Merge 5.10.200 into android12-5.10-lts

Changes in 5.10.200
	selftests/ftrace: Add new test case which checks non unique symbol
	mcb: Return actual parsed size when reading chameleon table
	mcb-lpc: Reallocate memory region to avoid memory overlapping
	virtio_balloon: Fix endless deflation and inflation on arm64
	virtio-mmio: fix memory leak of vm_dev
	mm/page_alloc: correct start page when guard page debug is enabled
	mmc: renesas_sdhi: use custom mask for TMIO_MASK_ALL
	drm/dp_mst: Fix NULL deref in get_mst_branch_device_by_guid_helper()
	r8169: fix the KCSAN reported data-race in rtl_tx while reading TxDescArray[entry].opts1
	r8169: fix the KCSAN reported data race in rtl_rx while reading desc->opts1
	treewide: Spelling fix in comment
	igb: Fix potential memory leak in igb_add_ethtool_nfc_entry
	neighbour: fix various data-races
	igc: Fix ambiguity in the ethtool advertising
	net: ieee802154: adf7242: Fix some potential buffer overflow in adf7242_stats_show()
	net: usb: smsc95xx: Fix uninit-value access in smsc95xx_read_reg
	r8152: Increase USB control msg timeout to 5000ms as per spec
	r8152: Run the unload routine if we have errors during probe
	r8152: Cancel hw_phy_work if we have an error in probe
	r8152: Release firmware if we have an error in probe
	tcp: fix wrong RTO timeout when received SACK reneging
	gtp: uapi: fix GTPA_MAX
	gtp: fix fragmentation needed check with gso
	i40e: Fix wrong check for I40E_TXR_FLAGS_WB_ON_ITR
	kasan: print the original fault addr when access invalid shadow
	iio: exynos-adc: request second interupt only when touchscreen mode is used
	i2c: muxes: i2c-mux-pinctrl: Use of_get_i2c_adapter_by_node()
	i2c: muxes: i2c-mux-gpmux: Use of_get_i2c_adapter_by_node()
	i2c: muxes: i2c-demux-pinctrl: Use of_get_i2c_adapter_by_node()
	i2c: stm32f7: Fix PEC handling in case of SMBUS transfers
	i2c: aspeed: Fix i2c bus hang in slave read
	tracing/kprobes: Fix the description of variable length arguments
	misc: fastrpc: Clean buffers on remote invocation failures
	nvmem: imx: correct nregs for i.MX6ULL
	nvmem: imx: correct nregs for i.MX6SLL
	nvmem: imx: correct nregs for i.MX6UL
	perf/core: Fix potential NULL deref
	sparc32: fix a braino in fault handling in csum_and_copy_..._user()
	clk: Sanitize possible_parent_show to Handle Return Value of of_clk_get_parent_name
	iio: adc: xilinx: use helper variable for &pdev->dev
	iio: adc: xilinx: use devm_krealloc() instead of kfree() + kcalloc()
	iio: adc: xilinx: use more devres helpers and remove remove()
	iio: adc: xilinx-xadc: Don't clobber preset voltage/temperature thresholds
	x86/i8259: Skip probing when ACPI/MADT advertises PCAT compatibility
	kobject: Fix slab-out-of-bounds in fill_kobj_path()
	smbdirect: missing rc checks while waiting for rdma events
	f2fs: fix to do sanity check on inode type during garbage collection
	x86/mm: Simplify RESERVE_BRK()
	x86/mm: Fix RESERVE_BRK() for older binutils
	ext4: add two helper functions extent_logical_end() and pa_logical_end()
	ext4: fix BUG in ext4_mb_new_inode_pa() due to overflow
	ext4: avoid overlapping preallocations due to overflow
	objtool/x86: add missing embedded_insn check
	driver: platform: Add helper for safer setting of driver_override
	rpmsg: Constify local variable in field store macro
	rpmsg: Fix kfree() of static memory on setting driver_override
	rpmsg: Fix calling device_lock() on non-initialized device
	rpmsg: glink: Release driver_override
	rpmsg: Fix possible refcount leak in rpmsg_register_device_override()
	x86: Fix .brk attribute in linker script
	net: sched: cls_u32: Fix allocation size in u32_init()
	irqchip/stm32-exti: add missing DT IRQ flag translation
	dmaengine: ste_dma40: Fix PM disable depth imbalance in d40_probe
	Input: synaptics-rmi4 - handle reset delay when using SMBus trsnsport
	fbdev: atyfb: only use ioremap_uc() on i386 and ia64
	spi: npcm-fiu: Fix UMA reads when dummy.nbytes == 0
	netfilter: nfnetlink_log: silence bogus compiler warning
	ASoC: rt5650: fix the wrong result of key button
	fbdev: uvesafb: Call cn_del_callback() at the end of uvesafb_exit()
	scsi: mpt3sas: Fix in error path
	platform/mellanox: mlxbf-tmfifo: Fix a warning message
	net: chelsio: cxgb4: add an error code check in t4_load_phy_fw
	powerpc/mm: Fix boot crash with FLATMEM
	can: isotp: change error format from decimal to symbolic error names
	can: isotp: add symbolic error message to isotp_module_init()
	can: isotp: Add error message if txqueuelen is too small
	can: isotp: set max PDU size to 64 kByte
	can: isotp: isotp_bind(): return -EINVAL on incorrect CAN ID formatting
	can: isotp: check CAN address family in isotp_bind()
	can: isotp: handle wait_event_interruptible() return values
	can: isotp: add local echo tx processing and tx without FC
	can: isotp: isotp_bind(): do not validate unused address information
	can: isotp: isotp_sendmsg(): fix TX state detection and wait behavior
	PCI: Prevent xHCI driver from claiming AMD VanGogh USB3 DRD device
	usb: storage: set 1.50 as the lower bcdDevice for older "Super Top" compatibility
	usb: raw-gadget: properly handle interrupted requests
	tty: 8250: Remove UC-257 and UC-431
	tty: 8250: Add support for additional Brainboxes UC cards
	tty: 8250: Add support for Brainboxes UP cards
	tty: 8250: Add support for Intashield IS-100
	ALSA: hda: intel-dsp-config: Fix JSL Chromebook quirk detection
	Linux 5.10.200

