commit a027d43cf3f2fdaabf467b4bcb92d0fe748c2eaf
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Tue Nov 2 18:26:46 2021 +0100

    Linux 4.19.215
    
    Link: https://lore.kernel.org/r/20211101082451.430720900@linuxfoundation.org
    Link: https://lore.kernel.org/r/20211101114224.924071362@linuxfoundation.org
    Tested-by: Jon Hunter <jonathanh@nvidia.com>
    Tested-by: Shuah Khan <skhan@linuxfoundation.org>
    Tested-by: Guenter Roeck <linux@roeck-us.net>
    Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
    Tested-by: Hulk Robot <hulkrobot@huawei.com>
    Tested-by: Sudip Mukherjee <sudip.mukherjee@codethink.co.uk>
    Tested-by: Pavel Machek (CIP) <pavel@denx.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 1ff3c379248ea579aa122d4ca245028e4bc9af23
Author: Xin Long <lucien.xin@gmail.com>
Date:   Wed Oct 20 07:42:47 2021 -0400

    sctp: add vtag check in sctp_sf_ootb
    
    [ Upstream commit 9d02831e517aa36ee6bdb453a0eb47bd49923fe3 ]
    
    sctp_sf_ootb() is called when processing DATA chunk in closed state,
    and many other places are also using it.
    
    The vtag in the chunk's sctphdr should be verified, otherwise, as
    later in chunk length check, it may send abort with the existent
    asoc's vtag, which can be exploited by one to cook a malicious
    chunk to terminate a SCTP asoc.
    
    When fails to verify the vtag from the chunk, this patch sets asoc
    to NULL, so that the abort will be made with the vtag from the
    received chunk later.
    
    Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
    Signed-off-by: Xin Long <lucien.xin@gmail.com>
    Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit d9a4f990aab48dd5c134a9e76c7b651d404b05d3
Author: Xin Long <lucien.xin@gmail.com>
Date:   Wed Oct 20 07:42:46 2021 -0400

    sctp: add vtag check in sctp_sf_do_8_5_1_E_sa
    
    [ Upstream commit ef16b1734f0a176277b7bb9c71a6d977a6ef3998 ]
    
    sctp_sf_do_8_5_1_E_sa() is called when processing SHUTDOWN_ACK chunk
    in cookie_wait and cookie_echoed state.
    
    The vtag in the chunk's sctphdr should be verified, otherwise, as
    later in chunk length check, it may send abort with the existent
    asoc's vtag, which can be exploited by one to cook a malicious
    chunk to terminate a SCTP asoc.
    
    Note that when fails to verify the vtag from SHUTDOWN-ACK chunk,
    SHUTDOWN COMPLETE message will still be sent back to peer, but
    with the vtag from SHUTDOWN-ACK chunk, as said in 5) of
    rfc4960#section-8.4.
    
    While at it, also remove the unnecessary chunk length check from
    sctp_sf_shut_8_4_5(), as it's already done in both places where
    it calls sctp_sf_shut_8_4_5().
    
    Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
    Signed-off-by: Xin Long <lucien.xin@gmail.com>
    Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 7bf2f6a30d1851c530ad5e4ee7e5c45fb6be0128
Author: Xin Long <lucien.xin@gmail.com>
Date:   Wed Oct 20 07:42:45 2021 -0400

    sctp: add vtag check in sctp_sf_violation
    
    [ Upstream commit aa0f697e45286a6b5f0ceca9418acf54b9099d99 ]
    
    sctp_sf_violation() is called when processing HEARTBEAT_ACK chunk
    in cookie_wait state, and some other places are also using it.
    
    The vtag in the chunk's sctphdr should be verified, otherwise, as
    later in chunk length check, it may send abort with the existent
    asoc's vtag, which can be exploited by one to cook a malicious
    chunk to terminate a SCTP asoc.
    
    Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
    Signed-off-by: Xin Long <lucien.xin@gmail.com>
    Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 86044244fc6f9eaec0070cb668e0d500de22dbba
Author: Xin Long <lucien.xin@gmail.com>
Date:   Wed Oct 20 07:42:44 2021 -0400

    sctp: fix the processing for COOKIE_ECHO chunk
    
    [ Upstream commit a64b341b8695e1c744dd972b39868371b4f68f83 ]
    
    1. In closed state: in sctp_sf_do_5_1D_ce():
    
      When asoc is NULL, making packet for abort will use chunk's vtag
      in sctp_ootb_pkt_new(). But when asoc exists, vtag from the chunk
      should be verified before using peer.i.init_tag to make packet
      for abort in sctp_ootb_pkt_new(), and just discard it if vtag is
      not correct.
    
    2. In the other states: in sctp_sf_do_5_2_4_dupcook():
    
      asoc always exists, but duplicate cookie_echo's vtag will be
      handled by sctp_tietags_compare() and then take actions, so before
      that we only verify the vtag for the abort sent for invalid chunk
      length.
    
    Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
    Signed-off-by: Xin Long <lucien.xin@gmail.com>
    Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 1f52dfacca7bb315d89f5ece5660b0337809798e
Author: Xin Long <lucien.xin@gmail.com>
Date:   Wed Oct 20 07:42:41 2021 -0400

    sctp: use init_tag from inithdr for ABORT chunk
    
    [ Upstream commit 4f7019c7eb33967eb87766e0e4602b5576873680 ]
    
    Currently Linux SCTP uses the verification tag of the existing SCTP
    asoc when failing to process and sending the packet with the ABORT
    chunk. This will result in the peer accepting the ABORT chunk and
    removing the SCTP asoc. One could exploit this to terminate a SCTP
    asoc.
    
    This patch is to fix it by always using the initiate tag of the
    received INIT chunk for the ABORT chunk to be sent.
    
    Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
    Signed-off-by: Xin Long <lucien.xin@gmail.com>
    Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit b75fa48e42d022d6757b7de29178d531df8cf43b
Author: Trevor Woerner <twoerner@gmail.com>
Date:   Sun Oct 24 13:50:02 2021 -0400

    net: nxp: lpc_eth.c: avoid hang when bringing interface down
    
    commit ace19b992436a257d9a793672e57abc28fe83e2e upstream.
    
    A hard hang is observed whenever the ethernet interface is brought
    down. If the PHY is stopped before the LPC core block is reset,
    the SoC will hang. Comparing lpc_eth_close() and lpc_eth_open() I
    re-arranged the ordering of the functions calls in lpc_eth_close() to
    reset the hardware before stopping the PHY.
    Fixes: b7370112f519 ("lpc32xx: Added ethernet driver")
    Signed-off-by: Trevor Woerner <twoerner@gmail.com>
    Acked-by: Vladimir Zapolskiy <vz@mleia.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 84a9eb9a2f179ea5e6398fe270560a8aaa16f996
Author: Yuiko Oshino <yuiko.oshino@microchip.com>
Date:   Fri Oct 22 11:53:43 2021 -0400

    net: ethernet: microchip: lan743x: Fix dma allocation failure by using dma_set_mask_and_coherent
    
    commit 95a359c9553342d36d408d35331ff0bfce75272f upstream.
    
    The dma failure was reported in the raspberry pi github (issue #4117).
    https://github.com/raspberrypi/linux/issues/4117
    The use of dma_set_mask_and_coherent fixes the issue.
    Tested on 32/64-bit raspberry pi CM4 and 64-bit ubuntu x86 PC with EVB-LAN7430.
    
    Fixes: 23f0703c125b ("lan743x: Add main source files for new lan743x driver")
    Signed-off-by: Yuiko Oshino <yuiko.oshino@microchip.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit fcda74cc95aa450a6d17780ccb1a8853cac7d0cd
Author: Yuiko Oshino <yuiko.oshino@microchip.com>
Date:   Fri Oct 22 11:13:53 2021 -0400

    net: ethernet: microchip: lan743x: Fix driver crash when lan743x_pm_resume fails
    
    commit d6423d2ec39cce2bfca418c81ef51792891576bc upstream.
    
    The driver needs to clean up and return when the initialization fails on resume.
    
    Fixes: 23f0703c125b ("lan743x: Add main source files for new lan743x driver")
    Signed-off-by: Yuiko Oshino <yuiko.oshino@microchip.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 25d852a8adf017a478246d19c8b282e975521e8a
Author: Guenter Roeck <linux@roeck-us.net>
Date:   Wed Oct 20 12:11:16 2021 -0700

    nios2: Make NIOS2_DTB_SOURCE_BOOL depend on !COMPILE_TEST
    
    commit 4a089e95b4d6bb625044d47aed0c442a8f7bd093 upstream.
    
    nios2:allmodconfig builds fail with
    
    make[1]: *** No rule to make target 'arch/nios2/boot/dts/""',
            needed by 'arch/nios2/boot/dts/built-in.a'.  Stop.
    make: [Makefile:1868: arch/nios2/boot/dts] Error 2 (ignored)
    
    This is seen with compile tests since those enable NIOS2_DTB_SOURCE_BOOL,
    which in turn enables NIOS2_DTB_SOURCE. This causes the build error
    because the default value for NIOS2_DTB_SOURCE is an empty string.
    Disable NIOS2_DTB_SOURCE_BOOL for compile tests to avoid the error.
    
    Fixes: 2fc8483fdcde ("nios2: Build infrastructure")
    Signed-off-by: Guenter Roeck <linux@roeck-us.net>
    Reviewed-by: Randy Dunlap <rdunlap@infradead.org>
    Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 02302cbd52264337630a32848ac03648648e9685
Author: Michael Chan <michael.chan@broadcom.com>
Date:   Mon Oct 25 05:05:28 2021 -0400

    net: Prevent infinite while loop in skb_tx_hash()
    
    commit 0c57eeecc559ca6bc18b8c4e2808bc78dbe769b0 upstream.
    
    Drivers call netdev_set_num_tc() and then netdev_set_tc_queue()
    to set the queue count and offset for each TC.  So the queue count
    and offset for the TCs may be zero for a short period after dev->num_tc
    has been set.  If a TX packet is being transmitted at this time in the
    code path netdev_pick_tx() -> skb_tx_hash(), skb_tx_hash() may see
    nonzero dev->num_tc but zero qcount for the TC.  The while loop that
    keeps looping while hash >= qcount will not end.
    
    Fix it by checking the TC's qcount to be nonzero before using it.
    
    Fixes: eadec877ce9c ("net: Add support for subordinate traffic classes to netdev_pick_tx")
    Reviewed-by: Andy Gospodarek <gospo@broadcom.com>
    Signed-off-by: Michael Chan <michael.chan@broadcom.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit fbf150b16a3635634b7dfb7f229d8fcd643c6c51
Author: Pavel Skripkin <paskripkin@gmail.com>
Date:   Sun Oct 24 16:13:56 2021 +0300

    net: batman-adv: fix error handling
    
    commit 6f68cd634856f8ca93bafd623ba5357e0f648c68 upstream.
    
    Syzbot reported ODEBUG warning in batadv_nc_mesh_free(). The problem was
    in wrong error handling in batadv_mesh_init().
    
    Before this patch batadv_mesh_init() was calling batadv_mesh_free() in case
    of any batadv_*_init() calls failure. This approach may work well, when
    there is some kind of indicator, which can tell which parts of batadv are
    initialized; but there isn't any.
    
