All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH 4.19 000/346] 4.19.164-rc1 review
@ 2020-12-28 12:45 Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 4.19 001/346] Kbuild: do not emit debug info for assembly with LLVM_IAS=1 Greg Kroah-Hartman
                   ` (348 more replies)
  0 siblings, 349 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, torvalds, akpm, linux, shuah, patches,
	lkft-triage, pavel, stable

This is the start of the stable review cycle for the 4.19.164 release.
There are 346 patches in this series, all will be posted as a response
to this one.  If anyone has any issues with these being applied, please
let me know.

Responses should be made by Wed, 30 Dec 2020 12:48:23 +0000.
Anything received after that time might be too late.

The whole patch series can be found in one patch at:
	https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.164-rc1.gz
or in the git tree and branch at:
	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Linux 4.19.164-rc1

Jubin Zhong <zhongjubin@huawei.com>
    PCI: Fix pci_slot_release() NULL pointer dereference

Carlos Garnacho <carlosg@gnome.org>
    platform/x86: intel-vbtn: Allow switch events on Acer Switch Alpha 12

Dan Williams <dan.j.williams@intel.com>
    libnvdimm/namespace: Fix reaping of invalidated block-window-namespace labels

SeongJae Park <sjpark@amazon.de>
    xenbus/xenbus_backend: Disallow pending watch messages

SeongJae Park <sjpark@amazon.de>
    xen/xenbus: Count pending messages for each watch

SeongJae Park <sjpark@amazon.de>
    xen/xenbus/xen_bus_type: Support will_handle watch callback

SeongJae Park <sjpark@amazon.de>
    xen/xenbus: Add 'will_handle' callback support in xenbus_watch_path()

SeongJae Park <sjpark@amazon.de>
    xen/xenbus: Allow watches discard events before queueing

Pawel Wieczorkiewicz <wipawel@amazon.de>
    xen-blkback: set ring->xenblkd to NULL after kthread_stop()

Terry Zhou <bjzhou@marvell.com>
    clk: mvebu: a3700: fix the XTAL MODE pin to MPP1_9

Yangtao Li <frank@allwinnertech.com>
    pinctrl: sunxi: Always call chained_irq_{enter, exit} in sunxi_pinctrl_irq_handler

Zhao Heming <heming.zhao@suse.com>
    md/cluster: fix deadlock when node is doing resync job

Zhao Heming <heming.zhao@suse.com>
    md/cluster: block reshape with remote resync job

Jonathan Cameron <Jonathan.Cameron@huawei.com>
    iio:imu:bmi160: Fix too large a buffer.

Jonathan Cameron <Jonathan.Cameron@huawei.com>
    iio:pressure:mpl3115: Force alignment of buffer

Jonathan Cameron <Jonathan.Cameron@huawei.com>
    iio:light:st_uvis25: Fix timestamp alignment and prevent data leak.

Jonathan Cameron <Jonathan.Cameron@huawei.com>
    iio:light:rpr0521: Fix timestamp alignment and prevent data leak.

Qinglang Miao <miaoqinglang@huawei.com>
    iio: adc: rockchip_saradc: fix missing clk_disable_unprepare() on error in rockchip_saradc_resume

Nuno Sá <nuno.sa@analog.com>
    iio: buffer: Fix demux update

James Smart <james.smart@broadcom.com>
    scsi: lpfc: Re-fix use after free in lpfc_rq_buf_free()

James Smart <james.smart@broadcom.com>
    scsi: lpfc: Fix invalid sleeping context in lpfc_sli4_nvmet_alloc()

Praveenkumar I <ipkumar@codeaurora.org>
    mtd: rawnand: qcom: Fix DMA sync on FLASH_STATUS register read

Sven Eckelmann <sven@narfation.org>
    mtd: parser: cmdline: Fix parsing of part-names with colons

Miquel Raynal <miquel.raynal@bootlin.com>
    mtd: spinand: Fix OOB read

Evan Green <evgreen@chromium.org>
    soc: qcom: smp2p: Safely acquire spinlock without IRQs

Qinglang Miao <miaoqinglang@huawei.com>
    spi: mt7621: fix missing clk_disable_unprepare() on error in mt7621_spi_probe

Lukas Wunner <lukas@wunner.de>
    spi: st-ssc4: Fix unbalanced pm_runtime_disable() in probe error path

Lukas Wunner <lukas@wunner.de>
    spi: sc18is602: Don't leak SPI master in probe error path

Lukas Wunner <lukas@wunner.de>
    spi: rb4xx: Don't leak SPI master in probe error path

Lukas Wunner <lukas@wunner.de>
    spi: pic32: Don't leak DMA channels in probe error path

Lukas Wunner <lukas@wunner.de>
    spi: davinci: Fix use-after-free on unbind

Lukas Wunner <lukas@wunner.de>
    spi: spi-sh: Fix use-after-free on unbind

Zwane Mwaikambo <zwane@yosper.io>
    drm/dp_aux_dev: check aux_dev before use in drm_dp_aux_dev_get_by_minor()

Dave Kleikamp <dave.kleikamp@oracle.com>
    jfs: Fix array index bounds check in dbAdjTree

Zhe Li <lizhe67@huawei.com>
    jffs2: Fix GC exit abnormally

Richard Weinberger <richard@nod.at>
    ubifs: wbuf: Don't leak kernel memory to flash

Steve French <stfrench@microsoft.com>
    SMB3.1.1: do not log warning message if server doesn't populate salt

Steve French <stfrench@microsoft.com>
    SMB3: avoid confusing warning message on mount to Azure

Luis Henriques <lhenriques@suse.de>
    ceph: fix race in concurrent __ceph_remove_cap invocations

Roberto Sassu <roberto.sassu@huawei.com>
    ima: Don't modify file descriptor mode on the fly

David Hildenbrand <david@redhat.com>
    powerpc/powernv/memtrace: Fix crashing the kernel when enabling concurrently

David Hildenbrand <david@redhat.com>
    powerpc/powernv/memtrace: Don't leak kernel memory to user space

Christophe Leroy <christophe.leroy@csgroup.eu>
    powerpc/xmon: Change printk() to pr_cont()

Tyrel Datwyler <tyreld@linux.ibm.com>
    powerpc/rtas: Fix typo of ibm,open-errinjct in RTAS filter

Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
    powerpc: Fix incorrect stw{, ux, u, x} instructions in __set_pte_at

Nicolas Ferre <nicolas.ferre@microchip.com>
    ARM: dts: at91: sama5d2: fix CAN message ram offset and size

H. Nikolaus Schaller <hns@goldelico.com>
    ARM: dts: pandaboard: fix pinmux for gpio user button of Pandaboard ES

Marc Zyngier <maz@kernel.org>
    KVM: arm64: Introduce handling of AArch32 TTBCR2 traps

Jan Kara <jack@suse.cz>
    ext4: fix deadlock with fs freezing and EA inodes

Chunguang Xu <brookxu@tencent.com>
    ext4: fix a memory leak of ext4_free_data

Johan Hovold <johan@kernel.org>
    USB: serial: keyspan_pda: fix write unthrottling

Johan Hovold <johan@kernel.org>
    USB: serial: keyspan_pda: fix tx-unthrottle use-after-free

Johan Hovold <johan@kernel.org>
    USB: serial: keyspan_pda: fix write-wakeup use-after-free

Johan Hovold <johan@kernel.org>
    USB: serial: keyspan_pda: fix stalled writes

Johan Hovold <johan@kernel.org>
    USB: serial: keyspan_pda: fix write deadlock

Johan Hovold <johan@kernel.org>
    USB: serial: keyspan_pda: fix dropped unthrottle interrupts

Johan Hovold <johan@kernel.org>
    USB: serial: digi_acceleport: fix write-wakeup deadlocks

Johan Hovold <johan@kernel.org>
    USB: serial: mos7720: fix parallel-port state restore

Borislav Petkov <bp@suse.de>
    EDAC/amd64: Fix PCI component registration

Ard Biesheuvel <ardb@kernel.org>
    crypto: ecdh - avoid unaligned accesses in ecdh_set_secret()

Athira Rajeev <atrajeev@linux.vnet.ibm.com>
    powerpc/perf: Exclude kernel samples while counting events in user space.

Ian Abbott <abbotti@mev.co.uk>
    staging: comedi: mf6x4: Fix AI end-of-conversion detection

Stefan Haberland <sth@linux.ibm.com>
    s390/dasd: fix list corruption of lcu list

Stefan Haberland <sth@linux.ibm.com>
    s390/dasd: fix list corruption of pavgroup group list

Stefan Haberland <sth@linux.ibm.com>
    s390/dasd: prevent inconsistent LCU device data

Stefan Haberland <sth@linux.ibm.com>
    s390/dasd: fix hanging device offline processing

Philipp Rudo <prudo@linux.ibm.com>
    s390/kexec_file: fix diag308 subcode when loading crash kernel

Sven Schnelle <svens@linux.ibm.com>
    s390/smp: perform initial CPU reset also for SMT siblings

Takashi Iwai <tiwai@suse.de>
    ALSA: usb-audio: Disable sample read check if firmware doesn't give back

Amadej Kastelic <amadejkastelic7@gmail.com>
    ALSA: usb-audio: Add VID to support native DSD reproduction on FiiO devices

Chris Chiu <chiu@endlessos.org>
    ALSA: hda/realtek: Apply jack fixup for Quanta NL3

Takashi Iwai <tiwai@suse.de>
    ALSA: hda/realtek: Add quirk for MSI-GP73

Takashi Iwai <tiwai@suse.de>
    ALSA: pcm: oss: Fix a few more UBSAN fixes

Chris Chiu <chiu@endlessos.org>
    ALSA: hda/realtek - Enable headset mic of ASUS Q524UQK with ALC255

Chris Chiu <chiu@endlessos.org>
    ALSA: hda/realtek - Enable headset mic of ASUS X430UN with ALC256

Takashi Iwai <tiwai@suse.de>
    ALSA: hda: Fix regressions on clear and reconfig sysfs

Hui Wang <hui.wang@canonical.com>
    ACPI: PNP: compare the string length in the matching_id()

Daniel Scally <djrscally@gmail.com>
    Revert "ACPI / resources: Use AE_CTRL_TERMINATE to terminate resources walks"

Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    PM: ACPI: PCI: Drop acpi_pm_set_bridge_wakeup()

Connor McAdams <conmanx360@gmail.com>
    ALSA: hda/ca0132 - Change Input Source enum strings.

Arnd Bergmann <arnd@arndb.de>
    Input: cyapa_gen6 - fix out-of-bounds stack access

Sakari Ailus <sakari.ailus@linux.intel.com>
    media: ipu3-cio2: Make the field on subdev format V4L2_FIELD_NONE

Sakari Ailus <sakari.ailus@linux.intel.com>
    media: ipu3-cio2: Validate mbus format in setting subdev format

Sakari Ailus <sakari.ailus@linux.intel.com>
    media: ipu3-cio2: Serialise access to pad format

Sakari Ailus <sakari.ailus@linux.intel.com>
    media: ipu3-cio2: Return actual subdev format

Sakari Ailus <sakari.ailus@linux.intel.com>
    media: ipu3-cio2: Remove traces of returned buffers

Lukas Wunner <lukas@wunner.de>
    media: netup_unidvb: Don't leak SPI master in probe error path

Sean Young <sean@mess.org>
    media: sunxi-cir: ensure IR is handled when it is continuous

Alan Stern <stern@rowland.harvard.edu>
    media: gspca: Fix memory leak in probe

Simon Beginn <linux@simonmicro.de>
    Input: goodix - add upside-down quirk for Teclast X98 Pro tablet

Dmitry Torokhov <dmitry.torokhov@gmail.com>
    Input: cros_ec_keyb - send 'scancodes' in addition to key events

Dongdong Wang <wangdongdong.6@bytedance.com>
    lwt: Disable BH too in run_lwt_bpf()

Serge Hallyn <shallyn@cisco.com>
    fix namespaced fscaps when !CONFIG_SECURITY

Sara Sharon <sara.sharon@intel.com>
    cfg80211: initialize rekey_data

Paul Kocialkowski <contact@paulk.fr>
    ARM: sunxi: Add machine match for the Allwinner V3 SoC

Masahiro Yamada <masahiroy@kernel.org>
    kconfig: fix return value of do_error_if()

Jernej Skrabec <jernej.skrabec@siol.net>
    clk: sunxi-ng: Make sure divider tables have sentinel

Christophe JAILLET <christophe.jaillet@wanadoo.fr>
    clk: s2mps11: Fix a resource leak in error handling paths in the probe function

Dan Carpenter <dan.carpenter@oracle.com>
    qlcnic: Fix error code in probe

Zheng Zengkai <zhengzengkai@huawei.com>
    perf record: Fix memory leak when using '--user-regs=?' to list registers

Lokesh Vutla <lokeshvutla@ti.com>
    pwm: lp3943: Dynamically allocate PWM chip base

Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
    pwm: zx: Add missing cleanup in error path

Zhang Qilong <zhangqilong3@huawei.com>
    clk: ti: Fix memleak in ti_fapll_synth_setup

Arnd Bergmann <arnd@arndb.de>
    watchdog: coh901327: add COMMON_CLK dependency

Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
    watchdog: qcom: Avoid context switch in restart handler

Zhang Qilong <zhangqilong3@huawei.com>
    libnvdimm/label: Return -ENXIO for no slot in __blk_label_update

Vincent Stehlé <vincent.stehle@laposte.net>
    net: korina: fix return value

Christophe JAILLET <christophe.jaillet@wanadoo.fr>
    net: allwinner: Fix some resources leak in the error handling path of the probe and in the remove function

Christophe JAILLET <christophe.jaillet@wanadoo.fr>
    net: bcmgenet: Fix a resource leak in an error handling path in the probe functin

Dwaipayan Ray <dwaipayanray1@gmail.com>
    checkpatch: fix unescaped left brace

Vincent Stehlé <vincent.stehle@laposte.net>
    powerpc/ps3: use dma_mapping_error()

Bongsu Jeon <bongsu.jeon@samsung.com>
    nfc: s3fwrn5: Release the nfc firmware

Anton Ivanov <anton.ivanov@cambridgegreys.com>
    um: chan_xterm: Fix fd leak

Anton Ivanov <anton.ivanov@cambridgegreys.com>
    um: tty: Fix handling of close in tty lines

Anton Ivanov <anton.ivanov@cambridgegreys.com>
    um: Monitor error events in IRQ controller

Wang Wensheng <wangwensheng4@huawei.com>
    watchdog: Fix potential dereferencing of null pointer

Lingling Xu <ling_ling.xu@unisoc.com>
    watchdog: sprd: check busy bit before new loading rather than after that

Lingling Xu <ling_ling.xu@unisoc.com>
    watchdog: sprd: remove watchdog disable from resume fail path

Guenter Roeck <linux@roeck-us.net>
    watchdog: sirfsoc: Add missing dependency on HAS_IOMEM

Marc Zyngier <maz@kernel.org>
    irqchip/alpine-msi: Fix freeing of interrupts on allocation error path

Dan Carpenter <dan.carpenter@oracle.com>
    ASoC: wm_adsp: remove "ctl" from list on error in wm_adsp_create_control()

Johannes Berg <johannes.berg@intel.com>
    mac80211: don't set set TDLS STA bandwidth wider than possible

Marek Szyprowski <m.szyprowski@samsung.com>
    extcon: max77693: Fix modalias string

Dmitry Osipenko <digetx@gmail.com>
    clk: tegra: Fix duplicated SE clock entry

Zhang Changzhong <zhangchangzhong@huawei.com>
    bus: fsl-mc: fix error return code in fsl_mc_object_allocate()

Masami Hiramatsu <mhiramat@kernel.org>
    x86/kprobes: Restore BTF if the single-stepping is cancelled

Cheng Lin <cheng.lin130@zte.com.cn>
    nfs_common: need lock during iterate through the list

kazuo ito <kzpn200@gmail.com>
    nfsd: Fix message level for normal termination

Yang Yingliang <yangyingliang@huawei.com>
    speakup: fix uninitialized flush_lock

Zhang Qilong <zhangqilong3@huawei.com>
    usb: oxu210hp-hcd: Fix memory leak in oxu_create

Zhang Qilong <zhangqilong3@huawei.com>
    usb: ehci-omap: Fix PM disable depth umbalance in ehci_hcd_omap_probe

Nathan Lynch <nathanl@linux.ibm.com>
    powerpc/pseries/hibernation: remove redundant cacheinfo update

Nathan Lynch <nathanl@linux.ibm.com>
    powerpc/pseries/hibernation: drop pseries_suspend_begin() from suspend ops

Vadim Pasternak <vadimp@nvidia.com>
    platform/x86: mlx-platform: Fix item counter assignment for MSN2700, MSN24xx systems

Zhang Changzhong <zhangchangzhong@huawei.com>
    scsi: fnic: Fix error return code in fnic_probe()

Arnd Bergmann <arnd@arndb.de>
    seq_buf: Avoid type mismatch for seq_buf_init

Zhang Qilong <zhangqilong3@huawei.com>
    scsi: pm80xx: Fix error return in pm8001_pci_probe()

Qinglang Miao <miaoqinglang@huawei.com>
    scsi: qedi: Fix missing destroy_workqueue() on error in __qedi_probe

Pali Rohár <pali@kernel.org>
    cpufreq: scpi: Add missing MODULE_ALIAS

Pali Rohár <pali@kernel.org>
    cpufreq: loongson1: Add missing MODULE_ALIAS

Pali Rohár <pali@kernel.org>
    cpufreq: st: Add missing MODULE_DEVICE_TABLE

Pali Rohár <pali@kernel.org>
    cpufreq: mediatek: Add missing MODULE_DEVICE_TABLE

Pali Rohár <pali@kernel.org>
    cpufreq: highbank: Add missing MODULE_DEVICE_TABLE

Keqian Zhu <zhukeqian1@huawei.com>
    clocksource/drivers/arm_arch_timer: Correct fault programming of CNTKCTL_EL1.EVNTI

Qinglang Miao <miaoqinglang@huawei.com>
    dm ioctl: fix error return code in target_message

Chuhong Yuan <hslester96@gmail.com>
    ASoC: jz4740-i2s: add missed checks for clk_get()

Leon Romanovsky <leonro@nvidia.com>
    net/mlx5: Properly convey driver version to firmware

Jing Xiangfeng <jingxiangfeng@huawei.com>
    memstick: r592: Fix error return in r592_probe()

Chen-Yu Tsai <wens@csie.org>
    arm64: dts: rockchip: Fix UART pull-ups on rk3328

Yu Kuai <yukuai3@huawei.com>
    pinctrl: falcon: add missing put_device() call in pinctrl_falcon_probe()

Claudiu Beznea <claudiu.beznea@microchip.com>
    ARM: dts: at91: sama5d2: map securam as device

Yu Kuai <yukuai3@huawei.com>
    clocksource/drivers/cadence_ttc: Fix memory leak in ttc_setup_clockevent()

Dan Carpenter <dan.carpenter@oracle.com>
    media: saa7146: fix array overflow in vidioc_s_audio()

Jason Gunthorpe <jgg@nvidia.com>
    vfio-pci: Use io_remap_pfn_range() for PCI IO memory

NeilBrown <neilb@suse.de>
    NFS: switch nfsiod to be an UNBOUND workqueue.

Calum Mackay <calum.mackay@oracle.com>
    lockd: don't use interval-based rebinding over TCP

Trond Myklebust <trond.myklebust@hammerspace.com>
    SUNRPC: xprt_load_transport() needs to support the netid "rdma6"

Olga Kornievskaia <kolga@netapp.com>
    NFSv4.2: condition READDIR's mask for security label based on LSM state

Christophe JAILLET <christophe.jaillet@wanadoo.fr>
    ath10k: Release some resources in an error handling path

Christophe JAILLET <christophe.jaillet@wanadoo.fr>
    ath10k: Fix an error handling path

Rakesh Pillai <pillair@codeaurora.org>
    ath10k: Fix the parsing error in service available event

Qinglang Miao <miaoqinglang@huawei.com>
    platform/x86: dell-smbios-base: Fix error return code in dell_smbios_init

Alexandre Belloni <alexandre.belloni@bootlin.com>
    ARM: dts: at91: at91sam9rl: fix ADC triggers

Artem Lapkin <art@khadas.com>
    arm64: dts: meson: fix spi-max-frequency on Khadas VIM2

Bharat Gooty <bharat.gooty@broadcom.com>
    PCI: iproc: Fix out-of-bound array accesses

Colin Ian King <colin.king@canonical.com>
    PCI: Fix overflow in command-line resource alignment requests

Bjorn Helgaas <bhelgaas@google.com>
    PCI: Bounds-check command-line resource alignment requests

Marc Zyngier <maz@kernel.org>
    genirq/irqdomain: Don't try to free an interrupt that has no mapping

Zhang Qilong <zhangqilong3@huawei.com>
    power: supply: bq24190_charger: fix reference leak

Hans de Goede <hdegoede@redhat.com>
    power: supply: axp288_charger: Fix HP Pavilion x2 10 DMI matching

Chen-Yu Tsai <wens@csie.org>
    arm64: dts: rockchip: Set dr_mode to "host" for OTG on rk3328-roc-cc

Chris Packham <chris.packham@alliedtelesis.co.nz>
    ARM: dts: Remove non-existent i2c1 from 98dx3236

Jing Xiangfeng <jingxiangfeng@huawei.com>
    HSI: omap_ssi: Don't jump to free ID in ssi_add_controller()

Bjorn Andersson <bjorn.andersson@linaro.org>
    slimbus: qcom-ngd-ctrl: Avoid sending power requests without QMI

Dan Carpenter <dan.carpenter@oracle.com>
    media: max2175: fix max2175_set_csm_mode() error code

Qinglang Miao <miaoqinglang@huawei.com>
    mips: cdmm: fix use-after-free in mips_cdmm_bus_discover

Daniel T. Lee <danieltimlee@gmail.com>
    samples: bpf: Fix lwt_len_hist reusing previous BPF map

Vadim Pasternak <vadimp@nvidia.com>
    platform/x86: mlx-platform: Remove PSU EEPROM from MSN274x platform configuration

Vadim Pasternak <vadimp@nvidia.com>
    platform/x86: mlx-platform: Remove PSU EEPROM from default platform configuration

Keita Suzuki <keitasuzuki.park@sslab.ics.keio.ac.jp>
    media: siano: fix memory leak of debugfs members in smsdvb_hotplug

Zhihao Cheng <chengzhihao1@huawei.com>
    dmaengine: mv_xor_v2: Fix error return code in mv_xor_v2_probe()

Qinglang Miao <miaoqinglang@huawei.com>
    cw1200: fix missing destroy_workqueue() on error in cw1200_init_common

Sebastian Andrzej Siewior <bigeasy@linutronix.de>
    orinoco: Move context allocation after processing the skb

Cristian Birsan <cristian.birsan@microchip.com>
    ARM: dts: at91: sama5d3_xplained: add pincontrol for USB Host

Cristian Birsan <cristian.birsan@microchip.com>
    ARM: dts: at91: sama5d4_xplained: add pincontrol for USB Host

Qinglang Miao <miaoqinglang@huawei.com>
    memstick: fix a double-free bug in memstick_check

Kamal Heib <kamalheib1@gmail.com>
    RDMA/cxgb4: Validate the number of CQEs

Zhang Qilong <zhangqilong3@huawei.com>
    Input: omap4-keypad - fix runtime PM error handling

Zhihao Cheng <chengzhihao1@huawei.com>
    drivers: soc: ti: knav_qmss_queue: Fix error return code in knav_queue_probe

Zhang Qilong <zhangqilong3@huawei.com>
    soc: ti: Fix reference imbalance in knav_dma_probe

Zhang Qilong <zhangqilong3@huawei.com>
    soc: ti: knav_qmss: fix reference leak in knav_queue_probe

Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
    spi: fix resource leak for drivers without .remove callback

Zhang Qilong <zhangqilong3@huawei.com>
    crypto: omap-aes - Fix PM disable depth imbalance in omap_aes_probe

Nathan Chancellor <natechancellor@gmail.com>
    crypto: crypto4xx - Replace bitwise OR with logical OR in crypto4xx_build_pd

Christophe Leroy <christophe.leroy@csgroup.eu>
    powerpc/feature: Fix CPU_FTRS_ALWAYS by removing CPU_FTRS_GENERIC_32

Zhang Qilong <zhangqilong3@huawei.com>
    spi: mxs: fix reference leak in mxs_spi_probe

Yang Yingliang <yangyingliang@huawei.com>
    usb/max3421: fix return error code in max3421_probe()

Dmitry Torokhov <dmitry.torokhov@gmail.com>
    Input: ads7846 - fix unaligned access on 7845

Oleksij Rempel <o.rempel@pengutronix.de>
    Input: ads7846 - fix integer overflow on Rt calculation

David Jander <david@protonic.nl>
    Input: ads7846 - fix race that causes missing releases

Yang Yingliang <yangyingliang@huawei.com>
    drm/omap: dmm_tiler: fix return error code in omap_dmm_probe()

Yang Yingliang <yangyingliang@huawei.com>
    video: fbdev: atmel_lcdfb: fix return error code in atmel_lcdfb_of_init()

Qinglang Miao <miaoqinglang@huawei.com>
    media: solo6x10: fix missing snd_card_free in error handling case

Martin Wilck <mwilck@suse.com>
    scsi: core: Fix VPD LUN ID designator priorities

Jerome Brunet <jbrunet@baylibre.com>
    ASoC: meson: fix COMPILE_TEST error

Yu Kuai <yukuai3@huawei.com>
    media: mtk-vcodec: add missing put_device() call in mtk_vcodec_release_dec_pm()

Colin Ian King <colin.king@canonical.com>
    media: tm6000: Fix sizeof() mismatches

Jing Xiangfeng <jingxiangfeng@huawei.com>
    staging: gasket: interrupt: fix the missed eventfd_ctx_put() in gasket_interrupt.c

Zhang Qilong <zhangqilong3@huawei.com>
    staging: greybus: codecs: Fix reference counter leak in error handling

Jack Xu <jack.xu@intel.com>
    crypto: qat - fix status check in qat_hal_put_rel_rd_xfer()

Necip Fazil Yildiran <fazilyildiran@gmail.com>
    MIPS: BCM47XX: fix kconfig dependency bug for BCM47XX_BCMA

Arnd Bergmann <arnd@arndb.de>
    RDMa/mthca: Work around -Wenum-conversion warning

Zhang Qilong <zhangqilong3@huawei.com>
    ASoC: arizona: Fix a wrong free in wm8997_probe

Vincent Bernat <vincent@bernat.ch>
    net: evaluate net.ipv4.conf.all.proxy_arp_pvlan

Vincent Bernat <vincent@bernat.ch>
    net: evaluate net.ipvX.conf.all.ignore_routes_with_linkdown

Zhang Qilong <zhangqilong3@huawei.com>
    ASoC: wm8998: Fix PM disable depth imbalance on error

Tsuchiya Yuto <kitakar@gmail.com>
    mwifiex: fix mwifiex_shutdown_sw() causing sw reset failure

Qinglang Miao <miaoqinglang@huawei.com>
    spi: bcm63xx-hsspi: fix missing clk_disable_unprepare() on error in bcm63xx_hsspi_resume

Zhang Qilong <zhangqilong3@huawei.com>
    spi: tegra114: fix reference leak in tegra spi ops

Zhang Qilong <zhangqilong3@huawei.com>
    spi: tegra20-sflash: fix reference leak in tegra_sflash_resume

Zhang Qilong <zhangqilong3@huawei.com>
    spi: tegra20-slink: fix reference leak in slink ops of tegra20

Zhang Qilong <zhangqilong3@huawei.com>
    spi: spi-ti-qspi: fix reference leak in ti_qspi_setup

Anant Thazhemadam <anant.thazhemadam@gmail.com>
    Bluetooth: hci_h5: fix memory leak in h5_close

Anmol Karn <anmol.karan123@gmail.com>
    Bluetooth: Fix null pointer dereference in hci_event_packet()

Paweł Chmiel <pawel.mikolaj.chmiel@gmail.com>
    arm64: dts: exynos: Correct psci compatible used on Exynos7

Paweł Chmiel <pawel.mikolaj.chmiel@gmail.com>
    arm64: dts: exynos: Include common syscon restart/poweroff for Exynos7

Paul Moore <paul@paul-moore.com>
    selinux: fix inode_doinit_with_dentry() LABEL_INVALID error handling

Cezary Rojewski <cezary.rojewski@intel.com>
    ASoC: pcm: DRAIN support reactivation

Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
    drm/msm/dsi_pll_10nm: restore VCO rate during restore_state

Zhang Qilong <zhangqilong3@huawei.com>
    spi: img-spfi: fix reference leak in img_spfi_resume

Jordan Niethe <jniethe5@gmail.com>
    powerpc/64: Set up a kernel stack for secondaries before cpu_restore()

Arnd Bergmann <arnd@arndb.de>
    drm/amdgpu: fix build_coefficients() argument

Colin Ian King <colin.king@canonical.com>
    crypto: inside-secure - Fix sizeof() mismatch

Christophe Leroy <christophe.leroy@csgroup.eu>
    crypto: talitos - Fix return type of current_desc_hdr()

Christophe Leroy <christophe.leroy@csgroup.eu>
    crypto: talitos - Endianess in current_desc_hdr()

Thomas Gleixner <tglx@linutronix.de>
    sched: Reenable interrupts in do_sched_yield()

Peng Liu <iwtbavbm@gmail.com>
    sched/deadline: Fix sched_dl_global_validate()

David Woodhouse <dwmw@amazon.co.uk>
    x86/apic: Fix x2apic enablement without interrupt remapping

Ard Biesheuvel <ardb@kernel.org>
    ARM: p2v: fix handling of LPAE translation in BE mode

Arvind Sankar <nivedita@alum.mit.edu>
    x86/mm/ident_map: Check for errors from ident_pud_init()

Bob Pearson <rpearsonhpe@gmail.com>
    RDMA/rxe: Compute PSN windows correctly

Joel Stanley <joel@jms.id.au>
    ARM: dts: aspeed: s2600wf: Fix VGA memory region location

Tianyue Ren <rentianyue@kylinos.cn>
    selinux: fix error initialization in inode_doinit_with_dentry()

Kamal Heib <kamalheib1@gmail.com>
    RDMA/bnxt_re: Set queue pair state when being queried

Douglas Anderson <dianders@chromium.org>
    soc: qcom: geni: More properly switch to DMA mode

Nicolas Boichat <drinkcat@chromium.org>
    soc: mediatek: Check if power domains can be powered on at boot time

Dan Carpenter <dan.carpenter@oracle.com>
    soc: renesas: rmobile-sysc: Fix some leaks in rmobile_init_pm_domains()

Krzysztof Kozlowski <krzk@kernel.org>
    drm/tve200: Fix handling of platform_get_irq() error

Tom Rix <trix@redhat.com>
    drm/gma500: fix double free of gma_connector

Leo Yan <leo.yan@linaro.org>
    perf cs-etm: Move definition of 'traceid_list' global variable from header file

Leo Yan <leo.yan@linaro.org>
    perf cs-etm: Change tuple from traceID-CPU# to traceID-metadata

Dae R. Jeong <dae.r.jeong@kaist.ac.kr>
    md: fix a warning caused by a race between concurrent md_ioctl()s

Eric Biggers <ebiggers@google.com>
    crypto: af_alg - avoid undefined behavior accessing salg_name

Antti Palosaari <crope@iki.fi>
    media: msi2500: assign SPI bus number dynamically

Jan Kara <jack@suse.cz>
    quota: Sanity-check quota file headers on load

Peilin Ye <yepeilin.cs@gmail.com>
    Bluetooth: Fix slab-out-of-bounds read in hci_le_direct_adv_report_evt()

Alexey Kardashevskiy <aik@ozlabs.ru>
    serial_core: Check for port state when tty is in error state

Julian Sax <jsbc@gmx.de>
    HID: i2c-hid: add Vero K147 to descriptor override

Arnd Bergmann <arnd@arndb.de>
    scsi: megaraid_sas: Check user-provided offsets

Mao Jinlong <jinlmao@codeaurora.org>
    coresight: tmc-etr: Check if page is valid before dma_map_page()

Krzysztof Kozlowski <krzk@kernel.org>
    ARM: dts: exynos: fix USB 3.0 pins supply being turned off on Odroid XU

Krzysztof Kozlowski <krzk@kernel.org>
    ARM: dts: exynos: fix USB 3.0 VBUS control and over-current pins on Exynos5410

Krzysztof Kozlowski <krzk@kernel.org>
    ARM: dts: exynos: fix roles of USB 3.0 ports on Odroid XU

Fabio Estevam <festevam@gmail.com>
    usb: chipidea: ci_hdrc_imx: Pass DISABLE_DEVICE_STREAMING flag to imx6ul

Will McVicker <willmcvicker@google.com>
    USB: gadget: f_rndis: fix bitrate for SuperSpeed and above

Jack Pham <jackp@codeaurora.org>
    usb: gadget: f_fs: Re-use SS descriptors for SuperSpeedPlus

Will McVicker <willmcvicker@google.com>
    USB: gadget: f_midi: setup SuperSpeed Plus descriptors

taehyun.cho <taehyun.cho@samsung.com>
    USB: gadget: f_acm: add support for SuperSpeed Plus

Johan Hovold <johan@kernel.org>
    USB: serial: option: add interface-number sanity check to flag handling

Nicolin Chen <nicoleotsuka@gmail.com>
    soc/tegra: fuse: Fix index bug in get_process_id

Thomas Gleixner <tglx@linutronix.de>
    dm table: Remove BUG_ON(in_interrupt())

Sreekanth Reddy <sreekanth.reddy@broadcom.com>
    scsi: mpt3sas: Increase IOCInit request timeout to 30s

Sven Eckelmann <sven@narfation.org>
    vxlan: Copy needed_tailroom from lowerdev

Sven Eckelmann <sven@narfation.org>
    vxlan: Add needed_headroom for lower device

Mark Rutland <mark.rutland@arm.com>
    arm64: syscall: exit userspace before unmasking exceptions

Qinglang Miao <miaoqinglang@huawei.com>
    drm/tegra: sor: Disable clocks on error in tegra_sor_init()

Nicholas Piggin <npiggin@gmail.com>
    kernel/cpu: add arch override for clear_tasks_mm_cpumask() mm handling

Deepak R Varma <mh12gx2825@gmail.com>
    drm/tegra: replace idr_init() by idr_init_base()

Björn Töpel <bjorn.topel@intel.com>
    ixgbe: avoid premature Rx buffer reuse

Leon Romanovsky <leonro@nvidia.com>
    RDMA/cm: Fix an attempt to use non-valid pointer when cleaning timewait

Toke Høiland-Jørgensen <toke@redhat.com>
    selftests/bpf/test_offload.py: Reset ethtool features after failed setting

Chunyan Zhang <chunyan.zhang@unisoc.com>
    gpio: eic-sprd: break loop when getting NULL device resource

Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
    netfilter: x_tables: Switch synchronization to RCU

Johannes Thumshirn <johannes.thumshirn@wdc.com>
    block: factor out requeue handling from dispatch code

Geert Uytterhoeven <geert+renesas@glider.be>
    clk: renesas: r9a06g032: Drop __packed for portability

Zhang Qilong <zhangqilong3@huawei.com>
    can: softing: softing_netdev_open(): fix error handling

Luc Van Oostenryck <luc.vanoostenryck@gmail.com>
    xsk: Fix xsk_poll()'s return type

Randy Dunlap <rdunlap@infradead.org>
    scsi: bnx2i: Requires MMU

Baruch Siach <baruch@tkos.co.il>
    gpio: mvebu: fix potential user-after-free on probe

Icenowy Zheng <icenowy@aosc.io>
    ARM: dts: sun8i: v3s: fix GIC node memory range

Andy Shevchenko <andriy.shevchenko@linux.intel.com>
    pinctrl: baytrail: Avoid clearing debounce value when turning it off

Andy Shevchenko <andriy.shevchenko@linux.intel.com>
    pinctrl: merrifield: Set default bias in case no particular value given

Xiaochen Shen <xiaochen.shen@intel.com>
    x86/resctrl: Fix incorrect local bandwidth when mba_sc is enabled

James Morse <james.morse@arm.com>
    x86/resctrl: Remove unused struct mbm_state::chunks_bw

Fangrui Song <maskray@google.com>
    arm64: Change .weak to SYM_FUNC_START_WEAK_PI for arch/arm64/lib/mem*.S

Vincenzo Frascino <vincenzo.frascino@arm.com>
    arm64: lse: Fix LSE atomics with LLVM

Sami Tolvanen <samitolvanen@google.com>
    arm64: lse: fix LSE atomics with LLVM's integrated assembler

Xin Xiong <xiongx18@fudan.edu.cn>
    drm: fix drm_dp_mst_port refcount leaks in drm_dp_mst_allocate_vcpi

Oleksandr Andrushchenko <oleksandr_andrushchenko@epam.com>
    drm/xen-front: Fix misused IS_ERR_OR_NULL checks

Alexander Sverdlin <alexander.sverdlin@gmail.com>
    serial: 8250_omap: Avoid FIFO corruption caused by MDR1 access

Takashi Iwai <tiwai@suse.de>
    ALSA: pcm: oss: Fix potential out-of-bounds shift

Thomas Gleixner <tglx@linutronix.de>
    USB: sisusbvga: Make console support depend on BROKEN

Oliver Neukum <oneukum@suse.com>
    USB: UAS: introduce a quirk to set no_write_same

Li Jun <jun.li@nxp.com>
    xhci: Give USB2 ports time to enter U3 in bus suspend

Takashi Iwai <tiwai@suse.de>
    ALSA: usb-audio: Fix control 'access overflow' errors from chmap

Takashi Iwai <tiwai@suse.de>
    ALSA: usb-audio: Fix potential out-of-bounds shift

Oliver Neukum <oneukum@suse.com>
    USB: add RESET_RESUME quirk for Snapscan 1212

Bui Quang Minh <minhquangbui99@gmail.com>
    USB: dummy-hcd: Fix uninitialized array use in init()

Steven Rostedt (VMware) <rostedt@goodmis.org>
    ktest.pl: If size of log is too big to email, email error message

Zhang Changzhong <zhangchangzhong@huawei.com>
    net: bridge: vlan: fix error return code in __vlan_add()

Martin Blumenstingl <martin.blumenstingl@googlemail.com>
    net: stmmac: dwmac-meson8b: fix mask definition of the m250_sel mux

Fugang Duan <fugang.duan@nxp.com>
    net: stmmac: delete the eee_ctrl_timer after napi disabled

Moshe Shemesh <moshe@mellanox.com>
    net/mlx4_en: Handle TX error CQE

Sergej Bauer <sbauer@blackbox.su>
    lan743x: fix for potential NULL pointer dereference with bare card

Moshe Shemesh <moshe@mellanox.com>
    net/mlx4_en: Avoid scheduling restart task if it is already running

Neal Cardwell <ncardwell@google.com>
    tcp: fix cwnd-limited bug for TSO deferral where we send nothing

Eric Dumazet <edumazet@google.com>
    tcp: select sane initial rcvq_space.space for big MSS

Fugang Duan <fugang.duan@nxp.com>
    net: stmmac: free tx skb buffer in stmmac_resume()

Eric Dumazet <edumazet@google.com>
    mac80211: mesh: fix mesh_pathtbl_init() error path

Ansuel Smith <ansuelsmth@gmail.com>
    PCI: qcom: Add missing reset for ipq806x

Arvind Sankar <nivedita@alum.mit.edu>
    compiler.h: fix barrier_data() on clang

Thomas Gleixner <tglx@linutronix.de>
    x86/apic/vector: Fix ordering in vector assignment

Andy Lutomirski <luto@kernel.org>
    x86/membarrier: Get rid of a dubious optimization

Arvind Sankar <nivedita@alum.mit.edu>
    x86/mm/mem_encrypt: Fix definition of PMD_FLAGS_DEC_WP

Dan Carpenter <dan.carpenter@oracle.com>
    scsi: be2iscsi: Revert "Fix a theoretical leak in beiscsi_create_eqs()"

Arnd Bergmann <arnd@arndb.de>
    kbuild: avoid static_assert for genksyms

Bean Huo <beanhuo@micron.com>
    mmc: block: Fixup condition for CMD13 polling for RPMB requests

Coiby Xu <coiby.xu@gmail.com>
    pinctrl: amd: remove debounce filter setting in IRQ type setting

Chris Chiu <chiu@endlessos.org>
    Input: i8042 - add Acer laptops to the i8042 reset list

Dmitry Torokhov <dmitry.torokhov@gmail.com>
    Input: cm109 - do not stomp on control URB

Max Verevkin <me@maxverevkin.tk>
    platform/x86: intel-vbtn: Support for tablet mode on HP Pavilion 13 x360 PC

Timo Witte <timo.witte@gmail.com>
    platform/x86: acer-wmi: add automatic keyboard background light toggle key as KEY_LIGHTS_TOGGLE

Hans de Goede <hdegoede@redhat.com>
    platform/x86: thinkpad_acpi: Add BAT1 is primary battery quirk for Thinkpad Yoga 11e 4th gen

Hans de Goede <hdegoede@redhat.com>
    platform/x86: thinkpad_acpi: Do not report SW_TABLET_MODE on Yoga 11e

Hao Si <si.hao@zte.com.cn>
    soc: fsl: dpio: Get the cpumask through cpumask_of(cpu)

Xu Qiang <xuqiang36@huawei.com>
    irqchip/gic-v3-its: Unconditionally save/restore the ITS state on suspend

Can Guo <cang@codeaurora.org>
    scsi: ufs: Make sure clk scaling happens only when HBA is runtime ACTIVE

Vineet Gupta <vgupta@synopsys.com>
    ARC: stack unwinding: don't assume non-current task is sleeping

Michael Ellerman <mpe@ellerman.id.au>
    powerpc: Drop -me200 addition to build flags

Sara Sharon <sara.sharon@intel.com>
    iwlwifi: mvm: fix kernel panic in case of assert during CSA

Markus Reichl <m.reichl@fivetechno.de>
    arm64: dts: rockchip: Assign a fixed index to mmc devices on rk3399 boards.

Johannes Berg <johannes.berg@intel.com>
    iwlwifi: pcie: limit memory read spin time

Nathan Chancellor <natechancellor@gmail.com>
    spi: bcm2835aux: Restore err assignment in bcm2835aux_spi_probe

Lukas Wunner <lukas@wunner.de>
    spi: bcm2835aux: Fix use-after-free on unbind

Fangrui Song <maskray@google.com>
    x86/lib: Change .weak to SYM_FUNC_START_WEAK for arch/x86/lib/mem*_64.S

Nick Desaulniers <ndesaulniers@google.com>
    Kbuild: do not emit debug info for assembly with LLVM_IAS=1


-------------

Diffstat:

 Documentation/admin-guide/kernel-parameters.txt    |   1 +
 Documentation/networking/ip-sysctl.txt             |   3 +
 Makefile                                           |   7 +-
 arch/arc/kernel/stacktrace.c                       |  23 ++--
 arch/arm/boot/dts/armada-xp-98dx3236.dtsi          |   5 -
 arch/arm/boot/dts/aspeed-bmc-intel-s2600wf.dts     |   4 +-
 arch/arm/boot/dts/at91-sama5d3_xplained.dts        |   7 ++
 arch/arm/boot/dts/at91-sama5d4_xplained.dts        |   7 ++
 arch/arm/boot/dts/at91sam9rl.dtsi                  |  19 ++--
 arch/arm/boot/dts/exynos5410-odroidxu.dts          |   6 +-
 arch/arm/boot/dts/exynos5410-pinctrl.dtsi          |  28 +++++
 arch/arm/boot/dts/exynos5410.dtsi                  |   4 +
 arch/arm/boot/dts/omap4-panda-es.dts               |   2 +-
 arch/arm/boot/dts/sama5d2.dtsi                     |   7 +-
 arch/arm/boot/dts/sun8i-v3s.dtsi                   |   2 +-
 arch/arm/kernel/head.S                             |   6 +-
 arch/arm/mach-shmobile/pm-rmobile.c                |   1 +
 arch/arm/mach-sunxi/sunxi.c                        |   1 +
 .../boot/dts/amlogic/meson-gxm-khadas-vim2.dts     |   2 +-
 arch/arm64/boot/dts/exynos/exynos7.dtsi            |  12 +-
 arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts     |   1 +
 arch/arm64/boot/dts/rockchip/rk3328.dtsi           |  16 +--
 arch/arm64/boot/dts/rockchip/rk3399.dtsi           |   3 +
 arch/arm64/include/asm/atomic_lse.h                |  76 +++++++++----
 arch/arm64/include/asm/kvm_host.h                  |   1 +
 arch/arm64/include/asm/lse.h                       |   6 +-
 arch/arm64/kernel/syscall.c                        |   2 +-
 arch/arm64/kvm/sys_regs.c                          |   1 +
 arch/arm64/lib/memcpy.S                            |   3 +-
 arch/arm64/lib/memmove.S                           |   3 +-
 arch/arm64/lib/memset.S                            |   3 +-
 arch/mips/bcm47xx/Kconfig                          |   1 +
 arch/powerpc/Makefile                              |   1 -
 arch/powerpc/include/asm/book3s/32/pgtable.h       |   4 +-
 arch/powerpc/include/asm/cputable.h                |   5 -
 arch/powerpc/include/asm/nohash/pgtable.h          |   4 +-
 arch/powerpc/kernel/head_64.S                      |   8 +-
 arch/powerpc/kernel/rtas.c                         |   2 +-
 arch/powerpc/kernel/setup-common.c                 |   4 +-
 arch/powerpc/perf/core-book3s.c                    |  10 ++
 arch/powerpc/platforms/powernv/memtrace.c          |  44 +++++--
 arch/powerpc/platforms/pseries/suspend.c           |   4 -
 arch/powerpc/xmon/nonstdio.c                       |   2 +-
 arch/s390/kernel/smp.c                             |  18 +--
 arch/s390/purgatory/head.S                         |   9 +-
 arch/um/drivers/chan_user.c                        |   4 +-
 arch/um/drivers/xterm.c                            |   5 +
 arch/um/os-Linux/irq.c                             |   2 +-
 arch/x86/include/asm/apic.h                        |   1 +
 arch/x86/include/asm/pgtable_types.h               |   1 +
 arch/x86/include/asm/sync_core.h                   |   9 +-
 arch/x86/kernel/apic/apic.c                        |  14 ++-
 arch/x86/kernel/apic/vector.c                      |  24 ++--
 arch/x86/kernel/apic/x2apic_phys.c                 |   9 ++
 arch/x86/kernel/cpu/intel_rdt.h                    |   2 -
 arch/x86/kernel/cpu/intel_rdt_monitor.c            |   7 +-
 arch/x86/kernel/kprobes/core.c                     |   5 +
 arch/x86/lib/memcpy_64.S                           |   6 +-
 arch/x86/lib/memmove_64.S                          |   4 +-
 arch/x86/lib/memset_64.S                           |   6 +-
 arch/x86/mm/ident_map.c                            |  12 +-
 arch/x86/mm/mem_encrypt_identity.c                 |   4 +-
 arch/x86/mm/tlb.c                                  |  10 +-
 block/blk-mq.c                                     |  29 +++--
 crypto/af_alg.c                                    |  10 +-
 crypto/ecdh.c                                      |   9 +-
 drivers/acpi/acpi_pnp.c                            |   3 +
 drivers/acpi/device_pm.c                           |  41 ++-----
 drivers/acpi/resource.c                            |   2 +-
 drivers/block/xen-blkback/xenbus.c                 |   4 +-
 drivers/bluetooth/hci_h5.c                         |   3 +
 drivers/bus/fsl-mc/fsl-mc-allocator.c              |   4 +-
 drivers/bus/mips_cdmm.c                            |   4 +-
 drivers/clk/clk-s2mps11.c                          |   1 +
 drivers/clk/mvebu/armada-37xx-xtal.c               |   4 +-
 drivers/clk/renesas/r9a06g032-clocks.c             |   2 +-
 drivers/clk/sunxi-ng/ccu-sun50i-a64.c              |   1 +
 drivers/clk/sunxi-ng/ccu-sun8i-h3.c                |   1 +
 drivers/clk/tegra/clk-id.h                         |   1 +
 drivers/clk/tegra/clk-tegra-periph.c               |   2 +-
 drivers/clk/ti/fapll.c                             |  11 +-
 drivers/clocksource/arm_arch_timer.c               |  23 ++--
 drivers/clocksource/cadence_ttc_timer.c            |  18 +--
 drivers/cpufreq/highbank-cpufreq.c                 |   7 ++
 drivers/cpufreq/loongson1-cpufreq.c                |   1 +
 drivers/cpufreq/mediatek-cpufreq.c                 |   1 +
 drivers/cpufreq/scpi-cpufreq.c                     |   1 +
 drivers/cpufreq/sti-cpufreq.c                      |   7 ++
 drivers/crypto/amcc/crypto4xx_core.c               |   2 +-
 drivers/crypto/inside-secure/safexcel.c            |   2 +-
 drivers/crypto/omap-aes.c                          |   3 +-
 drivers/crypto/qat/qat_common/qat_hal.c            |   2 +-
 drivers/crypto/talitos.c                           |  10 +-
 drivers/dma/mv_xor_v2.c                            |   4 +-
 drivers/edac/amd64_edac.c                          |  26 +++--
 drivers/extcon/extcon-max77693.c                   |   2 +-
 drivers/gpio/gpio-eic-sprd.c                       |   2 +-
 drivers/gpio/gpio-mvebu.c                          |  16 ++-
 .../drm/amd/display/modules/color/color_gamma.c    |   2 +-
 drivers/gpu/drm/drm_dp_aux_dev.c                   |   2 +-
 drivers/gpu/drm/drm_dp_mst_topology.c              |   7 +-
 drivers/gpu/drm/gma500/cdv_intel_dp.c              |   2 +-
 drivers/gpu/drm/msm/dsi/pll/dsi_pll_10nm.c         |   8 ++
 drivers/gpu/drm/omapdrm/omap_dmm_tiler.c           |   1 +
 drivers/gpu/drm/tegra/drm.c                        |   2 +-
 drivers/gpu/drm/tegra/sor.c                        |  10 +-
 drivers/gpu/drm/tve200/tve200_drv.c                |   4 +-
 drivers/gpu/drm/xen/xen_drm_front.c                |   2 +-
 drivers/gpu/drm/xen/xen_drm_front_gem.c            |   8 +-
 drivers/gpu/drm/xen/xen_drm_front_kms.c            |   2 +-
 drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c           |   8 ++
 drivers/hsi/controllers/omap_ssi_core.c            |   2 +-
 drivers/hwtracing/coresight/coresight-tmc-etr.c    |   2 +
 drivers/iio/adc/rockchip_saradc.c                  |   2 +-
 drivers/iio/imu/bmi160/bmi160_core.c               |   4 +-
 drivers/iio/industrialio-buffer.c                  |   6 +-
 drivers/iio/light/rpr0521.c                        |  17 ++-
 drivers/iio/light/st_uvis25.h                      |   5 +
 drivers/iio/light/st_uvis25_core.c                 |   8 +-
 drivers/iio/pressure/mpl3115.c                     |   9 +-
 drivers/infiniband/core/cm.c                       |   2 +
 drivers/infiniband/hw/bnxt_re/ib_verbs.c           |   1 +
 drivers/infiniband/hw/cxgb4/cq.c                   |   3 +
 drivers/infiniband/hw/mthca/mthca_cq.c             |   2 +-
 drivers/infiniband/hw/mthca/mthca_dev.h            |   1 -
 drivers/infiniband/sw/rxe/rxe_req.c                |   3 +-
 drivers/input/keyboard/cros_ec_keyb.c              |   1 +
 drivers/input/keyboard/omap4-keypad.c              |  89 +++++++++------
 drivers/input/misc/cm109.c                         |   7 +-
 drivers/input/mouse/cyapa_gen6.c                   |   2 +-
 drivers/input/serio/i8042-x86ia64io.h              |  42 +++++++
 drivers/input/touchscreen/ads7846.c                |  52 +++++----
 drivers/input/touchscreen/goodix.c                 |  12 ++
 drivers/irqchip/irq-alpine-msi.c                   |   3 +-
 drivers/irqchip/irq-gic-v3-its.c                   |  16 +--
 drivers/md/dm-ioctl.c                              |   1 +
 drivers/md/dm-table.c                              |   6 -
 drivers/md/md-cluster.c                            |  67 ++++++-----
 drivers/md/md.c                                    |  21 +++-
 drivers/media/common/siano/smsdvb-main.c           |   5 +-
 drivers/media/i2c/max2175.c                        |   2 +-
 drivers/media/pci/intel/ipu3/ipu3-cio2.c           |  62 +++++-----
 drivers/media/pci/intel/ipu3/ipu3-cio2.h           |   1 +
 drivers/media/pci/netup_unidvb/netup_unidvb_spi.c  |   5 +-
 drivers/media/pci/saa7146/mxb.c                    |  19 ++--
 drivers/media/pci/solo6x10/solo6x10-g723.c         |   2 +-
 .../media/platform/mtk-vcodec/mtk_vcodec_dec_pm.c  |   1 +
 drivers/media/rc/sunxi-cir.c                       |   2 +
 drivers/media/usb/gspca/gspca.c                    |   1 +
 drivers/media/usb/msi2500/msi2500.c                |   2 +-
 drivers/media/usb/tm6000/tm6000-video.c            |   5 +-
 drivers/memstick/core/memstick.c                   |   1 -
 drivers/memstick/host/r592.c                       |  12 +-
 drivers/mmc/core/block.c                           |   2 +-
 drivers/mtd/cmdlinepart.c                          |  14 ++-
 drivers/mtd/nand/raw/qcom_nandc.c                  |   2 +
 drivers/mtd/nand/spi/core.c                        |   4 +
 drivers/net/can/softing/softing_main.c             |   9 +-
 drivers/net/ethernet/allwinner/sun4i-emac.c        |   7 +-
 drivers/net/ethernet/broadcom/genet/bcmgenet.c     |   4 +-
 drivers/net/ethernet/intel/ixgbe/ixgbe_main.c      |  24 ++--
 drivers/net/ethernet/korina.c                      |   2 +-
 drivers/net/ethernet/mellanox/mlx4/en_netdev.c     |  21 ++--
 drivers/net/ethernet/mellanox/mlx4/en_tx.c         |  40 +++++--
 drivers/net/ethernet/mellanox/mlx4/mlx4_en.h       |  12 +-
 drivers/net/ethernet/mellanox/mlx5/core/main.c     |   6 +-
 drivers/net/ethernet/microchip/lan743x_ethtool.c   |   9 +-
 drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c   |   1 +
 .../net/ethernet/stmicro/stmmac/dwmac-meson8b.c    |   6 +-
 drivers/net/ethernet/stmicro/stmmac/stmmac_main.c  |  27 ++++-
 drivers/net/vxlan.c                                |   3 +
 drivers/net/wireless/ath/ath10k/usb.c              |   7 +-
 drivers/net/wireless/ath/ath10k/wmi-tlv.c          |   4 +-
 drivers/net/wireless/ath/ath10k/wmi.c              |   9 +-
 drivers/net/wireless/ath/ath10k/wmi.h              |   1 +
 drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c  |   2 +-
 drivers/net/wireless/intel/iwlwifi/pcie/trans.c    |  36 ++++--
 .../net/wireless/intersil/orinoco/orinoco_usb.c    |  14 +--
 drivers/net/wireless/marvell/mwifiex/main.c        |   2 +
 drivers/net/wireless/st/cw1200/main.c              |   2 +
 drivers/net/xen-netback/xenbus.c                   |   6 +-
 drivers/nfc/s3fwrn5/firmware.c                     |   4 +-
 drivers/nvdimm/label.c                             |  13 ++-
 drivers/pci/controller/dwc/pcie-qcom.c             |  12 ++
 drivers/pci/controller/pcie-iproc.c                |  10 +-
 drivers/pci/pci-acpi.c                             |   4 +-
 drivers/pci/pci.c                                  |  14 ++-
 drivers/pci/slot.c                                 |   6 +-
 drivers/pinctrl/intel/pinctrl-baytrail.c           |   8 +-
 drivers/pinctrl/intel/pinctrl-merrifield.c         |   8 ++
 drivers/pinctrl/pinctrl-amd.c                      |   7 --
 drivers/pinctrl/pinctrl-falcon.c                   |  14 ++-
 drivers/pinctrl/sunxi/pinctrl-sunxi.c              |   6 +-
 drivers/platform/x86/acer-wmi.c                    |   1 +
 drivers/platform/x86/dell-smbios-base.c            |   1 +
 drivers/platform/x86/intel-vbtn.c                  |  12 ++
 drivers/platform/x86/mlx-platform.c                |  16 +--
 drivers/platform/x86/thinkpad_acpi.c               |  10 +-
 drivers/power/supply/axp288_charger.c              |  28 +++--
 drivers/power/supply/bq24190_charger.c             |  20 +++-
 drivers/ps3/ps3stor_lib.c                          |   2 +-
 drivers/pwm/pwm-lp3943.c                           |   1 +
 drivers/pwm/pwm-zx.c                               |   1 +
 drivers/s390/block/dasd_alias.c                    |  22 +++-
 drivers/scsi/be2iscsi/be_main.c                    |   4 +-
 drivers/scsi/bnx2i/Kconfig                         |   1 +
 drivers/scsi/fnic/fnic_main.c                      |   1 +
 drivers/scsi/lpfc/lpfc_mem.c                       |   6 +-
 drivers/scsi/lpfc/lpfc_sli.c                       |  10 +-
 drivers/scsi/megaraid/megaraid_sas_base.c          |  16 ++-
 drivers/scsi/mpt3sas/mpt3sas_base.c                |   2 +-
 drivers/scsi/pm8001/pm8001_init.c                  |   3 +-
 drivers/scsi/qedi/qedi_main.c                      |   4 +-
 drivers/scsi/scsi_lib.c                            | 126 ++++++++++++++-------
 drivers/scsi/ufs/ufshcd.c                          |   7 ++
 drivers/slimbus/qcom-ngd-ctrl.c                    |   6 +
 drivers/soc/fsl/dpio/dpio-driver.c                 |   5 +-
 drivers/soc/mediatek/mtk-scpsys.c                  |   5 +-
 drivers/soc/qcom/qcom-geni-se.c                    |  17 ++-
 drivers/soc/qcom/smp2p.c                           |   5 +-
 drivers/soc/tegra/fuse/speedo-tegra210.c           |   2 +-
 drivers/soc/ti/knav_dma.c                          |  13 ++-
 drivers/soc/ti/knav_qmss_queue.c                   |   4 +-
 drivers/spi/spi-bcm2835aux.c                       |  17 +--
 drivers/spi/spi-bcm63xx-hsspi.c                    |   4 +-
 drivers/spi/spi-davinci.c                          |   2 +-
 drivers/spi/spi-img-spfi.c                         |   4 +-
 drivers/spi/spi-mxs.c                              |   1 +
 drivers/spi/spi-pic32.c                            |   1 +
 drivers/spi/spi-rb4xx.c                            |   2 +-
 drivers/spi/spi-sc18is602.c                        |  13 +--
 drivers/spi/spi-sh.c                               |  13 +--
 drivers/spi/spi-st-ssc4.c                          |   5 +-
 drivers/spi/spi-tegra114.c                         |   2 +
 drivers/spi/spi-tegra20-sflash.c                   |   1 +
 drivers/spi/spi-tegra20-slink.c                    |   2 +
 drivers/spi/spi-ti-qspi.c                          |   1 +
 drivers/spi/spi.c                                  |  19 ++--
 drivers/staging/comedi/drivers/mf6x4.c             |   3 +-
 drivers/staging/gasket/gasket_interrupt.c          |  15 ++-
 drivers/staging/greybus/audio_codec.c              |   2 +
 drivers/staging/mt7621-spi/spi-mt7621.c            |   2 +
 drivers/staging/speakup/speakup_dectlk.c           |   2 +-
 drivers/tty/serial/8250/8250_omap.c                |   5 -
 drivers/tty/serial/serial_core.c                   |   4 +
 drivers/usb/chipidea/ci_hdrc_imx.c                 |   3 +-
 drivers/usb/core/quirks.c                          |   3 +
 drivers/usb/gadget/function/f_acm.c                |   2 +-
 drivers/usb/gadget/function/f_fs.c                 |   5 +-
 drivers/usb/gadget/function/f_midi.c               |   6 +
 drivers/usb/gadget/function/f_rndis.c              |   4 +-
 drivers/usb/gadget/udc/dummy_hcd.c                 |   2 +-
 drivers/usb/host/ehci-omap.c                       |   1 +
 drivers/usb/host/max3421-hcd.c                     |   3 +-
 drivers/usb/host/oxu210hp-hcd.c                    |   4 +-
 drivers/usb/host/xhci-hub.c                        |   4 +
 drivers/usb/misc/sisusbvga/Kconfig                 |   2 +-
 drivers/usb/serial/digi_acceleport.c               |  45 +++-----
 drivers/usb/serial/keyspan_pda.c                   |  63 ++++++-----
 drivers/usb/serial/mos7720.c                       |   2 +
 drivers/usb/serial/option.c                        |  23 +++-
 drivers/usb/storage/uas.c                          |   3 +
 drivers/usb/storage/unusual_uas.h                  |   7 +-
 drivers/usb/storage/usb.c                          |   3 +
 drivers/vfio/pci/vfio_pci.c                        |   4 +-
 drivers/video/fbdev/atmel_lcdfb.c                  |   2 +-
 drivers/watchdog/Kconfig                           |   3 +-
 drivers/watchdog/qcom-wdt.c                        |   2 +-
 drivers/watchdog/sprd_wdt.c                        |  34 +++---
 drivers/watchdog/watchdog_core.c                   |  22 ++--
 drivers/xen/xen-pciback/xenbus.c                   |   2 +-
 drivers/xen/xenbus/xenbus.h                        |   2 +
 drivers/xen/xenbus/xenbus_client.c                 |   8 +-
 drivers/xen/xenbus/xenbus_probe.c                  |   1 +
 drivers/xen/xenbus/xenbus_probe_backend.c          |   7 ++
 drivers/xen/xenbus/xenbus_xs.c                     |  34 ++++--
 fs/ceph/caps.c                                     |  11 +-
 fs/cifs/smb2ops.c                                  |   3 +-
 fs/cifs/smb2pdu.c                                  |   7 +-
 fs/cifs/smb2pdu.h                                  |  14 ++-
 fs/ext4/inode.c                                    |  19 +++-
 fs/ext4/mballoc.c                                  |   1 +
 fs/jffs2/readinode.c                               |  16 +++
 fs/jfs/jfs_dmap.h                                  |   2 +-
 fs/lockd/host.c                                    |  20 ++--
 fs/nfs/inode.c                                     |   2 +-
 fs/nfs/nfs4proc.c                                  |  10 +-
 fs/nfs_common/grace.c                              |   6 +-
 fs/nfsd/nfssvc.c                                   |   3 +-
 fs/quota/quota_v2.c                                |  19 ++++
 fs/ubifs/io.c                                      |  13 ++-
 include/acpi/acpi_bus.h                            |   5 -
 include/linux/build_bug.h                          |   5 +
 include/linux/compiler-clang.h                     |   1 -
 include/linux/compiler-gcc.h                       |  19 ----
 include/linux/compiler.h                           |  18 ++-
 include/linux/inetdevice.h                         |   4 +-
 include/linux/netfilter/x_tables.h                 |   5 +-
 include/linux/security.h                           |   2 +-
 include/linux/seq_buf.h                            |   2 +-
 include/linux/sunrpc/xprt.h                        |   1 +
 include/linux/trace_seq.h                          |   4 +-
 include/linux/usb_usual.h                          |   2 +
 include/uapi/linux/if_alg.h                        |  16 +++
 include/xen/xenbus.h                               |  15 ++-
 kernel/cpu.c                                       |   6 +-
 kernel/irq/irqdomain.c                             |  11 +-
 kernel/sched/core.c                                |   6 +-
 kernel/sched/deadline.c                            |   5 +-
 kernel/sched/sched.h                               |  42 +++----
 net/bluetooth/hci_event.c                          |  17 +--
 net/bridge/br_vlan.c                               |   4 +-
 net/core/lwt_bpf.c                                 |   8 +-
 net/ipv4/netfilter/arp_tables.c                    |  14 +--
 net/ipv4/netfilter/ip_tables.c                     |  14 +--
 net/ipv4/tcp_input.c                               |   3 +-
 net/ipv4/tcp_output.c                              |   9 +-
 net/ipv6/netfilter/ip6_tables.c                    |  14 +--
 net/mac80211/mesh_pathtbl.c                        |   4 +-
 net/mac80211/vht.c                                 |  14 ++-
 net/netfilter/x_tables.c                           |  49 +++-----
 net/sunrpc/xprt.c                                  |  65 ++++++++---
 net/sunrpc/xprtrdma/module.c                       |   1 +
 net/sunrpc/xprtrdma/transport.c                    |   1 +
 net/sunrpc/xprtsock.c                              |   4 +
 net/wireless/nl80211.c                             |   2 +-
 net/xdp/xsk.c                                      |   8 +-
 samples/bpf/lwt_len_hist.sh                        |   2 +
 samples/bpf/test_lwt_bpf.sh                        |   0
 scripts/checkpatch.pl                              |   2 +-
 scripts/kconfig/preprocess.c                       |   2 +-
 security/integrity/ima/ima_crypto.c                |  20 +---
 security/selinux/hooks.c                           |  16 ++-
 sound/core/oss/pcm_oss.c                           |  28 +++--
 sound/pci/hda/hda_codec.c                          |   2 +-
 sound/pci/hda/hda_sysfs.c                          |   2 +-
 sound/pci/hda/patch_ca0132.c                       |   2 +-
 sound/pci/hda/patch_realtek.c                      |   4 +
 sound/soc/codecs/wm8997.c                          |   2 +
 sound/soc/codecs/wm8998.c                          |   4 +-
 sound/soc/codecs/wm_adsp.c                         |   5 +-
 sound/soc/jz4740/jz4740-i2s.c                      |   4 +
 sound/soc/meson/Kconfig                            |   2 +-
 sound/soc/soc-pcm.c                                |   2 +
 sound/usb/clock.c                                  |   6 +
 sound/usb/format.c                                 |   2 +
 sound/usb/quirks.c                                 |   1 +
 sound/usb/stream.c                                 |   6 +-
 tools/perf/util/cs-etm-decoder/cs-etm-decoder.c    |   8 +-
 tools/perf/util/cs-etm.c                           |  29 ++++-
 tools/perf/util/cs-etm.h                           |  10 +-
 tools/perf/util/parse-regs-options.c               |   2 +-
 tools/testing/ktest/ktest.pl                       |   7 +-
 tools/testing/selftests/bpf/test_offload.py        |   1 +
 354 files changed, 2093 insertions(+), 1109 deletions(-)



^ permalink raw reply	[flat|nested] 359+ messages in thread

* [PATCH 4.19 001/346] Kbuild: do not emit debug info for assembly with LLVM_IAS=1
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 4.19 002/346] x86/lib: Change .weak to SYM_FUNC_START_WEAK for arch/x86/lib/mem*_64.S Greg Kroah-Hartman
                   ` (347 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dmitry Golovin, Nathan Chancellor,
	Sedat Dilek, Fangrui Song, Nick Desaulniers, Masahiro Yamada

From: Nick Desaulniers <ndesaulniers@google.com>

commit b8a9092330da2030496ff357272f342eb970d51b upstream.

Clang's integrated assembler produces the warning for assembly files:

warning: DWARF2 only supports one section per compilation unit

If -Wa,-gdwarf-* is unspecified, then debug info is not emitted for
assembly sources (it is still emitted for C sources).  This will be
re-enabled for newer DWARF versions in a follow up patch.

Enables defconfig+CONFIG_DEBUG_INFO to build cleanly with
LLVM=1 LLVM_IAS=1 for x86_64 and arm64.

Cc: <stable@vger.kernel.org>
Link: https://github.com/ClangBuiltLinux/linux/issues/716
Reported-by: Dmitry Golovin <dima@golovin.in>
Reported-by: Nathan Chancellor <natechancellor@gmail.com>
Suggested-by: Dmitry Golovin <dima@golovin.in>
Suggested-by: Nathan Chancellor <natechancellor@gmail.com>
Suggested-by: Sedat Dilek <sedat.dilek@gmail.com>
Reviewed-by: Fangrui Song <maskray@google.com>
Reviewed-by: Nathan Chancellor <natechancellor@gmail.com>
Signed-off-by: Nick Desaulniers <ndesaulniers@google.com>
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
[nd: backport to avoid conflicts from:
  commit 10e68b02c861 ("Makefile: support compressed debug info")
  commit 7b16994437c7 ("Makefile: Improve compressed debug info support detection")
  commit 695afd3d7d58 ("kbuild: Simplify DEBUG_INFO Kconfig handling")]
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Makefile |    3 +++
 1 file changed, 3 insertions(+)

--- a/Makefile
+++ b/Makefile
@@ -745,8 +745,11 @@ KBUILD_CFLAGS   += $(call cc-option, -gs
 else
 KBUILD_CFLAGS	+= -g
 endif
+ifneq ($(LLVM_IAS),1)
 KBUILD_AFLAGS	+= -Wa,-gdwarf-2
 endif
+endif
+
 ifdef CONFIG_DEBUG_INFO_DWARF4
 KBUILD_CFLAGS	+= $(call cc-option, -gdwarf-4,)
 endif



^ permalink raw reply	[flat|nested] 359+ messages in thread

* [PATCH 4.19 002/346] x86/lib: Change .weak to SYM_FUNC_START_WEAK for arch/x86/lib/mem*_64.S
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 4.19 001/346] Kbuild: do not emit debug info for assembly with LLVM_IAS=1 Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 4.19 003/346] spi: bcm2835aux: Fix use-after-free on unbind Greg Kroah-Hartman
                   ` (346 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sami Tolvanen, Fangrui Song,
	Borislav Petkov, Nick Desaulniers, Nathan Chancellor

From: Fangrui Song <maskray@google.com>

commit 4d6ffa27b8e5116c0abb318790fd01d4e12d75e6 upstream.

Commit

  393f203f5fd5 ("x86_64: kasan: add interceptors for memset/memmove/memcpy functions")

added .weak directives to arch/x86/lib/mem*_64.S instead of changing the
existing ENTRY macros to WEAK. This can lead to the assembly snippet

  .weak memcpy
  ...
  .globl memcpy

which will produce a STB_WEAK memcpy with GNU as but STB_GLOBAL memcpy
with LLVM's integrated assembler before LLVM 12. LLVM 12 (since
https://reviews.llvm.org/D90108) will error on such an overridden symbol
binding.

Commit

  ef1e03152cb0 ("x86/asm: Make some functions local")

changed ENTRY in arch/x86/lib/memcpy_64.S to SYM_FUNC_START_LOCAL, which
was ineffective due to the preceding .weak directive.

Use the appropriate SYM_FUNC_START_WEAK instead.

Fixes: 393f203f5fd5 ("x86_64: kasan: add interceptors for memset/memmove/memcpy functions")
Fixes: ef1e03152cb0 ("x86/asm: Make some functions local")
Reported-by: Sami Tolvanen <samitolvanen@google.com>
Signed-off-by: Fangrui Song <maskray@google.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
Tested-by: Nathan Chancellor <natechancellor@gmail.com>
Tested-by: Nick Desaulniers <ndesaulniers@google.com>
Cc: <stable@vger.kernel.org>
Link: https://lkml.kernel.org/r/20201103012358.168682-1-maskray@google.com
[nd: backport due to missing
  commit e9b9d020c487 ("x86/asm: Annotate aliases")
  commit ffedeeb780dc ("linkage: Introduce new macros for assembler symbols")]
Signed-off-by: Nick Desaulniers <ndesaulniers@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/lib/memcpy_64.S  |    6 +++---
 arch/x86/lib/memmove_64.S |    4 ++--
 arch/x86/lib/memset_64.S  |    6 +++---
 3 files changed, 8 insertions(+), 8 deletions(-)

--- a/arch/x86/lib/memcpy_64.S
+++ b/arch/x86/lib/memcpy_64.S
@@ -14,8 +14,6 @@
  * to a jmp to memcpy_erms which does the REP; MOVSB mem copy.
  */
 
-.weak memcpy
-
 /*
  * memcpy - Copy a memory block.
  *
@@ -28,7 +26,9 @@
  * rax original destination
  */
 ENTRY(__memcpy)
-ENTRY(memcpy)
+.weak memcpy
+.p2align 4, 0x90
+memcpy:
 	ALTERNATIVE_2 "jmp memcpy_orig", "", X86_FEATURE_REP_GOOD, \
 		      "jmp memcpy_erms", X86_FEATURE_ERMS
 
--- a/arch/x86/lib/memmove_64.S
+++ b/arch/x86/lib/memmove_64.S
@@ -25,8 +25,8 @@
  * rax: dest
  */
 .weak memmove
-
-ENTRY(memmove)
+.p2align 4, 0x90
+memmove:
 ENTRY(__memmove)
 
 	/* Handle more 32 bytes in loop */
--- a/arch/x86/lib/memset_64.S
+++ b/arch/x86/lib/memset_64.S
@@ -6,8 +6,6 @@
 #include <asm/alternative-asm.h>
 #include <asm/export.h>
 
-.weak memset
-
 /*
  * ISO C memset - set a memory block to a byte value. This function uses fast
  * string to get better performance than the original function. The code is
@@ -19,7 +17,9 @@
  *
  * rax   original destination
  */
-ENTRY(memset)
+.weak memset
+.p2align 4, 0x90
+memset:
 ENTRY(__memset)
 	/*
 	 * Some CPUs support enhanced REP MOVSB/STOSB feature. It is recommended



^ permalink raw reply	[flat|nested] 359+ messages in thread

* [PATCH 4.19 003/346] spi: bcm2835aux: Fix use-after-free on unbind
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 4.19 001/346] Kbuild: do not emit debug info for assembly with LLVM_IAS=1 Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 4.19 002/346] x86/lib: Change .weak to SYM_FUNC_START_WEAK for arch/x86/lib/mem*_64.S Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 4.19 004/346] spi: bcm2835aux: Restore err assignment in bcm2835aux_spi_probe Greg Kroah-Hartman
                   ` (345 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Lukas Wunner, Mark Brown

From: Lukas Wunner <lukas@wunner.de>

[ Upstream commit e13ee6cc4781edaf8c7321bee19217e3702ed481 ]

bcm2835aux_spi_remove() accesses the driver's private data after calling
spi_unregister_master() even though that function releases the last
reference on the spi_master and thereby frees the private data.

Fix by switching over to the new devm_spi_alloc_master() helper which
keeps the private data accessible until the driver has unbound.

