commit 103f1dbea1ae44731edca02cd7fcfa4a33742cd2
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Fri May 28 13:10:27 2021 +0200

    Linux 5.4.123
    
    Link: https://lore.kernel.org/r/20210527151139.224619013@linuxfoundation.org
    Tested-by: Jon Hunter <jonathanh@nvidia.com>
    Tested-by: Shuah Khan <skhan@linuxfoundation.org>
    Tested-by: Florian Fainelli <f.fainelli@gmail.com>
    Reviewed-by: Guenter Roeck <linux@roeck-us.net>
    Tested-by: Hulk Robot <hulkrobot@huawei.com>
    Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit af2a4426baf71163c0c354580ae98c7888a9aba7
Author: Dongliang Mu <mudongliangabcd@gmail.com>
Date:   Sat May 15 07:29:06 2021 +0800

    NFC: nci: fix memory leak in nci_allocate_device
    
    commit e0652f8bb44d6294eeeac06d703185357f25d50b upstream.
    
    nfcmrvl_disconnect fails to free the hci_dev field in struct nci_dev.
    Fix this by freeing hci_dev in nci_free_device.
    
    BUG: memory leak
    unreferenced object 0xffff888111ea6800 (size 1024):
      comm "kworker/1:0", pid 19, jiffies 4294942308 (age 13.580s)
      hex dump (first 32 bytes):
        00 00 00 00 00 00 00 00 00 60 fd 0c 81 88 ff ff  .........`......
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
      backtrace:
        [<000000004bc25d43>] kmalloc include/linux/slab.h:552 [inline]
        [<000000004bc25d43>] kzalloc include/linux/slab.h:682 [inline]
        [<000000004bc25d43>] nci_hci_allocate+0x21/0xd0 net/nfc/nci/hci.c:784
        [<00000000c59cff92>] nci_allocate_device net/nfc/nci/core.c:1170 [inline]
        [<00000000c59cff92>] nci_allocate_device+0x10b/0x160 net/nfc/nci/core.c:1132
        [<00000000006e0a8e>] nfcmrvl_nci_register_dev+0x10a/0x1c0 drivers/nfc/nfcmrvl/main.c:153
        [<000000004da1b57e>] nfcmrvl_probe+0x223/0x290 drivers/nfc/nfcmrvl/usb.c:345
        [<00000000d506aed9>] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396
        [<00000000bc632c92>] really_probe+0x159/0x4a0 drivers/base/dd.c:554
        [<00000000f5009125>] driver_probe_device+0x84/0x100 drivers/base/dd.c:740
        [<000000000ce658ca>] __device_attach_driver+0xee/0x110 drivers/base/dd.c:846
        [<000000007067d05f>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:431
        [<00000000f8e13372>] __device_attach+0x122/0x250 drivers/base/dd.c:914
        [<000000009cf68860>] bus_probe_device+0xc6/0xe0 drivers/base/bus.c:491
        [<00000000359c965a>] device_add+0x5be/0xc30 drivers/base/core.c:3109
        [<00000000086e4bd3>] usb_set_configuration+0x9d9/0xb90 drivers/usb/core/message.c:2164
        [<00000000ca036872>] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238
        [<00000000d40d36f6>] usb_probe_device+0x5c/0x140 drivers/usb/core/driver.c:293
        [<00000000bc632c92>] really_probe+0x159/0x4a0 drivers/base/dd.c:554
    
    Reported-by: syzbot+19bcfc64a8df1318d1c3@syzkaller.appspotmail.com
    Fixes: 11f54f228643 ("NFC: nci: Add HCI over NCI protocol support")
    Signed-off-by: Dongliang Mu <mudongliangabcd@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 45aef101ca442bafb393a3c71a139b62bbaf80e4
Author: Dave Rigby <d.rigby@me.com>
Date:   Thu Feb 18 16:56:54 2021 +0000

    perf unwind: Set userdata for all __report_module() paths
    
    commit 4e1481445407b86a483616c4542ffdc810efb680 upstream.
    
    When locating the DWARF module for a given address, __find_debuginfo()
    requires a 'struct dso' passed via the userdata argument.
    
    However, this field is only set in __report_module() if the module is
    found in via dwfl_addrmodule(), not if it is found later via
    dwfl_report_elf().
    
    Set userdata irrespective of how the DWARF module was found, as long as
    we found a module.
    
    Fixes: bf53fc6b5f41 ("perf unwind: Fix separate debug info files when using elfutils' libdw's unwinder")
    Signed-off-by: Dave Rigby <d.rigby@me.com>
    Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=211801
    Acked-by: Jan Kratochvil <jan.kratochvil@redhat.com>
    Acked-by: Jiri Olsa <jolsa@redhat.com>
    Link: https://lore.kernel.org/linux-perf-users/20210218165654.36604-1-d.rigby@me.com/
    Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
    Cc: "Tommi Rantala" <tommi.t.rantala@nokia.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 2960df32bb72050ec87fd95d8de54a8c6f288398
Author: Jan Kratochvil <jan.kratochvil@redhat.com>
Date:   Fri Dec 4 09:17:02 2020 -0300

    perf unwind: Fix separate debug info files when using elfutils' libdw's unwinder
    
    commit bf53fc6b5f415cddc7118091cb8fd6a211b2320d upstream.
    
    elfutils needs to be provided main binary and separate debug info file
    respectively. Providing separate debug info file instead of the main
    binary is not sufficient.
    