Change-Id: I064cfd04d19db1e81d073b02c00258d3ebac2aa3
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

Makefile

@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 5
 PATCHLEVEL = 10
-SUBLEVEL = 199
+SUBLEVEL = 200
 EXTRAVERSION =
 NAME = Dare mighty things
 

arch/powerpc/kernel/setup-common.c

@@ -906,6 +906,8 @@ void __init setup_arch(char **cmdline_p)
 
 	/* Parse memory topology */
 	mem_topology_setup();
+	/* Set max_mapnr before paging_init() */
+	set_max_mapnr(max_pfn);
 
 	/*
 	 * Release secondary cpus out of their spinloops at 0x60 now that

arch/powerpc/mm/mem.c

@@ -293,7 +293,6 @@ void __init mem_init(void)
 #endif
 
 	high_memory = (void *) __va(max_low_pfn * PAGE_SIZE);
-	set_max_mapnr(max_pfn);
 
 	kasan_late_init();
 

arch/sparc/lib/checksum_32.S

@@ -463,5 +463,5 @@ ccslow:	cmp	%g1, 0
  * we only bother with faults on loads... */
 
 cc_fault:
-	ret
+	retl
 	 clr	%o0

arch/x86/include/asm/i8259.h

@@ -67,6 +67,8 @@ struct legacy_pic {
 	void (*make_irq)(unsigned int irq);
 };
 
+void legacy_pic_pcat_compat(void);
+
 extern struct legacy_pic *legacy_pic;
 extern struct legacy_pic null_legacy_pic;
 

arch/x86/include/asm/setup.h

@@ -108,27 +108,16 @@ extern unsigned long _brk_end;
 void *extend_brk(size_t size, size_t align);
 