Fixes: b9dd3f6d4172 ("spi: bcm2835aux: Fix controller unregister order")
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: <stable@vger.kernel.org> # v4.4+: 5e844cc37a5c: spi: Introduce device-managed SPI controller allocation
Cc: <stable@vger.kernel.org> # v4.4+: b9dd3f6d4172: spi: bcm2835aux: Fix controller unregister order
Cc: <stable@vger.kernel.org> # v4.4+
Link: https://lore.kernel.org/r/b290b06357d0c0bdee9cecc539b840a90630f101.1605121038.git.lukas@wunner.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/spi/spi-bcm2835aux.c |   18 ++++++------------
 1 file changed, 6 insertions(+), 12 deletions(-)

--- a/drivers/spi/spi-bcm2835aux.c
+++ b/drivers/spi/spi-bcm2835aux.c
@@ -407,7 +407,7 @@ static int bcm2835aux_spi_probe(struct p
 	unsigned long clk_hz;
 	int err;
 
-	master = spi_alloc_master(&pdev->dev, sizeof(*bs));
+	master = devm_spi_alloc_master(&pdev->dev, sizeof(*bs));
 	if (!master) {
 		dev_err(&pdev->dev, "spi_alloc_master() failed\n");
 		return -ENOMEM;
@@ -439,30 +439,26 @@ static int bcm2835aux_spi_probe(struct p
 	/* the main area */
 	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
 	bs->regs = devm_ioremap_resource(&pdev->dev, res);
-	if (IS_ERR(bs->regs)) {
-		err = PTR_ERR(bs->regs);
-		goto out_master_put;
-	}
+	if (IS_ERR(bs->regs))
+		return PTR_ERR(bs->regs);
 
 	bs->clk = devm_clk_get(&pdev->dev, NULL);
 	if ((!bs->clk) || (IS_ERR(bs->clk))) {
-		err = PTR_ERR(bs->clk);
 		dev_err(&pdev->dev, "could not get clk: %d\n", err);
-		goto out_master_put;
+		return PTR_ERR(bs->clk);
 	}
 
 	bs->irq = platform_get_irq(pdev, 0);
 	if (bs->irq <= 0) {
 		dev_err(&pdev->dev, "could not get IRQ: %d\n", bs->irq);
-		err = bs->irq ? bs->irq : -ENODEV;
-		goto out_master_put;
+		return bs->irq ? bs->irq : -ENODEV;
 	}
 
 	/* this also enables the HW block */
 	err = clk_prepare_enable(bs->clk);
 	if (err) {
 		dev_err(&pdev->dev, "could not prepare clock: %d\n", err);
-		goto out_master_put;
+		return err;
 	}
 
 	/* just checking if the clock returns a sane value */
@@ -495,8 +491,6 @@ static int bcm2835aux_spi_probe(struct p
 
 out_clk_disable:
 	clk_disable_unprepare(bs->clk);
-out_master_put:
-	spi_master_put(master);
 	return err;
 }
 



^ permalink raw reply	[flat|nested] 359+ messages in thread

* [PATCH 4.19 004/346] spi: bcm2835aux: Restore err assignment in bcm2835aux_spi_probe
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (2 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 4.19 003/346] spi: bcm2835aux: Fix use-after-free on unbind Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 4.19 005/346] iwlwifi: pcie: limit memory read spin time Greg Kroah-Hartman
                   ` (344 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Nathan Chancellor, Mark Brown, Lukas Wunner

From: Nathan Chancellor <natechancellor@gmail.com>

[ Upstream commit d853b3406903a7dc5b14eb5bada3e8cd677f66a2 ]

Clang warns:

drivers/spi/spi-bcm2835aux.c:532:50: warning: variable 'err' is
uninitialized when used here [-Wuninitialized]
                dev_err(&pdev->dev, "could not get clk: %d\n", err);
                                                               ^~~
./include/linux/dev_printk.h:112:32: note: expanded from macro 'dev_err'
        _dev_err(dev, dev_fmt(fmt), ##__VA_ARGS__)
                                      ^~~~~~~~~~~
drivers/spi/spi-bcm2835aux.c:495:9: note: initialize the variable 'err'
to silence this warning
        int err;
               ^
                = 0
1 warning generated.

Restore the assignment so that the error value can be used in the
dev_err statement and there is no uninitialized memory being leaked.

Fixes: e13ee6cc4781 ("spi: bcm2835aux: Fix use-after-free on unbind")
Link: https://github.com/ClangBuiltLinux/linux/issues/1199
Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
Link: https://lore.kernel.org/r/20201113180701.455541-1-natechancellor@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
[lukas: backport to 4.19-stable, add stable designation]
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: <stable@vger.kernel.org> # v4.4+: e13ee6cc4781: spi: bcm2835aux: Fix use-after-free on unbind
Cc: <stable@vger.kernel.org> # v4.4+
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/spi/spi-bcm2835aux.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/spi/spi-bcm2835aux.c
+++ b/drivers/spi/spi-bcm2835aux.c
@@ -444,8 +444,9 @@ static int bcm2835aux_spi_probe(struct p
 
 	bs->clk = devm_clk_get(&pdev->dev, NULL);
 	if ((!bs->clk) || (IS_ERR(bs->clk))) {
+		err = PTR_ERR(bs->clk);
 		dev_err(&pdev->dev, "could not get clk: %d\n", err);
-		return PTR_ERR(bs->clk);
+		return err;
 	}
 
 	bs->irq = platform_get_irq(pdev, 0);



^ permalink raw reply	[flat|nested] 359+ messages in thread

* [PATCH 4.19 005/346] iwlwifi: pcie: limit memory read spin time
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (3 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 4.19 004/346] spi: bcm2835aux: Restore err assignment in bcm2835aux_spi_probe Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 4.19 006/346] arm64: dts: rockchip: Assign a fixed index to mmc devices on rk3399 boards Greg Kroah-Hartman
                   ` (343 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Johannes Berg, Mordechay Goodstein,
	Luca Coelho, Kalle Valo, Sasha Levin

From: Johannes Berg <johannes.berg@intel.com>

[ Upstream commit 04516706bb99889986ddfa3a769ed50d2dc7ac13 ]

When we read device memory, we lock a spinlock, write the address we
want to read from the device and then spin in a loop reading the data
in 32-bit quantities from another register.

As the description makes clear, this is rather inefficient, incurring
a PCIe bus transaction for every read. In a typical device today, we
want to read 786k SMEM if it crashes, leading to 192k register reads.
Occasionally, we've seen the whole loop take over 20 seconds and then
triggering the soft lockup detector.

Clearly, it is unreasonable to spin here for such extended periods of
time.

To fix this, break the loop down into an outer and an inner loop, and
break out of the inner loop if more than half a second elapsed. To
avoid too much overhead, check for that only every 128 reads, though
there's no particular reason for that number. Then, unlock and relock
to obtain NIC access again, reprogram the start address and continue.

This will keep (interrupt) latencies on the CPU down to a reasonable
time.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Mordechay Goodstein <mordechay.goodstein@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/iwlwifi.20201022165103.45878a7e49aa.I3b9b9c5a10002915072312ce75b68ed5b3dc6e14@changeid
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../net/wireless/intel/iwlwifi/pcie/trans.c   | 36 ++++++++++++++-----
 1 file changed, 27 insertions(+), 9 deletions(-)

diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
index 24da496151353..f48c7cac122e9 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
@@ -2121,18 +2121,36 @@ static int iwl_trans_pcie_read_mem(struct iwl_trans *trans, u32 addr,
 				   void *buf, int dwords)
 {
 	unsigned long flags;
-	int offs, ret = 0;
+	int offs = 0;
 	u32 *vals = buf;
 
-	if (iwl_trans_grab_nic_access(trans, &flags)) {
-		iwl_write32(trans, HBUS_TARG_MEM_RADDR, addr);
-		for (offs = 0; offs < dwords; offs++)
-			vals[offs] = iwl_read32(trans, HBUS_TARG_MEM_RDAT);
-		iwl_trans_release_nic_access(trans, &flags);
-	} else {
-		ret = -EBUSY;
+	while (offs < dwords) {
+		/* limit the time we spin here under lock to 1/2s */
+		ktime_t timeout = ktime_add_us(ktime_get(), 500 * USEC_PER_MSEC);
+
+		if (iwl_trans_grab_nic_access(trans, &flags)) {
+			iwl_write32(trans, HBUS_TARG_MEM_RADDR,
+				    addr + 4 * offs);
+
+			while (offs < dwords) {
+				vals[offs] = iwl_read32(trans,
+							HBUS_TARG_MEM_RDAT);
+				offs++;
+
+				/* calling ktime_get is expensive so
+				 * do it once in 128 reads
+				 */
+				if (offs % 128 == 0 && ktime_after(ktime_get(),
+								   timeout))
+					break;
+			}
+			iwl_trans_release_nic_access(trans, &flags);
+		} else {
+			return -EBUSY;
+		}
 	}
-	return ret;
+
+	return 0;
 }
 
 static int iwl_trans_pcie_write_mem(struct iwl_trans *trans, u32 addr,
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 006/346] arm64: dts: rockchip: Assign a fixed index to mmc devices on rk3399 boards.
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (4 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 4.19 005/346] iwlwifi: pcie: limit memory read spin time Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 4.19 007/346] iwlwifi: mvm: fix kernel panic in case of assert during CSA Greg Kroah-Hartman
                   ` (342 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Markus Reichl, Douglas Anderson,
	Heiko Stuebner, Sasha Levin

From: Markus Reichl <m.reichl@fivetechno.de>

[ Upstream commit 0011c6d182774fc781fb9e115ebe8baa356029ae ]

Recently introduced async probe on mmc devices can shuffle block IDs.
Pin them to fixed values to ease booting in environments where UUIDs
are not practical. Use newly introduced aliases for mmcblk devices from [1].

[1]
https://patchwork.kernel.org/patch/11747669/

Signed-off-by: Markus Reichl <m.reichl@fivetechno.de>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Link: https://lore.kernel.org/r/20201104162356.1251-1-m.reichl@fivetechno.de
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/rockchip/rk3399.dtsi | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/arch/arm64/boot/dts/rockchip/rk3399.dtsi b/arch/arm64/boot/dts/rockchip/rk3399.dtsi
index f14e8c5c41acc..f4ee7c4f83b8b 100644
--- a/arch/arm64/boot/dts/rockchip/rk3399.dtsi
+++ b/arch/arm64/boot/dts/rockchip/rk3399.dtsi
@@ -29,6 +29,9 @@
 		i2c6 = &i2c6;
 		i2c7 = &i2c7;
 		i2c8 = &i2c8;
+		mmc0 = &sdio0;
+		mmc1 = &sdmmc;
+		mmc2 = &sdhci;
 		serial0 = &uart0;
 		serial1 = &uart1;
 		serial2 = &uart2;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 007/346] iwlwifi: mvm: fix kernel panic in case of assert during CSA
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (5 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 4.19 006/346] arm64: dts: rockchip: Assign a fixed index to mmc devices on rk3399 boards Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 4.19 008/346] powerpc: Drop -me200 addition to build flags Greg Kroah-Hartman
                   ` (341 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sara Sharon, Luca Coelho, Kalle Valo,
	Sasha Levin

From: Sara Sharon <sara.sharon@intel.com>

[ Upstream commit fe56d05ee6c87f6a1a8c7267affd92c9438249cc ]

During CSA, we briefly nullify the phy context, in __iwl_mvm_unassign_vif_chanctx.
In case we have a FW assert right after it, it remains NULL though.
We end up running into endless loop due to mac80211 trying repeatedly to
move us to ASSOC state, and we keep returning -EINVAL. Later down the road
we hit a kernel panic.

Detect and avoid this endless loop.

Signed-off-by: Sara Sharon <sara.sharon@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/iwlwifi.20201107104557.d64de2c17bff.Iedd0d2afa20a2aacba5259a5cae31cb3a119a4eb@changeid
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
index 525b26e0f65ee..2fad20c845b47 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
@@ -2880,7 +2880,7 @@ static int iwl_mvm_mac_sta_state(struct ieee80211_hw *hw,
 
 	/* this would be a mac80211 bug ... but don't crash */
 	if (WARN_ON_ONCE(!mvmvif->phy_ctxt))
-		return -EINVAL;
+		return test_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED, &mvm->status) ? 0 : -EINVAL;
 
 	/*
 	 * If we are in a STA removal flow and in DQA mode:
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 008/346] powerpc: Drop -me200 addition to build flags
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (6 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 4.19 007/346] iwlwifi: mvm: fix kernel panic in case of assert during CSA Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 4.19 009/346] ARC: stack unwinding: dont assume non-current task is sleeping Greg Kroah-Hartman
                   ` (340 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Németh Márton,
	kernel test robot, Michael Ellerman, Nick Desaulniers,
	Scott Wood, Sasha Levin

From: Michael Ellerman <mpe@ellerman.id.au>

[ Upstream commit e02152ba2810f7c88cb54e71cda096268dfa9241 ]

Currently a build with CONFIG_E200=y will fail with:

  Error: invalid switch -me200
  Error: unrecognized option -me200

Upstream binutils has never supported an -me200 option. Presumably it
was supported at some point by either a fork or Freescale internal
binutils.

We can't support code that we can't even build test, so drop the
addition of -me200 to the build flags, so we can at least build with
CONFIG_E200=y.

Reported-by: Németh Márton <nm127@freemail.hu>
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
Acked-by: Scott Wood <oss@buserror.net>
Link: https://lore.kernel.org/r/20201116120913.165317-1-mpe@ellerman.id.au
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/Makefile | 1 -
 1 file changed, 1 deletion(-)

diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile
index 8954108df4570..f51e21ea53492 100644
--- a/arch/powerpc/Makefile
+++ b/arch/powerpc/Makefile
@@ -251,7 +251,6 @@ endif
 
 cpu-as-$(CONFIG_4xx)		+= -Wa,-m405
 cpu-as-$(CONFIG_ALTIVEC)	+= $(call as-option,-Wa$(comma)-maltivec)
-cpu-as-$(CONFIG_E200)		+= -Wa,-me200
 cpu-as-$(CONFIG_E500)		+= -Wa,-me500
 
 # When using '-many -mpower4' gas will first try and find a matching power4
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 009/346] ARC: stack unwinding: dont assume non-current task is sleeping
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (7 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 4.19 008/346] powerpc: Drop -me200 addition to build flags Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 4.19 010/346] scsi: ufs: Make sure clk scaling happens only when HBA is runtime ACTIVE Greg Kroah-Hartman
                   ` (339 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Vineet Gupta, Sasha Levin

From: Vineet Gupta <vgupta@synopsys.com>

[ Upstream commit e42404fa10fd11fe72d0a0e149a321d10e577715 ]

To start stack unwinding (SP, PC and BLINK) are needed. When the
explicit execution context (pt_regs etc) is not available, unwinder
assumes the task is sleeping (in __switch_to()) and fetches SP and BLINK
from kernel mode stack.

But this assumption is not true, specially in a SMP system, when top
runs on 1 core, there may be active running processes on all cores.

So when unwinding non courrent tasks, ensure they are NOT running.

And while at it, handle the self unwinding case explicitly.

This came out of investigation of a customer reported hang with
rcutorture+top

Link: https://github.com/foss-for-synopsys-dwc-arc-processors/linux/issues/31
Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arc/kernel/stacktrace.c | 23 +++++++++++++++--------
 1 file changed, 15 insertions(+), 8 deletions(-)

diff --git a/arch/arc/kernel/stacktrace.c b/arch/arc/kernel/stacktrace.c
index 0fed32b959232..a211e87aa6d93 100644
--- a/arch/arc/kernel/stacktrace.c
+++ b/arch/arc/kernel/stacktrace.c
@@ -41,15 +41,15 @@
 
 #ifdef CONFIG_ARC_DW2_UNWIND
 
-static void seed_unwind_frame_info(struct task_struct *tsk,
-				   struct pt_regs *regs,
-				   struct unwind_frame_info *frame_info)
+static int
+seed_unwind_frame_info(struct task_struct *tsk, struct pt_regs *regs,
+		       struct unwind_frame_info *frame_info)
 {
 	/*
 	 * synchronous unwinding (e.g. dump_stack)
 	 *  - uses current values of SP and friends
 	 */
-	if (tsk == NULL && regs == NULL) {
+	if (regs == NULL && (tsk == NULL || tsk == current)) {
 		unsigned long fp, sp, blink, ret;
 		frame_info->task = current;
 
@@ -68,11 +68,15 @@ static void seed_unwind_frame_info(struct task_struct *tsk,
 		frame_info->call_frame = 0;
 	} else if (regs == NULL) {
 		/*
-		 * Asynchronous unwinding of sleeping task
-		 *  - Gets SP etc from task's pt_regs (saved bottom of kernel
-		 *    mode stack of task)
+		 * Asynchronous unwinding of a likely sleeping task
+		 *  - first ensure it is actually sleeping
+		 *  - if so, it will be in __switch_to, kernel mode SP of task
+		 *    is safe-kept and BLINK at a well known location in there
 		 */
 
+		if (tsk->state == TASK_RUNNING)
+			return -1;
+
 		frame_info->task = tsk;
 
 		frame_info->regs.r27 = TSK_K_FP(tsk);
@@ -106,6 +110,8 @@ static void seed_unwind_frame_info(struct task_struct *tsk,
 		frame_info->regs.r63 = regs->ret;
 		frame_info->call_frame = 0;
 	}
+
+	return 0;
 }
 
 #endif
@@ -119,7 +125,8 @@ arc_unwind_core(struct task_struct *tsk, struct pt_regs *regs,
 	unsigned int address;
 	struct unwind_frame_info frame_info;
 
-	seed_unwind_frame_info(tsk, regs, &frame_info);
+	if (seed_unwind_frame_info(tsk, regs, &frame_info))
+		return 0;
 
 	while (1) {
 		address = UNW_PC(&frame_info);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 010/346] scsi: ufs: Make sure clk scaling happens only when HBA is runtime ACTIVE
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (8 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 4.19 009/346] ARC: stack unwinding: dont assume non-current task is sleeping Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 4.19 011/346] irqchip/gic-v3-its: Unconditionally save/restore the ITS state on suspend Greg Kroah-Hartman
                   ` (338 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Stanley Chu, Can Guo,
	Martin K. Petersen, Sasha Levin

From: Can Guo <cang@codeaurora.org>

[ Upstream commit 73cc291c270248567245f084dcdf5078069af6b5 ]

If someone plays with the UFS clk scaling devfreq governor through sysfs,
ufshcd_devfreq_scale may be called even when HBA is not runtime ACTIVE.
This can lead to unexpected error. We cannot just protect it by calling
pm_runtime_get_sync() because that may cause a race condition since HBA
runtime suspend ops need to suspend clk scaling. To fix this call
pm_runtime_get_noresume() and check HBA's runtime status. Only proceed if
HBA is runtime ACTIVE, otherwise just bail.

governor_store
 devfreq_performance_handler
  update_devfreq
   devfreq_set_target
    ufshcd_devfreq_target
     ufshcd_devfreq_scale

Link: https://lore.kernel.org/r/1600758548-28576-1-git-send-email-cang@codeaurora.org
Reviewed-by: Stanley Chu <stanley.chu@mediatek.com>
Signed-off-by: Can Guo <cang@codeaurora.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/ufs/ufshcd.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
index 7e4e6e982055e..61b1eae42ea85 100644
--- a/drivers/scsi/ufs/ufshcd.c
+++ b/drivers/scsi/ufs/ufshcd.c
@@ -1281,8 +1281,15 @@ static int ufshcd_devfreq_target(struct device *dev,
 	}
 	spin_unlock_irqrestore(hba->host->host_lock, irq_flags);
 
+	pm_runtime_get_noresume(hba->dev);
+	if (!pm_runtime_active(hba->dev)) {
+		pm_runtime_put_noidle(hba->dev);
+		ret = -EAGAIN;
+		goto out;
+	}
 	start = ktime_get();
 	ret = ufshcd_devfreq_scale(hba, scale_up);
+	pm_runtime_put(hba->dev);
 
 	trace_ufshcd_profile_clk_scaling(dev_name(hba->dev),
 		(scale_up ? "up" : "down"),
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 011/346] irqchip/gic-v3-its: Unconditionally save/restore the ITS state on suspend
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (9 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 4.19 010/346] scsi: ufs: Make sure clk scaling happens only when HBA is runtime ACTIVE Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 4.19 012/346] soc: fsl: dpio: Get the cpumask through cpumask_of(cpu) Greg Kroah-Hartman
                   ` (337 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Xu Qiang, Marc Zyngier, Sasha Levin

From: Xu Qiang <xuqiang36@huawei.com>

[ Upstream commit 74cde1a53368aed4f2b4b54bf7030437f64a534b ]

On systems without HW-based collections (i.e. anything except GIC-500),
we rely on firmware to perform the ITS save/restore. This doesn't
really work, as although FW can properly save everything, it cannot
fully restore the state of the command queue (the read-side is reset
to the head of the queue). This results in the ITS consuming previously
processed commands, potentially corrupting the state.

Instead, let's always save the ITS state on suspend, disabling it in the
process, and restore the full state on resume. This saves us from broken
FW as long as it doesn't enable the ITS by itself (for which we can't do
anything).

This amounts to simply dropping the ITS_FLAGS_SAVE_SUSPEND_STATE.

Signed-off-by: Xu Qiang <xuqiang36@huawei.com>
[maz: added warning on resume, rewrote commit message]
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20201107104226.14282-1-xuqiang36@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/irqchip/irq-gic-v3-its.c | 16 +++-------------
 1 file changed, 3 insertions(+), 13 deletions(-)

diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
index d5cc32e80f5e2..cd58c123f547e 100644
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -49,7 +49,6 @@
 #define ITS_FLAGS_CMDQ_NEEDS_FLUSHING		(1ULL << 0)
 #define ITS_FLAGS_WORKAROUND_CAVIUM_22375	(1ULL << 1)
 #define ITS_FLAGS_WORKAROUND_CAVIUM_23144	(1ULL << 2)
-#define ITS_FLAGS_SAVE_SUSPEND_STATE		(1ULL << 3)
 
 #define RDIST_FLAGS_PROPBASE_NEEDS_FLUSHING	(1 << 0)
 
@@ -3240,9 +3239,6 @@ static int its_save_disable(void)
 	list_for_each_entry(its, &its_nodes, entry) {
 		void __iomem *base;
 
-		if (!(its->flags & ITS_FLAGS_SAVE_SUSPEND_STATE))
-			continue;
-
 		base = its->base;
 		its->ctlr_save = readl_relaxed(base + GITS_CTLR);
 		err = its_force_quiescent(base);
@@ -3261,9 +3257,6 @@ err:
 		list_for_each_entry_continue_reverse(its, &its_nodes, entry) {
 			void __iomem *base;
 
-			if (!(its->flags & ITS_FLAGS_SAVE_SUSPEND_STATE))
-				continue;
-
 			base = its->base;
 			writel_relaxed(its->ctlr_save, base + GITS_CTLR);
 		}
@@ -3283,9 +3276,6 @@ static void its_restore_enable(void)
 		void __iomem *base;
 		int i;
 
-		if (!(its->flags & ITS_FLAGS_SAVE_SUSPEND_STATE))
-			continue;
-
 		base = its->base;
 
 		/*
@@ -3293,7 +3283,10 @@ static void its_restore_enable(void)
 		 * don't restore it since writing to CBASER or BASER<n>
 		 * registers is undefined according to the GIC v3 ITS
 		 * Specification.
+		 *
+		 * Firmware resuming with the ITS enabled is terminally broken.
 		 */
+		WARN_ON(readl_relaxed(base + GITS_CTLR) & GITS_CTLR_ENABLE);
 		ret = its_force_quiescent(base);
 		if (ret) {
 			pr_err("ITS@%pa: failed to quiesce on resume: %d\n",
@@ -3558,9 +3551,6 @@ static int __init its_probe_one(struct resource *res,
 		ctlr |= GITS_CTLR_ImDe;
 	writel_relaxed(ctlr, its->base + GITS_CTLR);
 
-	if (GITS_TYPER_HCC(typer))
-		its->flags |= ITS_FLAGS_SAVE_SUSPEND_STATE;
-
 	err = its_init_domain(handle, its);
 	if (err)
 		goto out_free_tables;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 012/346] soc: fsl: dpio: Get the cpumask through cpumask_of(cpu)
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (10 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 4.19 011/346] irqchip/gic-v3-its: Unconditionally save/restore the ITS state on suspend Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 4.19 013/346] platform/x86: thinkpad_acpi: Do not report SW_TABLET_MODE on Yoga 11e Greg Kroah-Hartman
                   ` (336 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hao Si, Lin Chen, Yi Wang, Li Yang,
	Sasha Levin

From: Hao Si <si.hao@zte.com.cn>

[ Upstream commit 2663b3388551230cbc4606a40fabf3331ceb59e4 ]

The local variable 'cpumask_t mask' is in the stack memory, and its address
is assigned to 'desc->affinity' in 'irq_set_affinity_hint()'.
But the memory area where this variable is located is at risk of being
modified.

During LTP testing, the following error was generated:

Unable to handle kernel paging request at virtual address ffff000012e9b790
Mem abort info:
  ESR = 0x96000007
  Exception class = DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
Data abort info:
  ISV = 0, ISS = 0x00000007
  CM = 0, WnR = 0
swapper pgtable: 4k pages, 48-bit VAs, pgdp = 0000000075ac5e07
[ffff000012e9b790] pgd=00000027dbffe003, pud=00000027dbffd003,
pmd=00000027b6d61003, pte=0000000000000000
Internal error: Oops: 96000007 [#1] PREEMPT SMP
Modules linked in: xt_conntrack
Process read_all (pid: 20171, stack limit = 0x0000000044ea4095)
CPU: 14 PID: 20171 Comm: read_all Tainted: G    B   W
Hardware name: NXP Layerscape LX2160ARDB (DT)
pstate: 80000085 (Nzcv daIf -PAN -UAO)
pc : irq_affinity_hint_proc_show+0x54/0xb0
lr : irq_affinity_hint_proc_show+0x4c/0xb0
sp : ffff00001138bc10
x29: ffff00001138bc10 x28: 0000ffffd131d1e0
x27: 00000000007000c0 x26: ffff8025b9480dc0
x25: ffff8025b9480da8 x24: 00000000000003ff
x23: ffff8027334f8300 x22: ffff80272e97d000
x21: ffff80272e97d0b0 x20: ffff8025b9480d80
x19: ffff000009a49000 x18: 0000000000000000
x17: 0000000000000000 x16: 0000000000000000
x15: 0000000000000000 x14: 0000000000000000
x13: 0000000000000000 x12: 0000000000000040
x11: 0000000000000000 x10: ffff802735b79b88
x9 : 0000000000000000 x8 : 0000000000000000
x7 : ffff000009a49848 x6 : 0000000000000003
x5 : 0000000000000000 x4 : ffff000008157d6c
x3 : ffff00001138bc10 x2 : ffff000012e9b790
x1 : 0000000000000000 x0 : 0000000000000000
Call trace:
 irq_affinity_hint_proc_show+0x54/0xb0
 seq_read+0x1b0/0x440
 proc_reg_read+0x80/0xd8
 __vfs_read+0x60/0x178
 vfs_read+0x94/0x150
 ksys_read+0x74/0xf0
 __arm64_sys_read+0x24/0x30
 el0_svc_common.constprop.0+0xd8/0x1a0
 el0_svc_handler+0x34/0x88
 el0_svc+0x10/0x14
Code: f9001bbf 943e0732 f94066c2 b4000062 (f9400041)
---[ end trace b495bdcb0b3b732b ]---
Kernel panic - not syncing: Fatal exception
SMP: stopping secondary CPUs
SMP: failed to stop secondary CPUs 0,2-4,6,8,11,13-15
Kernel Offset: disabled
CPU features: 0x0,21006008
Memory Limit: none
---[ end Kernel panic - not syncing: Fatal exception ]---

Fix it by using 'cpumask_of(cpu)' to get the cpumask.

Signed-off-by: Hao Si <si.hao@zte.com.cn>
Signed-off-by: Lin Chen <chen.lin5@zte.com.cn>
Signed-off-by: Yi Wang <wang.yi59@zte.com.cn>
Signed-off-by: Li Yang <leoyang.li@nxp.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/soc/fsl/dpio/dpio-driver.c | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/drivers/soc/fsl/dpio/dpio-driver.c b/drivers/soc/fsl/dpio/dpio-driver.c
index b60b77bfaffae..ea6f8904c01b5 100644
--- a/drivers/soc/fsl/dpio/dpio-driver.c
+++ b/drivers/soc/fsl/dpio/dpio-driver.c
@@ -53,7 +53,6 @@ static int register_dpio_irq_handlers(struct fsl_mc_device *dpio_dev, int cpu)
 	struct dpio_priv *priv;
 	int error;
 	struct fsl_mc_device_irq *irq;
-	cpumask_t mask;
 
 	priv = dev_get_drvdata(&dpio_dev->dev);
 
@@ -72,9 +71,7 @@ static int register_dpio_irq_handlers(struct fsl_mc_device *dpio_dev, int cpu)
 	}
 
 	/* set the affinity hint */
-	cpumask_clear(&mask);
-	cpumask_set_cpu(cpu, &mask);
-	if (irq_set_affinity_hint(irq->msi_desc->irq, &mask))
+	if (irq_set_affinity_hint(irq->msi_desc->irq, cpumask_of(cpu)))
 		dev_err(&dpio_dev->dev,
 			"irq_set_affinity failed irq %d cpu %d\n",
 			irq->msi_desc->irq, cpu);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 013/346] platform/x86: thinkpad_acpi: Do not report SW_TABLET_MODE on Yoga 11e
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (11 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 4.19 012/346] soc: fsl: dpio: Get the cpumask through cpumask_of(cpu) Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 4.19 014/346] platform/x86: thinkpad_acpi: Add BAT1 is primary battery quirk for Thinkpad Yoga 11e 4th gen Greg Kroah-Hartman
                   ` (335 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Hans de Goede, Sasha Levin

From: Hans de Goede <hdegoede@redhat.com>

[ Upstream commit f2eae1888cf22590c38764b8fa3c989c0283870e ]

The Yoga 11e series has 2 accelerometers described by a BOSC0200 ACPI node.
This setup relies on a Windows service which reads both accelerometers and
then calculates the angle between the 2 halves to determine laptop / tent /
tablet mode and then reports the calculated mode back to the EC by calling
special ACPI methods on the BOSC0200 node.

The bmc150 iio driver does not support this (it involves double
calculations requiring sqrt and arccos so this really needs to be done
in userspace), as a result of this on the Yoga 11e the thinkpad_acpi
code always reports SW_TABLET_MODE=0, starting with GNOME 3.38 reporting
SW_TABLET_MODE=0 causes GNOME to:

1. Not show the onscreen keyboard when a text-input field is focussed
   with the touchscreen.
2. Disable accelerometer based auto display-rotation.

This makes sense when in laptop-mode but not when in tablet-mode. But
since for the Yoga 11e the thinkpad_acpi code always reports
SW_TABLET_MODE=0, GNOME does not know when the device is in tablet-mode.

Stop reporting the broken (always 0) SW_TABLET_MODE on Yoga 11e models
to fix this.

Note there are plans for userspace to support 360 degree hinges style
2-in-1s with 2 accelerometers and figure out the mode by itself, see:
https://gitlab.freedesktop.org/hadess/iio-sensor-proxy/-/issues/216

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Link: https://lore.kernel.org/r/20201106140130.46820-1-hdegoede@redhat.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/x86/thinkpad_acpi.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c
index 8cc01857bc5c0..79ac62d8ff7ba 100644
--- a/drivers/platform/x86/thinkpad_acpi.c
+++ b/drivers/platform/x86/thinkpad_acpi.c
@@ -3242,7 +3242,14 @@ static int hotkey_init_tablet_mode(void)
 
 		in_tablet_mode = hotkey_gmms_get_tablet_mode(res,
 							     &has_tablet_mode);
-		if (has_tablet_mode)
+		/*
+		 * The Yoga 11e series has 2 accelerometers described by a
+		 * BOSC0200 ACPI node. This setup relies on a Windows service
+		 * which calls special ACPI methods on this node to report
+		 * the laptop/tent/tablet mode to the EC. The bmc150 iio driver
+		 * does not support this, so skip the hotkey on these models.
+		 */
+		if (has_tablet_mode && !acpi_dev_present("BOSC0200", "1", -1))
 			tp_features.hotkey_tablet = TP_HOTKEY_TABLET_USES_GMMS;
 		type = "GMMS";
 	} else if (acpi_evalf(hkey_handle, &res, "MHKG", "qd")) {
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 014/346] platform/x86: thinkpad_acpi: Add BAT1 is primary battery quirk for Thinkpad Yoga 11e 4th gen
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (12 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 4.19 013/346] platform/x86: thinkpad_acpi: Do not report SW_TABLET_MODE on Yoga 11e Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 4.19 015/346] platform/x86: acer-wmi: add automatic keyboard background light toggle key as KEY_LIGHTS_TOGGLE Greg Kroah-Hartman
                   ` (334 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Hans de Goede, Sasha Levin

From: Hans de Goede <hdegoede@redhat.com>

[ Upstream commit c986a7024916c92a775fc8d853fba3cae1d5fde4 ]

The Thinkpad Yoga 11e 4th gen with the N3450 / Celeron CPU only has
one battery which is named BAT1 instead of the expected BAT0, add a
quirk for this. This fixes not being able to set the charging tresholds
on this model; and this alsoe fixes the following errors in dmesg:

ACPI: \_SB_.PCI0.LPCB.EC__.HKEY: BCTG evaluated but flagged as error
thinkpad_acpi: Error probing battery 2
battery: extension failed to load: ThinkPad Battery Extension
battery: extension unregistered: ThinkPad Battery Extension

Note that the added quirk is for the "R0K" BIOS versions which are
used on the Thinkpad Yoga 11e 4th gen's with a Celeron CPU, there
is a separate "R0L" BIOS for the i3/i5 based versions. This may also
need the same quirk, but if that really is necessary is unknown.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Link: https://lore.kernel.org/r/20201109103550.16265-1-hdegoede@redhat.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/x86/thinkpad_acpi.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c
index 79ac62d8ff7ba..a6e69f2495d23 100644
--- a/drivers/platform/x86/thinkpad_acpi.c
+++ b/drivers/platform/x86/thinkpad_acpi.c
@@ -9697,6 +9697,7 @@ static const struct tpacpi_quirk battery_quirk_table[] __initconst = {
 	TPACPI_Q_LNV3('R', '0', 'B', true), /* Thinkpad 11e gen 3 */
 	TPACPI_Q_LNV3('R', '0', 'C', true), /* Thinkpad 13 */
 	TPACPI_Q_LNV3('R', '0', 'J', true), /* Thinkpad 13 gen 2 */
+	TPACPI_Q_LNV3('R', '0', 'K', true), /* Thinkpad 11e gen 4 celeron BIOS */
 };
 
 static int __init tpacpi_battery_init(struct ibm_init_struct *ibm)
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 015/346] platform/x86: acer-wmi: add automatic keyboard background light toggle key as KEY_LIGHTS_TOGGLE
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (13 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 4.19 014/346] platform/x86: thinkpad_acpi: Add BAT1 is primary battery quirk for Thinkpad Yoga 11e 4th gen Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 4.19 016/346] platform/x86: intel-vbtn: Support for tablet mode on HP Pavilion 13 x360 PC Greg Kroah-Hartman
                   ` (333 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Timo Witte, Lee, Chun-Yi,
	Hans de Goede, Sasha Levin

From: Timo Witte <timo.witte@gmail.com>

[ Upstream commit 9e7a005ad56aa7d6ea5830c5ffcc60bf35de380b ]

Got a dmesg message on my AMD Renoir based Acer laptop:
"acer_wmi: Unknown key number - 0x84" when toggling keyboard
background light

Signed-off-by: Timo Witte <timo.witte@gmail.com>
Reviewed-by: "Lee, Chun-Yi" <jlee@suse.com>
Link: https://lore.kernel.org/r/20200804001423.36778-1-timo.witte@gmail.com
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/x86/acer-wmi.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c
index fcfeadd1301f4..92400abe35520 100644
--- a/drivers/platform/x86/acer-wmi.c
+++ b/drivers/platform/x86/acer-wmi.c
@@ -124,6 +124,7 @@ static const struct key_entry acer_wmi_keymap[] __initconst = {
 	{KE_KEY, 0x64, {KEY_SWITCHVIDEOMODE} },	/* Display Switch */
 	{KE_IGNORE, 0x81, {KEY_SLEEP} },
 	{KE_KEY, 0x82, {KEY_TOUCHPAD_TOGGLE} },	/* Touch Pad Toggle */
+	{KE_IGNORE, 0x84, {KEY_KBDILLUMTOGGLE} }, /* Automatic Keyboard background light toggle */
 	{KE_KEY, KEY_TOUCHPAD_ON, {KEY_TOUCHPAD_ON} },
 	{KE_KEY, KEY_TOUCHPAD_OFF, {KEY_TOUCHPAD_OFF} },
 	{KE_IGNORE, 0x83, {KEY_TOUCHPAD_TOGGLE} },
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 016/346] platform/x86: intel-vbtn: Support for tablet mode on HP Pavilion 13 x360 PC
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (14 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 4.19 015/346] platform/x86: acer-wmi: add automatic keyboard background light toggle key as KEY_LIGHTS_TOGGLE Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 4.19 017/346] Input: cm109 - do not stomp on control URB Greg Kroah-Hartman
                   ` (332 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Max Verevkin, Hans de Goede, Sasha Levin

From: Max Verevkin <me@maxverevkin.tk>

[ Upstream commit 8b205d3e1bf52ab31cdd5c55f87c87a227793d84 ]

The Pavilion 13 x360 PC has a chassis-type which does not indicate it is
a convertible, while it is actually a convertible. Add it to the
dmi_switches_allow_list.

Signed-off-by: Max Verevkin <me@maxverevkin.tk>
Link: https://lore.kernel.org/r/20201124131652.11165-1-me@maxverevkin.tk
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/x86/intel-vbtn.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/platform/x86/intel-vbtn.c b/drivers/platform/x86/intel-vbtn.c
index 1e6b4661c7645..3aba207ee1745 100644
--- a/drivers/platform/x86/intel-vbtn.c
+++ b/drivers/platform/x86/intel-vbtn.c
@@ -197,6 +197,12 @@ static const struct dmi_system_id dmi_switches_allow_list[] = {
 			DMI_MATCH(DMI_PRODUCT_NAME, "HP Stream x360 Convertible PC 11"),
 		},
 	},
+	{
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion 13 x360 PC"),
+		},
+	},
 	{} /* Array terminator */
 };
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 017/346] Input: cm109 - do not stomp on control URB
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (15 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 4.19 016/346] platform/x86: intel-vbtn: Support for tablet mode on HP Pavilion 13 x360 PC Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 4.19 018/346] Input: i8042 - add Acer laptops to the i8042 reset list Greg Kroah-Hartman
                   ` (331 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dmitry Torokhov, syzbot+150f793ac5bc18eee150

From: Dmitry Torokhov <dmitry.torokhov@gmail.com>

commit 82e06090473289ce63e23fdeb8737aad59b10645 upstream.

We need to make sure we are not stomping on the control URB that was
issued when opening the device when attempting to toggle buzzer.
To do that we need to mark it as pending in cm109_open().

Reported-and-tested-by: syzbot+150f793ac5bc18eee150@syzkaller.appspotmail.com
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/input/misc/cm109.c |    7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

--- a/drivers/input/misc/cm109.c
+++ b/drivers/input/misc/cm109.c
@@ -571,12 +571,15 @@ static int cm109_input_open(struct input
 	dev->ctl_data->byte[HID_OR2] = dev->keybit;
 	dev->ctl_data->byte[HID_OR3] = 0x00;
 
+	dev->ctl_urb_pending = 1;
 	error = usb_submit_urb(dev->urb_ctl, GFP_KERNEL);
-	if (error)
+	if (error) {
+		dev->ctl_urb_pending = 0;
 		dev_err(&dev->intf->dev, "%s: usb_submit_urb (urb_ctl) failed %d\n",
 			__func__, error);
-	else
+	} else {
 		dev->open = 1;
+	}
 
 	mutex_unlock(&dev->pm_mutex);
 



^ permalink raw reply	[flat|nested] 359+ messages in thread

* [PATCH 4.19 018/346] Input: i8042 - add Acer laptops to the i8042 reset list
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (16 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 4.19 017/346] Input: cm109 - do not stomp on control URB Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 4.19 019/346] pinctrl: amd: remove debounce filter setting in IRQ type setting Greg Kroah-Hartman
                   ` (330 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Chris Chiu, Dmitry Torokhov

From: Chris Chiu <chiu@endlessos.org>

commit ce6520b0eafad5962ffc21dc47cd7bd3250e9045 upstream.

The touchpad operates in Basic Mode by default in the Acer BIOS
setup, but some Aspire/TravelMate models require the i8042 to be
reset in order to be correctly detected.

Signed-off-by: Chris Chiu <chiu@endlessos.org>
Link: https://lore.kernel.org/r/20201207071250.15021-1-chiu@endlessos.org
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/input/serio/i8042-x86ia64io.h |   42 ++++++++++++++++++++++++++++++++++
 1 file changed, 42 insertions(+)

--- a/drivers/input/serio/i8042-x86ia64io.h
+++ b/drivers/input/serio/i8042-x86ia64io.h
@@ -616,6 +616,48 @@ static const struct dmi_system_id __init
 		},
 	},
 	{
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "Aspire A114-31"),
+		},
+	},
+	{
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "Aspire A314-31"),
+		},
+	},
+	{
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "Aspire A315-31"),
+		},
+	},
+	{
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "Aspire ES1-132"),
+		},
+	},
+	{
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "Aspire ES1-332"),
+		},
+	},
+	{
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "Aspire ES1-432"),
+		},
+	},
+	{
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "TravelMate Spin B118-RN"),
+		},
+	},
+	{
 		/* Advent 4211 */
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "DIXONSXP"),



^ permalink raw reply	[flat|nested] 359+ messages in thread

* [PATCH 4.19 019/346] pinctrl: amd: remove debounce filter setting in IRQ type setting
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (17 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 4.19 018/346] Input: i8042 - add Acer laptops to the i8042 reset list Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 4.19 020/346] mmc: block: Fixup condition for CMD13 polling for RPMB requests Greg Kroah-Hartman
                   ` (329 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Coiby Xu, Andy Shevchenko,
	Hans de Goede, Benjamin Tissoires, Linus Walleij

From: Coiby Xu <coiby.xu@gmail.com>

commit 47a0001436352c9853d72bf2071e85b316d688a2 upstream.

Debounce filter setting should be independent from IRQ type setting
because according to the ACPI specs, there are separate arguments for
specifying debounce timeout and IRQ type in GpioIo() and GpioInt().

Together with commit 06abe8291bc31839950f7d0362d9979edc88a666
("pinctrl: amd: fix incorrect way to disable debounce filter") and
Andy's patch "gpiolib: acpi: Take into account debounce settings" [1],
this will fix broken touchpads for laptops whose BIOS set the
debounce timeout to a relatively large value. For example, the BIOS
of Lenovo AMD gaming laptops including Legion-5 15ARH05 (R7000),
Legion-5P (R7000P) and IdeaPad Gaming 3 15ARH05, set the debounce
timeout to 124.8ms. This led to the kernel receiving only ~7 HID
reports per second from the Synaptics touchpad
(MSFT0001:00 06CB:7F28).

Existing touchpads like [2][3] are not troubled by this bug because
the debounce timeout has been set to 0 by the BIOS before enabling
the debounce filter in setting IRQ type.

[1] https://lore.kernel.org/linux-gpio/20201111222008.39993-11-andriy.shevchenko@linux.intel.com/
    8dcb7a15a585 ("gpiolib: acpi: Take into account debounce settings")
[2] https://github.com/Syniurge/i2c-amd-mp2/issues/11#issuecomment-721331582
[3] https://forum.manjaro.org/t/random-short-touchpad-freezes/30832/28

Signed-off-by: Coiby Xu <coiby.xu@gmail.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Cc: Hans de Goede <hdegoede@redhat.com>
Cc: Andy Shevchenko <andy.shevchenko@gmail.com>
Cc: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/linux-gpio/CAHp75VcwiGREBUJ0A06EEw-SyabqYsp%2Bdqs2DpSrhaY-2GVdAA%40mail.gmail.com/
BugLink: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1887190
Link: https://lore.kernel.org/r/20201125130320.311059-1-coiby.xu@gmail.com
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/pinctrl/pinctrl-amd.c |    7 -------
 1 file changed, 7 deletions(-)

--- a/drivers/pinctrl/pinctrl-amd.c
+++ b/drivers/pinctrl/pinctrl-amd.c
@@ -439,7 +439,6 @@ static int amd_gpio_irq_set_type(struct
 		pin_reg &= ~BIT(LEVEL_TRIG_OFF);
 		pin_reg &= ~(ACTIVE_LEVEL_MASK << ACTIVE_LEVEL_OFF);
 		pin_reg |= ACTIVE_HIGH << ACTIVE_LEVEL_OFF;
-		pin_reg |= DB_TYPE_REMOVE_GLITCH << DB_CNTRL_OFF;
 		irq_set_handler_locked(d, handle_edge_irq);
 		break;
 
@@ -447,7 +446,6 @@ static int amd_gpio_irq_set_type(struct
 		pin_reg &= ~BIT(LEVEL_TRIG_OFF);
 		pin_reg &= ~(ACTIVE_LEVEL_MASK << ACTIVE_LEVEL_OFF);
 		pin_reg |= ACTIVE_LOW << ACTIVE_LEVEL_OFF;
-		pin_reg |= DB_TYPE_REMOVE_GLITCH << DB_CNTRL_OFF;
 		irq_set_handler_locked(d, handle_edge_irq);
 		break;
 
@@ -455,7 +453,6 @@ static int amd_gpio_irq_set_type(struct
 		pin_reg &= ~BIT(LEVEL_TRIG_OFF);
 		pin_reg &= ~(ACTIVE_LEVEL_MASK << ACTIVE_LEVEL_OFF);
 		pin_reg |= BOTH_EADGE << ACTIVE_LEVEL_OFF;
-		pin_reg |= DB_TYPE_REMOVE_GLITCH << DB_CNTRL_OFF;
 		irq_set_handler_locked(d, handle_edge_irq);
 		break;
 
@@ -463,8 +460,6 @@ static int amd_gpio_irq_set_type(struct
 		pin_reg |= LEVEL_TRIGGER << LEVEL_TRIG_OFF;
 		pin_reg &= ~(ACTIVE_LEVEL_MASK << ACTIVE_LEVEL_OFF);
 		pin_reg |= ACTIVE_HIGH << ACTIVE_LEVEL_OFF;
-		pin_reg &= ~(DB_CNTRl_MASK << DB_CNTRL_OFF);
-		pin_reg |= DB_TYPE_PRESERVE_LOW_GLITCH << DB_CNTRL_OFF;
 		irq_set_handler_locked(d, handle_level_irq);
 		break;
 
@@ -472,8 +467,6 @@ static int amd_gpio_irq_set_type(struct
 		pin_reg |= LEVEL_TRIGGER << LEVEL_TRIG_OFF;
 		pin_reg &= ~(ACTIVE_LEVEL_MASK << ACTIVE_LEVEL_OFF);
 		pin_reg |= ACTIVE_LOW << ACTIVE_LEVEL_OFF;
-		pin_reg &= ~(DB_CNTRl_MASK << DB_CNTRL_OFF);
-		pin_reg |= DB_TYPE_PRESERVE_HIGH_GLITCH << DB_CNTRL_OFF;
 		irq_set_handler_locked(d, handle_level_irq);
 		break;
 



^ permalink raw reply	[flat|nested] 359+ messages in thread

* [PATCH 4.19 020/346] mmc: block: Fixup condition for CMD13 polling for RPMB requests
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (18 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 4.19 019/346] pinctrl: amd: remove debounce filter setting in IRQ type setting Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 4.19 021/346] kbuild: avoid static_assert for genksyms Greg Kroah-Hartman
                   ` (328 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Zhan Liu, Bean Huo, Ulf Hansson

From: Bean Huo <beanhuo@micron.com>

commit 6246d7c9d15aaff0bc3863f67900c6a6e6be921b upstream.

The CMD13 polling is needed for commands with R1B responses. In commit
a0d4c7eb71dd ("mmc: block: Add CMD13 polling for MMC IOCTLS with R1B
response"), the intent was to introduce this for requests targeted to the
RPMB partition. However, the condition to trigger the polling loop became
wrong, leading to unnecessary polling. Let's fix the condition to avoid
this.

Fixes: a0d4c7eb71dd ("mmc: block: Add CMD13 polling for MMC IOCTLS with R1B response")
Cc: stable@vger.kernel.org
Reported-by: Zhan Liu <zliua@micron.com>
Signed-off-by: Zhan Liu <zliua@micron.com>
Signed-off-by: Bean Huo <beanhuo@micron.com>
Link: https://lore.kernel.org/r/20201202202320.22165-1-huobean@gmail.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/mmc/core/block.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/mmc/core/block.c
+++ b/drivers/mmc/core/block.c
@@ -631,7 +631,7 @@ static int __mmc_blk_ioctl_cmd(struct mm
 
 	memcpy(&(idata->ic.response), cmd.resp, sizeof(cmd.resp));
 
-	if (idata->rpmb || (cmd.flags & MMC_RSP_R1B)) {
+	if (idata->rpmb || (cmd.flags & MMC_RSP_R1B) == MMC_RSP_R1B) {
 		/*
 		 * Ensure RPMB/R1B command has completed by polling CMD13
 		 * "Send Status".



^ permalink raw reply	[flat|nested] 359+ messages in thread

* [PATCH 4.19 021/346] kbuild: avoid static_assert for genksyms
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (19 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 4.19 020/346] mmc: block: Fixup condition for CMD13 polling for RPMB requests Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 4.19 022/346] scsi: be2iscsi: Revert "Fix a theoretical leak in beiscsi_create_eqs()" Greg Kroah-Hartman
                   ` (327 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Arnd Bergmann, Ard Biesheuvel,
	Masahiro Yamada, Michal Marek, Kees Cook, Rikard Falkeborn,
	Marco Elver, Andrew Morton, Linus Torvalds

From: Arnd Bergmann <arnd@arndb.de>

commit 14dc3983b5dff513a90bd5a8cc90acaf7867c3d0 upstream.

genksyms does not know or care about the _Static_assert() built-in, and
sometimes falls back to ignoring the later symbols, which causes
undefined behavior such as

  WARNING: modpost: EXPORT symbol "ethtool_set_ethtool_phy_ops" [vmlinux] version generation failed, symbol will not be versioned.
  ld: net/ethtool/common.o: relocation R_AARCH64_ABS32 against `__crc_ethtool_set_ethtool_phy_ops' can not be used when making a shared object
  net/ethtool/common.o:(_ftrace_annotated_branch+0x0): dangerous relocation: unsupported relocation

Redefine static_assert for genksyms to avoid that.

Link: https://lkml.kernel.org/r/20201203230955.1482058-1-arnd@kernel.org
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Suggested-by: Ard Biesheuvel <ardb@kernel.org>
Cc: Masahiro Yamada <masahiroy@kernel.org>
Cc: Michal Marek <michal.lkml@markovi.net>
Cc: Kees Cook <keescook@chromium.org>
Cc: Rikard Falkeborn <rikard.falkeborn@gmail.com>
Cc: Marco Elver <elver@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 include/linux/build_bug.h |    5 +++++
 1 file changed, 5 insertions(+)

--- a/include/linux/build_bug.h
+++ b/include/linux/build_bug.h
@@ -80,4 +80,9 @@
 
 #endif	/* __CHECKER__ */
 
+#ifdef __GENKSYMS__
+/* genksyms gets confused by _Static_assert */
+#define _Static_assert(expr, ...)
+#endif
+
 #endif	/* _LINUX_BUILD_BUG_H */



^ permalink raw reply	[flat|nested] 359+ messages in thread

* [PATCH 4.19 022/346] scsi: be2iscsi: Revert "Fix a theoretical leak in beiscsi_create_eqs()"
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (20 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 4.19 021/346] kbuild: avoid static_assert for genksyms Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 4.19 023/346] x86/mm/mem_encrypt: Fix definition of PMD_FLAGS_DEC_WP Greg Kroah-Hartman
                   ` (326 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Thomas Lamprecht, Dan Carpenter,
	Martin K. Petersen

From: Dan Carpenter <dan.carpenter@oracle.com>

commit eeaf06af6f87e1dba371fbe42674e6f963220b9c upstream.

My patch caused kernel Oopses and delays in boot.  Revert it.

The problem was that I moved the "mem->dma = paddr;" before the call to
be_fill_queue().  But the first thing that the be_fill_queue() function
does is memset the whole struct to zero which overwrites the assignment.

Link: https://lore.kernel.org/r/X8jXkt6eThjyVP1v@mwanda
Fixes: 38b2db564d9a ("scsi: be2iscsi: Fix a theoretical leak in beiscsi_create_eqs()")
Cc: stable <stable@vger.kernel.org>
Reported-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/scsi/be2iscsi/be_main.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/scsi/be2iscsi/be_main.c
+++ b/drivers/scsi/be2iscsi/be_main.c
@@ -3039,7 +3039,6 @@ static int beiscsi_create_eqs(struct bei
 			goto create_eq_error;
 		}
 
-		mem->dma = paddr;
 		mem->va = eq_vaddress;
 		ret = be_fill_queue(eq, phba->params.num_eq_entries,
 				    sizeof(struct be_eq_entry), eq_vaddress);
@@ -3049,6 +3048,7 @@ static int beiscsi_create_eqs(struct bei
 			goto create_eq_error;
 		}
 
+		mem->dma = paddr;
 		ret = beiscsi_cmd_eq_create(&phba->ctrl, eq,
 					    BEISCSI_EQ_DELAY_DEF);
 		if (ret) {
@@ -3105,7 +3105,6 @@ static int beiscsi_create_cqs(struct bei
 			goto create_cq_error;
 		}
 
-		mem->dma = paddr;
 		ret = be_fill_queue(cq, phba->params.num_cq_entries,
 				    sizeof(struct sol_cqe), cq_vaddress);
 		if (ret) {
@@ -3115,6 +3114,7 @@ static int beiscsi_create_cqs(struct bei
 			goto create_cq_error;
 		}
 
+		mem->dma = paddr;
 		ret = beiscsi_cmd_cq_create(&phba->ctrl, cq, eq, false,
 					    false, 0);
 		if (ret) {



^ permalink raw reply	[flat|nested] 359+ messages in thread

* [PATCH 4.19 023/346] x86/mm/mem_encrypt: Fix definition of PMD_FLAGS_DEC_WP
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (21 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 4.19 022/346] scsi: be2iscsi: Revert "Fix a theoretical leak in beiscsi_create_eqs()" Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 4.19 024/346] x86/membarrier: Get rid of a dubious optimization Greg Kroah-Hartman
                   ` (325 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Arvind Sankar, Borislav Petkov, Tom Lendacky

From: Arvind Sankar <nivedita@alum.mit.edu>

commit 29ac40cbed2bc06fa218ca25d7f5e280d3d08a25 upstream.

The PAT bit is in different locations for 4k and 2M/1G page table
entries.

Add a definition for _PAGE_LARGE_CACHE_MASK to represent the three
caching bits (PWT, PCD, PAT), similar to _PAGE_CACHE_MASK for 4k pages,
and use it in the definition of PMD_FLAGS_DEC_WP to get the correct PAT
index for write-protected pages.

Fixes: 6ebcb060713f ("x86/mm: Add support to encrypt the kernel in-place")
Signed-off-by: Arvind Sankar <nivedita@alum.mit.edu>
Signed-off-by: Borislav Petkov <bp@suse.de>
Tested-by: Tom Lendacky <thomas.lendacky@amd.com>
Cc: stable@vger.kernel.org
Link: https://lkml.kernel.org/r/20201111160946.147341-1-nivedita@alum.mit.edu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/x86/include/asm/pgtable_types.h |    1 +
 arch/x86/mm/mem_encrypt_identity.c   |    4 ++--
 2 files changed, 3 insertions(+), 2 deletions(-)

--- a/arch/x86/include/asm/pgtable_types.h
+++ b/arch/x86/include/asm/pgtable_types.h
@@ -148,6 +148,7 @@ enum page_cache_mode {
 #endif
 
 #define _PAGE_CACHE_MASK	(_PAGE_PAT | _PAGE_PCD | _PAGE_PWT)
+#define _PAGE_LARGE_CACHE_MASK	(_PAGE_PWT | _PAGE_PCD | _PAGE_PAT_LARGE)
 #define _PAGE_NOCACHE		(cachemode2protval(_PAGE_CACHE_MODE_UC))
 #define _PAGE_CACHE_WP		(cachemode2protval(_PAGE_CACHE_MODE_WP))
 
--- a/arch/x86/mm/mem_encrypt_identity.c
+++ b/arch/x86/mm/mem_encrypt_identity.c
@@ -47,8 +47,8 @@
 #define PMD_FLAGS_LARGE		(__PAGE_KERNEL_LARGE_EXEC & ~_PAGE_GLOBAL)
 
 #define PMD_FLAGS_DEC		PMD_FLAGS_LARGE
-#define PMD_FLAGS_DEC_WP	((PMD_FLAGS_DEC & ~_PAGE_CACHE_MASK) | \
-				 (_PAGE_PAT | _PAGE_PWT))
+#define PMD_FLAGS_DEC_WP	((PMD_FLAGS_DEC & ~_PAGE_LARGE_CACHE_MASK) | \
+				 (_PAGE_PAT_LARGE | _PAGE_PWT))
 
 #define PMD_FLAGS_ENC		(PMD_FLAGS_LARGE | _PAGE_ENC)
 



^ permalink raw reply	[flat|nested] 359+ messages in thread

* [PATCH 4.19 024/346] x86/membarrier: Get rid of a dubious optimization
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (22 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 4.19 023/346] x86/mm/mem_encrypt: Fix definition of PMD_FLAGS_DEC_WP Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 4.19 025/346] x86/apic/vector: Fix ordering in vector assignment Greg Kroah-Hartman
                   ` (324 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Andy Lutomirski, Thomas Gleixner,
	Mathieu Desnoyers

From: Andy Lutomirski <luto@kernel.org>

commit a493d1ca1a03b532871f1da27f8dbda2b28b04c4 upstream.

sync_core_before_usermode() had an incorrect optimization.  If the kernel
returns from an interrupt, it can get to usermode without IRET. It just has
to schedule to a different task in the same mm and do SYSRET.  Fortunately,
there were no callers of sync_core_before_usermode() that could have had
in_irq() or in_nmi() equal to true, because it's only ever called from the
scheduler.

While at it, clarify a related comment.

Fixes: 70216e18e519 ("membarrier: Provide core serializing command, *_SYNC_CORE")
Signed-off-by: Andy Lutomirski <luto@kernel.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/5afc7632be1422f91eaf7611aaaa1b5b8580a086.1607058304.git.luto@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/x86/include/asm/sync_core.h |    9 +++++----
 arch/x86/mm/tlb.c                |   10 ++++++++--
 2 files changed, 13 insertions(+), 6 deletions(-)

--- a/arch/x86/include/asm/sync_core.h
+++ b/arch/x86/include/asm/sync_core.h
@@ -16,12 +16,13 @@ static inline void sync_core_before_user
 	/* With PTI, we unconditionally serialize before running user code. */
 	if (static_cpu_has(X86_FEATURE_PTI))
 		return;
+
 	/*
-	 * Return from interrupt and NMI is done through iret, which is core
-	 * serializing.
+	 * Even if we're in an interrupt, we might reschedule before returning,
+	 * in which case we could switch to a different thread in the same mm
+	 * and return using SYSRET or SYSEXIT.  Instead of trying to keep
+	 * track of our need to sync the core, just sync right away.
 	 */
-	if (in_irq() || in_nmi())
-		return;
 	sync_core();
 }
 
--- a/arch/x86/mm/tlb.c
+++ b/arch/x86/mm/tlb.c
@@ -321,8 +321,14 @@ void switch_mm_irqs_off(struct mm_struct
 	/*
 	 * The membarrier system call requires a full memory barrier and
 	 * core serialization before returning to user-space, after
-	 * storing to rq->curr. Writing to CR3 provides that full
-	 * memory barrier and core serializing instruction.
+	 * storing to rq->curr, when changing mm.  This is because
+	 * membarrier() sends IPIs to all CPUs that are in the target mm
+	 * to make them issue memory barriers.  However, if another CPU
+	 * switches to/from the target mm concurrently with
+	 * membarrier(), it can cause that CPU not to receive an IPI
+	 * when it really should issue a memory barrier.  Writing to CR3
+	 * provides that full memory barrier and core serializing
+	 * instruction.
 	 */
 	if (real_prev == next) {
 		VM_WARN_ON(this_cpu_read(cpu_tlbstate.ctxs[prev_asid].ctx_id) !=



^ permalink raw reply	[flat|nested] 359+ messages in thread

* [PATCH 4.19 025/346] x86/apic/vector: Fix ordering in vector assignment
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (23 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 4.19 024/346] x86/membarrier: Get rid of a dubious optimization Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 4.19 026/346] compiler.h: fix barrier_data() on clang Greg Kroah-Hartman
                   ` (323 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Prarit Bhargava, Shung-Hsi Yu,
	Thomas Gleixner

From: Thomas Gleixner <tglx@linutronix.de>

commit 190113b4c6531c8e09b31d5235f9b5175cbb0f72 upstream.

Prarit reported that depending on the affinity setting the

 ' irq $N: Affinity broken due to vector space exhaustion.'

message is showing up in dmesg, but the vector space on the CPUs in the
affinity mask is definitely not exhausted.

Shung-Hsi provided traces and analysis which pinpoints the problem:

The ordering of trying to assign an interrupt vector in
assign_irq_vector_any_locked() is simply wrong if the interrupt data has a
valid node assigned. It does:

 1) Try the intersection of affinity mask and node mask
 2) Try the node mask
 3) Try the full affinity mask
 4) Try the full online mask

Obviously #2 and #3 are in the wrong order as the requested affinity
mask has to take precedence.

In the observed cases #1 failed because the affinity mask did not contain
CPUs from node 0. That made it allocate a vector from node 0, thereby
breaking affinity and emitting the misleading message.

Revert the order of #2 and #3 so the full affinity mask without the node
intersection is tried before actually affinity is broken.

If no node is assigned then only the full affinity mask and if that fails
the full online mask is tried.

Fixes: d6ffc6ac83b1 ("x86/vector: Respect affinity mask in irq descriptor")
Reported-by: Prarit Bhargava <prarit@redhat.com>
Reported-by: Shung-Hsi Yu <shung-hsi.yu@suse.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Tested-by: Shung-Hsi Yu <shung-hsi.yu@suse.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/87ft4djtyp.fsf@nanos.tec.linutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/x86/kernel/apic/vector.c |   24 ++++++++++++++----------
 1 file changed, 14 insertions(+), 10 deletions(-)

--- a/arch/x86/kernel/apic/vector.c
+++ b/arch/x86/kernel/apic/vector.c
@@ -274,20 +274,24 @@ static int assign_irq_vector_any_locked(
 	const struct cpumask *affmsk = irq_data_get_affinity_mask(irqd);
 	int node = irq_data_get_node(irqd);
 
-	if (node == NUMA_NO_NODE)
-		goto all;
-	/* Try the intersection of @affmsk and node mask */
-	cpumask_and(vector_searchmask, cpumask_of_node(node), affmsk);
-	if (!assign_vector_locked(irqd, vector_searchmask))
-		return 0;
-	/* Try the node mask */
-	if (!assign_vector_locked(irqd, cpumask_of_node(node)))
-		return 0;
-all:
+	if (node != NUMA_NO_NODE) {
+		/* Try the intersection of @affmsk and node mask */
+		cpumask_and(vector_searchmask, cpumask_of_node(node), affmsk);
+		if (!assign_vector_locked(irqd, vector_searchmask))
+			return 0;
+	}
+
 	/* Try the full affinity mask */
 	cpumask_and(vector_searchmask, affmsk, cpu_online_mask);
 	if (!assign_vector_locked(irqd, vector_searchmask))
 		return 0;
+
+	if (node != NUMA_NO_NODE) {
+		/* Try the node mask */
+		if (!assign_vector_locked(irqd, cpumask_of_node(node)))
+			return 0;
+	}
+
 	/* Try the full online mask */
 	return assign_vector_locked(irqd, cpu_online_mask);
 }



^ permalink raw reply	[flat|nested] 359+ messages in thread

* [PATCH 4.19 026/346] compiler.h: fix barrier_data() on clang
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (24 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 4.19 025/346] x86/apic/vector: Fix ordering in vector assignment Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 4.19 027/346] PCI: qcom: Add missing reset for ipq806x Greg Kroah-Hartman
                   ` (322 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Arvind Sankar, Randy Dunlap,
	Andrew Morton, Nick Desaulniers, Kees Cook, Linus Torvalds

From: Arvind Sankar <nivedita@alum.mit.edu>

commit 3347acc6fcd4ee71ad18a9ff9d9dac176b517329 upstream.

Commit 815f0ddb346c ("include/linux/compiler*.h: make compiler-*.h
mutually exclusive") neglected to copy barrier_data() from
compiler-gcc.h into compiler-clang.h.

The definition in compiler-gcc.h was really to work around clang's more
aggressive optimization, so this broke barrier_data() on clang, and
consequently memzero_explicit() as well.

For example, this results in at least the memzero_explicit() call in
lib/crypto/sha256.c:sha256_transform() being optimized away by clang.

Fix this by moving the definition of barrier_data() into compiler.h.

Also move the gcc/clang definition of barrier() into compiler.h,
__memory_barrier() is icc-specific (and barrier() is already defined
using it in compiler-intel.h) and doesn't belong in compiler.h.

[rdunlap@infradead.org: fix ALPHA builds when SMP is not enabled]

Link: https://lkml.kernel.org/r/20201101231835.4589-1-rdunlap@infradead.org
Fixes: 815f0ddb346c ("include/linux/compiler*.h: make compiler-*.h mutually exclusive")
Signed-off-by: Arvind Sankar <nivedita@alum.mit.edu>
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Tested-by: Nick Desaulniers <ndesaulniers@google.com>
Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
Cc: <stable@vger.kernel.org>
Link: https://lkml.kernel.org/r/20201014212631.207844-1-nivedita@alum.mit.edu
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
[nd: backport to account for missing
  commit e506ea451254a ("compiler.h: Split {READ,WRITE}_ONCE definitions out into rwonce.h")
  commit d08b9f0ca6605 ("scs: Add support for Clang's Shadow Call Stack (SCS)")
  commit a3f8a30f3f00 ("Compiler Attributes: use feature checks instead of version checks")]
Signed-off-by: Nick Desaulniers <ndesaulniers@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/linux/compiler-clang.h |    1 -
 include/linux/compiler-gcc.h   |   19 -------------------
 include/linux/compiler.h       |   18 ++++++++++++++++--
 3 files changed, 16 insertions(+), 22 deletions(-)

--- a/include/linux/compiler-clang.h
+++ b/include/linux/compiler-clang.h
@@ -39,7 +39,6 @@
  * and may be redefined here because they should not be shared with other
  * compilers, like ICC.
  */
-#define barrier() __asm__ __volatile__("" : : : "memory")
 #define __must_be_array(a) BUILD_BUG_ON_ZERO(__same_type((a), &(a)[0]))
 #define __assume_aligned(a, ...)	\
 	__attribute__((__assume_aligned__(a, ## __VA_ARGS__)))
--- a/include/linux/compiler-gcc.h
+++ b/include/linux/compiler-gcc.h
@@ -14,25 +14,6 @@
 # error Sorry, your compiler is too old - please upgrade it.
 #endif
 
-/* Optimization barrier */
-
-/* The "volatile" is due to gcc bugs */
-#define barrier() __asm__ __volatile__("": : :"memory")
-/*
- * This version is i.e. to prevent dead stores elimination on @ptr
- * where gcc and llvm may behave differently when otherwise using
- * normal barrier(): while gcc behavior gets along with a normal
- * barrier(), llvm needs an explicit input variable to be assumed
- * clobbered. The issue is as follows: while the inline asm might
- * access any memory it wants, the compiler could have fit all of
- * @ptr into memory registers instead, and since @ptr never escaped
- * from that, it proved that the inline asm wasn't touching any of
- * it. This version works well with both compilers, i.e. we're telling
- * the compiler that the inline asm absolutely may see the contents
- * of @ptr. See also: https://llvm.org/bugs/show_bug.cgi?id=15495
- */
-#define barrier_data(ptr) __asm__ __volatile__("": :"r"(ptr) :"memory")
-
 /*
  * This macro obfuscates arithmetic on a variable address so that gcc
  * shouldn't recognize the original var, and make assumptions about it.
--- a/include/linux/compiler.h
+++ b/include/linux/compiler.h
@@ -79,11 +79,25 @@ void ftrace_likely_update(struct ftrace_
 
 /* Optimization barrier */
 #ifndef barrier
-# define barrier() __memory_barrier()
+/* The "volatile" is due to gcc bugs */
+# define barrier() __asm__ __volatile__("": : :"memory")
 #endif
 
 #ifndef barrier_data
-# define barrier_data(ptr) barrier()
+/*
+ * This version is i.e. to prevent dead stores elimination on @ptr
+ * where gcc and llvm may behave differently when otherwise using
+ * normal barrier(): while gcc behavior gets along with a normal
+ * barrier(), llvm needs an explicit input variable to be assumed
+ * clobbered. The issue is as follows: while the inline asm might
+ * access any memory it wants, the compiler could have fit all of
+ * @ptr into memory registers instead, and since @ptr never escaped
+ * from that, it proved that the inline asm wasn't touching any of
+ * it. This version works well with both compilers, i.e. we're telling
+ * the compiler that the inline asm absolutely may see the contents
+ * of @ptr. See also: https://llvm.org/bugs/show_bug.cgi?id=15495
+ */
+# define barrier_data(ptr) __asm__ __volatile__("": :"r"(ptr) :"memory")
 #endif
 
 /* workaround for GCC PR82365 if needed */



^ permalink raw reply	[flat|nested] 359+ messages in thread

* [PATCH 4.19 027/346] PCI: qcom: Add missing reset for ipq806x
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (25 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 4.19 026/346] compiler.h: fix barrier_data() on clang Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 4.19 028/346] mac80211: mesh: fix mesh_pathtbl_init() error path Greg Kroah-Hartman
                   ` (321 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sham Muthayyan, Ansuel Smith,
	Lorenzo Pieralisi, Rob Herring, Philipp Zabel, Stanimir Varbanov,
	Sudip Mukherjee

From: Ansuel Smith <ansuelsmth@gmail.com>

commit ee367e2cdd2202b5714982739e684543cd2cee0e upstream

Add missing ext reset used by ipq8064 SoC in PCIe qcom driver.

Link: https://lore.kernel.org/r/20200615210608.21469-5-ansuelsmth@gmail.com
Fixes: 82a823833f4e ("PCI: qcom: Add Qualcomm PCIe controller driver")
Signed-off-by: Sham Muthayyan <smuthayy@codeaurora.org>
Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Reviewed-by: Rob Herring <robh@kernel.org>
Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de>
Acked-by: Stanimir Varbanov <svarbanov@mm-sol.com>
Cc: stable@vger.kernel.org # v4.5+
[sudip: adjust context]
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pci/controller/dwc/pcie-qcom.c |   12 ++++++++++++
 1 file changed, 12 insertions(+)

--- a/drivers/pci/controller/dwc/pcie-qcom.c
+++ b/drivers/pci/controller/dwc/pcie-qcom.c
@@ -108,6 +108,7 @@ struct qcom_pcie_resources_2_1_0 {
 	struct reset_control *ahb_reset;
 	struct reset_control *por_reset;
 	struct reset_control *phy_reset;
+	struct reset_control *ext_reset;
 	struct regulator_bulk_data supplies[QCOM_PCIE_2_1_0_MAX_SUPPLY];
 };
 
@@ -269,6 +270,10 @@ static int qcom_pcie_get_resources_2_1_0
 	if (IS_ERR(res->por_reset))
 		return PTR_ERR(res->por_reset);
 
+	res->ext_reset = devm_reset_control_get_optional_exclusive(dev, "ext");
+	if (IS_ERR(res->ext_reset))
+		return PTR_ERR(res->ext_reset);
+
 	res->phy_reset = devm_reset_control_get_exclusive(dev, "phy");
 	return PTR_ERR_OR_ZERO(res->phy_reset);
 }
@@ -281,6 +286,7 @@ static void qcom_pcie_deinit_2_1_0(struc
 	reset_control_assert(res->axi_reset);
 	reset_control_assert(res->ahb_reset);
 	reset_control_assert(res->por_reset);
+	reset_control_assert(res->ext_reset);
 	reset_control_assert(res->pci_reset);
 	clk_disable_unprepare(res->iface_clk);
 	clk_disable_unprepare(res->core_clk);
@@ -333,6 +339,12 @@ static int qcom_pcie_init_2_1_0(struct q
 		goto err_deassert_ahb;
 	}
 
+	ret = reset_control_deassert(res->ext_reset);
+	if (ret) {
+		dev_err(dev, "cannot deassert ext reset\n");
+		goto err_deassert_ahb;
+	}
+
 	/* enable PCIe clocks and resets */
 	val = readl(pcie->parf + PCIE20_PARF_PHY_CTRL);
 	val &= ~BIT(0);



^ permalink raw reply	[flat|nested] 359+ messages in thread

* [PATCH 4.19 028/346] mac80211: mesh: fix mesh_pathtbl_init() error path
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (26 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 4.19 027/346] PCI: qcom: Add missing reset for ipq806x Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 4.19 029/346] net: stmmac: free tx skb buffer in stmmac_resume() Greg Kroah-Hartman
                   ` (320 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Eric Dumazet, syzbot, Johannes Berg,
	Jakub Kicinski

From: Eric Dumazet <edumazet@google.com>

[ Upstream commit 905b2032fa424f253d9126271439cc1db2b01130 ]

If tbl_mpp can not be allocated, we call mesh_table_free(tbl_path)
while tbl_path rhashtable has not yet been initialized, which causes
panics.

