argument and member for skb_list_walk_safe helper
	net: ipv6: Validate GSO SKB before finish IPv6 processing
	spi: cadence: cache reference clock rate during probe
	Linux 4.19.170

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I4a12e49eae7097a468161952228c57c974a1b0ac
2021-01-23 16:13:31 +01:00
Michael Hennerich
cfca01ab14 spi: cadence: cache reference clock rate during probe
commit 4d163ad79b upstream.

The issue is that using SPI from a callback under the CCF lock will
deadlock, since this code uses clk_get_rate().

Fixes: c474b38665 ("spi: Add driver for Cadence SPI controller")
Signed-off-by: Michael Hennerich <michael.hennerich@analog.com>
Signed-off-by: Alexandru Ardelean <alexandru.ardelean@analog.com>
Link: https://lore.kernel.org/r/20210114154217.51996-1-alexandru.ardelean@analog.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-01-23 15:49:57 +01:00
Greg Kroah-Hartman
5905c14687 This is the 4.19.168 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmAENesACgkQONu9yGCS
 aT7VQg//Sr2GXQqTswXLMTMFCALNh7jSzYthMwvok9RqEeNg4bZlaXNFyylZxAgr
 q3WSPCtmJWlQ2L5mjae5qYnIvgrvf5uKRhVoiZ+piDPIaz1HLixO+oNosxsBVFc8
 Mx0OZpTP5TPRRLEyprOyQBo0fI3v4NHKQ3PYbJPzqA5jRSU+i5r1opKh8y+6pZjN
 PXdpZSinHpzs7qXWpPU3xEvmqy7TbNicD/SzJm12yoyVM3e1eB12rPDvaNMqGdLZ
 lgGhvcIunDS+rtNWrjnG4hXpKPfrpNFmH/QUK1v+/5oZDwFNn9tf1hIar5fu6T9U
 4gHhEiKlrRfJhZwgjppUTpMvt14q/XyOV3Bty3ekl6kjWalSAbffOrWongmAs5fG
 Xz/hPrhl2bO/WtXmyvuV8oQcuSc+7Ufu5lPAVALOtQcVqurOS/6KmylOWTuYaSqv
 oLzlHgHfBUf6ES1HRNb7Rn+li7c7DNzydtlr3jGxagn1ZTj6/I8GfI+UxyVPVCie
 Rq9C5ul6tE9bWnDCJEuTvEIKu11GysZqFk8nWKomXidc0pgWtr2nEtVzrsLXY+rp
 mrfmXwtHOlNmgW+kl9DFqgLUbo2kzefn62zVekbG3R7Oni3xs+YwbxZHJVkkFkXz
 G5ggw96v7M/kVRMzg/kuRaF3oYVJn6iQOueP+haX+YwoAUPjD0c=
 =zbAi
 -----END PGP SIGNATURE-----

Merge 4.19.168 into android-4.19-stable

Changes in 4.19.168
	net: cdc_ncm: correct overhead in delayed_ndp_size
	net: hns3: fix the number of queues actually used by ARQ
	net: stmmac: dwmac-sun8i: Balance internal PHY resource references
	net: stmmac: dwmac-sun8i: Balance internal PHY power
	net: vlan: avoid leaks on register_vlan_dev() failures
	net/sonic: Fix some resource leaks in error handling paths
	net: ip: always refragment ip defragmented packets
	net: fix pmtu check in nopmtudisc mode
	net: ipv6: fib: flush exceptions when purging route
	chtls: Fix hardware tid leak
	chtls: Remove invalid set_tcb call
	chtls: Fix panic when route to peer not configured
	chtls: Replace skb_dequeue with skb_peek
	chtls: Added a check to avoid NULL pointer dereference
	chtls: Fix chtls resources release sequence
	x86/resctrl: Use an IPI instead of task_work_add() to update PQR_ASSOC MSR
	x86/resctrl: Don't move a task to the same resource group
	vmlinux.lds.h: Add PGO and AutoFDO input sections
	drm/i915: Fix mismatch between misplaced vma check and vma insert
	spi: pxa2xx: Fix use-after-free on unbind
	iio: imu: st_lsm6dsx: flip irq return logic
	iio: imu: st_lsm6dsx: fix edge-trigger interrupts
	HID: wacom: Fix memory leakage caused by kfifo_alloc
	ARM: OMAP2+: omap_device: fix idling of devices during probe
	i2c: sprd: use a specific timeout to avoid system hang up issue
	cpufreq: powernow-k8: pass policy rather than use cpufreq_cpu_get()
	spi: stm32: FIFO threshold level - fix align packet size
	dmaengine: mediatek: mtk-hsdma: Fix a resource leak in the error handling path of the probe function
	dmaengine: xilinx_dma: check dma_async_device_register return value
	dmaengine: xilinx_dma: fix incompatible param warning in _child_probe()
	dmaengine: xilinx_dma: fix mixed_enum_type coverity warning
	wil6210: select CONFIG_CRC32
	block: rsxx: select CONFIG_CRC32
	lightnvm: select CONFIG_CRC32
	iommu/intel: Fix memleak in intel_irq_remapping_alloc
	net/mlx5e: Fix memleak in mlx5e_create_l2_table_groups
	net/mlx5e: Fix two double free cases
	regmap: debugfs: Fix a memory leak when calling regmap_attach_dev
	wan: ds26522: select CONFIG_BITREVERSE
	KVM: arm64: Don't access PMCR_EL0 when no PMU is available
	block: fix use-after-free in disk_part_iter_next
	net: drop bogus skb with CHECKSUM_PARTIAL and offset beyond end of trimmed packet
	regmap: debugfs: Fix a reversed if statement in regmap_debugfs_init()
	Linux 4.19.168

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ia39a78431db8bf624b3d0c0940be36c514b79a77
2021-01-17 15:40:58 +01:00
Roman Guskov
9b5a7943f7 spi: stm32: FIFO threshold level - fix align packet size
commit a590370d91 upstream.

if cur_bpw <= 8 and xfer_len < 4 then the value of fthlv will be 1 and
SPI registers content may have been lost.

* If SPI data register is accessed as a 16-bit register and DSIZE <= 8bit,
  better to select FTHLV = 2, 4, 6 etc

* If SPI data register is accessed as a 32-bit register and DSIZE > 8bit,
  better to select FTHLV = 2, 4, 6 etc, while if DSIZE <= 8bit,
  better to select FTHLV = 4, 8, 12 etc

Signed-off-by: Roman Guskov <rguskov@dh-electronics.com>
Fixes: dcbe0d84df ("spi: add driver for STM32 SPI controller")
Reviewed-by: Marek Vasut <marex@denx.de>
Link: https://lore.kernel.org/r/20201221123532.27272-1-rguskov@dh-electronics.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-01-17 14:04:21 +01:00
Lukas Wunner
d34e2cba77 spi: pxa2xx: Fix use-after-free on unbind
commit 5626308bb9 upstream

pxa2xx_spi_remove() accesses the driver's private data after calling
spi_unregister_controller() even though that function releases the last
reference on the spi_controller and thereby frees the private data.

Fix by switching over to the new devm_spi_alloc_master/slave() helper
which keeps the private data accessible until the driver has unbound.

Fixes: 32e5b57232 ("spi: pxa2xx: Fix controller unregister order")
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: <stable@vger.kernel.org> # v2.6.17+: 5e844cc37a5c: spi: Introduce device-managed SPI controller allocation
Cc: <stable@vger.kernel.org> # v2.6.17+: 32e5b57232c0: spi: pxa2xx: Fix controller unregister order
Cc: <stable@vger.kernel.org> # v2.6.17+
Link: https://lore.kernel.org/r/5764b04d4a6e43069ebb7808f64c2f774ac6f193.1607286887.git.lukas@wunner.de
Signed-off-by: Mark Brown <broonie@kernel.org>
[sudip: adjust context]
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-01-17 14:04:20 +01:00
Greg Kroah-Hartman
07ce88e9de This is the 4.19.164 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl/sVdwACgkQONu9yGCS
 aT581g/+KZ4lFcY/lAEY6/n6RjFenerl5O2a4tqO+j7eivOA8aNOzXQpvwcPXFKZ
 uCCwab3shrp0MdOJ4Ub1qLF5rZoJ/QvLNkI+8GVRztnchkWHwNlYbheZqHRows9E
 LM5w/+SUh+I7wymfjsjxr8ohSOxkvygNL9PLLTkuQMwbs/jjdizmcgqeYo54Plih
 IdtHrp/ZjxKMOu+fkp1dpTy2RUfbxxWS4RnVjSI+g3s8vaxWh90jMCwLP3fyUwpX
 a8eNCFkIV0lBCj+dYF+ry5x7wGd9mvCVAG70DmRkHd4nyc1WGnp+yz3lQlQnIzeq
 Hc7k3ts3FXmXBSRTzkqM9pmaOuyrKwqu3DoiplXxHgjeJYegP9k0jh33eohXmc/u
 qSz9XB3FhBxy7uRf8tqGLKiUsARnQUYfqzR8qgGFndvWRpIBr9egSzDKVNSF5uWu
 bPt3UQpM8O714NcnB2PGs4OUPqxSikT3BrnfurZOzEddkSveXfkItYnt3mc300bx
 MSHYY/iuLpsBeDd0U6POgf5J5RigmOWvayZrMkPSxlnm7v9diefpKo7xB7+l3AqD
 DZ5BSZMNtgKHwzck6d3RXX+GCILreL16Lj299NM1SJPm+j5SEkna7luikgi2pqrk
 r2cD31L9JHiq36L3uP5u30JoxEG6+W2Px+dqc+uyB3RXHJzRwy4=
 =TKv4
 -----END PGP SIGNATURE-----