 /*
- * Reserve space in the brk section.  The name must be unique within
- * the file, and somewhat descriptive.  The size is in bytes.  Must be
- * used at file scope.
+ * Reserve space in the .brk section, which is a block of memory from which the
+ * caller is allowed to allocate very early (before even memblock is available)
+ * by calling extend_brk().  All allocated memory will be eventually converted
+ * to memblock.  Any leftover unallocated memory will be freed.
  *
- * (This uses a temp function to wrap the asm so we can pass it the
- * size parameter; otherwise we wouldn't be able to.  We can't use a
- * "section" attribute on a normal variable because it always ends up
- * being @progbits, which ends up allocating space in the vmlinux
- * executable.)
+ * The size is in bytes.
  */
-#define RESERVE_BRK(name,sz)						\
-	static void __section(".discard.text") __used notrace		\
-	__brk_reservation_fn_##name##__(void) {				\
-		asm volatile (						\
-			".pushsection .brk_reservation,\"aw\",@nobits;" \
-			".brk." #name ":"				\
-			" 1:.skip %c0;"					\
-			" .size .brk." #name ", . - 1b;"		\
-			" .popsection"					\
-			: : "i" (sz));					\
-	}
+#define RESERVE_BRK(name, size)					\
+	__section(".bss..brk") __aligned(1) __used	\
+	static char __brk_##name[size]
 
 /* Helper for reserving space for arrays of things */
 #define RESERVE_BRK_ARRAY(type, name, entries)		\
@@ -146,12 +135,19 @@ asmlinkage void __init x86_64_start_reservations(char *real_mode_data);
 
 #endif /* __i386__ */
 #endif /* _SETUP */
-#else
-#define RESERVE_BRK(name,sz)				\
-	.pushsection .brk_reservation,"aw",@nobits;	\
-.brk.name:						\
-1:	.skip sz;					\
-	.size .brk.name,.-1b;				\
+
+#else  /* __ASSEMBLY */
+
+.macro __RESERVE_BRK name, size
+	.pushsection .bss..brk, "aw"
+SYM_DATA_START(__brk_\name)
+	.skip \size
+SYM_DATA_END(__brk_\name)
 	.popsection
+.endm
+
+#define RESERVE_BRK(name, size) __RESERVE_BRK name, size
+
 #endif /* __ASSEMBLY__ */
+
 #endif /* _ASM_X86_SETUP_H */

arch/x86/kernel/acpi/boot.c

@@ -141,6 +141,9 @@ static int __init acpi_parse_madt(struct acpi_table_header *table)
 		       madt->address);
 	}
 
+	if (madt->flags & ACPI_MADT_PCAT_COMPAT)
+		legacy_pic_pcat_compat();
+
 	default_acpi_madt_oem_check(madt->header.oem_id,
 				    madt->header.oem_table_id);
 

arch/x86/kernel/i8259.c

@@ -32,6 +32,7 @@
  */
 static void init_8259A(int auto_eoi);
 
+static bool pcat_compat __ro_after_init;
 static int i8259A_auto_eoi;
 DEFINE_RAW_SPINLOCK(i8259A_lock);
 
@@ -301,15 +302,32 @@ static void unmask_8259A(void)
 
 static int probe_8259A(void)
 {
+	unsigned char new_val, probe_val = ~(1 << PIC_CASCADE_IR);
 	unsigned long flags;
-	unsigned char probe_val = ~(1 << PIC_CASCADE_IR);
-	unsigned char new_val;
+
 	/*
-	 * Check to see if we have a PIC.
-	 * Mask all except the cascade and read
-	 * back the value we just wrote. If we don't
-	 * have a PIC, we will read 0xff as opposed to the
-	 * value we wrote.
+	 * If MADT has the PCAT_COMPAT flag set, then do not bother probing
+	 * for the PIC. Some BIOSes leave the PIC uninitialized and probing
+	 * fails.
+	 *
+	 * Right now this causes problems as quite some code depends on
+	 * nr_legacy_irqs() > 0 or has_legacy_pic() == true. This is silly
+	 * when the system has an IO/APIC because then PIC is not required
+	 * at all, except for really old machines where the timer interrupt
+	 * must be routed through the PIC. So just pretend that the PIC is
+	 * there and let legacy_pic->init() initialize it for nothing.
+	 *
+	 * Alternatively this could just try to initialize the PIC and
+	 * repeat the probe, but for cases where there is no PIC that's
+	 * just pointless.
+	 */
+	if (pcat_compat)
+		return nr_legacy_irqs();
+
+	/*
+	 * Check to see if we have a PIC.  Mask all except the cascade and
+	 * read back the value we just wrote. If we don't have a PIC, we
+	 * will read 0xff as opposed to the value we wrote.
 	 */
 	raw_spin_lock_irqsave(&i8259A_lock, flags);
 