Simply factorize the rhashtable_init() call into mesh_table_alloc()

WARNING: CPU: 1 PID: 8474 at kernel/workqueue.c:3040 __flush_work kernel/workqueue.c:3040 [inline]
WARNING: CPU: 1 PID: 8474 at kernel/workqueue.c:3040 __cancel_work_timer+0x514/0x540 kernel/workqueue.c:3136
Modules linked in:
CPU: 1 PID: 8474 Comm: syz-executor663 Not tainted 5.10.0-rc6-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:__flush_work kernel/workqueue.c:3040 [inline]
RIP: 0010:__cancel_work_timer+0x514/0x540 kernel/workqueue.c:3136
Code: 5d c3 e8 bf ae 29 00 0f 0b e9 f0 fd ff ff e8 b3 ae 29 00 0f 0b 43 80 3c 3e 00 0f 85 31 ff ff ff e9 34 ff ff ff e8 9c ae 29 00 <0f> 0b e9 dc fe ff ff 89 e9 80 e1 07 80 c1 03 38 c1 0f 8c 7d fd ff
RSP: 0018:ffffc9000165f5a0 EFLAGS: 00010293
RAX: ffffffff814b7064 RBX: 0000000000000001 RCX: ffff888021c80000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffff888024039ca0 R08: dffffc0000000000 R09: fffffbfff1dd3e64
R10: fffffbfff1dd3e64 R11: 0000000000000000 R12: 1ffff920002cbebd
R13: ffff888024039c88 R14: 1ffff11004807391 R15: dffffc0000000000
FS:  0000000001347880(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020000140 CR3: 000000002cc0a000 CR4: 00000000001506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 rhashtable_free_and_destroy+0x25/0x9c0 lib/rhashtable.c:1137
 mesh_table_free net/mac80211/mesh_pathtbl.c:69 [inline]
 mesh_pathtbl_init+0x287/0x2e0 net/mac80211/mesh_pathtbl.c:785
 ieee80211_mesh_init_sdata+0x2ee/0x530 net/mac80211/mesh.c:1591
 ieee80211_setup_sdata+0x733/0xc40 net/mac80211/iface.c:1569
 ieee80211_if_add+0xd5c/0x1cd0 net/mac80211/iface.c:1987
 ieee80211_add_iface+0x59/0x130 net/mac80211/cfg.c:125
 rdev_add_virtual_intf net/wireless/rdev-ops.h:45 [inline]
 nl80211_new_interface+0x563/0xb40 net/wireless/nl80211.c:3855
 genl_family_rcv_msg_doit net/netlink/genetlink.c:739 [inline]
 genl_family_rcv_msg net/netlink/genetlink.c:783 [inline]
 genl_rcv_msg+0xe4e/0x1280 net/netlink/genetlink.c:800
 netlink_rcv_skb+0x190/0x3a0 net/netlink/af_netlink.c:2494
 genl_rcv+0x24/0x40 net/netlink/genetlink.c:811
 netlink_unicast_kernel net/netlink/af_netlink.c:1304 [inline]
 netlink_unicast+0x780/0x930 net/netlink/af_netlink.c:1330
 netlink_sendmsg+0x9a8/0xd40 net/netlink/af_netlink.c:1919
 sock_sendmsg_nosec net/socket.c:651 [inline]
 sock_sendmsg net/socket.c:671 [inline]
 ____sys_sendmsg+0x519/0x800 net/socket.c:2353
 ___sys_sendmsg net/socket.c:2407 [inline]
 __sys_sendmsg+0x2b1/0x360 net/socket.c:2440
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Fixes: 60854fd94573 ("mac80211: mesh: convert path table to rhashtable")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Reviewed-by: Johannes Berg <johannes@sipsolutions.net>
Link: https://lore.kernel.org/r/20201204162428.2583119-1-eric.dumazet@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/mac80211/mesh_pathtbl.c |    4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

--- a/net/mac80211/mesh_pathtbl.c
+++ b/net/mac80211/mesh_pathtbl.c
@@ -63,6 +63,7 @@ static struct mesh_table *mesh_table_all
 	atomic_set(&newtbl->entries,  0);
 	spin_lock_init(&newtbl->gates_lock);
 	spin_lock_init(&newtbl->walk_lock);
+	rhashtable_init(&newtbl->rhead, &mesh_rht_params);
 
 	return newtbl;
 }
@@ -786,9 +787,6 @@ int mesh_pathtbl_init(struct ieee80211_s
 		goto free_path;
 	}
 
-	rhashtable_init(&tbl_path->rhead, &mesh_rht_params);
-	rhashtable_init(&tbl_mpp->rhead, &mesh_rht_params);
-
 	sdata->u.mesh.mesh_paths = tbl_path;
 	sdata->u.mesh.mpp_paths = tbl_mpp;
 



^ permalink raw reply	[flat|nested] 359+ messages in thread

* [PATCH 4.19 029/346] net: stmmac: free tx skb buffer in stmmac_resume()
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (27 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 4.19 028/346] mac80211: mesh: fix mesh_pathtbl_init() error path Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 4.19 030/346] tcp: select sane initial rcvq_space.space for big MSS Greg Kroah-Hartman
                   ` (319 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Fugang Duan, Joakim Zhang, David S. Miller

From: Fugang Duan <fugang.duan@nxp.com>

[ Upstream commit 4ec236c7c51f89abb0224a4da4a6b77f9beb6600 ]

When do suspend/resume test, there have WARN_ON() log dump from
stmmac_xmit() funciton, the code logic:
	entry = tx_q->cur_tx;
	first_entry = entry;
	WARN_ON(tx_q->tx_skbuff[first_entry]);

In normal case, tx_q->tx_skbuff[txq->cur_tx] should be NULL because
the skb should be handled and freed in stmmac_tx_clean().

But stmmac_resume() reset queue parameters like below, skb buffers
may not be freed.
	tx_q->cur_tx = 0;
	tx_q->dirty_tx = 0;

So free tx skb buffer in stmmac_resume() to avoid warning and
memory leak.

log:
[   46.139824] ------------[ cut here ]------------
[   46.144453] WARNING: CPU: 0 PID: 0 at drivers/net/ethernet/stmicro/stmmac/stmmac_main.c:3235 stmmac_xmit+0x7a0/0x9d0
[   46.154969] Modules linked in: crct10dif_ce vvcam(O) flexcan can_dev
[   46.161328] CPU: 0 PID: 0 Comm: swapper/0 Tainted: G           O      5.4.24-2.1.0+g2ad925d15481 #1
[   46.170369] Hardware name: NXP i.MX8MPlus EVK board (DT)
[   46.175677] pstate: 80000005 (Nzcv daif -PAN -UAO)
[   46.180465] pc : stmmac_xmit+0x7a0/0x9d0
[   46.184387] lr : dev_hard_start_xmit+0x94/0x158
[   46.188913] sp : ffff800010003cc0
[   46.192224] x29: ffff800010003cc0 x28: ffff000177e2a100
[   46.197533] x27: ffff000176ef0840 x26: ffff000176ef0090
[   46.202842] x25: 0000000000000000 x24: 0000000000000000
[   46.208151] x23: 0000000000000003 x22: ffff8000119ddd30
[   46.213460] x21: ffff00017636f000 x20: ffff000176ef0cc0
[   46.218769] x19: 0000000000000003 x18: 0000000000000000
[   46.224078] x17: 0000000000000000 x16: 0000000000000000
[   46.229386] x15: 0000000000000079 x14: 0000000000000000
[   46.234695] x13: 0000000000000003 x12: 0000000000000003
[   46.240003] x11: 0000000000000010 x10: 0000000000000010
[   46.245312] x9 : ffff00017002b140 x8 : 0000000000000000
[   46.250621] x7 : ffff00017636f000 x6 : 0000000000000010
[   46.255930] x5 : 0000000000000001 x4 : ffff000176ef0000
[   46.261238] x3 : 0000000000000003 x2 : 00000000ffffffff
[   46.266547] x1 : ffff000177e2a000 x0 : 0000000000000000
[   46.271856] Call trace:
[   46.274302]  stmmac_xmit+0x7a0/0x9d0
[   46.277874]  dev_hard_start_xmit+0x94/0x158
[   46.282056]  sch_direct_xmit+0x11c/0x338
[   46.285976]  __qdisc_run+0x118/0x5f0
[   46.289549]  net_tx_action+0x110/0x198
[   46.293297]  __do_softirq+0x120/0x23c
[   46.296958]  irq_exit+0xb8/0xd8
[   46.300098]  __handle_domain_irq+0x64/0xb8
[   46.304191]  gic_handle_irq+0x5c/0x148
[   46.307936]  el1_irq+0xb8/0x180
[   46.311076]  cpuidle_enter_state+0x84/0x360
[   46.315256]  cpuidle_enter+0x34/0x48
[   46.318829]  call_cpuidle+0x18/0x38
[   46.322314]  do_idle+0x1e0/0x280
[   46.325539]  cpu_startup_entry+0x24/0x40
[   46.329460]  rest_init+0xd4/0xe0
[   46.332687]  arch_call_rest_init+0xc/0x14
[   46.336695]  start_kernel+0x420/0x44c
[   46.340353] ---[ end trace bc1ee695123cbacd ]---

Fixes: 47dd7a540b8a0 ("net: add support for STMicroelectronics Ethernet controllers.")
Signed-off-by: Fugang Duan <fugang.duan@nxp.com>
Signed-off-by: Joakim Zhang <qiangqing.zhang@nxp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/stmicro/stmmac/stmmac_main.c |   14 ++++++++++++++
 1 file changed, 14 insertions(+)

--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -1429,6 +1429,19 @@ static void dma_free_tx_skbufs(struct st
 }
 
 /**
+ * stmmac_free_tx_skbufs - free TX skb buffers
+ * @priv: private structure
+ */
+static void stmmac_free_tx_skbufs(struct stmmac_priv *priv)
+{
+	u32 tx_queue_cnt = priv->plat->tx_queues_to_use;
+	u32 queue;
+
+	for (queue = 0; queue < tx_queue_cnt; queue++)
+		dma_free_tx_skbufs(priv, queue);
+}
+
+/**
  * free_dma_rx_desc_resources - free RX dma desc resources
  * @priv: private structure
  */
@@ -4591,6 +4604,7 @@ int stmmac_resume(struct device *dev)
 
 	stmmac_reset_queues_param(priv);
 
+	stmmac_free_tx_skbufs(priv);
 	stmmac_clear_descriptors(priv);
 
 	stmmac_hw_setup(ndev, false);



^ permalink raw reply	[flat|nested] 359+ messages in thread

* [PATCH 4.19 030/346] tcp: select sane initial rcvq_space.space for big MSS
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (28 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 4.19 029/346] net: stmmac: free tx skb buffer in stmmac_resume() Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 4.19 031/346] tcp: fix cwnd-limited bug for TSO deferral where we send nothing Greg Kroah-Hartman
                   ` (318 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hazem Mohamed Abuelfotoh,
	Eric Dumazet, Soheil Hassas Yeganeh, David S. Miller

From: Eric Dumazet <edumazet@google.com>

[ Upstream commit 72d05c00d7ecda85df29abd046da7e41cc071c17 ]

Before commit a337531b942b ("tcp: up initial rmem to 128KB and SYN rwin to around 64KB")
small tcp_rmem[1] values were overridden by tcp_fixup_rcvbuf() to accommodate various MSS.

This is no longer the case, and Hazem Mohamed Abuelfotoh reported
that DRS would not work for MTU 9000 endpoints receiving regular (1500 bytes) frames.

Root cause is that tcp_init_buffer_space() uses tp->rcv_wnd for upper limit
of rcvq_space.space computation, while it can select later a smaller
value for tp->rcv_ssthresh and tp->window_clamp.

ss -temoi on receiver would show :

skmem:(r0,rb131072,t0,tb46080,f0,w0,o0,bl0,d0) rcv_space:62496 rcv_ssthresh:56596

This means that TCP can not increase its window in tcp_grow_window(),
and that DRS can never kick.

Fix this by making sure that rcvq_space.space is not bigger than number of bytes
that can be held in TCP receive queue.

People unable/unwilling to change their kernel can work around this issue by
selecting a bigger tcp_rmem[1] value as in :

echo "4096 196608 6291456" >/proc/sys/net/ipv4/tcp_rmem

Based on an initial report and patch from Hazem Mohamed Abuelfotoh
 https://lore.kernel.org/netdev/20201204180622.14285-1-abuehaze@amazon.com/

Fixes: a337531b942b ("tcp: up initial rmem to 128KB and SYN rwin to around 64KB")
Fixes: 041a14d26715 ("tcp: start receiver buffer autotuning sooner")
Reported-by: Hazem Mohamed Abuelfotoh <abuehaze@amazon.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Acked-by: Soheil Hassas Yeganeh <soheil@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv4/tcp_input.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -439,7 +439,6 @@ void tcp_init_buffer_space(struct sock *
 	if (!(sk->sk_userlocks & SOCK_SNDBUF_LOCK))
 		tcp_sndbuf_expand(sk);
 
-	tp->rcvq_space.space = min_t(u32, tp->rcv_wnd, TCP_INIT_CWND * tp->advmss);
 	tcp_mstamp_refresh(tp);
 	tp->rcvq_space.time = tp->tcp_mstamp;
 	tp->rcvq_space.seq = tp->copied_seq;
@@ -463,6 +462,8 @@ void tcp_init_buffer_space(struct sock *
 
 	tp->rcv_ssthresh = min(tp->rcv_ssthresh, tp->window_clamp);
 	tp->snd_cwnd_stamp = tcp_jiffies32;
+	tp->rcvq_space.space = min3(tp->rcv_ssthresh, tp->rcv_wnd,
+				    (u32)TCP_INIT_CWND * tp->advmss);
 }
 
 /* 4. Recalculate window clamp after socket hit its memory bounds. */



^ permalink raw reply	[flat|nested] 359+ messages in thread

* [PATCH 4.19 031/346] tcp: fix cwnd-limited bug for TSO deferral where we send nothing
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (29 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 4.19 030/346] tcp: select sane initial rcvq_space.space for big MSS Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 4.19 032/346] net/mlx4_en: Avoid scheduling restart task if it is already running Greg Kroah-Hartman
                   ` (317 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ingemar Johansson, Neal Cardwell,
	Yuchung Cheng, Soheil Hassas Yeganeh, Eric Dumazet,
	Jakub Kicinski

From: Neal Cardwell <ncardwell@google.com>

[ Upstream commit 299bcb55ecd1412f6df606e9dc0912d55610029e ]

When cwnd is not a multiple of the TSO skb size of N*MSS, we can get
into persistent scenarios where we have the following sequence:

(1) ACK for full-sized skb of N*MSS arrives
  -> tcp_write_xmit() transmit full-sized skb with N*MSS
  -> move pacing release time forward
  -> exit tcp_write_xmit() because pacing time is in the future

(2) TSQ callback or TCP internal pacing timer fires
  -> try to transmit next skb, but TSO deferral finds remainder of
     available cwnd is not big enough to trigger an immediate send
     now, so we defer sending until the next ACK.

(3) repeat...

So we can get into a case where we never mark ourselves as
cwnd-limited for many seconds at a time, even with
bulk/infinite-backlog senders, because:

o In case (1) above, every time in tcp_write_xmit() we have enough
cwnd to send a full-sized skb, we are not fully using the cwnd
(because cwnd is not a multiple of the TSO skb size). So every time we
send data, we are not cwnd limited, and so in the cwnd-limited
tracking code in tcp_cwnd_validate() we mark ourselves as not
cwnd-limited.

o In case (2) above, every time in tcp_write_xmit() that we try to
transmit the "remainder" of the cwnd but defer, we set the local
variable is_cwnd_limited to true, but we do not send any packets, so
sent_pkts is zero, so we don't call the cwnd-limited logic to update
tp->is_cwnd_limited.

Fixes: ca8a22634381 ("tcp: make cwnd-limited checks measurement-based, and gentler")
Reported-by: Ingemar Johansson <ingemar.s.johansson@ericsson.com>
Signed-off-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: Yuchung Cheng <ycheng@google.com>
Acked-by: Soheil Hassas Yeganeh <soheil@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Link: https://lore.kernel.org/r/20201209035759.1225145-1-ncardwell.kernel@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv4/tcp_output.c |    9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -1622,7 +1622,8 @@ static void tcp_cwnd_validate(struct soc
 	 * window, and remember whether we were cwnd-limited then.
 	 */
 	if (!before(tp->snd_una, tp->max_packets_seq) ||
-	    tp->packets_out > tp->max_packets_out) {
+	    tp->packets_out > tp->max_packets_out ||
+	    is_cwnd_limited) {
 		tp->max_packets_out = tp->packets_out;
 		tp->max_packets_seq = tp->snd_nxt;
 		tp->is_cwnd_limited = is_cwnd_limited;
@@ -2407,6 +2408,10 @@ repair:
 	else
 		tcp_chrono_stop(sk, TCP_CHRONO_RWND_LIMITED);
 
+	is_cwnd_limited |= (tcp_packets_in_flight(tp) >= tp->snd_cwnd);
+	if (likely(sent_pkts || is_cwnd_limited))
+		tcp_cwnd_validate(sk, is_cwnd_limited);
+
 	if (likely(sent_pkts)) {
 		if (tcp_in_cwnd_reduction(sk))
 			tp->prr_out += sent_pkts;
@@ -2414,8 +2419,6 @@ repair:
 		/* Send one loss probe per tail loss episode. */
 		if (push_one != 2)
 			tcp_schedule_loss_probe(sk, false);
-		is_cwnd_limited |= (tcp_packets_in_flight(tp) >= tp->snd_cwnd);
-		tcp_cwnd_validate(sk, is_cwnd_limited);
 		return false;
 	}
 	return !tp->packets_out && !tcp_write_queue_empty(sk);



^ permalink raw reply	[flat|nested] 359+ messages in thread

* [PATCH 4.19 032/346] net/mlx4_en: Avoid scheduling restart task if it is already running
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (30 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 4.19 031/346] tcp: fix cwnd-limited bug for TSO deferral where we send nothing Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 4.19 033/346] lan743x: fix for potential NULL pointer dereference with bare card Greg Kroah-Hartman
                   ` (316 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Moshe Shemesh, Tariq Toukan, David S. Miller

From: Moshe Shemesh <moshe@mellanox.com>

[ Upstream commit fed91613c9dd455dd154b22fa8e11b8526466082 ]

Add restarting state flag to avoid scheduling another restart task while
such task is already running. Change task name from watchdog_task to
restart_task to better fit the task role.

Fixes: 1e338db56e5a ("mlx4_en: Fix a race at restart task")
Signed-off-by: Moshe Shemesh <moshe@mellanox.com>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/mellanox/mlx4/en_netdev.c |   20 +++++++++++++-------
 drivers/net/ethernet/mellanox/mlx4/mlx4_en.h   |    7 ++++++-
 2 files changed, 19 insertions(+), 8 deletions(-)

--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
@@ -1384,8 +1384,10 @@ static void mlx4_en_tx_timeout(struct ne
 	}
 
 	priv->port_stats.tx_timeout++;
-	en_dbg(DRV, priv, "Scheduling watchdog\n");
-	queue_work(mdev->workqueue, &priv->watchdog_task);
+	if (!test_and_set_bit(MLX4_EN_STATE_FLAG_RESTARTING, &priv->state)) {
+		en_dbg(DRV, priv, "Scheduling port restart\n");
+		queue_work(mdev->workqueue, &priv->restart_task);
+	}
 }
 
 
@@ -1835,6 +1837,7 @@ int mlx4_en_start_port(struct net_device
 		local_bh_enable();
 	}
 
+	clear_bit(MLX4_EN_STATE_FLAG_RESTARTING, &priv->state);
 	netif_tx_start_all_queues(dev);
 	netif_device_attach(dev);
 
@@ -2005,7 +2008,7 @@ void mlx4_en_stop_port(struct net_device
 static void mlx4_en_restart(struct work_struct *work)
 {
 	struct mlx4_en_priv *priv = container_of(work, struct mlx4_en_priv,
-						 watchdog_task);
+						 restart_task);
 	struct mlx4_en_dev *mdev = priv->mdev;
 	struct net_device *dev = priv->dev;
 
@@ -2387,7 +2390,7 @@ static int mlx4_en_change_mtu(struct net
 	if (netif_running(dev)) {
 		mutex_lock(&mdev->state_lock);
 		if (!mdev->device_up) {
-			/* NIC is probably restarting - let watchdog task reset
+			/* NIC is probably restarting - let restart task reset
 			 * the port */
 			en_dbg(DRV, priv, "Change MTU called with card down!?\n");
 		} else {
@@ -2396,7 +2399,9 @@ static int mlx4_en_change_mtu(struct net
 			if (err) {
 				en_err(priv, "Failed restarting port:%d\n",
 					 priv->port);
-				queue_work(mdev->workqueue, &priv->watchdog_task);
+				if (!test_and_set_bit(MLX4_EN_STATE_FLAG_RESTARTING,
+						      &priv->state))
+					queue_work(mdev->workqueue, &priv->restart_task);
 			}
 		}
 		mutex_unlock(&mdev->state_lock);
@@ -2882,7 +2887,8 @@ static int mlx4_xdp_set(struct net_devic
 		if (err) {
 			en_err(priv, "Failed starting port %d for XDP change\n",
 			       priv->port);
-			queue_work(mdev->workqueue, &priv->watchdog_task);
+			if (!test_and_set_bit(MLX4_EN_STATE_FLAG_RESTARTING, &priv->state))
+				queue_work(mdev->workqueue, &priv->restart_task);
 		}
 	}
 
@@ -3280,7 +3286,7 @@ int mlx4_en_init_netdev(struct mlx4_en_d
 	priv->counter_index = MLX4_SINK_COUNTER_INDEX(mdev->dev);
 	spin_lock_init(&priv->stats_lock);
 	INIT_WORK(&priv->rx_mode_task, mlx4_en_do_set_rx_mode);
-	INIT_WORK(&priv->watchdog_task, mlx4_en_restart);
+	INIT_WORK(&priv->restart_task, mlx4_en_restart);
 	INIT_WORK(&priv->linkstate_task, mlx4_en_linkstate);
 	INIT_DELAYED_WORK(&priv->stats_task, mlx4_en_do_get_stats);
 	INIT_DELAYED_WORK(&priv->service_task, mlx4_en_service_task);
--- a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
+++ b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
@@ -530,6 +530,10 @@ struct mlx4_en_stats_bitmap {
 	struct mutex mutex; /* for mutual access to stats bitmap */
 };
 
+enum {
+	MLX4_EN_STATE_FLAG_RESTARTING,
+};
+
 struct mlx4_en_priv {
 	struct mlx4_en_dev *mdev;
 	struct mlx4_en_port_profile *prof;
@@ -595,7 +599,7 @@ struct mlx4_en_priv {
 	struct mlx4_en_cq *rx_cq[MAX_RX_RINGS];
 	struct mlx4_qp drop_qp;
 	struct work_struct rx_mode_task;
-	struct work_struct watchdog_task;
+	struct work_struct restart_task;
 	struct work_struct linkstate_task;
 	struct delayed_work stats_task;
 	struct delayed_work service_task;
@@ -643,6 +647,7 @@ struct mlx4_en_priv {
 	u32 pflags;
 	u8 rss_key[MLX4_EN_RSS_KEY_SIZE];
 	u8 rss_hash_fn;
+	unsigned long state;
 };
 
 enum mlx4_en_wol {



^ permalink raw reply	[flat|nested] 359+ messages in thread

* [PATCH 4.19 033/346] lan743x: fix for potential NULL pointer dereference with bare card
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (31 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 4.19 032/346] net/mlx4_en: Avoid scheduling restart task if it is already running Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 4.19 034/346] net/mlx4_en: Handle TX error CQE Greg Kroah-Hartman
                   ` (315 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Sergej Bauer, Jakub Kicinski

From: Sergej Bauer <sbauer@blackbox.su>

[ Upstream commit e9e13b6adc338be1eb88db87bcb392696144bd02 ]

This is the 3rd revision of the patch fix for potential null pointer dereference
with lan743x card.

The simpliest way to reproduce: boot with bare lan743x and issue "ethtool ethN"
commant where ethN is the interface with lan743x card. Example:

$ sudo ethtool eth7
dmesg:
[  103.510336] BUG: kernel NULL pointer dereference, address: 0000000000000340
...
[  103.510836] RIP: 0010:phy_ethtool_get_wol+0x5/0x30 [libphy]
...
[  103.511629] Call Trace:
[  103.511666]  lan743x_ethtool_get_wol+0x21/0x40 [lan743x]
[  103.511724]  dev_ethtool+0x1507/0x29d0
[  103.511769]  ? avc_has_extended_perms+0x17f/0x440
[  103.511820]  ? tomoyo_init_request_info+0x84/0x90
[  103.511870]  ? tomoyo_path_number_perm+0x68/0x1e0
[  103.511919]  ? tty_insert_flip_string_fixed_flag+0x82/0xe0
[  103.511973]  ? inet_ioctl+0x187/0x1d0
[  103.512016]  dev_ioctl+0xb5/0x560
[  103.512055]  sock_do_ioctl+0xa0/0x140
[  103.512098]  sock_ioctl+0x2cb/0x3c0
[  103.512139]  __x64_sys_ioctl+0x84/0xc0
[  103.512183]  do_syscall_64+0x33/0x80
[  103.512224]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
[  103.512274] RIP: 0033:0x7f54a9cba427
...

Previous versions can be found at:
v1:
initial version
    https://lkml.org/lkml/2020/10/28/921

v2:
do not return from lan743x_ethtool_set_wol if netdev->phydev == NULL, just skip
the call of phy_ethtool_set_wol() instead.
    https://lkml.org/lkml/2020/10/31/380

v3:
in function lan743x_ethtool_set_wol:
use ternary operator instead of if-else sentence (review by Markus Elfring)
return -ENETDOWN insted of -EIO (review by Andrew Lunn)

Signed-off-by: Sergej Bauer <sbauer@blackbox.su>

Link: https://lore.kernel.org/r/20201101223556.16116-1-sbauer@blackbox.su
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/microchip/lan743x_ethtool.c |    9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

--- a/drivers/net/ethernet/microchip/lan743x_ethtool.c
+++ b/drivers/net/ethernet/microchip/lan743x_ethtool.c
@@ -659,7 +659,9 @@ static void lan743x_ethtool_get_wol(stru
 
 	wol->supported = 0;
 	wol->wolopts = 0;
-	phy_ethtool_get_wol(netdev->phydev, wol);
+
+	if (netdev->phydev)
+		phy_ethtool_get_wol(netdev->phydev, wol);
 
 	wol->supported |= WAKE_BCAST | WAKE_UCAST | WAKE_MCAST |
 		WAKE_MAGIC | WAKE_PHY | WAKE_ARP;
@@ -688,9 +690,8 @@ static int lan743x_ethtool_set_wol(struc
 
 	device_set_wakeup_enable(&adapter->pdev->dev, (bool)wol->wolopts);
 
-	phy_ethtool_set_wol(netdev->phydev, wol);
-
-	return 0;
+	return netdev->phydev ? phy_ethtool_set_wol(netdev->phydev, wol)
+			: -ENETDOWN;
 }
 #endif /* CONFIG_PM */
 



^ permalink raw reply	[flat|nested] 359+ messages in thread

* [PATCH 4.19 034/346] net/mlx4_en: Handle TX error CQE
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (32 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 4.19 033/346] lan743x: fix for potential NULL pointer dereference with bare card Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 4.19 035/346] net: stmmac: delete the eee_ctrl_timer after napi disabled Greg Kroah-Hartman
                   ` (314 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Moshe Shemesh, Tariq Toukan, David S. Miller

From: Moshe Shemesh <moshe@mellanox.com>

[ Upstream commit ba603d9d7b1215c72513d7c7aa02b6775fd4891b ]

In case error CQE was found while polling TX CQ, the QP is in error
state and all posted WQEs will generate error CQEs without any data
transmitted. Fix it by reopening the channels, via same method used for
TX timeout handling.

In addition add some more info on error CQE and WQE for debug.

Fixes: bd2f631d7c60 ("net/mlx4_en: Notify user when TX ring in error state")
Signed-off-by: Moshe Shemesh <moshe@mellanox.com>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/mellanox/mlx4/en_netdev.c |    1 
 drivers/net/ethernet/mellanox/mlx4/en_tx.c     |   40 ++++++++++++++++++++-----
 drivers/net/ethernet/mellanox/mlx4/mlx4_en.h   |    5 +++
 3 files changed, 39 insertions(+), 7 deletions(-)

--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
@@ -1741,6 +1741,7 @@ int mlx4_en_start_port(struct net_device
 				mlx4_en_deactivate_cq(priv, cq);
 				goto tx_err;
 			}
+			clear_bit(MLX4_EN_TX_RING_STATE_RECOVERING, &tx_ring->state);
 			if (t != TX_XDP) {
 				tx_ring->tx_queue = netdev_get_tx_queue(dev, i);
 				tx_ring->recycle_ring = NULL;
--- a/drivers/net/ethernet/mellanox/mlx4/en_tx.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
@@ -385,6 +385,35 @@ int mlx4_en_free_tx_buf(struct net_devic
 	return cnt;
 }
 
+static void mlx4_en_handle_err_cqe(struct mlx4_en_priv *priv, struct mlx4_err_cqe *err_cqe,
+				   u16 cqe_index, struct mlx4_en_tx_ring *ring)
+{
+	struct mlx4_en_dev *mdev = priv->mdev;
+	struct mlx4_en_tx_info *tx_info;
+	struct mlx4_en_tx_desc *tx_desc;
+	u16 wqe_index;
+	int desc_size;
+
+	en_err(priv, "CQE error - cqn 0x%x, ci 0x%x, vendor syndrome: 0x%x syndrome: 0x%x\n",
+	       ring->sp_cqn, cqe_index, err_cqe->vendor_err_syndrome, err_cqe->syndrome);
+	print_hex_dump(KERN_WARNING, "", DUMP_PREFIX_OFFSET, 16, 1, err_cqe, sizeof(*err_cqe),
+		       false);
+
+	wqe_index = be16_to_cpu(err_cqe->wqe_index) & ring->size_mask;
+	tx_info = &ring->tx_info[wqe_index];
+	desc_size = tx_info->nr_txbb << LOG_TXBB_SIZE;
+	en_err(priv, "Related WQE - qpn 0x%x, wqe index 0x%x, wqe size 0x%x\n", ring->qpn,
+	       wqe_index, desc_size);
+	tx_desc = ring->buf + (wqe_index << LOG_TXBB_SIZE);
+	print_hex_dump(KERN_WARNING, "", DUMP_PREFIX_OFFSET, 16, 1, tx_desc, desc_size, false);
+
+	if (test_and_set_bit(MLX4_EN_STATE_FLAG_RESTARTING, &priv->state))
+		return;
+
+	en_err(priv, "Scheduling port restart\n");
+	queue_work(mdev->workqueue, &priv->restart_task);
+}
+
 bool mlx4_en_process_tx_cq(struct net_device *dev,
 			   struct mlx4_en_cq *cq, int napi_budget)
 {
@@ -431,13 +460,10 @@ bool mlx4_en_process_tx_cq(struct net_de
 		dma_rmb();
 
 		if (unlikely((cqe->owner_sr_opcode & MLX4_CQE_OPCODE_MASK) ==
-			     MLX4_CQE_OPCODE_ERROR)) {
-			struct mlx4_err_cqe *cqe_err = (struct mlx4_err_cqe *)cqe;
-
-			en_err(priv, "CQE error - vendor syndrome: 0x%x syndrome: 0x%x\n",
-			       cqe_err->vendor_err_syndrome,
-			       cqe_err->syndrome);
-		}
+			     MLX4_CQE_OPCODE_ERROR))
+			if (!test_and_set_bit(MLX4_EN_TX_RING_STATE_RECOVERING, &ring->state))
+				mlx4_en_handle_err_cqe(priv, (struct mlx4_err_cqe *)cqe, index,
+						       ring);
 
 		/* Skip over last polled CQE */
 		new_index = be16_to_cpu(cqe->wqe_index) & size_mask;
--- a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
+++ b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
@@ -271,6 +271,10 @@ struct mlx4_en_page_cache {
 	} buf[MLX4_EN_CACHE_SIZE];
 };
 
+enum {
+	MLX4_EN_TX_RING_STATE_RECOVERING,
+};
+
 struct mlx4_en_priv;
 
 struct mlx4_en_tx_ring {
@@ -317,6 +321,7 @@ struct mlx4_en_tx_ring {
 	 * Only queue_stopped might be used if BQL is not properly working.
 	 */
 	unsigned long		queue_stopped;
+	unsigned long		state;
 	struct mlx4_hwq_resources sp_wqres;
 	struct mlx4_qp		sp_qp;
 	struct mlx4_qp_context	sp_context;



^ permalink raw reply	[flat|nested] 359+ messages in thread

* [PATCH 4.19 035/346] net: stmmac: delete the eee_ctrl_timer after napi disabled
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (33 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 4.19 034/346] net/mlx4_en: Handle TX error CQE Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 4.19 036/346] net: stmmac: dwmac-meson8b: fix mask definition of the m250_sel mux Greg Kroah-Hartman
                   ` (313 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Fugang Duan, Joakim Zhang, David S. Miller

From: Fugang Duan <fugang.duan@nxp.com>

[ Upstream commit 5f58591323bf3f342920179f24515935c4b5fd60 ]

There have chance to re-enable the eee_ctrl_timer and fire the timer
in napi callback after delete the timer in .stmmac_release(), which
introduces to access eee registers in the timer function after clocks
are disabled then causes system hang. Found this issue when do
suspend/resume and reboot stress test.

It is safe to delete the timer after napi disabled and disable lpi mode.

Fixes: d765955d2ae0b ("stmmac: add the Energy Efficient Ethernet support")
Signed-off-by: Fugang Duan <fugang.duan@nxp.com>
Signed-off-by: Joakim Zhang <qiangqing.zhang@nxp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/stmicro/stmmac/stmmac_main.c |   13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -2702,9 +2702,6 @@ static int stmmac_release(struct net_dev
 	struct stmmac_priv *priv = netdev_priv(dev);
 	u32 chan;
 
-	if (priv->eee_enabled)
-		del_timer_sync(&priv->eee_ctrl_timer);
-
 	/* Stop and disconnect the PHY */
 	if (dev->phydev) {
 		phy_stop(dev->phydev);
@@ -2723,6 +2720,11 @@ static int stmmac_release(struct net_dev
 	if (priv->lpi_irq > 0)
 		free_irq(priv->lpi_irq, dev);
 
+	if (priv->eee_enabled) {
+		priv->tx_path_in_lpi_mode = false;
+		del_timer_sync(&priv->eee_ctrl_timer);
+	}
+
 	/* Stop TX/RX DMA and clear the descriptors */
 	stmmac_stop_all_dma(priv);
 
@@ -4510,6 +4512,11 @@ int stmmac_suspend(struct device *dev)
 	for (chan = 0; chan < priv->plat->tx_queues_to_use; chan++)
 		del_timer_sync(&priv->tx_queue[chan].txtimer);
 
+	if (priv->eee_enabled) {
+		priv->tx_path_in_lpi_mode = false;
+		del_timer_sync(&priv->eee_ctrl_timer);
+	}
+
 	/* Stop TX/RX DMA */
 	stmmac_stop_all_dma(priv);
 



^ permalink raw reply	[flat|nested] 359+ messages in thread

* [PATCH 4.19 036/346] net: stmmac: dwmac-meson8b: fix mask definition of the m250_sel mux
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (34 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 4.19 035/346] net: stmmac: delete the eee_ctrl_timer after napi disabled Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 4.19 037/346] net: bridge: vlan: fix error return code in __vlan_add() Greg Kroah-Hartman
                   ` (312 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Martin Blumenstingl, Jerome Brunet,
	Jakub Kicinski

From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>

[ Upstream commit 82ca4c922b8992013a238d65cf4e60cc33e12f36 ]

The m250_sel mux clock uses bit 4 in the PRG_ETH0 register. Fix this by
shifting the PRG_ETH0_CLK_M250_SEL_MASK accordingly as the "mask" in
struct clk_mux expects the mask relative to the "shift" field in the
same struct.

While here, get rid of the PRG_ETH0_CLK_M250_SEL_SHIFT macro and use
__ffs() to determine it from the existing PRG_ETH0_CLK_M250_SEL_MASK
macro.

Fixes: 566e8251625304 ("net: stmmac: add a glue driver for the Amlogic Meson 8b / GXBB DWMAC")
Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Reviewed-by: Jerome Brunet <jbrunet@baylibre.com>
Link: https://lore.kernel.org/r/20201205213207.519341-1-martin.blumenstingl@googlemail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c
@@ -35,7 +35,6 @@
 #define PRG_ETH0_EXT_RMII_MODE		4
 
 /* mux to choose between fclk_div2 (bit unset) and mpll2 (bit set) */
-#define PRG_ETH0_CLK_M250_SEL_SHIFT	4
 #define PRG_ETH0_CLK_M250_SEL_MASK	GENMASK(4, 4)
 
 #define PRG_ETH0_TXDLY_SHIFT		5
@@ -149,8 +148,9 @@ static int meson8b_init_rgmii_tx_clk(str
 	}
 
 	clk_configs->m250_mux.reg = dwmac->regs + PRG_ETH0;
-	clk_configs->m250_mux.shift = PRG_ETH0_CLK_M250_SEL_SHIFT;
-	clk_configs->m250_mux.mask = PRG_ETH0_CLK_M250_SEL_MASK;
+	clk_configs->m250_mux.shift = __ffs(PRG_ETH0_CLK_M250_SEL_MASK);
+	clk_configs->m250_mux.mask = PRG_ETH0_CLK_M250_SEL_MASK >>
+				     clk_configs->m250_mux.shift;
 	clk = meson8b_dwmac_register_clk(dwmac, "m250_sel", mux_parent_names,
 					 MUX_CLK_NUM_PARENTS, &clk_mux_ops,
 					 &clk_configs->m250_mux.hw);



^ permalink raw reply	[flat|nested] 359+ messages in thread

* [PATCH 4.19 037/346] net: bridge: vlan: fix error return code in __vlan_add()
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (35 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 4.19 036/346] net: stmmac: dwmac-meson8b: fix mask definition of the m250_sel mux Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 4.19 038/346] ktest.pl: If size of log is too big to email, email error message Greg Kroah-Hartman
                   ` (311 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Zhang Changzhong,
	Nikolay Aleksandrov, Jakub Kicinski

From: Zhang Changzhong <zhangchangzhong@huawei.com>

[ Upstream commit ee4f52a8de2c6f78b01f10b4c330867d88c1653a ]

Fix to return a negative error code from the error handling
case instead of 0, as done elsewhere in this function.

Fixes: f8ed289fab84 ("bridge: vlan: use br_vlan_(get|put)_master to deal with refcounts")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
Acked-by: Nikolay Aleksandrov <nikolay@nvidia.com>
Link: https://lore.kernel.org/r/1607071737-33875-1-git-send-email-zhangchangzhong@huawei.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/bridge/br_vlan.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/net/bridge/br_vlan.c
+++ b/net/bridge/br_vlan.c
@@ -242,8 +242,10 @@ static int __vlan_add(struct net_bridge_
 		}
 
 		masterv = br_vlan_get_master(br, v->vid);
-		if (!masterv)
+		if (!masterv) {
+			err = -ENOMEM;
 			goto out_filt;
+		}
 		v->brvlan = masterv;
 		v->stats = masterv->stats;
 	} else {



^ permalink raw reply	[flat|nested] 359+ messages in thread

* [PATCH 4.19 038/346] ktest.pl: If size of log is too big to email, email error message
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (36 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 4.19 037/346] net: bridge: vlan: fix error return code in __vlan_add() Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 4.19 039/346] USB: dummy-hcd: Fix uninitialized array use in init() Greg Kroah-Hartman
                   ` (310 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Steven Rostedt (VMware)

From: Steven Rostedt (VMware) <rostedt@goodmis.org>

commit 8cd6bc0359deebd8500e6de95899a8a78d3ec4ba upstream.

If the size of the error log is too big to send via email, and the sending
fails, it wont email any result. This can be confusing for the user who is
waiting for an email on the completion of the tests.

If it fails to send email, then try again without the log file stating that
it failed to send an email. Obviously this will not be of use if the sending
of email failed for some other reasons, but it will at least give the user
some information when it fails for the most common reason.

Cc: stable@vger.kernel.org
Fixes: c2d84ddb338c8 ("ktest.pl: Add MAIL_COMMAND option to define how to send email")
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 tools/testing/ktest/ktest.pl |    7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

--- a/tools/testing/ktest/ktest.pl
+++ b/tools/testing/ktest/ktest.pl
@@ -4177,7 +4177,12 @@ sub do_send_mail {
     $mail_command =~ s/\$SUBJECT/$subject/g;
     $mail_command =~ s/\$MESSAGE/$message/g;
 
-    run_command $mail_command;
+    my $ret = run_command $mail_command;
+    if (!$ret && defined($file)) {
+	# try again without the file
+	$message .= "\n\n*** FAILED TO SEND LOG ***\n\n";
+	do_send_email($subject, $message);
+    }
 }
 
 sub send_email {



^ permalink raw reply	[flat|nested] 359+ messages in thread

* [PATCH 4.19 039/346] USB: dummy-hcd: Fix uninitialized array use in init()
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (37 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 4.19 038/346] ktest.pl: If size of log is too big to email, email error message Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 4.19 040/346] USB: add RESET_RESUME quirk for Snapscan 1212 Greg Kroah-Hartman
                   ` (309 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Alan Stern, Bui Quang Minh

From: Bui Quang Minh <minhquangbui99@gmail.com>

commit e90cfa813da7a527785033a0b247594c2de93dd8 upstream.

This error path

	err_add_pdata:
		for (i = 0; i < mod_data.num; i++)
			kfree(dum[i]);

can be triggered when not all dum's elements are initialized.

Fix this by initializing all dum's elements to NULL.

Acked-by: Alan Stern <stern@rowland.harvard.edu>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Bui Quang Minh <minhquangbui99@gmail.com>
Link: https://lore.kernel.org/r/1607063090-3426-1-git-send-email-minhquangbui99@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/gadget/udc/dummy_hcd.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/usb/gadget/udc/dummy_hcd.c
+++ b/drivers/usb/gadget/udc/dummy_hcd.c
@@ -2747,7 +2747,7 @@ static int __init init(void)
 {
 	int	retval = -ENOMEM;
 	int	i;
-	struct	dummy *dum[MAX_NUM_UDC];
+	struct	dummy *dum[MAX_NUM_UDC] = {};
 
 	if (usb_disabled())
 		return -ENODEV;



^ permalink raw reply	[flat|nested] 359+ messages in thread

* [PATCH 4.19 040/346] USB: add RESET_RESUME quirk for Snapscan 1212
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (38 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 4.19 039/346] USB: dummy-hcd: Fix uninitialized array use in init() Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 4.19 041/346] ALSA: usb-audio: Fix potential out-of-bounds shift Greg Kroah-Hartman
                   ` (308 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Oliver Neukum

From: Oliver Neukum <oneukum@suse.com>

commit 08a02f954b0def3ada8ed6d4b2c7bcb67e885e9c upstream.

I got reports that some models of this old scanner need
this when using runtime PM.

Signed-off-by: Oliver Neukum <oneukum@suse.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201207130323.23857-1-oneukum@suse.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/core/quirks.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -342,6 +342,9 @@ static const struct usb_device_id usb_qu
 	{ USB_DEVICE(0x06a3, 0x0006), .driver_info =
 			USB_QUIRK_CONFIG_INTF_STRINGS },
 
+	/* Agfa SNAPSCAN 1212U */
+	{ USB_DEVICE(0x06bd, 0x0001), .driver_info = USB_QUIRK_RESET_RESUME },
+
 	/* Guillemot Webcam Hercules Dualpix Exchange (2nd ID) */
 	{ USB_DEVICE(0x06f8, 0x0804), .driver_info = USB_QUIRK_RESET_RESUME },
 



^ permalink raw reply	[flat|nested] 359+ messages in thread

* [PATCH 4.19 041/346] ALSA: usb-audio: Fix potential out-of-bounds shift
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (39 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 4.19 040/346] USB: add RESET_RESUME quirk for Snapscan 1212 Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 4.19 042/346] ALSA: usb-audio: Fix control access overflow errors from chmap Greg Kroah-Hartman
                   ` (307 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, syzbot+df7dc146ebdd6435eea3, Takashi Iwai

From: Takashi Iwai <tiwai@suse.de>

commit 43d5ca88dfcd35e43010fdd818e067aa9a55f5ba upstream.

syzbot spotted a potential out-of-bounds shift in the USB-audio format
parser that receives the arbitrary shift value from the USB
descriptor.

Add a range check for avoiding the undefined behavior.

Reported-by: syzbot+df7dc146ebdd6435eea3@syzkaller.appspotmail.com
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201209084552.17109-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/usb/format.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/sound/usb/format.c
+++ b/sound/usb/format.c
@@ -53,6 +53,8 @@ static u64 parse_audio_format_i_type(str
 	case UAC_VERSION_1:
 	default: {
 		struct uac_format_type_i_discrete_descriptor *fmt = _fmt;
+		if (format >= 64)
+			return 0; /* invalid format */
 		sample_width = fmt->bBitResolution;
 		sample_bytes = fmt->bSubframeSize;
 		format = 1ULL << format;



^ permalink raw reply	[flat|nested] 359+ messages in thread

* [PATCH 4.19 042/346] ALSA: usb-audio: Fix control access overflow errors from chmap
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (40 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 4.19 041/346] ALSA: usb-audio: Fix potential out-of-bounds shift Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 4.19 043/346] xhci: Give USB2 ports time to enter U3 in bus suspend Greg Kroah-Hartman
                   ` (306 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Takashi Iwai

From: Takashi Iwai <tiwai@suse.de>

commit c6dde8ffd071aea9d1ce64279178e470977b235c upstream.

The current channel-map control implementation in USB-audio driver may
lead to an error message like
  "control 3:0:0:Playback Channel Map:0: access overflow"
when CONFIG_SND_CTL_VALIDATION is set.  It's because the chmap get
callback clears the whole array no matter which count is set, and
rather the false-positive detection.

This patch fixes the problem by clearing only the needed array range
at usb_chmap_ctl_get().

Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201211130048.6358-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/usb/stream.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- a/sound/usb/stream.c
+++ b/sound/usb/stream.c
@@ -198,16 +198,16 @@ static int usb_chmap_ctl_get(struct snd_
 	struct snd_pcm_chmap *info = snd_kcontrol_chip(kcontrol);
 	struct snd_usb_substream *subs = info->private_data;
 	struct snd_pcm_chmap_elem *chmap = NULL;
-	int i;
+	int i = 0;
 
-	memset(ucontrol->value.integer.value, 0,
-	       sizeof(ucontrol->value.integer.value));
 	if (subs->cur_audiofmt)
 		chmap = subs->cur_audiofmt->chmap;
 	if (chmap) {
 		for (i = 0; i < chmap->channels; i++)
 			ucontrol->value.integer.value[i] = chmap->map[i];
 	}
+	for (; i < subs->channels_max; i++)
+		ucontrol->value.integer.value[i] = 0;
 	return 0;
 }
 



^ permalink raw reply	[flat|nested] 359+ messages in thread

* [PATCH 4.19 043/346] xhci: Give USB2 ports time to enter U3 in bus suspend
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (41 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 4.19 042/346] ALSA: usb-audio: Fix control access overflow errors from chmap Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 4.19 044/346] USB: UAS: introduce a quirk to set no_write_same Greg Kroah-Hartman
                   ` (305 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Li Jun, Mathias Nyman

From: Li Jun <jun.li@nxp.com>

commit c1373f10479b624fb6dba0805d673e860f1b421d upstream.

If a USB2 device wakeup is not enabled/supported the link state may
still be in U0 in xhci_bus_suspend(), where it's then manually put
to suspended U3 state.

Just as with selective suspend the device needs time to enter U3
suspend before continuing with further suspend operations
(e.g. system suspend), otherwise we may enter system suspend with link
state in U0.

[commit message rewording -Mathias]

Cc: <stable@vger.kernel.org>
Signed-off-by: Li Jun <jun.li@nxp.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20201208092912.1773650-6-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/host/xhci-hub.c |    4 ++++
 1 file changed, 4 insertions(+)

--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -1617,6 +1617,10 @@ retry:
 	hcd->state = HC_STATE_SUSPENDED;
 	bus_state->next_statechange = jiffies + msecs_to_jiffies(10);
 	spin_unlock_irqrestore(&xhci->lock, flags);
+
+	if (bus_state->bus_suspended)
+		usleep_range(5000, 10000);
+
 	return 0;
 }
 



^ permalink raw reply	[flat|nested] 359+ messages in thread

* [PATCH 4.19 044/346] USB: UAS: introduce a quirk to set no_write_same
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (42 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 4.19 043/346] xhci: Give USB2 ports time to enter U3 in bus suspend Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 4.19 045/346] USB: sisusbvga: Make console support depend on BROKEN Greg Kroah-Hartman
                   ` (304 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, David C. Partridge, Oliver Neukum

From: Oliver Neukum <oneukum@suse.com>

commit 8010622c86ca5bb44bc98492f5968726fc7c7a21 upstream.

UAS does not share the pessimistic assumption storage is making that
devices cannot deal with WRITE_SAME.  A few devices supported by UAS,
are reported to not deal well with WRITE_SAME. Those need a quirk.

Add it to the device that needs it.

Reported-by: David C. Partridge <david.partridge@perdrix.co.uk>
Signed-off-by: Oliver Neukum <oneukum@suse.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201209152639.9195-1-oneukum@suse.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 Documentation/admin-guide/kernel-parameters.txt |    1 +
 drivers/usb/storage/uas.c                       |    3 +++
 drivers/usb/storage/unusual_uas.h               |    7 +++++--
 drivers/usb/storage/usb.c                       |    3 +++
 include/linux/usb_usual.h                       |    2 ++
 5 files changed, 14 insertions(+), 2 deletions(-)

--- a/Documentation/admin-guide/kernel-parameters.txt
+++ b/Documentation/admin-guide/kernel-parameters.txt
@@ -4998,6 +4998,7 @@
 					device);
 				j = NO_REPORT_LUNS (don't use report luns
 					command, uas only);
+				k = NO_SAME (do not use WRITE_SAME, uas only)
 				l = NOT_LOCKABLE (don't try to lock and
 					unlock ejectable media, not on uas);
 				m = MAX_SECTORS_64 (don't transfer more
--- a/drivers/usb/storage/uas.c
+++ b/drivers/usb/storage/uas.c
@@ -874,6 +874,9 @@ static int uas_slave_configure(struct sc
 	if (devinfo->flags & US_FL_NO_READ_CAPACITY_16)
 		sdev->no_read_capacity_16 = 1;
 
+	/* Some disks cannot handle WRITE_SAME */
+	if (devinfo->flags & US_FL_NO_SAME)
+		sdev->no_write_same = 1;
 	/*
 	 * Some disks return the total number of blocks in response
 	 * to READ CAPACITY rather than the highest block number.
--- a/drivers/usb/storage/unusual_uas.h
+++ b/drivers/usb/storage/unusual_uas.h
@@ -35,12 +35,15 @@ UNUSUAL_DEV(0x054c, 0x087d, 0x0000, 0x99
 		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
 		US_FL_NO_REPORT_OPCODES),
 
-/* Reported-by: Julian Groß <julian.g@posteo.de> */
+/*
+ *  Initially Reported-by: Julian Groß <julian.g@posteo.de>
+ *  Further reports David C. Partridge <david.partridge@perdrix.co.uk>
+ */
 UNUSUAL_DEV(0x059f, 0x105f, 0x0000, 0x9999,
 		"LaCie",
 		"2Big Quadra USB3",
 		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
-		US_FL_NO_REPORT_OPCODES),
+		US_FL_NO_REPORT_OPCODES | US_FL_NO_SAME),
 
 /*
  * Apricorn USB3 dongle sometimes returns "USBSUSBSUSBS" in response to SCSI
--- a/drivers/usb/storage/usb.c
+++ b/drivers/usb/storage/usb.c
@@ -541,6 +541,9 @@ void usb_stor_adjust_quirks(struct usb_d
 		case 'j':
 			f |= US_FL_NO_REPORT_LUNS;
 			break;
+		case 'k':
+			f |= US_FL_NO_SAME;
+			break;
 		case 'l':
 			f |= US_FL_NOT_LOCKABLE;
 			break;
--- a/include/linux/usb_usual.h
+++ b/include/linux/usb_usual.h
@@ -84,6 +84,8 @@
 		/* Cannot handle REPORT_LUNS */			\
 	US_FLAG(ALWAYS_SYNC, 0x20000000)			\
 		/* lies about caching, so always sync */	\
+	US_FLAG(NO_SAME, 0x40000000)				\
+		/* Cannot handle WRITE_SAME */			\
 
 #define US_FLAG(name, value)	US_FL_##name = value ,
 enum { US_DO_ALL_FLAGS };



^ permalink raw reply	[flat|nested] 359+ messages in thread

* [PATCH 4.19 045/346] USB: sisusbvga: Make console support depend on BROKEN
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (43 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 4.19 044/346] USB: UAS: introduce a quirk to set no_write_same Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 4.19 046/346] ALSA: pcm: oss: Fix potential out-of-bounds shift Greg Kroah-Hartman
                   ` (303 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Thomas Gleixner, Thomas Winischhofer,
	linux-usb

From: Thomas Gleixner <tglx@linutronix.de>

commit 862ee699fefe1e6d6f2c1518395f0b999b8beb15 upstream.

The console part of sisusbvga is broken vs. printk(). It uses in_atomic()
to detect contexts in which it cannot sleep despite the big fat comment in
preempt.h which says: Do not use in_atomic() in driver code.

in_atomic() does not work on kernels with CONFIG_PREEMPT_COUNT=n which
means that spin/rw_lock held regions are not detected by it.

There is no way to make this work by handing context information through to
the driver and this only can be solved once the core printk infrastructure
supports sleepable console drivers.

Make it depend on BROKEN for now.

Fixes: 1bbb4f2035d9 ("[PATCH] USB: sisusb[vga] update")
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Thomas Winischhofer <thomas@winischhofer.net>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: linux-usb@vger.kernel.org
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20201019101109.603244207@linutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/misc/sisusbvga/Kconfig |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/usb/misc/sisusbvga/Kconfig
+++ b/drivers/usb/misc/sisusbvga/Kconfig
@@ -15,7 +15,7 @@ config USB_SISUSBVGA
 
 config USB_SISUSBVGA_CON
 	bool "Text console and mode switching support" if USB_SISUSBVGA
-	depends on VT
+	depends on VT && BROKEN
 	select FONT_8x16
 	---help---
 	  Say Y here if you want a VGA text console via the USB dongle or



^ permalink raw reply	[flat|nested] 359+ messages in thread

* [PATCH 4.19 046/346] ALSA: pcm: oss: Fix potential out-of-bounds shift
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (44 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 4.19 045/346] USB: sisusbvga: Make console support depend on BROKEN Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 4.19 047/346] serial: 8250_omap: Avoid FIFO corruption caused by MDR1 access Greg Kroah-Hartman
                   ` (302 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, syzbot+df7dc146ebdd6435eea3, Takashi Iwai

From: Takashi Iwai <tiwai@suse.de>

commit 175b8d89fe292796811fdee87fa39799a5b6b87a upstream.

syzbot spotted a potential out-of-bounds shift in the PCM OSS layer
where it calculates the buffer size with the arbitrary shift value
given via an ioctl.

Add a range check for avoiding the undefined behavior.
As the value can be treated by a signed integer, the max shift should
be 30.

Reported-by: syzbot+df7dc146ebdd6435eea3@syzkaller.appspotmail.com
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201209084552.17109-2-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/core/oss/pcm_oss.c |    6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

--- a/sound/core/oss/pcm_oss.c
+++ b/sound/core/oss/pcm_oss.c
@@ -1949,11 +1949,15 @@ static int snd_pcm_oss_set_subdivide(str
 static int snd_pcm_oss_set_fragment1(struct snd_pcm_substream *substream, unsigned int val)
 {
 	struct snd_pcm_runtime *runtime;
+	int fragshift;
 
 	runtime = substream->runtime;
 	if (runtime->oss.subdivision || runtime->oss.fragshift)
 		return -EINVAL;
-	runtime->oss.fragshift = val & 0xffff;
+	fragshift = val & 0xffff;
+	if (fragshift >= 31)
+		return -EINVAL;
+	runtime->oss.fragshift = fragshift;
 	runtime->oss.maxfrags = (val >> 16) & 0xffff;
 	if (runtime->oss.fragshift < 4)		/* < 16 */
 		runtime->oss.fragshift = 4;



^ permalink raw reply	[flat|nested] 359+ messages in thread

* [PATCH 4.19 047/346] serial: 8250_omap: Avoid FIFO corruption caused by MDR1 access
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (45 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 4.19 046/346] ALSA: pcm: oss: Fix potential out-of-bounds shift Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 4.19 048/346] drm/xen-front: Fix misused IS_ERR_OR_NULL checks Greg Kroah-Hartman
                   ` (301 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Alexander Sverdlin

From: Alexander Sverdlin <alexander.sverdlin@gmail.com>

commit d96f04d347e4011977abdbb4da5d8f303ebd26f8 upstream.

It has been observed that once per 300-1300 port openings the first
transmitted byte is being corrupted on AM3352 ("v" written to FIFO appeared
as "e" on the wire). It only happened if single byte has been transmitted
right after port open, which means, DMA is not used for this transfer and
the corruption never happened afterwards.

Therefore I've carefully re-read the MDR1 errata (link below), which says
"when accessing the MDR1 registers that causes a dummy under-run condition
that will freeze the UART in IrDA transmission. In UART mode, this may
corrupt the transferred data". Strictly speaking,
omap_8250_mdr1_errataset() performs a read access and if the value is the
same as should be written, exits without errata-recommended FIFO reset.

A brief check of the serial_omap_mdr1_errataset() from the competing
omap-serial driver showed it has no read access of MDR1. After removing the
read access from omap_8250_mdr1_errataset() the data corruption never
happened any more.

Link: https://www.ti.com/lit/er/sprz360i/sprz360i.pdf
Fixes: 61929cf0169d ("tty: serial: Add 8250-core based omap driver")
Cc: stable@vger.kernel.org
Signed-off-by: Alexander Sverdlin <alexander.sverdlin@gmail.com>
Link: https://lore.kernel.org/r/20201210055257.1053028-1-alexander.sverdlin@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/tty/serial/8250/8250_omap.c |    5 -----
 1 file changed, 5 deletions(-)

--- a/drivers/tty/serial/8250/8250_omap.c
+++ b/drivers/tty/serial/8250/8250_omap.c
@@ -163,11 +163,6 @@ static void omap_8250_mdr1_errataset(str
 				     struct omap8250_priv *priv)
 {
 	u8 timeout = 255;
-	u8 old_mdr1;
-
-	old_mdr1 = serial_in(up, UART_OMAP_MDR1);
-	if (old_mdr1 == priv->mdr1)
-		return;
 
 	serial_out(up, UART_OMAP_MDR1, priv->mdr1);
 	udelay(2);



^ permalink raw reply	[flat|nested] 359+ messages in thread

* [PATCH 4.19 048/346] drm/xen-front: Fix misused IS_ERR_OR_NULL checks
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (46 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 4.19 047/346] serial: 8250_omap: Avoid FIFO corruption caused by MDR1 access Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 4.19 049/346] drm: fix drm_dp_mst_port refcount leaks in drm_dp_mst_allocate_vcpi Greg Kroah-Hartman
                   ` (300 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Oleksandr Andrushchenko,
	Dan Carpenter, Juergen Gross, Sudip Mukherjee

From: Oleksandr Andrushchenko <oleksandr_andrushchenko@epam.com>

commit 14dee058610446aa464254fc5c8e88c7535195e0 upstream

The patch c575b7eeb89f: "drm/xen-front: Add support for Xen PV
display frontend" from Apr 3, 2018, leads to the following static
checker warning:

	drivers/gpu/drm/xen/xen_drm_front_gem.c:140 xen_drm_front_gem_create()
	warn: passing zero to 'ERR_CAST'

drivers/gpu/drm/xen/xen_drm_front_gem.c
   133  struct drm_gem_object *xen_drm_front_gem_create(struct drm_device *dev,
   134                                                  size_t size)
   135  {
   136          struct xen_gem_object *xen_obj;
   137
   138          xen_obj = gem_create(dev, size);
   139          if (IS_ERR_OR_NULL(xen_obj))
   140                  return ERR_CAST(xen_obj);

Fix this and the rest of misused places with IS_ERR_OR_NULL in the
driver.

Fixes:  c575b7eeb89f: "drm/xen-front: Add support for Xen PV display frontend"

Signed-off-by: Oleksandr Andrushchenko <oleksandr_andrushchenko@epam.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200813062113.11030-3-andr2000@gmail.com
Signed-off-by: Juergen Gross <jgross@suse.com>
[sudip: adjust context]
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/xen/xen_drm_front.c     |    2 +-
 drivers/gpu/drm/xen/xen_drm_front_gem.c |    8 ++++----
 drivers/gpu/drm/xen/xen_drm_front_kms.c |    2 +-
 3 files changed, 6 insertions(+), 6 deletions(-)

--- a/drivers/gpu/drm/xen/xen_drm_front.c
+++ b/drivers/gpu/drm/xen/xen_drm_front.c
@@ -410,7 +410,7 @@ static int xen_drm_drv_dumb_create(struc
 	args->size = args->pitch * args->height;
 
 	obj = xen_drm_front_gem_create(dev, args->size);
-	if (IS_ERR_OR_NULL(obj)) {
+	if (IS_ERR(obj)) {
 		ret = PTR_ERR(obj);
 		goto fail;
 	}
--- a/drivers/gpu/drm/xen/xen_drm_front_gem.c
+++ b/drivers/gpu/drm/xen/xen_drm_front_gem.c
@@ -85,7 +85,7 @@ static struct xen_gem_object *gem_create
 
 	size = round_up(size, PAGE_SIZE);
 	xen_obj = gem_create_obj(dev, size);
-	if (IS_ERR_OR_NULL(xen_obj))
+	if (IS_ERR(xen_obj))
 		return xen_obj;
 
 	if (drm_info->front_info->cfg.be_alloc) {
@@ -119,7 +119,7 @@ static struct xen_gem_object *gem_create
 	 */
 	xen_obj->num_pages = DIV_ROUND_UP(size, PAGE_SIZE);
 	xen_obj->pages = drm_gem_get_pages(&xen_obj->base);
-	if (IS_ERR_OR_NULL(xen_obj->pages)) {
+	if (IS_ERR(xen_obj->pages)) {
 		ret = PTR_ERR(xen_obj->pages);
 		xen_obj->pages = NULL;
 		goto fail;
@@ -138,7 +138,7 @@ struct drm_gem_object *xen_drm_front_gem
 	struct xen_gem_object *xen_obj;
 
 	xen_obj = gem_create(dev, size);
-	if (IS_ERR_OR_NULL(xen_obj))
+	if (IS_ERR(xen_obj))
 		return ERR_CAST(xen_obj);
 
 	return &xen_obj->base;
@@ -196,7 +196,7 @@ xen_drm_front_gem_import_sg_table(struct
 
 	size = attach->dmabuf->size;
 	xen_obj = gem_create_obj(dev, size);
-	if (IS_ERR_OR_NULL(xen_obj))
+	if (IS_ERR(xen_obj))
 		return ERR_CAST(xen_obj);
 
 	ret = gem_alloc_pages_array(xen_obj, size);
--- a/drivers/gpu/drm/xen/xen_drm_front_kms.c
+++ b/drivers/gpu/drm/xen/xen_drm_front_kms.c
@@ -59,7 +59,7 @@ fb_create(struct drm_device *dev, struct
 	int ret;
 
 	fb = drm_gem_fb_create_with_funcs(dev, filp, mode_cmd, &fb_funcs);
-	if (IS_ERR_OR_NULL(fb))
+	if (IS_ERR(fb))
 		return fb;
 
 	gem_obj = drm_gem_object_lookup(filp, mode_cmd->handles[0]);



^ permalink raw reply	[flat|nested] 359+ messages in thread

* [PATCH 4.19 049/346] drm: fix drm_dp_mst_port refcount leaks in drm_dp_mst_allocate_vcpi
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (47 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 4.19 048/346] drm/xen-front: Fix misused IS_ERR_OR_NULL checks Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 4.19 050/346] arm64: lse: fix LSE atomics with LLVMs integrated assembler Greg Kroah-Hartman
                   ` (299 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Xiyu Yang, Xin Tan, Xin Xiong,
	Lyude Paul, Sudip Mukherjee

From: Xin Xiong <xiongx18@fudan.edu.cn>

commit a34a0a632dd991a371fec56431d73279f9c54029 upstream

drm_dp_mst_allocate_vcpi() invokes
drm_dp_mst_topology_get_port_validated(), which increases the refcount
of the "port".

These reference counting issues take place in two exception handling
paths separately. Either when “slots” is less than 0 or when
drm_dp_init_vcpi() returns a negative value, the function forgets to
reduce the refcnt increased drm_dp_mst_topology_get_port_validated(),
which results in a refcount leak.

Fix these issues by pulling up the error handling when "slots" is less
than 0, and calling drm_dp_mst_topology_put_port() before termination
when drm_dp_init_vcpi() returns a negative value.

Fixes: 1e797f556c61 ("drm/dp: Split drm_dp_mst_allocate_vcpi")
Cc: <stable@vger.kernel.org> # v4.12+
Signed-off-by: Xiyu Yang <xiyuyang19@fudan.edu.cn>
Signed-off-by: Xin Tan <tanxin.ctf@gmail.com>
Signed-off-by: Xin Xiong <xiongx18@fudan.edu.cn>
Reviewed-by: Lyude Paul <lyude@redhat.com>
Signed-off-by: Lyude Paul <lyude@redhat.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20200719154545.GA41231@xin-virtual-machine
[sudip: use old functions before rename]
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/drm_dp_mst_topology.c |    7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

--- a/drivers/gpu/drm/drm_dp_mst_topology.c
+++ b/drivers/gpu/drm/drm_dp_mst_topology.c
@@ -2706,11 +2706,11 @@ bool drm_dp_mst_allocate_vcpi(struct drm
 {
 	int ret;
 
-	port = drm_dp_get_validated_port_ref(mgr, port);
-	if (!port)
+	if (slots < 0)
 		return false;
 
-	if (slots < 0)
+	port = drm_dp_get_validated_port_ref(mgr, port);
+	if (!port)
 		return false;
 
 	if (port->vcpi.vcpi > 0) {
@@ -2725,6 +2725,7 @@ bool drm_dp_mst_allocate_vcpi(struct drm
 	if (ret) {
 		DRM_DEBUG_KMS("failed to init vcpi slots=%d max=63 ret=%d\n",
 				DIV_ROUND_UP(pbn, mgr->pbn_div), ret);
+		drm_dp_put_port(port);
 		goto out;
 	}
 	DRM_DEBUG_KMS("initing vcpi for pbn=%d slots=%d\n",



^ permalink raw reply	[flat|nested] 359+ messages in thread

* [PATCH 4.19 050/346] arm64: lse: fix LSE atomics with LLVMs integrated assembler
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (48 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 4.19 049/346] drm: fix drm_dp_mst_port refcount leaks in drm_dp_mst_allocate_vcpi Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 4.19 051/346] arm64: lse: Fix LSE atomics with LLVM Greg Kroah-Hartman
                   ` (298 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sami Tolvanen, Andrew Murray,
	Kees Cook, Nick Desaulniers, Will Deacon

From: Sami Tolvanen <samitolvanen@google.com>

commit e0d5896bd356cd577f9710a02d7a474cdf58426b upstream.

Unlike gcc, clang considers each inline assembly block to be independent
and therefore, when using the integrated assembler for inline assembly,
any preambles that enable features must be repeated in each block.

This change defines __LSE_PREAMBLE and adds it to each inline assembly
block that has LSE instructions, which allows them to be compiled also
with clang's assembler.

Link: https://github.com/ClangBuiltLinux/linux/issues/671
Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
Tested-by: Andrew Murray <andrew.murray@arm.com>
Tested-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Andrew Murray <andrew.murray@arm.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
Signed-off-by: Will Deacon <will@kernel.org>
[nd: backport adjusted due to missing:
  commit addfc38672c7 ("arm64: atomics: avoid out-of-line ll/sc atomics")]
Signed-off-by: Nick Desaulniers <ndesaulniers@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm64/include/asm/atomic_lse.h |   76 +++++++++++++++++++++++++++---------
 arch/arm64/include/asm/lse.h        |    6 +-
 2 files changed, 60 insertions(+), 22 deletions(-)

--- a/arch/arm64/include/asm/atomic_lse.h
+++ b/arch/arm64/include/asm/atomic_lse.h
@@ -32,7 +32,9 @@ static inline void atomic_##op(int i, at
 	register int w0 asm ("w0") = i;					\
 	register atomic_t *x1 asm ("x1") = v;				\
 									\
-	asm volatile(ARM64_LSE_ATOMIC_INSN(__LL_SC_ATOMIC(op),		\
+	asm volatile(							\
+	__LSE_PREAMBLE							\
+	ARM64_LSE_ATOMIC_INSN(__LL_SC_ATOMIC(op),			\
 "	" #asm_op "	%w[i], %[v]\n")					\
 	: [i] "+r" (w0), [v] "+Q" (v->counter)				\
 	: "r" (x1)							\
@@ -52,7 +54,9 @@ static inline int atomic_fetch_##op##nam
 	register int w0 asm ("w0") = i;					\
 	register atomic_t *x1 asm ("x1") = v;				\
 									\
-	asm volatile(ARM64_LSE_ATOMIC_INSN(				\
+	asm volatile(							\
+	__LSE_PREAMBLE							\
+	ARM64_LSE_ATOMIC_INSN(						\
 	/* LL/SC */							\
 	__LL_SC_ATOMIC(fetch_##op##name),				\
 	/* LSE atomics */						\
@@ -84,7 +88,9 @@ static inline int atomic_add_return##nam
 	register int w0 asm ("w0") = i;					\
 	register atomic_t *x1 asm ("x1") = v;				\
 									\
-	asm volatile(ARM64_LSE_ATOMIC_INSN(				\
+	asm volatile(							\
+	__LSE_PREAMBLE							\
+	ARM64_LSE_ATOMIC_INSN(						\
 	/* LL/SC */							\
 	__LL_SC_ATOMIC(add_return##name)				\
 	__nops(1),							\
@@ -110,7 +116,9 @@ static inline void atomic_and(int i, ato
 	register int w0 asm ("w0") = i;
 	register atomic_t *x1 asm ("x1") = v;
 
-	asm volatile(ARM64_LSE_ATOMIC_INSN(
+	asm volatile(
+	__LSE_PREAMBLE
+	ARM64_LSE_ATOMIC_INSN(
 	/* LL/SC */
 	__LL_SC_ATOMIC(and)
 	__nops(1),
@@ -128,7 +136,9 @@ static inline int atomic_fetch_and##name
 	register int w0 asm ("w0") = i;					\
 	register atomic_t *x1 asm ("x1") = v;				\
 									\
-	asm volatile(ARM64_LSE_ATOMIC_INSN(				\
+	asm volatile(							\
+	__LSE_PREAMBLE							\
+	ARM64_LSE_ATOMIC_INSN(						\
 	/* LL/SC */							\
 	__LL_SC_ATOMIC(fetch_and##name)					\
 	__nops(1),							\
@@ -154,7 +164,9 @@ static inline void atomic_sub(int i, ato
 	register int w0 asm ("w0") = i;
 	register atomic_t *x1 asm ("x1") = v;
 
-	asm volatile(ARM64_LSE_ATOMIC_INSN(
+	asm volatile(
+	__LSE_PREAMBLE
+	ARM64_LSE_ATOMIC_INSN(
 	/* LL/SC */
 	__LL_SC_ATOMIC(sub)
 	__nops(1),
@@ -172,7 +184,9 @@ static inline int atomic_sub_return##nam
 	register int w0 asm ("w0") = i;					\
 	register atomic_t *x1 asm ("x1") = v;				\
 									\
-	asm volatile(ARM64_LSE_ATOMIC_INSN(				\
+	asm volatile(							\
+	__LSE_PREAMBLE							\
+	ARM64_LSE_ATOMIC_INSN(						\
 	/* LL/SC */							\
 	__LL_SC_ATOMIC(sub_return##name)				\
 	__nops(2),							\
@@ -200,7 +214,9 @@ static inline int atomic_fetch_sub##name
 	register int w0 asm ("w0") = i;					\
 	register atomic_t *x1 asm ("x1") = v;				\
 									\
-	asm volatile(ARM64_LSE_ATOMIC_INSN(				\
+	asm volatile(							\
+	__LSE_PREAMBLE							\
+	ARM64_LSE_ATOMIC_INSN(						\
 	/* LL/SC */							\
 	__LL_SC_ATOMIC(fetch_sub##name)					\
 	__nops(1),							\
@@ -229,7 +245,9 @@ static inline void atomic64_##op(long i,
 	register long x0 asm ("x0") = i;				\
 	register atomic64_t *x1 asm ("x1") = v;				\
 									\
-	asm volatile(ARM64_LSE_ATOMIC_INSN(__LL_SC_ATOMIC64(op),	\
+	asm volatile(							\
+	__LSE_PREAMBLE							\
+	ARM64_LSE_ATOMIC_INSN(__LL_SC_ATOMIC64(op),			\
 "	" #asm_op "	%[i], %[v]\n")					\
 	: [i] "+r" (x0), [v] "+Q" (v->counter)				\
 	: "r" (x1)							\
@@ -249,7 +267,9 @@ static inline long atomic64_fetch_##op##
 	register long x0 asm ("x0") = i;				\
 	register atomic64_t *x1 asm ("x1") = v;				\
 									\
-	asm volatile(ARM64_LSE_ATOMIC_INSN(				\
+	asm volatile(							\
+	__LSE_PREAMBLE							\
+	ARM64_LSE_ATOMIC_INSN(						\
 	/* LL/SC */							\
 	__LL_SC_ATOMIC64(fetch_##op##name),				\
 	/* LSE atomics */						\
@@ -281,7 +301,9 @@ static inline long atomic64_add_return##
 	register long x0 asm ("x0") = i;				\
 	register atomic64_t *x1 asm ("x1") = v;				\
 									\
-	asm volatile(ARM64_LSE_ATOMIC_INSN(				\
+	asm volatile(							\
+	__LSE_PREAMBLE							\
+	ARM64_LSE_ATOMIC_INSN(						\
 	/* LL/SC */							\
 	__LL_SC_ATOMIC64(add_return##name)				\
 	__nops(1),							\
@@ -307,7 +329,9 @@ static inline void atomic64_and(long i,
 	register long x0 asm ("x0") = i;
 	register atomic64_t *x1 asm ("x1") = v;
 
-	asm volatile(ARM64_LSE_ATOMIC_INSN(
+	asm volatile(
+	__LSE_PREAMBLE
+	ARM64_LSE_ATOMIC_INSN(
 	/* LL/SC */
 	__LL_SC_ATOMIC64(and)
 	__nops(1),
@@ -325,7 +349,9 @@ static inline long atomic64_fetch_and##n
 	register long x0 asm ("x0") = i;				\
 	register atomic64_t *x1 asm ("x1") = v;				\
 									\
-	asm volatile(ARM64_LSE_ATOMIC_INSN(				\
+	asm volatile(							\
+	__LSE_PREAMBLE							\
+	ARM64_LSE_ATOMIC_INSN(						\
 	/* LL/SC */							\
 	__LL_SC_ATOMIC64(fetch_and##name)				\
 	__nops(1),							\
@@ -351,7 +377,9 @@ static inline void atomic64_sub(long i,
 	register long x0 asm ("x0") = i;
 	register atomic64_t *x1 asm ("x1") = v;
 
-	asm volatile(ARM64_LSE_ATOMIC_INSN(
+	asm volatile(
+	__LSE_PREAMBLE
+	ARM64_LSE_ATOMIC_INSN(
 	/* LL/SC */
 	__LL_SC_ATOMIC64(sub)
 	__nops(1),
@@ -369,7 +397,9 @@ static inline long atomic64_sub_return##
 	register long x0 asm ("x0") = i;				\
 	register atomic64_t *x1 asm ("x1") = v;				\
 									\
-	asm volatile(ARM64_LSE_ATOMIC_INSN(				\
+	asm volatile(							\
+	__LSE_PREAMBLE							\
+	ARM64_LSE_ATOMIC_INSN(						\
 	/* LL/SC */							\
 	__LL_SC_ATOMIC64(sub_return##name)				\
 	__nops(2),							\
@@ -397,7 +427,9 @@ static inline long atomic64_fetch_sub##n
 	register long x0 asm ("x0") = i;				\
 	register atomic64_t *x1 asm ("x1") = v;				\
 									\
-	asm volatile(ARM64_LSE_ATOMIC_INSN(				\
+	asm volatile(							\
+	__LSE_PREAMBLE							\
+	ARM64_LSE_ATOMIC_INSN(						\
 	/* LL/SC */							\
 	__LL_SC_ATOMIC64(fetch_sub##name)				\
 	__nops(1),							\
@@ -422,7 +454,9 @@ static inline long atomic64_dec_if_posit
 {
 	register long x0 asm ("x0") = (long)v;
 
-	asm volatile(ARM64_LSE_ATOMIC_INSN(
+	asm volatile(
+	__LSE_PREAMBLE
+	ARM64_LSE_ATOMIC_INSN(
 	/* LL/SC */
 	__LL_SC_ATOMIC64(dec_if_positive)
 	__nops(6),
@@ -455,7 +489,9 @@ static inline unsigned long __cmpxchg_ca
 	register unsigned long x1 asm ("x1") = old;			\
 	register unsigned long x2 asm ("x2") = new;			\
 									\
-	asm volatile(ARM64_LSE_ATOMIC_INSN(				\
+	asm volatile(							\
+	__LSE_PREAMBLE							\
+	ARM64_LSE_ATOMIC_INSN(						\
 	/* LL/SC */							\
 	__LL_SC_CMPXCHG(name)						\
 	__nops(2),							\
@@ -507,7 +543,9 @@ static inline long __cmpxchg_double##nam
 	register unsigned long x3 asm ("x3") = new2;			\
 	register unsigned long x4 asm ("x4") = (unsigned long)ptr;	\
 									\
-	asm volatile(ARM64_LSE_ATOMIC_INSN(				\
+	asm volatile(							\
+	__LSE_PREAMBLE							\
+	ARM64_LSE_ATOMIC_INSN(						\
 	/* LL/SC */							\
 	__LL_SC_CMPXCHG_DBL(name)					\
 	__nops(3),							\
--- a/arch/arm64/include/asm/lse.h
+++ b/arch/arm64/include/asm/lse.h
@@ -4,6 +4,8 @@
 
 #if defined(CONFIG_AS_LSE) && defined(CONFIG_ARM64_LSE_ATOMICS)
 
+#define __LSE_PREAMBLE	".arch armv8-a+lse\n"
+
 #include <linux/compiler_types.h>
 #include <linux/export.h>
 #include <linux/stringify.h>
@@ -20,8 +22,6 @@
 
 #else	/* __ASSEMBLER__ */
 
-__asm__(".arch_extension	lse");
-
 /* Move the ll/sc atomics out-of-line */
 #define __LL_SC_INLINE		notrace
 #define __LL_SC_PREFIX(x)	__ll_sc_##x
@@ -33,7 +33,7 @@ __asm__(".arch_extension	lse");
 
 /* In-line patching at runtime */
 #define ARM64_LSE_ATOMIC_INSN(llsc, lse)				\
-	ALTERNATIVE(llsc, lse, ARM64_HAS_LSE_ATOMICS)
+	ALTERNATIVE(llsc, __LSE_PREAMBLE lse, ARM64_HAS_LSE_ATOMICS)
 
 #endif	/* __ASSEMBLER__ */
 #else	/* CONFIG_AS_LSE && CONFIG_ARM64_LSE_ATOMICS */



^ permalink raw reply	[flat|nested] 359+ messages in thread

* [PATCH 4.19 051/346] arm64: lse: Fix LSE atomics with LLVM
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (49 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 4.19 050/346] arm64: lse: fix LSE atomics with LLVMs integrated assembler Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 4.19 052/346] arm64: Change .weak to SYM_FUNC_START_WEAK_PI for arch/arm64/lib/mem*.S Greg Kroah-Hartman
                   ` (297 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Catalin Marinas, Will Deacon,
	Amit Kachhap, Sami Tolvanen, Vincenzo Frascino, Nick Desaulniers

From: Vincenzo Frascino <vincenzo.frascino@arm.com>

commit dd1f6308b28edf0452dd5dc7877992903ec61e69 upstream.