    One needs to try both supplied filename and its possible cache by its
    build-id depending on the use case.
    
    Signed-off-by: Jan Kratochvil <jan.kratochvil@redhat.com>
    Tested-by: Jiri Olsa <jolsa@redhat.com>
    Cc: Adrian Hunter <adrian.hunter@intel.com>
    Cc: David Ahern <dsahern@gmail.com>
    Cc: Ian Rogers <irogers@google.com>
    Cc: Namhyung Kim <namhyung@kernel.org>
    Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
    Cc: "Tommi Rantala" <tommi.t.rantala@nokia.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f3d9f09b10e363543e0c793a38539c6f5c6a66dc
Author: Jack Pham <jackp@codeaurora.org>
Date:   Wed Apr 28 02:01:10 2021 -0700

    usb: dwc3: gadget: Enable suspend events
    
    commit d1d90dd27254c44d087ad3f8b5b3e4fff0571f45 upstream.
    
    commit 72704f876f50 ("dwc3: gadget: Implement the suspend entry event
    handler") introduced (nearly 5 years ago!) an interrupt handler for
    U3/L1-L2 suspend events.  The problem is that these events aren't
    currently enabled in the DEVTEN register so the handler is never
    even invoked.  Fix this simply by enabling the corresponding bit
    in dwc3_gadget_enable_irq() using the same revision check as found
    in the handler.
    
    Fixes: 72704f876f50 ("dwc3: gadget: Implement the suspend entry event handler")
    Acked-by: Felipe Balbi <balbi@kernel.org>
    Signed-off-by: Jack Pham <jackp@codeaurora.org>
    Cc: stable <stable@vger.kernel.org>
    Link: https://lore.kernel.org/r/20210428090111.3370-1-jackp@codeaurora.org
    [jackp@codeaurora.org: backport to pre-5.7 by replacing
     DWC3_IS_VER_PRIOR check with direct comparison of dwc->revision]
    Signed-off-by: Jack Pham <jackp@codeaurora.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 3173c7c807854a580c85f04193a6a25aeff3dd96
Author: Daniel Borkmann <daniel@iogearbox.net>
Date:   Tue May 4 08:58:25 2021 +0000

    bpf: No need to simulate speculative domain for immediates
    
    commit a7036191277f9fa68d92f2071ddc38c09b1e5ee5 upstream.
    
    In 801c6058d14a ("bpf: Fix leakage of uninitialized bpf stack under
    speculation") we replaced masking logic with direct loads of immediates
    if the register is a known constant. Given in this case we do not apply
    any masking, there is also no reason for the operation to be truncated
    under the speculative domain.
    
    Therefore, there is also zero reason for the verifier to branch-off and
    simulate this case, it only needs to do it for unknown but bounded scalars.
    As a side-effect, this also enables few test cases that were previously
    rejected due to simulation under zero truncation.
    
    Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
    Reviewed-by: Piotr Krysiuk <piotras@gmail.com>
    Acked-by: Alexei Starovoitov <ast@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 2b3cc41d500a74bb48358faf40b4a4ec6f03e25e
Author: Daniel Borkmann <daniel@iogearbox.net>
Date:   Fri May 21 10:19:22 2021 +0000

    bpf: Fix mask direction swap upon off reg sign change
    
    commit bb01a1bba579b4b1c5566af24d95f1767859771e upstream.
    
    Masking direction as indicated via mask_to_left is considered to be
    calculated once and then used to derive pointer limits. Thus, this
    needs to be placed into bpf_sanitize_info instead so we can pass it
    to sanitize_ptr_alu() call after the pointer move. Piotr noticed a
    corner case where the off reg causes masking direction change which
    then results in an incorrect final aux->alu_limit.
    
    Fixes: 7fedb63a8307 ("bpf: Tighten speculative pointer arithmetic mask")
    Reported-by: Piotr Krysiuk <piotras@gmail.com>
    Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
    Reviewed-by: Piotr Krysiuk <piotras@gmail.com>
    Acked-by: Alexei Starovoitov <ast@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 2768f9962231800dab70f5178041b4ff5028fc5d
Author: Daniel Borkmann <daniel@iogearbox.net>
Date:   Fri May 21 10:17:36 2021 +0000

    bpf: Wrap aux data inside bpf_sanitize_info container
    
    commit 3d0220f6861d713213b015b582e9f21e5b28d2e0 upstream.
    
    Add a container structure struct bpf_sanitize_info which holds
    the current aux info, and update call-sites to sanitize_ptr_alu()
    to pass it in. This is needed for passing in additional state
    later on.
    
    Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
    Reviewed-by: Piotr Krysiuk <piotras@gmail.com>
    Acked-by: Alexei Starovoitov <ast@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>