Pull JFFS2, UBI and UBIFS updates from Richard Weinberger:
 "JFFS2:
   - Fix for a corner case while mounting
   - Fix for an use-after-free issue

  UBI:
   - Fix for a memory load while attaching
   - Don't produce an anchor PEB with fastmap being disabled

  UBIFS:
   - Fix for orphan inode logic
   - Spelling fixes
   - New mount option to specify filesystem version"

* tag 'for-linus-5.9-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/ubifs:
  jffs2: fix UAF problem
  jffs2: fix jffs2 mounting failure
  ubifs: Fix wrong orphan node deletion in ubifs_jnl_update|rename
  ubi: fastmap: Free fastmap next anchor peb during detach
  ubi: fastmap: Don't produce the initial next anchor PEB when fastmap is disabled
  ubifs: misc.h: delete a duplicated word
  ubifs: add option to specify version for new file systems

Pull mtd updates from Miquel Raynal:
 "MTD core changes:
   - Spelling
   - http to https updates

  NAND core changes:
   - Drop useless 'depends on' in Kconfig
   - Add an extra level in the Kconfig hierarchy
   - Trivial spellings
   - Dynamic allocation of the interface configurations
   - Dropping the default ONFI timing mode
   - Various cleanup (types, structures, naming, comments)
   - Hide the chip->data_interface indirection
   - Add the generic rb-gpios property
   - Add the ->choose_interface_config() hook
   - Introduce nand_choose_best_sdr_timings()
   - Use default values for tPROG_max and tBERS_max
   - Avoid redefining tR_max and tCCS_min
   - Add a helper to find the closest ONFI mode
   - bcm63xx MTD parsers: simplify CFE detection

  Raw NAND controller drivers changes:
   - fsl-upm: Deprecation of specific DT properties
   - fsl_upm: Driver rework and cleanup in favor of ->exec_op()
   - Ingenic: Cleanup ARRAY_SIZE() vs sizeof() use
   - brcmnand: ECC error handling on EDU transfers
   - brcmnand: Don't default to EDU transfers
   - qcom: Set BAM mode only if not set already
   - qcom: Avoid write to unavailable register
   - gpio: Driver rework in favor of ->exec_op()
   - tango: ->exec_op() conversion
   - mtk: ->exec_op() conversion

  Raw NAND chip drivers changes:
   - toshiba: Implement ->choose_interface_config() for TH58NVG2S3HBAI4,
     TC58NVG0S3E, and TC58TEG5DCLTA00
   - hynix: Implement ->choose_interface_config() for H27UCG8T2ATR-BC

  SPI NOR core changes:
   - Disable Quad Mode in spi_nor_restore().
   - Don't abort BFPT parsing when QER reserved value is used.
   - Add support/update capabilities for few flashes.
   - Drop s70fl01gs flash: it does not support RDSR(05h) which is
     critical for erase/write.
   - Merge the SPIMEM DTR bits in spi-nor/next to avoid conflicts during
     the release cycle.

  SPI NOR controller drivers changes:
   - Move the cadence-quadspi driver to spi-mem. The series was taken
     through the SPI tree. Merge it also in spi-nor/next to avoid
     conflicts during the release cycle.
   - intel-spi:
      - Add new PCI IDs.
      - Ignore the Write Disable command, the controller doesn't support
        it.
      - Fix performance regression"

* tag 'mtd/for-5.9' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux: (79 commits)
  MTD: pfow.h: drop a duplicated word
  MTD: mtd-abi.h: drop a duplicated word
  mtd: rawnand: omap_elm: Replace HTTP links with HTTPS ones
  mtd: Replace HTTP links with HTTPS ones
  mtd: hyperbus: Replace HTTP links with HTTPS ones
  mtd: revert "spi-nor: intel: provide a range for poll_timout"
  mtd: spi-nor: update read capabilities for w25q64 and s25fl064k
  mtd: spi-nor: micron: Add SPI_NOR_DUAL_READ flag on mt25qu02g
  mtd: spi-nor: macronix: Add support for mx66u2g45g
  mtd: spi-nor: intel-spi: Simulate WRDI command
  mtd: spi-nor: Disable the flash quad mode in spi_nor_restore()
  mtd: spi-nor: Add capability to disable flash quad mode
  mtd: spi-nor: spansion: Remove s70fl01gs from flash_info
  mtd: spi-nor: sfdp: do not make invalid quad enable fatal
  dt-bindings: mtd: fsl-upm-nand: Deprecate chip-delay and fsl, upm-wait-flags
  mtd: rawnand: stm32_fmc2: get resources from parent node
  mtd: rawnand: stm32_fmc2: use regmap APIs
  memory: stm32-fmc2-ebi: add STM32 FMC2 EBI controller driver
  dt-bindings: memory-controller: add STM32 FMC2 EBI controller documentation
  dt-bindings: mtd: update STM32 FMC2 NAND controller documentation
  ...