Commit e0d5896bd356 ("arm64: lse: fix LSE atomics with LLVM's integrated
assembler") broke the build when clang is used in connjunction with the
binutils assembler ("-no-integrated-as"). This happens because
__LSE_PREAMBLE is defined as ".arch armv8-a+lse", which overrides the
version of the CPU architecture passed via the "-march" paramter to gas:

$ aarch64-none-linux-gnu-as -EL -I ./arch/arm64/include
                                -I ./arch/arm64/include/generated
                                -I ./include -I ./include
                                -I ./arch/arm64/include/uapi
                                -I ./arch/arm64/include/generated/uapi
                                -I ./include/uapi -I ./include/generated/uapi
                                -I ./init -I ./init
                                -march=armv8.3-a -o init/do_mounts.o
                                /tmp/do_mounts-d7992a.s
/tmp/do_mounts-d7992a.s: Assembler messages:
/tmp/do_mounts-d7992a.s:1959: Error: selected processor does not support `autiasp'
/tmp/do_mounts-d7992a.s:2021: Error: selected processor does not support `paciasp'
/tmp/do_mounts-d7992a.s:2157: Error: selected processor does not support `autiasp'
/tmp/do_mounts-d7992a.s:2175: Error: selected processor does not support `paciasp'
/tmp/do_mounts-d7992a.s:2494: Error: selected processor does not support `autiasp'

Fix the issue by replacing ".arch armv8-a+lse" with ".arch_extension lse".
Sami confirms that the clang integrated assembler does now support the
'.arch_extension' directive, so this change will be fine even for LTO
builds in future.

Fixes: e0d5896bd356cd ("arm64: lse: fix LSE atomics with LLVM's integrated assembler")
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Will Deacon <will@kernel.org>
Reported-by: Amit Kachhap <Amit.Kachhap@arm.com>
Tested-by: Sami Tolvanen <samitolvanen@google.com>
Signed-off-by: Vincenzo Frascino <vincenzo.frascino@arm.com>
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Nick Desaulniers <ndesaulniers@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm64/include/asm/lse.h |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/arm64/include/asm/lse.h
+++ b/arch/arm64/include/asm/lse.h
@@ -4,7 +4,7 @@
 
 #if defined(CONFIG_AS_LSE) && defined(CONFIG_ARM64_LSE_ATOMICS)
 
-#define __LSE_PREAMBLE	".arch armv8-a+lse\n"
+#define __LSE_PREAMBLE	".arch_extension lse\n"
 
 #include <linux/compiler_types.h>
 #include <linux/export.h>



^ permalink raw reply	[flat|nested] 359+ messages in thread

* [PATCH 4.19 052/346] arm64: Change .weak to SYM_FUNC_START_WEAK_PI for arch/arm64/lib/mem*.S
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (50 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 4.19 051/346] arm64: lse: Fix LSE atomics with LLVM Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 4.19 053/346] x86/resctrl: Remove unused struct mbm_state::chunks_bw Greg Kroah-Hartman
                   ` (296 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sami Tolvanen, Fangrui Song,
	Nick Desaulniers, Will Deacon

From: Fangrui Song <maskray@google.com>

commit ec9d78070de986ecf581ea204fd322af4d2477ec upstream.

Commit 39d114ddc682 ("arm64: add KASAN support") added .weak directives to
arch/arm64/lib/mem*.S instead of changing the existing SYM_FUNC_START_PI
macros. This can lead to the assembly snippet `.weak memcpy ... .globl
memcpy` which will produce a STB_WEAK memcpy with GNU as but STB_GLOBAL
memcpy with LLVM's integrated assembler before LLVM 12. LLVM 12 (since
https://reviews.llvm.org/D90108) will error on such an overridden symbol
binding.

Use the appropriate SYM_FUNC_START_WEAK_PI instead.

Fixes: 39d114ddc682 ("arm64: add KASAN support")
Reported-by: Sami Tolvanen <samitolvanen@google.com>
Signed-off-by: Fangrui Song <maskray@google.com>
Tested-by: Sami Tolvanen <samitolvanen@google.com>
Tested-by: Nick Desaulniers <ndesaulniers@google.com>
Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201029181951.1866093-1-maskray@google.com
Signed-off-by: Will Deacon <will@kernel.org>
[nd: backport to adjust for missing:
  commit 3ac0f4526dfb ("arm64: lib: Use modern annotations for assembly functions")
  commit 35e61c77ef38 ("arm64: asm: Add new-style position independent function annotations")]
Signed-off-by: Nick Desaulniers <ndesaulniers@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm64/lib/memcpy.S  |    3 +--
 arch/arm64/lib/memmove.S |    3 +--
 arch/arm64/lib/memset.S  |    3 +--
 3 files changed, 3 insertions(+), 6 deletions(-)

--- a/arch/arm64/lib/memcpy.S
+++ b/arch/arm64/lib/memcpy.S
@@ -68,9 +68,8 @@
 	stp \ptr, \regB, [\regC], \val
 	.endm
 
-	.weak memcpy
 ENTRY(__memcpy)
-ENTRY(memcpy)
+WEAK(memcpy)
 #include "copy_template.S"
 	ret
 ENDPIPROC(memcpy)
--- a/arch/arm64/lib/memmove.S
+++ b/arch/arm64/lib/memmove.S
@@ -57,9 +57,8 @@ C_h	.req	x12
 D_l	.req	x13
 D_h	.req	x14
 
-	.weak memmove
 ENTRY(__memmove)
-ENTRY(memmove)
+WEAK(memmove)
 	cmp	dstin, src
 	b.lo	__memcpy
 	add	tmp1, src, count
--- a/arch/arm64/lib/memset.S
+++ b/arch/arm64/lib/memset.S
@@ -54,9 +54,8 @@ dst		.req	x8
 tmp3w		.req	w9
 tmp3		.req	x9
 
-	.weak memset
 ENTRY(__memset)
-ENTRY(memset)
+WEAK(memset)
 	mov	dst, dstin	/* Preserve return value.  */
 	and	A_lw, val, #255
 	orr	A_lw, A_lw, A_lw, lsl #8



^ permalink raw reply	[flat|nested] 359+ messages in thread

* [PATCH 4.19 053/346] x86/resctrl: Remove unused struct mbm_state::chunks_bw
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (51 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 4.19 052/346] arm64: Change .weak to SYM_FUNC_START_WEAK_PI for arch/arm64/lib/mem*.S Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 4.19 054/346] x86/resctrl: Fix incorrect local bandwidth when mba_sc is enabled Greg Kroah-Hartman
                   ` (295 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, James Morse, Borislav Petkov,
	Reinette Chatre, Sudip Mukherjee

From: James Morse <james.morse@arm.com>

commit abe8f12b44250d02937665033a8b750c1bfeb26e upstream

Nothing reads struct mbm_states's chunks_bw value, its a copy of
chunks. Remove it.

Signed-off-by: James Morse <james.morse@arm.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Reviewed-by: Reinette Chatre <reinette.chatre@intel.com>
Link: https://lkml.kernel.org/r/20200708163929.2783-2-james.morse@arm.com
[sudip: manual backport to file at old path]
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kernel/cpu/intel_rdt.h         |    2 --
 arch/x86/kernel/cpu/intel_rdt_monitor.c |    3 +--
 2 files changed, 1 insertion(+), 4 deletions(-)

--- a/arch/x86/kernel/cpu/intel_rdt.h
+++ b/arch/x86/kernel/cpu/intel_rdt.h
@@ -251,7 +251,6 @@ struct rftype {
  * struct mbm_state - status for each MBM counter in each domain
  * @chunks:	Total data moved (multiply by rdt_group.mon_scale to get bytes)
  * @prev_msr	Value of IA32_QM_CTR for this RMID last time we read it
- * @chunks_bw	Total local data moved. Used for bandwidth calculation
  * @prev_bw_msr:Value of previous IA32_QM_CTR for bandwidth counting
  * @prev_bw	The most recent bandwidth in MBps
  * @delta_bw	Difference between the current and previous bandwidth
@@ -260,7 +259,6 @@ struct rftype {
 struct mbm_state {
 	u64	chunks;
 	u64	prev_msr;
-	u64	chunks_bw;
 	u64	prev_bw_msr;
 	u32	prev_bw;
 	u32	delta_bw;
--- a/arch/x86/kernel/cpu/intel_rdt_monitor.c
+++ b/arch/x86/kernel/cpu/intel_rdt_monitor.c
@@ -290,8 +290,7 @@ static void mbm_bw_count(u32 rmid, struc
 		return;
 
 	chunks = mbm_overflow_count(m->prev_bw_msr, tval);
-	m->chunks_bw += chunks;
-	m->chunks = m->chunks_bw;
+	m->chunks += chunks;
 	cur_bw = (chunks * r->mon_scale) >> 20;
 
 	if (m->delta_comp)



^ permalink raw reply	[flat|nested] 359+ messages in thread

* [PATCH 4.19 054/346] x86/resctrl: Fix incorrect local bandwidth when mba_sc is enabled
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (52 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 4.19 053/346] x86/resctrl: Remove unused struct mbm_state::chunks_bw Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 4.19 055/346] pinctrl: merrifield: Set default bias in case no particular value given Greg Kroah-Hartman
                   ` (294 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Xiaochen Shen, Borislav Petkov,
	Tony Luck, Sudip Mukherjee

From: Xiaochen Shen <xiaochen.shen@intel.com>

commit 06c5fe9b12dde1b62821f302f177c972bb1c81f9 upstream

The MBA software controller (mba_sc) is a feedback loop which
periodically reads MBM counters and tries to restrict the bandwidth
below a user-specified value. It tags along the MBM counter overflow
handler to do the updates with 1s interval in mbm_update() and
update_mba_bw().

The purpose of mbm_update() is to periodically read the MBM counters to
make sure that the hardware counter doesn't wrap around more than once
between user samplings. mbm_update() calls __mon_event_count() for local
bandwidth updating when mba_sc is not enabled, but calls mbm_bw_count()
instead when mba_sc is enabled. __mon_event_count() will not be called
for local bandwidth updating in MBM counter overflow handler, but it is
still called when reading MBM local bandwidth counter file
'mbm_local_bytes', the call path is as below:

  rdtgroup_mondata_show()
    mon_event_read()
      mon_event_count()
        __mon_event_count()

In __mon_event_count(), m->chunks is updated by delta chunks which is
calculated from previous MSR value (m->prev_msr) and current MSR value.
When mba_sc is enabled, m->chunks is also updated in mbm_update() by
mistake by the delta chunks which is calculated from m->prev_bw_msr
instead of m->prev_msr. But m->chunks is not used in update_mba_bw() in
the mba_sc feedback loop.

When reading MBM local bandwidth counter file, m->chunks was changed
unexpectedly by mbm_bw_count(). As a result, the incorrect local
bandwidth counter which calculated from incorrect m->chunks is shown to
the user.

Fix this by removing incorrect m->chunks updating in mbm_bw_count() in
MBM counter overflow handler, and always calling __mon_event_count() in
mbm_update() to make sure that the hardware local bandwidth counter
doesn't wrap around.

Test steps:
  # Run workload with aggressive memory bandwidth (e.g., 10 GB/s)
  git clone https://github.com/intel/intel-cmt-cat && cd intel-cmt-cat
  && make
  ./tools/membw/membw -c 0 -b 10000 --read

  # Enable MBA software controller
  mount -t resctrl resctrl -o mba_MBps /sys/fs/resctrl

  # Create control group c1
  mkdir /sys/fs/resctrl/c1

  # Set MB throttle to 6 GB/s
  echo "MB:0=6000;1=6000" > /sys/fs/resctrl/c1/schemata

  # Write PID of the workload to tasks file
  echo `pidof membw` > /sys/fs/resctrl/c1/tasks

  # Read local bytes counters twice with 1s interval, the calculated
  # local bandwidth is not as expected (approaching to 6 GB/s):
  local_1=`cat /sys/fs/resctrl/c1/mon_data/mon_L3_00/mbm_local_bytes`
  sleep 1
  local_2=`cat /sys/fs/resctrl/c1/mon_data/mon_L3_00/mbm_local_bytes`
  echo "local b/w (bytes/s):" `expr $local_2 - $local_1`

Before fix:
  local b/w (bytes/s): 11076796416

After fix:
  local b/w (bytes/s): 5465014272

Fixes: ba0f26d8529c (x86/intel_rdt/mba_sc: Prepare for feedback loop)
Signed-off-by: Xiaochen Shen <xiaochen.shen@intel.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Reviewed-by: Tony Luck <tony.luck@intel.com>
Cc: <stable@vger.kernel.org>
Link: https://lkml.kernel.org/r/1607063279-19437-1-git-send-email-xiaochen.shen@intel.com
[sudip: manual backport to file at old path]
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kernel/cpu/intel_rdt_monitor.c |    6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

--- a/arch/x86/kernel/cpu/intel_rdt_monitor.c
+++ b/arch/x86/kernel/cpu/intel_rdt_monitor.c
@@ -290,7 +290,6 @@ static void mbm_bw_count(u32 rmid, struc
 		return;
 
 	chunks = mbm_overflow_count(m->prev_bw_msr, tval);
-	m->chunks += chunks;
 	cur_bw = (chunks * r->mon_scale) >> 20;
 
 	if (m->delta_comp)
@@ -460,15 +459,14 @@ static void mbm_update(struct rdt_domain
 	}
 	if (is_mbm_local_enabled()) {
 		rr.evtid = QOS_L3_MBM_LOCAL_EVENT_ID;
+		__mon_event_count(rmid, &rr);
 
 		/*
 		 * Call the MBA software controller only for the
 		 * control groups and when user has enabled
 		 * the software controller explicitly.
 		 */
-		if (!is_mba_sc(NULL))
-			__mon_event_count(rmid, &rr);
-		else
+		if (is_mba_sc(NULL))
 			mbm_bw_count(rmid, &rr);
 	}
 }



^ permalink raw reply	[flat|nested] 359+ messages in thread

* [PATCH 4.19 055/346] pinctrl: merrifield: Set default bias in case no particular value given
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (53 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 4.19 054/346] x86/resctrl: Fix incorrect local bandwidth when mba_sc is enabled Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 4.19 056/346] pinctrl: baytrail: Avoid clearing debounce value when turning it off Greg Kroah-Hartman
                   ` (293 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Andy Shevchenko, Mika Westerberg,
	Sasha Levin

From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>

[ Upstream commit 0fa86fc2e28227f1e64f13867e73cf864c6d25ad ]

When GPIO library asks pin control to set the bias, it doesn't pass
any value of it and argument is considered boolean (and this is true
for ACPI GpioIo() / GpioInt() resources, by the way). Thus, individual
drivers must behave well, when they got the resistance value of 1 Ohm,
i.e. transforming it to sane default.

In case of Intel Merrifield pin control hardware the 20 kOhm sounds plausible
because it gives a good trade off between weakness and minimization of leakage
current (will be only 50 uA with the above choice).

Fixes: 4e80c8f50574 ("pinctrl: intel: Add Intel Merrifield pin controller support")
Depends-on: 2956b5d94a76 ("pinctrl / gpio: Introduce .set_config() callback for GPIO chips")
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pinctrl/intel/pinctrl-merrifield.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/pinctrl/intel/pinctrl-merrifield.c b/drivers/pinctrl/intel/pinctrl-merrifield.c
index 4fa69f988c7b7..6b2312e73f23f 100644
--- a/drivers/pinctrl/intel/pinctrl-merrifield.c
+++ b/drivers/pinctrl/intel/pinctrl-merrifield.c
@@ -729,6 +729,10 @@ static int mrfld_config_set_pin(struct mrfld_pinctrl *mp, unsigned int pin,
 		mask |= BUFCFG_Px_EN_MASK | BUFCFG_PUPD_VAL_MASK;
 		bits |= BUFCFG_PU_EN;
 
+		/* Set default strength value in case none is given */
+		if (arg == 1)
+			arg = 20000;
+
 		switch (arg) {
 		case 50000:
 			bits |= BUFCFG_PUPD_VAL_50K << BUFCFG_PUPD_VAL_SHIFT;
@@ -749,6 +753,10 @@ static int mrfld_config_set_pin(struct mrfld_pinctrl *mp, unsigned int pin,
 		mask |= BUFCFG_Px_EN_MASK | BUFCFG_PUPD_VAL_MASK;
 		bits |= BUFCFG_PD_EN;
 
+		/* Set default strength value in case none is given */
+		if (arg == 1)
+			arg = 20000;
+
 		switch (arg) {
 		case 50000:
 			bits |= BUFCFG_PUPD_VAL_50K << BUFCFG_PUPD_VAL_SHIFT;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 056/346] pinctrl: baytrail: Avoid clearing debounce value when turning it off
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (54 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 4.19 055/346] pinctrl: merrifield: Set default bias in case no particular value given Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 4.19 057/346] ARM: dts: sun8i: v3s: fix GIC node memory range Greg Kroah-Hartman
                   ` (292 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Andy Shevchenko, Mika Westerberg,
	Sasha Levin

From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>

[ Upstream commit 0b74e40a4e41f3cbad76dff4c50850d47b525b26 ]

Baytrail pin control has a common register to set up debounce timeout.
When a pin configuration requested debounce to be disabled, the rest
of the pins may still want to have debounce enabled and thus rely on
the common timeout value. Avoid clearing debounce value when turning
it off for one pin while others may still use it.

Fixes: 658b476c742f ("pinctrl: baytrail: Add debounce configuration")
Depends-on: 04ff5a095d66 ("pinctrl: baytrail: Rectify debounce support")
Depends-on: 827e1579e1d5 ("pinctrl: baytrail: Rectify debounce support (part 2)")
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pinctrl/intel/pinctrl-baytrail.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/drivers/pinctrl/intel/pinctrl-baytrail.c b/drivers/pinctrl/intel/pinctrl-baytrail.c
index 1b00a3f3b419c..b3d478edbbb1c 100644
--- a/drivers/pinctrl/intel/pinctrl-baytrail.c
+++ b/drivers/pinctrl/intel/pinctrl-baytrail.c
@@ -1258,7 +1258,6 @@ static int byt_pin_config_set(struct pinctrl_dev *pctl_dev,
 			break;
 		case PIN_CONFIG_INPUT_DEBOUNCE:
 			debounce = readl(db_reg);
-			debounce &= ~BYT_DEBOUNCE_PULSE_MASK;
 
 			if (arg)
 				conf |= BYT_DEBOUNCE_EN;
@@ -1267,24 +1266,31 @@ static int byt_pin_config_set(struct pinctrl_dev *pctl_dev,
 
 			switch (arg) {
 			case 375:
+				debounce &= ~BYT_DEBOUNCE_PULSE_MASK;
 				debounce |= BYT_DEBOUNCE_PULSE_375US;
 				break;
 			case 750:
+				debounce &= ~BYT_DEBOUNCE_PULSE_MASK;
 				debounce |= BYT_DEBOUNCE_PULSE_750US;
 				break;
 			case 1500:
+				debounce &= ~BYT_DEBOUNCE_PULSE_MASK;
 				debounce |= BYT_DEBOUNCE_PULSE_1500US;
 				break;
 			case 3000:
+				debounce &= ~BYT_DEBOUNCE_PULSE_MASK;
 				debounce |= BYT_DEBOUNCE_PULSE_3MS;
 				break;
 			case 6000:
+				debounce &= ~BYT_DEBOUNCE_PULSE_MASK;
 				debounce |= BYT_DEBOUNCE_PULSE_6MS;
 				break;
 			case 12000:
+				debounce &= ~BYT_DEBOUNCE_PULSE_MASK;
 				debounce |= BYT_DEBOUNCE_PULSE_12MS;
 				break;
 			case 24000:
+				debounce &= ~BYT_DEBOUNCE_PULSE_MASK;
 				debounce |= BYT_DEBOUNCE_PULSE_24MS;
 				break;
 			default:
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 057/346] ARM: dts: sun8i: v3s: fix GIC node memory range
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (55 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 4.19 056/346] pinctrl: baytrail: Avoid clearing debounce value when turning it off Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 4.19 058/346] gpio: mvebu: fix potential user-after-free on probe Greg Kroah-Hartman
                   ` (291 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Icenowy Zheng, Maxime Ripard, Sasha Levin

From: Icenowy Zheng <icenowy@aosc.io>

[ Upstream commit a98fd117a2553ab1a6d2fe3c7acae88c1eca4372 ]

Currently the GIC node in V3s DTSI follows some old DT examples, and
being broken. This leads a warning at boot.

Fix this.

Fixes: f989086ccbc6 ("ARM: dts: sunxi: add dtsi file for V3s SoC")
Signed-off-by: Icenowy Zheng <icenowy@aosc.io>
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
Link: https://lore.kernel.org/r/20201120050851.4123759-1-icenowy@aosc.io
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/sun8i-v3s.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/sun8i-v3s.dtsi b/arch/arm/boot/dts/sun8i-v3s.dtsi
index 92fcb756a08a9..97cac6d636923 100644
--- a/arch/arm/boot/dts/sun8i-v3s.dtsi
+++ b/arch/arm/boot/dts/sun8i-v3s.dtsi
@@ -419,7 +419,7 @@
 		gic: interrupt-controller@1c81000 {
 			compatible = "arm,cortex-a7-gic", "arm,cortex-a15-gic";
 			reg = <0x01c81000 0x1000>,
-			      <0x01c82000 0x1000>,
+			      <0x01c82000 0x2000>,
 			      <0x01c84000 0x2000>,
 			      <0x01c86000 0x2000>;
 			interrupt-controller;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 058/346] gpio: mvebu: fix potential user-after-free on probe
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (56 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 4.19 057/346] ARM: dts: sun8i: v3s: fix GIC node memory range Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 4.19 059/346] scsi: bnx2i: Requires MMU Greg Kroah-Hartman
                   ` (290 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Andrew Lunn, Baruch Siach,
	Bartosz Golaszewski, Sasha Levin

From: Baruch Siach <baruch@tkos.co.il>

[ Upstream commit 7ee1a01e47403f72b9f38839a737692f6991263e ]

When mvebu_pwm_probe() fails IRQ domain is not released. Move pwm probe
before IRQ domain allocation. Add pwm cleanup code to the failure path.

Fixes: 757642f9a584 ("gpio: mvebu: Add limited PWM support")
Reported-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpio/gpio-mvebu.c | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/drivers/gpio/gpio-mvebu.c b/drivers/gpio/gpio-mvebu.c
index adc768f908f1a..3b78dcda47364 100644
--- a/drivers/gpio/gpio-mvebu.c
+++ b/drivers/gpio/gpio-mvebu.c
@@ -1191,6 +1191,13 @@ static int mvebu_gpio_probe(struct platform_device *pdev)
 
 	devm_gpiochip_add_data(&pdev->dev, &mvchip->chip, mvchip);
 
+	/* Some MVEBU SoCs have simple PWM support for GPIO lines */
+	if (IS_ENABLED(CONFIG_PWM)) {
+		err = mvebu_pwm_probe(pdev, mvchip, id);
+		if (err)
+			return err;
+	}
+
 	/* Some gpio controllers do not provide irq support */
 	if (!have_irqs)
 		return 0;
@@ -1200,7 +1207,8 @@ static int mvebu_gpio_probe(struct platform_device *pdev)
 	if (!mvchip->domain) {
 		dev_err(&pdev->dev, "couldn't allocate irq domain %s (DT).\n",
 			mvchip->chip.label);
-		return -ENODEV;
+		err = -ENODEV;
+		goto err_pwm;
 	}
 
 	err = irq_alloc_domain_generic_chips(
@@ -1248,14 +1256,12 @@ static int mvebu_gpio_probe(struct platform_device *pdev)
 						 mvchip);
 	}
 
-	/* Some MVEBU SoCs have simple PWM support for GPIO lines */
-	if (IS_ENABLED(CONFIG_PWM))
-		return mvebu_pwm_probe(pdev, mvchip, id);
-
 	return 0;
 
 err_domain:
 	irq_domain_remove(mvchip->domain);
+err_pwm:
+	pwmchip_remove(&mvchip->mvpwm->chip);
 
 	return err;
 }
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 059/346] scsi: bnx2i: Requires MMU
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (57 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 4.19 058/346] gpio: mvebu: fix potential user-after-free on probe Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 4.19 060/346] xsk: Fix xsk_poll()s return type Greg Kroah-Hartman
                   ` (289 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, linux-scsi, Nilesh Javali,
	Manish Rangankar, GR-QLogic-Storage-Upstream,
	James E.J. Bottomley, Martin K. Petersen, Randy Dunlap,
	Sasha Levin

From: Randy Dunlap <rdunlap@infradead.org>

[ Upstream commit 2d586494c4a001312650f0b919d534e429dd1e09 ]

The SCSI_BNX2_ISCSI kconfig symbol selects CNIC and CNIC selects UIO, which
depends on MMU.

Since 'select' does not follow dependency chains, add the same MMU
dependency to SCSI_BNX2_ISCSI.

Quietens this kconfig warning:

WARNING: unmet direct dependencies detected for CNIC
  Depends on [n]: NETDEVICES [=y] && ETHERNET [=y] && NET_VENDOR_BROADCOM [=y] && PCI [=y] && (IPV6 [=m] || IPV6 [=m]=n) && MMU [=n]
  Selected by [m]:
  - SCSI_BNX2_ISCSI [=m] && SCSI_LOWLEVEL [=y] && SCSI [=y] && NET [=y] && PCI [=y] && (IPV6 [=m] || IPV6 [=m]=n)

Link: https://lore.kernel.org/r/20201129070916.3919-1-rdunlap@infradead.org
Fixes: cf4e6363859d ("[SCSI] bnx2i: Add bnx2i iSCSI driver.")
Cc: linux-scsi@vger.kernel.org
Cc: Nilesh Javali <njavali@marvell.com>
Cc: Manish Rangankar <mrangankar@marvell.com>
Cc: GR-QLogic-Storage-Upstream@marvell.com
Cc: "James E.J. Bottomley" <jejb@linux.ibm.com>
Cc: "Martin K. Petersen" <martin.petersen@oracle.com>
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/bnx2i/Kconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/scsi/bnx2i/Kconfig b/drivers/scsi/bnx2i/Kconfig
index ba30ff86d5818..b27a3738d940c 100644
--- a/drivers/scsi/bnx2i/Kconfig
+++ b/drivers/scsi/bnx2i/Kconfig
@@ -3,6 +3,7 @@ config SCSI_BNX2_ISCSI
 	depends on NET
 	depends on PCI
 	depends on (IPV6 || IPV6=n)
+	depends on MMU
 	select SCSI_ISCSI_ATTRS
 	select NETDEVICES
 	select ETHERNET
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 060/346] xsk: Fix xsk_poll()s return type
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (58 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 4.19 059/346] scsi: bnx2i: Requires MMU Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 4.19 061/346] can: softing: softing_netdev_open(): fix error handling Greg Kroah-Hartman
                   ` (288 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Luc Van Oostenryck, Daniel Borkmann,
	Björn Töpel, Sasha Levin

From: Luc Van Oostenryck <luc.vanoostenryck@gmail.com>

[ Upstream commit 5d946c5abbaf68083fa6a41824dd79e1f06286d8 ]

xsk_poll() is defined as returning 'unsigned int' but the
.poll method is declared as returning '__poll_t', a bitwise type.

Fix this by using the proper return type and using the EPOLL
constants instead of the POLL ones, as required for __poll_t.

Signed-off-by: Luc Van Oostenryck <luc.vanoostenryck@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Björn Töpel <bjorn.topel@intel.com>
Link: https://lore.kernel.org/bpf/20191120001042.30830-1-luc.vanoostenryck@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/xdp/xsk.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c
index 9ff2ab63e6392..6bb0649c028c4 100644
--- a/net/xdp/xsk.c
+++ b/net/xdp/xsk.c
@@ -289,17 +289,17 @@ static int xsk_sendmsg(struct socket *sock, struct msghdr *m, size_t total_len)
 	return (xs->zc) ? xsk_zc_xmit(sk) : xsk_generic_xmit(sk, m, total_len);
 }
 
-static unsigned int xsk_poll(struct file *file, struct socket *sock,
+static __poll_t xsk_poll(struct file *file, struct socket *sock,
 			     struct poll_table_struct *wait)
 {
-	unsigned int mask = datagram_poll(file, sock, wait);
+	__poll_t mask = datagram_poll(file, sock, wait);
 	struct sock *sk = sock->sk;
 	struct xdp_sock *xs = xdp_sk(sk);
 
 	if (xs->rx && !xskq_empty_desc(xs->rx))
-		mask |= POLLIN | POLLRDNORM;
+		mask |= EPOLLIN | EPOLLRDNORM;
 	if (xs->tx && !xskq_full_desc(xs->tx))
-		mask |= POLLOUT | POLLWRNORM;
+		mask |= EPOLLOUT | EPOLLWRNORM;
 
 	return mask;
 }
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 061/346] can: softing: softing_netdev_open(): fix error handling
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (59 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 4.19 060/346] xsk: Fix xsk_poll()s return type Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 4.19 062/346] clk: renesas: r9a06g032: Drop __packed for portability Greg Kroah-Hartman
                   ` (287 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Zhang Qilong, Kurt Van Dijck,
	Marc Kleine-Budde, Jakub Kicinski, Sasha Levin

From: Zhang Qilong <zhangqilong3@huawei.com>

[ Upstream commit 4d1be581ec6b92a338bb7ed23e1381f45ddf336f ]

If softing_netdev_open() fails, we should call close_candev() to avoid
reference leak.

Fixes: 03fd3cf5a179d ("can: add driver for Softing card")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Acked-by: Kurt Van Dijck <dev.kurt@vandijck-laurijssen.be>
Link: https://lore.kernel.org/r/20201202151632.1343786-1-zhangqilong3@huawei.com
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Link: https://lore.kernel.org/r/20201204133508.742120-2-mkl@pengutronix.de
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/can/softing/softing_main.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/drivers/net/can/softing/softing_main.c b/drivers/net/can/softing/softing_main.c
index e226961905830..bed5ffa75b276 100644
--- a/drivers/net/can/softing/softing_main.c
+++ b/drivers/net/can/softing/softing_main.c
@@ -393,8 +393,13 @@ static int softing_netdev_open(struct net_device *ndev)
 
 	/* check or determine and set bittime */
 	ret = open_candev(ndev);
-	if (!ret)
-		ret = softing_startstop(ndev, 1);
+	if (ret)
+		return ret;
+
+	ret = softing_startstop(ndev, 1);
+	if (ret < 0)
+		close_candev(ndev);
+
 	return ret;
 }
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 062/346] clk: renesas: r9a06g032: Drop __packed for portability
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (60 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 4.19 061/346] can: softing: softing_netdev_open(): fix error handling Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 4.19 063/346] block: factor out requeue handling from dispatch code Greg Kroah-Hartman
                   ` (286 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Stephen Rothwell, Geert Uytterhoeven,
	Stephen Boyd, Sasha Levin

From: Geert Uytterhoeven <geert+renesas@glider.be>

[ Upstream commit ceabbf94c317c6175dee6e91805fca4a6353745a ]

The R9A06G032 clock driver uses an array of packed structures to reduce
kernel size.  However, this array contains pointers, which are no longer
aligned naturally, and cannot be relocated on PPC64.  Hence when
compile-testing this driver on PPC64 with CONFIG_RELOCATABLE=y (e.g.
PowerPC allyesconfig), the following warnings are produced:

    WARNING: 136 bad relocations
    c000000000616be3 R_PPC64_UADDR64   .rodata+0x00000000000cf338
    c000000000616bfe R_PPC64_UADDR64   .rodata+0x00000000000cf370
    ...

Fix this by dropping the __packed attribute from the r9a06g032_clkdesc
definition, trading a small size increase for portability.

This increases the 156-entry clock table by 1 byte per entry, but due to
the compiler generating more efficient code for unpacked accesses, the
net size increase is only 76 bytes (gcc 9.3.0 on arm32).

Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
Fixes: 4c3d88526eba2143 ("clk: renesas: Renesas R9A06G032 clock driver")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://lore.kernel.org/r/20201130085743.1656317-1-geert+renesas@glider.be
Tested-by: Stephen Rothwell <sfr@canb.auug.org.au> # PowerPC allyesconfig build
Acked-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/renesas/r9a06g032-clocks.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/clk/renesas/r9a06g032-clocks.c b/drivers/clk/renesas/r9a06g032-clocks.c
index 6d2b568915597..6e03b467395b2 100644
--- a/drivers/clk/renesas/r9a06g032-clocks.c
+++ b/drivers/clk/renesas/r9a06g032-clocks.c
@@ -51,7 +51,7 @@ struct r9a06g032_clkdesc {
 			u16 sel, g1, r1, g2, r2;
 		} dual;
 	};
-} __packed;
+};
 
 #define I_GATE(_clk, _rst, _rdy, _midle, _scon, _mirack, _mistat) \
 	{ .gate = _clk, .reset = _rst, \
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 063/346] block: factor out requeue handling from dispatch code
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (61 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 4.19 062/346] clk: renesas: r9a06g032: Drop __packed for portability Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 4.19 064/346] netfilter: x_tables: Switch synchronization to RCU Greg Kroah-Hartman
                   ` (285 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Johannes Thumshirn,
	Christoph Hellwig, Jens Axboe, Sasha Levin

From: Johannes Thumshirn <johannes.thumshirn@wdc.com>

[ Upstream commit c92a41031a6d57395889b5c87cea359220a24d2a ]

Factor out the requeue handling from the dispatch code, this will make
subsequent addition of different requeueing schemes easier.

Signed-off-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 block/blk-mq.c | 29 ++++++++++++++++++-----------
 1 file changed, 18 insertions(+), 11 deletions(-)

diff --git a/block/blk-mq.c b/block/blk-mq.c
index db2db0b70d34f..0df43515ff949 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -1118,6 +1118,23 @@ static void blk_mq_update_dispatch_busy(struct blk_mq_hw_ctx *hctx, bool busy)
 
 #define BLK_MQ_RESOURCE_DELAY	3		/* ms units */
 
+static void blk_mq_handle_dev_resource(struct request *rq,
+				       struct list_head *list)
+{
+	struct request *next =
+		list_first_entry_or_null(list, struct request, queuelist);
+
+	/*
+	 * If an I/O scheduler has been configured and we got a driver tag for
+	 * the next request already, free it.
+	 */
+	if (next)
+		blk_mq_put_driver_tag(next);
+
+	list_add(&rq->queuelist, list);
+	__blk_mq_requeue_request(rq);
+}
+
 /*
  * Returns true if we did some work AND can potentially do more.
  */
@@ -1185,17 +1202,7 @@ bool blk_mq_dispatch_rq_list(struct request_queue *q, struct list_head *list,
 
 		ret = q->mq_ops->queue_rq(hctx, &bd);
 		if (ret == BLK_STS_RESOURCE || ret == BLK_STS_DEV_RESOURCE) {
-			/*
-			 * If an I/O scheduler has been configured and we got a
-			 * driver tag for the next request already, free it
-			 * again.
-			 */
-			if (!list_empty(list)) {
-				nxt = list_first_entry(list, struct request, queuelist);
-				blk_mq_put_driver_tag(nxt);
-			}
-			list_add(&rq->queuelist, list);
-			__blk_mq_requeue_request(rq);
+			blk_mq_handle_dev_resource(rq, list);
 			break;
 		}
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 064/346] netfilter: x_tables: Switch synchronization to RCU
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (62 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 4.19 063/346] block: factor out requeue handling from dispatch code Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 4.19 065/346] gpio: eic-sprd: break loop when getting NULL device resource Greg Kroah-Hartman
                   ` (284 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sean Tranchetti, kernel test robot,
	Florian Westphal, Subash Abhinov Kasiviswanathan,
	Pablo Neira Ayuso, Sasha Levin

From: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>

[ Upstream commit cc00bcaa589914096edef7fb87ca5cee4a166b5c ]

When running concurrent iptables rules replacement with data, the per CPU
sequence count is checked after the assignment of the new information.
The sequence count is used to synchronize with the packet path without the
use of any explicit locking. If there are any packets in the packet path using
the table information, the sequence count is incremented to an odd value and
is incremented to an even after the packet process completion.

The new table value assignment is followed by a write memory barrier so every
CPU should see the latest value. If the packet path has started with the old
table information, the sequence counter will be odd and the iptables
replacement will wait till the sequence count is even prior to freeing the
old table info.

However, this assumes that the new table information assignment and the memory
barrier is actually executed prior to the counter check in the replacement
thread. If CPU decides to execute the assignment later as there is no user of
the table information prior to the sequence check, the packet path in another
CPU may use the old table information. The replacement thread would then free
the table information under it leading to a use after free in the packet
processing context-

Unable to handle kernel NULL pointer dereference at virtual
address 000000000000008e
pc : ip6t_do_table+0x5d0/0x89c
lr : ip6t_do_table+0x5b8/0x89c
ip6t_do_table+0x5d0/0x89c
ip6table_filter_hook+0x24/0x30
nf_hook_slow+0x84/0x120
ip6_input+0x74/0xe0
ip6_rcv_finish+0x7c/0x128
ipv6_rcv+0xac/0xe4
__netif_receive_skb+0x84/0x17c
process_backlog+0x15c/0x1b8
napi_poll+0x88/0x284
net_rx_action+0xbc/0x23c
__do_softirq+0x20c/0x48c

This could be fixed by forcing instruction order after the new table
information assignment or by switching to RCU for the synchronization.

Fixes: 80055dab5de0 ("netfilter: x_tables: make xt_replace_table wait until old rules are not used anymore")
Reported-by: Sean Tranchetti <stranche@codeaurora.org>
Reported-by: kernel test robot <lkp@intel.com>
Suggested-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/netfilter/x_tables.h |  5 ++-
 net/ipv4/netfilter/arp_tables.c    | 14 ++++-----
 net/ipv4/netfilter/ip_tables.c     | 14 ++++-----
 net/ipv6/netfilter/ip6_tables.c    | 14 ++++-----
 net/netfilter/x_tables.c           | 49 +++++++++---------------------
 5 files changed, 40 insertions(+), 56 deletions(-)

diff --git a/include/linux/netfilter/x_tables.h b/include/linux/netfilter/x_tables.h
index 9077b3ebea08c..728d7716bf4f4 100644
--- a/include/linux/netfilter/x_tables.h
+++ b/include/linux/netfilter/x_tables.h
@@ -227,7 +227,7 @@ struct xt_table {
 	unsigned int valid_hooks;
 
 	/* Man behind the curtain... */
-	struct xt_table_info *private;
+	struct xt_table_info __rcu *private;
 
 	/* Set this to THIS_MODULE if you are a module, otherwise NULL */
 	struct module *me;
@@ -449,6 +449,9 @@ xt_get_per_cpu_counter(struct xt_counters *cnt, unsigned int cpu)
 
 struct nf_hook_ops *xt_hook_ops_alloc(const struct xt_table *, nf_hookfn *);
 
+struct xt_table_info
+*xt_table_get_private_protected(const struct xt_table *table);
+
 #ifdef CONFIG_COMPAT
 #include <net/compat.h>
 
diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index 10d8f95eb7712..ca20efe775ee4 100644
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -202,7 +202,7 @@ unsigned int arpt_do_table(struct sk_buff *skb,
 
 	local_bh_disable();
 	addend = xt_write_recseq_begin();
-	private = READ_ONCE(table->private); /* Address dependency. */
+	private = rcu_access_pointer(table->private);
 	cpu     = smp_processor_id();
 	table_base = private->entries;
 	jumpstack  = (struct arpt_entry **)private->jumpstack[cpu];
@@ -648,7 +648,7 @@ static struct xt_counters *alloc_counters(const struct xt_table *table)
 {
 	unsigned int countersize;
 	struct xt_counters *counters;
-	const struct xt_table_info *private = table->private;
+	const struct xt_table_info *private = xt_table_get_private_protected(table);
 
 	/* We need atomic snapshot of counters: rest doesn't change
 	 * (other than comefrom, which userspace doesn't care
@@ -672,7 +672,7 @@ static int copy_entries_to_user(unsigned int total_size,
 	unsigned int off, num;
 	const struct arpt_entry *e;
 	struct xt_counters *counters;
-	struct xt_table_info *private = table->private;
+	struct xt_table_info *private = xt_table_get_private_protected(table);
 	int ret = 0;
 	void *loc_cpu_entry;
 
@@ -807,7 +807,7 @@ static int get_info(struct net *net, void __user *user,
 	t = xt_request_find_table_lock(net, NFPROTO_ARP, name);
 	if (!IS_ERR(t)) {
 		struct arpt_getinfo info;
-		const struct xt_table_info *private = t->private;
+		const struct xt_table_info *private = xt_table_get_private_protected(t);
 #ifdef CONFIG_COMPAT
 		struct xt_table_info tmp;
 
@@ -860,7 +860,7 @@ static int get_entries(struct net *net, struct arpt_get_entries __user *uptr,
 
 	t = xt_find_table_lock(net, NFPROTO_ARP, get.name);
 	if (!IS_ERR(t)) {
-		const struct xt_table_info *private = t->private;
+		const struct xt_table_info *private = xt_table_get_private_protected(t);
 
 		if (get.size == private->size)
 			ret = copy_entries_to_user(private->size,
@@ -1019,7 +1019,7 @@ static int do_add_counters(struct net *net, const void __user *user,
 	}
 
 	local_bh_disable();
-	private = t->private;
+	private = xt_table_get_private_protected(t);
 	if (private->number != tmp.num_counters) {
 		ret = -EINVAL;
 		goto unlock_up_free;
@@ -1356,7 +1356,7 @@ static int compat_copy_entries_to_user(unsigned int total_size,
 				       void __user *userptr)
 {
 	struct xt_counters *counters;
-	const struct xt_table_info *private = table->private;
+	const struct xt_table_info *private = xt_table_get_private_protected(table);
 	void __user *pos;
 	unsigned int size;
 	int ret = 0;
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index e77872c93c206..115d48049686f 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -261,7 +261,7 @@ ipt_do_table(struct sk_buff *skb,
 	WARN_ON(!(table->valid_hooks & (1 << hook)));
 	local_bh_disable();
 	addend = xt_write_recseq_begin();
-	private = READ_ONCE(table->private); /* Address dependency. */
+	private = rcu_access_pointer(table->private);
 	cpu        = smp_processor_id();
 	table_base = private->entries;
 	jumpstack  = (struct ipt_entry **)private->jumpstack[cpu];
@@ -794,7 +794,7 @@ static struct xt_counters *alloc_counters(const struct xt_table *table)
 {
 	unsigned int countersize;
 	struct xt_counters *counters;
-	const struct xt_table_info *private = table->private;
+	const struct xt_table_info *private = xt_table_get_private_protected(table);
 
 	/* We need atomic snapshot of counters: rest doesn't change
 	   (other than comefrom, which userspace doesn't care
@@ -818,7 +818,7 @@ copy_entries_to_user(unsigned int total_size,
 	unsigned int off, num;
 	const struct ipt_entry *e;
 	struct xt_counters *counters;
-	const struct xt_table_info *private = table->private;
+	const struct xt_table_info *private = xt_table_get_private_protected(table);
 	int ret = 0;
 	const void *loc_cpu_entry;
 
@@ -968,7 +968,7 @@ static int get_info(struct net *net, void __user *user,
 	t = xt_request_find_table_lock(net, AF_INET, name);
 	if (!IS_ERR(t)) {
 		struct ipt_getinfo info;
-		const struct xt_table_info *private = t->private;
+		const struct xt_table_info *private = xt_table_get_private_protected(t);
 #ifdef CONFIG_COMPAT
 		struct xt_table_info tmp;
 
@@ -1022,7 +1022,7 @@ get_entries(struct net *net, struct ipt_get_entries __user *uptr,
 
 	t = xt_find_table_lock(net, AF_INET, get.name);
 	if (!IS_ERR(t)) {
-		const struct xt_table_info *private = t->private;
+		const struct xt_table_info *private = xt_table_get_private_protected(t);
 		if (get.size == private->size)
 			ret = copy_entries_to_user(private->size,
 						   t, uptr->entrytable);
@@ -1178,7 +1178,7 @@ do_add_counters(struct net *net, const void __user *user,
 	}
 
 	local_bh_disable();
-	private = t->private;
+	private = xt_table_get_private_protected(t);
 	if (private->number != tmp.num_counters) {
 		ret = -EINVAL;
 		goto unlock_up_free;
@@ -1573,7 +1573,7 @@ compat_copy_entries_to_user(unsigned int total_size, struct xt_table *table,
 			    void __user *userptr)
 {
 	struct xt_counters *counters;
-	const struct xt_table_info *private = table->private;
+	const struct xt_table_info *private = xt_table_get_private_protected(table);
 	void __user *pos;
 	unsigned int size;
 	int ret = 0;
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index daf2e9e9193d1..b1441349e1517 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -283,7 +283,7 @@ ip6t_do_table(struct sk_buff *skb,
 
 	local_bh_disable();
 	addend = xt_write_recseq_begin();
-	private = READ_ONCE(table->private); /* Address dependency. */
+	private = rcu_access_pointer(table->private);
 	cpu        = smp_processor_id();
 	table_base = private->entries;
 	jumpstack  = (struct ip6t_entry **)private->jumpstack[cpu];
@@ -810,7 +810,7 @@ static struct xt_counters *alloc_counters(const struct xt_table *table)
 {
 	unsigned int countersize;
 	struct xt_counters *counters;
-	const struct xt_table_info *private = table->private;
+	const struct xt_table_info *private = xt_table_get_private_protected(table);
 
 	/* We need atomic snapshot of counters: rest doesn't change
 	   (other than comefrom, which userspace doesn't care
@@ -834,7 +834,7 @@ copy_entries_to_user(unsigned int total_size,
 	unsigned int off, num;
 	const struct ip6t_entry *e;
 	struct xt_counters *counters;
-	const struct xt_table_info *private = table->private;
+	const struct xt_table_info *private = xt_table_get_private_protected(table);
 	int ret = 0;
 	const void *loc_cpu_entry;
 
@@ -984,7 +984,7 @@ static int get_info(struct net *net, void __user *user,
 	t = xt_request_find_table_lock(net, AF_INET6, name);
 	if (!IS_ERR(t)) {
 		struct ip6t_getinfo info;
-		const struct xt_table_info *private = t->private;
+		const struct xt_table_info *private = xt_table_get_private_protected(t);
 #ifdef CONFIG_COMPAT
 		struct xt_table_info tmp;
 
@@ -1039,7 +1039,7 @@ get_entries(struct net *net, struct ip6t_get_entries __user *uptr,
 
 	t = xt_find_table_lock(net, AF_INET6, get.name);
 	if (!IS_ERR(t)) {
-		struct xt_table_info *private = t->private;
+		struct xt_table_info *private = xt_table_get_private_protected(t);
 		if (get.size == private->size)
 			ret = copy_entries_to_user(private->size,
 						   t, uptr->entrytable);
@@ -1194,7 +1194,7 @@ do_add_counters(struct net *net, const void __user *user, unsigned int len,
 	}
 
 	local_bh_disable();
-	private = t->private;
+	private = xt_table_get_private_protected(t);
 	if (private->number != tmp.num_counters) {
 		ret = -EINVAL;
 		goto unlock_up_free;
@@ -1582,7 +1582,7 @@ compat_copy_entries_to_user(unsigned int total_size, struct xt_table *table,
 			    void __user *userptr)
 {
 	struct xt_counters *counters;
-	const struct xt_table_info *private = table->private;
+	const struct xt_table_info *private = xt_table_get_private_protected(table);
 	void __user *pos;
 	unsigned int size;
 	int ret = 0;
diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
index 3bab89dbc3717..6a7d0303d058f 100644
--- a/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@ -1354,6 +1354,14 @@ struct xt_counters *xt_counters_alloc(unsigned int counters)
 }
 EXPORT_SYMBOL(xt_counters_alloc);
 
+struct xt_table_info
+*xt_table_get_private_protected(const struct xt_table *table)
+{
+	return rcu_dereference_protected(table->private,
+					 mutex_is_locked(&xt[table->af].mutex));
+}
+EXPORT_SYMBOL(xt_table_get_private_protected);
+
 struct xt_table_info *
 xt_replace_table(struct xt_table *table,
 	      unsigned int num_counters,
@@ -1361,7 +1369,6 @@ xt_replace_table(struct xt_table *table,
 	      int *error)
 {
 	struct xt_table_info *private;
-	unsigned int cpu;
 	int ret;
 
 	ret = xt_jumpstack_alloc(newinfo);
@@ -1371,47 +1378,20 @@ xt_replace_table(struct xt_table *table,
 	}
 
 	/* Do the substitution. */
-	local_bh_disable();
-	private = table->private;
+	private = xt_table_get_private_protected(table);
 
 	/* Check inside lock: is the old number correct? */
 	if (num_counters != private->number) {
 		pr_debug("num_counters != table->private->number (%u/%u)\n",
 			 num_counters, private->number);
-		local_bh_enable();
 		*error = -EAGAIN;
 		return NULL;
 	}
 
 	newinfo->initial_entries = private->initial_entries;
-	/*
-	 * Ensure contents of newinfo are visible before assigning to
-	 * private.
-	 */
-	smp_wmb();
-	table->private = newinfo;
-
-	/* make sure all cpus see new ->private value */
-	smp_wmb();
 
-	/*
-	 * Even though table entries have now been swapped, other CPU's
-	 * may still be using the old entries...
-	 */
-	local_bh_enable();
-
-	/* ... so wait for even xt_recseq on all cpus */
-	for_each_possible_cpu(cpu) {
-		seqcount_t *s = &per_cpu(xt_recseq, cpu);
-		u32 seq = raw_read_seqcount(s);
-
-		if (seq & 1) {
-			do {
-				cond_resched();
-				cpu_relax();
-			} while (seq == raw_read_seqcount(s));
-		}
-	}
+	rcu_assign_pointer(table->private, newinfo);
+	synchronize_rcu();
 
 #ifdef CONFIG_AUDIT
 	if (audit_enabled) {
@@ -1452,12 +1432,12 @@ struct xt_table *xt_register_table(struct net *net,
 	}
 
 	/* Simplifies replace_table code. */
-	table->private = bootstrap;
+	rcu_assign_pointer(table->private, bootstrap);
 
 	if (!xt_replace_table(table, 0, newinfo, &ret))
 		goto unlock;
 
-	private = table->private;
+	private = xt_table_get_private_protected(table);
 	pr_debug("table->private->number = %u\n", private->number);
 
 	/* save number of initial entries */
@@ -1480,7 +1460,8 @@ void *xt_unregister_table(struct xt_table *table)
 	struct xt_table_info *private;
 
 	mutex_lock(&xt[table->af].mutex);
-	private = table->private;
+	private = xt_table_get_private_protected(table);
+	RCU_INIT_POINTER(table->private, NULL);
 	list_del(&table->list);
 	mutex_unlock(&xt[table->af].mutex);
 	kfree(table);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 065/346] gpio: eic-sprd: break loop when getting NULL device resource
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (63 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 4.19 064/346] netfilter: x_tables: Switch synchronization to RCU Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 4.19 066/346] selftests/bpf/test_offload.py: Reset ethtool features after failed setting Greg Kroah-Hartman
                   ` (283 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chunyan Zhang, Linus Walleij, Sasha Levin

From: Chunyan Zhang <chunyan.zhang@unisoc.com>

[ Upstream commit 263ade7166a2e589c5b605272690c155c0637dcb ]

EIC controller have unfixed numbers of banks on different Spreadtrum SoCs,
and each bank has its own base address, the loop of getting there base
address in driver should break if the resource gotten via
platform_get_resource() is NULL already. The later ones would be all NULL
even if the loop continues.

Fixes: 25518e024e3a ("gpio: Add Spreadtrum EIC driver support")
Signed-off-by: Chunyan Zhang <chunyan.zhang@unisoc.com>
Link: https://lore.kernel.org/r/20201209055106.840100-1-zhang.lyra@gmail.com
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpio/gpio-eic-sprd.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpio/gpio-eic-sprd.c b/drivers/gpio/gpio-eic-sprd.c
index 4935cda5301ea..4f1af323ec03b 100644
--- a/drivers/gpio/gpio-eic-sprd.c
+++ b/drivers/gpio/gpio-eic-sprd.c
@@ -599,7 +599,7 @@ static int sprd_eic_probe(struct platform_device *pdev)
 		 */
 		res = platform_get_resource(pdev, IORESOURCE_MEM, i);
 		if (!res)
-			continue;
+			break;
 
 		sprd_eic->base[i] = devm_ioremap_resource(&pdev->dev, res);
 		if (IS_ERR(sprd_eic->base[i]))
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 066/346] selftests/bpf/test_offload.py: Reset ethtool features after failed setting
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (64 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 4.19 065/346] gpio: eic-sprd: break loop when getting NULL device resource Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 4.19 067/346] RDMA/cm: Fix an attempt to use non-valid pointer when cleaning timewait Greg Kroah-Hartman
                   ` (282 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Toke Høiland-Jørgensen,
	Daniel Borkmann, Jakub Kicinski, Sasha Levin

From: Toke Høiland-Jørgensen <toke@redhat.com>

[ Upstream commit 766e62b7fcd2cf1d43e6594ba37c659dc48f7ddb ]

When setting the ethtool feature flag fails (as expected for the test), the
kernel now tracks that the feature was requested to be 'off' and refuses to
subsequently disable it again. So reset it back to 'on' so a subsequent
disable (that's not supposed to fail) can succeed.

Fixes: 417ec26477a5 ("selftests/bpf: add offload test based on netdevsim")
Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Jakub Kicinski <kuba@kernel.org>
Link: https://lore.kernel.org/bpf/160752226280.110217.10696241563705667871.stgit@toke.dk
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/testing/selftests/bpf/test_offload.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tools/testing/selftests/bpf/test_offload.py b/tools/testing/selftests/bpf/test_offload.py
index d59642e70f562..2229e55216a97 100755
--- a/tools/testing/selftests/bpf/test_offload.py
+++ b/tools/testing/selftests/bpf/test_offload.py
@@ -787,6 +787,7 @@ try:
     start_test("Test disabling TC offloads is rejected while filters installed...")
     ret, _ = sim.set_ethtool_tc_offloads(False, fail=False)
     fail(ret == 0, "Driver should refuse to disable TC offloads with filters installed...")
+    sim.set_ethtool_tc_offloads(True)
 
     start_test("Test qdisc removal frees things...")
     sim.tc_flush_filters()
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 067/346] RDMA/cm: Fix an attempt to use non-valid pointer when cleaning timewait
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (65 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 4.19 066/346] selftests/bpf/test_offload.py: Reset ethtool features after failed setting Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 4.19 068/346] ixgbe: avoid premature Rx buffer reuse Greg Kroah-Hartman
                   ` (281 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Maor Gottlieb, Amit Matityahu,
	Leon Romanovsky, Jason Gunthorpe, Sasha Levin

From: Leon Romanovsky <leonro@nvidia.com>

[ Upstream commit 340b940ea0ed12d9adbb8f72dea17d516b2019e8 ]

If cm_create_timewait_info() fails, the timewait_info pointer will contain
an error value and will be used in cm_remove_remote() later.

  general protection fault, probably for non-canonical address 0xdffffc0000000024: 0000 [#1] SMP KASAN PTI
  KASAN: null-ptr-deref in range [0×0000000000000120-0×0000000000000127]
  CPU: 2 PID: 12446 Comm: syz-executor.3 Not tainted 5.10.0-rc5-5d4c0742a60e #27
  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
  RIP: 0010:cm_remove_remote.isra.0+0x24/0×170 drivers/infiniband/core/cm.c:978
  Code: 84 00 00 00 00 00 41 54 55 53 48 89 fb 48 8d ab 2d 01 00 00 e8 7d bf 4b fe 48 89 ea 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <0f> b6 04 02 48 89 ea 83 e2 07 38 d0 7f 08 84 c0 0f 85 fc 00 00 00
  RSP: 0018:ffff888013127918 EFLAGS: 00010006
  RAX: dffffc0000000000 RBX: fffffffffffffff4 RCX: ffffc9000a18b000
  RDX: 0000000000000024 RSI: ffffffff82edc573 RDI: fffffffffffffff4
  RBP: 0000000000000121 R08: 0000000000000001 R09: ffffed1002624f1d
  R10: 0000000000000003 R11: ffffed1002624f1c R12: ffff888107760c70
  R13: ffff888107760c40 R14: fffffffffffffff4 R15: ffff888107760c9c
  FS:  00007fe1ffcc1700(0000) GS:ffff88811a600000(0000) knlGS:0000000000000000
  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  CR2: 0000001b2ff21000 CR3: 000000010f504001 CR4: 0000000000370ee0
  DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
  DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
  Call Trace:
   cm_destroy_id+0x189/0×15b0 drivers/infiniband/core/cm.c:1155
   cma_connect_ib drivers/infiniband/core/cma.c:4029 [inline]
   rdma_connect_locked+0x1100/0×17c0 drivers/infiniband/core/cma.c:4107
   rdma_connect+0x2a/0×40 drivers/infiniband/core/cma.c:4140
   ucma_connect+0x277/0×340 drivers/infiniband/core/ucma.c:1069
   ucma_write+0x236/0×2f0 drivers/infiniband/core/ucma.c:1724
   vfs_write+0x220/0×830 fs/read_write.c:603
   ksys_write+0x1df/0×240 fs/read_write.c:658
   do_syscall_64+0x33/0×40 arch/x86/entry/common.c:46
   entry_SYSCALL_64_after_hwframe+0x44/0xa9

Fixes: a977049dacde ("[PATCH] IB: Add the kernel CM implementation")
Link: https://lore.kernel.org/r/20201204064205.145795-1-leon@kernel.org
Reviewed-by: Maor Gottlieb <maorg@nvidia.com>
Reported-by: Amit Matityahu <mitm@nvidia.com>
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/core/cm.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c
index 4ebf63360a697..9bdb3fd97d264 100644
--- a/drivers/infiniband/core/cm.c
+++ b/drivers/infiniband/core/cm.c
@@ -1443,6 +1443,7 @@ int ib_send_cm_req(struct ib_cm_id *cm_id,
 							    id.local_id);
 	if (IS_ERR(cm_id_priv->timewait_info)) {
 		ret = PTR_ERR(cm_id_priv->timewait_info);
+		cm_id_priv->timewait_info = NULL;
 		goto out;
 	}
 
@@ -1969,6 +1970,7 @@ static int cm_req_handler(struct cm_work *work)
 							    id.local_id);
 	if (IS_ERR(cm_id_priv->timewait_info)) {
 		ret = PTR_ERR(cm_id_priv->timewait_info);
+		cm_id_priv->timewait_info = NULL;
 		goto destroy;
 	}
 	cm_id_priv->timewait_info->work.remote_id = req_msg->local_comm_id;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 068/346] ixgbe: avoid premature Rx buffer reuse
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (66 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 4.19 067/346] RDMA/cm: Fix an attempt to use non-valid pointer when cleaning timewait Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 4.19 069/346] drm/tegra: replace idr_init() by idr_init_base() Greg Kroah-Hartman
                   ` (280 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Björn Töpel,
	Sandeep Penigalapati, Tony Nguyen, Sasha Levin, Li RongQing

From: Björn Töpel <bjorn.topel@intel.com>

[ Upstream commit a06316dc87bdc000f7f39a315476957af2ba0f05 ]

The page recycle code, incorrectly, relied on that a page fragment
could not be freed inside xdp_do_redirect(). This assumption leads to
that page fragments that are used by the stack/XDP redirect can be
reused and overwritten.

To avoid this, store the page count prior invoking xdp_do_redirect().

Fixes: 6453073987ba ("ixgbe: add initial support for xdp redirect")
Reported-and-analyzed-by: Li RongQing <lirongqing@baidu.com>
Signed-off-by: Björn Töpel <bjorn.topel@intel.com>
Tested-by: Sandeep Penigalapati <sandeep.penigalapati@intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 24 +++++++++++++------
 1 file changed, 17 insertions(+), 7 deletions(-)

diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
index 4243ff4ec4b1d..faee77fa08044 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
@@ -1943,7 +1943,8 @@ static inline bool ixgbe_page_is_reserved(struct page *page)
 	return (page_to_nid(page) != numa_mem_id()) || page_is_pfmemalloc(page);
 }
 
-static bool ixgbe_can_reuse_rx_page(struct ixgbe_rx_buffer *rx_buffer)
+static bool ixgbe_can_reuse_rx_page(struct ixgbe_rx_buffer *rx_buffer,
+				    int rx_buffer_pgcnt)
 {
 	unsigned int pagecnt_bias = rx_buffer->pagecnt_bias;
 	struct page *page = rx_buffer->page;
@@ -1954,7 +1955,7 @@ static bool ixgbe_can_reuse_rx_page(struct ixgbe_rx_buffer *rx_buffer)
 
 #if (PAGE_SIZE < 8192)
 	/* if we are only owner of page we can reuse it */
-	if (unlikely((page_ref_count(page) - pagecnt_bias) > 1))
+	if (unlikely((rx_buffer_pgcnt - pagecnt_bias) > 1))
 		return false;
 #else
 	/* The last offset is a bit aggressive in that we assume the
@@ -2019,11 +2020,18 @@ static void ixgbe_add_rx_frag(struct ixgbe_ring *rx_ring,
 static struct ixgbe_rx_buffer *ixgbe_get_rx_buffer(struct ixgbe_ring *rx_ring,
 						   union ixgbe_adv_rx_desc *rx_desc,
 						   struct sk_buff **skb,
-						   const unsigned int size)
+						   const unsigned int size,
+						   int *rx_buffer_pgcnt)
 {
 	struct ixgbe_rx_buffer *rx_buffer;
 
 	rx_buffer = &rx_ring->rx_buffer_info[rx_ring->next_to_clean];
+	*rx_buffer_pgcnt =
+#if (PAGE_SIZE < 8192)
+		page_count(rx_buffer->page);
+#else
+		0;
+#endif
 	prefetchw(rx_buffer->page);
 	*skb = rx_buffer->skb;
 
@@ -2053,9 +2061,10 @@ static struct ixgbe_rx_buffer *ixgbe_get_rx_buffer(struct ixgbe_ring *rx_ring,
 
 static void ixgbe_put_rx_buffer(struct ixgbe_ring *rx_ring,
 				struct ixgbe_rx_buffer *rx_buffer,
-				struct sk_buff *skb)
+				struct sk_buff *skb,
+				int rx_buffer_pgcnt)
 {
-	if (ixgbe_can_reuse_rx_page(rx_buffer)) {
+	if (ixgbe_can_reuse_rx_page(rx_buffer, rx_buffer_pgcnt)) {
 		/* hand second half of page back to the ring */
 		ixgbe_reuse_rx_page(rx_ring, rx_buffer);
 	} else {
@@ -2299,6 +2308,7 @@ static int ixgbe_clean_rx_irq(struct ixgbe_q_vector *q_vector,
 		union ixgbe_adv_rx_desc *rx_desc;
 		struct ixgbe_rx_buffer *rx_buffer;
 		struct sk_buff *skb;
+		int rx_buffer_pgcnt;
 		unsigned int size;
 
 		/* return some buffers to hardware, one at a time is too slow */
@@ -2318,7 +2328,7 @@ static int ixgbe_clean_rx_irq(struct ixgbe_q_vector *q_vector,
 		 */
 		dma_rmb();
 
-		rx_buffer = ixgbe_get_rx_buffer(rx_ring, rx_desc, &skb, size);
+		rx_buffer = ixgbe_get_rx_buffer(rx_ring, rx_desc, &skb, size, &rx_buffer_pgcnt);
 
 		/* retrieve a buffer from the ring */
 		if (!skb) {
@@ -2360,7 +2370,7 @@ static int ixgbe_clean_rx_irq(struct ixgbe_q_vector *q_vector,
 			break;
 		}
 
-		ixgbe_put_rx_buffer(rx_ring, rx_buffer, skb);
+		ixgbe_put_rx_buffer(rx_ring, rx_buffer, skb, rx_buffer_pgcnt);
 		cleaned_count++;
 
 		/* place incomplete frames back on ring for completion */
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 069/346] drm/tegra: replace idr_init() by idr_init_base()
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (67 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 4.19 068/346] ixgbe: avoid premature Rx buffer reuse Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 4.19 070/346] kernel/cpu: add arch override for clear_tasks_mm_cpumask() mm handling Greg Kroah-Hartman
                   ` (279 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Deepak R Varma, Thierry Reding, Sasha Levin

From: Deepak R Varma <mh12gx2825@gmail.com>

[ Upstream commit 41f71629b4c432f8dd47d70ace813be5f79d4d75 ]

idr_init() uses base 0 which is an invalid identifier for this driver.
The new function idr_init_base allows IDR to set the ID lookup from
base 1. This avoids all lookups that otherwise starts from 0 since
0 is always unused.


Signed-off-by: Deepak R Varma <mh12gx2825@gmail.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/tegra/drm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/tegra/drm.c b/drivers/gpu/drm/tegra/drm.c
index a2bd5876c6335..00808a3d67832 100644
--- a/drivers/gpu/drm/tegra/drm.c
+++ b/drivers/gpu/drm/tegra/drm.c
@@ -242,7 +242,7 @@ static int tegra_drm_open(struct drm_device *drm, struct drm_file *filp)
 	if (!fpriv)
 		return -ENOMEM;
 
-	idr_init(&fpriv->contexts);
+	idr_init_base(&fpriv->contexts, 1);
 	mutex_init(&fpriv->lock);
 	filp->driver_priv = fpriv;
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 070/346] kernel/cpu: add arch override for clear_tasks_mm_cpumask() mm handling
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (68 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 4.19 069/346] drm/tegra: replace idr_init() by idr_init_base() Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 4.19 071/346] drm/tegra: sor: Disable clocks on error in tegra_sor_init() Greg Kroah-Hartman
                   ` (278 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Nicholas Piggin, Aneesh Kumar K.V,
	Peter Zijlstra (Intel),
	Michael Ellerman, Sasha Levin

From: Nicholas Piggin <npiggin@gmail.com>

[ Upstream commit 8ff00399b153440c1c83e20c43020385b416415b ]

powerpc/64s keeps a counter in the mm which counts bits set in
mm_cpumask as well as other things. This means it can't use generic code
to clear bits out of the mask and doesn't adjust the arch specific
counter.

Add an arch override that allows powerpc/64s to use
clear_tasks_mm_cpumask().

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20201126102530.691335-4-npiggin@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/cpu.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/kernel/cpu.c b/kernel/cpu.c
index 08b9d6ba0807f..9a39a24f60253 100644
--- a/kernel/cpu.c
+++ b/kernel/cpu.c
@@ -776,6 +776,10 @@ void __init cpuhp_threads_init(void)
 }
 
 #ifdef CONFIG_HOTPLUG_CPU
+#ifndef arch_clear_mm_cpumask_cpu
+#define arch_clear_mm_cpumask_cpu(cpu, mm) cpumask_clear_cpu(cpu, mm_cpumask(mm))
+#endif
+
 /**
  * clear_tasks_mm_cpumask - Safely clear tasks' mm_cpumask for a CPU
  * @cpu: a CPU id
@@ -811,7 +815,7 @@ void clear_tasks_mm_cpumask(int cpu)
 		t = find_lock_task_mm(p);
 		if (!t)
 			continue;
-		cpumask_clear_cpu(cpu, mm_cpumask(t->mm));
+		arch_clear_mm_cpumask_cpu(cpu, t->mm);
 		task_unlock(t);
 	}
 	rcu_read_unlock();
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 071/346] drm/tegra: sor: Disable clocks on error in tegra_sor_init()
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (69 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 4.19 070/346] kernel/cpu: add arch override for clear_tasks_mm_cpumask() mm handling Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 4.19 072/346] arm64: syscall: exit userspace before unmasking exceptions Greg Kroah-Hartman
                   ` (277 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Qinglang Miao, Thierry Reding, Sasha Levin

From: Qinglang Miao <miaoqinglang@huawei.com>

[ Upstream commit bf3a3cdcad40e5928a22ea0fd200d17fd6d6308d ]

Fix the missing clk_disable_unprepare() before return from
tegra_sor_init() in the error handling case.

Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/tegra/sor.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/tegra/sor.c b/drivers/gpu/drm/tegra/sor.c
index 89cb70da2bfe6..83108e2430501 100644
--- a/drivers/gpu/drm/tegra/sor.c
+++ b/drivers/gpu/drm/tegra/sor.c
@@ -2668,17 +2668,23 @@ static int tegra_sor_init(struct host1x_client *client)
 		if (err < 0) {
 			dev_err(sor->dev, "failed to deassert SOR reset: %d\n",
 				err);
+			clk_disable_unprepare(sor->clk);
 			return err;
 		}
 	}
 
 	err = clk_prepare_enable(sor->clk_safe);
-	if (err < 0)
+	if (err < 0) {
+		clk_disable_unprepare(sor->clk);
 		return err;
+	}
 
 	err = clk_prepare_enable(sor->clk_dp);
-	if (err < 0)
+	if (err < 0) {
+		clk_disable_unprepare(sor->clk_safe);
+		clk_disable_unprepare(sor->clk);
 		return err;
+	}
 
 	return 0;
 }
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 072/346] arm64: syscall: exit userspace before unmasking exceptions
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (70 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 4.19 071/346] drm/tegra: sor: Disable clocks on error in tegra_sor_init() Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 4.19 073/346] vxlan: Add needed_headroom for lower device Greg Kroah-Hartman
                   ` (276 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Mark Rutland, Catalin Marinas,
	James Morse, Will Deacon, Sasha Levin

From: Mark Rutland <mark.rutland@arm.com>

[ Upstream commit ca1314d73eed493c49bb1932c60a8605530db2e4 ]

In el0_svc_common() we unmask exceptions before we call user_exit(), and
so there's a window where an IRQ or debug exception can be taken while
RCU is not watching. In do_debug_exception() we account for this in via
debug_exception_{enter,exit}(), but in the el1_irq asm we do not and we
call trace functions which rely on RCU before we have a guarantee that
RCU is watching.

Let's avoid this by having el0_svc_common() exit userspace before
unmasking exceptions, matching what we do for all other EL0 entry paths.
We can use user_exit_irqoff() to avoid the pointless save/restore of IRQ
flags while we're sure exceptions are masked in DAIF.

The workaround for Cortex-A76 erratum 1463225 may trigger a debug
exception before this point, but the debug code invoked in this case is
safe even when RCU is not watching.

Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: James Morse <james.morse@arm.com>
Cc: Will Deacon <will@kernel.org>
Link: https://lore.kernel.org/r/20201130115950.22492-2-mark.rutland@arm.com
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/kernel/syscall.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/kernel/syscall.c b/arch/arm64/kernel/syscall.c
index 1457a0ba83dbc..f2d2dbbbfca20 100644
--- a/arch/arm64/kernel/syscall.c
+++ b/arch/arm64/kernel/syscall.c
@@ -102,8 +102,8 @@ static void el0_svc_common(struct pt_regs *regs, int scno, int sc_nr,
 	regs->syscallno = scno;
 
 	cortex_a76_erratum_1463225_svc_handler();
+	user_exit_irqoff();
 	local_daif_restore(DAIF_PROCCTX);
-	user_exit();
 
 	if (has_syscall_work(flags)) {
 		/* set default errno for user-issued syscall(-1) */
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 073/346] vxlan: Add needed_headroom for lower device
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (71 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 4.19 072/346] arm64: syscall: exit userspace before unmasking exceptions Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 4.19 074/346] vxlan: Copy needed_tailroom from lowerdev Greg Kroah-Hartman
                   ` (275 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Annika Wickert, Sven Eckelmann,
	Annika Wickert, Jakub Kicinski, Sasha Levin

From: Sven Eckelmann <sven@narfation.org>

[ Upstream commit 0a35dc41fea67ac4495ce7584406bf9557a6e7d0 ]

It was observed that sending data via batadv over vxlan (on top of
wireguard) reduced the performance massively compared to raw ethernet or
batadv on raw ethernet. A check of perf data showed that the
vxlan_build_skb was calling all the time pskb_expand_head to allocate
enough headroom for:

  min_headroom = LL_RESERVED_SPACE(dst->dev) + dst->header_len
  		+ VXLAN_HLEN + iphdr_len;

But the vxlan_config_apply only requested needed headroom for:

  lowerdev->hard_header_len + VXLAN6_HEADROOM or VXLAN_HEADROOM

So it completely ignored the needed_headroom of the lower device. The first
caller of net_dev_xmit could therefore never make sure that enough headroom
was allocated for the rest of the transmit path.