Merge 4.19.164 into android-4.19-stable

Changes in 4.19.164
	Kbuild: do not emit debug info for assembly with LLVM_IAS=1
	x86/lib: Change .weak to SYM_FUNC_START_WEAK for arch/x86/lib/mem*_64.S
	spi: bcm2835aux: Fix use-after-free on unbind
	spi: bcm2835aux: Restore err assignment in bcm2835aux_spi_probe
	iwlwifi: pcie: limit memory read spin time
	arm64: dts: rockchip: Assign a fixed index to mmc devices on rk3399 boards.
	iwlwifi: mvm: fix kernel panic in case of assert during CSA
	powerpc: Drop -me200 addition to build flags
	ARC: stack unwinding: don't assume non-current task is sleeping
	scsi: ufs: Make sure clk scaling happens only when HBA is runtime ACTIVE
	irqchip/gic-v3-its: Unconditionally save/restore the ITS state on suspend
	soc: fsl: dpio: Get the cpumask through cpumask_of(cpu)
	platform/x86: thinkpad_acpi: Do not report SW_TABLET_MODE on Yoga 11e
	platform/x86: thinkpad_acpi: Add BAT1 is primary battery quirk for Thinkpad Yoga 11e 4th gen
	platform/x86: acer-wmi: add automatic keyboard background light toggle key as KEY_LIGHTS_TOGGLE
	platform/x86: intel-vbtn: Support for tablet mode on HP Pavilion 13 x360 PC
	Input: cm109 - do not stomp on control URB
	Input: i8042 - add Acer laptops to the i8042 reset list
	pinctrl: amd: remove debounce filter setting in IRQ type setting
	mmc: block: Fixup condition for CMD13 polling for RPMB requests
	kbuild: avoid static_assert for genksyms
	scsi: be2iscsi: Revert "Fix a theoretical leak in beiscsi_create_eqs()"
	x86/mm/mem_encrypt: Fix definition of PMD_FLAGS_DEC_WP
	x86/membarrier: Get rid of a dubious optimization
	x86/apic/vector: Fix ordering in vector assignment
	compiler.h: fix barrier_data() on clang
	PCI: qcom: Add missing reset for ipq806x
	mac80211: mesh: fix mesh_pathtbl_init() error path
	net: stmmac: free tx skb buffer in stmmac_resume()
	tcp: select sane initial rcvq_space.space for big MSS
	tcp: fix cwnd-limited bug for TSO deferral where we send nothing
	net/mlx4_en: Avoid scheduling restart task if it is already running
	lan743x: fix for potential NULL pointer dereference with bare card
	net/mlx4_en: Handle TX error CQE
	net: stmmac: delete the eee_ctrl_timer after napi disabled
	net: stmmac: dwmac-meson8b: fix mask definition of the m250_sel mux
	net: bridge: vlan: fix error return code in __vlan_add()
	ktest.pl: If size of log is too big to email, email error message
	USB: dummy-hcd: Fix uninitialized array use in init()
	USB: add RESET_RESUME quirk for Snapscan 1212
	ALSA: usb-audio: Fix potential out-of-bounds shift
	ALSA: usb-audio: Fix control 'access overflow' errors from chmap
	xhci: Give USB2 ports time to enter U3 in bus suspend
	USB: UAS: introduce a quirk to set no_write_same
	USB: sisusbvga: Make console support depend on BROKEN
	ALSA: pcm: oss: Fix potential out-of-bounds shift
	serial: 8250_omap: Avoid FIFO corruption caused by MDR1 access
	drm/xen-front: Fix misused IS_ERR_OR_NULL checks
	drm: fix drm_dp_mst_port refcount leaks in drm_dp_mst_allocate_vcpi
	arm64: lse: fix LSE atomics with LLVM's integrated assembler
	arm64: lse: Fix LSE atomics with LLVM
	arm64: Change .weak to SYM_FUNC_START_WEAK_PI for arch/arm64/lib/mem*.S
	x86/resctrl: Remove unused struct mbm_state::chunks_bw
	x86/resctrl: Fix incorrect local bandwidth when mba_sc is enabled
	pinctrl: merrifield: Set default bias in case no particular value given
	pinctrl: baytrail: Avoid clearing debounce value when turning it off
	ARM: dts: sun8i: v3s: fix GIC node memory range
	gpio: mvebu: fix potential user-after-free on probe
	scsi: bnx2i: Requires MMU
	xsk: Fix xsk_poll()'s return type
	can: softing: softing_netdev_open(): fix error handling
	clk: renesas: r9a06g032: Drop __packed for portability
	block: factor out requeue handling from dispatch code
	netfilter: x_tables: Switch synchronization to RCU
	gpio: eic-sprd: break loop when getting NULL device resource
	selftests/bpf/test_offload.py: Reset ethtool features after failed setting
	RDMA/cm: Fix an attempt to use non-valid pointer when cleaning timewait
	ixgbe: avoid premature Rx buffer reuse
	drm/tegra: replace idr_init() by idr_init_base()
	kernel/cpu: add arch override for clear_tasks_mm_cpumask() mm handling
	drm/tegra: sor: Disable clocks on error in tegra_sor_init()
	arm64: syscall: exit userspace before unmasking exceptions
	vxlan: Add needed_headroom for lower device
	vxlan: Copy needed_tailroom from lowerdev
	scsi: mpt3sas: Increase IOCInit request timeout to 30s
	dm table: Remove BUG_ON(in_interrupt())
	soc/tegra: fuse: Fix index bug in get_process_id
	USB: serial: option: add interface-number sanity check to flag handling
	USB: gadget: f_acm: add support for SuperSpeed Plus
	USB: gadget: f_midi: setup SuperSpeed Plus descriptors
	usb: gadget: f_fs: Re-use SS descriptors for SuperSpeedPlus
	USB: gadget: f_rndis: fix bitrate for SuperSpeed and above
	usb: chipidea: ci_hdrc_imx: Pass DISABLE_DEVICE_STREAMING flag to imx6ul
	ARM: dts: exynos: fix roles of USB 3.0 ports on Odroid XU
	ARM: dts: exynos: fix USB 3.0 VBUS control and over-current pins on Exynos5410
	ARM: dts: exynos: fix USB 3.0 pins supply being turned off on Odroid XU
	coresight: tmc-etr: Check if page is valid before dma_map_page()
	scsi: megaraid_sas: Check user-provided offsets
	HID: i2c-hid: add Vero K147 to descriptor override
	serial_core: Check for port state when tty is in error state
	Bluetooth: Fix slab-out-of-bounds read in hci_le_direct_adv_report_evt()
	quota: Sanity-check quota file headers on load
	media: msi2500: assign SPI bus number dynamically
	crypto: af_alg - avoid undefined behavior accessing salg_name
	md: fix a warning caused by a race between concurrent md_ioctl()s
	perf cs-etm: Change tuple from traceID-CPU# to traceID-metadata
	perf cs-etm: Move definition of 'traceid_list' global variable from header file
	drm/gma500: fix double free of gma_connector
	drm/tve200: Fix handling of platform_get_irq() error
	soc: renesas: rmobile-sysc: Fix some leaks in rmobile_init_pm_domains()
	soc: mediatek: Check if power domains can be powered on at boot time
	soc: qcom: geni: More properly switch to DMA mode
	RDMA/bnxt_re: Set queue pair state when being queried
	selinux: fix error initialization in inode_doinit_with_dentry()
	ARM: dts: aspeed: s2600wf: Fix VGA memory region location
	RDMA/rxe: Compute PSN windows correctly
	x86/mm/ident_map: Check for errors from ident_pud_init()
	ARM: p2v: fix handling of LPAE translation in BE mode
	x86/apic: Fix x2apic enablement without interrupt remapping
	sched/deadline: Fix sched_dl_global_validate()
	sched: Reenable interrupts in do_sched_yield()
	crypto: talitos - Endianess in current_desc_hdr()
	crypto: talitos - Fix return type of current_desc_hdr()
	crypto: inside-secure - Fix sizeof() mismatch
	powerpc/64: Set up a kernel stack for secondaries before cpu_restore()
	spi: img-spfi: fix reference leak in img_spfi_resume
	drm/msm/dsi_pll_10nm: restore VCO rate during restore_state
	ASoC: pcm: DRAIN support reactivation
	selinux: fix inode_doinit_with_dentry() LABEL_INVALID error handling
	arm64: dts: exynos: Include common syscon restart/poweroff for Exynos7
	arm64: dts: exynos: Correct psci compatible used on Exynos7
	Bluetooth: Fix null pointer dereference in hci_event_packet()
	Bluetooth: hci_h5: fix memory leak in h5_close
	spi: spi-ti-qspi: fix reference leak in ti_qspi_setup
	spi: tegra20-slink: fix reference leak in slink ops of tegra20
	spi: tegra20-sflash: fix reference leak in tegra_sflash_resume
	spi: tegra114: fix reference leak in tegra spi ops
	spi: bcm63xx-hsspi: fix missing clk_disable_unprepare() on error in bcm63xx_hsspi_resume
	mwifiex: fix mwifiex_shutdown_sw() causing sw reset failure
	ASoC: wm8998: Fix PM disable depth imbalance on error
	ASoC: arizona: Fix a wrong free in wm8997_probe
	RDMa/mthca: Work around -Wenum-conversion warning
	MIPS: BCM47XX: fix kconfig dependency bug for BCM47XX_BCMA
	crypto: qat - fix status check in qat_hal_put_rel_rd_xfer()
	staging: greybus: codecs: Fix reference counter leak in error handling
	staging: gasket: interrupt: fix the missed eventfd_ctx_put() in gasket_interrupt.c
	media: tm6000: Fix sizeof() mismatches
	media: mtk-vcodec: add missing put_device() call in mtk_vcodec_release_dec_pm()
	ASoC: meson: fix COMPILE_TEST error
	scsi: core: Fix VPD LUN ID designator priorities
	media: solo6x10: fix missing snd_card_free in error handling case
	video: fbdev: atmel_lcdfb: fix return error code in atmel_lcdfb_of_init()
	drm/omap: dmm_tiler: fix return error code in omap_dmm_probe()
	Input: ads7846 - fix race that causes missing releases
	Input: ads7846 - fix integer overflow on Rt calculation
	Input: ads7846 - fix unaligned access on 7845
	usb/max3421: fix return error code in max3421_probe()
	spi: mxs: fix reference leak in mxs_spi_probe
	powerpc/feature: Fix CPU_FTRS_ALWAYS by removing CPU_FTRS_GENERIC_32
	crypto: crypto4xx - Replace bitwise OR with logical OR in crypto4xx_build_pd
	crypto: omap-aes - Fix PM disable depth imbalance in omap_aes_probe
	spi: fix resource leak for drivers without .remove callback
	soc: ti: knav_qmss: fix reference leak in knav_queue_probe
	soc: ti: Fix reference imbalance in knav_dma_probe
	drivers: soc: ti: knav_qmss_queue: Fix error return code in knav_queue_probe
	Input: omap4-keypad - fix runtime PM error handling
	RDMA/cxgb4: Validate the number of CQEs
	memstick: fix a double-free bug in memstick_check
	ARM: dts: at91: sama5d4_xplained: add pincontrol for USB Host
	ARM: dts: at91: sama5d3_xplained: add pincontrol for USB Host
	orinoco: Move context allocation after processing the skb
	cw1200: fix missing destroy_workqueue() on error in cw1200_init_common
	dmaengine: mv_xor_v2: Fix error return code in mv_xor_v2_probe()
	media: siano: fix memory leak of debugfs members in smsdvb_hotplug
	platform/x86: mlx-platform: Remove PSU EEPROM from default platform configuration
	platform/x86: mlx-platform: Remove PSU EEPROM from MSN274x platform configuration
	samples: bpf: Fix lwt_len_hist reusing previous BPF map
	mips: cdmm: fix use-after-free in mips_cdmm_bus_discover
	media: max2175: fix max2175_set_csm_mode() error code
	slimbus: qcom-ngd-ctrl: Avoid sending power requests without QMI
	HSI: omap_ssi: Don't jump to free ID in ssi_add_controller()
	ARM: dts: Remove non-existent i2c1 from 98dx3236
	arm64: dts: rockchip: Set dr_mode to "host" for OTG on rk3328-roc-cc
	power: supply: axp288_charger: Fix HP Pavilion x2 10 DMI matching
	power: supply: bq24190_charger: fix reference leak
	genirq/irqdomain: Don't try to free an interrupt that has no mapping
	PCI: Bounds-check command-line resource alignment requests
	PCI: Fix overflow in command-line resource alignment requests
	PCI: iproc: Fix out-of-bound array accesses
	arm64: dts: meson: fix spi-max-frequency on Khadas VIM2
	ARM: dts: at91: at91sam9rl: fix ADC triggers
	platform/x86: dell-smbios-base: Fix error return code in dell_smbios_init
	ath10k: Fix the parsing error in service available event
	ath10k: Fix an error handling path
	ath10k: Release some resources in an error handling path
	NFSv4.2: condition READDIR's mask for security label based on LSM state
	SUNRPC: xprt_load_transport() needs to support the netid "rdma6"
	lockd: don't use interval-based rebinding over TCP
	NFS: switch nfsiod to be an UNBOUND workqueue.
	vfio-pci: Use io_remap_pfn_range() for PCI IO memory
	media: saa7146: fix array overflow in vidioc_s_audio()
	clocksource/drivers/cadence_ttc: Fix memory leak in ttc_setup_clockevent()
	ARM: dts: at91: sama5d2: map securam as device
	pinctrl: falcon: add missing put_device() call in pinctrl_falcon_probe()
	arm64: dts: rockchip: Fix UART pull-ups on rk3328
	memstick: r592: Fix error return in r592_probe()
	net/mlx5: Properly convey driver version to firmware
	ASoC: jz4740-i2s: add missed checks for clk_get()
	dm ioctl: fix error return code in target_message
	clocksource/drivers/arm_arch_timer: Correct fault programming of CNTKCTL_EL1.EVNTI
	cpufreq: highbank: Add missing MODULE_DEVICE_TABLE
	cpufreq: mediatek: Add missing MODULE_DEVICE_TABLE
	cpufreq: st: Add missing MODULE_DEVICE_TABLE
	cpufreq: loongson1: Add missing MODULE_ALIAS
	cpufreq: scpi: Add missing MODULE_ALIAS
	scsi: qedi: Fix missing destroy_workqueue() on error in __qedi_probe
	scsi: pm80xx: Fix error return in pm8001_pci_probe()
	seq_buf: Avoid type mismatch for seq_buf_init
	scsi: fnic: Fix error return code in fnic_probe()
	platform/x86: mlx-platform: Fix item counter assignment for MSN2700, MSN24xx systems
	powerpc/pseries/hibernation: drop pseries_suspend_begin() from suspend ops
	powerpc/pseries/hibernation: remove redundant cacheinfo update
	usb: ehci-omap: Fix PM disable depth umbalance in ehci_hcd_omap_probe
	usb: oxu210hp-hcd: Fix memory leak in oxu_create
	speakup: fix uninitialized flush_lock
	nfsd: Fix message level for normal termination
	nfs_common: need lock during iterate through the list
	x86/kprobes: Restore BTF if the single-stepping is cancelled
	bus: fsl-mc: fix error return code in fsl_mc_object_allocate()
	clk: tegra: Fix duplicated SE clock entry
	extcon: max77693: Fix modalias string
	mac80211: don't set set TDLS STA bandwidth wider than possible
	ASoC: wm_adsp: remove "ctl" from list on error in wm_adsp_create_control()
	irqchip/alpine-msi: Fix freeing of interrupts on allocation error path
	watchdog: sirfsoc: Add missing dependency on HAS_IOMEM
	watchdog: sprd: remove watchdog disable from resume fail path
	watchdog: sprd: check busy bit before new loading rather than after that
	watchdog: Fix potential dereferencing of null pointer
	um: Monitor error events in IRQ controller
	um: tty: Fix handling of close in tty lines
	um: chan_xterm: Fix fd leak
	nfc: s3fwrn5: Release the nfc firmware
	powerpc/ps3: use dma_mapping_error()
	checkpatch: fix unescaped left brace
	net: bcmgenet: Fix a resource leak in an error handling path in the probe functin
	net: allwinner: Fix some resources leak in the error handling path of the probe and in the remove function
	net: korina: fix return value
	libnvdimm/label: Return -ENXIO for no slot in __blk_label_update
	watchdog: qcom: Avoid context switch in restart handler
	watchdog: coh901327: add COMMON_CLK dependency
	clk: ti: Fix memleak in ti_fapll_synth_setup
	pwm: zx: Add missing cleanup in error path
	pwm: lp3943: Dynamically allocate PWM chip base
	perf record: Fix memory leak when using '--user-regs=?' to list registers
	qlcnic: Fix error code in probe
	clk: s2mps11: Fix a resource leak in error handling paths in the probe function
	clk: sunxi-ng: Make sure divider tables have sentinel
	kconfig: fix return value of do_error_if()
	ARM: sunxi: Add machine match for the Allwinner V3 SoC
	cfg80211: initialize rekey_data
	fix namespaced fscaps when !CONFIG_SECURITY
	lwt: Disable BH too in run_lwt_bpf()
	Input: cros_ec_keyb - send 'scancodes' in addition to key events
	Input: goodix - add upside-down quirk for Teclast X98 Pro tablet
	media: gspca: Fix memory leak in probe
	media: sunxi-cir: ensure IR is handled when it is continuous
	media: netup_unidvb: Don't leak SPI master in probe error path
	media: ipu3-cio2: Remove traces of returned buffers
	media: ipu3-cio2: Return actual subdev format
	media: ipu3-cio2: Serialise access to pad format
	media: ipu3-cio2: Validate mbus format in setting subdev format
	media: ipu3-cio2: Make the field on subdev format V4L2_FIELD_NONE
	Input: cyapa_gen6 - fix out-of-bounds stack access
	ALSA: hda/ca0132 - Change Input Source enum strings.
	PM: ACPI: PCI: Drop acpi_pm_set_bridge_wakeup()
	Revert "ACPI / resources: Use AE_CTRL_TERMINATE to terminate resources walks"
	ACPI: PNP: compare the string length in the matching_id()
	ALSA: hda: Fix regressions on clear and reconfig sysfs
	ALSA: hda/realtek - Enable headset mic of ASUS X430UN with ALC256
	ALSA: hda/realtek - Enable headset mic of ASUS Q524UQK with ALC255
	ALSA: pcm: oss: Fix a few more UBSAN fixes
	ALSA: hda/realtek: Add quirk for MSI-GP73
	ALSA: hda/realtek: Apply jack fixup for Quanta NL3
	ALSA: usb-audio: Add VID to support native DSD reproduction on FiiO devices
	ALSA: usb-audio: Disable sample read check if firmware doesn't give back
	s390/smp: perform initial CPU reset also for SMT siblings
	s390/kexec_file: fix diag308 subcode when loading crash kernel
	s390/dasd: fix hanging device offline processing
	s390/dasd: prevent inconsistent LCU device data
	s390/dasd: fix list corruption of pavgroup group list
	s390/dasd: fix list corruption of lcu list
	staging: comedi: mf6x4: Fix AI end-of-conversion detection
	powerpc/perf: Exclude kernel samples while counting events in user space.
	crypto: ecdh - avoid unaligned accesses in ecdh_set_secret()
	EDAC/amd64: Fix PCI component registration
	USB: serial: mos7720: fix parallel-port state restore
	USB: serial: digi_acceleport: fix write-wakeup deadlocks
	USB: serial: keyspan_pda: fix dropped unthrottle interrupts
	USB: serial: keyspan_pda: fix write deadlock
	USB: serial: keyspan_pda: fix stalled writes
	USB: serial: keyspan_pda: fix write-wakeup use-after-free
	USB: serial: keyspan_pda: fix tx-unthrottle use-after-free
	USB: serial: keyspan_pda: fix write unthrottling
	ext4: fix a memory leak of ext4_free_data
	ext4: fix deadlock with fs freezing and EA inodes
	KVM: arm64: Introduce handling of AArch32 TTBCR2 traps
	ARM: dts: pandaboard: fix pinmux for gpio user button of Pandaboard ES
	ARM: dts: at91: sama5d2: fix CAN message ram offset and size
	powerpc: Fix incorrect stw{, ux, u, x} instructions in __set_pte_at
	powerpc/rtas: Fix typo of ibm,open-errinjct in RTAS filter
	powerpc/xmon: Change printk() to pr_cont()
	powerpc/powernv/memtrace: Don't leak kernel memory to user space
	powerpc/powernv/memtrace: Fix crashing the kernel when enabling concurrently
	ima: Don't modify file descriptor mode on the fly
	ceph: fix race in concurrent __ceph_remove_cap invocations
	SMB3: avoid confusing warning message on mount to Azure
	SMB3.1.1: do not log warning message if server doesn't populate salt
	ubifs: wbuf: Don't leak kernel memory to flash
	jffs2: Fix GC exit abnormally
	jfs: Fix array index bounds check in dbAdjTree
	drm/dp_aux_dev: check aux_dev before use in drm_dp_aux_dev_get_by_minor()
	spi: spi-sh: Fix use-after-free on unbind
	spi: davinci: Fix use-after-free on unbind
	spi: pic32: Don't leak DMA channels in probe error path
	spi: rb4xx: Don't leak SPI master in probe error path
	spi: sc18is602: Don't leak SPI master in probe error path
	spi: st-ssc4: Fix unbalanced pm_runtime_disable() in probe error path
	spi: mt7621: fix missing clk_disable_unprepare() on error in mt7621_spi_probe
	soc: qcom: smp2p: Safely acquire spinlock without IRQs
	mtd: spinand: Fix OOB read
	mtd: parser: cmdline: Fix parsing of part-names with colons
	mtd: rawnand: qcom: Fix DMA sync on FLASH_STATUS register read
	scsi: lpfc: Fix invalid sleeping context in lpfc_sli4_nvmet_alloc()
	scsi: lpfc: Re-fix use after free in lpfc_rq_buf_free()
	iio: buffer: Fix demux update
	iio: adc: rockchip_saradc: fix missing clk_disable_unprepare() on error in rockchip_saradc_resume
	iio:light:rpr0521: Fix timestamp alignment and prevent data leak.
	iio:light:st_uvis25: Fix timestamp alignment and prevent data leak.
	iio:pressure:mpl3115: Force alignment of buffer
	iio:imu:bmi160: Fix too large a buffer.
	md/cluster: block reshape with remote resync job
	md/cluster: fix deadlock when node is doing resync job
	pinctrl: sunxi: Always call chained_irq_{enter, exit} in sunxi_pinctrl_irq_handler
	clk: mvebu: a3700: fix the XTAL MODE pin to MPP1_9
	xen-blkback: set ring->xenblkd to NULL after kthread_stop()
	xen/xenbus: Allow watches discard events before queueing
	xen/xenbus: Add 'will_handle' callback support in xenbus_watch_path()
	xen/xenbus/xen_bus_type: Support will_handle watch callback
	xen/xenbus: Count pending messages for each watch
	xenbus/xenbus_backend: Disallow pending watch messages
	libnvdimm/namespace: Fix reaping of invalidated block-window-namespace labels
	platform/x86: intel-vbtn: Allow switch events on Acer Switch Alpha 12
	PCI: Fix pci_slot_release() NULL pointer dereference
	platform/x86: mlx-platform: remove an unused variable
	Linux 4.19.164