    All written above lead to cleaning up uninitialized fields. Even if we hide
    ODEBUG warning by initializing bat_priv->nc.work, syzbot was able to hit
    GPF in batadv_nc_purge_paths(), because hash pointer in still NULL. [1]
    
    To fix these bugs we can unwind batadv_*_init() calls one by one.
    It is good approach for 2 reasons: 1) It fixes bugs on error handling
    path 2) It improves the performance, since we won't call unneeded
    batadv_*_free() functions.
    
    So, this patch makes all batadv_*_init() clean up all allocated memory
    before returning with an error to no call correspoing batadv_*_free()
    and open-codes batadv_mesh_free() with proper order to avoid touching
    uninitialized fields.
    
    Link: https://lore.kernel.org/netdev/000000000000c87fbd05cef6bcb0@google.com/ [1]
    Reported-and-tested-by: syzbot+28b0702ada0bf7381f58@syzkaller.appspotmail.com
    Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol")
    Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
    Acked-by: Sven Eckelmann <sven@narfation.org>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 3dae1a4eced3ee733d7222e69b8a55caf2d61091
Author: Yang Yingliang <yangyingliang@huawei.com>
Date:   Tue Oct 12 10:37:35 2021 +0800

    regmap: Fix possible double-free in regcache_rbtree_exit()
    
    commit 55e6d8037805b3400096d621091dfbf713f97e83 upstream.
    
    In regcache_rbtree_insert_to_block(), when 'present' realloc failed,
    the 'blk' which is supposed to assign to 'rbnode->block' will be freed,
    so 'rbnode->block' points a freed memory, in the error handling path of
    regcache_rbtree_init(), 'rbnode->block' will be freed again in
    regcache_rbtree_exit(), KASAN will report double-free as follows:
    
    BUG: KASAN: double-free or invalid-free in kfree+0xce/0x390
    Call Trace:
     slab_free_freelist_hook+0x10d/0x240
     kfree+0xce/0x390
     regcache_rbtree_exit+0x15d/0x1a0
     regcache_rbtree_init+0x224/0x2c0
     regcache_init+0x88d/0x1310
     __regmap_init+0x3151/0x4a80
     __devm_regmap_init+0x7d/0x100
     madera_spi_probe+0x10f/0x333 [madera_spi]
     spi_probe+0x183/0x210
     really_probe+0x285/0xc30
    
    To fix this, moving up the assignment of rbnode->block to immediately after
    the reallocation has succeeded so that the data structure stays valid even
    if the second reallocation fails.
    
    Reported-by: Hulk Robot <hulkci@huawei.com>
    Fixes: 3f4ff561bc88b ("regmap: rbtree: Make cache_present bitmap per node")
    Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
    Link: https://lore.kernel.org/r/20211012023735.1632786-1-yangyingliang@huawei.com
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit cdaf7a469244b5e65ae5eda062ff5ea90172de62
Author: Clément Bœsch <u@pkh.me>
Date:   Sun Sep 5 02:20:27 2021 +0200

    arm64: dts: allwinner: h5: NanoPI Neo 2: Fix ethernet node
    
    commit 0764e365dacd0b8f75c1736f9236be280649bd18 upstream.
    
    RX and TX delay are provided by ethernet PHY. Reflect that in ethernet
    node.
    
    Fixes: 44a94c7ef989 ("arm64: dts: allwinner: H5: Restore EMAC changes")
    Signed-off-by: Clément Bœsch <u@pkh.me>
    Reviewed-by: Jernej Skrabec <jernej.skrabec@gmail.com>
    Reviewed-by: Andrew Lunn <andrew@lunn.ch>
    Signed-off-by: Maxime Ripard <maxime@cerno.tech>
    Link: https://lore.kernel.org/r/20210905002027.171984-1-u@pkh.me
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 2864b6d54244b82a8c7d4628a43055c57bfba80c
Author: Patrisious Haddad <phaddad@nvidia.com>
Date:   Wed Oct 6 12:31:53 2021 +0300

    RDMA/mlx5: Set user priority for DCT
    
    commit 1ab52ac1e9bc9391f592c9fa8340a6e3e9c36286 upstream.
    
    Currently, the driver doesn't set the PCP-based priority for DCT, hence
    DCT response packets are transmitted without user priority.
    
    Fix it by setting user provided priority in the eth_prio field in the DCT
    context, which in turn sets the value in the transmitted packet.
    
    Fixes: 776a3906b692 ("IB/mlx5: Add support for DC target QP")
    Link: https://lore.kernel.org/r/5fd2d94a13f5742d8803c218927322257d53205c.1633512672.git.leonro@nvidia.com
    Signed-off-by: Patrisious Haddad <phaddad@nvidia.com>
    Reviewed-by: Maor Gottlieb <maorg@nvidia.com>
    Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
    Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 326da4f6ffdbd8671e86f69ded7a714dcc12fecf
Author: Johan Hovold <johan@kernel.org>
Date:   Tue Oct 26 12:36:17 2021 +0200

    net: lan78xx: fix division by zero in send path
    
    commit db6c3c064f5d55fa9969f33eafca3cdbefbb3541 upstream.
    
    Add the missing endpoint max-packet sanity check to probe() to avoid
    division by zero in lan78xx_tx_bh() in case a malicious device has
    broken descriptors (or when doing descriptor fuzz testing).
    
    Note that USB core will reject URBs submitted for endpoints with zero
    wMaxPacketSize but that drivers doing packet-size calculations still
    need to handle this (cf. commit 2548288b4fb0 ("USB: Fix: Don't skip
    endpoint descriptors with maxpacket=0")).
    