@@ -431,5 +449,9 @@ static int __init i8259A_init_ops(void)
 
 	return 0;
 }
-
 device_initcall(i8259A_init_ops);
+
+void __init legacy_pic_pcat_compat(void)
+{
+	pcat_compat = true;
+}

arch/x86/kernel/setup.c

@@ -64,11 +64,6 @@ RESERVE_BRK(dmi_alloc, 65536);
 #endif
 
 
-/*
- * Range of the BSS area. The size of the BSS area is determined
- * at link time, with RESERVE_BRK*() facility reserving additional
- * chunks.
- */
 unsigned long _brk_start = (unsigned long)__brk_base;
 unsigned long _brk_end   = (unsigned long)__brk_base;
 

arch/x86/kernel/vmlinux.lds.S

@@ -414,7 +414,7 @@ SECTIONS
 	.brk : AT(ADDR(.brk) - LOAD_OFFSET) {
 		__brk_base = .;
 		. += 64 * 1024;		/* 64k alignment slop space */
-		*(.brk_reservation)	/* areas brk users have reserved */
+		*(.bss..brk)		/* areas brk users have reserved */
 		__brk_limit = .;
 	}
 

drivers/base/driver.c

@@ -30,6 +30,75 @@ static struct device *next_device(struct klist_iter *i)
 	return dev;
 }
 
+/**
+ * driver_set_override() - Helper to set or clear driver override.
+ * @dev: Device to change
+ * @override: Address of string to change (e.g. &device->driver_override);
+ *            The contents will be freed and hold newly allocated override.
+ * @s: NUL-terminated string, new driver name to force a match, pass empty
+ *     string to clear it ("" or "\n", where the latter is only for sysfs
+ *     interface).
+ * @len: length of @s
+ *
+ * Helper to set or clear driver override in a device, intended for the cases
+ * when the driver_override field is allocated by driver/bus code.
+ *
+ * Returns: 0 on success or a negative error code on failure.
+ */
+int driver_set_override(struct device *dev, const char **override,
+			const char *s, size_t len)
+{
+	const char *new, *old;
+	char *cp;
+
+	if (!override || !s)
+		return -EINVAL;
+
+	/*
+	 * The stored value will be used in sysfs show callback (sysfs_emit()),
+	 * which has a length limit of PAGE_SIZE and adds a trailing newline.
+	 * Thus we can store one character less to avoid truncation during sysfs
+	 * show.
+	 */
+	if (len >= (PAGE_SIZE - 1))
+		return -EINVAL;
+
+	if (!len) {
+		/* Empty string passed - clear override */
+		device_lock(dev);
+		old = *override;
+		*override = NULL;
+		device_unlock(dev);
+		kfree(old);
+
+		return 0;
+	}
+
+	cp = strnchr(s, len, '\n');
+	if (cp)
+		len = cp - s;
+
+	new = kstrndup(s, len, GFP_KERNEL);
+	if (!new)
+		return -ENOMEM;
+
+	device_lock(dev);
+	old = *override;
+	if (cp != s) {
+		*override = new;
+	} else {
+		/* "\n" passed - clear override */
+		kfree(new);
+		*override = NULL;
+	}
+	device_unlock(dev);
+
+	kfree(old);
+
+	return 0;
+}
+EXPORT_SYMBOL_GPL(driver_set_override);
+
 /**
  * driver_for_each_device - Iterator for devices bound to a driver.
  * @drv: Driver we're iterating.