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I8e2d24b45393ee2360186893d4e578e20156c7f1
2020-12-30 12:19:31 +01:00
Lukas Wunner
66f3bc0991 spi: st-ssc4: Fix unbalanced pm_runtime_disable() in probe error path
commit 5ef76dac0f upstream.

If the calls to devm_platform_ioremap_resource(), irq_of_parse_and_map()
or devm_request_irq() fail on probe of the ST SSC4 SPI driver, the
runtime PM disable depth is incremented even though it was not
decremented before.  Fix it.

Fixes: cd050abeba ("spi: st-ssc4: add missed pm_runtime_disable")
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: <stable@vger.kernel.org> # v5.5+
Cc: Chuhong Yuan <hslester96@gmail.com>
Link: https://lore.kernel.org/r/fbe8768c30dc829e2d77eabe7be062ca22f84024.1604874488.git.lukas@wunner.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-30 11:26:14 +01:00
Lukas Wunner
a33642f952 spi: sc18is602: Don't leak SPI master in probe error path
commit 5b8c88462d upstream.

If the call to devm_gpiod_get_optional() fails on probe of the NXP
SC18IS602/603 SPI driver, the spi_master struct is erroneously not freed.

Fix by switching over to the new devm_spi_alloc_master() helper.

Fixes: f99008013e ("spi: sc18is602: Add reset control via gpio pin.")
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: <stable@vger.kernel.org> # v4.9+: 5e844cc37a5c: spi: Introduce device-managed SPI controller allocation
Cc: <stable@vger.kernel.org> # v4.9+
Cc: Phil Reid <preid@electromag.com.au>
Link: https://lore.kernel.org/r/d5f715527b894b91d530fe11a86f51b3184a4e1a.1607286887.git.lukas@wunner.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-30 11:26:14 +01:00
Lukas Wunner
e9a04636e8 spi: rb4xx: Don't leak SPI master in probe error path
commit a4729c3506 upstream.

If the calls to devm_clk_get(), devm_spi_register_master() or
clk_prepare_enable() fail on probe of the Mikrotik RB4xx SPI driver,
the spi_master struct is erroneously not freed.

Fix by switching over to the new devm_spi_alloc_master() helper.

Fixes: 05aec35787 ("spi: Add SPI driver for Mikrotik RB4xx series boards")
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: <stable@vger.kernel.org> # v4.2+: 5e844cc37a5c: spi: Introduce device-managed SPI controller allocation
Cc: <stable@vger.kernel.org> # v4.2+
Cc: Bert Vermeulen <bert@biot.com>
Link: https://lore.kernel.org/r/369bf26d71927f60943b1d9d8f51810f00b0237d.1607286887.git.lukas@wunner.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-30 11:26:14 +01:00
Lukas Wunner
ba02e02944 spi: pic32: Don't leak DMA channels in probe error path
commit c575e9113b upstream.

If the calls to devm_request_irq() or devm_spi_register_master() fail
on probe of the PIC32 SPI driver, the DMA channels requested by
pic32_spi_dma_prep() are erroneously not released.  Plug the leak.

Fixes: 1bcb9f8ceb ("spi: spi-pic32: Add PIC32 SPI master driver")
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: <stable@vger.kernel.org> # v4.7+
Cc: Purna Chandra Mandal <purna.mandal@microchip.com>
Link: https://lore.kernel.org/r/9624250e3a7aa61274b38219a62375bac1def637.1604874488.git.lukas@wunner.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-30 11:26:14 +01:00
Lukas Wunner
9c8ef3bfd1 spi: davinci: Fix use-after-free on unbind
commit 373afef350 upstream.

davinci_spi_remove() accesses the driver's private data after it's been
freed with spi_master_put().

Fix by moving the spi_master_put() to the end of the function.

Fixes: fe5fd25409 ("spi: davinci: Use dma_request_chan() for requesting DMA channel")
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Acked-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
Cc: <stable@vger.kernel.org> # v4.7+
Link: https://lore.kernel.org/r/412f7eb1cf8990e0a3a2153f4c577298deab623e.1607286887.git.lukas@wunner.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-30 11:26:14 +01:00
Lukas Wunner
f9433449a7 spi: spi-sh: Fix use-after-free on unbind
commit e77df3eca1 upstream.

spi_sh_remove() accesses the driver's private data after calling
spi_unregister_master() even though that function releases the last
reference on the spi_master and thereby frees the private data.

Fix by switching over to the new devm_spi_alloc_master() helper which
keeps the private data accessible until the driver has unbound.

Fixes: 680c1305e2 ("spi/spi_sh: use spi_unregister_master instead of spi_master_put in remove path")
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: <stable@vger.kernel.org> # v3.0+: 5e844cc37a5c: spi: Introduce device-managed SPI controller allocation
Cc: <stable@vger.kernel.org> # v3.0+
Cc: Axel Lin <axel.lin@ingics.com>
Link: https://lore.kernel.org/r/6d97628b536baf01d5e3e39db61108f84d44c8b2.1607286887.git.lukas@wunner.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-30 11:26:14 +01:00
Uwe Kleine-König
d85ed98f5a spi: fix resource leak for drivers without .remove callback
[ Upstream commit 440408dbad ]

Consider an spi driver with a .probe but without a .remove callback (e.g.
rtc-ds1347). The function spi_drv_probe() is called to bind a device and
so dev_pm_domain_attach() is called. As there is no remove callback
spi_drv_remove() isn't called at unbind time however and so calling
dev_pm_domain_detach() is missed and the pm domain keeps active.

To fix this always use both spi_drv_probe() and spi_drv_remove() and
make them handle the respective callback not being set. This has the
side effect that for a (hypothetical) driver that has neither .probe nor
remove the clk and pm domain setup is done.

Fixes: 33cf00e570 ("spi: attach/detach SPI device to the ACPI power domain")
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Link: https://lore.kernel.org/r/20201119161604.2633521-1-u.kleine-koenig@pengutronix.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-12-30 11:25:55 +01:00
Zhang Qilong
e92591b781 spi: mxs: fix reference leak in mxs_spi_probe
[ Upstream commit 03fc41afaa ]

pm_runtime_get_sync will increment pm usage counter even it
failed. Forgetting to pm_runtime_put_noidle will result in
reference leak in mxs_spi_probe, so we should fix it.

Fixes: b7969caf41 ("spi: mxs: implement runtime pm")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Link: https://lore.kernel.org/r/20201106012421.95420-1-zhangqilong3@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-12-30 11:25:54 +01:00
Qinglang Miao
74f92cc8b4 spi: bcm63xx-hsspi: fix missing clk_disable_unprepare() on error in bcm63xx_hsspi_resume
[ Upstream commit 9bb9ef2b3e ]

Fix the missing clk_disable_unprepare() before return
from bcm63xx_hsspi_resume in the error handling case when
fails to prepare and enable bs->pll_clk.

Fixes: 0fd85869c2 ("spi/bcm63xx-hsspi: keep pll clk enabled")
Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
Link: https://lore.kernel.org/r/20201103074911.195530-1-miaoqinglang@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-12-30 11:25:52 +01:00
Zhang Qilong
9559ee15ca spi: tegra114: fix reference leak in tegra spi ops
[ Upstream commit a042184c7f ]

pm_runtime_get_sync will increment pm usage counter even it
failed. Forgetting to pm_runtime_put_noidle will result in
reference leak in two callers(tegra_spi_setup and
tegra_spi_resume), so we should fix it.

Fixes: f333a331ad ("spi/tegra114: add spi driver")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Link: https://lore.kernel.org/r/20201103141306.5607-1-zhangqilong3@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-12-30 11:25:52 +01:00
Zhang Qilong
2d40dbad5f spi: tegra20-sflash: fix reference leak in tegra_sflash_resume
[ Upstream commit 3482e797ab ]

pm_runtime_get_sync will increment pm usage counter even it
failed. Forgetting to pm_runtime_put_noidle will result in
reference leak in tegra_sflash_resume, so we should fix it.

Fixes: 8528547bcc ("spi: tegra: add spi driver for sflash controller")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Link: https://lore.kernel.org/r/20201103141323.5841-1-zhangqilong3@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-12-30 11:25:52 +01:00
Zhang Qilong
3c0f136a05 spi: tegra20-slink: fix reference leak in slink ops of tegra20
[ Upstream commit 763eab7074 ]

pm_runtime_get_sync will increment pm usage counter even it
failed. Forgetting to pm_runtime_put_noidle will result in
reference leak in two callers(tegra_slink_setup and
tegra_slink_resume), so we should fix it.

Fixes: dc4dc36056 ("spi: tegra: add spi driver for SLINK controller")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Link: https://lore.kernel.org/r/20201103141345.6188-1-zhangqilong3@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-12-30 11:25:52 +01:00
Zhang Qilong
b7d60a1b30 spi: spi-ti-qspi: fix reference leak in ti_qspi_setup
[ Upstream commit 45c0cba753 ]

pm_runtime_get_sync will increment pm usage counter even it
failed. Forgetting to pm_runtime_put_noidle will result in
reference leak in ti_qspi_setup, so we should fix it.

Fixes: 505a14954e ("spi/qspi: Add qspi flash controller")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Link: https://lore.kernel.org/r/20201103140947.3815-1-zhangqilong3@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-12-30 11:25:52 +01:00
Zhang Qilong
dc8805b8e9 spi: img-spfi: fix reference leak in img_spfi_resume
[ Upstream commit ee5558a908 ]

pm_runtime_get_sync will increment pm usage counter even it
failed. Forgetting to pm_runtime_put_noidle will result in
reference leak in img_spfi_resume, so we should fix it.

Fixes: deba25800a ("spi: Add driver for IMG SPFI controller")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Link: https://lore.kernel.org/r/20201102145651.3875-1-zhangqilong3@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-12-30 11:25:51 +01:00
Nathan Chancellor
1e2f19a1dc spi: bcm2835aux: Restore err assignment in bcm2835aux_spi_probe
[ Upstream commit d853b34069 ]

Clang warns:

drivers/spi/spi-bcm2835aux.c:532:50: warning: variable 'err' is
uninitialized when used here [-Wuninitialized]
                dev_err(&pdev->dev, "could not get clk: %d\n", err);
                                                               ^~~
./include/linux/dev_printk.h:112:32: note: expanded from macro 'dev_err'
        _dev_err(dev, dev_fmt(fmt), ##__VA_ARGS__)
                                      ^~~~~~~~~~~
drivers/spi/spi-bcm2835aux.c:495:9: note: initialize the variable 'err'
to silence this warning
        int err;
               ^
                = 0
1 warning generated.

Restore the assignment so that the error value can be used in the
dev_err statement and there is no uninitialized memory being leaked.

Fixes: e13ee6cc47 ("spi: bcm2835aux: Fix use-after-free on unbind")
Link: https://github.com/ClangBuiltLinux/linux/issues/1199
Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
Link: https://lore.kernel.org/r/20201113180701.455541-1-natechancellor@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
[lukas: backport to 4.19-stable, add stable designation]
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: <stable@vger.kernel.org> # v4.4+: e13ee6cc4781: spi: bcm2835aux: Fix use-after-free on unbind
Cc: <stable@vger.kernel.org> # v4.4+
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-30 11:25:37 +01:00
Lukas Wunner
6b3f38cef4 spi: bcm2835aux: Fix use-after-free on unbind
[ Upstream commit e13ee6cc47 ]

bcm2835aux_spi_remove() accesses the driver's private data after calling
spi_unregister_master() even though that function releases the last
reference on the spi_master and thereby frees the private data.

Fix by switching over to the new devm_spi_alloc_master() helper which
keeps the private data accessible until the driver has unbound.