    Fixes: 55d7de9de6c3 ("Microchip's LAN7800 family USB 2/3 to 10/100/1000 Ethernet device driver")
    Cc: stable@vger.kernel.org      # 4.3
    Cc: Woojung.Huh@microchip.com <Woojung.Huh@microchip.com>
    Signed-off-by: Johan Hovold <johan@kernel.org>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 2ff5289793fd61c56ac8774408f27350e5da865f
Author: Haibo Chen <haibo.chen@nxp.com>
Date:   Fri Oct 15 10:00:36 2021 +0800

    mmc: sdhci-esdhc-imx: clear the buffer_read_ready to reset standard tuning circuit
    
    commit 9af372dc70e9fdcbb70939dac75365e7b88580b4 upstream.
    
    To reset standard tuning circuit completely, after clear ESDHC_MIX_CTRL_EXE_TUNE,
    also need to clear bit buffer_read_ready, this operation will finally clear the
    USDHC IP internal logic flag execute_tuning_with_clr_buf, make sure the following
    normal data transfer will not be impacted by standard tuning logic used before.
    
    Find this issue when do quick SD card insert/remove stress test. During standard
    tuning prodedure, if remove SD card, USDHC standard tuning logic can't clear the
    internal flag execute_tuning_with_clr_buf. Next time when insert SD card, all
    data related commands can't get any data related interrupts, include data transfer
    complete interrupt, data timeout interrupt, data CRC interrupt, data end bit interrupt.
    Always trigger software timeout issue. Even reset the USDHC through bits in register
    SYS_CTRL (0x2C, bit28 reset tuning, bit26 reset data, bit 25 reset command, bit 24
    reset all) can't recover this. From the user's point of view, USDHC stuck, SD can't
    be recognized any more.
    
    Fixes: d9370424c948 ("mmc: sdhci-esdhc-imx: reset tuning circuit when power on mmc card")
    Signed-off-by: Haibo Chen <haibo.chen@nxp.com>
    Acked-by: Adrian Hunter <adrian.hunter@intel.com>
    Cc: stable@vger.kernel.org
    Link: https://lore.kernel.org/r/1634263236-6111-1-git-send-email-haibo.chen@nxp.com
    Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 7824414c2903e2cfe56ea610387a22c0c88fb468
Author: Shawn Guo <shawn.guo@linaro.org>
Date:   Mon Oct 4 10:49:35 2021 +0800

    mmc: sdhci: Map more voltage level to SDHCI_POWER_330
    
    commit 4217d07b9fb328751f877d3bd9550122014860a2 upstream.
    
    On Thundercomm TurboX CM2290, the eMMC OCR reports vdd = 23 (3.5 ~ 3.6 V),
    which is being treated as an invalid value by sdhci_set_power_noreg().
    And thus eMMC is totally broken on the platform.
    
    [    1.436599] ------------[ cut here ]------------
    [    1.436606] mmc0: Invalid vdd 0x17
    [    1.436640] WARNING: CPU: 2 PID: 69 at drivers/mmc/host/sdhci.c:2048 sdhci_set_power_noreg+0x168/0x2b4
    [    1.436655] Modules linked in:
    [    1.436662] CPU: 2 PID: 69 Comm: kworker/u8:1 Tainted: G        W         5.15.0-rc1+ #137
    [    1.436669] Hardware name: Thundercomm TurboX CM2290 (DT)
    [    1.436674] Workqueue: events_unbound async_run_entry_fn
    [    1.436685] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
    [    1.436692] pc : sdhci_set_power_noreg+0x168/0x2b4
    [    1.436698] lr : sdhci_set_power_noreg+0x168/0x2b4
    [    1.436703] sp : ffff800010803a60
    [    1.436705] x29: ffff800010803a60 x28: ffff6a9102465f00 x27: ffff6a9101720a70
    [    1.436715] x26: ffff6a91014de1c0 x25: ffff6a91014de010 x24: ffff6a91016af280
    [    1.436724] x23: ffffaf7b1b276640 x22: 0000000000000000 x21: ffff6a9101720000
    [    1.436733] x20: ffff6a9101720370 x19: ffff6a9101720580 x18: 0000000000000020
    [    1.436743] x17: 0000000000000000 x16: 0000000000000004 x15: ffffffffffffffff
    [    1.436751] x14: 0000000000000000 x13: 00000000fffffffd x12: ffffaf7b1b84b0bc
    [    1.436760] x11: ffffaf7b1b720d10 x10: 000000000000000a x9 : ffff800010803a60
    [    1.436769] x8 : 000000000000000a x7 : 000000000000000f x6 : 00000000fffff159
    [    1.436778] x5 : 0000000000000000 x4 : 0000000000000000 x3 : 00000000ffffffff
    [    1.436787] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff6a9101718d80
    [    1.436797] Call trace:
    [    1.436800]  sdhci_set_power_noreg+0x168/0x2b4
    [    1.436805]  sdhci_set_ios+0xa0/0x7fc
    [    1.436811]  mmc_power_up.part.0+0xc4/0x164
    [    1.436818]  mmc_start_host+0xa0/0xb0
    [    1.436824]  mmc_add_host+0x60/0x90
    [    1.436830]  __sdhci_add_host+0x174/0x330
    [    1.436836]  sdhci_msm_probe+0x7c0/0x920
    [    1.436842]  platform_probe+0x68/0xe0
    [    1.436850]  really_probe.part.0+0x9c/0x31c
    [    1.436857]  __driver_probe_device+0x98/0x144
    [    1.436863]  driver_probe_device+0xc8/0x15c
    [    1.436869]  __device_attach_driver+0xb4/0x120
    [    1.436875]  bus_for_each_drv+0x78/0xd0
    [    1.436881]  __device_attach_async_helper+0xac/0xd0
    [    1.436888]  async_run_entry_fn+0x34/0x110
    [    1.436895]  process_one_work+0x1d0/0x354
    [    1.436903]  worker_thread+0x13c/0x470
    [    1.436910]  kthread+0x150/0x160
    [    1.436915]  ret_from_fork+0x10/0x20
    [    1.436923] ---[ end trace fcfac44cb045c3a8 ]---
    
    Fix the issue by mapping MMC_VDD_35_36 (and MMC_VDD_34_35) to
    SDHCI_POWER_330 as well.
    