Cc: Annika Wickert <annika.wickert@exaring.de>
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Tested-by: Annika Wickert <aw@awlnx.space>
Link: https://lore.kernel.org/r/20201126125247.1047977-1-sven@narfation.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/vxlan.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index abf85f0ab72fc..8481a21fe7afb 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -3180,6 +3180,7 @@ static void vxlan_config_apply(struct net_device *dev,
 		dev->gso_max_segs = lowerdev->gso_max_segs;
 
 		needed_headroom = lowerdev->hard_header_len;
+		needed_headroom += lowerdev->needed_headroom;
 
 		max_mtu = lowerdev->mtu - (use_ipv6 ? VXLAN6_HEADROOM :
 					   VXLAN_HEADROOM);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 074/346] vxlan: Copy needed_tailroom from lowerdev
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (72 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 4.19 073/346] vxlan: Add needed_headroom for lower device Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 4.19 075/346] scsi: mpt3sas: Increase IOCInit request timeout to 30s Greg Kroah-Hartman
                   ` (274 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sven Eckelmann, Jakub Kicinski, Sasha Levin

From: Sven Eckelmann <sven@narfation.org>

[ Upstream commit a5e74021e84bb5eadf760aaf2c583304f02269be ]

While vxlan doesn't need any extra tailroom, the lowerdev might need it. In
that case, copy it over to reduce the chance for additional (re)allocations
in the transmit path.

Signed-off-by: Sven Eckelmann <sven@narfation.org>
Link: https://lore.kernel.org/r/20201126125247.1047977-2-sven@narfation.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/vxlan.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index 8481a21fe7afb..66fffbd64a33f 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -3182,6 +3182,8 @@ static void vxlan_config_apply(struct net_device *dev,
 		needed_headroom = lowerdev->hard_header_len;
 		needed_headroom += lowerdev->needed_headroom;
 
+		dev->needed_tailroom = lowerdev->needed_tailroom;
+
 		max_mtu = lowerdev->mtu - (use_ipv6 ? VXLAN6_HEADROOM :
 					   VXLAN_HEADROOM);
 		if (max_mtu < ETH_MIN_MTU)
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 075/346] scsi: mpt3sas: Increase IOCInit request timeout to 30s
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (73 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 4.19 074/346] vxlan: Copy needed_tailroom from lowerdev Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 4.19 076/346] dm table: Remove BUG_ON(in_interrupt()) Greg Kroah-Hartman
                   ` (273 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sreekanth Reddy, Martin K. Petersen,
	Sasha Levin

From: Sreekanth Reddy <sreekanth.reddy@broadcom.com>

[ Upstream commit 85dad327d9b58b4c9ce08189a2707167de392d23 ]

Currently the IOCInit request message timeout is set to 10s. This is not
sufficient in some scenarios such as during HBA FW downgrade operations.

Increase the IOCInit request timeout to 30s.

Link: https://lore.kernel.org/r/20201130082733.26120-1-sreekanth.reddy@broadcom.com
Signed-off-by: Sreekanth Reddy <sreekanth.reddy@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/mpt3sas/mpt3sas_base.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c
index 9fbe20e38ad07..07959047d4dc4 100644
--- a/drivers/scsi/mpt3sas/mpt3sas_base.c
+++ b/drivers/scsi/mpt3sas/mpt3sas_base.c
@@ -5771,7 +5771,7 @@ _base_send_ioc_init(struct MPT3SAS_ADAPTER *ioc)
 
 	r = _base_handshake_req_reply_wait(ioc,
 	    sizeof(Mpi2IOCInitRequest_t), (u32 *)&mpi_request,
-	    sizeof(Mpi2IOCInitReply_t), (u16 *)&mpi_reply, 10);
+	    sizeof(Mpi2IOCInitReply_t), (u16 *)&mpi_reply, 30);
 
 	if (r != 0) {
 		pr_err(MPT3SAS_FMT "%s: handshake failed (r=%d)\n",
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 076/346] dm table: Remove BUG_ON(in_interrupt())
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (74 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 4.19 075/346] scsi: mpt3sas: Increase IOCInit request timeout to 30s Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 4.19 077/346] soc/tegra: fuse: Fix index bug in get_process_id Greg Kroah-Hartman
                   ` (272 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Thomas Gleixner,
	Sebastian Andrzej Siewior, Mike Snitzer, Sasha Levin

From: Thomas Gleixner <tglx@linutronix.de>

[ Upstream commit e7b624183d921b49ef0a96329f21647d38865ee9 ]

The BUG_ON(in_interrupt()) in dm_table_event() is a historic leftover from
a rework of the dm table code which changed the calling context.

Issuing a BUG for a wrong calling context is frowned upon and
in_interrupt() is deprecated and only covering parts of the wrong
contexts. The sanity check for the context is covered by
CONFIG_DEBUG_ATOMIC_SLEEP and other debug facilities already.

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/md/dm-table.c | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
index 36275c59e4e7b..f849db3035a05 100644
--- a/drivers/md/dm-table.c
+++ b/drivers/md/dm-table.c
@@ -1336,12 +1336,6 @@ void dm_table_event_callback(struct dm_table *t,
 
 void dm_table_event(struct dm_table *t)
 {
-	/*
-	 * You can no longer call dm_table_event() from interrupt
-	 * context, use a bottom half instead.
-	 */
-	BUG_ON(in_interrupt());
-
 	mutex_lock(&_event_lock);
 	if (t->event_fn)
 		t->event_fn(t->event_context);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 077/346] soc/tegra: fuse: Fix index bug in get_process_id
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (75 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 4.19 076/346] dm table: Remove BUG_ON(in_interrupt()) Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 4.19 078/346] USB: serial: option: add interface-number sanity check to flag handling Greg Kroah-Hartman
                   ` (271 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Nicolin Chen, Thierry Reding

From: Nicolin Chen <nicoleotsuka@gmail.com>

commit b9ce9b0f83b536a4ac7de7567a265d28d13e5bea upstream.

This patch simply fixes a bug of referencing speedos[num] in every
for-loop iteration in get_process_id function.

Fixes: 0dc5a0d83675 ("soc/tegra: fuse: Add Tegra210 support")
Cc: <stable@vger.kernel.org>
Signed-off-by: Nicolin Chen <nicoleotsuka@gmail.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/soc/tegra/fuse/speedo-tegra210.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/soc/tegra/fuse/speedo-tegra210.c
+++ b/drivers/soc/tegra/fuse/speedo-tegra210.c
@@ -105,7 +105,7 @@ static int get_process_id(int value, con
 	unsigned int i;
 
 	for (i = 0; i < num; i++)
-		if (value < speedos[num])
+		if (value < speedos[i])
 			return i;
 
 	return -EINVAL;



^ permalink raw reply	[flat|nested] 359+ messages in thread

* [PATCH 4.19 078/346] USB: serial: option: add interface-number sanity check to flag handling
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (76 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 4.19 077/346] soc/tegra: fuse: Fix index bug in get_process_id Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 4.19 079/346] USB: gadget: f_acm: add support for SuperSpeed Plus Greg Kroah-Hartman
                   ` (270 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, syzbot+8881b478dad0a7971f79, Johan Hovold

From: Johan Hovold <johan@kernel.org>

commit a251963f76fa0226d0fdf0c4f989496f18d9ae7f upstream.

Add an interface-number sanity check before testing the device flags to
avoid relying on undefined behaviour when left shifting in case a device
uses an interface number greater than or equal to BITS_PER_LONG (i.e. 64
or 32).

Reported-by: syzbot+8881b478dad0a7971f79@syzkaller.appspotmail.com
Fixes: c3a65808f04a ("USB: serial: option: reimplement interface masking")
Cc: stable@vger.kernel.org
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/serial/option.c |   23 +++++++++++++++++++++--
 1 file changed, 21 insertions(+), 2 deletions(-)

--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -563,6 +563,9 @@ static void option_instat_callback(struc
 
 /* Device flags */
 
+/* Highest interface number which can be used with NCTRL() and RSVD() */
+#define FLAG_IFNUM_MAX	7
+
 /* Interface does not support modem-control requests */
 #define NCTRL(ifnum)	((BIT(ifnum) & 0xff) << 8)
 
@@ -2100,6 +2103,14 @@ static struct usb_serial_driver * const
 
 module_usb_serial_driver(serial_drivers, option_ids);
 
+static bool iface_is_reserved(unsigned long device_flags, u8 ifnum)
+{
+	if (ifnum > FLAG_IFNUM_MAX)
+		return false;
+
+	return device_flags & RSVD(ifnum);
+}
+
 static int option_probe(struct usb_serial *serial,
 			const struct usb_device_id *id)
 {
@@ -2116,7 +2127,7 @@ static int option_probe(struct usb_seria
 	 * the same class/subclass/protocol as the serial interfaces.  Look at
 	 * the Windows driver .INF files for reserved interface numbers.
 	 */
-	if (device_flags & RSVD(iface_desc->bInterfaceNumber))
+	if (iface_is_reserved(device_flags, iface_desc->bInterfaceNumber))
 		return -ENODEV;
 
 	/*
@@ -2132,6 +2143,14 @@ static int option_probe(struct usb_seria
 	return 0;
 }
 
+static bool iface_no_modem_control(unsigned long device_flags, u8 ifnum)
+{
+	if (ifnum > FLAG_IFNUM_MAX)
+		return false;
+
+	return device_flags & NCTRL(ifnum);
+}
+
 static int option_attach(struct usb_serial *serial)
 {
 	struct usb_interface_descriptor *iface_desc;
@@ -2147,7 +2166,7 @@ static int option_attach(struct usb_seri
 
 	iface_desc = &serial->interface->cur_altsetting->desc;
 
-	if (!(device_flags & NCTRL(iface_desc->bInterfaceNumber)))
+	if (!iface_no_modem_control(device_flags, iface_desc->bInterfaceNumber))
 		data->use_send_setup = 1;
 
 	if (device_flags & ZLP)



^ permalink raw reply	[flat|nested] 359+ messages in thread

* [PATCH 4.19 079/346] USB: gadget: f_acm: add support for SuperSpeed Plus
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (77 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 4.19 078/346] USB: serial: option: add interface-number sanity check to flag handling Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 4.19 080/346] USB: gadget: f_midi: setup SuperSpeed Plus descriptors Greg Kroah-Hartman
                   ` (269 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Felipe Balbi, taehyun.cho,
	Will McVicker, Peter Chen

From: taehyun.cho <taehyun.cho@samsung.com>

commit 3ee05c20656782387aa9eb010fdb9bb16982ac3f upstream.

Setup the SuperSpeed Plus descriptors for f_acm.  This allows the gadget
to work properly without crashing at SuperSpeed rates.

Cc: Felipe Balbi <balbi@kernel.org>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: taehyun.cho <taehyun.cho@samsung.com>
Signed-off-by: Will McVicker <willmcvicker@google.com>
Reviewed-by: Peter Chen <peter.chen@nxp.com>
Link: https://lore.kernel.org/r/20201127140559.381351-3-gregkh@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/gadget/function/f_acm.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/usb/gadget/function/f_acm.c
+++ b/drivers/usb/gadget/function/f_acm.c
@@ -684,7 +684,7 @@ acm_bind(struct usb_configuration *c, st
 	acm_ss_out_desc.bEndpointAddress = acm_fs_out_desc.bEndpointAddress;
 
 	status = usb_assign_descriptors(f, acm_fs_function, acm_hs_function,
-			acm_ss_function, NULL);
+			acm_ss_function, acm_ss_function);
 	if (status)
 		goto fail;
 



^ permalink raw reply	[flat|nested] 359+ messages in thread

* [PATCH 4.19 080/346] USB: gadget: f_midi: setup SuperSpeed Plus descriptors
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (78 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 4.19 079/346] USB: gadget: f_acm: add support for SuperSpeed Plus Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 4.19 081/346] usb: gadget: f_fs: Re-use SS descriptors for SuperSpeedPlus Greg Kroah-Hartman
                   ` (268 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Felipe Balbi, Will McVicker, Peter Chen

From: Will McVicker <willmcvicker@google.com>

commit 457a902ba1a73b7720666b21ca038cd19764db18 upstream.

Needed for SuperSpeed Plus support for f_midi.  This allows the
gadget to work properly without crashing at SuperSpeed rates.

Cc: Felipe Balbi <balbi@kernel.org>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Will McVicker <willmcvicker@google.com>
Reviewed-by: Peter Chen <peter.chen@nxp.com>
Link: https://lore.kernel.org/r/20201127140559.381351-4-gregkh@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/gadget/function/f_midi.c |    6 ++++++
 1 file changed, 6 insertions(+)

--- a/drivers/usb/gadget/function/f_midi.c
+++ b/drivers/usb/gadget/function/f_midi.c
@@ -1048,6 +1048,12 @@ static int f_midi_bind(struct usb_config
 		f->ss_descriptors = usb_copy_descriptors(midi_function);
 		if (!f->ss_descriptors)
 			goto fail_f_midi;
+
+		if (gadget_is_superspeed_plus(c->cdev->gadget)) {
+			f->ssp_descriptors = usb_copy_descriptors(midi_function);
+			if (!f->ssp_descriptors)
+				goto fail_f_midi;
+		}
 	}
 
 	kfree(midi_function);



^ permalink raw reply	[flat|nested] 359+ messages in thread

* [PATCH 4.19 081/346] usb: gadget: f_fs: Re-use SS descriptors for SuperSpeedPlus
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (79 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 4.19 080/346] USB: gadget: f_midi: setup SuperSpeed Plus descriptors Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 4.19 082/346] USB: gadget: f_rndis: fix bitrate for SuperSpeed and above Greg Kroah-Hartman
                   ` (267 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jack Pham

From: Jack Pham <jackp@codeaurora.org>

commit a353397b0d5dfa3c99b372505db3378fc919c6c6 upstream.

In many cases a function that supports SuperSpeed can very well
operate in SuperSpeedPlus, if a gadget controller supports it,
as the endpoint descriptors (and companion descriptors) are
generally identical and can be re-used. This is true for two
commonly used functions: Android's ADB and MTP. So we can simply
assign the usb_function's ssp_descriptors array to point to its
ss_descriptors, if available. Similarly, we need to allow an
epfile's ioctl for FUNCTIONFS_ENDPOINT_DESC to correctly
return the corresponding SuperSpeed endpoint descriptor in case
the connected speed is SuperSpeedPlus as well.

The only exception is if a function wants to implement an
Isochronous endpoint capable of transferring more than 48KB per
service interval when operating at greater than USB 3.1 Gen1
speed, in which case it would require an additional SuperSpeedPlus
Isochronous Endpoint Companion descriptor to be returned as part
of the Configuration Descriptor. Support for that would need
to be separately added to the userspace-facing FunctionFS API
which may not be a trivial task--likely a new descriptor format
(v3?) may need to be devised to allow for separate SS and SSP
descriptors to be supplied.

Signed-off-by: Jack Pham <jackp@codeaurora.org>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201027230731.9073-1-jackp@codeaurora.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/gadget/function/f_fs.c |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -1247,6 +1247,7 @@ static long ffs_epfile_ioctl(struct file
 
 		switch (epfile->ffs->gadget->speed) {
 		case USB_SPEED_SUPER:
+		case USB_SPEED_SUPER_PLUS:
 			desc_idx = 2;
 			break;
 		case USB_SPEED_HIGH:
@@ -3077,7 +3078,8 @@ static int _ffs_func_bind(struct usb_con
 	}
 
 	if (likely(super)) {
-		func->function.ss_descriptors = vla_ptr(vlabuf, d, ss_descs);
+		func->function.ss_descriptors = func->function.ssp_descriptors =
+			vla_ptr(vlabuf, d, ss_descs);
 		ss_len = ffs_do_descs(ffs->ss_descs_count,
 				vla_ptr(vlabuf, d, raw_descs) + fs_len + hs_len,
 				d_raw_descs__sz - fs_len - hs_len,
@@ -3487,6 +3489,7 @@ static void ffs_func_unbind(struct usb_c
 	func->function.fs_descriptors = NULL;
 	func->function.hs_descriptors = NULL;
 	func->function.ss_descriptors = NULL;
+	func->function.ssp_descriptors = NULL;
 	func->interfaces_nums = NULL;
 
 	ffs_event_add(ffs, FUNCTIONFS_UNBIND);



^ permalink raw reply	[flat|nested] 359+ messages in thread

* [PATCH 4.19 082/346] USB: gadget: f_rndis: fix bitrate for SuperSpeed and above
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (80 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 4.19 081/346] usb: gadget: f_fs: Re-use SS descriptors for SuperSpeedPlus Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 4.19 083/346] usb: chipidea: ci_hdrc_imx: Pass DISABLE_DEVICE_STREAMING flag to imx6ul Greg Kroah-Hartman
                   ` (266 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Felipe Balbi, EJ Hsu, Peter Chen,
	Will McVicker

From: Will McVicker <willmcvicker@google.com>

commit b00f444f9add39b64d1943fa75538a1ebd54a290 upstream.

Align the SuperSpeed Plus bitrate for f_rndis to match f_ncm's ncm_bitrate
defined by commit 1650113888fe ("usb: gadget: f_ncm: add SuperSpeed descriptors
for CDC NCM").

Cc: Felipe Balbi <balbi@kernel.org>
Cc: EJ Hsu <ejh@nvidia.com>
Cc: Peter Chen <peter.chen@nxp.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Will McVicker <willmcvicker@google.com>
Reviewed-by: Peter Chen <peter.chen@nxp.com>
Link: https://lore.kernel.org/r/20201127140559.381351-2-gregkh@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/gadget/function/f_rndis.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/drivers/usb/gadget/function/f_rndis.c
+++ b/drivers/usb/gadget/function/f_rndis.c
@@ -87,8 +87,10 @@ static inline struct f_rndis *func_to_rn
 /* peak (theoretical) bulk transfer rate in bits-per-second */
 static unsigned int bitrate(struct usb_gadget *g)
 {
+	if (gadget_is_superspeed(g) && g->speed >= USB_SPEED_SUPER_PLUS)
+		return 4250000000U;
 	if (gadget_is_superspeed(g) && g->speed == USB_SPEED_SUPER)
-		return 13 * 1024 * 8 * 1000 * 8;
+		return 3750000000U;
 	else if (gadget_is_dualspeed(g) && g->speed == USB_SPEED_HIGH)
 		return 13 * 512 * 8 * 1000 * 8;
 	else



^ permalink raw reply	[flat|nested] 359+ messages in thread

* [PATCH 4.19 083/346] usb: chipidea: ci_hdrc_imx: Pass DISABLE_DEVICE_STREAMING flag to imx6ul
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (81 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 4.19 082/346] USB: gadget: f_rndis: fix bitrate for SuperSpeed and above Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 4.19 084/346] ARM: dts: exynos: fix roles of USB 3.0 ports on Odroid XU Greg Kroah-Hartman
                   ` (265 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Fabio Estevam, Peter Chen

From: Fabio Estevam <festevam@gmail.com>

commit c7721e15f434920145c376e8fe77e1c079fc3726 upstream.

According to the i.MX6UL Errata document:
https://www.nxp.com/docs/en/errata/IMX6ULCE.pdf

ERR007881 also affects i.MX6UL, so pass the
CI_HDRC_DISABLE_DEVICE_STREAMING flag to workaround the issue.

Fixes: 52fe568e5d71 ("usb: chipidea: imx: add imx6ul usb support")
Cc: <stable@vger.kernel.org>
Signed-off-by: Fabio Estevam <festevam@gmail.com>
Signed-off-by: Peter Chen <peter.chen@nxp.com>
Link: https://lore.kernel.org/r/20201207020909.22483-2-peter.chen@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/chipidea/ci_hdrc_imx.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/usb/chipidea/ci_hdrc_imx.c
+++ b/drivers/usb/chipidea/ci_hdrc_imx.c
@@ -57,7 +57,8 @@ static const struct ci_hdrc_imx_platform
 
 static const struct ci_hdrc_imx_platform_flag imx6ul_usb_data = {
 	.flags = CI_HDRC_SUPPORTS_RUNTIME_PM |
-		CI_HDRC_TURN_VBUS_EARLY_ON,
+		CI_HDRC_TURN_VBUS_EARLY_ON |
+		CI_HDRC_DISABLE_DEVICE_STREAMING,
 };
 
 static const struct ci_hdrc_imx_platform_flag imx7d_usb_data = {



^ permalink raw reply	[flat|nested] 359+ messages in thread

* [PATCH 4.19 084/346] ARM: dts: exynos: fix roles of USB 3.0 ports on Odroid XU
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (82 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 4.19 083/346] usb: chipidea: ci_hdrc_imx: Pass DISABLE_DEVICE_STREAMING flag to imx6ul Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 4.19 085/346] ARM: dts: exynos: fix USB 3.0 VBUS control and over-current pins on Exynos5410 Greg Kroah-Hartman
                   ` (264 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Krzysztof Kozlowski, Gabriel Ribba Esteva

From: Krzysztof Kozlowski <krzk@kernel.org>

commit ecc1ff532b499d20304a4f682247137025814c34 upstream.

On Odroid XU board the USB3-0 port is a microUSB and USB3-1 port is USB
type A (host).  The roles were copied from Odroid XU3 (Exynos5422)
design which has it reversed.

Fixes: 8149afe4dbf9 ("ARM: dts: exynos: Add initial support for Odroid XU board")
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201015182044.480562-1-krzk@kernel.org
Tested-by: Gabriel Ribba Esteva <gabriel.ribbae@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/arm/boot/dts/exynos5410-odroidxu.dts |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/arch/arm/boot/dts/exynos5410-odroidxu.dts
+++ b/arch/arm/boot/dts/exynos5410-odroidxu.dts
@@ -626,11 +626,11 @@
 };
 
 &usbdrd_dwc3_0 {
-	dr_mode = "host";
+	dr_mode = "peripheral";
 };
 
 &usbdrd_dwc3_1 {
-	dr_mode = "peripheral";
+	dr_mode = "host";
 };
 
 &usbdrd3_0 {



^ permalink raw reply	[flat|nested] 359+ messages in thread

* [PATCH 4.19 085/346] ARM: dts: exynos: fix USB 3.0 VBUS control and over-current pins on Exynos5410
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (83 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 4.19 084/346] ARM: dts: exynos: fix roles of USB 3.0 ports on Odroid XU Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 4.19 086/346] ARM: dts: exynos: fix USB 3.0 pins supply being turned off on Odroid XU Greg Kroah-Hartman
                   ` (263 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Krzysztof Kozlowski, Gabriel Ribba Esteva

From: Krzysztof Kozlowski <krzk@kernel.org>

commit 3d992fd8f4e0f09c980726308d2f2725587b32d6 upstream.

The VBUS control (PWREN) and over-current pins of USB 3.0 DWC3
controllers are on Exynos5410 regular GPIOs.  This is different than for
example on Exynos5422 where these are special ETC pins with proper reset
values (pulls, functions).

Therefore these pins should be configured to enable proper USB 3.0
peripheral and host modes.  This also fixes over-current warning:

    [    6.024658] usb usb4-port1: over-current condition
    [    6.028271] usb usb3-port1: over-current condition

Fixes: cb0896562228 ("ARM: dts: exynos: Add USB to Exynos5410")
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201015182044.480562-2-krzk@kernel.org
Tested-by: Gabriel Ribba Esteva <gabriel.ribbae@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/arm/boot/dts/exynos5410-pinctrl.dtsi |   28 ++++++++++++++++++++++++++++
 arch/arm/boot/dts/exynos5410.dtsi         |    4 ++++
 2 files changed, 32 insertions(+)

--- a/arch/arm/boot/dts/exynos5410-pinctrl.dtsi
+++ b/arch/arm/boot/dts/exynos5410-pinctrl.dtsi
@@ -560,6 +560,34 @@
 		interrupt-controller;
 		#interrupt-cells = <2>;
 	};
+
+	usb3_1_oc: usb3-1-oc {
+		samsung,pins = "gpk2-4", "gpk2-5";
+		samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
+		samsung,pin-pud = <EXYNOS_PIN_PULL_UP>;
+		samsung,pin-drv = <EXYNOS5420_PIN_DRV_LV1>;
+	};
+
+	usb3_1_vbusctrl: usb3-1-vbusctrl {
+		samsung,pins = "gpk2-6", "gpk2-7";
+		samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
+		samsung,pin-pud = <EXYNOS_PIN_PULL_DOWN>;
+		samsung,pin-drv = <EXYNOS5420_PIN_DRV_LV1>;
+	};
+
+	usb3_0_oc: usb3-0-oc {
+		samsung,pins = "gpk3-0", "gpk3-1";
+		samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
+		samsung,pin-pud = <EXYNOS_PIN_PULL_UP>;
+		samsung,pin-drv = <EXYNOS5420_PIN_DRV_LV1>;
+	};
+
+	usb3_0_vbusctrl: usb3-0-vbusctrl {
+		samsung,pins = "gpk3-2", "gpk3-3";
+		samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
+		samsung,pin-pud = <EXYNOS_PIN_PULL_DOWN>;
+		samsung,pin-drv = <EXYNOS5420_PIN_DRV_LV1>;
+	};
 };
 
 &pinctrl_2 {
--- a/arch/arm/boot/dts/exynos5410.dtsi
+++ b/arch/arm/boot/dts/exynos5410.dtsi
@@ -392,6 +392,8 @@
 &usbdrd3_0 {
 	clocks = <&clock CLK_USBD300>;
 	clock-names = "usbdrd30";
+	pinctrl-names = "default";
+	pinctrl-0 = <&usb3_0_oc>, <&usb3_0_vbusctrl>;
 };
 
 &usbdrd_phy0 {
@@ -403,6 +405,8 @@
 &usbdrd3_1 {
 	clocks = <&clock CLK_USBD301>;
 	clock-names = "usbdrd30";
+	pinctrl-names = "default";
+	pinctrl-0 = <&usb3_1_oc>, <&usb3_1_vbusctrl>;
 };
 
 &usbdrd_dwc3_1 {



^ permalink raw reply	[flat|nested] 359+ messages in thread

* [PATCH 4.19 086/346] ARM: dts: exynos: fix USB 3.0 pins supply being turned off on Odroid XU
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (84 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 4.19 085/346] ARM: dts: exynos: fix USB 3.0 VBUS control and over-current pins on Exynos5410 Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 4.19 087/346] coresight: tmc-etr: Check if page is valid before dma_map_page() Greg Kroah-Hartman
                   ` (262 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Krzysztof Kozlowski, Gabriel Ribba Esteva

From: Krzysztof Kozlowski <krzk@kernel.org>

commit bd7e7ff56feea7810df900fb09c9741d259861d9 upstream.

On Odroid XU LDO12 and LDO15 supplies the power to USB 3.0 blocks but
the GPK GPIO pins are supplied by LDO7 (VDDQ_LCD).  LDO7 also supplies
GPJ GPIO pins.

The Exynos pinctrl driver does not take any supplies, so to have entire
GPIO block always available, make the regulator always on.

Fixes: 88644b4c750b ("ARM: dts: exynos: Configure PWM, usb3503, PMIC and thermal on Odroid XU board")
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201015182044.480562-3-krzk@kernel.org
Tested-by: Gabriel Ribba Esteva <gabriel.ribbae@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/arm/boot/dts/exynos5410-odroidxu.dts |    2 ++
 1 file changed, 2 insertions(+)

--- a/arch/arm/boot/dts/exynos5410-odroidxu.dts
+++ b/arch/arm/boot/dts/exynos5410-odroidxu.dts
@@ -324,6 +324,8 @@
 				regulator-name = "vddq_lcd";
 				regulator-min-microvolt = <1800000>;
 				regulator-max-microvolt = <1800000>;
+				/* Supplies also GPK and GPJ */
+				regulator-always-on;
 			};
 
 			ldo8_reg: LDO8 {



^ permalink raw reply	[flat|nested] 359+ messages in thread

* [PATCH 4.19 087/346] coresight: tmc-etr: Check if page is valid before dma_map_page()
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (85 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 4.19 086/346] ARM: dts: exynos: fix USB 3.0 pins supply being turned off on Odroid XU Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 4.19 088/346] scsi: megaraid_sas: Check user-provided offsets Greg Kroah-Hartman
                   ` (261 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Suzuki K Poulose, Mao Jinlong,
	Sai Prakash Ranjan, Mathieu Poirier

From: Mao Jinlong <jinlmao@codeaurora.org>

commit 1cc573d5754e92372a7e30e35468644f8811e1a4 upstream.

alloc_pages_node() return should be checked before calling
dma_map_page() to make sure that valid page is mapped or
else it can lead to aborts as below:

 Unable to handle kernel paging request at virtual address ffffffc008000000
 Mem abort info:
 <snip>...
 pc : __dma_inv_area+0x40/0x58
 lr : dma_direct_map_page+0xd8/0x1c8

 Call trace:
  __dma_inv_area
  tmc_pages_alloc
  tmc_alloc_data_pages
  tmc_alloc_sg_table
  tmc_init_etr_sg_table
  tmc_alloc_etr_buf
  tmc_enable_etr_sink_sysfs
  tmc_enable_etr_sink
  coresight_enable_path
  coresight_enable
  enable_source_store
  dev_attr_store
  sysfs_kf_write

Fixes: 99443ea19e8b ("coresight: Add generic TMC sg table framework")
Cc: stable@vger.kernel.org
Reviewed-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Signed-off-by: Mao Jinlong <jinlmao@codeaurora.org>
Signed-off-by: Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
Link: https://lore.kernel.org/r/20201127175256.1092685-13-mathieu.poirier@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/hwtracing/coresight/coresight-tmc-etr.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/drivers/hwtracing/coresight/coresight-tmc-etr.c
+++ b/drivers/hwtracing/coresight/coresight-tmc-etr.c
@@ -183,6 +183,8 @@ static int tmc_pages_alloc(struct tmc_pa
 		} else {
 			page = alloc_pages_node(node,
 						GFP_KERNEL | __GFP_ZERO, 0);
+			if (!page)
+				goto err;
 		}
 		paddr = dma_map_page(dev, page, 0, PAGE_SIZE, dir);
 		if (dma_mapping_error(dev, paddr))



^ permalink raw reply	[flat|nested] 359+ messages in thread

* [PATCH 4.19 088/346] scsi: megaraid_sas: Check user-provided offsets
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (86 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 4.19 087/346] coresight: tmc-etr: Check if page is valid before dma_map_page() Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 4.19 089/346] HID: i2c-hid: add Vero K147 to descriptor override Greg Kroah-Hartman
                   ` (260 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christoph Hellwig, Arnd Bergmann,
	Martin K. Petersen

From: Arnd Bergmann <arnd@arndb.de>

commit 381d34e376e3d9d27730fda8a0e870600e6c8196 upstream.

It sounds unwise to let user space pass an unchecked 32-bit offset into a
kernel structure in an ioctl. This is an unsigned variable, so checking the
upper bound for the size of the structure it points into is sufficient to
avoid data corruption, but as the pointer might also be unaligned, it has
to be written carefully as well.

While I stumbled over this problem by reading the code, I did not continue
checking the function for further problems like it.

Link: https://lore.kernel.org/r/20201030164450.1253641-2-arnd@kernel.org
Fixes: c4a3e0a529ab ("[SCSI] MegaRAID SAS RAID: new driver")
Cc: <stable@vger.kernel.org> # v2.6.15+
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/scsi/megaraid/megaraid_sas_base.c |   16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

--- a/drivers/scsi/megaraid/megaraid_sas_base.c
+++ b/drivers/scsi/megaraid/megaraid_sas_base.c
@@ -7192,7 +7192,7 @@ megasas_mgmt_fw_ioctl(struct megasas_ins
 	int error = 0, i;
 	void *sense = NULL;
 	dma_addr_t sense_handle;
-	unsigned long *sense_ptr;
+	void *sense_ptr;
 	u32 opcode = 0;
 
 	memset(kbuff_arr, 0, sizeof(kbuff_arr));
@@ -7309,6 +7309,13 @@ megasas_mgmt_fw_ioctl(struct megasas_ins
 	}
 
 	if (ioc->sense_len) {
+		/* make sure the pointer is part of the frame */
+		if (ioc->sense_off >
+		    (sizeof(union megasas_frame) - sizeof(__le64))) {
+			error = -EINVAL;
+			goto out;
+		}
+
 		sense = dma_alloc_coherent(&instance->pdev->dev, ioc->sense_len,
 					     &sense_handle, GFP_KERNEL);
 		if (!sense) {
@@ -7316,12 +7323,11 @@ megasas_mgmt_fw_ioctl(struct megasas_ins
 			goto out;
 		}
 
-		sense_ptr =
-		(unsigned long *) ((unsigned long)cmd->frame + ioc->sense_off);
+		sense_ptr = (void *)cmd->frame + ioc->sense_off;
 		if (instance->consistent_mask_64bit)
-			*sense_ptr = cpu_to_le64(sense_handle);
+			put_unaligned_le64(sense_handle, sense_ptr);
 		else
-			*sense_ptr = cpu_to_le32(sense_handle);
+			put_unaligned_le32(sense_handle, sense_ptr);
 	}
 
 	/*



^ permalink raw reply	[flat|nested] 359+ messages in thread

* [PATCH 4.19 089/346] HID: i2c-hid: add Vero K147 to descriptor override
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (87 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 4.19 088/346] scsi: megaraid_sas: Check user-provided offsets Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 4.19 090/346] serial_core: Check for port state when tty is in error state Greg Kroah-Hartman
                   ` (259 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Julian Sax, Hans de Goede, Jiri Kosina

From: Julian Sax <jsbc@gmx.de>

commit c870d50ce387d84b6438211a7044c60afbd5d60a upstream.

This device uses the SIPODEV SP1064 touchpad, which does not
supply descriptors, so it has to be added to the override list.

Cc: stable@vger.kernel.org
Signed-off-by: Julian Sax <jsbc@gmx.de>
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c |    8 ++++++++
 1 file changed, 8 insertions(+)

--- a/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c
+++ b/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c
@@ -397,6 +397,14 @@ static const struct dmi_system_id i2c_hi
 		},
 		.driver_data = (void *)&sipodev_desc
 	},
+	{
+		.ident = "Vero K147",
+		.matches = {
+			DMI_EXACT_MATCH(DMI_SYS_VENDOR, "VERO"),
+			DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "K147"),
+		},
+		.driver_data = (void *)&sipodev_desc
+	},
 	{ }	/* Terminate list */
 };
 



^ permalink raw reply	[flat|nested] 359+ messages in thread

* [PATCH 4.19 090/346] serial_core: Check for port state when tty is in error state
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (88 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 4.19 089/346] HID: i2c-hid: add Vero K147 to descriptor override Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 4.19 091/346] Bluetooth: Fix slab-out-of-bounds read in hci_le_direct_adv_report_evt() Greg Kroah-Hartman
                   ` (258 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Alexey Kardashevskiy

From: Alexey Kardashevskiy <aik@ozlabs.ru>

commit 2f70e49ed860020f5abae4f7015018ebc10e1f0e upstream.

At the moment opening a serial device node (such as /dev/ttyS3)
succeeds even if there is no actual serial device behind it.
Reading/writing/ioctls fail as expected because the uart port is not
initialized (the type is PORT_UNKNOWN) and the TTY_IO_ERROR error state
bit is set fot the tty.

However setting line discipline does not have these checks
8250_port.c (8250 is the default choice made by univ8250_console_init()).
As the result of PORT_UNKNOWN, uart_port::iobase is NULL which
a platform translates onto some address accessing which produces a crash
like below.

This adds tty_port_initialized() to uart_set_ldisc() to prevent the crash.

Found by syzkaller.

Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
Link: https://lore.kernel.org/r/20201203055834.45838-1-aik@ozlabs.ru
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/tty/serial/serial_core.c |    4 ++++
 1 file changed, 4 insertions(+)

--- a/drivers/tty/serial/serial_core.c
+++ b/drivers/tty/serial/serial_core.c
@@ -1421,6 +1421,10 @@ static void uart_set_ldisc(struct tty_st
 {
 	struct uart_state *state = tty->driver_data;
 	struct uart_port *uport;
+	struct tty_port *port = &state->port;
+
+	if (!tty_port_initialized(port))
+		return;
 
 	mutex_lock(&state->port.mutex);
 	uport = uart_port_check(state);



^ permalink raw reply	[flat|nested] 359+ messages in thread

* [PATCH 4.19 091/346] Bluetooth: Fix slab-out-of-bounds read in hci_le_direct_adv_report_evt()
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (89 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 4.19 090/346] serial_core: Check for port state when tty is in error state Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 4.19 092/346] quota: Sanity-check quota file headers on load Greg Kroah-Hartman
                   ` (257 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Peilin Ye, Marcel Holtmann,
	syzbot+24ebd650e20bd263ca01

From: Peilin Ye <yepeilin.cs@gmail.com>

commit f7e0e8b2f1b0a09b527885babda3e912ba820798 upstream.

`num_reports` is not being properly checked. A malformed event packet with
a large `num_reports` number makes hci_le_direct_adv_report_evt() read out
of bounds. Fix it.

Cc: stable@vger.kernel.org
Fixes: 2f010b55884e ("Bluetooth: Add support for handling LE Direct Advertising Report events")
Reported-and-tested-by: syzbot+24ebd650e20bd263ca01@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?extid=24ebd650e20bd263ca01
Signed-off-by: Peilin Ye <yepeilin.cs@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/bluetooth/hci_event.c |   12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -5596,21 +5596,19 @@ static void hci_le_direct_adv_report_evt
 					 struct sk_buff *skb)
 {
 	u8 num_reports = skb->data[0];
-	void *ptr = &skb->data[1];
+	struct hci_ev_le_direct_adv_info *ev = (void *)&skb->data[1];
 
-	hci_dev_lock(hdev);
+	if (!num_reports || skb->len < num_reports * sizeof(*ev) + 1)
+		return;
 
-	while (num_reports--) {
-		struct hci_ev_le_direct_adv_info *ev = ptr;
+	hci_dev_lock(hdev);
 
+	for (; num_reports; num_reports--, ev++)
 		process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
 				   ev->bdaddr_type, &ev->direct_addr,
 				   ev->direct_addr_type, ev->rssi, NULL, 0,
 				   false);
 
-		ptr += sizeof(*ev);
-	}
-
 	hci_dev_unlock(hdev);
 }
 



^ permalink raw reply	[flat|nested] 359+ messages in thread

* [PATCH 4.19 092/346] quota: Sanity-check quota file headers on load
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (90 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 4.19 091/346] Bluetooth: Fix slab-out-of-bounds read in hci_le_direct_adv_report_evt() Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 4.19 093/346] media: msi2500: assign SPI bus number dynamically Greg Kroah-Hartman
                   ` (256 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, syzbot+f816042a7ae2225f25ba,
	Andreas Dilger, Jan Kara

From: Jan Kara <jack@suse.cz>

commit 11c514a99bb960941535134f0587102855e8ddee upstream.

Perform basic sanity checks of quota headers to avoid kernel crashes on
corrupted quota files.

CC: stable@vger.kernel.org
Reported-by: syzbot+f816042a7ae2225f25ba@syzkaller.appspotmail.com
Reviewed-by: Andreas Dilger <adilger@dilger.ca>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/quota/quota_v2.c |   19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

--- a/fs/quota/quota_v2.c
+++ b/fs/quota/quota_v2.c
@@ -158,6 +158,25 @@ static int v2_read_file_info(struct supe
 		qinfo->dqi_entry_size = sizeof(struct v2r1_disk_dqblk);
 		qinfo->dqi_ops = &v2r1_qtree_ops;
 	}
+	ret = -EUCLEAN;
+	/* Some sanity checks of the read headers... */
+	if ((loff_t)qinfo->dqi_blocks << qinfo->dqi_blocksize_bits >
+	    i_size_read(sb_dqopt(sb)->files[type])) {
+		quota_error(sb, "Number of blocks too big for quota file size (%llu > %llu).",
+		    (loff_t)qinfo->dqi_blocks << qinfo->dqi_blocksize_bits,
+		    i_size_read(sb_dqopt(sb)->files[type]));
+		goto out;
+	}
+	if (qinfo->dqi_free_blk >= qinfo->dqi_blocks) {
+		quota_error(sb, "Free block number too big (%u >= %u).",
+			    qinfo->dqi_free_blk, qinfo->dqi_blocks);
+		goto out;
+	}
+	if (qinfo->dqi_free_entry >= qinfo->dqi_blocks) {
+		quota_error(sb, "Block with free entry too big (%u >= %u).",
+			    qinfo->dqi_free_entry, qinfo->dqi_blocks);
+		goto out;
+	}
 	ret = 0;
 out:
 	up_read(&dqopt->dqio_sem);



^ permalink raw reply	[flat|nested] 359+ messages in thread

* [PATCH 4.19 093/346] media: msi2500: assign SPI bus number dynamically
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (91 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 4.19 092/346] quota: Sanity-check quota file headers on load Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 4.19 094/346] crypto: af_alg - avoid undefined behavior accessing salg_name Greg Kroah-Hartman
                   ` (255 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Antti Palosaari,
	Mauro Carvalho Chehab, syzbot+c60ddb60b685777d9d59

From: Antti Palosaari <crope@iki.fi>

commit 9c60cc797cf72e95bb39f32316e9f0e5f85435f9 upstream.

SPI bus number must be assigned dynamically for each device, otherwise it
will crash when multiple devices are plugged to system.

Reported-and-tested-by: syzbot+c60ddb60b685777d9d59@syzkaller.appspotmail.com

Cc: stable@vger.kernel.org
Signed-off-by: Antti Palosaari <crope@iki.fi>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/media/usb/msi2500/msi2500.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/media/usb/msi2500/msi2500.c
+++ b/drivers/media/usb/msi2500/msi2500.c
@@ -1250,7 +1250,7 @@ static int msi2500_probe(struct usb_inte
 	}
 
 	dev->master = master;
-	master->bus_num = 0;
+	master->bus_num = -1;
 	master->num_chipselect = 1;
 	master->transfer_one_message = msi2500_transfer_one_message;
 	spi_master_set_devdata(master, dev);



^ permalink raw reply	[flat|nested] 359+ messages in thread

* [PATCH 4.19 094/346] crypto: af_alg - avoid undefined behavior accessing salg_name
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (92 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 4.19 093/346] media: msi2500: assign SPI bus number dynamically Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 4.19 095/346] md: fix a warning caused by a race between concurrent md_ioctl()s Greg Kroah-Hartman
                   ` (254 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, syzbot+92ead4eb8e26a26d465e,
	Eric Biggers, Herbert Xu

From: Eric Biggers <ebiggers@google.com>

commit 92eb6c3060ebe3adf381fd9899451c5b047bb14d upstream.

Commit 3f69cc60768b ("crypto: af_alg - Allow arbitrarily long algorithm
names") made the kernel start accepting arbitrarily long algorithm names
in sockaddr_alg.  However, the actual length of the salg_name field
stayed at the original 64 bytes.

This is broken because the kernel can access indices >= 64 in salg_name,
which is undefined behavior -- even though the memory that is accessed
is still located within the sockaddr structure.  It would only be
defined behavior if the array were properly marked as arbitrary-length
(either by making it a flexible array, which is the recommended way
these days, or by making it an array of length 0 or 1).

We can't simply change salg_name into a flexible array, since that would
break source compatibility with userspace programs that embed
sockaddr_alg into another struct, or (more commonly) declare a
sockaddr_alg like 'struct sockaddr_alg sa = { .salg_name = "foo" };'.

One solution would be to change salg_name into a flexible array only
when '#ifdef __KERNEL__'.  However, that would keep userspace without an
easy way to actually use the longer algorithm names.

Instead, add a new structure 'sockaddr_alg_new' that has the flexible
array field, and expose it to both userspace and the kernel.
Make the kernel use it correctly in alg_bind().

This addresses the syzbot report
"UBSAN: array-index-out-of-bounds in alg_bind"
(https://syzkaller.appspot.com/bug?extid=92ead4eb8e26a26d465e).

Reported-by: syzbot+92ead4eb8e26a26d465e@syzkaller.appspotmail.com
Fixes: 3f69cc60768b ("crypto: af_alg - Allow arbitrarily long algorithm names")
Cc: <stable@vger.kernel.org> # v4.12+
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 crypto/af_alg.c             |   10 +++++++---
 include/uapi/linux/if_alg.h |   16 ++++++++++++++++
 2 files changed, 23 insertions(+), 3 deletions(-)

--- a/crypto/af_alg.c
+++ b/crypto/af_alg.c
@@ -151,7 +151,7 @@ static int alg_bind(struct socket *sock,
 	const u32 allowed = CRYPTO_ALG_KERN_DRIVER_ONLY;
 	struct sock *sk = sock->sk;
 	struct alg_sock *ask = alg_sk(sk);
-	struct sockaddr_alg *sa = (void *)uaddr;
+	struct sockaddr_alg_new *sa = (void *)uaddr;
 	const struct af_alg_type *type;
 	void *private;
 	int err;
@@ -159,7 +159,11 @@ static int alg_bind(struct socket *sock,
 	if (sock->state == SS_CONNECTED)
 		return -EINVAL;
 
-	if (addr_len < sizeof(*sa))
+	BUILD_BUG_ON(offsetof(struct sockaddr_alg_new, salg_name) !=
+		     offsetof(struct sockaddr_alg, salg_name));
+	BUILD_BUG_ON(offsetof(struct sockaddr_alg, salg_name) != sizeof(*sa));
+
+	if (addr_len < sizeof(*sa) + 1)
 		return -EINVAL;
 
 	/* If caller uses non-allowed flag, return error. */
@@ -167,7 +171,7 @@ static int alg_bind(struct socket *sock,
 		return -EINVAL;
 
 	sa->salg_type[sizeof(sa->salg_type) - 1] = 0;
-	sa->salg_name[sizeof(sa->salg_name) + addr_len - sizeof(*sa) - 1] = 0;
+	sa->salg_name[addr_len - sizeof(*sa) - 1] = 0;
 
 	type = alg_get_type(sa->salg_type);
 	if (IS_ERR(type) && PTR_ERR(type) == -ENOENT) {
--- a/include/uapi/linux/if_alg.h
+++ b/include/uapi/linux/if_alg.h
@@ -24,6 +24,22 @@ struct sockaddr_alg {
 	__u8	salg_name[64];
 };
 
+/*
+ * Linux v4.12 and later removed the 64-byte limit on salg_name[]; it's now an
+ * arbitrary-length field.  We had to keep the original struct above for source
+ * compatibility with existing userspace programs, though.  Use the new struct
+ * below if support for very long algorithm names is needed.  To do this,
+ * allocate 'sizeof(struct sockaddr_alg_new) + strlen(algname) + 1' bytes, and
+ * copy algname (including the null terminator) into salg_name.
+ */
+struct sockaddr_alg_new {
+	__u16	salg_family;
+	__u8	salg_type[14];
+	__u32	salg_feat;
+	__u32	salg_mask;
+	__u8	salg_name[];
+};
+
 struct af_alg_iv {
 	__u32	ivlen;
 	__u8	iv[0];



^ permalink raw reply	[flat|nested] 359+ messages in thread

* [PATCH 4.19 095/346] md: fix a warning caused by a race between concurrent md_ioctl()s
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (93 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 4.19 094/346] crypto: af_alg - avoid undefined behavior accessing salg_name Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46   ` Greg Kroah-Hartman
                   ` (253 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, syzbot+1e46a0864c1a6e9bd3d8,
	Dae R. Jeong, Song Liu

From: Dae R. Jeong <dae.r.jeong@kaist.ac.kr>

commit c731b84b51bf7fe83448bea8f56a6d55006b0615 upstream.

Syzkaller reports a warning as belows.
WARNING: CPU: 0 PID: 9647 at drivers/md/md.c:7169
...
Call Trace:
...
RIP: 0010:md_ioctl+0x4017/0x5980 drivers/md/md.c:7169
RSP: 0018:ffff888096027950 EFLAGS: 00010293
RAX: ffff88809322c380 RBX: 0000000000000932 RCX: ffffffff84e266f2
RDX: 0000000000000000 RSI: ffffffff84e299f7 RDI: 0000000000000007
RBP: ffff888096027bc0 R08: ffff88809322c380 R09: ffffed101341a482
R10: ffff888096027940 R11: ffff88809a0d240f R12: 0000000000000932
R13: ffff8880a2c14100 R14: ffff88809a0d2268 R15: ffff88809a0d2408
 __blkdev_driver_ioctl block/ioctl.c:304 [inline]
 blkdev_ioctl+0xece/0x1c10 block/ioctl.c:606
 block_ioctl+0xee/0x130 fs/block_dev.c:1930
 vfs_ioctl fs/ioctl.c:46 [inline]
 file_ioctl fs/ioctl.c:509 [inline]
 do_vfs_ioctl+0xd5f/0x1380 fs/ioctl.c:696
 ksys_ioctl+0xab/0xd0 fs/ioctl.c:713
 __do_sys_ioctl fs/ioctl.c:720 [inline]
 __se_sys_ioctl fs/ioctl.c:718 [inline]
 __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:718
 do_syscall_64+0xfd/0x680 arch/x86/entry/common.c:301
 entry_SYSCALL_64_after_hwframe+0x49/0xbe

This is caused by a race between two concurrenct md_ioctl()s closing
the array.
CPU1 (md_ioctl())                   CPU2 (md_ioctl())
------                              ------
set_bit(MD_CLOSING, &mddev->flags);
did_set_md_closing = true;
                                    WARN_ON_ONCE(test_bit(MD_CLOSING,
                                            &mddev->flags));
if(did_set_md_closing)
    clear_bit(MD_CLOSING, &mddev->flags);

Fix the warning by returning immediately if the MD_CLOSING bit is set
in &mddev->flags which indicates that the array is being closed.

Fixes: 065e519e71b2 ("md: MD_CLOSING needs to be cleared after called md_set_readonly or do_md_stop")
Reported-by: syzbot+1e46a0864c1a6e9bd3d8@syzkaller.appspotmail.com
Cc: stable@vger.kernel.org
Signed-off-by: Dae R. Jeong <dae.r.jeong@kaist.ac.kr>
Signed-off-by: Song Liu <songliubraving@fb.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/md/md.c |    7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -7214,8 +7214,11 @@ static int md_ioctl(struct block_device
 			err = -EBUSY;
 			goto out;
 		}
-		WARN_ON_ONCE(test_bit(MD_CLOSING, &mddev->flags));
-		set_bit(MD_CLOSING, &mddev->flags);
+		if (test_and_set_bit(MD_CLOSING, &mddev->flags)) {
+			mutex_unlock(&mddev->open_mutex);
+			err = -EBUSY;
+			goto out;
+		}
 		did_set_md_closing = true;
 		mutex_unlock(&mddev->open_mutex);
 		sync_blockdev(bdev);



^ permalink raw reply	[flat|nested] 359+ messages in thread

* [PATCH 4.19 096/346] perf cs-etm: Change tuple from traceID-CPU# to traceID-metadata
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
@ 2020-12-28 12:46   ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 4.19 002/346] x86/lib: Change .weak to SYM_FUNC_START_WEAK for arch/x86/lib/mem*_64.S Greg Kroah-Hartman
                     ` (347 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Leo Yan, Mathieu Poirier,
	Alexander Shishkin, Jiri Olsa, Mike Leach, Namhyung Kim,
	Robert Walker, Suzuki K Poulouse, coresight ml, linux-arm-kernel,
	Arnaldo Carvalho de Melo, Salvatore Bonaccorso

From: Leo Yan <leo.yan@linaro.org>

commit 95c6fe970a0160cb770c5dce9f80311b42d030c0 upstream.

If packet processing wants to know the packet is bound with which ETM
version, it needs to access metadata to decide that based on metadata
magic number; but we cannot simply to use CPU logic ID number as index
to access metadata sequential array, especially when system have
hotplugged off CPUs, the metadata array are only allocated for online
CPUs but not offline CPUs, so the CPU logic number doesn't match with
its index in the array.

This patch is to change tuple from traceID-CPU# to traceID-metadata,
thus it can use the tuple to retrieve metadata pointer according to
traceID.

For safe accessing metadata fields, this patch provides helper function
cs_etm__get_cpu() which is used to return CPU number according to
traceID; cs_etm_decoder__buffer_packet() is the first consumer for this
helper function.

Signed-off-by: Leo Yan <leo.yan@linaro.org>
Reviewed-by: Mathieu Poirier <mathieu.poirier@linaro.org>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Mike Leach <mike.leach@linaro.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Robert Walker <robert.walker@arm.com>
Cc: Suzuki K Poulouse <suzuki.poulose@arm.com>
Cc: coresight ml <coresight@lists.linaro.org>
Cc: linux-arm-kernel@lists.infradead.org
Link: http://lkml.kernel.org/r/20190129122842.32041-6-leo.yan@linaro.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
[Salvatore Bonaccorso: Adjust for context changes in
tools/perf/util/cs-etm-decoder/cs-etm-decoder.c]
Signed-off-by: Salvatore Bonaccorso <carnil@debian.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 tools/perf/util/cs-etm-decoder/cs-etm-decoder.c |    8 ++-----
 tools/perf/util/cs-etm.c                        |   26 ++++++++++++++++++------
 tools/perf/util/cs-etm.h                        |    9 +++++++-
 3 files changed, 31 insertions(+), 12 deletions(-)

--- a/tools/perf/util/cs-etm-decoder/cs-etm-decoder.c
+++ b/tools/perf/util/cs-etm-decoder/cs-etm-decoder.c
@@ -278,14 +278,12 @@ cs_etm_decoder__buffer_packet(struct cs_
 			      enum cs_etm_sample_type sample_type)
 {
 	u32 et = 0;
-	struct int_node *inode = NULL;
+	int cpu;
 
 	if (decoder->packet_count >= MAX_BUFFER - 1)
 		return OCSD_RESP_FATAL_SYS_ERR;
 
-	/* Search the RB tree for the cpu associated with this traceID */
-	inode = intlist__find(traceid_list, trace_chan_id);
-	if (!inode)
+	if (cs_etm__get_cpu(trace_chan_id, &cpu) < 0)
 		return OCSD_RESP_FATAL_SYS_ERR;
 
 	et = decoder->tail;
@@ -296,7 +294,7 @@ cs_etm_decoder__buffer_packet(struct cs_
 	decoder->packet_buffer[et].sample_type = sample_type;
 	decoder->packet_buffer[et].exc = false;
 	decoder->packet_buffer[et].exc_ret = false;
-	decoder->packet_buffer[et].cpu = *((int *)inode->priv);
+	decoder->packet_buffer[et].cpu = cpu;
 	decoder->packet_buffer[et].start_addr = CS_ETM_INVAL_ADDR;
 	decoder->packet_buffer[et].end_addr = CS_ETM_INVAL_ADDR;
 
--- a/tools/perf/util/cs-etm.c
+++ b/tools/perf/util/cs-etm.c
@@ -91,6 +91,20 @@ static int cs_etm__update_queues(struct
 static int cs_etm__process_timeless_queues(struct cs_etm_auxtrace *etm,
 					   pid_t tid, u64 time_);
 
+int cs_etm__get_cpu(u8 trace_chan_id, int *cpu)
+{
+	struct int_node *inode;
+	u64 *metadata;
+
+	inode = intlist__find(traceid_list, trace_chan_id);
+	if (!inode)
+		return -EINVAL;
+
+	metadata = inode->priv;
+	*cpu = (int)metadata[CS_ETM_CPU];
+	return 0;
+}
+
 static void cs_etm__packet_dump(const char *pkt_string)
 {
 	const char *color = PERF_COLOR_BLUE;
@@ -230,7 +244,7 @@ static void cs_etm__free(struct perf_ses
 	cs_etm__free_events(session);
 	session->auxtrace = NULL;
 
-	/* First remove all traceID/CPU# nodes for the RB tree */
+	/* First remove all traceID/metadata nodes for the RB tree */
 	intlist__for_each_entry_safe(inode, tmp, traceid_list)
 		intlist__remove(traceid_list, inode);
 	/* Then the RB tree itself */
@@ -1316,9 +1330,9 @@ int cs_etm__process_auxtrace_info(union
 				    0xffffffff);
 
 	/*
-	 * Create an RB tree for traceID-CPU# tuple. Since the conversion has
-	 * to be made for each packet that gets decoded, optimizing access in
-	 * anything other than a sequential array is worth doing.
+	 * Create an RB tree for traceID-metadata tuple.  Since the conversion
+	 * has to be made for each packet that gets decoded, optimizing access
+	 * in anything other than a sequential array is worth doing.
 	 */
 	traceid_list = intlist__new(NULL);
 	if (!traceid_list) {
@@ -1384,8 +1398,8 @@ int cs_etm__process_auxtrace_info(union
 			err = -EINVAL;
 			goto err_free_metadata;
 		}
-		/* All good, associate the traceID with the CPU# */
-		inode->priv = &metadata[j][CS_ETM_CPU];
+		/* All good, associate the traceID with the metadata pointer */
+		inode->priv = metadata[j];
 	}
 
 	/*
--- a/tools/perf/util/cs-etm.h
+++ b/tools/perf/util/cs-etm.h
@@ -53,7 +53,7 @@ enum {
 	CS_ETMV4_PRIV_MAX,
 };
 
-/* RB tree for quick conversion between traceID and CPUs */
+/* RB tree for quick conversion between traceID and metadata pointers */
 struct intlist *traceid_list;
 
 #define KiB(x) ((x) * 1024)
@@ -69,6 +69,7 @@ static const u64 __perf_cs_etmv4_magic
 #ifdef HAVE_CSTRACE_SUPPORT
 int cs_etm__process_auxtrace_info(union perf_event *event,
 				  struct perf_session *session);
+int cs_etm__get_cpu(u8 trace_chan_id, int *cpu);
 #else
 static inline int
 cs_etm__process_auxtrace_info(union perf_event *event __maybe_unused,
@@ -76,6 +77,12 @@ cs_etm__process_auxtrace_info(union perf
 {
 	return -1;
 }
+
+static inline int cs_etm__get_cpu(u8 trace_chan_id __maybe_unused,
+				  int *cpu __maybe_unused)
+{
+	return -1;
+}
 #endif
 
 #endif



^ permalink raw reply	[flat|nested] 359+ messages in thread

* [PATCH 4.19 096/346] perf cs-etm: Change tuple from traceID-CPU# to traceID-metadata
@ 2020-12-28 12:46   ` Greg Kroah-Hartman
  0 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Mathieu Poirier, Suzuki K Poulouse, Alexander Shishkin,
	Greg Kroah-Hartman, coresight ml, stable,
	Arnaldo Carvalho de Melo, Leo Yan, Namhyung Kim, Robert Walker,
	Salvatore Bonaccorso, Jiri Olsa, linux-arm-kernel, Mike Leach

From: Leo Yan <leo.yan@linaro.org>

commit 95c6fe970a0160cb770c5dce9f80311b42d030c0 upstream.

If packet processing wants to know the packet is bound with which ETM
version, it needs to access metadata to decide that based on metadata
magic number; but we cannot simply to use CPU logic ID number as index
to access metadata sequential array, especially when system have
hotplugged off CPUs, the metadata array are only allocated for online
CPUs but not offline CPUs, so the CPU logic number doesn't match with
its index in the array.

This patch is to change tuple from traceID-CPU# to traceID-metadata,
thus it can use the tuple to retrieve metadata pointer according to
traceID.

For safe accessing metadata fields, this patch provides helper function
cs_etm__get_cpu() which is used to return CPU number according to
traceID; cs_etm_decoder__buffer_packet() is the first consumer for this
helper function.

Signed-off-by: Leo Yan <leo.yan@linaro.org>
Reviewed-by: Mathieu Poirier <mathieu.poirier@linaro.org>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Mike Leach <mike.leach@linaro.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Robert Walker <robert.walker@arm.com>
Cc: Suzuki K Poulouse <suzuki.poulose@arm.com>
Cc: coresight ml <coresight@lists.linaro.org>
Cc: linux-arm-kernel@lists.infradead.org
Link: http://lkml.kernel.org/r/20190129122842.32041-6-leo.yan@linaro.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
[Salvatore Bonaccorso: Adjust for context changes in
tools/perf/util/cs-etm-decoder/cs-etm-decoder.c]
Signed-off-by: Salvatore Bonaccorso <carnil@debian.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 tools/perf/util/cs-etm-decoder/cs-etm-decoder.c |    8 ++-----
 tools/perf/util/cs-etm.c                        |   26 ++++++++++++++++++------
 tools/perf/util/cs-etm.h                        |    9 +++++++-
 3 files changed, 31 insertions(+), 12 deletions(-)

--- a/tools/perf/util/cs-etm-decoder/cs-etm-decoder.c
+++ b/tools/perf/util/cs-etm-decoder/cs-etm-decoder.c
@@ -278,14 +278,12 @@ cs_etm_decoder__buffer_packet(struct cs_
 			      enum cs_etm_sample_type sample_type)
 {
 	u32 et = 0;
-	struct int_node *inode = NULL;
+	int cpu;
 
 	if (decoder->packet_count >= MAX_BUFFER - 1)
 		return OCSD_RESP_FATAL_SYS_ERR;
 
-	/* Search the RB tree for the cpu associated with this traceID */
-	inode = intlist__find(traceid_list, trace_chan_id);
-	if (!inode)
+	if (cs_etm__get_cpu(trace_chan_id, &cpu) < 0)
 		return OCSD_RESP_FATAL_SYS_ERR;
 
 	et = decoder->tail;
@@ -296,7 +294,7 @@ cs_etm_decoder__buffer_packet(struct cs_
 	decoder->packet_buffer[et].sample_type = sample_type;
 	decoder->packet_buffer[et].exc = false;
 	decoder->packet_buffer[et].exc_ret = false;
-	decoder->packet_buffer[et].cpu = *((int *)inode->priv);
+	decoder->packet_buffer[et].cpu = cpu;
 	decoder->packet_buffer[et].start_addr = CS_ETM_INVAL_ADDR;
 	decoder->packet_buffer[et].end_addr = CS_ETM_INVAL_ADDR;
 
--- a/tools/perf/util/cs-etm.c
+++ b/tools/perf/util/cs-etm.c
@@ -91,6 +91,20 @@ static int cs_etm__update_queues(struct
 static int cs_etm__process_timeless_queues(struct cs_etm_auxtrace *etm,
 					   pid_t tid, u64 time_);
 
+int cs_etm__get_cpu(u8 trace_chan_id, int *cpu)
+{
+	struct int_node *inode;
+	u64 *metadata;
+
+	inode = intlist__find(traceid_list, trace_chan_id);
+	if (!inode)
+		return -EINVAL;
+
+	metadata = inode->priv;
+	*cpu = (int)metadata[CS_ETM_CPU];
+	return 0;
+}
+
 static void cs_etm__packet_dump(const char *pkt_string)
 {
 	const char *color = PERF_COLOR_BLUE;
@@ -230,7 +244,7 @@ static void cs_etm__free(struct perf_ses
 	cs_etm__free_events(session);
 	session->auxtrace = NULL;
 
-	/* First remove all traceID/CPU# nodes for the RB tree */
+	/* First remove all traceID/metadata nodes for the RB tree */
 	intlist__for_each_entry_safe(inode, tmp, traceid_list)
 		intlist__remove(traceid_list, inode);
 	/* Then the RB tree itself */
@@ -1316,9 +1330,9 @@ int cs_etm__process_auxtrace_info(union
 				    0xffffffff);
 
 	/*
-	 * Create an RB tree for traceID-CPU# tuple. Since the conversion has
-	 * to be made for each packet that gets decoded, optimizing access in
-	 * anything other than a sequential array is worth doing.
+	 * Create an RB tree for traceID-metadata tuple.  Since the conversion
+	 * has to be made for each packet that gets decoded, optimizing access
+	 * in anything other than a sequential array is worth doing.
 	 */
 	traceid_list = intlist__new(NULL);
 	if (!traceid_list) {
@@ -1384,8 +1398,8 @@ int cs_etm__process_auxtrace_info(union
 			err = -EINVAL;
 			goto err_free_metadata;
 		}
-		/* All good, associate the traceID with the CPU# */
-		inode->priv = &metadata[j][CS_ETM_CPU];
+		/* All good, associate the traceID with the metadata pointer */
+		inode->priv = metadata[j];
 	}
 
 	/*
--- a/tools/perf/util/cs-etm.h
+++ b/tools/perf/util/cs-etm.h
@@ -53,7 +53,7 @@ enum {
 	CS_ETMV4_PRIV_MAX,
 };
 
-/* RB tree for quick conversion between traceID and CPUs */
+/* RB tree for quick conversion between traceID and metadata pointers */
 struct intlist *traceid_list;
 
 #define KiB(x) ((x) * 1024)
@@ -69,6 +69,7 @@ static const u64 __perf_cs_etmv4_magic
 #ifdef HAVE_CSTRACE_SUPPORT
 int cs_etm__process_auxtrace_info(union perf_event *event,
 				  struct perf_session *session);
+int cs_etm__get_cpu(u8 trace_chan_id, int *cpu);
 #else
 static inline int
 cs_etm__process_auxtrace_info(union perf_event *event __maybe_unused,
@@ -76,6 +77,12 @@ cs_etm__process_auxtrace_info(union perf
 {
 	return -1;
 }
+
+static inline int cs_etm__get_cpu(u8 trace_chan_id __maybe_unused,
+				  int *cpu __maybe_unused)
+{
+	return -1;
+}
 #endif
 
 #endif



_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

^ permalink raw reply	[flat|nested] 359+ messages in thread

* [PATCH 4.19 097/346] perf cs-etm: Move definition of traceid_list global variable from header file
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
@ 2020-12-28 12:46   ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 4.19 002/346] x86/lib: Change .weak to SYM_FUNC_START_WEAK for arch/x86/lib/mem*_64.S Greg Kroah-Hartman
                     ` (347 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Thomas Backlund, Leo Yan,
	Mathieu Poirier, Mike Leach, Alexander Shishkin, Jiri Olsa,
	Mark Rutland, Namhyung Kim, Peter Zijlstra, Suzuki Poulouse,
	Tor Jeremiassen, linux-arm-kernel, Arnaldo Carvalho de Melo,
	Salvatore Bonaccorso

From: Leo Yan <leo.yan@linaro.org>

commit 168200b6d6ea0cb5765943ec5da5b8149701f36a upstream.

The variable 'traceid_list' is defined in the header file cs-etm.h,
if multiple C files include cs-etm.h the compiler might complaint for
multiple definition of 'traceid_list'.

To fix multiple definition error, move the definition of 'traceid_list'
into cs-etm.c.

Fixes: cd8bfd8c973e ("perf tools: Add processing of coresight metadata")
Reported-by: Thomas Backlund <tmb@mageia.org>
Signed-off-by: Leo Yan <leo.yan@linaro.org>
Reviewed-by: Mathieu Poirier <mathieu.poirier@linaro.org>
Reviewed-by: Mike Leach <mike.leach@linaro.org>
Tested-by: Mike Leach <mike.leach@linaro.org>
Tested-by: Thomas Backlund <tmb@mageia.org>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Suzuki Poulouse <suzuki.poulose@arm.com>
Cc: Tor Jeremiassen <tor@ti.com>
Cc: linux-arm-kernel@lists.infradead.org
Link: http://lore.kernel.org/lkml/20200505133642.4756-1-leo.yan@linaro.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Salvatore Bonaccorso <carnil@debian.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 tools/perf/util/cs-etm.c |    3 +++
 tools/perf/util/cs-etm.h |    3 ---
 2 files changed, 3 insertions(+), 3 deletions(-)

--- a/tools/perf/util/cs-etm.c
+++ b/tools/perf/util/cs-etm.c
@@ -87,6 +87,9 @@ struct cs_etm_queue {
 	struct cs_etm_packet *packet;
 };
 
+/* RB tree for quick conversion between traceID and metadata pointers */
+static struct intlist *traceid_list;
+
 static int cs_etm__update_queues(struct cs_etm_auxtrace *etm);
 static int cs_etm__process_timeless_queues(struct cs_etm_auxtrace *etm,
 					   pid_t tid, u64 time_);
--- a/tools/perf/util/cs-etm.h
+++ b/tools/perf/util/cs-etm.h
@@ -53,9 +53,6 @@ enum {
 	CS_ETMV4_PRIV_MAX,
 };
 
-/* RB tree for quick conversion between traceID and metadata pointers */
-struct intlist *traceid_list;
-
 #define KiB(x) ((x) * 1024)
 #define MiB(x) ((x) * 1024 * 1024)
 



^ permalink raw reply	[flat|nested] 359+ messages in thread

* [PATCH 4.19 097/346] perf cs-etm: Move definition of traceid_list global variable from header file
@ 2020-12-28 12:46   ` Greg Kroah-Hartman
  0 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Mark Rutland, Mathieu Poirier, Suzuki Poulouse,
	Alexander Shishkin, Greg Kroah-Hartman, stable, Tor Jeremiassen,
	Arnaldo Carvalho de Melo, Peter Zijlstra, Leo Yan, Namhyung Kim,
	Salvatore Bonaccorso, Jiri Olsa, Thomas Backlund,
	linux-arm-kernel, Mike Leach

From: Leo Yan <leo.yan@linaro.org>

commit 168200b6d6ea0cb5765943ec5da5b8149701f36a upstream.

The variable 'traceid_list' is defined in the header file cs-etm.h,
if multiple C files include cs-etm.h the compiler might complaint for
multiple definition of 'traceid_list'.

To fix multiple definition error, move the definition of 'traceid_list'
into cs-etm.c.

Fixes: cd8bfd8c973e ("perf tools: Add processing of coresight metadata")
Reported-by: Thomas Backlund <tmb@mageia.org>
Signed-off-by: Leo Yan <leo.yan@linaro.org>
Reviewed-by: Mathieu Poirier <mathieu.poirier@linaro.org>
Reviewed-by: Mike Leach <mike.leach@linaro.org>
Tested-by: Mike Leach <mike.leach@linaro.org>
Tested-by: Thomas Backlund <tmb@mageia.org>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Suzuki Poulouse <suzuki.poulose@arm.com>
Cc: Tor Jeremiassen <tor@ti.com>
Cc: linux-arm-kernel@lists.infradead.org
Link: http://lore.kernel.org/lkml/20200505133642.4756-1-leo.yan@linaro.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Salvatore Bonaccorso <carnil@debian.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 tools/perf/util/cs-etm.c |    3 +++
 tools/perf/util/cs-etm.h |    3 ---
 2 files changed, 3 insertions(+), 3 deletions(-)

--- a/tools/perf/util/cs-etm.c
+++ b/tools/perf/util/cs-etm.c
@@ -87,6 +87,9 @@ struct cs_etm_queue {
 	struct cs_etm_packet *packet;
 };
 
+/* RB tree for quick conversion between traceID and metadata pointers */
+static struct intlist *traceid_list;
+
 static int cs_etm__update_queues(struct cs_etm_auxtrace *etm);
 static int cs_etm__process_timeless_queues(struct cs_etm_auxtrace *etm,
 					   pid_t tid, u64 time_);
--- a/tools/perf/util/cs-etm.h
+++ b/tools/perf/util/cs-etm.h
@@ -53,9 +53,6 @@ enum {
 	CS_ETMV4_PRIV_MAX,
 };
 
-/* RB tree for quick conversion between traceID and metadata pointers */
-struct intlist *traceid_list;
-
 #define KiB(x) ((x) * 1024)
 #define MiB(x) ((x) * 1024 * 1024)
 



_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

^ permalink raw reply	[flat|nested] 359+ messages in thread

* [PATCH 4.19 098/346] drm/gma500: fix double free of gma_connector
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (96 preceding siblings ...)
  2020-12-28 12:46   ` Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 4.19 099/346] drm/tve200: Fix handling of platform_get_irq() error Greg Kroah-Hartman
                   ` (250 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Tom Rix, Daniel Vetter, Sasha Levin

From: Tom Rix <trix@redhat.com>

[ Upstream commit 4e19d51ca5b28a1d435a844c7b2a8e1b1b6fa237 ]

clang static analysis reports this problem:

cdv_intel_dp.c:2101:2: warning: Attempt to free released memory
        kfree(gma_connector);
        ^~~~~~~~~~~~~~~~~~~~

In cdv_intel_dp_init() when the call to cdv_intel_edp_panel_vdd_off()
fails, the handler calls cdv_intel_dp_destroy(connector) which does
the first free of gma_connector. So adjust the goto label and skip
the second free.

Fixes: d112a8163f83 ("gma500/cdv: Add eDP support")
Signed-off-by: Tom Rix <trix@redhat.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20201003193928.18869-1-trix@redhat.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/gma500/cdv_intel_dp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/gma500/cdv_intel_dp.c b/drivers/gpu/drm/gma500/cdv_intel_dp.c
index 05eba6dec5ebf..3e8b804cf7e7e 100644
--- a/drivers/gpu/drm/gma500/cdv_intel_dp.c
+++ b/drivers/gpu/drm/gma500/cdv_intel_dp.c
@@ -2124,7 +2124,7 @@ cdv_intel_dp_init(struct drm_device *dev, struct psb_intel_mode_device *mode_dev
 			DRM_INFO("failed to retrieve link info, disabling eDP\n");
 			cdv_intel_dp_encoder_destroy(encoder);
 			cdv_intel_dp_destroy(connector);
-			goto err_priv;
+			goto err_connector;
 		} else {
         		DRM_DEBUG_KMS("DPCD: Rev=%x LN_Rate=%x LN_CNT=%x LN_DOWNSP=%x\n",
 				intel_dp->dpcd[0], intel_dp->dpcd[1], 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 099/346] drm/tve200: Fix handling of platform_get_irq() error
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (97 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 4.19 098/346] drm/gma500: fix double free of gma_connector Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 4.19 100/346] soc: renesas: rmobile-sysc: Fix some leaks in rmobile_init_pm_domains() Greg Kroah-Hartman
                   ` (249 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Krzysztof Kozlowski, Linus Walleij,
	Sam Ravnborg, Sasha Levin

From: Krzysztof Kozlowski <krzk@kernel.org>

[ Upstream commit 77bb5aaf2bb8180e7d1bb70b4df306f511707a7d ]

platform_get_irq() returns -ERRNO on error.  In such case comparison
to 0 would pass the check.

Fixes: 179c02fe90a4 ("drm/tve200: Add new driver for TVE200")
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Acked-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20200827071107.27429-2-krzk@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/tve200/tve200_drv.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/tve200/tve200_drv.c b/drivers/gpu/drm/tve200/tve200_drv.c
index ac344ddb23bc8..f93384c232066 100644
--- a/drivers/gpu/drm/tve200/tve200_drv.c
+++ b/drivers/gpu/drm/tve200/tve200_drv.c
@@ -223,8 +223,8 @@ static int tve200_probe(struct platform_device *pdev)
 	}
 
 	irq = platform_get_irq(pdev, 0);
-	if (!irq) {
-		ret = -EINVAL;
+	if (irq < 0) {
+		ret = irq;
 		goto clk_disable;
 	}
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 100/346] soc: renesas: rmobile-sysc: Fix some leaks in rmobile_init_pm_domains()
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (98 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 4.19 099/346] drm/tve200: Fix handling of platform_get_irq() error Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 4.19 101/346] soc: mediatek: Check if power domains can be powered on at boot time Greg Kroah-Hartman
                   ` (248 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Geert Uytterhoeven,
	Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit cf25d802e029c31efac8bdc979236927f37183bd ]

This code needs to call iounmap() on one error path.