Fixes: b9dd3f6d41 ("spi: bcm2835aux: Fix controller unregister order")
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: <stable@vger.kernel.org> # v4.4+: 5e844cc37a5c: spi: Introduce device-managed SPI controller allocation
Cc: <stable@vger.kernel.org> # v4.4+: b9dd3f6d4172: spi: bcm2835aux: Fix controller unregister order
Cc: <stable@vger.kernel.org> # v4.4+
Link: https://lore.kernel.org/r/b290b06357d0c0bdee9cecc539b840a90630f101.1605121038.git.lukas@wunner.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-30 11:25:37 +01:00
Jon Lin
1d93776778 spi: rockchip: Support SPI_CS_HIGH
Change-Id: I899bce8d9418ee99c784726bb56534aaed27c00b
Signed-off-by: Jon Lin <jon.lin@rock-chips.com>
2020-12-28 09:48:04 +08:00
Greg Kroah-Hartman
a175946a5a This is the 4.19.163 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl/TZyUACgkQONu9yGCS
 aT6Z8Q/+It2xbx52eGrQbN1beQ4vlER+kfbyvIWGgj3GYgiTn1nBTf0COJs5ukXG
 YiKfimV7vUth1NOFkgb4/FKLaU1YkIBpKgOruFA8bxL/XIfX617Y9e3zIFU7Dhsx
 R/fuLm0+EqaIlT9nO59vf3MU1Fe6Ty8jBzwrVlgAUwSDWqtPLvvevwwpS1dJLQ77
 5O3Q8/tO9epc6r5RxSzdcaFZDAp1SeT/lIxzKQD9rBeySJeB/e0usoo00SpjcGiL
 biZSgKAbpLQ2Y5Mbev5OClNxP3zCObOy8Hj20xOl1jlUil+UNQXfbU+bLNuQKfWU
 ilPjhrqUarBaMHydsJDZ9CTHOB94dVqUPB1YJYgtDr3cC5X/yQkqZwPGoK8tEe5u
 IO2XUkCGd6bj4nnqikkodh6zYlfxMYbHaFRAUaOMkE5c5Y3mb3h+/DW8cFuEIEg3
 4dYnujItqCnqlNP3/bmT6i2uicxNzbAGYNZ/7B883WyCsBlxaPTJlY8yzFxoPk03
 HYXKxM9lY1gn0zFXttvWp0l91UWnuIuJqRyc97NuhTxKr9+ZHbnBDWXnF3Dm3iie
 262DXA+dAIc5FR9LQHG83nrrnLVk+3d1fiaduHCmaMjx/T1kJquMRuuWEUJZf/CG
 ++DecqyoGCqNJAQfbu5OUywPnakRfaCdXUo73qfCfloS4OYe5ck=
 =hIcD
 -----END PGP SIGNATURE-----

Merge 4.19.163 into android-4.19-stable

Changes in 4.19.163
	pinctrl: baytrail: Replace WARN with dev_info_once when setting direct-irq pin to output
	pinctrl: baytrail: Fix pin being driven low for a while on gpiod_get(..., GPIOD_OUT_HIGH)
	usb: gadget: f_fs: Use local copy of descriptors for userspace copy
	USB: serial: kl5kusb105: fix memleak on open
	USB: serial: ch341: add new Product ID for CH341A
	USB: serial: ch341: sort device-id entries
	USB: serial: option: add Fibocom NL668 variants
	USB: serial: option: add support for Thales Cinterion EXS82
	USB: serial: option: fix Quectel BG96 matching
	tty: Fix ->pgrp locking in tiocspgrp()
	tty: Fix ->session locking
	ALSA: hda/realtek: Add mute LED quirk to yet another HP x360 model
	ALSA: hda/realtek: Enable headset of ASUS UX482EG & B9400CEA with ALC294
	ALSA: hda/realtek - Add new codec supported for ALC897
	ALSA: hda/generic: Add option to enforce preferred_dacs pairs
	ftrace: Fix updating FTRACE_FL_TRAMP
	cifs: fix potential use-after-free in cifs_echo_request()
	i2c: imx: Don't generate STOP condition if arbitration has been lost
	scsi: mpt3sas: Fix ioctl timeout
	dm writecache: fix the maximum number of arguments
	dm: remove invalid sparse __acquires and __releases annotations
	mm: list_lru: set shrinker map bit when child nr_items is not zero
	mm/swapfile: do not sleep with a spin lock held
	x86/uprobes: Do not use prefixes.nbytes when looping over prefixes.bytes
	i2c: imx: Fix reset of I2SR_IAL flag
	i2c: imx: Check for I2SR_IAL after every byte
	speakup: Reject setting the speakup line discipline outside of speakup
	iommu/amd: Set DTE[IntTabLen] to represent 512 IRTEs
	spi: Introduce device-managed SPI controller allocation
	spi: bcm-qspi: Fix use-after-free on unbind
	spi: bcm2835: Fix use-after-free on unbind
	spi: bcm2835: Release the DMA channel if probe fails after dma_init
	tracing: Fix userstacktrace option for instances
	gfs2: check for empty rgrp tree in gfs2_ri_update
	i2c: qup: Fix error return code in qup_i2c_bam_schedule_desc()
	dm writecache: remove BUG() and fail gracefully instead
	Input: i8042 - fix error return code in i8042_setup_aux()
	netfilter: nf_tables: avoid false-postive lockdep splat
	x86/insn-eval: Use new for_each_insn_prefix() macro to loop over prefixes bytes
	Revert "geneve: pull IP header before ECN decapsulation"
	Linux 4.19.163

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I65bc0b27c576e6d5c75f0bc085cb80e9a2f0a2d3
2020-12-11 14:59:08 +01:00
Peter Ujfalusi
08aca8e28f spi: bcm2835: Release the DMA channel if probe fails after dma_init
[ Upstream commit 666224b43b ]

The DMA channel was not released if either devm_request_irq() or
devm_spi_register_controller() failed.

Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
Reviewed-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
Link: https://lore.kernel.org/r/20191212135550.4634-3-peter.ujfalusi@ti.com
Signed-off-by: Mark Brown <broonie@kernel.org>
[lukas: backport to 4.19-stable]
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-11 13:25:03 +01:00
Lukas Wunner
c886774bf5 spi: bcm2835: Fix use-after-free on unbind
[ Upstream commit e1483ac030 ]

bcm2835_spi_remove() accesses the driver's private data after calling
spi_unregister_controller() even though that function releases the last
reference on the spi_controller and thereby frees the private data.

Fix by switching over to the new devm_spi_alloc_master() helper which
keeps the private data accessible until the driver has unbound.

Fixes: f8043872e7 ("spi: add driver for BCM2835")
Reported-by: Sascha Hauer <s.hauer@pengutronix.de>
Reported-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: <stable@vger.kernel.org> # v3.10+: 5e844cc37a5c: spi: Introduce device-managed SPI controller allocation
Cc: <stable@vger.kernel.org> # v3.10+
Cc: Vladimir Oltean <olteanv@gmail.com>
Tested-by: Florian Fainelli <f.fainelli@gmail.com>
Acked-by: Florian Fainelli <f.fainelli@gmail.com>
Link: https://lore.kernel.org/r/ad66e0a0ad96feb848814842ecf5b6a4539ef35c.1605121038.git.lukas@wunner.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-11 13:25:03 +01:00
Lukas Wunner
8dc5d5b831 spi: bcm-qspi: Fix use-after-free on unbind
commit 63c5395bb7 upstream

bcm_qspi_remove() calls spi_unregister_master() even though
bcm_qspi_probe() calls devm_spi_register_master().  The spi_master is
therefore unregistered and freed twice on unbind.

Moreover, since commit 0392727c26 ("spi: bcm-qspi: Handle clock probe
deferral"), bcm_qspi_probe() leaks the spi_master allocation if the call
to devm_clk_get_optional() fails.

Fix by switching over to the new devm_spi_alloc_master() helper which
keeps the private data accessible until the driver has unbound and also
avoids the spi_master leak on probe.

While at it, fix an ordering issue in bcm_qspi_remove() wherein
spi_unregister_master() is called after uninitializing the hardware,
disabling the clock and freeing an IRQ data structure.  The correct
order is to call spi_unregister_master() *before* those teardown steps
because bus accesses may still be ongoing until that function returns.

Fixes: fa236a7ef2 ("spi: bcm-qspi: Add Broadcom MSPI driver")
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: <stable@vger.kernel.org> # v4.9+: 123456789abc: spi: Introduce device-managed SPI controller allocation
Cc: <stable@vger.kernel.org> # v4.9+
Cc: Kamal Dasu <kdasu.kdev@gmail.com>
Acked-by: Florian Fainelli <f.fainelli@gmail.com>
Tested-by: Florian Fainelli <f.fainelli@gmail.com>
Link: https://lore.kernel.org/r/5e31a9a59fd1c0d0b795b2fe219f25e5ee855f9d.1605121038.git.lukas@wunner.de
Signed-off-by: Mark Brown <broonie@kernel.org>
[sudip: adjust context]
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-11 13:25:03 +01:00
Lukas Wunner
234b432c7b spi: Introduce device-managed SPI controller allocation
[ Upstream commit 5e844cc37a ]

SPI driver probing currently comprises two steps, whereas removal
comprises only one step:

    spi_alloc_master()
    spi_register_controller()

    spi_unregister_controller()

That's because spi_unregister_controller() calls device_unregister()
instead of device_del(), thereby releasing the reference on the
spi_controller which was obtained by spi_alloc_master().

An SPI driver's private data is contained in the same memory allocation
as the spi_controller struct.  Thus, once spi_unregister_controller()
has been called, the private data is inaccessible.  But some drivers
need to access it after spi_unregister_controller() to perform further
teardown steps.

Introduce devm_spi_alloc_master() and devm_spi_alloc_slave(), which
release a reference on the spi_controller struct only after the driver
has unbound, thereby keeping the memory allocation accessible.  Change
spi_unregister_controller() to not release a reference if the
spi_controller was allocated by one of these new devm functions.

The present commit is small enough to be backportable to stable.
It allows fixing drivers which use the private data in their ->remove()
hook after it's been freed.  It also allows fixing drivers which neglect
to release a reference on the spi_controller in the probe error path.

Long-term, most SPI drivers shall be moved over to the devm functions
introduced herein.  The few that can't shall be changed in a treewide
commit to explicitly release the last reference on the controller.
That commit shall amend spi_unregister_controller() to no longer release
a reference, thereby completing the migration.

As a result, the behaviour will be less surprising and more consistent
with subsystems such as IIO, which also includes the private data in the
allocation of the generic iio_dev struct, but calls device_del() in
iio_device_unregister().

Signed-off-by: Lukas Wunner <lukas@wunner.de>
Link: https://lore.kernel.org/r/272bae2ef08abd21388c98e23729886663d19192.1605121038.git.lukas@wunner.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-11 13:25:03 +01:00
Jon Lin
fb0f0e5330 spi: rockchip: Wait for STB status in slave mode tx_xfer
Change-Id: I39fe2b9e5a84304e7d0320842399a02a4b0743a0
Signed-off-by: Jon Lin <jon.lin@rock-chips.com>
2020-12-04 10:31:48 +08:00
Jon Lin
40bf5c914a spi: rockchip-test: Support 8 devices
Change-Id: I1599111c3a70e185a216b2f592aecffd28259e11
Signed-off-by: Jon Lin <jon.lin@rock-chips.com>
2020-12-03 17:58:45 +08:00
Jon Lin
3a6ad2d61b spi: rockchip: Set rx_fifo interrupt waterline base on transfer item
Change-Id: Ia141ce99b14f8728302535d0748af66d597a2fdc
Signed-off-by: Jon Lin <jon.lin@rock-chips.com>
2020-12-03 17:58:45 +08:00
Jon Lin
6a1a1cf4e7 spi: rockchip: Add compatible string for rk3568
Change-Id: I3ebee7ebd129ccd43c23fade643a9f6f30d4d930
Signed-off-by: Jon Lin <jon.lin@rock-chips.com>
2020-11-04 09:00:28 +08:00
Tao Huang
439d4e9999 Merge tag 'ASB-2020-11-05_4.19-stable' of https://android.googlesource.com/kernel/common
https://source.android.com/security/bulletin/2020-11-01
CVE-2020-0423

* tag 'ASB-2020-11-05_4.19-stable': (529 commits)
  ANDROID: GKI: Enable DEBUG_INFO_DWARF4
  UPSTREAM: mm/sl[uo]b: export __kmalloc_track(_node)_caller
  BACKPORT: xfrm/compat: Translate 32-bit user_policy from sockptr
  BACKPORT: xfrm/compat: Add 32=>64-bit messages translator
  UPSTREAM: xfrm/compat: Attach xfrm dumps to 64=>32 bit translator
  UPSTREAM: xfrm/compat: Add 64=>32-bit messages translator
  BACKPORT: xfrm: Provide API to register translator module
  ANDROID: Publish uncompressed Image on aarch64
  FROMLIST: crypto: arm64/poly1305-neon - reorder PAC authentication with SP update
  UPSTREAM: crypto: arm64/chacha - fix chacha_4block_xor_neon() for big endian
  UPSTREAM: crypto: arm64/chacha - fix hchacha_block_neon() for big endian
  Linux 4.19.154
  usb: gadget: f_ncm: allow using NCM in SuperSpeed Plus gadgets.
  eeprom: at25: set minimum read/write access stride to 1
  USB: cdc-wdm: Make wdm_flush() interruptible and add wdm_fsync().
  usb: cdc-acm: add quirk to blacklist ETAS ES58X devices
  tty: serial: fsl_lpuart: fix lpuart32_poll_get_char
  net: korina: cast KSEG0 address to pointer in kfree
  ath10k: check idx validity in __ath10k_htt_rx_ring_fill_n()
  scsi: ufs: ufs-qcom: Fix race conditions caused by ufs_qcom_testbus_config()
  ...

Change-Id: I797efa1149f557c1dfab7856813cc40d1a4d60b2

Conflicts:
	drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
	mm/page_alloc.c
2020-11-03 18:36:42 +08:00
Jon Lin
83d107c070 spi: rockchip: Support cs-gpio
Change-Id: I8f839189038afd77d534d767d938c845aa54fedb
Signed-off-by: Jon Lin <jon.lin@rock-chips.com>
2020-11-02 16:48:11 +08:00
Greg Kroah-Hartman
b9a942466b This is the 4.19.153 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl+ag5UACgkQONu9yGCS
 aT5O3w//RaOcwQdi47/UJz8zyja1ZG8MSSCGibpwvaDwrsXu9es1QtqLAC38H10o
 ygxNLBZQHxhScsRpicNc+Dy87+lcSj8cF1ed7sd1LU8rvmQ18uIeFUZxfzYth8jW
 i6erzas0Ojw8IMy566GDxkfAC6n5GhJuJTVFQWUQpoEbsb5rXcGCLx3u+S3Ew+5t
 Xb9qE6r5cImYymvMkMy7RQ4Db2qgOwjkaCj+Ol+4BSR0bF4OweMQLPJs9gN8pJpr
 o2nxHg7wdO8SKJZCBVw8ZmfO4zF6czcKy+KzFajn+4LA2oT5mgiV8y21cd9CWYeQ
 JQK1jZGwwl/xljrM1yLd+crG8i11DhCStY90+4bxD68r8H+g1kwZ8jELmCwuuyx6
 dk1s7jOxyKl9qAnMt6r2HqrjgxGD+2hL+2S84jPGRBow5IYjrdD0REXZjyk1R7Rp
 8k00lRk1ATEy7H2lj4JW34tcsTEEDcn8PqUFx7MRKtCUI2uo4Gr5HXqf6wTJDp6S
 BsDe8mm77jd81vtw/AZ8Fv7Fg42QIPt7G1QV9wBbFvDmKmDa7Gj6SuQqTeu75oU9
 M++aWSwyOb08wZEE0y94wsm6r4raN3A8o70Df9FltNFTALowuIcR+CVtOnQfHEuL
 BUBJcWg3SDsIxkXYgvQ9jO5h38i6dhAIVGAcU4VB0rgP/ePKMQs=
 =GiLo
 -----END PGP SIGNATURE-----