drivers/base/platform.c

@@ -1046,31 +1046,11 @@ static ssize_t driver_override_store(struct device *dev,
 				     const char *buf, size_t count)
 {
 	struct platform_device *pdev = to_platform_device(dev);
-	char *driver_override, *old, *cp;
+	int ret;
 
-	/* We need to keep extra room for a newline */
-	if (count >= (PAGE_SIZE - 1))
-		return -EINVAL;
-
-	driver_override = kstrndup(buf, count, GFP_KERNEL);
-	if (!driver_override)
-		return -ENOMEM;
-
-	cp = strchr(driver_override, '\n');
-	if (cp)
-		*cp = '\0';
-
-	device_lock(dev);
-	old = pdev->driver_override;
-	if (strlen(driver_override)) {
-		pdev->driver_override = driver_override;
-	} else {
-		kfree(driver_override);
-		pdev->driver_override = NULL;
-	}
-	device_unlock(dev);
-
-	kfree(old);
+	ret = driver_set_override(dev, &pdev->driver_override, buf, count);
+	if (ret)
+		return ret;
 
 	return count;
 }

drivers/clk/clk.c

@@ -3246,6 +3246,7 @@ static void possible_parent_show(struct seq_file *s, struct clk_core *core,
 				 unsigned int i, char terminator)
 {
 	struct clk_core *parent;
+	const char *name = NULL;
 
 	/*
 	 * Go through the following options to fetch a parent's name.
@@ -3260,18 +3261,20 @@ static void possible_parent_show(struct seq_file *s, struct clk_core *core,
 	 * registered (yet).
 	 */
 	parent = clk_core_get_parent_by_index(core, i);
-	if (parent)
+	if (parent) {
 		seq_puts(s, parent->name);
-	else if (core->parents[i].name)
+	} else if (core->parents[i].name) {
 		seq_puts(s, core->parents[i].name);
-	else if (core->parents[i].fw_name)
+	} else if (core->parents[i].fw_name) {
 		seq_printf(s, "<%s>(fw)", core->parents[i].fw_name);
-	else if (core->parents[i].index >= 0)
-		seq_puts(s,
-			 of_clk_get_parent_name(core->of_node,
-						core->parents[i].index));
-	else
-		seq_puts(s, "(missing)");
+	} else {
+		if (core->parents[i].index >= 0)
+			name = of_clk_get_parent_name(core->of_node, core->parents[i].index);
+		if (!name)
+			name = "(missing)";
+
+		seq_puts(s, name);
+	}
 
 	seq_putc(s, terminator);
 }

drivers/dma/ste_dma40.c

@@ -3698,6 +3698,7 @@ static int __init d40_probe(struct platform_device *pdev)
 		regulator_disable(base->lcpa_regulator);
 		regulator_put(base->lcpa_regulator);
 	}
+	pm_runtime_disable(base->dev);
 
 	kfree(base->lcla_pool.alloc_map);
 	kfree(base->lookup_log_chans);

drivers/gpu/drm/drm_dp_mst_topology.c

@@ -2612,14 +2612,14 @@ static struct drm_dp_mst_branch *get_mst_branch_device_by_guid_helper(
 	struct drm_dp_mst_branch *found_mstb;
 	struct drm_dp_mst_port *port;
 
+	if (!mstb)
+		return NULL;
+
 	if (memcmp(mstb->guid, guid, 16) == 0)
 		return mstb;
 
 
 	list_for_each_entry(port, &mstb->ports, next) {
-		if (!port->mstb)
-			continue;
-
 		found_mstb = get_mst_branch_device_by_guid_helper(port->mstb, guid);
 
 		if (found_mstb)