Pull misc vfs updates from Al Viro:
 "No common topic whatsoever in those, sorry"

* 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
  fs: define inode flags using bit numbers
  iov_iter: Move unnecessary inclusion of crypto/hash.h
  dlmfs: clean up dlmfs_file_{read,write}() a bit

Core changes:
* Drop useless 'depends on' in Kconfig
* Add an extra level in the Kconfig hierarchy
* Trivial spellings
* Dynamic allocation of the interface configurations
* Dropping the default ONFI timing mode
* Various cleanup (types, structures, naming, comments)
* Hide the chip->data_interface indirection
* Add the generic rb-gpios property
* Add the ->choose_interface_config() hook
* Introduce nand_choose_best_sdr_timings()
* Use default values for tPROG_max and tBERS_max
* Avoid redefining tR_max and tCCS_min
* Add a helper to find the closest ONFI mode
* bcm63xx MTD parsers: simplify CFE detection

Raw NAND controller drivers changes:
* fsl-upm: Deprecation of specific DT properties
* fsl_upm: Driver rework and cleanup in favor of ->exec_op()
* Ingenic: Cleanup ARRAY_SIZE() vs sizeof() use
* brcmnand: ECC error handling on EDU transfers
* brcmnand: Don't default to EDU transfers
* qcom: Set BAM mode only if not set already
* qcom: Avoid write to unavailable register
* gpio: Driver rework in favor of ->exec_op()
* tango: ->exec_op() conversion
* mtk: ->exec_op() conversion

Raw NAND chip drivers changes:
* toshiba: Implement ->choose_interface_config() for TH58NVG2S3HBAI4
* toshiba: Implement ->choose_interface_config() for TC58NVG0S3E
* toshiba: Implement ->choose_interface_config() for TC58TEG5DCLTA00
* hynix: Implement ->choose_interface_config() for H27UCG8T2ATR-BC

Pull uninitialized_var() macro removal from Kees Cook:
 "This is long overdue, and has hidden too many bugs over the years. The
  series has several "by hand" fixes, and then a trivial treewide
  replacement.

   - Clean up non-trivial uses of uninitialized_var()

   - Update documentation and checkpatch for uninitialized_var() removal

   - Treewide removal of uninitialized_var()"

* tag 'uninit-macro-v5.9-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
  compiler: Remove uninitialized_var() macro
  treewide: Remove uninitialized_var() usage
  checkpatch: Remove awareness of uninitialized_var() macro
  mm/debug_vm_pgtable: Remove uninitialized_var() usage
  f2fs: Eliminate usage of uninitialized_var() macro
  media: sur40: Remove uninitialized_var() usage
  KVM: PPC: Book3S PR: Remove uninitialized_var() usage
  clk: spear: Remove uninitialized_var() usage
  clk: st: Remove uninitialized_var() usage
  spi: davinci: Remove uninitialized_var() usage
  ide: Remove uninitialized_var() usage
  rtlwifi: rtl8192cu: Remove uninitialized_var() usage
  b43: Remove uninitialized_var() usage
  drbd: Remove uninitialized_var() usage
  x86/mm/numa: Remove uninitialized_var() usage
  docs: deprecated.rst: Add uninitialized_var()

Pull spi updates from Mark Brown:
 "A fairly quiet release for SPI, nothing really going on in the core
  although there's been quite a bit of driver related activity.

  This includes the addition of some shared code in drivers/memory for
  the Renesas RPC-IF which is used by a newly added SPI driver, the
  memory subsystem doesn't seem to have a fixed maintainer at the minute
  and this seemed like the most sensible way to get that hardware
  supported.