Merge 4.19.153 into android-4.19-stable

Changes in 4.19.153
	ibmveth: Switch order of ibmveth_helper calls.
	ibmveth: Identify ingress large send packets.
	ipv4: Restore flowi4_oif update before call to xfrm_lookup_route
	mlx4: handle non-napi callers to napi_poll
	net: fec: Fix phy_device lookup for phy_reset_after_clk_enable()
	net: fec: Fix PHY init after phy_reset_after_clk_enable()
	net: fix pos incrementment in ipv6_route_seq_next
	net/smc: fix valid DMBE buffer sizes
	net: usb: qmi_wwan: add Cellient MPL200 card
	tipc: fix the skb_unshare() in tipc_buf_append()
	net/ipv4: always honour route mtu during forwarding
	r8169: fix data corruption issue on RTL8402
	net/tls: sendfile fails with ktls offload
	binder: fix UAF when releasing todo list
	ALSA: bebob: potential info leak in hwdep_read()
	chelsio/chtls: fix socket lock
	chelsio/chtls: correct netdevice for vlan interface
	chelsio/chtls: correct function return and return type
	net: hdlc: In hdlc_rcv, check to make sure dev is an HDLC device
	net: hdlc_raw_eth: Clear the IFF_TX_SKB_SHARING flag after calling ether_setup
	net/sched: act_tunnel_key: fix OOB write in case of IPv6 ERSPAN tunnels
	nfc: Ensure presence of NFC_ATTR_FIRMWARE_NAME attribute in nfc_genl_fw_download()
	tcp: fix to update snd_wl1 in bulk receiver fast path
	r8169: fix operation under forced interrupt threading
	icmp: randomize the global rate limiter
	ALSA: hda/realtek: Enable audio jacks of ASUS D700SA with ALC887
	cifs: remove bogus debug code
	cifs: Return the error from crypt_message when enc/dec key not found.
	KVM: x86/mmu: Commit zap of remaining invalid pages when recovering lpages
	KVM: SVM: Initialize prev_ga_tag before use
	ima: Don't ignore errors from crypto_shash_update()
	crypto: algif_aead - Do not set MAY_BACKLOG on the async path
	EDAC/i5100: Fix error handling order in i5100_init_one()
	EDAC/ti: Fix handling of platform_get_irq() error
	x86/fpu: Allow multiple bits in clearcpuid= parameter
	drivers/perf: xgene_pmu: Fix uninitialized resource struct
	x86/nmi: Fix nmi_handle() duration miscalculation
	x86/events/amd/iommu: Fix sizeof mismatch
	crypto: algif_skcipher - EBUSY on aio should be an error
	crypto: mediatek - Fix wrong return value in mtk_desc_ring_alloc()
	crypto: ixp4xx - Fix the size used in a 'dma_free_coherent()' call
	crypto: picoxcell - Fix potential race condition bug
	media: tuner-simple: fix regression in simple_set_radio_freq
	media: Revert "media: exynos4-is: Add missed check for pinctrl_lookup_state()"
	media: m5mols: Check function pointer in m5mols_sensor_power
	media: uvcvideo: Set media controller entity functions
	media: uvcvideo: Silence shift-out-of-bounds warning
	media: omap3isp: Fix memleak in isp_probe
	crypto: omap-sham - fix digcnt register handling with export/import
	hwmon: (pmbus/max34440) Fix status register reads for MAX344{51,60,61}
	cypto: mediatek - fix leaks in mtk_desc_ring_alloc
	media: mx2_emmaprp: Fix memleak in emmaprp_probe
	media: tc358743: initialize variable
	media: tc358743: cleanup tc358743_cec_isr
	media: rcar-vin: Fix a reference count leak.
	media: rockchip/rga: Fix a reference count leak.
	media: platform: fcp: Fix a reference count leak.
	media: camss: Fix a reference count leak.
	media: s5p-mfc: Fix a reference count leak
	media: stm32-dcmi: Fix a reference count leak
	media: ti-vpe: Fix a missing check and reference count leak
	regulator: resolve supply after creating regulator
	pinctrl: bcm: fix kconfig dependency warning when !GPIOLIB
	spi: spi-s3c64xx: swap s3c64xx_spi_set_cs() and s3c64xx_enable_datapath()
	spi: spi-s3c64xx: Check return values
	ath10k: provide survey info as accumulated data
	Bluetooth: hci_uart: Cancel init work before unregistering
	ath6kl: prevent potential array overflow in ath6kl_add_new_sta()
	ath9k: Fix potential out of bounds in ath9k_htc_txcompletion_cb()
	ath10k: Fix the size used in a 'dma_free_coherent()' call in an error handling path
	wcn36xx: Fix reported 802.11n rx_highest rate wcn3660/wcn3680
	ASoC: qcom: lpass-platform: fix memory leak
	ASoC: qcom: lpass-cpu: fix concurrency issue
	brcmfmac: check ndev pointer
	mwifiex: Do not use GFP_KERNEL in atomic context
	staging: rtl8192u: Do not use GFP_KERNEL in atomic context
	drm/gma500: fix error check
	scsi: qla4xxx: Fix an error handling path in 'qla4xxx_get_host_stats()'
	scsi: qla2xxx: Fix wrong return value in qla_nvme_register_hba()
	scsi: csiostor: Fix wrong return value in csio_hw_prep_fw()
	backlight: sky81452-backlight: Fix refcount imbalance on error
	VMCI: check return value of get_user_pages_fast() for errors
	tty: serial: earlycon dependency
	tty: hvcs: Don't NULL tty->driver_data until hvcs_cleanup()
	pty: do tty_flip_buffer_push without port->lock in pty_write
	pwm: lpss: Fix off by one error in base_unit math in pwm_lpss_prepare()
	pwm: lpss: Add range limit check for the base_unit register value
	drivers/virt/fsl_hypervisor: Fix error handling path
	video: fbdev: vga16fb: fix setting of pixclock because a pass-by-value error
	video: fbdev: sis: fix null ptr dereference
	video: fbdev: radeon: Fix memleak in radeonfb_pci_register
	HID: roccat: add bounds checking in kone_sysfs_write_settings()
	pinctrl: mcp23s08: Fix mcp23x17_regmap initialiser
	pinctrl: mcp23s08: Fix mcp23x17 precious range
	net/mlx5: Don't call timecounter cyc2time directly from 1PPS flow
	net: stmmac: use netif_tx_start|stop_all_queues() function
	cpufreq: armada-37xx: Add missing MODULE_DEVICE_TABLE
	net: dsa: rtl8366: Check validity of passed VLANs
	net: dsa: rtl8366: Refactor VLAN/PVID init
	net: dsa: rtl8366: Skip PVID setting if not requested
	net: dsa: rtl8366rb: Support all 4096 VLANs
	ath6kl: wmi: prevent a shift wrapping bug in ath6kl_wmi_delete_pstream_cmd()
	misc: mic: scif: Fix error handling path
	ALSA: seq: oss: Avoid mutex lock for a long-time ioctl
	usb: dwc2: Fix parameter type in function pointer prototype
	quota: clear padding in v2r1_mem2diskdqb()
	slimbus: core: check get_addr before removing laddr ida
	slimbus: core: do not enter to clock pause mode in core
	slimbus: qcom-ngd-ctrl: disable ngd in qmi server down callback
	HID: hid-input: fix stylus battery reporting
	qtnfmac: fix resource leaks on unsupported iftype error return path
	net: enic: Cure the enic api locking trainwreck
	mfd: sm501: Fix leaks in probe()
	iwlwifi: mvm: split a print to avoid a WARNING in ROC
	usb: gadget: f_ncm: fix ncm_bitrate for SuperSpeed and above.
	usb: gadget: u_ether: enable qmult on SuperSpeed Plus as well
	nl80211: fix non-split wiphy information
	usb: dwc2: Fix INTR OUT transfers in DDMA mode.
	scsi: target: tcmu: Fix warning: 'page' may be used uninitialized
	scsi: be2iscsi: Fix a theoretical leak in beiscsi_create_eqs()
	platform/x86: mlx-platform: Remove PSU EEPROM configuration
	mwifiex: fix double free
	ipvs: clear skb->tstamp in forwarding path
	net: korina: fix kfree of rx/tx descriptor array
	netfilter: nf_log: missing vlan offload tag and proto
	mm/memcg: fix device private memcg accounting
	mm, oom_adj: don't loop through tasks in __set_oom_adj when not necessary
	IB/mlx4: Fix starvation in paravirt mux/demux
	IB/mlx4: Adjust delayed work when a dup is observed
	powerpc/pseries: Fix missing of_node_put() in rng_init()
	powerpc/icp-hv: Fix missing of_node_put() in success path
	RDMA/ucma: Fix locking for ctx->events_reported
	RDMA/ucma: Add missing locking around rdma_leave_multicast()
	mtd: lpddr: fix excessive stack usage with clang
	powerpc/pseries: explicitly reschedule during drmem_lmb list traversal
	mtd: mtdoops: Don't write panic data twice
	ARM: 9007/1: l2c: fix prefetch bits init in L2X0_AUX_CTRL using DT values
	arc: plat-hsdk: fix kconfig dependency warning when !RESET_CONTROLLER
	xfs: limit entries returned when counting fsmap records
	xfs: fix high key handling in the rt allocator's query_range function
	RDMA/qedr: Fix use of uninitialized field
	RDMA/qedr: Fix inline size returned for iWARP
	powerpc/tau: Use appropriate temperature sample interval
	powerpc/tau: Convert from timer to workqueue
	powerpc/tau: Remove duplicated set_thresholds() call
	Linux 4.19.153

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I9e85e8ca67ab8e28d04a77339f80fdbf3c568956
2020-10-29 11:36:20 +01:00
Łukasz Stelmach
71c611d6b2 spi: spi-s3c64xx: Check return values
[ Upstream commit 2f4db6f705 ]

Check return values in prepare_dma() and s3c64xx_spi_config() and
propagate errors upwards.

Fixes: 788437273f ("spi: s3c64xx: move to generic dmaengine API")
Reviewed-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Łukasz Stelmach <l.stelmach@samsung.com>
Link: https://lore.kernel.org/r/20201002122243.26849-4-l.stelmach@samsung.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-10-29 09:55:05 +01:00
Łukasz Stelmach
96eb5e0dd2 spi: spi-s3c64xx: swap s3c64xx_spi_set_cs() and s3c64xx_enable_datapath()
[ Upstream commit 581e2b4197 ]

Fix issues with DMA transfers bigger than 512 bytes on Exynos3250. Without
the patches such transfers fail to complete. This solution to the problem
is found in the vendor kernel for ARTIK5 boards based on Exynos3250.

Reviewed-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Łukasz Stelmach <l.stelmach@samsung.com>
Link: https://lore.kernel.org/r/20201002122243.26849-2-l.stelmach@samsung.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-10-29 09:55:05 +01:00
Tao Huang
0c17cc5fc3 Merge tag 'ASB-2020-10-05_4.19-stable' of https://android.googlesource.com/kernel/common
https://source.android.com/security/bulletin/2020-10-01
Fix for CVE-2020-0423 not yet public.

* tag 'ASB-2020-10-05_4.19-stable': (518 commits)
  ANDROID: use arm-linux-androidkernel- for CROSS_COMPILE_COMPAT
  ANDROID: build.config.common: enable LLVM=1
  Linux 4.19.149
  KVM: arm64: Assume write fault on S1PTW permission fault on instruction fetch
  ata: sata_mv, avoid trigerrable BUG_ON
  ata: make qc_prep return ata_completion_errors
  ata: define AC_ERR_OK
  kprobes: Fix compiler warning for !CONFIG_KPROBES_ON_FTRACE
  s390/zcrypt: Fix ZCRYPT_PERDEV_REQCNT ioctl
  mm, THP, swap: fix allocating cluster for swapfile by mistake
  kprobes: Fix to check probe enabled before disarm_kprobe_ftrace()
  s390/dasd: Fix zero write for FBA devices
  tracing: fix double free
  KVM: SVM: Add a dedicated INVD intercept routine
  KVM: x86: Reset MMU context if guest toggles CR4.SMAP or CR4.PKE
  MIPS: Add the missing 'CPU_1074K' into __get_cpu_type()
  regmap: fix page selection for noinc reads
  ALSA: asihpi: fix iounmap in error handler
  bpf: Fix a rcu warning for bpffs map pretty-print
  batman-adv: mcast: fix duplicate mcast packets from BLA backbone to mesh
  ...

Change-Id: I5af52b9921cfd8b55aba5b7705a8bc1a4f88db74

Conflicts:
	drivers/tty/serial/8250/8250_port.c
	drivers/usb/core/message.c
	drivers/usb/core/quirks.c
2020-10-10 18:38:14 +08:00
Greg Kroah-Hartman
2dce03a5c2 This is the 4.19.150 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl99WYoACgkQONu9yGCS
 aT75hA/+Lu0udzlCD/Uw1SDFKPo3Xed6hFiFUOHHtQxVel9r3DNOX1+kfNAH5ifo
 G2NW6O25Bl4qxmG02QRW85r7JRHhoMQOx1DldLGlJCfcgmVcwEaiRg6HgMh+9OiC
 qPAuE6zbB5h97dPQppe5u7e6pzjrsTgR6pYlnuwPVF6TSmTYXM3OGubXItOyneRZ
 ePnzH9w4bk/n4UAARYOowfFhRnO/Qml+QPxc8rFbK2inGXCJ31QLITJCa3Y3KXP3
 AC2aM2M8B04GJBFhXH8pLFrzvB/+S1DwzmtT3d6TWdQRqdSr+GAPJ/3jX2eKMuwK
 6vfF/caGvfYpomEFCHFKyLxmFwhbSEfVD0ht4jr3aiF/E0ii8sXKN8mnnowpNFpG
 23kG+baxxe1ZbjXw4VjtGGXruJQ6im5o7siRnmfKYv18Fo5O3yEga9pCjOdkHT20
 gjes0GfTtgr3nrlW19B03ZYL7p3ri46NlY7Zlawvtz3dlWY9rTkII3nxD5k5Ywxs
 KgDVpREwr7LuKOgGTxkwLGHNEF7b1mJrjdrlX/X2SDJD/IQc3xdD5382lXSQRaem
 QaZhu6S6SNCjI9fGQ7jOYMR3ouGegFsPOnr6BQxvKmoolsUzXTeTxR0u2R5dqYGI
 1RwmuTIQTvURoFy1XyhNyLJAbCvk+9BeNp8I5/YTNbvkFKlnawM=
 =qKZh
 -----END PGP SIGNATURE-----

Merge 4.19.150 into android-4.19-stable

Changes in 4.19.150
	mmc: sdhci: Workaround broken command queuing on Intel GLK based IRBIS models
	USB: gadget: f_ncm: Fix NDP16 datagram validation
	gpio: mockup: fix resource leak in error path
	gpio: tc35894: fix up tc35894 interrupt configuration
	clk: socfpga: stratix10: fix the divider for the emac_ptp_free_clk
	vsock/virtio: use RCU to avoid use-after-free on the_virtio_vsock
	vsock/virtio: stop workers during the .remove()
	vsock/virtio: add transport parameter to the virtio_transport_reset_no_sock()
	net: virtio_vsock: Enhance connection semantics
	Input: i8042 - add nopnp quirk for Acer Aspire 5 A515
	ftrace: Move RCU is watching check after recursion check
	drm/amdgpu: restore proper ref count in amdgpu_display_crtc_set_config
	drivers/net/wan/hdlc_fr: Add needed_headroom for PVC devices
	drm/sun4i: mixer: Extend regmap max_register
	net: dec: de2104x: Increase receive ring size for Tulip
	rndis_host: increase sleep time in the query-response loop
	nvme-core: get/put ctrl and transport module in nvme_dev_open/release()
	drivers/net/wan/lapbether: Make skb->protocol consistent with the header
	drivers/net/wan/hdlc: Set skb->protocol before transmitting
	mac80211: do not allow bigger VHT MPDUs than the hardware supports
	spi: fsl-espi: Only process interrupts for expected events
	nvme-fc: fail new connections to a deleted host or remote port
	gpio: sprd: Clear interrupt when setting the type as edge
	pinctrl: mvebu: Fix i2c sda definition for 98DX3236
	nfs: Fix security label length not being reset
	clk: samsung: exynos4: mark 'chipid' clock as CLK_IGNORE_UNUSED
	iommu/exynos: add missing put_device() call in exynos_iommu_of_xlate()
	i2c: cpm: Fix i2c_ram structure
	Input: trackpoint - enable Synaptics trackpoints
	random32: Restore __latent_entropy attribute on net_rand_state
	mm: replace memmap_context by meminit_context
	mm: don't rely on system state to detect hot-plug operations
	net/packet: fix overflow in tpacket_rcv
	epoll: do not insert into poll queues until all sanity checks are done
	epoll: replace ->visited/visited_list with generation count
	epoll: EPOLL_CTL_ADD: close the race in decision to take fast path
	ep_create_wakeup_source(): dentry name can change under you...
	netfilter: ctnetlink: add a range check for l3/l4 protonum
	Linux 4.19.150

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ib6f1b6fce01bec80efd4a905d03903ff20ca89be
2020-10-07 08:45:35 +02:00
Chris Packham
8f72de67c7 spi: fsl-espi: Only process interrupts for expected events
[ Upstream commit b867eef4cf ]

The SPIE register contains counts for the TX FIFO so any time the irq
handler was invoked we would attempt to process the RX/TX fifos. Use the
SPIM value to mask the events so that we only process interrupts that
were expected.