Fixes: 2173fc7cb681 ("ARM: shmobile: R-Mobile: Add DT support for PM domains")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/20200923113142.GC1473821@mwanda
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/mach-shmobile/pm-rmobile.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/arm/mach-shmobile/pm-rmobile.c b/arch/arm/mach-shmobile/pm-rmobile.c
index e348bcfe389da..cb8b02a1abe26 100644
--- a/arch/arm/mach-shmobile/pm-rmobile.c
+++ b/arch/arm/mach-shmobile/pm-rmobile.c
@@ -330,6 +330,7 @@ static int __init rmobile_init_pm_domains(void)
 
 		pmd = of_get_child_by_name(np, "pm-domains");
 		if (!pmd) {
+			iounmap(base);
 			pr_warn("%pOF lacks pm-domains node\n", np);
 			continue;
 		}
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 101/346] soc: mediatek: Check if power domains can be powered on at boot time
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (99 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 4.19 100/346] soc: renesas: rmobile-sysc: Fix some leaks in rmobile_init_pm_domains() Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 4.19 102/346] soc: qcom: geni: More properly switch to DMA mode Greg Kroah-Hartman
                   ` (247 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Nicolas Boichat, Matthias Brugger,
	Sasha Levin

From: Nicolas Boichat <drinkcat@chromium.org>

[ Upstream commit 4007844b05815717f522c7ea9914e24ad0ff6c79 ]

In the error case, where a power domain cannot be powered on
successfully at boot time (in mtk_register_power_domains),
pm_genpd_init would still be called with is_off=false, and the
system would later try to disable the power domain again, triggering
warnings as disabled clocks are disabled again (and other potential
issues).

Also print a warning splat in that case, as this should never
happen.

Fixes: c84e358718a66f7 ("soc: Mediatek: Add SCPSYS power domain driver")
Signed-off-by: Nicolas Boichat <drinkcat@chromium.org>
Link: https://lore.kernel.org/r/20200928113107.v2.1.I5e6f8c262031d0451fe7241b744f4f3111c1ce71@changeid
Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/soc/mediatek/mtk-scpsys.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/soc/mediatek/mtk-scpsys.c b/drivers/soc/mediatek/mtk-scpsys.c
index 5b24bb4bfbf66..ef54f1638d207 100644
--- a/drivers/soc/mediatek/mtk-scpsys.c
+++ b/drivers/soc/mediatek/mtk-scpsys.c
@@ -454,6 +454,7 @@ static void mtk_register_power_domains(struct platform_device *pdev,
 	for (i = 0; i < num; i++) {
 		struct scp_domain *scpd = &scp->domains[i];
 		struct generic_pm_domain *genpd = &scpd->genpd;
+		bool on;
 
 		/*
 		 * Initially turn on all domains to make the domains usable
@@ -461,9 +462,9 @@ static void mtk_register_power_domains(struct platform_device *pdev,
 		 * software.  The unused domains will be switched off during
 		 * late_init time.
 		 */
-		genpd->power_on(genpd);
+		on = !WARN_ON(genpd->power_on(genpd) < 0);
 
-		pm_genpd_init(genpd, NULL, false);
+		pm_genpd_init(genpd, NULL, !on);
 	}
 
 	/*
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 102/346] soc: qcom: geni: More properly switch to DMA mode
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (100 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 4.19 101/346] soc: mediatek: Check if power domains can be powered on at boot time Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 4.19 103/346] RDMA/bnxt_re: Set queue pair state when being queried Greg Kroah-Hartman
                   ` (246 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Douglas Anderson, Stephen Boyd,
	Akash Asthana, Dmitry Baryshkov, Bjorn Andersson, Sasha Levin

From: Douglas Anderson <dianders@chromium.org>

[ Upstream commit 4b6ea87be44ef34732846fc71e44c41125f0c4fa ]

On geni-i2c transfers using DMA, it was seen that if you program the
command (I2C_READ) before calling geni_se_rx_dma_prep() that it could
cause interrupts to fire.  If we get unlucky, these interrupts can
just keep firing (and not be handled) blocking further progress and
hanging the system.

In commit 02b9aec59243 ("i2c: i2c-qcom-geni: Fix DMA transfer race")
we avoided that by making sure we didn't program the command until
after geni_se_rx_dma_prep() was called.  While that avoided the
problems, it also turns out to be invalid.  At least in the TX case we
started seeing sporadic corrupted transfers.  This is easily seen by
adding an msleep() between the DMA prep and the writing of the
command, which makes the problem worse.  That means we need to revert
that commit and find another way to fix the bogus IRQs.

Specifically, after reverting commit 02b9aec59243 ("i2c:
i2c-qcom-geni: Fix DMA transfer race"), I put some traces in.  I found
that the when the interrupts were firing like crazy:
- "m_stat" had bits for M_RX_IRQ_EN, M_RX_FIFO_WATERMARK_EN set.
- "dma" was set.

Further debugging showed that I could make the problem happen more
reliably by adding an "msleep(1)" any time after geni_se_setup_m_cmd()
ran up until geni_se_rx_dma_prep() programmed the length.

A rather simple fix is to change geni_se_select_dma_mode() so it's a
true inverse of geni_se_select_fifo_mode() and disables all the FIFO
related interrupts.  Now the problematic interrupts can't fire and we
can program things in the correct order without worrying.

As part of this, let's also change the writel_relaxed() in the prepare
function to a writel() so that our DMA is guaranteed to be prepared
now that we can't rely on geni_se_setup_m_cmd()'s writel().

NOTE: the only current user of GENI_SE_DMA in mainline is i2c.

Fixes: 37692de5d523 ("i2c: i2c-qcom-geni: Add bus driver for the Qualcomm GENI I2C controller")
Fixes: 02b9aec59243 ("i2c: i2c-qcom-geni: Fix DMA transfer race")
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Reviewed-by: Stephen Boyd <swboyd@chromium.org>
Reviewed-by: Akash Asthana <akashast@codeaurora.org>
Tested-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Link: https://lore.kernel.org/r/20201013142448.v2.1.Ifdb1b69fa3367b81118e16e9e4e63299980ca798@changeid
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/soc/qcom/qcom-geni-se.c | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/drivers/soc/qcom/qcom-geni-se.c b/drivers/soc/qcom/qcom-geni-se.c
index ee89ffb6dde84..7369b061929bb 100644
--- a/drivers/soc/qcom/qcom-geni-se.c
+++ b/drivers/soc/qcom/qcom-geni-se.c
@@ -275,6 +275,7 @@ static void geni_se_select_fifo_mode(struct geni_se *se)
 
 static void geni_se_select_dma_mode(struct geni_se *se)
 {
+	u32 proto = geni_se_read_proto(se);
 	u32 val;
 
 	writel_relaxed(0, se->base + SE_GSI_EVENT_EN);
@@ -284,6 +285,18 @@ static void geni_se_select_dma_mode(struct geni_se *se)
 	writel_relaxed(0xffffffff, se->base + SE_DMA_RX_IRQ_CLR);
 	writel_relaxed(0xffffffff, se->base + SE_IRQ_EN);
 
+	val = readl_relaxed(se->base + SE_GENI_M_IRQ_EN);
+	if (proto != GENI_SE_UART) {
+		val &= ~(M_CMD_DONE_EN | M_TX_FIFO_WATERMARK_EN);
+		val &= ~(M_RX_FIFO_WATERMARK_EN | M_RX_FIFO_LAST_EN);
+	}
+	writel_relaxed(val, se->base + SE_GENI_M_IRQ_EN);
+
+	val = readl_relaxed(se->base + SE_GENI_S_IRQ_EN);
+	if (proto != GENI_SE_UART)
+		val &= ~S_CMD_DONE_EN;
+	writel_relaxed(val, se->base + SE_GENI_S_IRQ_EN);
+
 	val = readl_relaxed(se->base + SE_GENI_DMA_MODE_EN);
 	val |= GENI_DMA_MODE_EN;
 	writel_relaxed(val, se->base + SE_GENI_DMA_MODE_EN);
@@ -633,7 +646,7 @@ int geni_se_tx_dma_prep(struct geni_se *se, void *buf, size_t len,
 	writel_relaxed(lower_32_bits(*iova), se->base + SE_DMA_TX_PTR_L);
 	writel_relaxed(upper_32_bits(*iova), se->base + SE_DMA_TX_PTR_H);
 	writel_relaxed(GENI_SE_DMA_EOT_BUF, se->base + SE_DMA_TX_ATTR);
-	writel_relaxed(len, se->base + SE_DMA_TX_LEN);
+	writel(len, se->base + SE_DMA_TX_LEN);
 	return 0;
 }
 EXPORT_SYMBOL(geni_se_tx_dma_prep);
@@ -667,7 +680,7 @@ int geni_se_rx_dma_prep(struct geni_se *se, void *buf, size_t len,
 	writel_relaxed(upper_32_bits(*iova), se->base + SE_DMA_RX_PTR_H);
 	/* RX does not have EOT buffer type bit. So just reset RX_ATTR */
 	writel_relaxed(0, se->base + SE_DMA_RX_ATTR);
-	writel_relaxed(len, se->base + SE_DMA_RX_LEN);
+	writel(len, se->base + SE_DMA_RX_LEN);
 	return 0;
 }
 EXPORT_SYMBOL(geni_se_rx_dma_prep);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 103/346] RDMA/bnxt_re: Set queue pair state when being queried
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (101 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 4.19 102/346] soc: qcom: geni: More properly switch to DMA mode Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 4.19 104/346] selinux: fix error initialization in inode_doinit_with_dentry() Greg Kroah-Hartman
                   ` (245 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Kamal Heib, Selvin Xavier,
	Jason Gunthorpe, Sasha Levin

From: Kamal Heib <kamalheib1@gmail.com>

[ Upstream commit 53839b51a7671eeb3fb44d479d541cf3a0f2dd45 ]

The API for ib_query_qp requires the driver to set cur_qp_state on return,
add the missing set.

Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver")
Link: https://lore.kernel.org/r/20201021114952.38876-1-kamalheib1@gmail.com
Signed-off-by: Kamal Heib <kamalheib1@gmail.com>
Acked-by: Selvin Xavier <selvin.xavier@broadcom.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/hw/bnxt_re/ib_verbs.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
index 957da3ffe593c..f8c9caa8aad6d 100644
--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c
+++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
@@ -1838,6 +1838,7 @@ int bnxt_re_query_qp(struct ib_qp *ib_qp, struct ib_qp_attr *qp_attr,
 		goto out;
 	}
 	qp_attr->qp_state = __to_ib_qp_state(qplib_qp->state);
+	qp_attr->cur_qp_state = __to_ib_qp_state(qplib_qp->cur_qp_state);
 	qp_attr->en_sqd_async_notify = qplib_qp->en_sqd_async_notify ? 1 : 0;
 	qp_attr->qp_access_flags = __to_ib_access_flags(qplib_qp->access);
 	qp_attr->pkey_index = qplib_qp->pkey_index;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 104/346] selinux: fix error initialization in inode_doinit_with_dentry()
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (102 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 4.19 103/346] RDMA/bnxt_re: Set queue pair state when being queried Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 4.19 105/346] ARM: dts: aspeed: s2600wf: Fix VGA memory region location Greg Kroah-Hartman
                   ` (244 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Tianyue Ren, Paul Moore, Sasha Levin

From: Tianyue Ren <rentianyue@kylinos.cn>

[ Upstream commit 83370b31a915493231e5b9addc72e4bef69f8d31 ]

Mark the inode security label as invalid if we cannot find
a dentry so that we will retry later rather than marking it
initialized with the unlabeled SID.

Fixes: 9287aed2ad1f ("selinux: Convert isec->lock into a spinlock")
Signed-off-by: Tianyue Ren <rentianyue@kylinos.cn>
[PM: minor comment tweaks]
Signed-off-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 security/selinux/hooks.c | 19 ++++++++++++++++---
 1 file changed, 16 insertions(+), 3 deletions(-)

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 250b725f5754c..02afe52a55d0d 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -1618,7 +1618,13 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent
 			 * inode_doinit with a dentry, before these inodes could
 			 * be used again by userspace.
 			 */
-			goto out;
+			isec->initialized = LABEL_INVALID;
+			/*
+			 * There is nothing useful to jump to the "out"
+			 * label, except a needless spin lock/unlock
+			 * cycle.
+			 */
+			return 0;
 		}
 
 		len = INITCONTEXTLEN;
@@ -1733,8 +1739,15 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent
 			 * inode_doinit() with a dentry, before these inodes
 			 * could be used again by userspace.
 			 */
-			if (!dentry)
-				goto out;
+			if (!dentry) {
+				isec->initialized = LABEL_INVALID;
+				/*
+				 * There is nothing useful to jump to the "out"
+				 * label, except a needless spin lock/unlock
+				 * cycle.
+				 */
+				return 0;
+			}
 			rc = selinux_genfs_get_sid(dentry, sclass,
 						   sbsec->flags, &sid);
 			dput(dentry);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 105/346] ARM: dts: aspeed: s2600wf: Fix VGA memory region location
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (103 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 4.19 104/346] selinux: fix error initialization in inode_doinit_with_dentry() Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 4.19 106/346] RDMA/rxe: Compute PSN windows correctly Greg Kroah-Hartman
                   ` (243 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, John Wang, Joel Stanley, Sasha Levin

From: Joel Stanley <joel@jms.id.au>

[ Upstream commit 9e1cc9679776f5b9e42481d392b1550753ebd084 ]

The VGA memory region is always from the top of RAM. On this board, that
is 0x80000000 + 0x20000000 - 0x01000000 = 0x9f000000.

This was not an issue in practice as the region is "reserved" by the
vendor's u-boot reducing the amount of available RAM, and the only user
is the host VGA device poking at RAM over PCIe. That is, nothing from
the ARM touches it.

It is worth fixing as developers copy existing device trees when
building their machines, and the XDMA driver does use the memory region
from the ARM side.

Fixes: c4043ecac34a ("ARM: dts: aspeed: Add S2600WF BMC Machine")
Reported-by: John Wang <wangzhiqiang.bj@bytedance.com>
Link: https://lore.kernel.org/r/20200922064234.163799-1-joel@jms.id.au
Signed-off-by: Joel Stanley <joel@jms.id.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/aspeed-bmc-intel-s2600wf.dts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm/boot/dts/aspeed-bmc-intel-s2600wf.dts b/arch/arm/boot/dts/aspeed-bmc-intel-s2600wf.dts
index 22dade6393d06..d1dbe3b6ad5a7 100644
--- a/arch/arm/boot/dts/aspeed-bmc-intel-s2600wf.dts
+++ b/arch/arm/boot/dts/aspeed-bmc-intel-s2600wf.dts
@@ -22,9 +22,9 @@
 		#size-cells = <1>;
 		ranges;
 
-		vga_memory: framebuffer@7f000000 {
+		vga_memory: framebuffer@9f000000 {
 			no-map;
-			reg = <0x7f000000 0x01000000>;
+			reg = <0x9f000000 0x01000000>; /* 16M */
 		};
 	};
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 106/346] RDMA/rxe: Compute PSN windows correctly
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (104 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 4.19 105/346] ARM: dts: aspeed: s2600wf: Fix VGA memory region location Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 4.19 107/346] x86/mm/ident_map: Check for errors from ident_pud_init() Greg Kroah-Hartman
                   ` (242 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Bob Pearson, Jason Gunthorpe, Sasha Levin

From: Bob Pearson <rpearsonhpe@gmail.com>

[ Upstream commit bb3ab2979fd69db23328691cb10067861df89037 ]

The code which limited the number of unacknowledged PSNs was incorrect.
The PSNs are limited to 24 bits and wrap back to zero from 0x00ffffff.
The test was computing a 32 bit value which wraps at 32 bits so that
qp->req.psn can appear smaller than the limit when it is actually larger.

Replace '>' test with psn_compare which is used for other PSN comparisons
and correctly handles the 24 bit size.

Fixes: 8700e3e7c485 ("Soft RoCE driver")
Link: https://lore.kernel.org/r/20201013170741.3590-1-rpearson@hpe.com
Signed-off-by: Bob Pearson <rpearson@hpe.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/sw/rxe/rxe_req.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/infiniband/sw/rxe/rxe_req.c b/drivers/infiniband/sw/rxe/rxe_req.c
index 1c1eae0ef8c28..63db49144f62b 100644
--- a/drivers/infiniband/sw/rxe/rxe_req.c
+++ b/drivers/infiniband/sw/rxe/rxe_req.c
@@ -664,7 +664,8 @@ next_wqe:
 	}
 
 	if (unlikely(qp_type(qp) == IB_QPT_RC &&
-		     qp->req.psn > (qp->comp.psn + RXE_MAX_UNACKED_PSNS))) {
+		psn_compare(qp->req.psn, (qp->comp.psn +
+				RXE_MAX_UNACKED_PSNS)) > 0)) {
 		qp->req.wait_psn = 1;
 		goto exit;
 	}
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 107/346] x86/mm/ident_map: Check for errors from ident_pud_init()
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (105 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 4.19 106/346] RDMA/rxe: Compute PSN windows correctly Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 4.19 108/346] ARM: p2v: fix handling of LPAE translation in BE mode Greg Kroah-Hartman
                   ` (241 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Arvind Sankar, Borislav Petkov,
	Joerg Roedel, Kirill A. Shutemov, Sasha Levin

From: Arvind Sankar <nivedita@alum.mit.edu>

[ Upstream commit 1fcd009102ee02e217f2e7635ab65517d785da8e ]

Commit

  ea3b5e60ce80 ("x86/mm/ident_map: Add 5-level paging support")

added ident_p4d_init() to support 5-level paging, but this function
doesn't check and return errors from ident_pud_init().

For example, the decompressor stub uses this code to create an identity
mapping. If it runs out of pages while trying to allocate a PMD
pagetable, the error will be currently ignored.

Fix this to propagate errors.

 [ bp: Space out statements for better readability. ]

Fixes: ea3b5e60ce80 ("x86/mm/ident_map: Add 5-level paging support")
Signed-off-by: Arvind Sankar <nivedita@alum.mit.edu>
Signed-off-by: Borislav Petkov <bp@suse.de>
Reviewed-by: Joerg Roedel <jroedel@suse.de>
Acked-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Link: https://lkml.kernel.org/r/20201027230648.1885111-1-nivedita@alum.mit.edu
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/mm/ident_map.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/arch/x86/mm/ident_map.c b/arch/x86/mm/ident_map.c
index fe7a12599d8eb..968d7005f4a72 100644
--- a/arch/x86/mm/ident_map.c
+++ b/arch/x86/mm/ident_map.c
@@ -62,6 +62,7 @@ static int ident_p4d_init(struct x86_mapping_info *info, p4d_t *p4d_page,
 			  unsigned long addr, unsigned long end)
 {
 	unsigned long next;
+	int result;
 
 	for (; addr < end; addr = next) {
 		p4d_t *p4d = p4d_page + p4d_index(addr);
@@ -73,13 +74,20 @@ static int ident_p4d_init(struct x86_mapping_info *info, p4d_t *p4d_page,
 
 		if (p4d_present(*p4d)) {
 			pud = pud_offset(p4d, 0);
-			ident_pud_init(info, pud, addr, next);
+			result = ident_pud_init(info, pud, addr, next);
+			if (result)
+				return result;
+
 			continue;
 		}
 		pud = (pud_t *)info->alloc_pgt_page(info->context);
 		if (!pud)
 			return -ENOMEM;
-		ident_pud_init(info, pud, addr, next);
+
+		result = ident_pud_init(info, pud, addr, next);
+		if (result)
+			return result;
+
 		set_p4d(p4d, __p4d(__pa(pud) | info->kernpg_flag));
 	}
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 108/346] ARM: p2v: fix handling of LPAE translation in BE mode
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (106 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 4.19 107/346] x86/mm/ident_map: Check for errors from ident_pud_init() Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 4.19 109/346] x86/apic: Fix x2apic enablement without interrupt remapping Greg Kroah-Hartman
                   ` (240 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Nicolas Pitre, Linus Walleij,
	Ard Biesheuvel, Sasha Levin

From: Ard Biesheuvel <ardb@kernel.org>

[ Upstream commit 4e79f0211b473f8e1eab8211a9fd50cc41a3a061 ]

When running in BE mode on LPAE hardware with a PA-to-VA translation
that exceeds 4 GB, we patch bits 39:32 of the offset into the wrong
byte of the opcode. So fix that, by rotating the offset in r0 to the
right by 8 bits, which will put the 8-bit immediate in bits 31:24.

Note that this will also move bit #22 in its correct place when
applying the rotation to the constant #0x400000.

Fixes: d9a790df8e984 ("ARM: 7883/1: fix mov to mvn conversion in case of 64 bit phys_addr_t and BE")
Acked-by: Nicolas Pitre <nico@fluxnic.net>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/kernel/head.S | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/arch/arm/kernel/head.S b/arch/arm/kernel/head.S
index 6b1148cafffdb..90add5ded3f1f 100644
--- a/arch/arm/kernel/head.S
+++ b/arch/arm/kernel/head.S
@@ -674,12 +674,8 @@ ARM_BE8(rev16	ip, ip)
 	ldrcc	r7, [r4], #4	@ use branch for delay slot
 	bcc	1b
 	bx	lr
-#else
-#ifdef CONFIG_CPU_ENDIAN_BE8
-	moveq	r0, #0x00004000	@ set bit 22, mov to mvn instruction
 #else
 	moveq	r0, #0x400000	@ set bit 22, mov to mvn instruction
-#endif
 	b	2f
 1:	ldr	ip, [r7, r3]
 #ifdef CONFIG_CPU_ENDIAN_BE8
@@ -688,7 +684,7 @@ ARM_BE8(rev16	ip, ip)
 	tst	ip, #0x000f0000	@ check the rotation field
 	orrne	ip, ip, r6, lsl #24 @ mask in offset bits 31-24
 	biceq	ip, ip, #0x00004000 @ clear bit 22
-	orreq	ip, ip, r0      @ mask in offset bits 7-0
+	orreq	ip, ip, r0, ror #8  @ mask in offset bits 7-0
 #else
 	bic	ip, ip, #0x000000ff
 	tst	ip, #0xf00	@ check the rotation field
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 109/346] x86/apic: Fix x2apic enablement without interrupt remapping
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (107 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 4.19 108/346] ARM: p2v: fix handling of LPAE translation in BE mode Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 4.19 110/346] sched/deadline: Fix sched_dl_global_validate() Greg Kroah-Hartman
                   ` (239 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, David Woodhouse, Thomas Gleixner,
	Sasha Levin

From: David Woodhouse <dwmw@amazon.co.uk>

[ Upstream commit 26573a97746c7a99f394f9d398ce91a8853b3b89 ]

Currently, Linux as a hypervisor guest will enable x2apic only if there are
no CPUs present at boot time with an APIC ID above 255.

Hotplugging a CPU later with a higher APIC ID would result in a CPU which
cannot be targeted by external interrupts.

Add a filter in x2apic_apic_id_valid() which can be used to prevent such
CPUs from coming online, and allow x2apic to be enabled even if they are
present at boot time.

Fixes: ce69a784504 ("x86/apic: Enable x2APIC without interrupt remapping under KVM")
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Link: https://lore.kernel.org/r/20201024213535.443185-2-dwmw2@infradead.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/include/asm/apic.h        |  1 +
 arch/x86/kernel/apic/apic.c        | 14 ++++++++------
 arch/x86/kernel/apic/x2apic_phys.c |  9 +++++++++
 3 files changed, 18 insertions(+), 6 deletions(-)

diff --git a/arch/x86/include/asm/apic.h b/arch/x86/include/asm/apic.h
index 3c1e51ead0722..cd2aa72e21239 100644
--- a/arch/x86/include/asm/apic.h
+++ b/arch/x86/include/asm/apic.h
@@ -252,6 +252,7 @@ static inline u64 native_x2apic_icr_read(void)
 
 extern int x2apic_mode;
 extern int x2apic_phys;
+extern void __init x2apic_set_max_apicid(u32 apicid);
 extern void __init check_x2apic(void);
 extern void x2apic_setup(void);
 static inline int x2apic_enabled(void)
diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
index e9456a2eef585..ab8187271d470 100644
--- a/arch/x86/kernel/apic/apic.c
+++ b/arch/x86/kernel/apic/apic.c
@@ -1813,20 +1813,22 @@ static __init void try_to_enable_x2apic(int remap_mode)
 		return;
 
 	if (remap_mode != IRQ_REMAP_X2APIC_MODE) {
-		/* IR is required if there is APIC ID > 255 even when running
-		 * under KVM
+		/*
+		 * Using X2APIC without IR is not architecturally supported
+		 * on bare metal but may be supported in guests.
 		 */
-		if (max_physical_apicid > 255 ||
-		    !x86_init.hyper.x2apic_available()) {
+		if (!x86_init.hyper.x2apic_available()) {
 			pr_info("x2apic: IRQ remapping doesn't support X2APIC mode\n");
 			x2apic_disable();
 			return;
 		}
 
 		/*
-		 * without IR all CPUs can be addressed by IOAPIC/MSI
-		 * only in physical mode
+		 * Without IR, all CPUs can be addressed by IOAPIC/MSI only
+		 * in physical mode, and CPUs with an APIC ID that cannnot
+		 * be addressed must not be brought online.
 		 */
+		x2apic_set_max_apicid(255);
 		x2apic_phys = 1;
 	}
 	x2apic_enable();
diff --git a/arch/x86/kernel/apic/x2apic_phys.c b/arch/x86/kernel/apic/x2apic_phys.c
index b5cf9e7b3830c..ed56d2850e96a 100644
--- a/arch/x86/kernel/apic/x2apic_phys.c
+++ b/arch/x86/kernel/apic/x2apic_phys.c
@@ -13,6 +13,12 @@
 int x2apic_phys;
 
 static struct apic apic_x2apic_phys;
+static u32 x2apic_max_apicid __ro_after_init;
+
+void __init x2apic_set_max_apicid(u32 apicid)
+{
+	x2apic_max_apicid = apicid;
+}
 
 static int __init set_x2apic_phys_mode(char *arg)
 {
@@ -103,6 +109,9 @@ static int x2apic_phys_probe(void)
 /* Common x2apic functions, also used by x2apic_cluster */
 int x2apic_apic_id_valid(u32 apicid)
 {
+	if (x2apic_max_apicid && apicid > x2apic_max_apicid)
+		return 0;
+
 	return 1;
 }
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 110/346] sched/deadline: Fix sched_dl_global_validate()
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (108 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 4.19 109/346] x86/apic: Fix x2apic enablement without interrupt remapping Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 4.19 111/346] sched: Reenable interrupts in do_sched_yield() Greg Kroah-Hartman
                   ` (238 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Peng Liu, Peter Zijlstra (Intel),
	Daniel Bristot de Oliveira, Juri Lelli, Sasha Levin

From: Peng Liu <iwtbavbm@gmail.com>

[ Upstream commit a57415f5d1e43c3a5c5d412cd85e2792d7ed9b11 ]

When change sched_rt_{runtime, period}_us, we validate that the new
settings should at least accommodate the currently allocated -dl
bandwidth:

  sched_rt_handler()
    -->	sched_dl_bandwidth_validate()
	{
		new_bw = global_rt_runtime()/global_rt_period();

		for_each_possible_cpu(cpu) {
			dl_b = dl_bw_of(cpu);
			if (new_bw < dl_b->total_bw)    <-------
				ret = -EBUSY;
		}
	}

But under CONFIG_SMP, dl_bw is per root domain , but not per CPU,
dl_b->total_bw is the allocated bandwidth of the whole root domain.
Instead, we should compare dl_b->total_bw against "cpus*new_bw",
where 'cpus' is the number of CPUs of the root domain.

Also, below annotation(in kernel/sched/sched.h) implied implementation
only appeared in SCHED_DEADLINE v2[1], then deadline scheduler kept
evolving till got merged(v9), but the annotation remains unchanged,
meaningless and misleading, update it.

* With respect to SMP, the bandwidth is given on a per-CPU basis,
* meaning that:
*  - dl_bw (< 100%) is the bandwidth of the system (group) on each CPU;
*  - dl_total_bw array contains, in the i-eth element, the currently
*    allocated bandwidth on the i-eth CPU.

[1]: https://lore.kernel.org/lkml/1267385230.13676.101.camel@Palantir/

Fixes: 332ac17ef5bf ("sched/deadline: Add bandwidth management for SCHED_DEADLINE tasks")
Signed-off-by: Peng Liu <iwtbavbm@gmail.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Daniel Bristot de Oliveira <bristot@redhat.com>
Acked-by: Juri Lelli <juri.lelli@redhat.com>
Link: https://lkml.kernel.org/r/db6bbda316048cda7a1bbc9571defde193a8d67e.1602171061.git.iwtbavbm@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/sched/deadline.c |  5 +++--
 kernel/sched/sched.h    | 42 ++++++++++++++++++-----------------------
 2 files changed, 21 insertions(+), 26 deletions(-)

diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c
index 8aecfb143859d..aa592dc3cb401 100644
--- a/kernel/sched/deadline.c
+++ b/kernel/sched/deadline.c
@@ -2464,7 +2464,7 @@ int sched_dl_global_validate(void)
 	u64 period = global_rt_period();
 	u64 new_bw = to_ratio(period, runtime);
 	struct dl_bw *dl_b;
-	int cpu, ret = 0;
+	int cpu, cpus, ret = 0;
 	unsigned long flags;
 
 	/*
@@ -2479,9 +2479,10 @@ int sched_dl_global_validate(void)
 	for_each_possible_cpu(cpu) {
 		rcu_read_lock_sched();
 		dl_b = dl_bw_of(cpu);
+		cpus = dl_bw_cpus(cpu);
 
 		raw_spin_lock_irqsave(&dl_b->lock, flags);
-		if (new_bw < dl_b->total_bw)
+		if (new_bw * cpus < dl_b->total_bw)
 			ret = -EBUSY;
 		raw_spin_unlock_irqrestore(&dl_b->lock, flags);
 
diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h
index 41b7954be68b7..7b7ba91e319bb 100644
--- a/kernel/sched/sched.h
+++ b/kernel/sched/sched.h
@@ -247,30 +247,6 @@ struct rt_bandwidth {
 
 void __dl_clear_params(struct task_struct *p);
 
-/*
- * To keep the bandwidth of -deadline tasks and groups under control
- * we need some place where:
- *  - store the maximum -deadline bandwidth of the system (the group);
- *  - cache the fraction of that bandwidth that is currently allocated.
- *
- * This is all done in the data structure below. It is similar to the
- * one used for RT-throttling (rt_bandwidth), with the main difference
- * that, since here we are only interested in admission control, we
- * do not decrease any runtime while the group "executes", neither we
- * need a timer to replenish it.
- *
- * With respect to SMP, the bandwidth is given on a per-CPU basis,
- * meaning that:
- *  - dl_bw (< 100%) is the bandwidth of the system (group) on each CPU;
- *  - dl_total_bw array contains, in the i-eth element, the currently
- *    allocated bandwidth on the i-eth CPU.
- * Moreover, groups consume bandwidth on each CPU, while tasks only
- * consume bandwidth on the CPU they're running on.
- * Finally, dl_total_bw_cpu is used to cache the index of dl_total_bw
- * that will be shown the next time the proc or cgroup controls will
- * be red. It on its turn can be changed by writing on its own
- * control.
- */
 struct dl_bandwidth {
 	raw_spinlock_t		dl_runtime_lock;
 	u64			dl_runtime;
@@ -282,6 +258,24 @@ static inline int dl_bandwidth_enabled(void)
 	return sysctl_sched_rt_runtime >= 0;
 }
 
+/*
+ * To keep the bandwidth of -deadline tasks under control
+ * we need some place where:
+ *  - store the maximum -deadline bandwidth of each cpu;
+ *  - cache the fraction of bandwidth that is currently allocated in
+ *    each root domain;
+ *
+ * This is all done in the data structure below. It is similar to the
+ * one used for RT-throttling (rt_bandwidth), with the main difference
+ * that, since here we are only interested in admission control, we
+ * do not decrease any runtime while the group "executes", neither we
+ * need a timer to replenish it.
+ *
+ * With respect to SMP, bandwidth is given on a per root domain basis,
+ * meaning that:
+ *  - bw (< 100%) is the deadline bandwidth of each CPU;
+ *  - total_bw is the currently allocated bandwidth in each root domain;
+ */
 struct dl_bw {
 	raw_spinlock_t		lock;
 	u64			bw;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 111/346] sched: Reenable interrupts in do_sched_yield()
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (109 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 4.19 110/346] sched/deadline: Fix sched_dl_global_validate() Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 4.19 112/346] crypto: talitos - Endianess in current_desc_hdr() Greg Kroah-Hartman
                   ` (237 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Thomas Gleixner,
	Peter Zijlstra (Intel),
	Sasha Levin

From: Thomas Gleixner <tglx@linutronix.de>

[ Upstream commit 345a957fcc95630bf5535d7668a59ed983eb49a7 ]

do_sched_yield() invokes schedule() with interrupts disabled which is
not allowed. This goes back to the pre git era to commit a6efb709806c
("[PATCH] irqlock patch 2.5.27-H6") in the history tree.

Reenable interrupts and remove the misleading comment which "explains" it.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/87r1pt7y5c.fsf@nanos.tec.linutronix.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/sched/core.c | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index b166320f7633e..013b1c6cb4ed9 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -4984,12 +4984,8 @@ static void do_sched_yield(void)
 	schedstat_inc(rq->yld_count);
 	current->sched_class->yield_task(rq);
 
-	/*
-	 * Since we are going to call schedule() anyway, there's
-	 * no need to preempt or enable interrupts:
-	 */
 	preempt_disable();
-	rq_unlock(rq, &rf);
+	rq_unlock_irq(rq, &rf);
 	sched_preempt_enable_no_resched();
 
 	schedule();
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 112/346] crypto: talitos - Endianess in current_desc_hdr()
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (110 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 4.19 111/346] sched: Reenable interrupts in do_sched_yield() Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 4.19 113/346] crypto: talitos - Fix return type of current_desc_hdr() Greg Kroah-Hartman
                   ` (236 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christophe Leroy, Herbert Xu, Sasha Levin

From: Christophe Leroy <christophe.leroy@csgroup.eu>

[ Upstream commit 195404db27f9533c71fdcb78d32a77075c2cb4a2 ]

current_desc_hdr() compares the value of the current descriptor
with the next_desc member of the talitos_desc struct.

While the current descriptor is obtained from in_be32() which
return CPU ordered bytes, next_desc member is in big endian order.

Convert the current descriptor into big endian before comparing it
with next_desc.

This fixes a sparse warning.

Fixes: 37b5e8897eb5 ("crypto: talitos - chain in buffered data for ahash on SEC1")
Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/talitos.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c
index ea16308fae0a5..7e69d77ea2595 100644
--- a/drivers/crypto/talitos.c
+++ b/drivers/crypto/talitos.c
@@ -492,7 +492,7 @@ static u32 current_desc_hdr(struct device *dev, int ch)
 
 	iter = tail;
 	while (priv->chan[ch].fifo[iter].dma_desc != cur_desc &&
-	       priv->chan[ch].fifo[iter].desc->next_desc != cur_desc) {
+	       priv->chan[ch].fifo[iter].desc->next_desc != cpu_to_be32(cur_desc)) {
 		iter = (iter + 1) & (priv->fifo_len - 1);
 		if (iter == tail) {
 			dev_err(dev, "couldn't locate current descriptor\n");
@@ -500,7 +500,7 @@ static u32 current_desc_hdr(struct device *dev, int ch)
 		}
 	}
 
-	if (priv->chan[ch].fifo[iter].desc->next_desc == cur_desc) {
+	if (priv->chan[ch].fifo[iter].desc->next_desc == cpu_to_be32(cur_desc)) {
 		struct talitos_edesc *edesc;
 
 		edesc = container_of(priv->chan[ch].fifo[iter].desc,
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 113/346] crypto: talitos - Fix return type of current_desc_hdr()
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (111 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 4.19 112/346] crypto: talitos - Endianess in current_desc_hdr() Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 4.19 114/346] crypto: inside-secure - Fix sizeof() mismatch Greg Kroah-Hartman
                   ` (235 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christophe Leroy, Herbert Xu, Sasha Levin

From: Christophe Leroy <christophe.leroy@csgroup.eu>

[ Upstream commit 0237616173fd363a54bd272aa3bd376faa1d7caa ]

current_desc_hdr() returns a u32 but in fact this is a __be32,
leading to a lot of sparse warnings.

Change the return type to __be32 and ensure it is handled as
sure by the caller.

Fixes: 3e721aeb3df3 ("crypto: talitos - handle descriptor not found in error path")
Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/talitos.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c
index 7e69d77ea2595..c70a7c4f5b739 100644
--- a/drivers/crypto/talitos.c
+++ b/drivers/crypto/talitos.c
@@ -474,7 +474,7 @@ DEF_TALITOS2_DONE(ch1_3, TALITOS2_ISR_CH_1_3_DONE)
 /*
  * locate current (offending) descriptor
  */
-static u32 current_desc_hdr(struct device *dev, int ch)
+static __be32 current_desc_hdr(struct device *dev, int ch)
 {
 	struct talitos_private *priv = dev_get_drvdata(dev);
 	int tail, iter;
@@ -515,13 +515,13 @@ static u32 current_desc_hdr(struct device *dev, int ch)
 /*
  * user diagnostics; report root cause of error based on execution unit status
  */
-static void report_eu_error(struct device *dev, int ch, u32 desc_hdr)
+static void report_eu_error(struct device *dev, int ch, __be32 desc_hdr)
 {
 	struct talitos_private *priv = dev_get_drvdata(dev);
 	int i;
 
 	if (!desc_hdr)
-		desc_hdr = in_be32(priv->chan[ch].reg + TALITOS_DESCBUF);
+		desc_hdr = cpu_to_be32(in_be32(priv->chan[ch].reg + TALITOS_DESCBUF));
 
 	switch (desc_hdr & DESC_HDR_SEL0_MASK) {
 	case DESC_HDR_SEL0_AFEU:
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 114/346] crypto: inside-secure - Fix sizeof() mismatch
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (112 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 4.19 113/346] crypto: talitos - Fix return type of current_desc_hdr() Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 4.19 115/346] drm/amdgpu: fix build_coefficients() argument Greg Kroah-Hartman
                   ` (234 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Colin Ian King, Antoine Tenart,
	Herbert Xu, Sasha Levin

From: Colin Ian King <colin.king@canonical.com>

[ Upstream commit c98e233062cd9d0e2f10e445a671f0799daaef67 ]

An incorrect sizeof() is being used, sizeof(priv->ring[i].rdr_req) is
not correct, it should be sizeof(*priv->ring[i].rdr_req). Note that
since the size of ** is the same size as * this is not causing any
issues.

Addresses-Coverity: ("Sizeof not portable (SIZEOF_MISMATCH)")
Fixes: 9744fec95f06 ("crypto: inside-secure - remove request list to improve performance")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Acked-by: Antoine Tenart <atenart@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/inside-secure/safexcel.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/crypto/inside-secure/safexcel.c b/drivers/crypto/inside-secure/safexcel.c
index 86c699c14f849..bc6c5cb7de239 100644
--- a/drivers/crypto/inside-secure/safexcel.c
+++ b/drivers/crypto/inside-secure/safexcel.c
@@ -1066,7 +1066,7 @@ static int safexcel_probe(struct platform_device *pdev)
 
 		priv->ring[i].rdr_req = devm_kcalloc(dev,
 			EIP197_DEFAULT_RING_SIZE,
-			sizeof(priv->ring[i].rdr_req),
+			sizeof(*priv->ring[i].rdr_req),
 			GFP_KERNEL);
 		if (!priv->ring[i].rdr_req) {
 			ret = -ENOMEM;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 115/346] drm/amdgpu: fix build_coefficients() argument
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (113 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 4.19 114/346] crypto: inside-secure - Fix sizeof() mismatch Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 4.19 116/346] powerpc/64: Set up a kernel stack for secondaries before cpu_restore() Greg Kroah-Hartman
                   ` (233 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Harry Wentland, Arnd Bergmann,
	Alex Deucher, Sasha Levin

From: Arnd Bergmann <arnd@arndb.de>

[ Upstream commit dbb60031dd0c2b85f10ce4c12ae604c28d3aaca4 ]

gcc -Wextra warns about a function taking an enum argument
being called with a bool:

drivers/gpu/drm/amd/amdgpu/../display/modules/color/color_gamma.c: In function 'apply_degamma_for_user_regamma':
drivers/gpu/drm/amd/amdgpu/../display/modules/color/color_gamma.c:1617:29: warning: implicit conversion from 'enum <anonymous>' to 'enum dc_transfer_func_predefined' [-Wenum-conversion]
 1617 |  build_coefficients(&coeff, true);

It appears that a patch was added using the old calling conventions
after the type was changed, and the value should actually be 0
(TRANSFER_FUNCTION_SRGB) here instead of 1 (true).

Fixes: 55a01d4023ce ("drm/amd/display: Add user_regamma to color module")
Reviewed-by: Harry Wentland <harry.wentland@amd.com>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/display/modules/color/color_gamma.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/display/modules/color/color_gamma.c b/drivers/gpu/drm/amd/display/modules/color/color_gamma.c
index 11ea1a0e629bd..458e82da3c85b 100644
--- a/drivers/gpu/drm/amd/display/modules/color/color_gamma.c
+++ b/drivers/gpu/drm/amd/display/modules/color/color_gamma.c
@@ -1296,7 +1296,7 @@ static void apply_degamma_for_user_regamma(struct pwl_float_data_ex *rgb_regamma
 	struct pwl_float_data_ex *rgb = rgb_regamma;
 	const struct hw_x_point *coord_x = coordinates_x;
 
-	build_coefficients(&coeff, true);
+	build_coefficients(&coeff, TRANSFER_FUNCTION_SRGB);
 
 	i = 0;
 	while (i != hw_points_num + 1) {
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 116/346] powerpc/64: Set up a kernel stack for secondaries before cpu_restore()
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (114 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 4.19 115/346] drm/amdgpu: fix build_coefficients() argument Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 4.19 117/346] spi: img-spfi: fix reference leak in img_spfi_resume Greg Kroah-Hartman
                   ` (232 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jordan Niethe, Michael Ellerman, Sasha Levin

From: Jordan Niethe <jniethe5@gmail.com>

[ Upstream commit 3c0b976bf20d236c57adcefa80f86a0a1d737727 ]

Currently in generic_secondary_smp_init(), cur_cpu_spec->cpu_restore()
is called before a stack has been set up in r1. This was previously fine
as the cpu_restore() functions were implemented in assembly and did not
use a stack. However commit 5a61ef74f269 ("powerpc/64s: Support new
device tree binding for discovering CPU features") used
__restore_cpu_cpufeatures() as the cpu_restore() function for a
device-tree features based cputable entry. This is a C function and
hence uses a stack in r1.

generic_secondary_smp_init() is entered on the secondary cpus via the
primary cpu using the OPAL call opal_start_cpu(). In OPAL, each hardware
thread has its own stack. The OPAL call is ran in the primary's hardware
thread. During the call, a job is scheduled on a secondary cpu that will
start executing at the address of generic_secondary_smp_init().  Hence
the value that will be left in r1 when the secondary cpu enters the
kernel is part of that secondary cpu's individual OPAL stack. This means
that __restore_cpu_cpufeatures() will write to that OPAL stack. This is
not horribly bad as each hardware thread has its own stack and the call
that enters the kernel from OPAL never returns, but it is still wrong
and should be corrected.

Create the temp kernel stack before calling cpu_restore().

As noted by mpe, for a kexec boot, the secondary CPUs are released from
the spin loop at address 0x60 by smp_release_cpus() and then jump to
generic_secondary_smp_init(). The call to smp_release_cpus() is in
setup_arch(), and it comes before the call to emergency_stack_init().
emergency_stack_init() allocates an emergency stack in the PACA for each
CPU.  This address in the PACA is what is used to set up the temp kernel
stack in generic_secondary_smp_init(). Move releasing the secondary CPUs
to after the PACAs have been allocated an emergency stack, otherwise the
PACA stack pointer will contain garbage and hence the temp kernel stack
created from it will be broken.

Fixes: 5a61ef74f269 ("powerpc/64s: Support new device tree binding for discovering CPU features")
Signed-off-by: Jordan Niethe <jniethe5@gmail.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20201014072837.24539-1-jniethe5@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/kernel/head_64.S      | 8 ++++----
 arch/powerpc/kernel/setup-common.c | 4 ++--
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/arch/powerpc/kernel/head_64.S b/arch/powerpc/kernel/head_64.S
index 389da790c1296..4f7b225d78cff 100644
--- a/arch/powerpc/kernel/head_64.S
+++ b/arch/powerpc/kernel/head_64.S
@@ -423,6 +423,10 @@ generic_secondary_common_init:
 	/* From now on, r24 is expected to be logical cpuid */
 	mr	r24,r5
 
+	/* Create a temp kernel stack for use before relocation is on.	*/
+	ld	r1,PACAEMERGSP(r13)
+	subi	r1,r1,STACK_FRAME_OVERHEAD
+
 	/* See if we need to call a cpu state restore handler */
 	LOAD_REG_ADDR(r23, cur_cpu_spec)
 	ld	r23,0(r23)
@@ -451,10 +455,6 @@ generic_secondary_common_init:
 	sync				/* order paca.run and cur_cpu_spec */
 	isync				/* In case code patching happened */
 
-	/* Create a temp kernel stack for use before relocation is on.	*/
-	ld	r1,PACAEMERGSP(r13)
-	subi	r1,r1,STACK_FRAME_OVERHEAD
-
 	b	__secondary_start
 #endif /* SMP */
 
diff --git a/arch/powerpc/kernel/setup-common.c b/arch/powerpc/kernel/setup-common.c
index 508244bcf19c2..7787a26d47777 100644
--- a/arch/powerpc/kernel/setup-common.c
+++ b/arch/powerpc/kernel/setup-common.c
@@ -929,8 +929,6 @@ void __init setup_arch(char **cmdline_p)
 
 	/* On BookE, setup per-core TLB data structures. */
 	setup_tlb_core_data();
-
-	smp_release_cpus();
 #endif
 
 	/* Print various info about the machine that has been gathered so far. */
@@ -964,6 +962,8 @@ void __init setup_arch(char **cmdline_p)
 	exc_lvl_early_init();
 	emergency_stack_init();
 
+	smp_release_cpus();
+
 	initmem_init();
 
 #ifdef CONFIG_DUMMY_CONSOLE
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 117/346] spi: img-spfi: fix reference leak in img_spfi_resume
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (115 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 4.19 116/346] powerpc/64: Set up a kernel stack for secondaries before cpu_restore() Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 4.19 118/346] drm/msm/dsi_pll_10nm: restore VCO rate during restore_state Greg Kroah-Hartman
                   ` (231 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Zhang Qilong, Mark Brown, Sasha Levin

From: Zhang Qilong <zhangqilong3@huawei.com>

[ Upstream commit ee5558a9084584015c8754ffd029ce14a5827fa8 ]

pm_runtime_get_sync will increment pm usage counter even it
failed. Forgetting to pm_runtime_put_noidle will result in
reference leak in img_spfi_resume, so we should fix it.

Fixes: deba25800a12b ("spi: Add driver for IMG SPFI controller")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Link: https://lore.kernel.org/r/20201102145651.3875-1-zhangqilong3@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-img-spfi.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/spi/spi-img-spfi.c b/drivers/spi/spi-img-spfi.c
index e4b31d6e6e33e..25a545c985d4a 100644
--- a/drivers/spi/spi-img-spfi.c
+++ b/drivers/spi/spi-img-spfi.c
@@ -774,8 +774,10 @@ static int img_spfi_resume(struct device *dev)
 	int ret;
 
 	ret = pm_runtime_get_sync(dev);
-	if (ret)
+	if (ret) {
+		pm_runtime_put_noidle(dev);
 		return ret;
+	}
 	spfi_reset(spfi);
 	pm_runtime_put(dev);
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 118/346] drm/msm/dsi_pll_10nm: restore VCO rate during restore_state
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (116 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 4.19 117/346] spi: img-spfi: fix reference leak in img_spfi_resume Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 4.19 119/346] ASoC: pcm: DRAIN support reactivation Greg Kroah-Hartman
                   ` (230 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dmitry Baryshkov, Rob Clark, Sasha Levin

From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>

[ Upstream commit a4ccc37693a271330a46208afbeaed939d54fdbb ]

PHY disable/enable resets PLL registers to default values. Thus in
addition to restoring several registers we also need to restore VCO rate
settings.

Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Fixes: c6659785dfb3 ("drm/msm/dsi/pll: call vco set rate explicitly")
Signed-off-by: Rob Clark <robdclark@chromium.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/msm/dsi/pll/dsi_pll_10nm.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/gpu/drm/msm/dsi/pll/dsi_pll_10nm.c b/drivers/gpu/drm/msm/dsi/pll/dsi_pll_10nm.c
index 21a69b046625a..d15511b521cb7 100644
--- a/drivers/gpu/drm/msm/dsi/pll/dsi_pll_10nm.c
+++ b/drivers/gpu/drm/msm/dsi/pll/dsi_pll_10nm.c
@@ -554,6 +554,7 @@ static int dsi_pll_10nm_restore_state(struct msm_dsi_pll *pll)
 	struct pll_10nm_cached_state *cached = &pll_10nm->cached_state;
 	void __iomem *phy_base = pll_10nm->phy_cmn_mmio;
 	u32 val;
+	int ret;
 
 	val = pll_read(pll_10nm->mmio + REG_DSI_10nm_PHY_PLL_PLL_OUTDIV_RATE);
 	val &= ~0x3;
@@ -568,6 +569,13 @@ static int dsi_pll_10nm_restore_state(struct msm_dsi_pll *pll)
 	val |= cached->pll_mux;
 	pll_write(phy_base + REG_DSI_10nm_PHY_CMN_CLK_CFG1, val);
 
+	ret = dsi_pll_10nm_vco_set_rate(&pll->clk_hw, pll_10nm->vco_current_rate, pll_10nm->vco_ref_clk_rate);
+	if (ret) {
+		DRM_DEV_ERROR(&pll_10nm->pdev->dev,
+			"restore vco rate failed. ret=%d\n", ret);
+		return ret;
+	}
+
 	DBG("DSI PLL%d", pll_10nm->id);
 
 	return 0;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 119/346] ASoC: pcm: DRAIN support reactivation
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (117 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 4.19 118/346] drm/msm/dsi_pll_10nm: restore VCO rate during restore_state Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 4.19 120/346] selinux: fix inode_doinit_with_dentry() LABEL_INVALID error handling Greg Kroah-Hartman
                   ` (229 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Cezary Rojewski, Ranjani Sridharan,
	Mark Brown, Sasha Levin

From: Cezary Rojewski <cezary.rojewski@intel.com>

[ Upstream commit 4c22b80f61540ea99d9b4af0127315338755f05b ]

soc-pcm's dpcm_fe_dai_do_trigger() supported DRAIN commnad up to kernel
v5.4 where explicit switch(cmd) has been introduced which takes into
account all SNDRV_PCM_TRIGGER_xxx but SNDRV_PCM_TRIGGER_DRAIN. Update
switch statement to reactive support for it.

As DRAIN is somewhat unique by lacking negative/stop counterpart, bring
behaviour of dpcm_fe_dai_do_trigger() for said command back to its
pre-v5.4 state by adding it to START/RESUME/PAUSE_RELEASE group.

Fixes: acbf27746ecf ("ASoC: pcm: update FE/BE trigger order based on the command")
Signed-off-by: Cezary Rojewski <cezary.rojewski@intel.com>
Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
Link: https://lore.kernel.org/r/20201026100129.8216-1-cezary.rojewski@intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/soc-pcm.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c
index a0d1ce0edaf9a..af14304645ce8 100644
--- a/sound/soc/soc-pcm.c
+++ b/sound/soc/soc-pcm.c
@@ -2390,6 +2390,7 @@ static int dpcm_fe_dai_do_trigger(struct snd_pcm_substream *substream, int cmd)
 		case SNDRV_PCM_TRIGGER_START:
 		case SNDRV_PCM_TRIGGER_RESUME:
 		case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
+		case SNDRV_PCM_TRIGGER_DRAIN:
 			ret = dpcm_dai_trigger_fe_be(substream, cmd, true);
 			break;
 		case SNDRV_PCM_TRIGGER_STOP:
@@ -2407,6 +2408,7 @@ static int dpcm_fe_dai_do_trigger(struct snd_pcm_substream *substream, int cmd)
 		case SNDRV_PCM_TRIGGER_START:
 		case SNDRV_PCM_TRIGGER_RESUME:
 		case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
+		case SNDRV_PCM_TRIGGER_DRAIN:
 			ret = dpcm_dai_trigger_fe_be(substream, cmd, false);
 			break;
 		case SNDRV_PCM_TRIGGER_STOP:
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 120/346] selinux: fix inode_doinit_with_dentry() LABEL_INVALID error handling
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (118 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 4.19 119/346] ASoC: pcm: DRAIN support reactivation Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 4.19 121/346] arm64: dts: exynos: Include common syscon restart/poweroff for Exynos7 Greg Kroah-Hartman
                   ` (228 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sven Schnelle, Ondrej Mosnacek,
	Paul Moore, Sasha Levin

From: Paul Moore <paul@paul-moore.com>

[ Upstream commit 200ea5a2292dc444a818b096ae6a32ba3caa51b9 ]

A previous fix, commit 83370b31a915 ("selinux: fix error initialization
in inode_doinit_with_dentry()"), changed how failures were handled
before a SELinux policy was loaded.  Unfortunately that patch was
potentially problematic for two reasons: it set the isec->initialized
state without holding a lock, and it didn't set the inode's SELinux
label to the "default" for the particular filesystem.  The later can
be a problem if/when a later attempt to revalidate the inode fails
and SELinux reverts to the existing inode label.

This patch should restore the default inode labeling that existed
before the original fix, without affecting the LABEL_INVALID marking
such that revalidation will still be attempted in the future.

Fixes: 83370b31a915 ("selinux: fix error initialization in inode_doinit_with_dentry()")
Reported-by: Sven Schnelle <svens@linux.ibm.com>
Tested-by: Sven Schnelle <svens@linux.ibm.com>
Reviewed-by: Ondrej Mosnacek <omosnace@redhat.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 security/selinux/hooks.c | 31 +++++++++++++------------------
 1 file changed, 13 insertions(+), 18 deletions(-)

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 02afe52a55d0d..08833bbb97aab 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -1618,13 +1618,7 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent
 			 * inode_doinit with a dentry, before these inodes could
 			 * be used again by userspace.
 			 */
-			isec->initialized = LABEL_INVALID;
-			/*
-			 * There is nothing useful to jump to the "out"
-			 * label, except a needless spin lock/unlock
-			 * cycle.
-			 */
-			return 0;
+			goto out_invalid;
 		}
 
 		len = INITCONTEXTLEN;
@@ -1739,15 +1733,8 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent
 			 * inode_doinit() with a dentry, before these inodes
 			 * could be used again by userspace.
 			 */
-			if (!dentry) {
-				isec->initialized = LABEL_INVALID;
-				/*
-				 * There is nothing useful to jump to the "out"
-				 * label, except a needless spin lock/unlock
-				 * cycle.
-				 */
-				return 0;
-			}
+			if (!dentry)
+				goto out_invalid;
 			rc = selinux_genfs_get_sid(dentry, sclass,
 						   sbsec->flags, &sid);
 			dput(dentry);
@@ -1760,11 +1747,10 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent
 out:
 	spin_lock(&isec->lock);
 	if (isec->initialized == LABEL_PENDING) {
-		if (!sid || rc) {
+		if (rc) {
 			isec->initialized = LABEL_INVALID;
 			goto out_unlock;
 		}
-
 		isec->initialized = LABEL_INITIALIZED;
 		isec->sid = sid;
 	}
@@ -1772,6 +1758,15 @@ out:
 out_unlock:
 	spin_unlock(&isec->lock);
 	return rc;
+
+out_invalid:
+	spin_lock(&isec->lock);
+	if (isec->initialized == LABEL_PENDING) {
+		isec->initialized = LABEL_INVALID;
+		isec->sid = sid;
+	}
+	spin_unlock(&isec->lock);
+	return 0;
 }
 
 /* Convert a Linux signal to an access vector. */
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 121/346] arm64: dts: exynos: Include common syscon restart/poweroff for Exynos7
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (119 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 4.19 120/346] selinux: fix inode_doinit_with_dentry() LABEL_INVALID error handling Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 4.19 122/346] arm64: dts: exynos: Correct psci compatible used on Exynos7 Greg Kroah-Hartman
                   ` (227 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Paweł Chmiel,
	Krzysztof Kozlowski, Sasha Levin

From: Paweł Chmiel <pawel.mikolaj.chmiel@gmail.com>

[ Upstream commit 73bc7510ea0dafb4ff1ae6808759627a8ec51f5a ]

Exynos7 uses the same syscon reboot and poweroff nodes as other Exynos
SoCs, so instead of duplicating code we can just include common dtsi
file, which already contains definitions of them. After this change,
poweroff node will be also available, previously this dts file did
contain only reboot node.

Fixes: fb026cb65247 ("arm64: dts: Add reboot node for exynos7")
Fixes: b9024cbc937d ("arm64: dts: Add initial device tree support for exynos7")
Signed-off-by: Paweł Chmiel <pawel.mikolaj.chmiel@gmail.com>
Link: https://lore.kernel.org/r/20201107133926.37187-1-pawel.mikolaj.chmiel@gmail.com
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/exynos/exynos7.dtsi | 8 +-------
 1 file changed, 1 insertion(+), 7 deletions(-)

diff --git a/arch/arm64/boot/dts/exynos/exynos7.dtsi b/arch/arm64/boot/dts/exynos/exynos7.dtsi
index 31b1a606cb664..38a07d9763a3f 100644
--- a/arch/arm64/boot/dts/exynos/exynos7.dtsi
+++ b/arch/arm64/boot/dts/exynos/exynos7.dtsi
@@ -494,13 +494,6 @@
 		pmu_system_controller: system-controller@105c0000 {
 			compatible = "samsung,exynos7-pmu", "syscon";
 			reg = <0x105c0000 0x5000>;
-
-			reboot: syscon-reboot {
-				compatible = "syscon-reboot";
-				regmap = <&pmu_system_controller>;
-				offset = <0x0400>;
-				mask = <0x1>;
-			};
 		};
 
 		rtc: rtc@10590000 {
@@ -638,3 +631,4 @@
 };
 
 #include "exynos7-pinctrl.dtsi"
+#include "arm/exynos-syscon-restart.dtsi"
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 122/346] arm64: dts: exynos: Correct psci compatible used on Exynos7
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (120 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 4.19 121/346] arm64: dts: exynos: Include common syscon restart/poweroff for Exynos7 Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 4.19 123/346] Bluetooth: Fix null pointer dereference in hci_event_packet() Greg Kroah-Hartman
                   ` (226 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Paweł Chmiel,
	Krzysztof Kozlowski, Sasha Levin

From: Paweł Chmiel <pawel.mikolaj.chmiel@gmail.com>

[ Upstream commit e1e47fbca668507a81bb388fcae044b89d112ecc ]

It's not possible to reboot or poweroff Exynos7420 using PSCI. Instead
we need to use syscon reboot/poweroff drivers, like it's done for other
Exynos SoCs. This was confirmed by checking vendor source and testing it
on Samsung Galaxy S6 device based on this SoC.

To be able to use custom restart/poweroff handlers instead of PSCI
functions, we need to correct psci compatible. This also requires us to
provide function ids for CPU_ON and CPU_OFF.

Fixes: fb026cb65247 ("arm64: dts: Add reboot node for exynos7")
Fixes: b9024cbc937d ("arm64: dts: Add initial device tree support for exynos7")
Signed-off-by: Paweł Chmiel <pawel.mikolaj.chmiel@gmail.com>
Link: https://lore.kernel.org/r/20201107133926.37187-2-pawel.mikolaj.chmiel@gmail.com
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/exynos/exynos7.dtsi | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/exynos/exynos7.dtsi b/arch/arm64/boot/dts/exynos/exynos7.dtsi
index 38a07d9763a3f..5c5e57026c275 100644
--- a/arch/arm64/boot/dts/exynos/exynos7.dtsi
+++ b/arch/arm64/boot/dts/exynos/exynos7.dtsi
@@ -62,8 +62,10 @@
 	};
 
 	psci {
-		compatible = "arm,psci-0.2";
+		compatible = "arm,psci";
 		method = "smc";
+		cpu_off = <0x84000002>;
+		cpu_on = <0xC4000003>;
 	};
 
 	soc: soc {
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 123/346] Bluetooth: Fix null pointer dereference in hci_event_packet()
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (121 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 4.19 122/346] arm64: dts: exynos: Correct psci compatible used on Exynos7 Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 4.19 124/346] Bluetooth: hci_h5: fix memory leak in h5_close Greg Kroah-Hartman
                   ` (225 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Anmol Karn, Marcel Holtmann,
	Sasha Levin, syzbot+0bef568258653cff272f

From: Anmol Karn <anmol.karan123@gmail.com>

[ Upstream commit 6dfccd13db2ff2b709ef60a50163925d477549aa ]

AMP_MGR is getting derefernced in hci_phy_link_complete_evt(), when called
from hci_event_packet() and there is a possibility, that hcon->amp_mgr may
not be found when accessing after initialization of hcon.

- net/bluetooth/hci_event.c:4945
The bug seems to get triggered in this line:

bredr_hcon = hcon->amp_mgr->l2cap_conn->hcon;

Fix it by adding a NULL check for the hcon->amp_mgr before checking the ev-status.

Fixes: d5e911928bd8 ("Bluetooth: AMP: Process Physical Link Complete evt")
Reported-and-tested-by: syzbot+0bef568258653cff272f@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?extid=0bef568258653cff272f
Signed-off-by: Anmol Karn <anmol.karan123@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/bluetooth/hci_event.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 622898d018f63..b58afd2d5ebf4 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -4672,6 +4672,11 @@ static void hci_phy_link_complete_evt(struct hci_dev *hdev,
 		return;
 	}
 
+	if (!hcon->amp_mgr) {
+		hci_dev_unlock(hdev);
+		return;
+	}
+
 	if (ev->status) {
 		hci_conn_del(hcon);
 		hci_dev_unlock(hdev);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 124/346] Bluetooth: hci_h5: fix memory leak in h5_close
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (122 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 4.19 123/346] Bluetooth: Fix null pointer dereference in hci_event_packet() Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 4.19 125/346] spi: spi-ti-qspi: fix reference leak in ti_qspi_setup Greg Kroah-Hartman
                   ` (224 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, syzbot+6ce141c55b2f7aafd1c4,
	Anant Thazhemadam, Hans de Goede, Marcel Holtmann, Sasha Levin

From: Anant Thazhemadam <anant.thazhemadam@gmail.com>

[ Upstream commit 855af2d74c870d747bf53509f8b2d7b9dc9ee2c3 ]

When h5_close() is called, h5 is directly freed when !hu->serdev.
However, h5->rx_skb is not freed, which causes a memory leak.

Freeing h5->rx_skb and setting it to NULL, fixes this memory leak.

Fixes: ce945552fde4 ("Bluetooth: hci_h5: Add support for serdev enumerated devices")
Reported-by: syzbot+6ce141c55b2f7aafd1c4@syzkaller.appspotmail.com
Tested-by: syzbot+6ce141c55b2f7aafd1c4@syzkaller.appspotmail.com
Signed-off-by: Anant Thazhemadam <anant.thazhemadam@gmail.com>
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/bluetooth/hci_h5.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/bluetooth/hci_h5.c b/drivers/bluetooth/hci_h5.c
index 5a68cd4dd71cb..7ffeb37e8f202 100644
--- a/drivers/bluetooth/hci_h5.c
+++ b/drivers/bluetooth/hci_h5.c
@@ -257,6 +257,9 @@ static int h5_close(struct hci_uart *hu)
 	skb_queue_purge(&h5->rel);
 	skb_queue_purge(&h5->unrel);
 
+	kfree_skb(h5->rx_skb);
+	h5->rx_skb = NULL;
+
 	if (h5->vnd && h5->vnd->close)
 		h5->vnd->close(h5);
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 125/346] spi: spi-ti-qspi: fix reference leak in ti_qspi_setup
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (123 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 4.19 124/346] Bluetooth: hci_h5: fix memory leak in h5_close Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 4.19 126/346] spi: tegra20-slink: fix reference leak in slink ops of tegra20 Greg Kroah-Hartman
                   ` (223 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Zhang Qilong, Mark Brown, Sasha Levin

From: Zhang Qilong <zhangqilong3@huawei.com>

[ Upstream commit 45c0cba753641e5d7c3207f04241bd0e7a021698 ]

pm_runtime_get_sync will increment pm usage counter even it
failed. Forgetting to pm_runtime_put_noidle will result in
reference leak in ti_qspi_setup, so we should fix it.

Fixes: 505a14954e2d7 ("spi/qspi: Add qspi flash controller")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Link: https://lore.kernel.org/r/20201103140947.3815-1-zhangqilong3@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-ti-qspi.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/spi/spi-ti-qspi.c b/drivers/spi/spi-ti-qspi.c
index 95c28abaa0272..73a08724034ba 100644
--- a/drivers/spi/spi-ti-qspi.c
+++ b/drivers/spi/spi-ti-qspi.c
@@ -183,6 +183,7 @@ static int ti_qspi_setup(struct spi_device *spi)
 
 	ret = pm_runtime_get_sync(qspi->dev);
 	if (ret < 0) {
+		pm_runtime_put_noidle(qspi->dev);
 		dev_err(qspi->dev, "pm_runtime_get_sync() failed\n");
 		return ret;
 	}
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 126/346] spi: tegra20-slink: fix reference leak in slink ops of tegra20
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (124 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 4.19 125/346] spi: spi-ti-qspi: fix reference leak in ti_qspi_setup Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 4.19 127/346] spi: tegra20-sflash: fix reference leak in tegra_sflash_resume Greg Kroah-Hartman
                   ` (222 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Zhang Qilong, Mark Brown, Sasha Levin

From: Zhang Qilong <zhangqilong3@huawei.com>

[ Upstream commit 763eab7074f6e71babd85d796156f05a675f9510 ]

pm_runtime_get_sync will increment pm usage counter even it
failed. Forgetting to pm_runtime_put_noidle will result in
reference leak in two callers(tegra_slink_setup and
tegra_slink_resume), so we should fix it.

Fixes: dc4dc36056392 ("spi: tegra: add spi driver for SLINK controller")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Link: https://lore.kernel.org/r/20201103141345.6188-1-zhangqilong3@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-tegra20-slink.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/spi/spi-tegra20-slink.c b/drivers/spi/spi-tegra20-slink.c
index d1187317bb5d7..c6b80a60951b1 100644
--- a/drivers/spi/spi-tegra20-slink.c
+++ b/drivers/spi/spi-tegra20-slink.c
@@ -761,6 +761,7 @@ static int tegra_slink_setup(struct spi_device *spi)
 
 	ret = pm_runtime_get_sync(tspi->dev);
 	if (ret < 0) {
+		pm_runtime_put_noidle(tspi->dev);
 		dev_err(tspi->dev, "pm runtime failed, e = %d\n", ret);
 		return ret;
 	}
@@ -1197,6 +1198,7 @@ static int tegra_slink_resume(struct device *dev)
 
 	ret = pm_runtime_get_sync(dev);
 	if (ret < 0) {
+		pm_runtime_put_noidle(dev);
 		dev_err(dev, "pm runtime failed, e = %d\n", ret);
 		return ret;
 	}
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 127/346] spi: tegra20-sflash: fix reference leak in tegra_sflash_resume
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (125 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 4.19 126/346] spi: tegra20-slink: fix reference leak in slink ops of tegra20 Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 4.19 128/346] spi: tegra114: fix reference leak in tegra spi ops Greg Kroah-Hartman
                   ` (221 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Zhang Qilong, Mark Brown, Sasha Levin

From: Zhang Qilong <zhangqilong3@huawei.com>

[ Upstream commit 3482e797ab688da6703fe18d8bad52f94199f4f2 ]

pm_runtime_get_sync will increment pm usage counter even it
failed. Forgetting to pm_runtime_put_noidle will result in
reference leak in tegra_sflash_resume, so we should fix it.

Fixes: 8528547bcc336 ("spi: tegra: add spi driver for sflash controller")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Link: https://lore.kernel.org/r/20201103141323.5841-1-zhangqilong3@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-tegra20-sflash.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/spi/spi-tegra20-sflash.c b/drivers/spi/spi-tegra20-sflash.c
index 22893a7e0aa0e..749288310c36c 100644
--- a/drivers/spi/spi-tegra20-sflash.c
+++ b/drivers/spi/spi-tegra20-sflash.c
@@ -564,6 +564,7 @@ static int tegra_sflash_resume(struct device *dev)
 
 	ret = pm_runtime_get_sync(dev);
 	if (ret < 0) {
+		pm_runtime_put_noidle(dev);
 		dev_err(dev, "pm runtime failed, e = %d\n", ret);
 		return ret;
 	}
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 128/346] spi: tegra114: fix reference leak in tegra spi ops
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (126 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 4.19 127/346] spi: tegra20-sflash: fix reference leak in tegra_sflash_resume Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 4.19 129/346] spi: bcm63xx-hsspi: fix missing clk_disable_unprepare() on error in bcm63xx_hsspi_resume Greg Kroah-Hartman
                   ` (220 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Zhang Qilong, Mark Brown, Sasha Levin

From: Zhang Qilong <zhangqilong3@huawei.com>

[ Upstream commit a042184c7fb99961ea083d4ec192614bec671969 ]

pm_runtime_get_sync will increment pm usage counter even it
failed. Forgetting to pm_runtime_put_noidle will result in
reference leak in two callers(tegra_spi_setup and
tegra_spi_resume), so we should fix it.

Fixes: f333a331adfac ("spi/tegra114: add spi driver")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Link: https://lore.kernel.org/r/20201103141306.5607-1-zhangqilong3@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-tegra114.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/spi/spi-tegra114.c b/drivers/spi/spi-tegra114.c
index 09cfae3abce2d..c510b53e5e3f5 100644
--- a/drivers/spi/spi-tegra114.c
+++ b/drivers/spi/spi-tegra114.c
@@ -827,6 +827,7 @@ static int tegra_spi_setup(struct spi_device *spi)
 
 	ret = pm_runtime_get_sync(tspi->dev);
 	if (ret < 0) {
+		pm_runtime_put_noidle(tspi->dev);
 		dev_err(tspi->dev, "pm runtime failed, e = %d\n", ret);
 		return ret;
 	}
@@ -1252,6 +1253,7 @@ static int tegra_spi_resume(struct device *dev)
 
 	ret = pm_runtime_get_sync(dev);
 	if (ret < 0) {
+		pm_runtime_put_noidle(dev);
 		dev_err(dev, "pm runtime failed, e = %d\n", ret);
 		return ret;
 	}
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 129/346] spi: bcm63xx-hsspi: fix missing clk_disable_unprepare() on error in bcm63xx_hsspi_resume
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (127 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 4.19 128/346] spi: tegra114: fix reference leak in tegra spi ops Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 4.19 130/346] mwifiex: fix mwifiex_shutdown_sw() causing sw reset failure Greg Kroah-Hartman
                   ` (219 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Qinglang Miao, Mark Brown, Sasha Levin

From: Qinglang Miao <miaoqinglang@huawei.com>

[ Upstream commit 9bb9ef2b3e5d9d012876e7e2d7757eb30e865bee ]

Fix the missing clk_disable_unprepare() before return
from bcm63xx_hsspi_resume in the error handling case when
fails to prepare and enable bs->pll_clk.

Fixes: 0fd85869c2a9 ("spi/bcm63xx-hsspi: keep pll clk enabled")
Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
Link: https://lore.kernel.org/r/20201103074911.195530-1-miaoqinglang@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-bcm63xx-hsspi.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/spi/spi-bcm63xx-hsspi.c b/drivers/spi/spi-bcm63xx-hsspi.c
index 1669c554ea340..2ad7b3f3666be 100644
--- a/drivers/spi/spi-bcm63xx-hsspi.c
+++ b/drivers/spi/spi-bcm63xx-hsspi.c
@@ -487,8 +487,10 @@ static int bcm63xx_hsspi_resume(struct device *dev)
 
 	if (bs->pll_clk) {
 		ret = clk_prepare_enable(bs->pll_clk);
-		if (ret)
+		if (ret) {
+			clk_disable_unprepare(bs->clk);
 			return ret;
+		}
 	}
 
 	spi_master_resume(master);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 130/346] mwifiex: fix mwifiex_shutdown_sw() causing sw reset failure
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (128 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 4.19 129/346] spi: bcm63xx-hsspi: fix missing clk_disable_unprepare() on error in bcm63xx_hsspi_resume Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 4.19 131/346] ASoC: wm8998: Fix PM disable depth imbalance on error Greg Kroah-Hartman
                   ` (218 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Tsuchiya Yuto, Kalle Valo, Sasha Levin

From: Tsuchiya Yuto <kitakar@gmail.com>

[ Upstream commit fa74cb1dc0f4da46c441b735ca865ac52de42c0e ]

When a PCIe function level reset (FLR) is performed but without fw reset for
some reasons (e.g., on Microsoft Surface devices, fw reset requires other
quirks), it fails to reset wifi properly. You can trigger the issue on such
devices via debugfs entry for reset:

    $ echo 1 | sudo tee /sys/kernel/debug/mwifiex/mlan0/reset

and the resulting dmesg log:

    [   45.740508] mwifiex_pcie 0000:03:00.0: Resetting per request
    [   45.742937] mwifiex_pcie 0000:03:00.0: info: successfully disconnected from [BSSID]: reason code 3
    [   45.744666] mwifiex_pcie 0000:03:00.0: info: shutdown mwifiex...
    [   45.751530] mwifiex_pcie 0000:03:00.0: PREP_CMD: card is removed
    [   45.751539] mwifiex_pcie 0000:03:00.0: PREP_CMD: card is removed
    [   45.771691] mwifiex_pcie 0000:03:00.0: PREP_CMD: card is removed
    [   45.771695] mwifiex_pcie 0000:03:00.0: deleting the crypto keys
    [   45.771697] mwifiex_pcie 0000:03:00.0: PREP_CMD: card is removed
    [   45.771698] mwifiex_pcie 0000:03:00.0: deleting the crypto keys
    [   45.771699] mwifiex_pcie 0000:03:00.0: PREP_CMD: card is removed
    [   45.771701] mwifiex_pcie 0000:03:00.0: deleting the crypto keys
    [   45.771702] mwifiex_pcie 0000:03:00.0: PREP_CMD: card is removed
    [   45.771703] mwifiex_pcie 0000:03:00.0: deleting the crypto keys
    [   45.771704] mwifiex_pcie 0000:03:00.0: PREP_CMD: card is removed
    [   45.771705] mwifiex_pcie 0000:03:00.0: deleting the crypto keys
    [   45.771707] mwifiex_pcie 0000:03:00.0: PREP_CMD: card is removed
    [   45.771708] mwifiex_pcie 0000:03:00.0: deleting the crypto keys
    [   53.099343] mwifiex_pcie 0000:03:00.0: info: trying to associate to '[SSID]' bssid [BSSID]
    [   53.241870] mwifiex_pcie 0000:03:00.0: info: associated to bssid [BSSID] successfully
    [   75.377942] mwifiex_pcie 0000:03:00.0: cmd_wait_q terminated: -110
    [   85.385491] mwifiex_pcie 0000:03:00.0: info: successfully disconnected from [BSSID]: reason code 15
    [   87.539408] mwifiex_pcie 0000:03:00.0: cmd_wait_q terminated: -110
    [   87.539412] mwifiex_pcie 0000:03:00.0: deleting the crypto keys
    [   99.699917] mwifiex_pcie 0000:03:00.0: cmd_wait_q terminated: -110
    [   99.699925] mwifiex_pcie 0000:03:00.0: deleting the crypto keys
    [  111.859802] mwifiex_pcie 0000:03:00.0: cmd_wait_q terminated: -110
    [  111.859808] mwifiex_pcie 0000:03:00.0: deleting the crypto keys
    [...]