    Signed-off-by: Shawn Guo <shawn.guo@linaro.org>
    Acked-by: Adrian Hunter <adrian.hunter@intel.com>
    Cc: stable@vger.kernel.org
    Link: https://lore.kernel.org/r/20211004024935.15326-1-shawn.guo@linaro.org
    Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 29d56f3790e684e630d56f500b59e834fa382209
Author: Jaehoon Chung <jh80.chung@samsung.com>
Date:   Fri Oct 22 17:21:06 2021 +0900

    mmc: dw_mmc: exynos: fix the finding clock sample value
    
    commit 697542bceae51f7620af333b065dd09d213629fb upstream.
    
    Even though there are candiates value if can't find best value, it's
    returned -EIO. It's not proper behavior.
    If there is not best value, use a first candiate value to work eMMC.
    
    Signed-off-by: Jaehoon Chung <jh80.chung@samsung.com>
    Tested-by: Marek Szyprowski <m.szyprowski@samsung.com>
    Tested-by: Christian Hewitt <christianshewitt@gmail.com>
    Cc: stable@vger.kernel.org
    Fixes: c537a1c5ff63 ("mmc: dw_mmc: exynos: add variable delay tuning sequence")
    Link: https://lore.kernel.org/r/20211022082106.1557-1-jh80.chung@samsung.com
    Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 24f8658690477e8983f88cbfe21fb7f4062ad837
Author: Wenbin Mei <wenbin.mei@mediatek.com>
Date:   Tue Oct 26 15:08:12 2021 +0800

    mmc: cqhci: clear HALT state after CQE enable
    
    commit 92b18252b91de567cd875f2e84722b10ab34ee28 upstream.
    
    While mmc0 enter suspend state, we need halt CQE to send legacy cmd(flush
    cache) and disable cqe, for resume back, we enable CQE and not clear HALT
    state.
    In this case MediaTek mmc host controller will keep the value for HALT
    state after CQE disable/enable flow, so the next CQE transfer after resume
    will be timeout due to CQE is in HALT state, the log as below:
    <4>.(4)[318:kworker/4:1H]mmc0: cqhci: timeout for tag 2
    <4>.(4)[318:kworker/4:1H]mmc0: cqhci: ============ CQHCI REGISTER DUMP ===========
    <4>.(4)[318:kworker/4:1H]mmc0: cqhci: Caps:      0x100020b6 | Version:  0x00000510
    <4>.(4)[318:kworker/4:1H]mmc0: cqhci: Config:    0x00001103 | Control:  0x00000001
    <4>.(4)[318:kworker/4:1H]mmc0: cqhci: Int stat:  0x00000000 | Int enab: 0x00000006
    <4>.(4)[318:kworker/4:1H]mmc0: cqhci: Int sig:   0x00000006 | Int Coal: 0x00000000
    <4>.(4)[318:kworker/4:1H]mmc0: cqhci: TDL base:  0xfd05f000 | TDL up32: 0x00000000
    <4>.(4)[318:kworker/4:1H]mmc0: cqhci: Doorbell:  0x8000203c | TCN:      0x00000000
    <4>.(4)[318:kworker/4:1H]mmc0: cqhci: Dev queue: 0x00000000 | Dev Pend: 0x00000000
    <4>.(4)[318:kworker/4:1H]mmc0: cqhci: Task clr:  0x00000000 | SSC1:     0x00001000
    <4>.(4)[318:kworker/4:1H]mmc0: cqhci: SSC2:      0x00000001 | DCMD rsp: 0x00000000
    <4>.(4)[318:kworker/4:1H]mmc0: cqhci: RED mask:  0xfdf9a080 | TERRI:    0x00000000
    <4>.(4)[318:kworker/4:1H]mmc0: cqhci: Resp idx:  0x00000000 | Resp arg: 0x00000000
    <4>.(4)[318:kworker/4:1H]mmc0: cqhci: CRNQP:     0x00000000 | CRNQDUN:  0x00000000
    <4>.(4)[318:kworker/4:1H]mmc0: cqhci: CRNQIS:    0x00000000 | CRNQIE:   0x00000000
    
    This change check HALT state after CQE enable, if CQE is in HALT state, we
    will clear it.
    
    Signed-off-by: Wenbin Mei <wenbin.mei@mediatek.com>
    Cc: stable@vger.kernel.org
    Acked-by: Adrian Hunter <adrian.hunter@intel.com>
    Fixes: a4080225f51d ("mmc: cqhci: support for command queue enabled host")
    Link: https://lore.kernel.org/r/20211026070812.9359-1-wenbin.mei@mediatek.com
    Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 99641238575c26c2e47fa593f562dae476709d68
Author: Johan Hovold <johan@kernel.org>
Date:   Mon Oct 25 13:56:08 2021 +0200

    mmc: vub300: fix control-message timeouts
    
    commit 8c8171929116cc23f74743d99251eedadf62341a upstream.
    
    USB control-message timeouts are specified in milliseconds and should
    specifically not vary with CONFIG_HZ.
    