This was a latent issue exposed by commit 3282a3da25 ("powerpc/64:
Implement soft interrupt replay in C").

Signed-off-by: Chris Packham <chris.packham@alliedtelesis.co.nz>
Link: https://lore.kernel.org/r/20200904002812.7300-1-chris.packham@alliedtelesis.co.nz
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-10-07 08:00:07 +02:00
Greg Kroah-Hartman
0b8c61c48e This is the 4.19.147 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl9rH4IACgkQONu9yGCS
 aT4wsw/9E4DOfXrQvUvScgV6weqomHrJ4oEEh/hckog4lHcym6//DxRhXXgd1OVL
 CoNdIciv5ixqMjENMjGxM9Ob/GiTihhl7Zivu+DsLmCHAovcUsUxBGjg4Oh6nJHt
 BCh4Dy2umFi6dzohkWRCdLyJie6hlXoGtpycRZ+3KlOV3x6/A4lLeiqTBh1bwJxq
 30VBFimykIcjSzGSpu/HuMFXuDlT9TCaY20JSnKTW1Z2hapTG3Q6wERNMfRyaUhH
 JwDXWVPN+1zLecNQGODSsJrapaQCqWgVKaQjJoB6Pn3TMTMQox0bRCXErjq8YZJr
 NPF54m0flHj1hIQhsKRM5Zp/3Dd2kGXNzOq8HN2sRb0jz2L9WsnVTvWYPyPV9TEt
 yaytDy7XwSASVp1IFzGe4uFVevezw7OF0bbNJm2dMB0+O6pTaHyZ2KAlVa9CWiSy
 h/kGdu1JiV4jgaRDz4WdEVUvojSrQonC3CsmMZKOt2klAgPCKE6LOws5ZyCr1haK
 TgsajqNwNZcfqMGnCxOwA5nZEzxSxGdAnFZ+1slzDQzDOqwGYTQZr3sa4pY+7V7r
 eIGYIC1VL3Vjnq3KavDdBbUiQvskEYUMnjq7NUCMZVW2IJ0ULm05MO4nHXzKfT7o
 dw/H5EUUJ5ta+8f2XTS0p2ZRy+F0bkW0evmh15Cvt5dQLkxF35A=
 =gyKc
 -----END PGP SIGNATURE-----

Merge 4.19.147 into android-4.19-stable

Changes in 4.19.147
	dsa: Allow forwarding of redirected IGMP traffic
	scsi: qla2xxx: Update rscn_rcvd field to more meaningful scan_needed
	scsi: qla2xxx: Move rport registration out of internal work_list
	scsi: qla2xxx: Reduce holding sess_lock to prevent CPU lock-up
	gfs2: initialize transaction tr_ailX_lists earlier
	RDMA/bnxt_re: Restrict the max_gids to 256
	net: handle the return value of pskb_carve_frag_list() correctly
	hv_netvsc: Remove "unlikely" from netvsc_select_queue
	NFSv4.1 handle ERR_DELAY error reclaiming locking state on delegation recall
	scsi: pm8001: Fix memleak in pm8001_exec_internal_task_abort
	scsi: libfc: Fix for double free()
	scsi: lpfc: Fix FLOGI/PLOGI receive race condition in pt2pt discovery
	regulator: pwm: Fix machine constraints application
	spi: spi-loopback-test: Fix out-of-bounds read
	NFS: Zero-stateid SETATTR should first return delegation
	SUNRPC: stop printk reading past end of string
	rapidio: Replace 'select' DMAENGINES 'with depends on'
	openrisc: Fix cache API compile issue when not inlining
	nvme-fc: cancel async events before freeing event struct
	nvme-rdma: cancel async events before freeing event struct
	f2fs: fix indefinite loop scanning for free nid
	f2fs: Return EOF on unaligned end of file DIO read
	i2c: algo: pca: Reapply i2c bus settings after reset
	spi: Fix memory leak on splited transfers
	KVM: MIPS: Change the definition of kvm type
	clk: davinci: Use the correct size when allocating memory
	clk: rockchip: Fix initialization of mux_pll_src_4plls_p
	ASoC: qcom: Set card->owner to avoid warnings
	Drivers: hv: vmbus: Add timeout to vmbus_wait_for_unload
	perf test: Fix the "signal" test inline assembly
	MIPS: SNI: Fix MIPS_L1_CACHE_SHIFT
	perf test: Free formats for perf pmu parse test
	fbcon: Fix user font detection test at fbcon_resize().
	MIPS: SNI: Fix spurious interrupts
	drm/mediatek: Add exception handing in mtk_drm_probe() if component init fail
	drm/mediatek: Add missing put_device() call in mtk_hdmi_dt_parse_pdata()
	USB: quirks: Add USB_QUIRK_IGNORE_REMOTE_WAKEUP quirk for BYD zhaoxin notebook
	USB: UAS: fix disconnect by unplugging a hub
	usblp: fix race between disconnect() and read()
	i2c: i801: Fix resume bug
	Revert "ALSA: hda - Fix silent audio output and corrupted input on MSI X570-A PRO"
	percpu: fix first chunk size calculation for populated bitmap
	Input: trackpoint - add new trackpoint variant IDs
	Input: i8042 - add Entroware Proteus EL07R4 to nomux and reset lists
	serial: 8250_pci: Add Realtek 816a and 816b
	x86/boot/compressed: Disable relocation relaxation
	ehci-hcd: Move include to keep CRC stable
	powerpc/dma: Fix dma_map_ops::get_required_mask
	x86/defconfig: Enable CONFIG_USB_XHCI_HCD=y
	Linux 4.19.147

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I1c512021698db2701c51491a813bec79bda6bbf5
2020-09-24 12:48:04 +02:00
Tao Huang
48f4e7f7c2 Merge tag 'ASB-2020-09-05_4.19-stable' of https://android.googlesource.com/kernel/common
https://source.android.com/security/bulletin/2020-09-01
CVE-2020-0402
CVE-2020-0404
CVE-2020-0407

* tag 'ASB-2020-09-05_4.19-stable': (3616 commits)
  Linux 4.19.143
  ALSA: usb-audio: Update documentation comment for MS2109 quirk
  HID: hiddev: Fix slab-out-of-bounds write in hiddev_ioctl_usage()
  tpm: Unify the mismatching TPM space buffer sizes
  usb: dwc3: gadget: Handle ZLP for sg requests
  usb: dwc3: gadget: Fix handling ZLP
  usb: dwc3: gadget: Don't setup more than requested
  btrfs: check the right error variable in btrfs_del_dir_entries_in_log
  usb: storage: Add unusual_uas entry for Sony PSZ drives
  USB: cdc-acm: rework notification_buffer resizing
  USB: gadget: u_f: Unbreak offset calculation in VLAs
  USB: gadget: f_ncm: add bounds checks to ncm_unwrap_ntb()
  USB: gadget: u_f: add overflow checks to VLA macros
  usb: host: ohci-exynos: Fix error handling in exynos_ohci_probe()
  USB: Ignore UAS for JMicron JMS567 ATA/ATAPI Bridge
  USB: quirks: Ignore duplicate endpoint on Sound Devices MixPre-D
  USB: quirks: Add no-lpm quirk for another Raydium touchscreen
  usb: uas: Add quirk for PNY Pro Elite
  USB: yurex: Fix bad gfp argument
  drm/amd/pm: correct Vega12 swctf limit setting
  ...

Change-Id: Iece02c55e9b3446bdda5dc7bdfbe3e310b2dbc83

Conflicts:
	arch/arm/boot/dts/rk322x.dtsi
	arch/arm64/boot/dts/rockchip/rk3399.dtsi
	arch/arm64/kernel/cpuinfo.c
	drivers/clk/clk.c
	drivers/clk/rockchip/clk-cpu.c
	drivers/clk/rockchip/clk-rk3228.c
	drivers/devfreq/governor_simpleondemand.c
	drivers/gpu/drm/bridge/synopsys/dw-hdmi.c
	drivers/gpu/drm/drm_edid.c
	drivers/hid/usbhid/hid-core.c
	drivers/media/i2c/ov5695.c
	drivers/media/v4l2-core/v4l2-ioctl.c
	drivers/regulator/core.c
	drivers/thermal/cpu_cooling.c
	drivers/usb/core/quirks.c
	drivers/usb/dwc2/platform.c
	drivers/usb/dwc3/core.c
	drivers/usb/dwc3/core.h
	drivers/usb/dwc3/gadget.c
	drivers/usb/host/ehci-platform.c
	drivers/usb/storage/unusual_uas.h
	include/drm/drm_connector.h
	include/linux/clk-provider.h
	include/linux/devfreq.h
	include/linux/pci_ids.h
	kernel/power/wakeup_reason.c
	mm/memory.c
	mm/swapfile.c
2020-09-24 17:59:50 +08:00
Gustav Wiklander
80c468d9ab spi: Fix memory leak on splited transfers
[ Upstream commit b59a7ca154 ]

In the prepare_message callback the bus driver has the
opportunity to split a transfer into smaller chunks.
spi_map_msg is done after prepare_message.

Function spi_res_release releases the splited transfers
in the message. Therefore spi_res_release should be called
after spi_map_msg.

The previous try at this was commit c9ba7a16d0
which released the splited transfers after
spi_finalize_current_message had been called.
This introduced a race since the message struct could be
out of scope because the spi_sync call got completed.

Fixes this leak on spi bus driver spi-bcm2835.c when transfer
size is greater than 65532:

Kmemleak:
sg_alloc_table+0x28/0xc8
spi_map_buf+0xa4/0x300
__spi_pump_messages+0x370/0x748
__spi_sync+0x1d4/0x270
spi_sync+0x34/0x58
spi_test_execute_msg+0x60/0x340 [spi_loopback_test]
spi_test_run_iter+0x548/0x578 [spi_loopback_test]
spi_test_run_test+0x94/0x140 [spi_loopback_test]
spi_test_run_tests+0x150/0x180 [spi_loopback_test]
spi_loopback_test_probe+0x50/0xd0 [spi_loopback_test]
spi_drv_probe+0x84/0xe0

Signed-off-by: Gustav Wiklander <gustavwi@axis.com>
Link: https://lore.kernel.org/r/20200908151129.15915-1-gustav.wiklander@axis.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-09-23 12:10:59 +02:00
Vincent Whitchurch
09ca2d2681 spi: spi-loopback-test: Fix out-of-bounds read
[ Upstream commit 837ba18dfc ]

The "tx/rx-transfer - crossing PAGE_SIZE" test always fails when
len=131071 and rx_offset >= 5:

 spi-loopback-test spi0.0: Running test tx/rx-transfer - crossing PAGE_SIZE
 ...
   with iteration values: len = 131071, tx_off = 0, rx_off = 3
   with iteration values: len = 131071, tx_off = 0, rx_off = 4
   with iteration values: len = 131071, tx_off = 0, rx_off = 5
 loopback strangeness - rx changed outside of allowed range at: ...a4321000
   spi_msg@ffffffd5a4157690
     frame_length:  131071
     actual_length: 131071
     spi_transfer@ffffffd5a41576f8
       len:    131071
       tx_buf: ffffffd5a4340ffc

Note that rx_offset > 3 can only occur if the SPI controller driver sets
->dma_alignment to a higher value than 4, so most SPI controller drivers
are not affect.

The allocated Rx buffer is of size SPI_TEST_MAX_SIZE_PLUS, which is 132
KiB (assuming 4 KiB pages).  This test uses an initial offset into the
rx_buf of PAGE_SIZE - 4, and a len of 131071, so the range expected to
be written in this transfer ends at (4096 - 4) + 5 + 131071 == 132 KiB,
which is also the end of the allocated buffer.  But the code which
verifies the content of the buffer reads a byte beyond the allocated
buffer and spuriously fails because this out-of-bounds read doesn't
return the expected value.

Fix this by using ITERATE_LEN instead of ITERATE_MAX_LEN to avoid
testing sizes which cause out-of-bounds reads.