   - Quite a few cleanups and optimizations for the Altera, Qualcomm
     GENI, sun6i and lantiq drivers.

   - Several more GPIO descriptor conversions.

   - Move the Cadence QuadSPI driver from drivers/mtd to drivers/spi.

   - New support for Mediatek MT8192 and Renesas RPC-IF, R8A7742 and
     R8A774e1"

* tag 'spi-v5.9' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: (119 commits)
  dt-bindings: lpspi: New property in document DT bindings for LPSPI
  spi: lpspi: fix using CS discontinuously on i.MX8DXLEVK
  spi: lpspi: remove unused fsl_lpspi->chipselect
  spi: lpspi: Fix kernel warning dump when probe fail after calling spi_register
  spi: rockchip: Fix error in SPI slave pio read
  spi: rockchip: Support 64-location deep FIFOs
  spi: rockchip: Config spi rx dma burst size depend on xfer length
  spi: spi-topcliff-pch: drop call to wakeup-disable
  spi: spidev: Align buffers for DMA
  spi: correct kernel-doc inconsistency
  spi: sun4i: update max transfer size reported
  spi: imx: enable runtime pm support
  spi: update bindings for MT8192 SoC
  spi: mediatek: add spi support for mt8192 IC
  spi: Add bindings for Lightning Mountain SoC
  spi: lantiq: Add support to Lightning Mountain SoC
  spi: lantiq: Move interrupt configuration to SoC specific data structure
  spi: lantiq: Add fifo size bit mask in SoC specific data structure
  spi: lantiq: Add support to acknowledge interrupt
  spi: lantiq: Move interrupt control register offesets to SoC specific data structure
  ...

ubi_wl_entry related with the fm_next_anchor PEB is not freed during
detach, which causes a memory leak.
Don't forget to release fm_next_anchor PEB while detaching ubi from
mtd when CONFIG_MTD_UBI_FASTMAP is enabled.

Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
Fixes: 4b68bf9a69d22d ("ubi: Select fastmap anchor PEBs considering...")
Signed-off-by: Richard Weinberger <richard@nod.at>

Following process triggers a memleak caused by forgetting to release the
initial next anchor PEB (CONFIG_MTD_UBI_FASTMAP is disabled):
1. attach -> __erase_worker -> produce the initial next anchor PEB
2. detach -> ubi_fastmap_close (Do nothing, it should have released the
   initial next anchor PEB)

Don't produce the initial next anchor PEB in __erase_worker() when fastmap
is disabled.

Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
Suggested-by: Sascha Hauer <s.hauer@pengutronix.de>
Fixes: f9c34bb529975fe ("ubi: Fix producing anchor PEBs")
Reported-by: syzbot+d9aab50b1154e3d163f5@syzkaller.appspotmail.com
Signed-off-by: Richard Weinberger <richard@nod.at>

Rationale:
Reduces attack surface on kernel devs opening the links for MITM
as HTTPS traffic is much harder to manipulate.

Deterministic algorithm:
For each file:
  If not .svg:
    For each line:
      If doesn't contain `\bxmlns\b`:
        For each link, `\bhttp://[^# \t\r\n]*(?:\w|/)`:
	  If neither `\bgnu\.org/license`, nor `\bmozilla\.org/MPL\b`:
            If both the HTTP and HTTPS versions
            return 200 OK and serve the same content:
              Replace HTTP with HTTPS.

Signed-off-by: Alexander A. Klimov <grandmaster@al2klimov.de>
Signed-off-by: Richard Weinberger <richard@nod.at>

Rationale:
Reduces attack surface on kernel devs opening the links for MITM
as HTTPS traffic is much harder to manipulate.

Deterministic algorithm:
For each file:
  If not .svg:
    For each line:
      If doesn't contain `\bxmlns\b`:
        For each link, `\bhttp://[^# \t\r\n]*(?:\w|/)`:
	  If neither `\bgnu\.org/license`, nor `\bmozilla\.org/MPL\b`:
            If both the HTTP and HTTPS versions
            return 200 OK and serve the same content:
              Replace HTTP with HTTPS.

Signed-off-by: Alexander A. Klimov <grandmaster@al2klimov.de>
Acked-by: Rob Herring <robh@kernel.org>
Signed-off-by: Richard Weinberger <richard@nod.at>