    Fixes: 88095e7b473a ("mmc: Add new VUB300 USB-to-SD/SDIO/MMC driver")
    Cc: stable@vger.kernel.org      # 3.0
    Signed-off-by: Johan Hovold <johan@kernel.org>
    Link: https://lore.kernel.org/r/20211025115608.5287-1-johan@kernel.org
    Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c6d0d68d6da68159948cad3d808d61bb291a0283
Author: Eric Dumazet <edumazet@google.com>
Date:   Sun Aug 29 15:16:14 2021 -0700

    ipv6: make exception cache less predictible
    
    commit a00df2caffed3883c341d5685f830434312e4a43 upstream.
    
    Even after commit 4785305c05b2 ("ipv6: use siphash in rt6_exception_hash()"),
    an attacker can still use brute force to learn some secrets from a victim
    linux host.
    
    One way to defeat these attacks is to make the max depth of the hash
    table bucket a random value.
    
    Before this patch, each bucket of the hash table used to store exceptions
    could contain 6 items under attack.
    
    After the patch, each bucket would contains a random number of items,
    between 6 and 10. The attacker can no longer infer secrets.
    
    This is slightly increasing memory size used by the hash table,
    we do not expect this to be a problem.
    
    Following patch is dealing with the same issue in IPv4.
    
    Fixes: 35732d01fe31 ("ipv6: introduce a hash table to store dst cache")
    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Reported-by: Keyu Man <kman001@ucr.edu>
    Cc: Wei Wang <weiwan@google.com>
    Cc: Martin KaFai Lau <kafai@fb.com>
    Reviewed-by: David Ahern <dsahern@kernel.org>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    [OP: adjusted context for 4.19 stable]
    Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ad829847ad59af8e26a1f1c345716099abbc7a58
Author: Eric Dumazet <edumazet@google.com>
Date:   Fri Oct 29 10:50:26 2021 +0300

    ipv6: use siphash in rt6_exception_hash()
    
    commit 4785305c05b25a242e5314cc821f54ade4c18810 upstream.
    
    A group of security researchers brought to our attention
    the weakness of hash function used in rt6_exception_hash()
    
    Lets use siphash instead of Jenkins Hash, to considerably
    reduce security risks.
    
    Following patch deals with IPv4.
    
    Fixes: 35732d01fe31 ("ipv6: introduce a hash table to store dst cache")
    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Reported-by: Keyu Man <kman001@ucr.edu>
    Cc: Wei Wang <weiwan@google.com>
    Cc: Martin KaFai Lau <kafai@fb.com>
    Acked-by: Wei Wang <weiwan@google.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    [OP: adjusted context for 4.19 stable]
    Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 6e2856767eb1a9cfcfcd82136928037f04920e97
Author: Eric Dumazet <edumazet@google.com>
Date:   Fri Oct 29 10:50:25 2021 +0300

    ipv4: use siphash instead of Jenkins in fnhe_hashfun()
    
    commit 6457378fe796815c973f631a1904e147d6ee33b1 upstream.
    
    A group of security researchers brought to our attention
    the weakness of hash function used in fnhe_hashfun().
    
    Lets use siphash instead of Jenkins Hash, to considerably
    reduce security risks.
    
    Also remove the inline keyword, this really is distracting.
    
    Fixes: d546c621542d ("ipv4: harden fnhe_hashfun()")
    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Reported-by: Keyu Man <kman001@ucr.edu>
    Cc: Willy Tarreau <w@1wt.eu>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    [OP: adjusted context for 4.19 stable]
    Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 8121d0d4fd108280f5cd7b7fe8c6592adaa37be9
Author: Pavel Skripkin <paskripkin@gmail.com>
Date:   Thu Sep 30 20:49:42 2021 +0300

    Revert "net: mdiobus: Fix memory leak in __mdiobus_register"
    
    commit 10eff1f5788b6ffac212c254e2f3666219576889 upstream.
    
    This reverts commit ab609f25d19858513919369ff3d9a63c02cd9e2e.
    
    This patch is correct in the sense that we _should_ call device_put() in
    case of device_register() failure, but the problem in this code is more
    vast.
    
    We need to set bus->state to UNMDIOBUS_REGISTERED before calling
    device_register() to correctly release the device in mdiobus_free().
    This patch prevents us from doing it, since in case of device_register()
    failure put_device() will be called 2 times and it will cause UAF or
    something else.
    
    Also, Reported-by: tag in revered commit was wrong, since syzbot
    reported different leak in same function.
    
    Link: https://lore.kernel.org/netdev/20210928092657.GI2048@kadam/
    Acked-by: Yanfei Xu <yanfei.xu@windriver.com>
    Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
    Link: https://lore.kernel.org/r/f12fb1faa4eccf0f355788225335eb4309ff2599.1633024062.git.paskripkin@gmail.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 4a9043ba1b0e9bea1da0fe34366222974f2c0f92
Author: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Date:   Mon Oct 25 16:49:36 2021 +0200

    nfc: port100: fix using -ERRNO as command type mask
    
    commit 2195f2062e4cc93870da8e71c318ef98a1c51cef upstream.
    
    During probing, the driver tries to get a list (mask) of supported
    command types in port100_get_command_type_mask() function.  The value
    is u64 and 0 is treated as invalid mask (no commands supported).  The
    function however returns also -ERRNO as u64 which will be interpret as
    valid command mask.
    
    Return 0 on every error case of port100_get_command_type_mask(), so the
    probing will stop.
    
    Cc: <stable@vger.kernel.org>
    Fixes: 0347a6ab300a ("NFC: port100: Commands mechanism implementation")
    Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a36119f9b3fb069437383a8eff4e65181b6e7e2f
Author: Zheyu Ma <zheyuma97@gmail.com>
Date:   Fri Oct 22 09:12:26 2021 +0000

    ata: sata_mv: Fix the error handling of mv_chip_id()
    
    commit a0023bb9dd9bc439d44604eeec62426a990054cd upstream.
    
    mv_init_host() propagates the value returned by mv_chip_id() which in turn
    gets propagated by mv_pci_init_one() and hits local_pci_probe().
    