drivers/i2c/busses/i2c-aspeed.c

@@ -740,6 +740,8 @@ static void __aspeed_i2c_reg_slave(struct aspeed_i2c_bus *bus, u16 slave_addr)
 	func_ctrl_reg_val = readl(bus->base + ASPEED_I2C_FUN_CTRL_REG);
 	func_ctrl_reg_val |= ASPEED_I2CD_SLAVE_EN;
 	writel(func_ctrl_reg_val, bus->base + ASPEED_I2C_FUN_CTRL_REG);
+
+	bus->slave_state = ASPEED_I2C_SLAVE_INACTIVE;
 }
 
 static int aspeed_i2c_reg_slave(struct i2c_client *client)
@@ -756,7 +758,6 @@ static int aspeed_i2c_reg_slave(struct i2c_client *client)
 	__aspeed_i2c_reg_slave(bus, client->addr);
 
 	bus->slave = client;
-	bus->slave_state = ASPEED_I2C_SLAVE_INACTIVE;
 	spin_unlock_irqrestore(&bus->lock, flags);
 
 	return 0;

drivers/i2c/busses/i2c-stm32f7.c

@@ -1042,9 +1042,10 @@ static int stm32f7_i2c_smbus_xfer_msg(struct stm32f7_i2c_dev *i2c_dev,
 	/* Configure PEC */
 	if ((flags & I2C_CLIENT_PEC) && f7_msg->size != I2C_SMBUS_QUICK) {
 		cr1 |= STM32F7_I2C_CR1_PECEN;
-		cr2 |= STM32F7_I2C_CR2_PECBYTE;
-		if (!f7_msg->read_write)
+		if (!f7_msg->read_write) {
+			cr2 |= STM32F7_I2C_CR2_PECBYTE;
 			f7_msg->count++;
+		}
 	} else {
 		cr1 &= ~STM32F7_I2C_CR1_PECEN;
 		cr2 &= ~STM32F7_I2C_CR2_PECBYTE;
@@ -1132,8 +1133,10 @@ static void stm32f7_i2c_smbus_rep_start(struct stm32f7_i2c_dev *i2c_dev)
 	f7_msg->stop = true;
 
 	/* Add one byte for PEC if needed */
-	if (cr1 & STM32F7_I2C_CR1_PECEN)
+	if (cr1 & STM32F7_I2C_CR1_PECEN) {
+		cr2 |= STM32F7_I2C_CR2_PECBYTE;
 		f7_msg->count++;
+	}
 
 	/* Set number of bytes to be transferred */
 	cr2 &= ~(STM32F7_I2C_CR2_NBYTES_MASK);

drivers/i2c/muxes/i2c-demux-pinctrl.c

@@ -61,7 +61,7 @@ static int i2c_demux_activate_master(struct i2c_demux_pinctrl_priv *priv, u32 ne
 	if (ret)
 		goto err;
 
-	adap = of_find_i2c_adapter_by_node(priv->chan[new_chan].parent_np);
+	adap = of_get_i2c_adapter_by_node(priv->chan[new_chan].parent_np);
 	if (!adap) {
 		ret = -ENODEV;
 		goto err_with_revert;

drivers/i2c/muxes/i2c-mux-gpmux.c

@@ -52,7 +52,7 @@ static struct i2c_adapter *mux_parent_adapter(struct device *dev)
 		dev_err(dev, "Cannot parse i2c-parent\n");
 		return ERR_PTR(-ENODEV);
 	}
-	parent = of_find_i2c_adapter_by_node(parent_np);
+	parent = of_get_i2c_adapter_by_node(parent_np);
 	of_node_put(parent_np);
 	if (!parent)
 		return ERR_PTR(-EPROBE_DEFER);

drivers/i2c/muxes/i2c-mux-pinctrl.c

@@ -62,7 +62,7 @@ static struct i2c_adapter *i2c_mux_pinctrl_parent_adapter(struct device *dev)
 		dev_err(dev, "Cannot parse i2c-parent\n");
 		return ERR_PTR(-ENODEV);
 	}
-	parent = of_find_i2c_adapter_by_node(parent_np);
+	parent = of_get_i2c_adapter_by_node(parent_np);
 	of_node_put(parent_np);
 	if (!parent)
 		return ERR_PTR(-EPROBE_DEFER);