When comparing mwifiex_shutdown_sw() with mwifiex_pcie_remove(), it
lacks mwifiex_init_shutdown_fw().

This commit fixes mwifiex_shutdown_sw() by adding the missing
mwifiex_init_shutdown_fw().

Fixes: 4c5dae59d2e9 ("mwifiex: add PCIe function level reset support")
Signed-off-by: Tsuchiya Yuto <kitakar@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20201028142110.18144-2-kitakar@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/marvell/mwifiex/main.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/wireless/marvell/mwifiex/main.c b/drivers/net/wireless/marvell/mwifiex/main.c
index e48b47f425540..ceac611ef0864 100644
--- a/drivers/net/wireless/marvell/mwifiex/main.c
+++ b/drivers/net/wireless/marvell/mwifiex/main.c
@@ -1474,6 +1474,8 @@ int mwifiex_shutdown_sw(struct mwifiex_adapter *adapter)
 	priv = mwifiex_get_priv(adapter, MWIFIEX_BSS_ROLE_ANY);
 	mwifiex_deauthenticate(priv, NULL);
 
+	mwifiex_init_shutdown_fw(priv, MWIFIEX_FUNC_SHUTDOWN);
+
 	mwifiex_uninit_sw(adapter);
 
 	if (adapter->if_ops.down_dev)
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 131/346] ASoC: wm8998: Fix PM disable depth imbalance on error
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (129 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 4.19 130/346] mwifiex: fix mwifiex_shutdown_sw() causing sw reset failure Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 4.19 132/346] net: evaluate net.ipvX.conf.all.ignore_routes_with_linkdown Greg Kroah-Hartman
                   ` (217 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Zhang Qilong, Richard Fitzgerald,
	Mark Brown, Sasha Levin

From: Zhang Qilong <zhangqilong3@huawei.com>

[ Upstream commit 193aa0a043645220d2a2f783ba06ae13d4601078 ]

The pm_runtime_enable will increase power disable depth. Thus
a pairing decrement is needed on the error handling path to
keep it balanced according to context.

Fixes: 31833ead95c2c ("ASoC: arizona: Move request of speaker IRQs into bus probe")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Reviewed-by: Richard Fitzgerald <rf@opensource.cirrus.com>
Link: https://lore.kernel.org/r/20201111041326.1257558-4-zhangqilong3@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/codecs/wm8998.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/sound/soc/codecs/wm8998.c b/sound/soc/codecs/wm8998.c
index 61294c787f274..17dc5780ab686 100644
--- a/sound/soc/codecs/wm8998.c
+++ b/sound/soc/codecs/wm8998.c
@@ -1378,7 +1378,7 @@ static int wm8998_probe(struct platform_device *pdev)
 
 	ret = arizona_init_spk_irqs(arizona);
 	if (ret < 0)
-		return ret;
+		goto err_pm_disable;
 
 	ret = devm_snd_soc_register_component(&pdev->dev,
 					      &soc_component_dev_wm8998,
@@ -1393,6 +1393,8 @@ static int wm8998_probe(struct platform_device *pdev)
 
 err_spk_irqs:
 	arizona_free_spk_irqs(arizona);
+err_pm_disable:
+	pm_runtime_disable(&pdev->dev);
 
 	return ret;
 }
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 132/346] net: evaluate net.ipvX.conf.all.ignore_routes_with_linkdown
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (130 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 4.19 131/346] ASoC: wm8998: Fix PM disable depth imbalance on error Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 4.19 133/346] net: evaluate net.ipv4.conf.all.proxy_arp_pvlan Greg Kroah-Hartman
                   ` (216 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Vincent Bernat, Jakub Kicinski, Sasha Levin

From: Vincent Bernat <vincent@bernat.ch>

[ Upstream commit c0c5a60f0f1311bcf08bbe735122096d6326fb5b ]

Introduced in 0eeb075fad73, the "ignore_routes_with_linkdown" sysctl
ignores a route whose interface is down. It is provided as a
per-interface sysctl. However, while a "all" variant is exposed, it
was a noop since it was never evaluated. We use the usual "or" logic
for this kind of sysctls.

Tested with:

    ip link add type veth # veth0 + veth1
    ip link add type veth # veth1 + veth2
    ip link set up dev veth0
    ip link set up dev veth1 # link-status paired with veth0
    ip link set up dev veth2
    ip link set up dev veth3 # link-status paired with veth2

    # First available path
    ip -4 addr add 203.0.113.${uts#H}/24 dev veth0
    ip -6 addr add 2001:db8:1::${uts#H}/64 dev veth0

    # Second available path
    ip -4 addr add 192.0.2.${uts#H}/24 dev veth2
    ip -6 addr add 2001:db8:2::${uts#H}/64 dev veth2

    # More specific route through first path
    ip -4 route add 198.51.100.0/25 via 203.0.113.254 # via veth0
    ip -6 route add 2001:db8:3::/56 via 2001:db8:1::ff # via veth0

    # Less specific route through second path
    ip -4 route add 198.51.100.0/24 via 192.0.2.254 # via veth2
    ip -6 route add 2001:db8:3::/48 via 2001:db8:2::ff # via veth2

    # H1: enable on "all"
    # H2: enable on "veth0"
    for v in ipv4 ipv6; do
      case $uts in
        H1)
          sysctl -qw net.${v}.conf.all.ignore_routes_with_linkdown=1
          ;;
        H2)
          sysctl -qw net.${v}.conf.veth0.ignore_routes_with_linkdown=1
          ;;
      esac
    done

    set -xe
    # When veth0 is up, best route is through veth0
    ip -o route get 198.51.100.1 | grep -Fw veth0
    ip -o route get 2001:db8:3::1 | grep -Fw veth0

    # When veth0 is down, best route should be through veth2 on H1/H2,
    # but on veth0 on H2
    ip link set down dev veth1 # down veth0
    ip route show
    [ $uts != H3 ] || ip -o route get 198.51.100.1 | grep -Fw veth0
    [ $uts != H3 ] || ip -o route get 2001:db8:3::1 | grep -Fw veth0
    [ $uts = H3 ] || ip -o route get 198.51.100.1 | grep -Fw veth2
    [ $uts = H3 ] || ip -o route get 2001:db8:3::1 | grep -Fw veth2

Without this patch, the two last lines would fail on H1 (the one using
the "all" sysctl). With the patch, everything succeeds as expected.

Also document the sysctl in `ip-sysctl.rst`.

Fixes: 0eeb075fad73 ("net: ipv4 sysctl option to ignore routes when nexthop link is down")
Signed-off-by: Vincent Bernat <vincent@bernat.ch>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 Documentation/networking/ip-sysctl.txt | 3 +++
 include/linux/inetdevice.h             | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
index 3c617d620b6f8..94d42eb83588b 100644
--- a/Documentation/networking/ip-sysctl.txt
+++ b/Documentation/networking/ip-sysctl.txt
@@ -1300,6 +1300,9 @@ igmpv3_unsolicited_report_interval - INTEGER
 	IGMPv3 report retransmit will take place.
 	Default: 1000 (1 seconds)
 
+ignore_routes_with_linkdown - BOOLEAN
+        Ignore routes whose link is down when performing a FIB lookup.
+
 promote_secondaries - BOOLEAN
 	When a primary IP address is removed from this interface
 	promote a corresponding secondary IP address instead of
diff --git a/include/linux/inetdevice.h b/include/linux/inetdevice.h
index a64f21a97369a..11adf828edf58 100644
--- a/include/linux/inetdevice.h
+++ b/include/linux/inetdevice.h
@@ -126,7 +126,7 @@ static inline void ipv4_devconf_setall(struct in_device *in_dev)
 	  IN_DEV_ORCONF((in_dev), ACCEPT_REDIRECTS)))
 
 #define IN_DEV_IGNORE_ROUTES_WITH_LINKDOWN(in_dev) \
-	IN_DEV_CONF_GET((in_dev), IGNORE_ROUTES_WITH_LINKDOWN)
+	IN_DEV_ORCONF((in_dev), IGNORE_ROUTES_WITH_LINKDOWN)
 
 #define IN_DEV_ARPFILTER(in_dev)	IN_DEV_ORCONF((in_dev), ARPFILTER)
 #define IN_DEV_ARP_ACCEPT(in_dev)	IN_DEV_ORCONF((in_dev), ARP_ACCEPT)
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 133/346] net: evaluate net.ipv4.conf.all.proxy_arp_pvlan
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (131 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 4.19 132/346] net: evaluate net.ipvX.conf.all.ignore_routes_with_linkdown Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 4.19 134/346] ASoC: arizona: Fix a wrong free in wm8997_probe Greg Kroah-Hartman
                   ` (215 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Vincent Bernat, Jakub Kicinski, Sasha Levin

From: Vincent Bernat <vincent@bernat.ch>

[ Upstream commit 1af5318c00a8acc33a90537af49b3f23f72a2c4b ]

Introduced in 65324144b50b, the "proxy_arp_vlan" sysctl is a
per-interface sysctl to tune proxy ARP support for private VLANs.
While the "all" variant is exposed, it was a noop and never evaluated.
We use the usual "or" logic for this kind of sysctls.

Fixes: 65324144b50b ("net: RFC3069, private VLAN proxy arp support")
Signed-off-by: Vincent Bernat <vincent@bernat.ch>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/inetdevice.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/linux/inetdevice.h b/include/linux/inetdevice.h
index 11adf828edf58..141abec5cf957 100644
--- a/include/linux/inetdevice.h
+++ b/include/linux/inetdevice.h
@@ -105,7 +105,7 @@ static inline void ipv4_devconf_setall(struct in_device *in_dev)
 
 #define IN_DEV_LOG_MARTIANS(in_dev)	IN_DEV_ORCONF((in_dev), LOG_MARTIANS)
 #define IN_DEV_PROXY_ARP(in_dev)	IN_DEV_ORCONF((in_dev), PROXY_ARP)
-#define IN_DEV_PROXY_ARP_PVLAN(in_dev)	IN_DEV_CONF_GET(in_dev, PROXY_ARP_PVLAN)
+#define IN_DEV_PROXY_ARP_PVLAN(in_dev)	IN_DEV_ORCONF((in_dev), PROXY_ARP_PVLAN)
 #define IN_DEV_SHARED_MEDIA(in_dev)	IN_DEV_ORCONF((in_dev), SHARED_MEDIA)
 #define IN_DEV_TX_REDIRECTS(in_dev)	IN_DEV_ORCONF((in_dev), SEND_REDIRECTS)
 #define IN_DEV_SEC_REDIRECTS(in_dev)	IN_DEV_ORCONF((in_dev), \
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 134/346] ASoC: arizona: Fix a wrong free in wm8997_probe
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (132 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 4.19 133/346] net: evaluate net.ipv4.conf.all.proxy_arp_pvlan Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 4.19 135/346] RDMa/mthca: Work around -Wenum-conversion warning Greg Kroah-Hartman
                   ` (214 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Richard Fitzgerald, Zhang Qilong,
	Mark Brown, Sasha Levin

From: Zhang Qilong <zhangqilong3@huawei.com>

[ Upstream commit 5e7aace13df24ff72511f29c14ebbfe638ef733c ]

In the normal path, we should not free the arizona,
we should return immediately. It will be free when
call remove operation.

Fixes: 31833ead95c2c ("ASoC: arizona: Move request of speaker IRQs into bus probe")
Reported-by: Richard Fitzgerald <rf@opensource.cirrus.com>
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Acked-by: Richard Fitzgerald <rf@opensource.cirrus.com>
Link: https://lore.kernel.org/r/20201111130923.220186-2-zhangqilong3@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/codecs/wm8997.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/sound/soc/codecs/wm8997.c b/sound/soc/codecs/wm8997.c
index df5b36b8fc5a6..bb6a95be87265 100644
--- a/sound/soc/codecs/wm8997.c
+++ b/sound/soc/codecs/wm8997.c
@@ -1180,6 +1180,8 @@ static int wm8997_probe(struct platform_device *pdev)
 		goto err_spk_irqs;
 	}
 
+	return ret;
+
 err_spk_irqs:
 	arizona_free_spk_irqs(arizona);
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 135/346] RDMa/mthca: Work around -Wenum-conversion warning
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (133 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 4.19 134/346] ASoC: arizona: Fix a wrong free in wm8997_probe Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 4.19 136/346] MIPS: BCM47XX: fix kconfig dependency bug for BCM47XX_BCMA Greg Kroah-Hartman
                   ` (213 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Arnd Bergmann, Jason Gunthorpe, Sasha Levin

From: Arnd Bergmann <arnd@arndb.de>

[ Upstream commit fbb7dc5db6dee553b5a07c27e86364a5223e244c ]

gcc points out a suspicious mixing of enum types in a function that
converts from MTHCA_OPCODE_* values to IB_WC_* values:

drivers/infiniband/hw/mthca/mthca_cq.c: In function 'mthca_poll_one':
drivers/infiniband/hw/mthca/mthca_cq.c:607:21: warning: implicit conversion from 'enum <anonymous>' to 'enum ib_wc_opcode' [-Wenum-conversion]
  607 |    entry->opcode    = MTHCA_OPCODE_INVALID;

Nothing seems to ever check for MTHCA_OPCODE_INVALID again, no idea if
this is meaningful, but it seems harmless as it deals with an invalid
input.

Remove MTHCA_OPCODE_INVALID and set the ib_wc_opcode to 0xFF, which is
still bogus, but at least doesn't make compiler warnings.

Fixes: 2a4443a69934 ("[PATCH] IB/mthca: fill in opcode field for send completions")
Link: https://lore.kernel.org/r/20201026211311.3887003-1-arnd@kernel.org
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/hw/mthca/mthca_cq.c  | 2 +-
 drivers/infiniband/hw/mthca/mthca_dev.h | 1 -
 2 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/infiniband/hw/mthca/mthca_cq.c b/drivers/infiniband/hw/mthca/mthca_cq.c
index a5694dec3f2ee..098653b8157ed 100644
--- a/drivers/infiniband/hw/mthca/mthca_cq.c
+++ b/drivers/infiniband/hw/mthca/mthca_cq.c
@@ -609,7 +609,7 @@ static inline int mthca_poll_one(struct mthca_dev *dev,
 			entry->byte_len  = MTHCA_ATOMIC_BYTE_LEN;
 			break;
 		default:
-			entry->opcode    = MTHCA_OPCODE_INVALID;
+			entry->opcode = 0xFF;
 			break;
 		}
 	} else {
diff --git a/drivers/infiniband/hw/mthca/mthca_dev.h b/drivers/infiniband/hw/mthca/mthca_dev.h
index 220a3e4717a35..e23575861f287 100644
--- a/drivers/infiniband/hw/mthca/mthca_dev.h
+++ b/drivers/infiniband/hw/mthca/mthca_dev.h
@@ -105,7 +105,6 @@ enum {
 	MTHCA_OPCODE_ATOMIC_CS      = 0x11,
 	MTHCA_OPCODE_ATOMIC_FA      = 0x12,
 	MTHCA_OPCODE_BIND_MW        = 0x18,
-	MTHCA_OPCODE_INVALID        = 0xff
 };
 
 enum {
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 136/346] MIPS: BCM47XX: fix kconfig dependency bug for BCM47XX_BCMA
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (134 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 4.19 135/346] RDMa/mthca: Work around -Wenum-conversion warning Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 4.19 137/346] crypto: qat - fix status check in qat_hal_put_rel_rd_xfer() Greg Kroah-Hartman
                   ` (212 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Necip Fazil Yildiran,
	Thomas Bogendoerfer, Sasha Levin

From: Necip Fazil Yildiran <fazilyildiran@gmail.com>

[ Upstream commit 3a5fe2fb9635c43359c9729352f45044f3c8df6b ]

When BCM47XX_BCMA is enabled and BCMA_DRIVER_PCI is disabled, it results
in the following Kbuild warning:

WARNING: unmet direct dependencies detected for BCMA_DRIVER_PCI_HOSTMODE
  Depends on [n]: MIPS [=y] && BCMA_DRIVER_PCI [=n] && PCI_DRIVERS_LEGACY [=y] && BCMA [=y]=y
  Selected by [y]:
  - BCM47XX_BCMA [=y] && BCM47XX [=y] && PCI [=y]

The reason is that BCM47XX_BCMA selects BCMA_DRIVER_PCI_HOSTMODE without
depending on or selecting BCMA_DRIVER_PCI while BCMA_DRIVER_PCI_HOSTMODE
depends on BCMA_DRIVER_PCI. This can also fail building the kernel.

Honor the kconfig dependency to remove unmet direct dependency warnings
and avoid any potential build failures.

Fixes: c1d1c5d4213e ("bcm47xx: add support for bcma bus")
Link: https://bugzilla.kernel.org/show_bug.cgi?id=209879
Signed-off-by: Necip Fazil Yildiran <fazilyildiran@gmail.com>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/mips/bcm47xx/Kconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/mips/bcm47xx/Kconfig b/arch/mips/bcm47xx/Kconfig
index 29471038d817e..c6b99845fb377 100644
--- a/arch/mips/bcm47xx/Kconfig
+++ b/arch/mips/bcm47xx/Kconfig
@@ -27,6 +27,7 @@ config BCM47XX_BCMA
 	select BCMA
 	select BCMA_HOST_SOC
 	select BCMA_DRIVER_MIPS
+	select BCMA_DRIVER_PCI if PCI
 	select BCMA_DRIVER_PCI_HOSTMODE if PCI
 	select BCMA_DRIVER_GPIO
 	default y
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 137/346] crypto: qat - fix status check in qat_hal_put_rel_rd_xfer()
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (135 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 4.19 136/346] MIPS: BCM47XX: fix kconfig dependency bug for BCM47XX_BCMA Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 4.19 138/346] staging: greybus: codecs: Fix reference counter leak in error handling Greg Kroah-Hartman
                   ` (211 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jack Xu, Giovanni Cabiddu,
	Fiona Trahe, Herbert Xu, Sasha Levin

From: Jack Xu <jack.xu@intel.com>

[ Upstream commit 3b5c130fb2e4c045369791c33c83b59f6e84f7d6 ]

The return value of qat_hal_rd_ae_csr() is always a CSR value and never
a status and should not be stored in the status variable of
qat_hal_put_rel_rd_xfer().

This removes the assignment as qat_hal_rd_ae_csr() is not expected to
fail.
A more comprehensive handling of the theoretical corner case which could
result in a fail will be submitted in a separate patch.

Fixes: 8c9478a400b7 ("crypto: qat - reduce stack size with KASAN")
Signed-off-by: Jack Xu <jack.xu@intel.com>
Reviewed-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Reviewed-by: Fiona Trahe <fiona.trahe@intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/qat/qat_common/qat_hal.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/crypto/qat/qat_common/qat_hal.c b/drivers/crypto/qat/qat_common/qat_hal.c
index ff149e176f649..dac130bb807ae 100644
--- a/drivers/crypto/qat/qat_common/qat_hal.c
+++ b/drivers/crypto/qat/qat_common/qat_hal.c
@@ -1189,7 +1189,7 @@ static int qat_hal_put_rel_rd_xfer(struct icp_qat_fw_loader_handle *handle,
 	unsigned short mask;
 	unsigned short dr_offset = 0x10;
 
-	status = ctx_enables = qat_hal_rd_ae_csr(handle, ae, CTX_ENABLES);
+	ctx_enables = qat_hal_rd_ae_csr(handle, ae, CTX_ENABLES);
 	if (CE_INUSE_CONTEXTS & ctx_enables) {
 		if (ctx & 0x1) {
 			pr_err("QAT: bad 4-ctx mode,ctx=0x%x\n", ctx);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 138/346] staging: greybus: codecs: Fix reference counter leak in error handling
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (136 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 4.19 137/346] crypto: qat - fix status check in qat_hal_put_rel_rd_xfer() Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 4.19 139/346] staging: gasket: interrupt: fix the missed eventfd_ctx_put() in gasket_interrupt.c Greg Kroah-Hartman
                   ` (210 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Zhang Qilong, Sasha Levin

From: Zhang Qilong <zhangqilong3@huawei.com>

[ Upstream commit 3952659a6108f77a0d062d8e8487bdbdaf52a66c ]

gb_pm_runtime_get_sync has increased the usage counter of the device here.
Forgetting to call gb_pm_runtime_put_noidle will result in usage counter
leak in the error branch of (gbcodec_hw_params and gbcodec_prepare). We
fixed it by adding it.

Fixes: c388ae7696992 ("greybus: audio: Update pm runtime support in dai_ops callback")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Link: https://lore.kernel.org/r/20201109131347.1725288-2-zhangqilong3@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/staging/greybus/audio_codec.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/staging/greybus/audio_codec.c b/drivers/staging/greybus/audio_codec.c
index 35acd55ca5ab7..6cbf69a57dfd9 100644
--- a/drivers/staging/greybus/audio_codec.c
+++ b/drivers/staging/greybus/audio_codec.c
@@ -489,6 +489,7 @@ static int gbcodec_hw_params(struct snd_pcm_substream *substream,
 	if (ret) {
 		dev_err_ratelimited(dai->dev, "%d: Error during set_config\n",
 				    ret);
+		gb_pm_runtime_put_noidle(bundle);
 		mutex_unlock(&codec->lock);
 		return ret;
 	}
@@ -565,6 +566,7 @@ static int gbcodec_prepare(struct snd_pcm_substream *substream,
 		break;
 	}
 	if (ret) {
+		gb_pm_runtime_put_noidle(bundle);
 		mutex_unlock(&codec->lock);
 		dev_err_ratelimited(dai->dev, "set_data_size failed:%d\n",
 				    ret);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 139/346] staging: gasket: interrupt: fix the missed eventfd_ctx_put() in gasket_interrupt.c
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (137 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 4.19 138/346] staging: greybus: codecs: Fix reference counter leak in error handling Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 4.19 140/346] media: tm6000: Fix sizeof() mismatches Greg Kroah-Hartman
                   ` (209 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jing Xiangfeng, Sasha Levin

From: Jing Xiangfeng <jingxiangfeng@huawei.com>

[ Upstream commit ab5b769a23af12a675b9f3d7dd529250c527f5ac ]

gasket_interrupt_set_eventfd() misses to call eventfd_ctx_put() in an
error path. We check interrupt is valid before calling
eventfd_ctx_fdget() to fix it.

There is the same issue in gasket_interrupt_clear_eventfd(), Add the
missed function call to fix it.

Fixes: 9a69f5087ccc ("drivers/staging: Gasket driver framework + Apex driver")
Signed-off-by: Jing Xiangfeng <jingxiangfeng@huawei.com>
Link: https://lore.kernel.org/r/20201112064924.99680-1-jingxiangfeng@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/staging/gasket/gasket_interrupt.c | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/drivers/staging/gasket/gasket_interrupt.c b/drivers/staging/gasket/gasket_interrupt.c
index 1cfbc120f2284..225460c535d61 100644
--- a/drivers/staging/gasket/gasket_interrupt.c
+++ b/drivers/staging/gasket/gasket_interrupt.c
@@ -527,14 +527,16 @@ int gasket_interrupt_system_status(struct gasket_dev *gasket_dev)
 int gasket_interrupt_set_eventfd(struct gasket_interrupt_data *interrupt_data,
 				 int interrupt, int event_fd)
 {
-	struct eventfd_ctx *ctx = eventfd_ctx_fdget(event_fd);
-
-	if (IS_ERR(ctx))
-		return PTR_ERR(ctx);
+	struct eventfd_ctx *ctx;
 
 	if (interrupt < 0 || interrupt >= interrupt_data->num_interrupts)
 		return -EINVAL;
 
+	ctx = eventfd_ctx_fdget(event_fd);
+
+	if (IS_ERR(ctx))
+		return PTR_ERR(ctx);
+
 	interrupt_data->eventfd_ctxs[interrupt] = ctx;
 	return 0;
 }
@@ -545,6 +547,9 @@ int gasket_interrupt_clear_eventfd(struct gasket_interrupt_data *interrupt_data,
 	if (interrupt < 0 || interrupt >= interrupt_data->num_interrupts)
 		return -EINVAL;
 
-	interrupt_data->eventfd_ctxs[interrupt] = NULL;
+	if (interrupt_data->eventfd_ctxs[interrupt]) {
+		eventfd_ctx_put(interrupt_data->eventfd_ctxs[interrupt]);
+		interrupt_data->eventfd_ctxs[interrupt] = NULL;
+	}
 	return 0;
 }
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 140/346] media: tm6000: Fix sizeof() mismatches
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (138 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 4.19 139/346] staging: gasket: interrupt: fix the missed eventfd_ctx_put() in gasket_interrupt.c Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 4.19 141/346] media: mtk-vcodec: add missing put_device() call in mtk_vcodec_release_dec_pm() Greg Kroah-Hartman
                   ` (208 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Colin Ian King, Hans Verkuil,
	Mauro Carvalho Chehab, Sasha Levin

From: Colin Ian King <colin.king@canonical.com>

[ Upstream commit a08ad6339e0441ca12533969ed94a87e3655426e ]

The are two instances of sizeof() being used incorrectly. The
sizeof(void *) is incorrect because urb_buffer is a char ** pointer,
fix this by using sizeof(*dev->urb_buffer).  The sizeof(dma_addr_t *)
is incorrect, it should be sizeof(*dev->urb_dma), which is a dma_addr_t
and not a dma_addr_t *.  This errors did not cause any issues because
it just so happens the sizes are the same.

Addresses-Coverity: ("Sizeof not portable (SIZEOF_MISMATCH)")

Fixes: 16427faf2867 ("[media] tm6000: Add parameter to keep urb bufs allocated")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/usb/tm6000/tm6000-video.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/media/usb/tm6000/tm6000-video.c b/drivers/media/usb/tm6000/tm6000-video.c
index 96055de6e8ce2..62f0128419717 100644
--- a/drivers/media/usb/tm6000/tm6000-video.c
+++ b/drivers/media/usb/tm6000/tm6000-video.c
@@ -463,11 +463,12 @@ static int tm6000_alloc_urb_buffers(struct tm6000_core *dev)
 	if (dev->urb_buffer)
 		return 0;
 
-	dev->urb_buffer = kmalloc_array(num_bufs, sizeof(void *), GFP_KERNEL);
+	dev->urb_buffer = kmalloc_array(num_bufs, sizeof(*dev->urb_buffer),
+					GFP_KERNEL);
 	if (!dev->urb_buffer)
 		return -ENOMEM;
 
-	dev->urb_dma = kmalloc_array(num_bufs, sizeof(dma_addr_t *),
+	dev->urb_dma = kmalloc_array(num_bufs, sizeof(*dev->urb_dma),
 				     GFP_KERNEL);
 	if (!dev->urb_dma)
 		return -ENOMEM;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 141/346] media: mtk-vcodec: add missing put_device() call in mtk_vcodec_release_dec_pm()
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (139 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 4.19 140/346] media: tm6000: Fix sizeof() mismatches Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 4.19 142/346] ASoC: meson: fix COMPILE_TEST error Greg Kroah-Hartman
                   ` (207 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yu Kuai, Hans Verkuil,
	Mauro Carvalho Chehab, Sasha Levin

From: Yu Kuai <yukuai3@huawei.com>

[ Upstream commit 27c3943683f74e35e1d390ceb2e3639eff616ad6 ]

mtk_vcodec_release_dec_pm() will be called in two places:

a. mtk_vcodec_init_dec_pm() succeed while mtk_vcodec_probe() return error.
b. mtk_vcodec_dec_remove().

In both cases put_device() call is needed, since of_find_device_by_node()
was called in mtk_vcodec_init_dec_pm() previously.

Thus add put_devices() call in mtk_vcodec_release_dec_pm()

Fixes: 590577a4e525 ("[media] vcodec: mediatek: Add Mediatek V4L2 Video Decoder Driver")
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/mtk-vcodec/mtk_vcodec_dec_pm.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/media/platform/mtk-vcodec/mtk_vcodec_dec_pm.c b/drivers/media/platform/mtk-vcodec/mtk_vcodec_dec_pm.c
index 79ca03ac449c3..3f64119e8c082 100644
--- a/drivers/media/platform/mtk-vcodec/mtk_vcodec_dec_pm.c
+++ b/drivers/media/platform/mtk-vcodec/mtk_vcodec_dec_pm.c
@@ -103,6 +103,7 @@ int mtk_vcodec_init_dec_pm(struct mtk_vcodec_dev *mtkdev)
 void mtk_vcodec_release_dec_pm(struct mtk_vcodec_dev *dev)
 {
 	pm_runtime_disable(dev->pm.dev);
+	put_device(dev->pm.larbvdec);
 }
 
 void mtk_vcodec_dec_pw_on(struct mtk_vcodec_pm *pm)
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 142/346] ASoC: meson: fix COMPILE_TEST error
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (140 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 4.19 141/346] media: mtk-vcodec: add missing put_device() call in mtk_vcodec_release_dec_pm() Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 4.19 143/346] scsi: core: Fix VPD LUN ID designator priorities Greg Kroah-Hartman
                   ` (206 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, kernel test robot, Jerome Brunet,
	Mark Brown, Sasha Levin

From: Jerome Brunet <jbrunet@baylibre.com>

[ Upstream commit 299fe9937dbd1a4d9a1da6a2b6f222298534ca57 ]

When compiled with CONFIG_HAVE_CLK, the kernel need to get provider for the
clock API. This is usually selected by the platform and the sound drivers
should not really care about this. However COMPILE_TEST is special and the
platform required may not have been selected, leading to this type of
error:

> aiu-encoder-spdif.c:(.text+0x3a0): undefined reference to `clk_set_parent'

Since we need a sane provider of the API with COMPILE_TEST, depends on
COMMON_CLK.

Fixes: 6dc4fa179fb8 ("ASoC: meson: add axg fifo base driver")
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
Link: https://lore.kernel.org/r/20201116172423.546855-1-jbrunet@baylibre.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/meson/Kconfig | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sound/soc/meson/Kconfig b/sound/soc/meson/Kconfig
index 8af8bc358a90a..19fd4d583b869 100644
--- a/sound/soc/meson/Kconfig
+++ b/sound/soc/meson/Kconfig
@@ -1,5 +1,5 @@
 menu "ASoC support for Amlogic platforms"
-	depends on ARCH_MESON || COMPILE_TEST
+	depends on ARCH_MESON || (COMPILE_TEST && COMMON_CLK)
 
 config SND_MESON_AXG_FIFO
 	tristate
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 143/346] scsi: core: Fix VPD LUN ID designator priorities
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (141 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 4.19 142/346] ASoC: meson: fix COMPILE_TEST error Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 4.19 144/346] media: solo6x10: fix missing snd_card_free in error handling case Greg Kroah-Hartman
                   ` (205 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hannes Reinecke, Martin Wilck,
	Martin K. Petersen, Sasha Levin

From: Martin Wilck <mwilck@suse.com>

[ Upstream commit 2e4209b3806cda9b89c30fd5e7bfecb7044ec78b ]

The current implementation of scsi_vpd_lun_id() uses the designator length
as an implicit measure of priority. This works most of the time, but not
always. For example, some Hitachi storage arrays return this in VPD 0x83:

VPD INQUIRY: Device Identification page
  Designation descriptor number 1, descriptor length: 24
    designator_type: T10 vendor identification,  code_set: ASCII
    associated with the Addressed logical unit
      vendor id: HITACHI
      vendor specific: 5030C3502025
  Designation descriptor number 2, descriptor length: 6
    designator_type: vendor specific [0x0],  code_set: Binary
    associated with the Target port
      vendor specific: 08 03
  Designation descriptor number 3, descriptor length: 20
    designator_type: NAA,  code_set: Binary
    associated with the Addressed logical unit
      NAA 6, IEEE Company_id: 0x60e8
      Vendor Specific Identifier: 0x7c35000
      Vendor Specific Identifier Extension: 0x30c35000002025
      [0x60060e8007c350000030c35000002025]

The current code would use the first descriptor because it's longer than
the NAA descriptor. But this is wrong, the kernel is supposed to prefer NAA
descriptors over T10 vendor ID. Designator length should only be used to
compare designators of the same type.

This patch addresses the issue by separating designator priority and
length.

Link: https://lore.kernel.org/r/20201029170846.14786-1-mwilck@suse.com
Fixes: 9983bed3907c ("scsi: Add scsi_vpd_lun_id()")
Reviewed-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: Martin Wilck <mwilck@suse.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/scsi_lib.c | 126 +++++++++++++++++++++++++++-------------
 1 file changed, 86 insertions(+), 40 deletions(-)

diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index c501fb5190a38..fe5ae2b221c19 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -3446,6 +3446,78 @@ void sdev_enable_disk_events(struct scsi_device *sdev)
 }
 EXPORT_SYMBOL(sdev_enable_disk_events);
 
+static unsigned char designator_prio(const unsigned char *d)
+{
+	if (d[1] & 0x30)
+		/* not associated with LUN */
+		return 0;
+
+	if (d[3] == 0)
+		/* invalid length */
+		return 0;
+
+	/*
+	 * Order of preference for lun descriptor:
+	 * - SCSI name string
+	 * - NAA IEEE Registered Extended
+	 * - EUI-64 based 16-byte
+	 * - EUI-64 based 12-byte
+	 * - NAA IEEE Registered
+	 * - NAA IEEE Extended
+	 * - EUI-64 based 8-byte
+	 * - SCSI name string (truncated)
+	 * - T10 Vendor ID
+	 * as longer descriptors reduce the likelyhood
+	 * of identification clashes.
+	 */
+
+	switch (d[1] & 0xf) {
+	case 8:
+		/* SCSI name string, variable-length UTF-8 */
+		return 9;
+	case 3:
+		switch (d[4] >> 4) {
+		case 6:
+			/* NAA registered extended */
+			return 8;
+		case 5:
+			/* NAA registered */
+			return 5;
+		case 4:
+			/* NAA extended */
+			return 4;
+		case 3:
+			/* NAA locally assigned */
+			return 1;
+		default:
+			break;
+		}
+		break;
+	case 2:
+		switch (d[3]) {
+		case 16:
+			/* EUI64-based, 16 byte */
+			return 7;
+		case 12:
+			/* EUI64-based, 12 byte */
+			return 6;
+		case 8:
+			/* EUI64-based, 8 byte */
+			return 3;
+		default:
+			break;
+		}
+		break;
+	case 1:
+		/* T10 vendor ID */
+		return 1;
+	default:
+		break;
+	}
+
+	return 0;
+}
+
 /**
  * scsi_vpd_lun_id - return a unique device identification
  * @sdev: SCSI device
@@ -3462,7 +3534,7 @@ EXPORT_SYMBOL(sdev_enable_disk_events);
  */
 int scsi_vpd_lun_id(struct scsi_device *sdev, char *id, size_t id_len)
 {
-	u8 cur_id_type = 0xff;
+	u8 cur_id_prio = 0;
 	u8 cur_id_size = 0;
 	const unsigned char *d, *cur_id_str;
 	const struct scsi_vpd *vpd_pg83;
@@ -3475,20 +3547,6 @@ int scsi_vpd_lun_id(struct scsi_device *sdev, char *id, size_t id_len)
 		return -ENXIO;
 	}
 
-	/*
-	 * Look for the correct descriptor.
-	 * Order of preference for lun descriptor:
-	 * - SCSI name string
-	 * - NAA IEEE Registered Extended
-	 * - EUI-64 based 16-byte
-	 * - EUI-64 based 12-byte
-	 * - NAA IEEE Registered
-	 * - NAA IEEE Extended
-	 * - T10 Vendor ID
-	 * as longer descriptors reduce the likelyhood
-	 * of identification clashes.
-	 */
-
 	/* The id string must be at least 20 bytes + terminating NULL byte */
 	if (id_len < 21) {
 		rcu_read_unlock();
@@ -3498,8 +3556,9 @@ int scsi_vpd_lun_id(struct scsi_device *sdev, char *id, size_t id_len)
 	memset(id, 0, id_len);
 	d = vpd_pg83->data + 4;
 	while (d < vpd_pg83->data + vpd_pg83->len) {
-		/* Skip designators not referring to the LUN */
-		if ((d[1] & 0x30) != 0x00)
+		u8 prio = designator_prio(d);
+
+		if (prio == 0 || cur_id_prio > prio)
 			goto next_desig;
 
 		switch (d[1] & 0xf) {
@@ -3507,28 +3566,19 @@ int scsi_vpd_lun_id(struct scsi_device *sdev, char *id, size_t id_len)
 			/* T10 Vendor ID */
 			if (cur_id_size > d[3])
 				break;
-			/* Prefer anything */
-			if (cur_id_type > 0x01 && cur_id_type != 0xff)
-				break;
+			cur_id_prio = prio;
 			cur_id_size = d[3];
 			if (cur_id_size + 4 > id_len)
 				cur_id_size = id_len - 4;
 			cur_id_str = d + 4;
-			cur_id_type = d[1] & 0xf;
 			id_size = snprintf(id, id_len, "t10.%*pE",
 					   cur_id_size, cur_id_str);
 			break;
 		case 0x2:
 			/* EUI-64 */
-			if (cur_id_size > d[3])
-				break;
-			/* Prefer NAA IEEE Registered Extended */
-			if (cur_id_type == 0x3 &&
-			    cur_id_size == d[3])
-				break;
+			cur_id_prio = prio;
 			cur_id_size = d[3];
 			cur_id_str = d + 4;
-			cur_id_type = d[1] & 0xf;
 			switch (cur_id_size) {
 			case 8:
 				id_size = snprintf(id, id_len,
@@ -3546,17 +3596,14 @@ int scsi_vpd_lun_id(struct scsi_device *sdev, char *id, size_t id_len)
 						   cur_id_str);
 				break;
 			default:
-				cur_id_size = 0;
 				break;
 			}
 			break;
 		case 0x3:
 			/* NAA */
-			if (cur_id_size > d[3])
-				break;
+			cur_id_prio = prio;
 			cur_id_size = d[3];
 			cur_id_str = d + 4;
-			cur_id_type = d[1] & 0xf;
 			switch (cur_id_size) {
 			case 8:
 				id_size = snprintf(id, id_len,
@@ -3569,26 +3616,25 @@ int scsi_vpd_lun_id(struct scsi_device *sdev, char *id, size_t id_len)
 						   cur_id_str);
 				break;
 			default:
-				cur_id_size = 0;
 				break;
 			}
 			break;
 		case 0x8:
 			/* SCSI name string */
-			if (cur_id_size + 4 > d[3])
+			if (cur_id_size > d[3])
 				break;
 			/* Prefer others for truncated descriptor */
-			if (cur_id_size && d[3] > id_len)
-				break;
+			if (d[3] > id_len) {
+				prio = 2;
+				if (cur_id_prio > prio)
+					break;
+			}
+			cur_id_prio = prio;
 			cur_id_size = id_size = d[3];
 			cur_id_str = d + 4;
-			cur_id_type = d[1] & 0xf;
 			if (cur_id_size >= id_len)
 				cur_id_size = id_len - 1;
 			memcpy(id, cur_id_str, cur_id_size);
-			/* Decrease priority for truncated descriptor */
-			if (cur_id_size != id_size)
-				cur_id_size = 6;
 			break;
 		default:
 			break;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 144/346] media: solo6x10: fix missing snd_card_free in error handling case
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (142 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 4.19 143/346] scsi: core: Fix VPD LUN ID designator priorities Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 4.19 145/346] video: fbdev: atmel_lcdfb: fix return error code in atmel_lcdfb_of_init() Greg Kroah-Hartman
                   ` (204 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Qinglang Miao,
	Hans Verkuil, Mauro Carvalho Chehab, Sasha Levin

From: Qinglang Miao <miaoqinglang@huawei.com>

[ Upstream commit dcdff74fa6bc00c32079d0bebd620764c26f2d89 ]

Fix to goto snd_error in error handling case when fails
to do snd_ctl_add, as done elsewhere in this function.

Fixes: 28cae868cd24 ("[media] solo6x10: move out of staging into drivers/media/pci.")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/pci/solo6x10/solo6x10-g723.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/pci/solo6x10/solo6x10-g723.c b/drivers/media/pci/solo6x10/solo6x10-g723.c
index 2ac33b5cc4546..f06e6d35d846c 100644
--- a/drivers/media/pci/solo6x10/solo6x10-g723.c
+++ b/drivers/media/pci/solo6x10/solo6x10-g723.c
@@ -410,7 +410,7 @@ int solo_g723_init(struct solo_dev *solo_dev)
 
 	ret = snd_ctl_add(card, snd_ctl_new1(&kctl, solo_dev));
 	if (ret < 0)
-		return ret;
+		goto snd_error;
 
 	ret = solo_snd_pcm_init(solo_dev);
 	if (ret < 0)
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 145/346] video: fbdev: atmel_lcdfb: fix return error code in atmel_lcdfb_of_init()
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (143 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 4.19 144/346] media: solo6x10: fix missing snd_card_free in error handling case Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 4.19 146/346] drm/omap: dmm_tiler: fix return error code in omap_dmm_probe() Greg Kroah-Hartman
                   ` (203 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Yang Yingliang,
	Thomas Zimmermann, Sasha Levin

From: Yang Yingliang <yangyingliang@huawei.com>

[ Upstream commit ba236455ee750270f33998df57f982433cea4d8e ]

If devm_kzalloc() failed after the first time, atmel_lcdfb_of_init()
can't return -ENOMEM, fix this by putting the error code in loop.

Fixes: b985172b328a ("video: atmel_lcdfb: add device tree suport")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://patchwork.freedesktop.org/patch/msgid/20201117061350.3453742-1-yangyingliang@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/video/fbdev/atmel_lcdfb.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/video/fbdev/atmel_lcdfb.c b/drivers/video/fbdev/atmel_lcdfb.c
index 4ed55e6bbb840..6d01ae3984c73 100644
--- a/drivers/video/fbdev/atmel_lcdfb.c
+++ b/drivers/video/fbdev/atmel_lcdfb.c
@@ -1071,8 +1071,8 @@ static int atmel_lcdfb_of_init(struct atmel_lcdfb_info *sinfo)
 	}
 
 	INIT_LIST_HEAD(&pdata->pwr_gpios);
-	ret = -ENOMEM;
 	for (i = 0; i < gpiod_count(dev, "atmel,power-control"); i++) {
+		ret = -ENOMEM;
 		gpiod = devm_gpiod_get_index(dev, "atmel,power-control",
 					     i, GPIOD_ASIS);
 		if (IS_ERR(gpiod))
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 146/346] drm/omap: dmm_tiler: fix return error code in omap_dmm_probe()
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (144 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 4.19 145/346] video: fbdev: atmel_lcdfb: fix return error code in atmel_lcdfb_of_init() Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 4.19 147/346] Input: ads7846 - fix race that causes missing releases Greg Kroah-Hartman
                   ` (202 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Yang Yingliang,
	Thomas Zimmermann, Sasha Levin

From: Yang Yingliang <yangyingliang@huawei.com>

[ Upstream commit 723ae803218da993143387bf966042eccefac077 ]

Return -ENOMEM when allocating refill memory failed.

Fixes: 71e8831f6407 ("drm/omap: DMM/TILER support for OMAP4+ platform")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://patchwork.freedesktop.org/patch/msgid/20201117061045.3452287-1-yangyingliang@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/omapdrm/omap_dmm_tiler.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c b/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c
index e884183c018ac..cb5ce73f72694 100644
--- a/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c
+++ b/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c
@@ -763,6 +763,7 @@ static int omap_dmm_probe(struct platform_device *dev)
 					   &omap_dmm->refill_pa, GFP_KERNEL);
 	if (!omap_dmm->refill_va) {
 		dev_err(&dev->dev, "could not allocate refill memory\n");
+		ret = -ENOMEM;
 		goto fail;
 	}
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 147/346] Input: ads7846 - fix race that causes missing releases
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (145 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 4.19 146/346] drm/omap: dmm_tiler: fix return error code in omap_dmm_probe() Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 4.19 148/346] Input: ads7846 - fix integer overflow on Rt calculation Greg Kroah-Hartman
                   ` (201 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, David Jander, Oleksij Rempel,
	Dmitry Torokhov, Sasha Levin

From: David Jander <david@protonic.nl>

[ Upstream commit e52cd628a03f72a547dbf90ccb703ee64800504a ]

If touchscreen is released while busy reading HWMON device, the release
can be missed. The IRQ thread is not started because no touch is active
and BTN_TOUCH release event is never sent.

Fixes: f5a28a7d4858f94a ("Input: ads7846 - avoid pen up/down when reading hwmon")
Co-developed-by: Oleksij Rempel <o.rempel@pengutronix.de>
Signed-off-by: David Jander <david@protonic.nl>
Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
Link: https://lore.kernel.org/r/20201027105416.18773-1-o.rempel@pengutronix.de
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/input/touchscreen/ads7846.c | 44 +++++++++++++++++------------
 1 file changed, 26 insertions(+), 18 deletions(-)

diff --git a/drivers/input/touchscreen/ads7846.c b/drivers/input/touchscreen/ads7846.c
index a2f45aefce08a..0fbad337e45a3 100644
--- a/drivers/input/touchscreen/ads7846.c
+++ b/drivers/input/touchscreen/ads7846.c
@@ -199,6 +199,26 @@ struct ads7846 {
 #define	REF_ON	(READ_12BIT_DFR(x, 1, 1))
 #define	REF_OFF	(READ_12BIT_DFR(y, 0, 0))
 
+static int get_pendown_state(struct ads7846 *ts)
+{
+	if (ts->get_pendown_state)
+		return ts->get_pendown_state();
+
+	return !gpio_get_value(ts->gpio_pendown);
+}
+
+static void ads7846_report_pen_up(struct ads7846 *ts)
+{
+	struct input_dev *input = ts->input;
+
+	input_report_key(input, BTN_TOUCH, 0);
+	input_report_abs(input, ABS_PRESSURE, 0);
+	input_sync(input);
+
+	ts->pendown = false;
+	dev_vdbg(&ts->spi->dev, "UP\n");
+}
+
 /* Must be called with ts->lock held */
 static void ads7846_stop(struct ads7846 *ts)
 {
@@ -215,6 +235,10 @@ static void ads7846_stop(struct ads7846 *ts)
 static void ads7846_restart(struct ads7846 *ts)
 {
 	if (!ts->disabled && !ts->suspended) {
+		/* Check if pen was released since last stop */
+		if (ts->pendown && !get_pendown_state(ts))
+			ads7846_report_pen_up(ts);
+
 		/* Tell IRQ thread that it may poll the device. */
 		ts->stopped = false;
 		mb();
@@ -605,14 +629,6 @@ static const struct attribute_group ads784x_attr_group = {
 
 /*--------------------------------------------------------------------------*/
 
-static int get_pendown_state(struct ads7846 *ts)
-{
-	if (ts->get_pendown_state)
-		return ts->get_pendown_state();
-
-	return !gpio_get_value(ts->gpio_pendown);
-}
-
 static void null_wait_for_sync(void)
 {
 }
@@ -871,16 +887,8 @@ static irqreturn_t ads7846_irq(int irq, void *handle)
 				   msecs_to_jiffies(TS_POLL_PERIOD));
 	}
 
-	if (ts->pendown && !ts->stopped) {
-		struct input_dev *input = ts->input;
-
-		input_report_key(input, BTN_TOUCH, 0);
-		input_report_abs(input, ABS_PRESSURE, 0);
-		input_sync(input);
-
-		ts->pendown = false;
-		dev_vdbg(&ts->spi->dev, "UP\n");
-	}
+	if (ts->pendown && !ts->stopped)
+		ads7846_report_pen_up(ts);
 
 	return IRQ_HANDLED;
 }
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 148/346] Input: ads7846 - fix integer overflow on Rt calculation
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (146 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 4.19 147/346] Input: ads7846 - fix race that causes missing releases Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 4.19 149/346] Input: ads7846 - fix unaligned access on 7845 Greg Kroah-Hartman
                   ` (200 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, David Jander, Oleksij Rempel,
	Dmitry Torokhov, Sasha Levin

From: Oleksij Rempel <o.rempel@pengutronix.de>

[ Upstream commit 820830ec918f6c3dcd77a54a1c6198ab57407916 ]

In some rare cases the 32 bit Rt value will overflow if z2 and x is max,
z1 is minimal value and x_plate_ohms is relatively high (for example 800
ohm). This would happen on some screen age with low pressure.

There are two possible fixes:
- make Rt 64bit
- reorder calculation to avoid overflow

The second variant seems to be preferable, since 64 bit calculation on
32 bit system is a bit more expensive.

Fixes: ffa458c1bd9b6f653008d450f337602f3d52a646 ("spi: ads7846 driver")
Co-developed-by: David Jander <david@protonic.nl>
Signed-off-by: David Jander <david@protonic.nl>
Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
Link: https://lore.kernel.org/r/20201113112240.1360-1-o.rempel@pengutronix.de
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/input/touchscreen/ads7846.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/input/touchscreen/ads7846.c b/drivers/input/touchscreen/ads7846.c
index 0fbad337e45a3..7ce0eedaa0e5e 100644
--- a/drivers/input/touchscreen/ads7846.c
+++ b/drivers/input/touchscreen/ads7846.c
@@ -801,10 +801,11 @@ static void ads7846_report_state(struct ads7846 *ts)
 		/* compute touch pressure resistance using equation #2 */
 		Rt = z2;
 		Rt -= z1;
-		Rt *= x;
 		Rt *= ts->x_plate_ohms;
+		Rt = DIV_ROUND_CLOSEST(Rt, 16);
+		Rt *= x;
 		Rt /= z1;
-		Rt = (Rt + 2047) >> 12;
+		Rt = DIV_ROUND_CLOSEST(Rt, 256);
 	} else {
 		Rt = 0;
 	}
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 149/346] Input: ads7846 - fix unaligned access on 7845
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (147 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 4.19 148/346] Input: ads7846 - fix integer overflow on Rt calculation Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 4.19 150/346] usb/max3421: fix return error code in max3421_probe() Greg Kroah-Hartman
                   ` (199 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Dmitry Torokhov, Sasha Levin

From: Dmitry Torokhov <dmitry.torokhov@gmail.com>

[ Upstream commit 03e2c9c782f721b661a0e42b1b58f394b5298544 ]

req->sample[1] is not naturally aligned at word boundary, and therefore we
should use get_unaligned_be16() when accessing it.

Fixes: 3eac5c7e44f3 ("Input: ads7846 - extend the driver for ads7845 controller support")
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/input/touchscreen/ads7846.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/input/touchscreen/ads7846.c b/drivers/input/touchscreen/ads7846.c
index 7ce0eedaa0e5e..b536768234b7c 100644
--- a/drivers/input/touchscreen/ads7846.c
+++ b/drivers/input/touchscreen/ads7846.c
@@ -35,6 +35,7 @@
 #include <linux/regulator/consumer.h>
 #include <linux/module.h>
 #include <asm/irq.h>
+#include <asm/unaligned.h>
 
 /*
  * This code has been heavily tested on a Nokia 770, and lightly
@@ -434,7 +435,7 @@ static int ads7845_read12_ser(struct device *dev, unsigned command)
 
 	if (status == 0) {
 		/* BE12 value, then padding */
-		status = be16_to_cpu(*((u16 *)&req->sample[1]));
+		status = get_unaligned_be16(&req->sample[1]);
 		status = status >> 3;
 		status &= 0x0fff;
 	}
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 150/346] usb/max3421: fix return error code in max3421_probe()
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (148 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 4.19 149/346] Input: ads7846 - fix unaligned access on 7845 Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 4.19 151/346] spi: mxs: fix reference leak in mxs_spi_probe Greg Kroah-Hartman
                   ` (198 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Yang Yingliang, Sasha Levin

From: Yang Yingliang <yangyingliang@huawei.com>

[ Upstream commit 5a569343e8a618dc73edebe0957eb42f2ab476bd ]

retval may be reassigned to 0 after max3421_of_vbus_en_pin(),
if allocate memory failed after this, max3421_probe() cann't
return ENOMEM, fix this by moving assign retval afther max3421_probe().

Fixes: 721fdc83b31b ("usb: max3421: Add devicetree support")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Link: https://lore.kernel.org/r/20201117061500.3454223-1-yangyingliang@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/host/max3421-hcd.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/host/max3421-hcd.c b/drivers/usb/host/max3421-hcd.c
index afa321ab55fcf..c9acc59f4addd 100644
--- a/drivers/usb/host/max3421-hcd.c
+++ b/drivers/usb/host/max3421-hcd.c
@@ -1864,7 +1864,7 @@ max3421_probe(struct spi_device *spi)
 	struct max3421_hcd *max3421_hcd;
 	struct usb_hcd *hcd = NULL;
 	struct max3421_hcd_platform_data *pdata = NULL;
-	int retval = -ENOMEM;
+	int retval;
 
 	if (spi_setup(spi) < 0) {
 		dev_err(&spi->dev, "Unable to setup SPI bus");
@@ -1906,6 +1906,7 @@ max3421_probe(struct spi_device *spi)
 		goto error;
 	}
 
+	retval = -ENOMEM;
 	hcd = usb_create_hcd(&max3421_hcd_desc, &spi->dev,
 			     dev_name(&spi->dev));
 	if (!hcd) {
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 151/346] spi: mxs: fix reference leak in mxs_spi_probe
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (149 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 4.19 150/346] usb/max3421: fix return error code in max3421_probe() Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 4.19 152/346] powerpc/feature: Fix CPU_FTRS_ALWAYS by removing CPU_FTRS_GENERIC_32 Greg Kroah-Hartman
                   ` (197 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Zhang Qilong, Mark Brown, Sasha Levin

From: Zhang Qilong <zhangqilong3@huawei.com>

[ Upstream commit 03fc41afaa6549baa2dab7a84e1afaf5cadb5b18 ]

pm_runtime_get_sync will increment pm usage counter even it
failed. Forgetting to pm_runtime_put_noidle will result in
reference leak in mxs_spi_probe, so we should fix it.

Fixes: b7969caf41a1d ("spi: mxs: implement runtime pm")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Link: https://lore.kernel.org/r/20201106012421.95420-1-zhangqilong3@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-mxs.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/spi/spi-mxs.c b/drivers/spi/spi-mxs.c
index 6ac95a2a21cef..4a7375ecb65ef 100644
--- a/drivers/spi/spi-mxs.c
+++ b/drivers/spi/spi-mxs.c
@@ -605,6 +605,7 @@ static int mxs_spi_probe(struct platform_device *pdev)
 
 	ret = pm_runtime_get_sync(ssp->dev);
 	if (ret < 0) {
+		pm_runtime_put_noidle(ssp->dev);
 		dev_err(ssp->dev, "runtime_get_sync failed\n");
 		goto out_pm_runtime_disable;
 	}
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 152/346] powerpc/feature: Fix CPU_FTRS_ALWAYS by removing CPU_FTRS_GENERIC_32
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (150 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 4.19 151/346] spi: mxs: fix reference leak in mxs_spi_probe Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 4.19 153/346] crypto: crypto4xx - Replace bitwise OR with logical OR in crypto4xx_build_pd Greg Kroah-Hartman
                   ` (196 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christophe Leroy, Michael Ellerman,
	Sasha Levin

From: Christophe Leroy <christophe.leroy@csgroup.eu>

[ Upstream commit 78665179e569c7e1fe102fb6c21d0f5b6951f084 ]

On 8xx, we get the following features:

[    0.000000] cpu_features      = 0x0000000000000100
[    0.000000]   possible        = 0x0000000000000120
[    0.000000]   always          = 0x0000000000000000

This is not correct. As CONFIG_PPC_8xx is mutually exclusive with all
other configurations, the three lines should be equal.

The problem is due to CPU_FTRS_GENERIC_32 which is taken when
CONFIG_BOOK3S_32 is NOT selected. This CPU_FTRS_GENERIC_32 is
pointless because there is no generic configuration supporting
all 32 bits but book3s/32.

Remove this pointless generic features definition to unbreak the
calculation of 'possible' features and 'always' features.

Fixes: 76bc080ef5a3 ("[POWERPC] Make default cputable entries reflect selected CPU family")
Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/76a85f30bf981d1aeaae00df99321235494da254.1604426550.git.christophe.leroy@csgroup.eu
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/include/asm/cputable.h | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/arch/powerpc/include/asm/cputable.h b/arch/powerpc/include/asm/cputable.h
index 59b35b93eadec..d90093a88e096 100644
--- a/arch/powerpc/include/asm/cputable.h
+++ b/arch/powerpc/include/asm/cputable.h
@@ -411,7 +411,6 @@ static inline void cpu_feature_keys_init(void) { }
 	    CPU_FTR_DBELL | CPU_FTR_POPCNTB | CPU_FTR_POPCNTD | \
 	    CPU_FTR_DEBUG_LVL_EXC | CPU_FTR_EMB_HV | CPU_FTR_ALTIVEC_COMP | \
 	    CPU_FTR_CELL_TB_BUG | CPU_FTR_SMT)
-#define CPU_FTRS_GENERIC_32	(CPU_FTR_COMMON | CPU_FTR_NODSISRALIGN)
 
 /* 64-bit CPUs */
 #define CPU_FTRS_PPC970	(CPU_FTR_LWSYNC | \
@@ -509,8 +508,6 @@ enum {
 	    CPU_FTRS_7447 | CPU_FTRS_7447A | CPU_FTRS_82XX |
 	    CPU_FTRS_G2_LE | CPU_FTRS_E300 | CPU_FTRS_E300C2 |
 	    CPU_FTRS_CLASSIC32 |
-#else
-	    CPU_FTRS_GENERIC_32 |
 #endif
 #ifdef CONFIG_PPC_8xx
 	    CPU_FTRS_8XX |
@@ -585,8 +582,6 @@ enum {
 	    CPU_FTRS_7447 & CPU_FTRS_7447A & CPU_FTRS_82XX &
 	    CPU_FTRS_G2_LE & CPU_FTRS_E300 & CPU_FTRS_E300C2 &
 	    CPU_FTRS_CLASSIC32 &
-#else
-	    CPU_FTRS_GENERIC_32 &
 #endif
 #ifdef CONFIG_PPC_8xx
 	    CPU_FTRS_8XX &
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 153/346] crypto: crypto4xx - Replace bitwise OR with logical OR in crypto4xx_build_pd
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (151 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 4.19 152/346] powerpc/feature: Fix CPU_FTRS_ALWAYS by removing CPU_FTRS_GENERIC_32 Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 4.19 154/346] crypto: omap-aes - Fix PM disable depth imbalance in omap_aes_probe Greg Kroah-Hartman
                   ` (195 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Nathan Chancellor,
	Christian Lamparter, Herbert Xu, Sasha Levin

From: Nathan Chancellor <natechancellor@gmail.com>

[ Upstream commit 5bdad829c31a09069fd508534f03c2ea1576ac75 ]

Clang warns:

drivers/crypto/amcc/crypto4xx_core.c:921:60: warning: operator '?:' has
lower precedence than '|'; '|' will be evaluated first
[-Wbitwise-conditional-parentheses]
                 (crypto_tfm_alg_type(req->tfm) == CRYPTO_ALG_TYPE_AEAD) ?
                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ^
drivers/crypto/amcc/crypto4xx_core.c:921:60: note: place parentheses
around the '|' expression to silence this warning
                 (crypto_tfm_alg_type(req->tfm) == CRYPTO_ALG_TYPE_AEAD) ?
                                                                         ^
                                                                        )
drivers/crypto/amcc/crypto4xx_core.c:921:60: note: place parentheses
around the '?:' expression to evaluate it first
                 (crypto_tfm_alg_type(req->tfm) == CRYPTO_ALG_TYPE_AEAD) ?
                                                                         ^
                 (
1 warning generated.

It looks like this should have been a logical OR so that
PD_CTL_HASH_FINAL gets added to the w bitmask if crypto_tfm_alg_type
is either CRYPTO_ALG_TYPE_AHASH or CRYPTO_ALG_TYPE_AEAD. Change the
operator so that everything works properly.

Fixes: 4b5b79998af6 ("crypto: crypto4xx - fix stalls under heavy load")
Link: https://github.com/ClangBuiltLinux/linux/issues/1198
Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
Reviewed-by: Christian Lamparter <chunkeey@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/amcc/crypto4xx_core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/crypto/amcc/crypto4xx_core.c b/drivers/crypto/amcc/crypto4xx_core.c
index 68d5ea818b6c0..cd00afb5786e8 100644
--- a/drivers/crypto/amcc/crypto4xx_core.c
+++ b/drivers/crypto/amcc/crypto4xx_core.c
@@ -926,7 +926,7 @@ int crypto4xx_build_pd(struct crypto_async_request *req,
 	}
 
 	pd->pd_ctl.w = PD_CTL_HOST_READY |
-		((crypto_tfm_alg_type(req->tfm) == CRYPTO_ALG_TYPE_AHASH) |
+		((crypto_tfm_alg_type(req->tfm) == CRYPTO_ALG_TYPE_AHASH) ||
 		 (crypto_tfm_alg_type(req->tfm) == CRYPTO_ALG_TYPE_AEAD) ?
 			PD_CTL_HASH_FINAL : 0);
 	pd->pd_ctl_len.w = 0x00400000 | (assoclen + datalen);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 154/346] crypto: omap-aes - Fix PM disable depth imbalance in omap_aes_probe
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (152 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 4.19 153/346] crypto: crypto4xx - Replace bitwise OR with logical OR in crypto4xx_build_pd Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-30 13:16   ` Pavel Machek
  2020-12-28 12:47 ` [PATCH 4.19 155/346] spi: fix resource leak for drivers without .remove callback Greg Kroah-Hartman
                   ` (194 subsequent siblings)
  348 siblings, 1 reply; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Zhang Qilong, Herbert Xu, Sasha Levin

From: Zhang Qilong <zhangqilong3@huawei.com>

[ Upstream commit ff8107200367f4abe0e5bce66a245e8d0f2d229e ]

The pm_runtime_enable will increase power disable depth.
Thus a pairing decrement is needed on the error handling
path to keep it balanced according to context.

Fixes: f7b2b5dd6a62a ("crypto: omap-aes - add error check for pm_runtime_get_sync")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/omap-aes.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/crypto/omap-aes.c b/drivers/crypto/omap-aes.c
index 9019f6b67986b..a5d6e1a0192bc 100644
--- a/drivers/crypto/omap-aes.c
+++ b/drivers/crypto/omap-aes.c
@@ -1163,7 +1163,7 @@ static int omap_aes_probe(struct platform_device *pdev)
 	if (err < 0) {
 		dev_err(dev, "%s: failed to get_sync(%d)\n",
 			__func__, err);
-		goto err_res;
+		goto err_pm_disable;
 	}
 
 	omap_aes_dma_stop(dd);
@@ -1276,6 +1276,7 @@ err_engine:
 	omap_aes_dma_cleanup(dd);
 err_irq:
 	tasklet_kill(&dd->done_task);
+err_pm_disable:
 	pm_runtime_disable(dev);
 err_res:
 	dd = NULL;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 155/346] spi: fix resource leak for drivers without .remove callback
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (153 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 4.19 154/346] crypto: omap-aes - Fix PM disable depth imbalance in omap_aes_probe Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 4.19 156/346] soc: ti: knav_qmss: fix reference leak in knav_queue_probe Greg Kroah-Hartman
                   ` (193 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Uwe Kleine-König, Mark Brown,
	Sasha Levin

From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>

[ Upstream commit 440408dbadfe47a615afd0a0a4a402e629be658a ]

Consider an spi driver with a .probe but without a .remove callback (e.g.
rtc-ds1347). The function spi_drv_probe() is called to bind a device and
so dev_pm_domain_attach() is called. As there is no remove callback
spi_drv_remove() isn't called at unbind time however and so calling
dev_pm_domain_detach() is missed and the pm domain keeps active.

To fix this always use both spi_drv_probe() and spi_drv_remove() and
make them handle the respective callback not being set. This has the
side effect that for a (hypothetical) driver that has neither .probe nor
remove the clk and pm domain setup is done.

Fixes: 33cf00e57082 ("spi: attach/detach SPI device to the ACPI power domain")
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Link: https://lore.kernel.org/r/20201119161604.2633521-1-u.kleine-koenig@pengutronix.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi.c | 19 ++++++++++---------
 1 file changed, 10 insertions(+), 9 deletions(-)

diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index fbc5444bd9cbd..7dabbc82b6463 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -362,9 +362,11 @@ static int spi_drv_probe(struct device *dev)
 	if (ret)
 		return ret;
 
-	ret = sdrv->probe(spi);
-	if (ret)
-		dev_pm_domain_detach(dev, true);
+	if (sdrv->probe) {
+		ret = sdrv->probe(spi);
+		if (ret)
+			dev_pm_domain_detach(dev, true);
+	}
 
 	return ret;
 }
@@ -372,9 +374,10 @@ static int spi_drv_probe(struct device *dev)
 static int spi_drv_remove(struct device *dev)
 {
 	const struct spi_driver		*sdrv = to_spi_driver(dev->driver);
-	int ret;
+	int ret = 0;
 
-	ret = sdrv->remove(to_spi_device(dev));
+	if (sdrv->remove)
+		ret = sdrv->remove(to_spi_device(dev));
 	dev_pm_domain_detach(dev, true);
 
 	return ret;
@@ -399,10 +402,8 @@ int __spi_register_driver(struct module *owner, struct spi_driver *sdrv)
 {
 	sdrv->driver.owner = owner;
 	sdrv->driver.bus = &spi_bus_type;
-	if (sdrv->probe)
-		sdrv->driver.probe = spi_drv_probe;
-	if (sdrv->remove)
-		sdrv->driver.remove = spi_drv_remove;
+	sdrv->driver.probe = spi_drv_probe;
+	sdrv->driver.remove = spi_drv_remove;
 	if (sdrv->shutdown)
 		sdrv->driver.shutdown = spi_drv_shutdown;
 	return driver_register(&sdrv->driver);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 156/346] soc: ti: knav_qmss: fix reference leak in knav_queue_probe
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (154 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 4.19 155/346] spi: fix resource leak for drivers without .remove callback Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 4.19 157/346] soc: ti: Fix reference imbalance in knav_dma_probe Greg Kroah-Hartman
                   ` (192 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Zhang Qilong, Santosh Shilimkar, Sasha Levin

From: Zhang Qilong <zhangqilong3@huawei.com>

[ Upstream commit ec8684847d8062496c4619bc3fcff31c19d56847 ]

pm_runtime_get_sync will increment pm usage counter even it
failed. Forgetting to pm_runtime_put_noidle will result in
reference leak in knav_queue_probe, so we should fix it.

Fixes: 41f93af900a20 ("soc: ti: add Keystone Navigator QMSS driver")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Signed-off-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/soc/ti/knav_qmss_queue.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/soc/ti/knav_qmss_queue.c b/drivers/soc/ti/knav_qmss_queue.c
index ef36acc0e7088..ffd7046caa2ca 100644
--- a/drivers/soc/ti/knav_qmss_queue.c
+++ b/drivers/soc/ti/knav_qmss_queue.c
@@ -1799,6 +1799,7 @@ static int knav_queue_probe(struct platform_device *pdev)
 	pm_runtime_enable(&pdev->dev);
 	ret = pm_runtime_get_sync(&pdev->dev);
 	if (ret < 0) {
+		pm_runtime_put_noidle(&pdev->dev);
 		dev_err(dev, "Failed to enable QMSS\n");
 		return ret;
 	}
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 157/346] soc: ti: Fix reference imbalance in knav_dma_probe
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (155 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 4.19 156/346] soc: ti: knav_qmss: fix reference leak in knav_queue_probe Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 4.19 158/346] drivers: soc: ti: knav_qmss_queue: Fix error return code in knav_queue_probe Greg Kroah-Hartman
                   ` (191 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Zhang Qilong, Santosh Shilimkar, Sasha Levin

From: Zhang Qilong <zhangqilong3@huawei.com>

[ Upstream commit b4fa73358c306d747a2200aec6f7acb97e5750e6 ]

The patch fix two reference leak.

  1) pm_runtime_get_sync will increment pm usage counter even it
     failed. Forgetting to call put operation will result in
     reference leak.

  2) The pm_runtime_enable will increase power disable depth. Thus
     a pairing decrement is needed on the error handling path to
     keep it balanced.

We fix it by: 1) adding call pm_runtime_put_noidle or
pm_runtime_put_sync in error handling. 2) adding pm_runtime_disable
in error handling, to keep usage counter and disable depth balanced.

Fixes: 88139ed030583 ("soc: ti: add Keystone Navigator DMA support")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Signed-off-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/soc/ti/knav_dma.c | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/drivers/soc/ti/knav_dma.c b/drivers/soc/ti/knav_dma.c
index 224d7ddeeb767..eb2e87229c1da 100644
--- a/drivers/soc/ti/knav_dma.c
+++ b/drivers/soc/ti/knav_dma.c
@@ -759,8 +759,9 @@ static int knav_dma_probe(struct platform_device *pdev)
 	pm_runtime_enable(kdev->dev);
 	ret = pm_runtime_get_sync(kdev->dev);
 	if (ret < 0) {
+		pm_runtime_put_noidle(kdev->dev);
 		dev_err(kdev->dev, "unable to enable pktdma, err %d\n", ret);
-		return ret;
+		goto err_pm_disable;
 	}
 
 	/* Initialise all packet dmas */
@@ -774,7 +775,8 @@ static int knav_dma_probe(struct platform_device *pdev)
 
 	if (list_empty(&kdev->list)) {
 		dev_err(dev, "no valid dma instance\n");
-		return -ENODEV;
+		ret = -ENODEV;
+		goto err_put_sync;
 	}
 
 	debugfs_create_file("knav_dma", S_IFREG | S_IRUGO, NULL, NULL,
@@ -782,6 +784,13 @@ static int knav_dma_probe(struct platform_device *pdev)
 
 	device_ready = true;
 	return ret;
+
+err_put_sync:
+	pm_runtime_put_sync(kdev->dev);
+err_pm_disable:
+	pm_runtime_disable(kdev->dev);
+
+	return ret;
 }
 
 static int knav_dma_remove(struct platform_device *pdev)
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 158/346] drivers: soc: ti: knav_qmss_queue: Fix error return code in knav_queue_probe
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (156 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 4.19 157/346] soc: ti: Fix reference imbalance in knav_dma_probe Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 4.19 159/346] Input: omap4-keypad - fix runtime PM error handling Greg Kroah-Hartman
                   ` (190 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Zhihao Cheng,
	Santosh Shilimkar, Sasha Levin

From: Zhihao Cheng <chengzhihao1@huawei.com>

[ Upstream commit 4cba398f37f868f515ff12868418dc28574853a1 ]

Fix to return the error code from of_get_child_by_name() instaed of 0
in knav_queue_probe().

Fixes: 41f93af900a20d1a0a ("soc: ti: add Keystone Navigator QMSS driver")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
Signed-off-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/soc/ti/knav_qmss_queue.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/soc/ti/knav_qmss_queue.c b/drivers/soc/ti/knav_qmss_queue.c
index ffd7046caa2ca..9f5ce52e6c161 100644
--- a/drivers/soc/ti/knav_qmss_queue.c
+++ b/drivers/soc/ti/knav_qmss_queue.c
@@ -1867,9 +1867,10 @@ static int knav_queue_probe(struct platform_device *pdev)
 	if (ret)
 		goto err;
 
-	regions =  of_get_child_by_name(node, "descriptor-regions");
+	regions = of_get_child_by_name(node, "descriptor-regions");
 	if (!regions) {
 		dev_err(dev, "descriptor-regions not specified\n");
+		ret = -ENODEV;
 		goto err;
 	}
 	ret = knav_queue_setup_regions(kdev, regions);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 159/346] Input: omap4-keypad - fix runtime PM error handling
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (157 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 4.19 158/346] drivers: soc: ti: knav_qmss_queue: Fix error return code in knav_queue_probe Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 4.19 160/346] RDMA/cxgb4: Validate the number of CQEs Greg Kroah-Hartman
                   ` (189 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Zhang Qilong, Dmitry Torokhov, Sasha Levin

From: Zhang Qilong <zhangqilong3@huawei.com>

[ Upstream commit 59bbf83835f591b95c3bdd09d900f3584fa227af ]

In omap4_keypad_probe, the patch fix several bugs.

  1) pm_runtime_get_sync will increment pm usage counter even it
     failed. Forgetting to pm_runtime_put_noidle will result in
     reference leak.

  2) In err_unmap, forget to disable runtime of device,
     pm_runtime_enable will increase power disable depth. Thus a
     pairing decrement is needed on the error handling path to keep
     it balanced.

  3) In err_pm_disable, it will call pm_runtime_put_sync twice not
     one time.

To fix this we factor out code reading revision and disabling touchpad, and
drop PM reference once we are done talking to the device.