Signed-off-by: Vincent Whitchurch <vincent.whitchurch@axis.com>
Link: https://lore.kernel.org/r/20200902132341.7079-1-vincent.whitchurch@axis.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-09-23 12:10:58 +02:00
Greg Kroah-Hartman
a13ec5ea86 This is the 4.19.143 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl9QtnYACgkQONu9yGCS
 aT6d3hAA0SGXTk13kxCTzOTOh7hhZJSI6a+JL64Cj/o8IkaoaCFMjLevcuYMAWh1
 LARaLjPy7MNm1fAy6LPaQcLwRax2Ocwyl27x3U3IrM4/Fos/r0wkn4Ek6IJVBD0H
 FqF4VHRoLt0IUhOTdsdGqv4YHRhE/l8dFHXVencTVE8dAB5QUUpI8XwKruk8HlOD
 L2h1gF6x8yV18lt3I6kIA3+n9ImMSNO65OxwXUTgu0cZoyk35byj1bbgu8mkZPkk
 s7Y5oBS5CorhBYFP+D6Av5e9LOP4jzvwPqCeLLCIa5idM277afyt6dKnwBcdK4w/
 Y10AIlGeji0xaAD4Xv2SnjiY6lFtA5DF8gg8zLsjdjgPyELrZOdNOxJPhckL8Fbj
 u9oeWerJPBgI1bEtaWUihRSo31dedp8VAi87aRdwMkNIdBrXLo9tdv+waWTm8YPi
 0kbG+p/Cp7Z8SqG6dEJsLxnes2Spd5RohRsYET/L3adl5B/IdYVxuHF0Lc2U/5AM
 +7FvisuqjeDS0o8ZpAP8F0wpvqDIhD+5Iy2NkT3/HcgzyYYd9q4+L5szoARN4Dzn
 pIm/Y9UyvXxgYNUSvVl5H1hn4JJR0WuxgiBYoUrZGc5w5Ey5f8M9hOM90lfu6MWO
 YWbLVEIui+jW9pkV4SmO71zkR+OI6u1I2YSTYGyTvXnyD+YL44w=
 =416Q
 -----END PGP SIGNATURE-----

Merge 4.19.143 into android-4.19-stable

Changes in 4.19.143
	powerpc/64s: Don't init FSCR_DSCR in __init_FSCR()
	gre6: Fix reception with IP6_TNL_F_RCV_DSCP_COPY
	net: Fix potential wrong skb->protocol in skb_vlan_untag()
	net: qrtr: fix usage of idr in port assignment to socket
	net/smc: Prevent kernel-infoleak in __smc_diag_dump()
	tipc: fix uninit skb->data in tipc_nl_compat_dumpit()
	net: ena: Make missed_tx stat incremental
	ipvlan: fix device features
	ALSA: pci: delete repeated words in comments
	ASoC: img: Fix a reference count leak in img_i2s_in_set_fmt
	ASoC: img-parallel-out: Fix a reference count leak
	ASoC: tegra: Fix reference count leaks.
	mfd: intel-lpss: Add Intel Emmitsburg PCH PCI IDs
	arm64: dts: qcom: msm8916: Pull down PDM GPIOs during sleep
	powerpc/xive: Ignore kmemleak false positives
	media: pci: ttpci: av7110: fix possible buffer overflow caused by bad DMA value in debiirq()
	blktrace: ensure our debugfs dir exists
	scsi: target: tcmu: Fix crash on ARM during cmd completion
	iommu/iova: Don't BUG on invalid PFNs
	drm/amdkfd: Fix reference count leaks.
	drm/radeon: fix multiple reference count leak
	drm/amdgpu: fix ref count leak in amdgpu_driver_open_kms
	drm/amd/display: fix ref count leak in amdgpu_drm_ioctl
	drm/amdgpu: fix ref count leak in amdgpu_display_crtc_set_config
	drm/amdgpu/display: fix ref count leak when pm_runtime_get_sync fails
	scsi: lpfc: Fix shost refcount mismatch when deleting vport
	xfs: Don't allow logging of XFS_ISTALE inodes
	selftests/powerpc: Purge extra count_pmc() calls of ebb selftests
	f2fs: fix error path in do_recover_data()
	omapfb: fix multiple reference count leaks due to pm_runtime_get_sync
	PCI: Fix pci_create_slot() reference count leak
	ARM: dts: ls1021a: output PPS signal on FIPER2
	rtlwifi: rtl8192cu: Prevent leaking urb
	mips/vdso: Fix resource leaks in genvdso.c
	cec-api: prevent leaking memory through hole in structure
	HID: quirks: add NOGET quirk for Logitech GROUP
	f2fs: fix use-after-free issue
	drm/nouveau/drm/noveau: fix reference count leak in nouveau_fbcon_open
	drm/nouveau: fix reference count leak in nv50_disp_atomic_commit
	drm/nouveau: Fix reference count leak in nouveau_connector_detect
	locking/lockdep: Fix overflow in presentation of average lock-time
	btrfs: file: reserve qgroup space after the hole punch range is locked
	scsi: iscsi: Do not put host in iscsi_set_flashnode_param()
	ceph: fix potential mdsc use-after-free crash
	scsi: fcoe: Memory leak fix in fcoe_sysfs_fcf_del()
	EDAC/ie31200: Fallback if host bridge device is already initialized
	KVM: arm64: Fix symbol dependency in __hyp_call_panic_nvhe
	powerpc/spufs: add CONFIG_COREDUMP dependency
	USB: sisusbvga: Fix a potential UB casued by left shifting a negative value
	efi: provide empty efi_enter_virtual_mode implementation
	Revert "ath10k: fix DMA related firmware crashes on multiple devices"
	media: gpio-ir-tx: improve precision of transmitted signal due to scheduling
	drm/msm/adreno: fix updating ring fence
	nvme-fc: Fix wrong return value in __nvme_fc_init_request()
	null_blk: fix passing of REQ_FUA flag in null_handle_rq
	i2c: rcar: in slave mode, clear NACK earlier
	usb: gadget: f_tcm: Fix some resource leaks in some error paths
	jbd2: make sure jh have b_transaction set in refile/unfile_buffer
	ext4: don't BUG on inconsistent journal feature
	ext4: handle read only external journal device
	jbd2: abort journal if free a async write error metadata buffer
	ext4: handle option set by mount flags correctly
	ext4: handle error of ext4_setup_system_zone() on remount
	ext4: correctly restore system zone info when remount fails
	fs: prevent BUG_ON in submit_bh_wbc()
	spi: stm32: fix stm32_spi_prepare_mbr in case of odd clk_rate
	s390/cio: add cond_resched() in the slow_eval_known_fn() loop
	ASoC: wm8994: Avoid attempts to read unreadable registers
	scsi: fcoe: Fix I/O path allocation
	scsi: ufs: Fix possible infinite loop in ufshcd_hold
	scsi: ufs: Improve interrupt handling for shared interrupts
	scsi: ufs: Clean up completed request without interrupt notification
	scsi: qla2xxx: Check if FW supports MQ before enabling
	scsi: qla2xxx: Fix null pointer access during disconnect from subsystem
	Revert "scsi: qla2xxx: Fix crash on qla2x00_mailbox_command"
	macvlan: validate setting of multiple remote source MAC addresses
	net: gianfar: Add of_node_put() before goto statement
	powerpc/perf: Fix soft lockups due to missed interrupt accounting
	block: loop: set discard granularity and alignment for block device backed loop
	HID: i2c-hid: Always sleep 60ms after I2C_HID_PWR_ON commands
	blk-mq: order adding requests to hctx->dispatch and checking SCHED_RESTART
	btrfs: reset compression level for lzo on remount
	btrfs: fix space cache memory leak after transaction abort
	fbcon: prevent user font height or width change from causing potential out-of-bounds access
	USB: lvtest: return proper error code in probe
	vt: defer kfree() of vc_screenbuf in vc_do_resize()
	vt_ioctl: change VT_RESIZEX ioctl to check for error return from vc_resize()
	serial: samsung: Removes the IRQ not found warning
	serial: pl011: Fix oops on -EPROBE_DEFER
	serial: pl011: Don't leak amba_ports entry on driver register error
	serial: 8250_exar: Fix number of ports for Commtech PCIe cards
	serial: 8250: change lock order in serial8250_do_startup()
	writeback: Protect inode->i_io_list with inode->i_lock
	writeback: Avoid skipping inode writeback
	writeback: Fix sync livelock due to b_dirty_time processing
	XEN uses irqdesc::irq_data_common::handler_data to store a per interrupt XEN data pointer which contains XEN specific information.
	usb: host: xhci: fix ep context print mismatch in debugfs
	xhci: Do warm-reset when both CAS and XDEV_RESUME are set
	xhci: Always restore EP_SOFT_CLEAR_TOGGLE even if ep reset failed
	PM: sleep: core: Fix the handling of pending runtime resume requests
	device property: Fix the secondary firmware node handling in set_primary_fwnode()
	genirq/matrix: Deal with the sillyness of for_each_cpu() on UP
	irqchip/stm32-exti: Avoid losing interrupts due to clearing pending bits by mistake
	drm/amdgpu: Fix buffer overflow in INFO ioctl
	drm/amd/pm: correct Vega10 swctf limit setting
	drm/amd/pm: correct Vega12 swctf limit setting
	USB: yurex: Fix bad gfp argument
	usb: uas: Add quirk for PNY Pro Elite
	USB: quirks: Add no-lpm quirk for another Raydium touchscreen
	USB: quirks: Ignore duplicate endpoint on Sound Devices MixPre-D
	USB: Ignore UAS for JMicron JMS567 ATA/ATAPI Bridge
	usb: host: ohci-exynos: Fix error handling in exynos_ohci_probe()
	USB: gadget: u_f: add overflow checks to VLA macros
	USB: gadget: f_ncm: add bounds checks to ncm_unwrap_ntb()
	USB: gadget: u_f: Unbreak offset calculation in VLAs
	USB: cdc-acm: rework notification_buffer resizing
	usb: storage: Add unusual_uas entry for Sony PSZ drives
	btrfs: check the right error variable in btrfs_del_dir_entries_in_log
	usb: dwc3: gadget: Don't setup more than requested
	usb: dwc3: gadget: Fix handling ZLP
	usb: dwc3: gadget: Handle ZLP for sg requests
	tpm: Unify the mismatching TPM space buffer sizes
	HID: hiddev: Fix slab-out-of-bounds write in hiddev_ioctl_usage()
	ALSA: usb-audio: Update documentation comment for MS2109 quirk
	Linux 4.19.143

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I8b6e29eda77bd69df30132842cf28019c8e7c1a3
2020-09-03 13:19:20 +02:00
Amelie Delaunay
ca57f45050 spi: stm32: fix stm32_spi_prepare_mbr in case of odd clk_rate
[ Upstream commit 9cc61973bf ]

Fix spi->clk_rate when it is odd to the nearest lowest even value because
minimum SPI divider is 2.

Signed-off-by: Amelie Delaunay <amelie.delaunay@st.com>
Signed-off-by: Alain Volmat <alain.volmat@st.com>
Link: https://lore.kernel.org/r/1597043558-29668-4-git-send-email-alain.volmat@st.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-09-03 11:24:24 +02:00
Greg Kroah-Hartman
599bf02de4 This is the 4.19.142 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl9GHdsACgkQONu9yGCS
 aT4AoA//RHH+8srJoIL7iz4HMcXbSTqom//BkZKhDLMvDoOHt7GE3t571kM4Bx99
 cY+oJCxsfUgbSLGE2eBRmfr0i+kcyT/Ke1Jyp0/3+lrqZeFxhtda8z1TYz0PC0E6
 V/M9OaKKpKFW2tsGxsiKsomE4wNZExhKl2yti6QWS6jl+1ngAKZEg0LLMjDDSC3G
 CGtnk9yYjdExxky0XYN15B7I4RfIFLmHprT++Ctrgxq6wlrOiZyB2LqNJeZdJmsx
 7tieTxC0rAsyMG5w1j6kFy5+6e+5t81B5yk5IfHNH17ZUU+L8p15fC172GEi3rwn
 UOYPZxIEJs4wRImJTur3JwfQbt2ySt45GNJBTVtOt/dUvS141NgpBVTSaQ60Zv4Y
 4aXi4GucVr3nApTnTfAM5nRjtnRrHPXg49qzM0CqOAzdlyuUpzpvQsyek1ml8Etl
 Vdgn7iLyUbV7Cb/aVVEAwvkT+EAPdrzqSK8Q3nonl8R4pZy35CrxlPkdFPVSIKmH
 KGLZP+xg3wJSHdjVuLAtMAYcREau/Yo+i3W8Pz4niU3MUnskPqdPQyp8XzY+hwfp
 4OgJatcUPdB9782b242WmrVJ4b4Ts4ZOuM6hrIrSqdvOkuzQQ9vyDmfHHlEEfH4F
 6tSEA96MZ1bG7uIyMwgx+11lbBC48UYhm/dKcXmyX/yV60N8oPw=
 =/u20
 -----END PGP SIGNATURE-----

Merge 4.19.142 into android-4.19-stable

Changes in 4.19.142
	drm/vgem: Replace opencoded version of drm_gem_dumb_map_offset()
	perf probe: Fix memory leakage when the probe point is not found
	khugepaged: khugepaged_test_exit() check mmget_still_valid()
	khugepaged: adjust VM_BUG_ON_MM() in __khugepaged_enter()
	btrfs: export helpers for subvolume name/id resolution
	btrfs: don't show full path of bind mounts in subvol=
	btrfs: Move free_pages_out label in inline extent handling branch in compress_file_range
	btrfs: inode: fix NULL pointer dereference if inode doesn't need compression
	btrfs: sysfs: use NOFS for device creation
	romfs: fix uninitialized memory leak in romfs_dev_read()
	kernel/relay.c: fix memleak on destroy relay channel
	mm: include CMA pages in lowmem_reserve at boot
	mm, page_alloc: fix core hung in free_pcppages_bulk()
	ext4: fix checking of directory entry validity for inline directories
	jbd2: add the missing unlock_buffer() in the error path of jbd2_write_superblock()
	scsi: zfcp: Fix use-after-free in request timeout handlers
	drm/amd/display: fix pow() crashing when given base 0
	kthread: Do not preempt current task if it is going to call schedule()
	spi: Prevent adding devices below an unregistering controller
	scsi: ufs: Add DELAY_BEFORE_LPM quirk for Micron devices
	scsi: target: tcmu: Fix crash in tcmu_flush_dcache_range on ARM
	media: budget-core: Improve exception handling in budget_register()
	rtc: goldfish: Enable interrupt in set_alarm() when necessary
	media: vpss: clean up resources in init
	Input: psmouse - add a newline when printing 'proto' by sysfs
	m68knommu: fix overwriting of bits in ColdFire V3 cache control
	svcrdma: Fix another Receive buffer leak
	xfs: fix inode quota reservation checks
	jffs2: fix UAF problem
	ceph: fix use-after-free for fsc->mdsc
	cpufreq: intel_pstate: Fix cpuinfo_max_freq when MSR_TURBO_RATIO_LIMIT is 0
	scsi: libfc: Free skb in fc_disc_gpn_id_resp() for valid cases
	virtio_ring: Avoid loop when vq is broken in virtqueue_poll
	tools/testing/selftests/cgroup/cgroup_util.c: cg_read_strcmp: fix null pointer dereference
	xfs: Fix UBSAN null-ptr-deref in xfs_sysfs_init
	alpha: fix annotation of io{read,write}{16,32}be()
	fs/signalfd.c: fix inconsistent return codes for signalfd4
	ext4: fix potential negative array index in do_split()
	ext4: don't allow overlapping system zones
	ASoC: q6routing: add dummy register read/write function
	i40e: Set RX_ONLY mode for unicast promiscuous on VLAN
	i40e: Fix crash during removing i40e driver
	net: fec: correct the error path for regulator disable in probe
	bonding: show saner speed for broadcast mode
	bonding: fix a potential double-unregister
	s390/runtime_instrumentation: fix storage key handling
	s390/ptrace: fix storage key handling
	ASoC: msm8916-wcd-analog: fix register Interrupt offset
	ASoC: intel: Fix memleak in sst_media_open
	vfio/type1: Add proper error unwind for vfio_iommu_replay()
	kvm: x86: Toggling CR4.SMAP does not load PDPTEs in PAE mode
	kvm: x86: Toggling CR4.PKE does not load PDPTEs in PAE mode
	kconfig: qconf: do not limit the pop-up menu to the first row
	kconfig: qconf: fix signal connection to invalid slots
	efi: avoid error message when booting under Xen
	Fix build error when CONFIG_ACPI is not set/enabled:
	RDMA/bnxt_re: Do not add user qps to flushlist
	afs: Fix NULL deref in afs_dynroot_depopulate()
	bonding: fix active-backup failover for current ARP slave
	net: ena: Prevent reset after device destruction
	net: gemini: Fix missing free_netdev() in error path of gemini_ethernet_port_probe()
	hv_netvsc: Fix the queue_mapping in netvsc_vf_xmit()
	net: dsa: b53: check for timeout
	powerpc/pseries: Do not initiate shutdown when system is running on UPS
	efi: add missed destroy_workqueue when efisubsys_init fails
	epoll: Keep a reference on files added to the check list
	do_epoll_ctl(): clean the failure exits up a bit
	mm/hugetlb: fix calculation of adjust_range_if_pmd_sharing_possible
	xen: don't reschedule in preemption off sections
	clk: Evict unregistered clks from parent caches
	KVM: Pass MMU notifier range flags to kvm_unmap_hva_range()
	KVM: arm64: Only reschedule if MMU_NOTIFIER_RANGE_BLOCKABLE is not set
	Linux 4.19.142

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ibfe4a0a4249f76ab35076f4b003e32cd6f9788a5
2020-08-26 11:07:03 +02:00
Lukas Wunner
30872ac7db spi: Prevent adding devices below an unregistering controller
[ Upstream commit ddf75be47c ]

CONFIG_OF_DYNAMIC and CONFIG_ACPI allow adding SPI devices at runtime
using a DeviceTree overlay or DSDT patch.  CONFIG_SPI_SLAVE allows the
same via sysfs.