    During the process of driver probing, the probe function should return < 0
    for failure, otherwise, the kernel will treat value > 0 as success.
    
    Since this is a bug rather than a recoverable runtime error we should
    use dev_alert() instead of dev_err().
    
    Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
    Signed-off-by: Damien Le Moal <damien.lemoal@opensource.wdc.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 78c2dc1cdf0bdfc83e473d78f23da4d2aeb98142
Author: Wang Hai <wanghai38@huawei.com>
Date:   Tue Oct 26 20:40:15 2021 +0800

    usbnet: fix error return code in usbnet_probe()
    
    commit 6f7c88691191e6c52ef2543d6f1da8d360b27a24 upstream.
    
    Return error code if usb_maxpacket() returns 0 in usbnet_probe()
    
    Fixes: 397430b50a36 ("usbnet: sanity check for maxpacket")
    Reported-by: Hulk Robot <hulkci@huawei.com>
    Signed-off-by: Wang Hai <wanghai38@huawei.com>
    Reviewed-by: Johan Hovold <johan@kernel.org>
    Link: https://lore.kernel.org/r/20211026124015.3025136-1-wanghai38@huawei.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 002d82227c0abe29118cf80f7e2f396b22d448ed
Author: Oliver Neukum <oneukum@suse.com>
Date:   Thu Oct 21 14:29:44 2021 +0200

    usbnet: sanity check for maxpacket
    
    commit 397430b50a363d8b7bdda00522123f82df6adc5e upstream.
    
    maxpacket of 0 makes no sense and oopses as we need to divide
    by it. Give up.
    
    V2: fixed typo in log and stylistic issues
    
    Signed-off-by: Oliver Neukum <oneukum@suse.com>
    Reported-by: syzbot+76bb1d34ffa0adc03baa@syzkaller.appspotmail.com
    Reviewed-by: Johan Hovold <johan@kernel.org>
    Link: https://lore.kernel.org/r/20211021122944.21816-1-oneukum@suse.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d725978abb0bac6e0c427548dfd6db86709a2a1e
Author: Nathan Chancellor <nathan@kernel.org>
Date:   Sat Jan 5 19:35:25 2019 +0100

    ARM: 8819/1: Remove '-p' from LDFLAGS
    
    commit 091bb549f7722723b284f63ac665e2aedcf9dec9 upstream.
    
    This option is not supported by lld:
    
        ld.lld: error: unknown argument: -p
    
    This has been a no-op in binutils since 2004 (see commit dea514f51da1 in
    that tree). Given that the lowest officially supported of binutils for
    the kernel is 2.20, which was released in 2009, nobody needs this flag
    around so just remove it. Commit 1a381d4a0a9a ("arm64: remove no-op -p
    linker flag") did the same for arm64.
    
    Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
    Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
    Acked-by: Nicolas Pitre <nico@linaro.org>
    Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
    Reviewed-by: Stefan Agner <stefan@agner.ch>
    Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit aaf4e1b05cab800b36b40c1aa09f7c13ef30de56
Author: Robin Murphy <robin.murphy@arm.com>
Date:   Mon Jul 12 15:27:46 2021 +0100

    arm64: Avoid premature usercopy failure
    
    commit 295cf156231ca3f9e3a66bde7fab5e09c41835e0 upstream.
    
    Al reminds us that the usercopy API must only return complete failure
    if absolutely nothing could be copied. Currently, if userspace does
    something silly like giving us an unaligned pointer to Device memory,
    or a size which overruns MTE tag bounds, we may fail to honour that
    requirement when faulting on a multi-byte access even though a smaller
    access could have succeeded.
    
    Add a mitigation to the fixup routines to fall back to a single-byte
    copy if we faulted on a larger access before anything has been written
    to the destination, to guarantee making *some* forward progress. We
    needn't be too concerned about the overall performance since this should
    only occur when callers are doing something a bit dodgy in the first
    place. Particularly broken userspace might still be able to trick
    generic_perform_write() into an infinite loop by targeting write() at
    an mmap() of some read-only device register where the fault-in load
    succeeds but any store synchronously aborts such that copy_to_user() is
    genuinely unable to make progress, but, well, don't do that...
    
    CC: stable@vger.kernel.org
    Reported-by: Chen Huang <chenhuang5@huawei.com>
    Suggested-by: Al Viro <viro@zeniv.linux.org.uk>
    Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
    Signed-off-by: Robin Murphy <robin.murphy@arm.com>
    Link: https://lore.kernel.org/r/dc03d5c675731a1f24a62417dba5429ad744234e.1626098433.git.robin.murphy@arm.com
    Signed-off-by: Will Deacon <will@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Chen Huang <chenhuang5@huawei.com>

commit 5909b851b5e11d04f299e5f0a8937e9dcc807248
Author: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
Date:   Wed Oct 6 01:55:22 2021 +0530

    powerpc/bpf: Fix BPF_MOD when imm == 1
    
    commit 8bbc9d822421d9ac8ff9ed26a3713c9afc69d6c8 upstream.
    
    Only ignore the operation if dividing by 1.
    