But there are no precautions to prevent adding a device below a
controller that's being removed.  Such a device is unusable and may not
even be able to unbind cleanly as it becomes inaccessible once the
controller has been torn down.  E.g. it is then impossible to quiesce
the device's interrupt.

of_spi_notify() and acpi_spi_notify() do hold a ref on the controller,
but otherwise run lockless against spi_unregister_controller().

Fix by holding the spi_add_lock in spi_unregister_controller() and
bailing out of spi_add_device() if the controller has been unregistered
concurrently.

Fixes: ce79d54ae4 ("spi/of: Add OF notifier handler")
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: stable@vger.kernel.org # v3.19+
Cc: Geert Uytterhoeven <geert+renesas@glider.be>
Cc: Octavian Purdila <octavian.purdila@intel.com>
Cc: Pantelis Antoniou <pantelis.antoniou@konsulko.com>
Link: https://lore.kernel.org/r/a8c3205088a969dc8410eec1eba9aface60f36af.1596451035.git.lukas@wunner.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-08-26 10:31:00 +02:00
Greg Kroah-Hartman
7086849b9c This is the 4.19.140 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl88w3UACgkQONu9yGCS
 aT4fZQ/+NYyfbsgFARqld2HbOIDSYyua90k42Xj7nlHXa3UcbPCsNEWIWn2k5SXU
 kvzwXSUuI14AOyqBOp/swKkEZh7Dh5c6q8QBHA6YJnNaJBQQxv2tjMpA4TngMifG
 oUSnxgHKNHtiD/6D7ZZ36l8u83sXfE6qPiginJAECdC2bVjpdfT7EqK5bY2lFd1s
 yiz9RxEDXSlrVMXqew75XBEj+304RYhZcJEVPQrqFb/q2Q+rSYs1mAkCazFvAkX+
 6Yooyp0tYlfUlkF2ItDpWmuKDcbGtWDd/I9LVGwZ0J67uAN86ZhNGbqlI8bpig9o
 qNW0FXAN2TNjpBvKXwg1qavfs5xYQu2E0OrRpCUleL1yD/kWu2vfK4HqyIardsVq
 63ffUvMJnJaWPnIvB2gx5f5tRt3Ca7uqvoM4LlYR1fwNZwVaU1fyWNEfeID4MAkr
 jBhC8x3n40TF1ngdaZ/XETiAJbjiYve2uEVuvdCtnp1fFbQ892QD5A8MQYsOVFuh
 6aR4f6bsR23F/h+tOMJc89wZTRYsCrFxbjwjye+tsWPcBm2GR7hgvCxo1JFqHgrz
 elY15u+AWj4pjVhiQcsnXLL8pGKkZTvPrq+iwg12AE23gvE4ww1lpYbxO46GUWuw
 q6L8oaHYA6cZiEnIde6yTUpkm6zag0MK+HDutiFUrEAmJTmeWds=
 =9oFP
 -----END PGP SIGNATURE-----

Merge 4.19.140 into android-4.19-stable

Changes in 4.19.140
	tracepoint: Mark __tracepoint_string's __used
	HID: input: Fix devices that return multiple bytes in battery report
	cgroup: add missing skcd->no_refcnt check in cgroup_sk_clone()
	x86/mce/inject: Fix a wrong assignment of i_mce.status
	sched/fair: Fix NOHZ next idle balance
	sched: correct SD_flags returned by tl->sd_flags()
	arm64: dts: rockchip: fix rk3368-lion gmac reset gpio
	arm64: dts: rockchip: fix rk3399-puma vcc5v0-host gpio
	arm64: dts: rockchip: fix rk3399-puma gmac reset gpio
	EDAC: Fix reference count leaks
	arm64: dts: qcom: msm8916: Replace invalid bias-pull-none property
	crypto: ccree - fix resource leak on error path
	firmware: arm_scmi: Fix SCMI genpd domain probing
	arm64: dts: exynos: Fix silent hang after boot on Espresso
	clk: scmi: Fix min and max rate when registering clocks with discrete rates
	m68k: mac: Don't send IOP message until channel is idle
	m68k: mac: Fix IOP status/control register writes
	platform/x86: intel-hid: Fix return value check in check_acpi_dev()
	platform/x86: intel-vbtn: Fix return value check in check_acpi_dev()
	ARM: dts: gose: Fix ports node name for adv7180
	ARM: dts: gose: Fix ports node name for adv7612
	ARM: at91: pm: add missing put_device() call in at91_pm_sram_init()
	spi: lantiq: fix: Rx overflow error in full duplex mode
	ARM: socfpga: PM: add missing put_device() call in socfpga_setup_ocram_self_refresh()
	drm/tilcdc: fix leak & null ref in panel_connector_get_modes
	soc: qcom: rpmh-rsc: Set suppress_bind_attrs flag
	Bluetooth: add a mutex lock to avoid UAF in do_enale_set
	loop: be paranoid on exit and prevent new additions / removals
	fs/btrfs: Add cond_resched() for try_release_extent_mapping() stalls
	drm/amdgpu: avoid dereferencing a NULL pointer
	drm/radeon: Fix reference count leaks caused by pm_runtime_get_sync
	crypto: aesni - Fix build with LLVM_IAS=1
	video: fbdev: neofb: fix memory leak in neo_scan_monitor()
	md-cluster: fix wild pointer of unlock_all_bitmaps()
	arm64: dts: hisilicon: hikey: fixes to comply with adi, adv7533 DT binding
	drm/etnaviv: fix ref count leak via pm_runtime_get_sync
	drm/nouveau: fix multiple instances of reference count leaks
	usb: mtu3: clear dual mode of u3port when disable device
	drm/debugfs: fix plain echo to connector "force" attribute
	drm/radeon: disable AGP by default
	irqchip/irq-mtk-sysirq: Replace spinlock with raw_spinlock
	mm/mmap.c: Add cond_resched() for exit_mmap() CPU stalls
	brcmfmac: keep SDIO watchdog running when console_interval is non-zero
	brcmfmac: To fix Bss Info flag definition Bug
	brcmfmac: set state of hanger slot to FREE when flushing PSQ
	iwlegacy: Check the return value of pcie_capability_read_*()
	gpu: host1x: debug: Fix multiple channels emitting messages simultaneously
	usb: gadget: net2280: fix memory leak on probe error handling paths
	bdc: Fix bug causing crash after multiple disconnects
	usb: bdc: Halt controller on suspend
	dyndbg: fix a BUG_ON in ddebug_describe_flags
	bcache: fix super block seq numbers comparision in register_cache_set()
	ACPICA: Do not increment operation_region reference counts for field units
	drm/msm: ratelimit crtc event overflow error
	agp/intel: Fix a memory leak on module initialisation failure
	video: fbdev: sm712fb: fix an issue about iounmap for a wrong address
	console: newport_con: fix an issue about leak related system resources
	video: pxafb: Fix the function used to balance a 'dma_alloc_coherent()' call
	ath10k: Acquire tx_lock in tx error paths
	iio: improve IIO_CONCENTRATION channel type description
	drm/etnaviv: Fix error path on failure to enable bus clk
	drm/arm: fix unintentional integer overflow on left shift
	leds: lm355x: avoid enum conversion warning
	media: omap3isp: Add missed v4l2_ctrl_handler_free() for preview_init_entities()
	ASoC: Intel: bxt_rt298: add missing .owner field
	scsi: cumana_2: Fix different dev_id between request_irq() and free_irq()
	drm/mipi: use dcs write for mipi_dsi_dcs_set_tear_scanline
	cxl: Fix kobject memleak
	drm/radeon: fix array out-of-bounds read and write issues
	scsi: powertec: Fix different dev_id between request_irq() and free_irq()
	scsi: eesox: Fix different dev_id between request_irq() and free_irq()
	ipvs: allow connection reuse for unconfirmed conntrack
	media: firewire: Using uninitialized values in node_probe()
	media: exynos4-is: Add missed check for pinctrl_lookup_state()
	xfs: don't eat an EIO/ENOSPC writeback error when scrubbing data fork
	xfs: fix reflink quota reservation accounting error
	RDMA/rxe: Skip dgid check in loopback mode
	PCI: Fix pci_cfg_wait queue locking problem
	leds: core: Flush scheduled work for system suspend
	drm: panel: simple: Fix bpc for LG LB070WV8 panel
	phy: exynos5-usbdrd: Calibrating makes sense only for USB2.0 PHY
	drm/bridge: sil_sii8620: initialize return of sii8620_readb
	scsi: scsi_debug: Add check for sdebug_max_queue during module init
	mwifiex: Prevent memory corruption handling keys
	powerpc/vdso: Fix vdso cpu truncation
	RDMA/qedr: SRQ's bug fixes
	RDMA/rxe: Prevent access to wr->next ptr afrer wr is posted to send queue
	staging: rtl8192u: fix a dubious looking mask before a shift
	PCI/ASPM: Add missing newline in sysfs 'policy'
	powerpc/book3s64/pkeys: Use PVR check instead of cpu feature
	drm/imx: tve: fix regulator_disable error path
	USB: serial: iuu_phoenix: fix led-activity helpers
	usb: core: fix quirks_param_set() writing to a const pointer
	thermal: ti-soc-thermal: Fix reversed condition in ti_thermal_expose_sensor()
	coresight: tmc: Fix TMC mode read in tmc_read_unprepare_etb()
	MIPS: OCTEON: add missing put_device() call in dwc3_octeon_device_init()
	usb: dwc2: Fix error path in gadget registration
	scsi: mesh: Fix panic after host or bus reset
	net: dsa: mv88e6xxx: MV88E6097 does not support jumbo configuration
	PCI: cadence: Fix updating Vendor ID and Subsystem Vendor ID register
	RDMA/core: Fix return error value in _ib_modify_qp() to negative
	Smack: fix another vsscanf out of bounds
	Smack: prevent underflow in smk_set_cipso()
	power: supply: check if calc_soc succeeded in pm860x_init_battery
	Bluetooth: hci_h5: Set HCI_UART_RESET_ON_INIT to correct flags
	Bluetooth: hci_serdev: Only unregister device if it was registered
	net: dsa: rtl8366: Fix VLAN semantics
	net: dsa: rtl8366: Fix VLAN set-up
	powerpc/boot: Fix CONFIG_PPC_MPC52XX references
	selftests/powerpc: Fix CPU affinity for child process
	PCI: Release IVRS table in AMD ACS quirk
	selftests/powerpc: Fix online CPU selection
	ASoC: meson: axg-tdm-interface: fix link fmt setup
	s390/qeth: don't process empty bridge port events
	wl1251: fix always return 0 error
	tools, build: Propagate build failures from tools/build/Makefile.build
	net: ethernet: aquantia: Fix wrong return value
	liquidio: Fix wrong return value in cn23xx_get_pf_num()
	net: spider_net: Fix the size used in a 'dma_free_coherent()' call
	fsl/fman: use 32-bit unsigned integer
	fsl/fman: fix dereference null return value
	fsl/fman: fix unreachable code
	fsl/fman: check dereferencing null pointer
	fsl/fman: fix eth hash table allocation
	dlm: Fix kobject memleak
	ocfs2: fix unbalanced locking
	pinctrl-single: fix pcs_parse_pinconf() return value
	svcrdma: Fix page leak in svc_rdma_recv_read_chunk()
	x86/fsgsbase/64: Fix NULL deref in 86_fsgsbase_read_task
	crypto: aesni - add compatibility with IAS
	af_packet: TPACKET_V3: fix fill status rwlock imbalance
	drivers/net/wan/lapbether: Added needed_headroom and a skb->len check
	net/nfc/rawsock.c: add CAP_NET_RAW check.
	net: Set fput_needed iff FDPUT_FPUT is set
	net/tls: Fix kmap usage
	net: refactor bind_bucket fastreuse into helper
	net: initialize fastreuse on inet_inherit_port
	USB: serial: cp210x: re-enable auto-RTS on open
	USB: serial: cp210x: enable usb generic throttle/unthrottle
	ALSA: hda - fix the micmute led status for Lenovo ThinkCentre AIO
	ALSA: usb-audio: Creative USB X-Fi Pro SB1095 volume knob support
	ALSA: usb-audio: fix overeager device match for MacroSilicon MS2109
	ALSA: usb-audio: work around streaming quirk for MacroSilicon MS2109
	pstore: Fix linking when crypto API disabled
	crypto: hisilicon - don't sleep of CRYPTO_TFM_REQ_MAY_SLEEP was not specified
	crypto: qat - fix double free in qat_uclo_create_batch_init_list
	crypto: ccp - Fix use of merged scatterlists
	crypto: cpt - don't sleep of CRYPTO_TFM_REQ_MAY_SLEEP was not specified
	bitfield.h: don't compile-time validate _val in FIELD_FIT
	fs/minix: check return value of sb_getblk()
	fs/minix: don't allow getting deleted inodes
	fs/minix: reject too-large maximum file size
	ALSA: usb-audio: add quirk for Pioneer DDJ-RB
	9p: Fix memory leak in v9fs_mount
	drm/ttm/nouveau: don't call tt destroy callback on alloc failure.
	NFS: Don't move layouts to plh_return_segs list while in use
	NFS: Don't return layout segments that are in use
	cpufreq: dt: fix oops on armada37xx
	include/asm-generic/vmlinux.lds.h: align ro_after_init
	spi: spidev: Align buffers for DMA
	mtd: rawnand: qcom: avoid write to unavailable register
	parisc: Implement __smp_store_release and __smp_load_acquire barriers
	parisc: mask out enable and reserved bits from sba imask
	ARM: 8992/1: Fix unwind_frame for clang-built kernels
	irqdomain/treewide: Free firmware node after domain removal
	xen/balloon: fix accounting in alloc_xenballooned_pages error path
	xen/balloon: make the balloon wait interruptible
	xen/gntdev: Fix dmabuf import with non-zero sgt offset
	Linux 4.19.140

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I6b0d8dcf9ded022f62d9c62605388f1c1e9112d1
2020-08-19 08:43:22 +02:00