    Fixes: 156d0e290e969c ("powerpc/ebpf/jit: Implement JIT compiler for extended BPF")
    Signed-off-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
    Tested-by: Johan Almbladh <johan.almbladh@anyfinetworks.com>
    Reviewed-by: Christophe Leroy <christophe.leroy@csgroup.eu>
    Acked-by: Song Liu <songliubraving@fb.com>
    Acked-by: Johan Almbladh <johan.almbladh@anyfinetworks.com>
    Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
    Link: https://lore.kernel.org/r/c674ca18c3046885602caebb326213731c675d06.1633464148.git.naveen.n.rao@linux.vnet.ibm.com
    [cascardo: use PPC_LI instead of EMIT(PPC_RAW_LI)]
    Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 901741a53d7cf45be861e881c0e3cba5b4bd1f94
Author: Arnd Bergmann <arnd@arndb.de>
Date:   Mon Oct 18 15:30:37 2021 +0100

    ARM: 9141/1: only warn about XIP address when not compile testing
    
    commit 48ccc8edf5b90622cdc4f8878e0042ab5883e2ca upstream.
    
    In randconfig builds, we sometimes come across this warning:
    
    arm-linux-gnueabi-ld: XIP start address may cause MPU programming issues
    
    While this is helpful for actual systems to figure out why it
    fails, the warning does not provide any benefit for build testing,
    so guard it in a check for CONFIG_COMPILE_TEST, which is usually
    set on randconfig builds.
    
    Fixes: 216218308cfb ("ARM: 8713/1: NOMMU: Support MPU in XIP configuration")
    Signed-off-by: Arnd Bergmann <arnd@arndb.de>
    Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ee4b38ce37ed31beca29d3ebec7db3d5e87fe39e
Author: Arnd Bergmann <arnd@arndb.de>
Date:   Mon Oct 18 15:30:09 2021 +0100

    ARM: 9139/1: kprobes: fix arch_init_kprobes() prototype
    
    commit 1f323127cab086e4fd618981b1e5edc396eaf0f4 upstream.
    
    With extra warnings enabled, gcc complains about this function
    definition:
    
    arch/arm/probes/kprobes/core.c: In function 'arch_init_kprobes':
    arch/arm/probes/kprobes/core.c:465:12: warning: old-style function definition [-Wold-style-definition]
      465 | int __init arch_init_kprobes()
    
    Link: https://lore.kernel.org/all/20201027093057.c685a14b386acacb3c449e3d@kernel.org/
    
    Fixes: 24ba613c9d6c ("ARM kprobes: core code")
    Acked-by: Masami Hiramatsu <mhiramat@kernel.org>
    Signed-off-by: Arnd Bergmann <arnd@arndb.de>
    Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c0b4f1db7feef31d401814121760b45aff7885c1
Author: Arnd Bergmann <arnd@arndb.de>
Date:   Mon Oct 18 15:30:04 2021 +0100

    ARM: 9134/1: remove duplicate memcpy() definition
    
    commit eaf6cc7165c9c5aa3c2f9faa03a98598123d0afb upstream.
    
    Both the decompressor code and the kasan logic try to override
    the memcpy() and memmove()  definitions, which leading to a clash
    in a KASAN-enabled kernel with XZ decompression:
    
    arch/arm/boot/compressed/decompress.c:50:9: error: 'memmove' macro redefined [-Werror,-Wmacro-redefined]
     #define memmove memmove
            ^
    arch/arm/include/asm/string.h:59:9: note: previous definition is here
     #define memmove(dst, src, len) __memmove(dst, src, len)
            ^
    arch/arm/boot/compressed/decompress.c:51:9: error: 'memcpy' macro redefined [-Werror,-Wmacro-redefined]
     #define memcpy memcpy
            ^
    arch/arm/include/asm/string.h:58:9: note: previous definition is here
     #define memcpy(dst, src, len) __memcpy(dst, src, len)
            ^
    
    Here we want the set of functions from the decompressor, so undefine
    the other macros before the override.
    
    Link: https://lore.kernel.org/linux-arm-kernel/CACRpkdZYJogU_SN3H9oeVq=zJkRgRT1gDz3xp59gdqWXxw-B=w@mail.gmail.com/
    Link: https://lore.kernel.org/lkml/202105091112.F5rmd4By-lkp@intel.com/
    
    Fixes: d6d51a96c7d6 ("ARM: 9014/2: Replace string mem* functions for KASan")
    Fixes: a7f464f3db93 ("ARM: 7001/2: Wire up support for the XZ decompressor")
    Reported-by: kernel test robot <lkp@intel.com>
    Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
    Signed-off-by: Arnd Bergmann <arnd@arndb.de>
    Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 00dcbb2d2cd3594faa2f977f2f7175cf23d4e326
Author: Nick Desaulniers <ndesaulniers@google.com>
Date:   Mon Oct 4 18:03:28 2021 +0100

    ARM: 9133/1: mm: proc-macros: ensure *_tlb_fns are 4B aligned
    
    commit e6a0c958bdf9b2e1b57501fc9433a461f0a6aadd upstream.
    
    A kernel built with CONFIG_THUMB2_KERNEL=y and using clang as the
    assembler could generate non-naturally-aligned v7wbi_tlb_fns which
    results in a boot failure. The original commit adding the macro missed
    the .align directive on this data.
    
    Link: https://github.com/ClangBuiltLinux/linux/issues/1447
    Link: https://lore.kernel.org/all/0699da7b-354f-aecc-a62f-e25693209af4@linaro.org/
    Debugged-by: Ard Biesheuvel <ardb@kernel.org>
    Debugged-by: Nathan Chancellor <nathan@kernel.org>
    Debugged-by: Richard Henderson <richard.henderson@linaro.org>
    
    Fixes: 66a625a88174 ("ARM: mm: proc-macros: Add generic proc/cache/tlb struct definition macros")
    Suggested-by: Ard Biesheuvel <ardb@kernel.org>
    Acked-by: Ard Biesheuvel <ardb@kernel.org>
    Signed-off-by: Nick Desaulniers <ndesaulniers@google.com>
    Tested-by: Nathan Chancellor <nathan@kernel.org>
    Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>