Fixes: f77621cc640a7 ("Input: omap-keypad - dynamically handle register offsets")
Fixes: 5ad567ffbaf20 ("Input: omap4-keypad - wire up runtime PM handling")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Link: https://lore.kernel.org/r/20201120133918.2559681-1-zhangqilong3@huawei.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/input/keyboard/omap4-keypad.c | 89 ++++++++++++++++-----------
 1 file changed, 53 insertions(+), 36 deletions(-)

diff --git a/drivers/input/keyboard/omap4-keypad.c b/drivers/input/keyboard/omap4-keypad.c
index aeeef50cef9bb..adb1ecc969eeb 100644
--- a/drivers/input/keyboard/omap4-keypad.c
+++ b/drivers/input/keyboard/omap4-keypad.c
@@ -199,12 +199,8 @@ static int omap4_keypad_open(struct input_dev *input)
 	return 0;
 }
 
-static void omap4_keypad_close(struct input_dev *input)
+static void omap4_keypad_stop(struct omap4_keypad *keypad_data)
 {
-	struct omap4_keypad *keypad_data = input_get_drvdata(input);
-
-	disable_irq(keypad_data->irq);
-
 	/* Disable interrupts and wake-up events */
 	kbd_write_irqreg(keypad_data, OMAP4_KBD_IRQENABLE,
 			 OMAP4_VAL_IRQDISABLE);
@@ -213,7 +209,15 @@ static void omap4_keypad_close(struct input_dev *input)
 	/* clear pending interrupts */
 	kbd_write_irqreg(keypad_data, OMAP4_KBD_IRQSTATUS,
 			 kbd_read_irqreg(keypad_data, OMAP4_KBD_IRQSTATUS));
+}
+
+static void omap4_keypad_close(struct input_dev *input)
+{
+	struct omap4_keypad *keypad_data;
 
+	keypad_data = input_get_drvdata(input);
+	disable_irq(keypad_data->irq);
+	omap4_keypad_stop(keypad_data);
 	enable_irq(keypad_data->irq);
 
 	pm_runtime_put_sync(input->dev.parent);
@@ -236,13 +240,37 @@ static int omap4_keypad_parse_dt(struct device *dev,
 	return 0;
 }
 
+static int omap4_keypad_check_revision(struct device *dev,
+				       struct omap4_keypad *keypad_data)
+{
+	unsigned int rev;
+
+	rev = __raw_readl(keypad_data->base + OMAP4_KBD_REVISION);
+	rev &= 0x03 << 30;
+	rev >>= 30;
+	switch (rev) {
+	case KBD_REVISION_OMAP4:
+		keypad_data->reg_offset = 0x00;
+		keypad_data->irqreg_offset = 0x00;
+		break;
+	case KBD_REVISION_OMAP5:
+		keypad_data->reg_offset = 0x10;
+		keypad_data->irqreg_offset = 0x0c;
+		break;
+	default:
+		dev_err(dev, "Keypad reports unsupported revision %d", rev);
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
 static int omap4_keypad_probe(struct platform_device *pdev)
 {
 	struct omap4_keypad *keypad_data;
 	struct input_dev *input_dev;
 	struct resource *res;
 	unsigned int max_keys;
-	int rev;
 	int irq;
 	int error;
 
@@ -282,41 +310,33 @@ static int omap4_keypad_probe(struct platform_device *pdev)
 		goto err_release_mem;
 	}
 
+	pm_runtime_enable(&pdev->dev);
 
 	/*
 	 * Enable clocks for the keypad module so that we can read
 	 * revision register.
 	 */
-	pm_runtime_enable(&pdev->dev);
 	error = pm_runtime_get_sync(&pdev->dev);
 	if (error) {
 		dev_err(&pdev->dev, "pm_runtime_get_sync() failed\n");
-		goto err_unmap;
-	}
-	rev = __raw_readl(keypad_data->base + OMAP4_KBD_REVISION);
-	rev &= 0x03 << 30;
-	rev >>= 30;
-	switch (rev) {
-	case KBD_REVISION_OMAP4:
-		keypad_data->reg_offset = 0x00;
-		keypad_data->irqreg_offset = 0x00;
-		break;
-	case KBD_REVISION_OMAP5:
-		keypad_data->reg_offset = 0x10;
-		keypad_data->irqreg_offset = 0x0c;
-		break;
-	default:
-		dev_err(&pdev->dev,
-			"Keypad reports unsupported revision %d", rev);
-		error = -EINVAL;
-		goto err_pm_put_sync;
+		pm_runtime_put_noidle(&pdev->dev);
+	} else {
+		error = omap4_keypad_check_revision(&pdev->dev,
+						    keypad_data);
+		if (!error) {
+			/* Ensure device does not raise interrupts */
+			omap4_keypad_stop(keypad_data);
+		}
+		pm_runtime_put_sync(&pdev->dev);
 	}
+	if (error)
+		goto err_pm_disable;
 
 	/* input device allocation */
 	keypad_data->input = input_dev = input_allocate_device();
 	if (!input_dev) {
 		error = -ENOMEM;
-		goto err_pm_put_sync;
+		goto err_pm_disable;
 	}
 
 	input_dev->name = pdev->name;
@@ -362,28 +382,25 @@ static int omap4_keypad_probe(struct platform_device *pdev)
 		goto err_free_keymap;
 	}
 
-	device_init_wakeup(&pdev->dev, true);
-	pm_runtime_put_sync(&pdev->dev);
-
 	error = input_register_device(keypad_data->input);
 	if (error < 0) {
 		dev_err(&pdev->dev, "failed to register input device\n");
-		goto err_pm_disable;
+		goto err_free_irq;
 	}
 
+	device_init_wakeup(&pdev->dev, true);
 	platform_set_drvdata(pdev, keypad_data);
+
 	return 0;
 
-err_pm_disable:
-	pm_runtime_disable(&pdev->dev);
+err_free_irq:
 	free_irq(keypad_data->irq, keypad_data);
 err_free_keymap:
 	kfree(keypad_data->keymap);
 err_free_input:
 	input_free_device(input_dev);
-err_pm_put_sync:
-	pm_runtime_put_sync(&pdev->dev);
-err_unmap:
+err_pm_disable:
+	pm_runtime_disable(&pdev->dev);
 	iounmap(keypad_data->base);
 err_release_mem:
 	release_mem_region(res->start, resource_size(res));
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 160/346] RDMA/cxgb4: Validate the number of CQEs
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (158 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 4.19 159/346] Input: omap4-keypad - fix runtime PM error handling Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 4.19 161/346] memstick: fix a double-free bug in memstick_check Greg Kroah-Hartman
                   ` (188 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Kamal Heib, Jason Gunthorpe, Sasha Levin

From: Kamal Heib <kamalheib1@gmail.com>

[ Upstream commit 6d8285e604e0221b67bd5db736921b7ddce37d00 ]

Before create CQ, make sure that the requested number of CQEs is in the
supported range.

Fixes: cfdda9d76436 ("RDMA/cxgb4: Add driver for Chelsio T4 RNIC")
Link: https://lore.kernel.org/r/20201108132007.67537-1-kamalheib1@gmail.com
Signed-off-by: Kamal Heib <kamalheib1@gmail.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/hw/cxgb4/cq.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/infiniband/hw/cxgb4/cq.c b/drivers/infiniband/hw/cxgb4/cq.c
index 1fd8798d91a73..beba761902449 100644
--- a/drivers/infiniband/hw/cxgb4/cq.c
+++ b/drivers/infiniband/hw/cxgb4/cq.c
@@ -1012,6 +1012,9 @@ struct ib_cq *c4iw_create_cq(struct ib_device *ibdev,
 
 	rhp = to_c4iw_dev(ibdev);
 
+	if (entries < 1 || entries > ibdev->attrs.max_cqe)
+		return -EINVAL;
+
 	if (vector >= rhp->rdev.lldi.nciq)
 		return ERR_PTR(-EINVAL);
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 161/346] memstick: fix a double-free bug in memstick_check
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (159 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 4.19 160/346] RDMA/cxgb4: Validate the number of CQEs Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 4.19 162/346] ARM: dts: at91: sama5d4_xplained: add pincontrol for USB Host Greg Kroah-Hartman
                   ` (187 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Qinglang Miao,
	Ulf Hansson, Sasha Levin

From: Qinglang Miao <miaoqinglang@huawei.com>

[ Upstream commit e3e9ced5c93803d5b2ea1942c4bf0192622531d6 ]

kfree(host->card) has been called in put_device so that
another kfree would raise cause a double-free bug.

Fixes: 0193383a5833 ("memstick: core: fix device_register() error handling")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
Link: https://lore.kernel.org/r/20201120074846.31322-1-miaoqinglang@huawei.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/memstick/core/memstick.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/memstick/core/memstick.c b/drivers/memstick/core/memstick.c
index b1564cacd19e1..20ae8652adf44 100644
--- a/drivers/memstick/core/memstick.c
+++ b/drivers/memstick/core/memstick.c
@@ -469,7 +469,6 @@ static void memstick_check(struct work_struct *work)
 			host->card = card;
 			if (device_register(&card->dev)) {
 				put_device(&card->dev);
-				kfree(host->card);
 				host->card = NULL;
 			}
 		} else
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 162/346] ARM: dts: at91: sama5d4_xplained: add pincontrol for USB Host
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (160 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 4.19 161/346] memstick: fix a double-free bug in memstick_check Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 4.19 163/346] ARM: dts: at91: sama5d3_xplained: " Greg Kroah-Hartman
                   ` (186 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Cristian Birsan, Alexandre Belloni,
	Ludovic Desroches, Sasha Levin

From: Cristian Birsan <cristian.birsan@microchip.com>

[ Upstream commit be4dd2d448816a27c1446f8f37fce375daf64148 ]

The pincontrol node is needed for USB Host since Linux v5.7-rc1. Without
it the driver probes but VBus is not powered because of wrong pincontrol
configuration.

Fixes: 38153a017896f ("ARM: at91/dt: sama5d4: add dts for sama5d4 xplained board")
Signed-off-by: Cristian Birsan <cristian.birsan@microchip.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Acked-by: Ludovic Desroches <ludovic.desroches@microchip.com>
Link: https://lore.kernel.org/r/20201118120019.1257580-3-cristian.birsan@microchip.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/at91-sama5d4_xplained.dts | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/arch/arm/boot/dts/at91-sama5d4_xplained.dts b/arch/arm/boot/dts/at91-sama5d4_xplained.dts
index 7d554b9ab27fd..e998d72d8b107 100644
--- a/arch/arm/boot/dts/at91-sama5d4_xplained.dts
+++ b/arch/arm/boot/dts/at91-sama5d4_xplained.dts
@@ -170,6 +170,11 @@
 						atmel,pins =
 							<AT91_PIOE 31 AT91_PERIPH_GPIO AT91_PINCTRL_DEGLITCH>;
 					};
+					pinctrl_usb_default: usb_default {
+						atmel,pins =
+							<AT91_PIOE 11 AT91_PERIPH_GPIO AT91_PINCTRL_NONE
+							 AT91_PIOE 14 AT91_PERIPH_GPIO AT91_PINCTRL_NONE>;
+					};
 					pinctrl_key_gpio: key_gpio_0 {
 						atmel,pins =
 							<AT91_PIOE 8 AT91_PERIPH_GPIO AT91_PINCTRL_PULL_UP_DEGLITCH>;
@@ -195,6 +200,8 @@
 					   &pioE 11 GPIO_ACTIVE_HIGH
 					   &pioE 14 GPIO_ACTIVE_HIGH
 					  >;
+			pinctrl-names = "default";
+			pinctrl-0 = <&pinctrl_usb_default>;
 			status = "okay";
 		};
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 163/346] ARM: dts: at91: sama5d3_xplained: add pincontrol for USB Host
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (161 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 4.19 162/346] ARM: dts: at91: sama5d4_xplained: add pincontrol for USB Host Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 4.19 164/346] orinoco: Move context allocation after processing the skb Greg Kroah-Hartman
                   ` (185 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Cristian Birsan, Alexandre Belloni,
	Ludovic Desroches, Sasha Levin

From: Cristian Birsan <cristian.birsan@microchip.com>

[ Upstream commit e1062fa7292f1e3744db0a487c4ac0109e09b03d ]

The pincontrol node is needed for USB Host since Linux v5.7-rc1. Without
it the driver probes but VBus is not powered because of wrong pincontrol
configuration.

Fixes: b7c2b61570798 ("ARM: at91: add Atmel's SAMA5D3 Xplained board")
Signed-off-by: Cristian Birsan <cristian.birsan@microchip.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Acked-by: Ludovic Desroches <ludovic.desroches@microchip.com>
Link: https://lore.kernel.org/r/20201118120019.1257580-4-cristian.birsan@microchip.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/at91-sama5d3_xplained.dts | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/arch/arm/boot/dts/at91-sama5d3_xplained.dts b/arch/arm/boot/dts/at91-sama5d3_xplained.dts
index 02c1d2958d780..74440dad43354 100644
--- a/arch/arm/boot/dts/at91-sama5d3_xplained.dts
+++ b/arch/arm/boot/dts/at91-sama5d3_xplained.dts
@@ -243,6 +243,11 @@
 						atmel,pins =
 							<AT91_PIOE 9 AT91_PERIPH_GPIO AT91_PINCTRL_DEGLITCH>;	/* PE9, conflicts with A9 */
 					};
+					pinctrl_usb_default: usb_default {
+						atmel,pins =
+							<AT91_PIOE 3 AT91_PERIPH_GPIO AT91_PINCTRL_NONE
+							 AT91_PIOE 4 AT91_PERIPH_GPIO AT91_PINCTRL_NONE>;
+					};
 				};
 			};
 		};
@@ -260,6 +265,8 @@
 					   &pioE 3 GPIO_ACTIVE_LOW
 					   &pioE 4 GPIO_ACTIVE_LOW
 					  >;
+			pinctrl-names = "default";
+			pinctrl-0 = <&pinctrl_usb_default>;
 			status = "okay";
 		};
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 164/346] orinoco: Move context allocation after processing the skb
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (162 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 4.19 163/346] ARM: dts: at91: sama5d3_xplained: " Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 4.19 165/346] cw1200: fix missing destroy_workqueue() on error in cw1200_init_common Greg Kroah-Hartman
                   ` (184 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sebastian Andrzej Siewior,
	Kalle Valo, Sasha Levin

From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>

[ Upstream commit a31eb615646a63370aa1da1053c45439c7653d83 ]

ezusb_xmit() allocates a context which is leaked if
orinoco_process_xmit_skb() returns an error.

Move ezusb_alloc_ctx() after the invocation of
orinoco_process_xmit_skb() because the context is not needed so early.
ezusb_access_ltv() will cleanup the context in case of an error.

Fixes: bac6fafd4d6a0 ("orinoco: refactor xmit path")
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20201113212252.2243570-2-bigeasy@linutronix.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../net/wireless/intersil/orinoco/orinoco_usb.c    | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/drivers/net/wireless/intersil/orinoco/orinoco_usb.c b/drivers/net/wireless/intersil/orinoco/orinoco_usb.c
index b704e4bce171d..a04d598430228 100644
--- a/drivers/net/wireless/intersil/orinoco/orinoco_usb.c
+++ b/drivers/net/wireless/intersil/orinoco/orinoco_usb.c
@@ -1237,13 +1237,6 @@ static netdev_tx_t ezusb_xmit(struct sk_buff *skb, struct net_device *dev)
 	if (skb->len < ETH_HLEN)
 		goto drop;
 
-	ctx = ezusb_alloc_ctx(upriv, EZUSB_RID_TX, 0);
-	if (!ctx)
-		goto busy;
-
-	memset(ctx->buf, 0, BULK_BUF_SIZE);
-	buf = ctx->buf->data;
-
 	tx_control = 0;
 
 	err = orinoco_process_xmit_skb(skb, dev, priv, &tx_control,
@@ -1251,6 +1244,13 @@ static netdev_tx_t ezusb_xmit(struct sk_buff *skb, struct net_device *dev)
 	if (err)
 		goto drop;
 
+	ctx = ezusb_alloc_ctx(upriv, EZUSB_RID_TX, 0);
+	if (!ctx)
+		goto drop;
+
+	memset(ctx->buf, 0, BULK_BUF_SIZE);
+	buf = ctx->buf->data;
+
 	{
 		__le16 *tx_cntl = (__le16 *)buf;
 		*tx_cntl = cpu_to_le16(tx_control);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 165/346] cw1200: fix missing destroy_workqueue() on error in cw1200_init_common
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (163 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 4.19 164/346] orinoco: Move context allocation after processing the skb Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 4.19 166/346] dmaengine: mv_xor_v2: Fix error return code in mv_xor_v2_probe() Greg Kroah-Hartman
                   ` (183 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Qinglang Miao,
	Kalle Valo, Sasha Levin

From: Qinglang Miao <miaoqinglang@huawei.com>

[ Upstream commit 7ec8a926188eb8e7a3cbaca43ec44f2d7146d71b ]

Add the missing destroy_workqueue() before return from
cw1200_init_common in the error handling case.

Fixes: a910e4a94f69 ("cw1200: add driver for the ST-E CW1100 & CW1200 WLAN chipsets")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20201119070842.1011-1-miaoqinglang@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/st/cw1200/main.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/wireless/st/cw1200/main.c b/drivers/net/wireless/st/cw1200/main.c
index c1608f0bf6d01..0c5a15e2b8f97 100644
--- a/drivers/net/wireless/st/cw1200/main.c
+++ b/drivers/net/wireless/st/cw1200/main.c
@@ -384,6 +384,7 @@ static struct ieee80211_hw *cw1200_init_common(const u8 *macaddr,
 				    CW1200_LINK_ID_MAX,
 				    cw1200_skb_dtor,
 				    priv)) {
+		destroy_workqueue(priv->workqueue);
 		ieee80211_free_hw(hw);
 		return NULL;
 	}
@@ -395,6 +396,7 @@ static struct ieee80211_hw *cw1200_init_common(const u8 *macaddr,
 			for (; i > 0; i--)
 				cw1200_queue_deinit(&priv->tx_queue[i - 1]);
 			cw1200_queue_stats_deinit(&priv->tx_queue_stats);
+			destroy_workqueue(priv->workqueue);
 			ieee80211_free_hw(hw);
 			return NULL;
 		}
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 166/346] dmaengine: mv_xor_v2: Fix error return code in mv_xor_v2_probe()
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (164 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 4.19 165/346] cw1200: fix missing destroy_workqueue() on error in cw1200_init_common Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 4.19 167/346] media: siano: fix memory leak of debugfs members in smsdvb_hotplug Greg Kroah-Hartman
                   ` (182 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Zhihao Cheng, Vinod Koul,
	Sasha Levin

From: Zhihao Cheng <chengzhihao1@huawei.com>

[ Upstream commit c95e6515a8c065862361f7e0e452978ade7f94ec ]

Return the corresponding error code when first_msi_entry() returns
NULL in mv_xor_v2_probe().

Fixes: 19a340b1a820430 ("dmaengine: mv_xor_v2: new driver")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
Link: https://lore.kernel.org/r/20201124010813.1939095-1-chengzhihao1@huawei.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/dma/mv_xor_v2.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/dma/mv_xor_v2.c b/drivers/dma/mv_xor_v2.c
index 8dc0aa4d73ab8..462adf7e4e952 100644
--- a/drivers/dma/mv_xor_v2.c
+++ b/drivers/dma/mv_xor_v2.c
@@ -777,8 +777,10 @@ static int mv_xor_v2_probe(struct platform_device *pdev)
 		goto disable_clk;
 
 	msi_desc = first_msi_entry(&pdev->dev);
-	if (!msi_desc)
+	if (!msi_desc) {
+		ret = -ENODEV;
 		goto free_msi_irqs;
+	}
 	xor_dev->msi_desc = msi_desc;
 
 	ret = devm_request_irq(&pdev->dev, msi_desc->irq,
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 167/346] media: siano: fix memory leak of debugfs members in smsdvb_hotplug
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (165 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 4.19 166/346] dmaengine: mv_xor_v2: Fix error return code in mv_xor_v2_probe() Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 4.19 168/346] platform/x86: mlx-platform: Remove PSU EEPROM from default platform configuration Greg Kroah-Hartman
                   ` (181 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Keita Suzuki, Sean Young,
	Mauro Carvalho Chehab, Sasha Levin

From: Keita Suzuki <keitasuzuki.park@sslab.ics.keio.ac.jp>

[ Upstream commit abf287eeff4c6da6aa804bbd429dfd9d0dfb6ea7 ]

When dvb_create_media_graph fails, the debugfs kept inside client should
be released. However, the current implementation does not release them.

Fix this by adding a new goto label to call smsdvb_debugfs_release.

Fixes: 0d3ab8410dcb ("[media] dvb core: must check dvb_create_media_graph()")
Signed-off-by: Keita Suzuki <keitasuzuki.park@sslab.ics.keio.ac.jp>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/common/siano/smsdvb-main.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/media/common/siano/smsdvb-main.c b/drivers/media/common/siano/smsdvb-main.c
index 43cfd1dbda014..afca47b97c2a2 100644
--- a/drivers/media/common/siano/smsdvb-main.c
+++ b/drivers/media/common/siano/smsdvb-main.c
@@ -1180,12 +1180,15 @@ static int smsdvb_hotplug(struct smscore_device_t *coredev,
 	rc = dvb_create_media_graph(&client->adapter, true);
 	if (rc < 0) {
 		pr_err("dvb_create_media_graph failed %d\n", rc);
-		goto client_error;
+		goto media_graph_error;
 	}
 
 	pr_info("DVB interface registered.\n");
 	return 0;
 
+media_graph_error:
+	smsdvb_debugfs_release(client);
+
 client_error:
 	dvb_unregister_frontend(&client->frontend);
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 168/346] platform/x86: mlx-platform: Remove PSU EEPROM from default platform configuration
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (166 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 4.19 167/346] media: siano: fix memory leak of debugfs members in smsdvb_hotplug Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 4.19 169/346] platform/x86: mlx-platform: Remove PSU EEPROM from MSN274x " Greg Kroah-Hartman
                   ` (180 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Vadim Pasternak, Hans de Goede, Sasha Levin

From: Vadim Pasternak <vadimp@nvidia.com>

[ Upstream commit 2bf5046bdb649908df8bcc0a012c56eee931a9af ]

Remove PSU EEPROM configuration for systems class equipped with
Mellanox chip Spectrum and Celeron CPU - system types MSN2700, MSN2100.
Till now all the systems from this class used few types of power units,
all equipped with EEPROM device with address space two bytes. Thus, all
these devices have been handled by EEPROM driver "24c02".

There is a new requirement is to support power unit replacement by "off
the shelf" device, matching electrical required parameters. Such device
can be equipped with different EEPROM type, which could be one byte
address space addressing or even could be not equipped with EEPROM.
In such case "24c02" will not work.

Fixes: c6acad68e ("platform/mellanox: mlxreg-hotplug: Modify to use a regmap interface")
Fixes: ba814fdd0 ("platform/x86: mlx-platform: Use defines for bus assignment")
Signed-off-by: Vadim Pasternak <vadimp@nvidia.com>
Link: https://lore.kernel.org/r/20201125101056.174708-2-vadimp@nvidia.com
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/x86/mlx-platform.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/drivers/platform/x86/mlx-platform.c b/drivers/platform/x86/mlx-platform.c
index 0c72de95b5ccd..62c749180bb78 100644
--- a/drivers/platform/x86/mlx-platform.c
+++ b/drivers/platform/x86/mlx-platform.c
@@ -251,15 +251,13 @@ static struct mlxreg_core_data mlxplat_mlxcpld_default_psu_items_data[] = {
 		.label = "psu1",
 		.reg = MLXPLAT_CPLD_LPC_REG_PSU_OFFSET,
 		.mask = BIT(0),
-		.hpdev.brdinfo = &mlxplat_mlxcpld_psu[0],
-		.hpdev.nr = MLXPLAT_CPLD_PSU_DEFAULT_NR,
+		.hpdev.nr = MLXPLAT_CPLD_NR_NONE,
 	},
 	{
 		.label = "psu2",
 		.reg = MLXPLAT_CPLD_LPC_REG_PSU_OFFSET,
 		.mask = BIT(1),
-		.hpdev.brdinfo = &mlxplat_mlxcpld_psu[1],
-		.hpdev.nr = MLXPLAT_CPLD_PSU_DEFAULT_NR,
+		.hpdev.nr = MLXPLAT_CPLD_NR_NONE,
 	},
 };
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 169/346] platform/x86: mlx-platform: Remove PSU EEPROM from MSN274x platform configuration
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (167 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 4.19 168/346] platform/x86: mlx-platform: Remove PSU EEPROM from default platform configuration Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 4.19 170/346] samples: bpf: Fix lwt_len_hist reusing previous BPF map Greg Kroah-Hartman
                   ` (179 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Vadim Pasternak, Hans de Goede, Sasha Levin

From: Vadim Pasternak <vadimp@nvidia.com>

[ Upstream commit 912b341585e302ee44fc5a2733f7bcf505e2c86f ]

Remove PSU EEPROM configuration for systems class equipped with
Mellanox chip Spectrum and ATOM CPU - system types MSN274x. Till now
all the systems from this class used few types of power units, all
equipped with EEPROM device with address space two bytes. Thus, all
these devices have been handled by EEPROM driver "24c02".

There is a new requirement is to support power unit replacement by "off
the shelf" device, matching electrical required parameters. Such device
can be equipped with different EEPROM type, which could be one byte
address space addressing or even could be not equipped with EEPROM.
In such case "24c02" will not work.

Fixes: ef08e14a3 ("platform/x86: mlx-platform: Add support for new msn274x system type")
Signed-off-by: Vadim Pasternak <vadimp@nvidia.com>
Link: https://lore.kernel.org/r/20201125101056.174708-3-vadimp@nvidia.com
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/x86/mlx-platform.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/drivers/platform/x86/mlx-platform.c b/drivers/platform/x86/mlx-platform.c
index 62c749180bb78..850c719de68d4 100644
--- a/drivers/platform/x86/mlx-platform.c
+++ b/drivers/platform/x86/mlx-platform.c
@@ -420,15 +420,13 @@ static struct mlxreg_core_data mlxplat_mlxcpld_msn274x_psu_items_data[] = {
 		.label = "psu1",
 		.reg = MLXPLAT_CPLD_LPC_REG_PSU_OFFSET,
 		.mask = BIT(0),
-		.hpdev.brdinfo = &mlxplat_mlxcpld_psu[0],
-		.hpdev.nr = MLXPLAT_CPLD_PSU_MSNXXXX_NR,
+		.hpdev.nr = MLXPLAT_CPLD_NR_NONE,
 	},
 	{
 		.label = "psu2",
 		.reg = MLXPLAT_CPLD_LPC_REG_PSU_OFFSET,
 		.mask = BIT(1),
-		.hpdev.brdinfo = &mlxplat_mlxcpld_psu[1],
-		.hpdev.nr = MLXPLAT_CPLD_PSU_MSNXXXX_NR,
+		.hpdev.nr = MLXPLAT_CPLD_NR_NONE,
 	},
 };
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 170/346] samples: bpf: Fix lwt_len_hist reusing previous BPF map
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (168 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 4.19 169/346] platform/x86: mlx-platform: Remove PSU EEPROM from MSN274x " Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 4.19 171/346] mips: cdmm: fix use-after-free in mips_cdmm_bus_discover Greg Kroah-Hartman
                   ` (178 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Daniel T. Lee, Andrii Nakryiko, Sasha Levin

From: Daniel T. Lee <danieltimlee@gmail.com>

[ Upstream commit 0afe0a998c40085a6342e1aeb4c510cccba46caf ]

Currently, lwt_len_hist's map lwt_len_hist_map is uses pinning, and the
map isn't cleared on test end. This leds to reuse of that map for
each test, which prevents the results of the test from being accurate.

This commit fixes the problem by removing of pinned map from bpffs.
Also, this commit add the executable permission to shell script
files.

Fixes: f74599f7c5309 ("bpf: Add tests and samples for LWT-BPF")
Signed-off-by: Daniel T. Lee <danieltimlee@gmail.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20201124090310.24374-7-danieltimlee@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 samples/bpf/lwt_len_hist.sh | 2 ++
 samples/bpf/test_lwt_bpf.sh | 0
 2 files changed, 2 insertions(+)
 mode change 100644 => 100755 samples/bpf/lwt_len_hist.sh
 mode change 100644 => 100755 samples/bpf/test_lwt_bpf.sh

diff --git a/samples/bpf/lwt_len_hist.sh b/samples/bpf/lwt_len_hist.sh
old mode 100644
new mode 100755
index 090b96eaf7f76..0eda9754f50b8
--- a/samples/bpf/lwt_len_hist.sh
+++ b/samples/bpf/lwt_len_hist.sh
@@ -8,6 +8,8 @@ VETH1=tst_lwt1b
 TRACE_ROOT=/sys/kernel/debug/tracing
 
 function cleanup {
+	# To reset saved histogram, remove pinned map
+	rm /sys/fs/bpf/tc/globals/lwt_len_hist_map
 	ip route del 192.168.253.2/32 dev $VETH0 2> /dev/null
 	ip link del $VETH0 2> /dev/null
 	ip link del $VETH1 2> /dev/null
diff --git a/samples/bpf/test_lwt_bpf.sh b/samples/bpf/test_lwt_bpf.sh
old mode 100644
new mode 100755
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 171/346] mips: cdmm: fix use-after-free in mips_cdmm_bus_discover
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (169 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 4.19 170/346] samples: bpf: Fix lwt_len_hist reusing previous BPF map Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 4.19 172/346] media: max2175: fix max2175_set_csm_mode() error code Greg Kroah-Hartman
                   ` (177 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Qinglang Miao,
	Serge Semin, Thomas Bogendoerfer, Sasha Levin

From: Qinglang Miao <miaoqinglang@huawei.com>

[ Upstream commit f0e82242b16826077a2775eacfe201d803bb7a22 ]

kfree(dev) has been called inside put_device so anther
kfree would cause a use-after-free bug/

Fixes: 8286ae03308c ("MIPS: Add CDMM bus support")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
Acked-by: Serge Semin <fancer.lancer@gmail.com>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/bus/mips_cdmm.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/drivers/bus/mips_cdmm.c b/drivers/bus/mips_cdmm.c
index 1b14256376d24..7c1da45be166e 100644
--- a/drivers/bus/mips_cdmm.c
+++ b/drivers/bus/mips_cdmm.c
@@ -544,10 +544,8 @@ static void mips_cdmm_bus_discover(struct mips_cdmm_bus *bus)
 		dev_set_name(&dev->dev, "cdmm%u-%u", cpu, id);
 		++id;
 		ret = device_register(&dev->dev);
-		if (ret) {
+		if (ret)
 			put_device(&dev->dev);
-			kfree(dev);
-		}
 	}
 }
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 172/346] media: max2175: fix max2175_set_csm_mode() error code
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (170 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 4.19 171/346] mips: cdmm: fix use-after-free in mips_cdmm_bus_discover Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 4.19 173/346] slimbus: qcom-ngd-ctrl: Avoid sending power requests without QMI Greg Kroah-Hartman
                   ` (176 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Mauro Carvalho Chehab,
	Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit 9b1b0cb0636166187478ef68d5b95f5caea062ec ]

This is supposed to return negative error codes but the type is bool so
it returns true instead.

Fixes: b47b79d8a231 ("[media] media: i2c: max2175: Add MAX2175 support")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/i2c/max2175.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/i2c/max2175.c b/drivers/media/i2c/max2175.c
index 008a082cb8ad7..dddc5ef50dd4e 100644
--- a/drivers/media/i2c/max2175.c
+++ b/drivers/media/i2c/max2175.c
@@ -511,7 +511,7 @@ static void max2175_set_bbfilter(struct max2175 *ctx)
 	}
 }
 
-static bool max2175_set_csm_mode(struct max2175 *ctx,
+static int max2175_set_csm_mode(struct max2175 *ctx,
 			  enum max2175_csm_mode new_mode)
 {
 	int ret = max2175_poll_csm_ready(ctx);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 173/346] slimbus: qcom-ngd-ctrl: Avoid sending power requests without QMI
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (171 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 4.19 172/346] media: max2175: fix max2175_set_csm_mode() error code Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 4.19 174/346] HSI: omap_ssi: Dont jump to free ID in ssi_add_controller() Greg Kroah-Hartman
                   ` (175 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Bjorn Andersson, Srinivas Kandagatla,
	Sasha Levin

From: Bjorn Andersson <bjorn.andersson@linaro.org>

[ Upstream commit 39014ce6d6028614a46395923a2c92d058b6fa87 ]

Attempting to send a power request during PM operations, when the QMI
handle isn't initialized results in a NULL pointer dereference. So check
if the QMI handle has been initialized before attempting to post the
power requests.

Fixes: 917809e2280b ("slimbus: ngd: Add qcom SLIMBus NGD driver")
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Link: https://lore.kernel.org/r/20201127102451.17114-7-srinivas.kandagatla@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/slimbus/qcom-ngd-ctrl.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/slimbus/qcom-ngd-ctrl.c b/drivers/slimbus/qcom-ngd-ctrl.c
index 522a87fc573a6..44021620d1013 100644
--- a/drivers/slimbus/qcom-ngd-ctrl.c
+++ b/drivers/slimbus/qcom-ngd-ctrl.c
@@ -1200,6 +1200,9 @@ static int qcom_slim_ngd_runtime_resume(struct device *dev)
 	struct qcom_slim_ngd_ctrl *ctrl = dev_get_drvdata(dev);
 	int ret = 0;
 
+	if (!ctrl->qmi.handle)
+		return 0;
+
 	if (ctrl->state >= QCOM_SLIM_NGD_CTRL_ASLEEP)
 		ret = qcom_slim_ngd_power_up(ctrl);
 	if (ret) {
@@ -1493,6 +1496,9 @@ static int __maybe_unused qcom_slim_ngd_runtime_suspend(struct device *dev)
 	struct qcom_slim_ngd_ctrl *ctrl = dev_get_drvdata(dev);
 	int ret = 0;
 
+	if (!ctrl->qmi.handle)
+		return 0;
+
 	ret = qcom_slim_qmi_power_request(ctrl, false);
 	if (ret && ret != -EBUSY)
 		dev_info(ctrl->dev, "slim resource not idle:%d\n", ret);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 174/346] HSI: omap_ssi: Dont jump to free ID in ssi_add_controller()
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (172 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 4.19 173/346] slimbus: qcom-ngd-ctrl: Avoid sending power requests without QMI Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 4.19 175/346] ARM: dts: Remove non-existent i2c1 from 98dx3236 Greg Kroah-Hartman
                   ` (174 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jing Xiangfeng, Sebastian Reichel,
	Sasha Levin

From: Jing Xiangfeng <jingxiangfeng@huawei.com>

[ Upstream commit 41fff6e19bc8d6d8bca79ea388427c426e72e097 ]

In current code, it jumps to ida_simple_remove() when ida_simple_get()
failes to allocate an ID. Just return to fix it.

Fixes: 0fae198988b8 ("HSI: omap_ssi: built omap_ssi and omap_ssi_port into one module")
Signed-off-by: Jing Xiangfeng <jingxiangfeng@huawei.com>
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hsi/controllers/omap_ssi_core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/hsi/controllers/omap_ssi_core.c b/drivers/hsi/controllers/omap_ssi_core.c
index 41a09f506803d..129c5e6bc6547 100644
--- a/drivers/hsi/controllers/omap_ssi_core.c
+++ b/drivers/hsi/controllers/omap_ssi_core.c
@@ -389,7 +389,7 @@ static int ssi_add_controller(struct hsi_controller *ssi,
 
 	err = ida_simple_get(&platform_omap_ssi_ida, 0, 0, GFP_KERNEL);
 	if (err < 0)
-		goto out_err;
+		return err;
 	ssi->id = err;
 
 	ssi->owner = THIS_MODULE;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 175/346] ARM: dts: Remove non-existent i2c1 from 98dx3236
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (173 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 4.19 174/346] HSI: omap_ssi: Dont jump to free ID in ssi_add_controller() Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 4.19 176/346] arm64: dts: rockchip: Set dr_mode to "host" for OTG on rk3328-roc-cc Greg Kroah-Hartman
                   ` (173 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chris Packham, Andrew Lunn,
	Gregory CLEMENT, Sasha Levin

From: Chris Packham <chris.packham@alliedtelesis.co.nz>

[ Upstream commit 7f24479ead579459106bb55c2320a000135731f9 ]

The switches with integrated CPUs have only got a single i2c controller.
They incorrectly gained one when they were split from the Armada-XP.

Fixes: 43e28ba87708 ("ARM: dts: Use armada-370-xp as a base for armada-xp-98dx3236")
Signed-off-by: Chris Packham <chris.packham@alliedtelesis.co.nz>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/armada-xp-98dx3236.dtsi | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/arch/arm/boot/dts/armada-xp-98dx3236.dtsi b/arch/arm/boot/dts/armada-xp-98dx3236.dtsi
index 3e7d093d7a9a2..966d9a6c40fca 100644
--- a/arch/arm/boot/dts/armada-xp-98dx3236.dtsi
+++ b/arch/arm/boot/dts/armada-xp-98dx3236.dtsi
@@ -266,11 +266,6 @@
 	reg = <0x11000 0x100>;
 };
 
-&i2c1 {
-	compatible = "marvell,mv78230-i2c", "marvell,mv64xxx-i2c";
-	reg = <0x11100 0x100>;
-};
-
 &mpic {
 	reg = <0x20a00 0x2d0>, <0x21070 0x58>;
 };
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 176/346] arm64: dts: rockchip: Set dr_mode to "host" for OTG on rk3328-roc-cc
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (174 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 4.19 175/346] ARM: dts: Remove non-existent i2c1 from 98dx3236 Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 4.19 177/346] power: supply: axp288_charger: Fix HP Pavilion x2 10 DMI matching Greg Kroah-Hartman
                   ` (172 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chen-Yu Tsai, Heiko Stuebner, Sasha Levin

From: Chen-Yu Tsai <wens@csie.org>

[ Upstream commit 4076a007bd0f6171434bdb119a0b8797749b0502 ]

The board has a standard USB A female port connected to the USB OTG
controller's data pins. Set dr_mode in the OTG controller node to
indicate this usage, instead of having the implementation guess.

Fixes: 2171f4fdac06 ("arm64: dts: rockchip: add roc-rk3328-cc board")
Signed-off-by: Chen-Yu Tsai <wens@csie.org>
Link: https://lore.kernel.org/r/20201126073336.30794-2-wens@kernel.org
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts b/arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts
index 91061d9cf78bc..5b1ece4a68d67 100644
--- a/arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts
+++ b/arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts
@@ -255,6 +255,7 @@
 };
 
 &usb20_otg {
+	dr_mode = "host";
 	status = "okay";
 };
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 177/346] power: supply: axp288_charger: Fix HP Pavilion x2 10 DMI matching
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (175 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 4.19 176/346] arm64: dts: rockchip: Set dr_mode to "host" for OTG on rk3328-roc-cc Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 4.19 178/346] power: supply: bq24190_charger: fix reference leak Greg Kroah-Hartman
                   ` (171 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hans de Goede, Sebastian Reichel,
	Sasha Levin

From: Hans de Goede <hdegoede@redhat.com>

[ Upstream commit a0f1ccd96c7049377d892a4299b6d5e47ec9179d ]

Commit 9c80662a74cd ("power: supply: axp288_charger: Add special handling
for HP Pavilion x2 10") added special handling for HP Pavilion x2 10
models which use the weird combination of a Type-C connector and the
non Type-C aware AXP288 PMIC.

This special handling was activated by a DMI match a the product-name
of "HP Pavilion x2 Detachable". Recently I've learned that there are
also older "HP Pavilion x2 Detachable" models with an AXP288 PMIC +
a micro-usb connector where we should not activate the special handling
for the Type-C connectors.

Extend the matching to also match on the DMI board-name and match on the
2 boards (one Bay Trail based one Cherry Trail based) of which we are
certain that they use the AXP288 + Type-C connector combination.

Note the DSDT code from these older (AXP288 + micro-USB) models contains
some AML code (which never runs under Linux) which reads the micro-USB
connector id-pin and if it is pulled to ground, which would normally mean
the port is in host mode!, then it sets the input-current-limit to 3A,
it seems HP is using the micro-USB port as a charging only connector
and identifies their own 3A capable charger though this hack which is a
major violation of the USB specs. Note HP also hardcodes a 2A limit
when the id-pin is not pulled to ground, which is also in violation
of the specs.

I've no intention to add support for HP's hack to support 3A charging
on these older models. By making the DMI matches for the Type-C equipped
models workaround more tighter, these older models will be treated just
like any other AXP288 + micro-USB equipped device and the input-current
limit will follow the BC 1.2 spec (using the defacto standard values
there where the BC 1.2 spec defines a range).

Fixes: 9c80662a74cd ("power: supply: axp288_charger: Add special handling for HP Pavilion x2 10")
BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1896924
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/power/supply/axp288_charger.c | 28 ++++++++++++++++-----------
 1 file changed, 17 insertions(+), 11 deletions(-)

diff --git a/drivers/power/supply/axp288_charger.c b/drivers/power/supply/axp288_charger.c
index 46eb7716c35c8..84106a9836c8f 100644
--- a/drivers/power/supply/axp288_charger.c
+++ b/drivers/power/supply/axp288_charger.c
@@ -555,14 +555,15 @@ out:
 
 /*
  * The HP Pavilion x2 10 series comes in a number of variants:
- * Bay Trail SoC    + AXP288 PMIC, DMI_BOARD_NAME: "815D"
- * Cherry Trail SoC + AXP288 PMIC, DMI_BOARD_NAME: "813E"
- * Cherry Trail SoC + TI PMIC,     DMI_BOARD_NAME: "827C" or "82F4"
+ * Bay Trail SoC    + AXP288 PMIC, Micro-USB, DMI_BOARD_NAME: "8021"
+ * Bay Trail SoC    + AXP288 PMIC, Type-C,    DMI_BOARD_NAME: "815D"
+ * Cherry Trail SoC + AXP288 PMIC, Type-C,    DMI_BOARD_NAME: "813E"
+ * Cherry Trail SoC + TI PMIC,     Type-C,    DMI_BOARD_NAME: "827C" or "82F4"
  *
- * The variants with the AXP288 PMIC are all kinds of special:
+ * The variants with the AXP288 + Type-C connector are all kinds of special:
  *
- * 1. All variants use a Type-C connector which the AXP288 does not support, so
- * when using a Type-C charger it is not recognized. Unlike most AXP288 devices,
+ * 1. They use a Type-C connector which the AXP288 does not support, so when
+ * using a Type-C charger it is not recognized. Unlike most AXP288 devices,
  * this model actually has mostly working ACPI AC / Battery code, the ACPI code
  * "solves" this by simply setting the input_current_limit to 3A.
  * There are still some issues with the ACPI code, so we use this native driver,
@@ -585,12 +586,17 @@ out:
  */
 static const struct dmi_system_id axp288_hp_x2_dmi_ids[] = {
 	{
-		/*
-		 * Bay Trail model has "Hewlett-Packard" as sys_vendor, Cherry
-		 * Trail model has "HP", so we only match on product_name.
-		 */
 		.matches = {
-			DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion x2 Detachable"),
+			DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+			DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "HP Pavilion x2 Detachable"),
+			DMI_EXACT_MATCH(DMI_BOARD_NAME, "815D"),
+		},
+	},
+	{
+		.matches = {
+			DMI_EXACT_MATCH(DMI_SYS_VENDOR, "HP"),
+			DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "HP Pavilion x2 Detachable"),
+			DMI_EXACT_MATCH(DMI_BOARD_NAME, "813E"),
 		},
 	},
 	{} /* Terminating entry */
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 178/346] power: supply: bq24190_charger: fix reference leak
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (176 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 4.19 177/346] power: supply: axp288_charger: Fix HP Pavilion x2 10 DMI matching Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 4.19 179/346] genirq/irqdomain: Dont try to free an interrupt that has no mapping Greg Kroah-Hartman
                   ` (170 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Zhang Qilong, Sebastian Reichel, Sasha Levin

From: Zhang Qilong <zhangqilong3@huawei.com>

[ Upstream commit b2f6cb78eaa1cad57dd3fe11d0458cd4fae9a584 ]

pm_runtime_get_sync will increment pm usage counter even it
failed. Forgetting to call pm_runtime_put_noidle will result
in reference leak in callers(bq24190_sysfs_show,
bq24190_charger_get_property, bq24190_charger_set_property,
bq24190_battery_get_property, bq24190_battery_set_property),
so we should fix it.

Fixes: f385e6e2a1532 ("power: bq24190_charger: Use PM runtime autosuspend")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/power/supply/bq24190_charger.c | 20 +++++++++++++++-----
 1 file changed, 15 insertions(+), 5 deletions(-)

diff --git a/drivers/power/supply/bq24190_charger.c b/drivers/power/supply/bq24190_charger.c
index b58df04d03b33..863208928cf0b 100644
--- a/drivers/power/supply/bq24190_charger.c
+++ b/drivers/power/supply/bq24190_charger.c
@@ -446,8 +446,10 @@ static ssize_t bq24190_sysfs_show(struct device *dev,
 		return -EINVAL;
 
 	ret = pm_runtime_get_sync(bdi->dev);
-	if (ret < 0)
+	if (ret < 0) {
+		pm_runtime_put_noidle(bdi->dev);
 		return ret;
+	}
 
 	ret = bq24190_read_mask(bdi, info->reg, info->mask, info->shift, &v);
 	if (ret)
@@ -1092,8 +1094,10 @@ static int bq24190_charger_get_property(struct power_supply *psy,
 	dev_dbg(bdi->dev, "prop: %d\n", psp);
 
 	ret = pm_runtime_get_sync(bdi->dev);
-	if (ret < 0)
+	if (ret < 0) {
+		pm_runtime_put_noidle(bdi->dev);
 		return ret;
+	}
 
 	switch (psp) {
 	case POWER_SUPPLY_PROP_CHARGE_TYPE:
@@ -1164,8 +1168,10 @@ static int bq24190_charger_set_property(struct power_supply *psy,
 	dev_dbg(bdi->dev, "prop: %d\n", psp);
 
 	ret = pm_runtime_get_sync(bdi->dev);
-	if (ret < 0)
+	if (ret < 0) {
+		pm_runtime_put_noidle(bdi->dev);
 		return ret;
+	}
 
 	switch (psp) {
 	case POWER_SUPPLY_PROP_ONLINE:
@@ -1425,8 +1431,10 @@ static int bq24190_battery_get_property(struct power_supply *psy,
 	dev_dbg(bdi->dev, "prop: %d\n", psp);
 
 	ret = pm_runtime_get_sync(bdi->dev);
-	if (ret < 0)
+	if (ret < 0) {
+		pm_runtime_put_noidle(bdi->dev);
 		return ret;
+	}
 
 	switch (psp) {
 	case POWER_SUPPLY_PROP_STATUS:
@@ -1471,8 +1479,10 @@ static int bq24190_battery_set_property(struct power_supply *psy,
 	dev_dbg(bdi->dev, "prop: %d\n", psp);
 
 	ret = pm_runtime_get_sync(bdi->dev);
-	if (ret < 0)
+	if (ret < 0) {
+		pm_runtime_put_noidle(bdi->dev);
 		return ret;
+	}
 
 	switch (psp) {
 	case POWER_SUPPLY_PROP_ONLINE:
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 179/346] genirq/irqdomain: Dont try to free an interrupt that has no mapping
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (177 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 4.19 178/346] power: supply: bq24190_charger: fix reference leak Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 4.19 180/346] PCI: Bounds-check command-line resource alignment requests Greg Kroah-Hartman
                   ` (169 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Marc Zyngier, Thomas Gleixner, Sasha Levin

From: Marc Zyngier <maz@kernel.org>

[ Upstream commit 4615fbc3788ddc8e7c6d697714ad35a53729aa2c ]

When an interrupt allocation fails for N interrupts, it is pretty
common for the error handling code to free the same number of interrupts,
no matter how many interrupts have actually been allocated.

This may result in the domain freeing code to be unexpectedly called
for interrupts that have no mapping in that domain. Things end pretty
badly.

Instead, add some checks to irq_domain_free_irqs_hierarchy() to make sure
that thiss does not follow the hierarchy if no mapping exists for a given
interrupt.

Fixes: 6a6544e520abe ("genirq/irqdomain: Remove auto-recursive hierarchy support")
Signed-off-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Link: https://lore.kernel.org/r/20201129135551.396777-1-maz@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/irq/irqdomain.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/kernel/irq/irqdomain.c b/kernel/irq/irqdomain.c
index 0a76c44eb6b29..1e42fc2ad4d57 100644
--- a/kernel/irq/irqdomain.c
+++ b/kernel/irq/irqdomain.c
@@ -1247,8 +1247,15 @@ static void irq_domain_free_irqs_hierarchy(struct irq_domain *domain,
 					   unsigned int irq_base,
 					   unsigned int nr_irqs)
 {
-	if (domain->ops->free)
-		domain->ops->free(domain, irq_base, nr_irqs);
+	unsigned int i;
+
+	if (!domain->ops->free)
+		return;
+
+	for (i = 0; i < nr_irqs; i++) {
+		if (irq_domain_get_irq_data(domain, irq_base + i))
+			domain->ops->free(domain, irq_base + i, 1);
+	}
 }
 
 int irq_domain_alloc_irqs_hierarchy(struct irq_domain *domain,
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 180/346] PCI: Bounds-check command-line resource alignment requests
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (178 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 4.19 179/346] genirq/irqdomain: Dont try to free an interrupt that has no mapping Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 4.19 181/346] PCI: Fix overflow in " Greg Kroah-Hartman
                   ` (168 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Bjorn Helgaas, Sasha Levin

From: Bjorn Helgaas <bhelgaas@google.com>

[ Upstream commit 6534aac198b58309ff2337981d3f893e0be1d19d ]

32-bit BARs are limited to 2GB size (2^31).  By extension, I assume 64-bit
BARs are limited to 2^63 bytes.  Limit the alignment requested by the
"pci=resource_alignment=" command-line parameter to 2^63.

Link: https://lore.kernel.org/r/20201007123045.GS4282@kadam
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/pci.c | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index 57a87a001b4f4..5103d4b140ee3 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -5840,19 +5840,21 @@ static resource_size_t pci_specified_resource_alignment(struct pci_dev *dev,
 	while (*p) {
 		count = 0;
 		if (sscanf(p, "%d%n", &align_order, &count) == 1 &&
-							p[count] == '@') {
+		    p[count] == '@') {
 			p += count + 1;
+			if (align_order > 63) {
+				pr_err("PCI: Invalid requested alignment (order %d)\n",
+				       align_order);
+				align_order = PAGE_SHIFT;
+			}
 		} else {
-			align_order = -1;
+			align_order = PAGE_SHIFT;
 		}
 
 		ret = pci_dev_str_match(dev, p, &p);
 		if (ret == 1) {
 			*resize = true;
-			if (align_order == -1)
-				align = PAGE_SIZE;
-			else
-				align = 1 << align_order;
+			align = 1 << align_order;
 			break;
 		} else if (ret < 0) {
 			pr_err("PCI: Can't parse resource_alignment parameter: %s\n",
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 181/346] PCI: Fix overflow in command-line resource alignment requests
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (179 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 4.19 180/346] PCI: Bounds-check command-line resource alignment requests Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 4.19 182/346] PCI: iproc: Fix out-of-bound array accesses Greg Kroah-Hartman
                   ` (167 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Colin Ian King, Bjorn Helgaas,
	Logan Gunthorpe, Sasha Levin

From: Colin Ian King <colin.king@canonical.com>

[ Upstream commit cc73eb321d246776e5a9f7723d15708809aa3699 ]

The shift of 1 by align_order is evaluated using 32 bit arithmetic and the
result is assigned to a resource_size_t type variable that is a 64 bit
unsigned integer on 64 bit platforms. Fix an overflow before widening issue
by making the 1 a ULL.

Addresses-Coverity: ("Unintentional integer overflow")
Fixes: 32a9a682bef2 ("PCI: allow assignment of memory resources with a specified alignment")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Logan Gunthorpe <logang@deltatee.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/pci.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index 5103d4b140ee3..cd628dd73719b 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -5854,7 +5854,7 @@ static resource_size_t pci_specified_resource_alignment(struct pci_dev *dev,
 		ret = pci_dev_str_match(dev, p, &p);
 		if (ret == 1) {
 			*resize = true;
-			align = 1 << align_order;
+			align = 1ULL << align_order;
 			break;
 		} else if (ret < 0) {
 			pr_err("PCI: Can't parse resource_alignment parameter: %s\n",
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 182/346] PCI: iproc: Fix out-of-bound array accesses
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (180 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 4.19 181/346] PCI: Fix overflow in " Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 4.19 183/346] arm64: dts: meson: fix spi-max-frequency on Khadas VIM2 Greg Kroah-Hartman
                   ` (166 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Bharat Gooty, Lorenzo Pieralisi, Sasha Levin

From: Bharat Gooty <bharat.gooty@broadcom.com>

[ Upstream commit a3ff529f5d368a17ff35ada8009e101162ebeaf9 ]

Declare the full size array for all revisions of PAX register sets
to avoid potentially out of bound access of the register array
when they are being initialized in iproc_pcie_rev_init().

Link: https://lore.kernel.org/r/20201001060054.6616-2-srinath.mannam@broadcom.com
Fixes: 06324ede76cdf ("PCI: iproc: Improve core register population")
Signed-off-by: Bharat Gooty <bharat.gooty@broadcom.com>
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/controller/pcie-iproc.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/pci/controller/pcie-iproc.c b/drivers/pci/controller/pcie-iproc.c
index ec86414216f97..f2d79e0235bc1 100644
--- a/drivers/pci/controller/pcie-iproc.c
+++ b/drivers/pci/controller/pcie-iproc.c
@@ -300,7 +300,7 @@ enum iproc_pcie_reg {
 };
 
 /* iProc PCIe PAXB BCMA registers */
-static const u16 iproc_pcie_reg_paxb_bcma[] = {
+static const u16 iproc_pcie_reg_paxb_bcma[IPROC_PCIE_MAX_NUM_REG] = {
 	[IPROC_PCIE_CLK_CTRL]		= 0x000,
 	[IPROC_PCIE_CFG_IND_ADDR]	= 0x120,
 	[IPROC_PCIE_CFG_IND_DATA]	= 0x124,
@@ -311,7 +311,7 @@ static const u16 iproc_pcie_reg_paxb_bcma[] = {
 };
 
 /* iProc PCIe PAXB registers */
-static const u16 iproc_pcie_reg_paxb[] = {
+static const u16 iproc_pcie_reg_paxb[IPROC_PCIE_MAX_NUM_REG] = {
 	[IPROC_PCIE_CLK_CTRL]		= 0x000,
 	[IPROC_PCIE_CFG_IND_ADDR]	= 0x120,
 	[IPROC_PCIE_CFG_IND_DATA]	= 0x124,
@@ -327,7 +327,7 @@ static const u16 iproc_pcie_reg_paxb[] = {
 };
 
 /* iProc PCIe PAXB v2 registers */
-static const u16 iproc_pcie_reg_paxb_v2[] = {
+static const u16 iproc_pcie_reg_paxb_v2[IPROC_PCIE_MAX_NUM_REG] = {
 	[IPROC_PCIE_CLK_CTRL]		= 0x000,
 	[IPROC_PCIE_CFG_IND_ADDR]	= 0x120,
 	[IPROC_PCIE_CFG_IND_DATA]	= 0x124,
@@ -355,7 +355,7 @@ static const u16 iproc_pcie_reg_paxb_v2[] = {
 };
 
 /* iProc PCIe PAXC v1 registers */
-static const u16 iproc_pcie_reg_paxc[] = {
+static const u16 iproc_pcie_reg_paxc[IPROC_PCIE_MAX_NUM_REG] = {
 	[IPROC_PCIE_CLK_CTRL]		= 0x000,
 	[IPROC_PCIE_CFG_IND_ADDR]	= 0x1f0,
 	[IPROC_PCIE_CFG_IND_DATA]	= 0x1f4,
@@ -364,7 +364,7 @@ static const u16 iproc_pcie_reg_paxc[] = {
 };
 
 /* iProc PCIe PAXC v2 registers */
-static const u16 iproc_pcie_reg_paxc_v2[] = {
+static const u16 iproc_pcie_reg_paxc_v2[IPROC_PCIE_MAX_NUM_REG] = {
 	[IPROC_PCIE_MSI_GIC_MODE]	= 0x050,
 	[IPROC_PCIE_MSI_BASE_ADDR]	= 0x074,
 	[IPROC_PCIE_MSI_WINDOW_SIZE]	= 0x078,
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 183/346] arm64: dts: meson: fix spi-max-frequency on Khadas VIM2
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (181 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 4.19 182/346] PCI: iproc: Fix out-of-bound array accesses Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 4.19 184/346] ARM: dts: at91: at91sam9rl: fix ADC triggers Greg Kroah-Hartman
                   ` (165 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Artem Lapkin, Neil Armstrong,
	Kevin Hilman, Sasha Levin

From: Artem Lapkin <art@khadas.com>

[ Upstream commit b6c605e00ce8910d7ec3d9a54725d78b14db49b9 ]

The max frequency for the w25q32 (VIM v1.2) and w25q128 (VIM v1.4) spifc
chip should be 104Mhz not 30MHz.

Fixes: b8b74dda3908 ("ARM64: dts: meson-gxm: Add support for Khadas VIM2")
Signed-off-by: Artem Lapkin <art@khadas.com>
Reviewed-by: Neil Armstrong <narmstrong@baylibre.com>
Signed-off-by: Kevin Hilman <khilman@baylibre.com>
Link: https://lore.kernel.org/r/20201125024001.19036-1-christianshewitt@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts b/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts
index bdf7c6c5983ce..30fa9302a4dc8 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts
@@ -399,7 +399,7 @@
 		#size-cells = <1>;
 		compatible = "winbond,w25q16", "jedec,spi-nor";
 		reg = <0>;
-		spi-max-frequency = <3000000>;
+		spi-max-frequency = <104000000>;
 	};
 };
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 184/346] ARM: dts: at91: at91sam9rl: fix ADC triggers
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (182 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 4.19 183/346] arm64: dts: meson: fix spi-max-frequency on Khadas VIM2 Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 4.19 185/346] platform/x86: dell-smbios-base: Fix error return code in dell_smbios_init Greg Kroah-Hartman
                   ` (164 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Alexandre Belloni, Sasha Levin

From: Alexandre Belloni <alexandre.belloni@bootlin.com>

[ Upstream commit 851a95da583c26e2ddeb7281e9b61f0d76ea5aba ]

The triggers for the ADC were taken from at91sam9260 dtsi but are not
correct.

Fixes: a4c1d6c75822 ("ARM: at91/dt: sam9rl: add lcd, adc, usb gadget and pwm support")
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Link: https://lore.kernel.org/r/20201128222818.1910764-10-alexandre.belloni@bootlin.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/at91sam9rl.dtsi | 19 +++++++++++--------
 1 file changed, 11 insertions(+), 8 deletions(-)

diff --git a/arch/arm/boot/dts/at91sam9rl.dtsi b/arch/arm/boot/dts/at91sam9rl.dtsi
index ad495f5a5790f..cdf016232fb7d 100644
--- a/arch/arm/boot/dts/at91sam9rl.dtsi
+++ b/arch/arm/boot/dts/at91sam9rl.dtsi
@@ -277,23 +277,26 @@
 				atmel,adc-use-res = "highres";
 
 				trigger0 {
-					trigger-name = "timer-counter-0";
+					trigger-name = "external-rising";
 					trigger-value = <0x1>;
+					trigger-external;
 				};
+
 				trigger1 {
-					trigger-name = "timer-counter-1";
-					trigger-value = <0x3>;
+					trigger-name = "external-falling";
+					trigger-value = <0x2>;
+					trigger-external;
 				};
 
 				trigger2 {
-					trigger-name = "timer-counter-2";
-					trigger-value = <0x5>;
+					trigger-name = "external-any";
+					trigger-value = <0x3>;
+					trigger-external;
 				};
 
 				trigger3 {
-					trigger-name = "external";
-					trigger-value = <0x13>;
-					trigger-external;
+					trigger-name = "continuous";
+					trigger-value = <0x6>;
 				};
 			};
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 185/346] platform/x86: dell-smbios-base: Fix error return code in dell_smbios_init
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (183 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 4.19 184/346] ARM: dts: at91: at91sam9rl: fix ADC triggers Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 4.19 186/346] ath10k: Fix the parsing error in service available event Greg Kroah-Hartman
                   ` (163 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Qinglang Miao,
	Mario Limonciello, Hans de Goede, Sasha Levin

From: Qinglang Miao <miaoqinglang@huawei.com>

[ Upstream commit 2425ccd30fd78ce35237350fe8baac31dc18bd45 ]

Fix to return the error code -ENODEV when fails to init wmi and
smm.

Fixes: 41e36f2f85af ("platform/x86: dell-smbios: Link all dell-smbios-* modules together")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
Reviewed-by: Mario Limonciello <mario.limonciello@dell.com>
Link: https://lore.kernel.org/r/20201125065032.154125-1-miaoqinglang@huawei.com
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/x86/dell-smbios-base.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/platform/x86/dell-smbios-base.c b/drivers/platform/x86/dell-smbios-base.c
index 0537d44d45a6e..9e9fc51557892 100644
--- a/drivers/platform/x86/dell-smbios-base.c
+++ b/drivers/platform/x86/dell-smbios-base.c
@@ -597,6 +597,7 @@ static int __init dell_smbios_init(void)
 	if (wmi && smm) {
 		pr_err("No SMBIOS backends available (wmi: %d, smm: %d)\n",
 			wmi, smm);
+		ret = -ENODEV;
 		goto fail_create_group;
 	}
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 186/346] ath10k: Fix the parsing error in service available event
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (184 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 4.19 185/346] platform/x86: dell-smbios-base: Fix error return code in dell_smbios_init Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 4.19 187/346] ath10k: Fix an error handling path Greg Kroah-Hartman
                   ` (162 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Rakesh Pillai, Douglas Anderson,
	Kalle Valo, Sasha Levin

From: Rakesh Pillai <pillair@codeaurora.org>

[ Upstream commit c7cee9c0f499f27ec6de06bea664b61320534768 ]

The wmi service available event has been
extended to contain extra 128 bit for new services
to be indicated by firmware.

Currently the presence of any optional TLVs in
the wmi service available event leads to a parsing
error with the below error message:
ath10k_snoc 18800000.wifi: failed to parse svc_avail tlv: -71

The wmi service available event parsing should
not return error for the newly added optional TLV.
Fix this parsing for service available event message.

Tested-on: WCN3990 hw1.0 SNOC WLAN.HL.3.2.2-00720-QCAHLSWMTPL-1

Fixes: cea19a6ce8bf ("ath10k: add WMI_SERVICE_AVAILABLE_EVENT support")
Signed-off-by: Rakesh Pillai <pillair@codeaurora.org>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/1605501291-23040-1-git-send-email-pillair@codeaurora.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath10k/wmi-tlv.c | 4 +++-
 drivers/net/wireless/ath/ath10k/wmi.c     | 9 +++++++--
 drivers/net/wireless/ath/ath10k/wmi.h     | 1 +
 3 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/drivers/net/wireless/ath/ath10k/wmi-tlv.c b/drivers/net/wireless/ath/ath10k/wmi-tlv.c
index 7f435fa29f75e..a6f7bf28a8b2d 100644
--- a/drivers/net/wireless/ath/ath10k/wmi-tlv.c
+++ b/drivers/net/wireless/ath/ath10k/wmi-tlv.c
@@ -1157,13 +1157,15 @@ static int ath10k_wmi_tlv_svc_avail_parse(struct ath10k *ar, u16 tag, u16 len,
 
 	switch (tag) {
 	case WMI_TLV_TAG_STRUCT_SERVICE_AVAILABLE_EVENT:
+		arg->service_map_ext_valid = true;
 		arg->service_map_ext_len = *(__le32 *)ptr;
 		arg->service_map_ext = ptr + sizeof(__le32);
 		return 0;
 	default:
 		break;
 	}
-	return -EPROTO;
+
+	return 0;
 }
 
 static int ath10k_wmi_tlv_op_pull_svc_avail(struct ath10k *ar,
diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c
index 3f3fbee631c34..41eb57be92220 100644
--- a/drivers/net/wireless/ath/ath10k/wmi.c
+++ b/drivers/net/wireless/ath/ath10k/wmi.c
@@ -5510,8 +5510,13 @@ void ath10k_wmi_event_service_available(struct ath10k *ar, struct sk_buff *skb)
 			    ret);
 	}
 
-	ath10k_wmi_map_svc_ext(ar, arg.service_map_ext, ar->wmi.svc_map,
-			       __le32_to_cpu(arg.service_map_ext_len));
+	/*
+	 * Initialization of "arg.service_map_ext_valid" to ZERO is necessary
+	 * for the below logic to work.
+	 */
+	if (arg.service_map_ext_valid)
+		ath10k_wmi_map_svc_ext(ar, arg.service_map_ext, ar->wmi.svc_map,
+				       __le32_to_cpu(arg.service_map_ext_len));
 }
 
 static int ath10k_wmi_event_temperature(struct ath10k *ar, struct sk_buff *skb)
diff --git a/drivers/net/wireless/ath/ath10k/wmi.h b/drivers/net/wireless/ath/ath10k/wmi.h
index e341cfb3fcc26..6bd63d1cd0395 100644
--- a/drivers/net/wireless/ath/ath10k/wmi.h
+++ b/drivers/net/wireless/ath/ath10k/wmi.h
@@ -6710,6 +6710,7 @@ struct wmi_svc_rdy_ev_arg {
 };
 
 struct wmi_svc_avail_ev_arg {
+	bool service_map_ext_valid;
 	__le32 service_map_ext_len;
 	const __le32 *service_map_ext;
 };
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 187/346] ath10k: Fix an error handling path
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (185 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 4.19 186/346] ath10k: Fix the parsing error in service available event Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 4.19 188/346] ath10k: Release some resources in " Greg Kroah-Hartman
                   ` (161 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christophe JAILLET, Kalle Valo, Sasha Levin

From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>

[ Upstream commit ed3573bc3943c27d2d8e405a242f87ed14572ca1 ]

If 'ath10k_usb_create()' fails, we should release some resources and report
an error instead of silently continuing.

Fixes: 4db66499df91 ("ath10k: add initial USB support")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20201122170342.1346011-1-christophe.jaillet@wanadoo.fr
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath10k/usb.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/wireless/ath/ath10k/usb.c b/drivers/net/wireless/ath/ath10k/usb.c
index c64a03f164c0f..f4e6d84bfb91c 100644
--- a/drivers/net/wireless/ath/ath10k/usb.c
+++ b/drivers/net/wireless/ath/ath10k/usb.c
@@ -1019,6 +1019,8 @@ static int ath10k_usb_probe(struct usb_interface *interface,
 
 	ar_usb = ath10k_usb_priv(ar);
 	ret = ath10k_usb_create(ar, interface);
+	if (ret)
+		goto err;
 	ar_usb->ar = ar;
 
 	ar->dev_id = product_id;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 188/346] ath10k: Release some resources in an error handling path
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (186 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 4.19 187/346] ath10k: Fix an error handling path Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 4.19 189/346] NFSv4.2: condition READDIRs mask for security label based on LSM state Greg Kroah-Hartman
                   ` (160 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christophe JAILLET, Kalle Valo, Sasha Levin

From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>

[ Upstream commit 6364e693f4a7a89a2fb3dd2cbd6cc06d5fd6e26d ]

Should an error occur after calling 'ath10k_usb_create()', it should be
undone by a corresponding 'ath10k_usb_destroy()' call

Fixes: 4db66499df91 ("ath10k: add initial USB support")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20201122170358.1346065-1-christophe.jaillet@wanadoo.fr
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath10k/usb.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/ath/ath10k/usb.c b/drivers/net/wireless/ath/ath10k/usb.c
index f4e6d84bfb91c..16d5fe6d1e2e4 100644
--- a/drivers/net/wireless/ath/ath10k/usb.c
+++ b/drivers/net/wireless/ath/ath10k/usb.c
@@ -1032,7 +1032,7 @@ static int ath10k_usb_probe(struct usb_interface *interface,
 	ret = ath10k_core_register(ar, chip_id);
 	if (ret) {
 		ath10k_warn(ar, "failed to register driver core: %d\n", ret);
-		goto err;
+		goto err_usb_destroy;
 	}
 
 	/* TODO: remove this once USB support is fully implemented */
@@ -1040,6 +1040,9 @@ static int ath10k_usb_probe(struct usb_interface *interface,
 
 	return 0;
 
+err_usb_destroy:
+	ath10k_usb_destroy(ar);
+
 err:
 	ath10k_core_destroy(ar);
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 189/346] NFSv4.2: condition READDIRs mask for security label based on LSM state
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (187 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 4.19 188/346] ath10k: Release some resources in " Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 4.19 190/346] SUNRPC: xprt_load_transport() needs to support the netid "rdma6" Greg Kroah-Hartman
                   ` (159 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ondrej Mosnacek, Scott Mayhew,
	Olga Kornievskaia, Trond Myklebust, Sasha Levin

From: Olga Kornievskaia <kolga@netapp.com>

[ Upstream commit 05ad917561fca39a03338cb21fe9622f998b0f9c ]

Currently, the client will always ask for security_labels if the server
returns that it supports that feature regardless of any LSM modules
(such as Selinux) enforcing security policy. This adds performance
penalty to the READDIR operation.

Client adjusts superblock's support of the security_label based on
the server's support but also current client's configuration of the
LSM modules. Thus, prior to using the default bitmask in READDIR,
this patch checks the server's capabilities and then instructs
READDIR to remove FATTR4_WORD2_SECURITY_LABEL from the bitmask.

v5: fixing silly mistakes of the rushed v4
v4: simplifying logic
v3: changing label's initialization per Ondrej's comment
v2: dropping selinux hook and using the sb cap.

Suggested-by: Ondrej Mosnacek <omosnace@redhat.com>
Suggested-by: Scott Mayhew <smayhew@redhat.com>
Signed-off-by: Olga Kornievskaia <kolga@netapp.com>
Fixes: 2b0143b5c986 ("VFS: normal filesystems (and lustre): d_inode() annotations")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/nfs/nfs4proc.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index fe7b42c277ac5..1a395647ae265 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -4687,12 +4687,12 @@ static int _nfs4_proc_readdir(struct dentry *dentry, struct rpc_cred *cred,
 		u64 cookie, struct page **pages, unsigned int count, bool plus)
 {
 	struct inode		*dir = d_inode(dentry);
+	struct nfs_server	*server = NFS_SERVER(dir);
 	struct nfs4_readdir_arg args = {
 		.fh = NFS_FH(dir),
 		.pages = pages,
 		.pgbase = 0,
 		.count = count,
-		.bitmask = NFS_SERVER(d_inode(dentry))->attr_bitmask,
 		.plus = plus,
 	};
 	struct nfs4_readdir_res res;
@@ -4707,9 +4707,15 @@ static int _nfs4_proc_readdir(struct dentry *dentry, struct rpc_cred *cred,
 	dprintk("%s: dentry = %pd2, cookie = %Lu\n", __func__,
 			dentry,
 			(unsigned long long)cookie);
+	if (!(server->caps & NFS_CAP_SECURITY_LABEL))
+		args.bitmask = server->attr_bitmask_nl;
+	else
+		args.bitmask = server->attr_bitmask;
+
 	nfs4_setup_readdir(cookie, NFS_I(dir)->cookieverf, dentry, &args);
 	res.pgbase = args.pgbase;
-	status = nfs4_call_sync(NFS_SERVER(dir)->client, NFS_SERVER(dir), &msg, &args.seq_args, &res.seq_res, 0);
+	status = nfs4_call_sync(server->client, server, &msg, &args.seq_args,
+			&res.seq_res, 0);
 	if (status >= 0) {
 		memcpy(NFS_I(dir)->cookieverf, res.verifier.data, NFS4_VERIFIER_SIZE);
 		status += args.pgbase;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 190/346] SUNRPC: xprt_load_transport() needs to support the netid "rdma6"
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (188 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 4.19 189/346] NFSv4.2: condition READDIRs mask for security label based on LSM state Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 4.19 191/346] lockd: dont use interval-based rebinding over TCP Greg Kroah-Hartman
                   ` (158 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Trond Myklebust, Sasha Levin

From: Trond Myklebust <trond.myklebust@hammerspace.com>

[ Upstream commit d5aa6b22e2258f05317313ecc02efbb988ed6d38 ]

According to RFC5666, the correct netid for an IPv6 addressed RDMA
transport is "rdma6", which we've supported as a mount option since
Linux-4.7. The problem is when we try to load the module "xprtrdma6",
that will fail, since there is no modulealias of that name.

Fixes: 181342c5ebe8 ("xprtrdma: Add rdma6 option to support NFS/RDMA IPv6")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/sunrpc/xprt.h     |  1 +
 net/sunrpc/xprt.c               | 65 +++++++++++++++++++++++++--------
 net/sunrpc/xprtrdma/module.c    |  1 +
 net/sunrpc/xprtrdma/transport.c |  1 +
 net/sunrpc/xprtsock.c           |  4 ++
 5 files changed, 56 insertions(+), 16 deletions(-)

diff --git a/include/linux/sunrpc/xprt.h b/include/linux/sunrpc/xprt.h
index e7bbd82908b10..69fed13e633b7 100644
--- a/include/linux/sunrpc/xprt.h
+++ b/include/linux/sunrpc/xprt.h
@@ -317,6 +317,7 @@ struct xprt_class {
 	struct rpc_xprt *	(*setup)(struct xprt_create *);
 	struct module		*owner;
 	char			name[32];
+	const char *		netid[];
 };
 
 /*
diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
index 5e7c13aa66d0d..9c4235ce57894 100644
--- a/net/sunrpc/xprt.c
+++ b/net/sunrpc/xprt.c
@@ -143,31 +143,64 @@ out:
 }
 EXPORT_SYMBOL_GPL(xprt_unregister_transport);
 
+static void
+xprt_class_release(const struct xprt_class *t)
+{
+	module_put(t->owner);
+}
+
+static const struct xprt_class *
+xprt_class_find_by_netid_locked(const char *netid)
+{
+	const struct xprt_class *t;
+	unsigned int i;
+
+	list_for_each_entry(t, &xprt_list, list) {
+		for (i = 0; t->netid[i][0] != '\0'; i++) {
+			if (strcmp(t->netid[i], netid) != 0)
+				continue;
+			if (!try_module_get(t->owner))
+				continue;
+			return t;
+		}
+	}
+	return NULL;
+}
+
+static const struct xprt_class *
+xprt_class_find_by_netid(const char *netid)
+{
+	const struct xprt_class *t;
+
+	spin_lock(&xprt_list_lock);
+	t = xprt_class_find_by_netid_locked(netid);
+	if (!t) {
+		spin_unlock(&xprt_list_lock);
+		request_module("rpc%s", netid);
+		spin_lock(&xprt_list_lock);
+		t = xprt_class_find_by_netid_locked(netid);
+	}
+	spin_unlock(&xprt_list_lock);
+	return t;
+}
+
 /**
  * xprt_load_transport - load a transport implementation
- * @transport_name: transport to load
+ * @netid: transport to load
  *
  * Returns:
  * 0:		transport successfully loaded
  * -ENOENT:	transport module not available
  */
-int xprt_load_transport(const char *transport_name)
+int xprt_load_transport(const char *netid)
 {
-	struct xprt_class *t;
-	int result;
+	const struct xprt_class *t;
 
-	result = 0;
-	spin_lock(&xprt_list_lock);
-	list_for_each_entry(t, &xprt_list, list) {
-		if (strcmp(t->name, transport_name) == 0) {
-			spin_unlock(&xprt_list_lock);
-			goto out;
-		}
-	}
-	spin_unlock(&xprt_list_lock);
-	result = request_module("xprt%s", transport_name);
-out:
-	return result;
+	t = xprt_class_find_by_netid(netid);
+	if (!t)
+		return -ENOENT;
+	xprt_class_release(t);
+	return 0;
 }
 EXPORT_SYMBOL_GPL(xprt_load_transport);
 
diff --git a/net/sunrpc/xprtrdma/module.c b/net/sunrpc/xprtrdma/module.c
index 620327c01302c..45c5b41ac8dc9 100644
--- a/net/sunrpc/xprtrdma/module.c
+++ b/net/sunrpc/xprtrdma/module.c
@@ -24,6 +24,7 @@ MODULE_DESCRIPTION("RPC/RDMA Transport");
 MODULE_LICENSE("Dual BSD/GPL");
 MODULE_ALIAS("svcrdma");
 MODULE_ALIAS("xprtrdma");
+MODULE_ALIAS("rpcrdma6");
 
 static void __exit rpc_rdma_cleanup(void)
 {
diff --git a/net/sunrpc/xprtrdma/transport.c b/net/sunrpc/xprtrdma/transport.c
index f56f36b4d742d..fdd14908eacbd 100644
--- a/net/sunrpc/xprtrdma/transport.c
+++ b/net/sunrpc/xprtrdma/transport.c
@@ -854,6 +854,7 @@ static struct xprt_class xprt_rdma = {
 	.owner			= THIS_MODULE,
 	.ident			= XPRT_TRANSPORT_RDMA,
 	.setup			= xprt_setup_rdma,
+	.netid			= { "rdma", "rdma6", "" },
 };
 
 void xprt_rdma_cleanup(void)
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index 9dc059dea689d..798fbd89ed42f 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -3241,6 +3241,7 @@ static struct xprt_class	xs_local_transport = {
 	.owner		= THIS_MODULE,
 	.ident		= XPRT_TRANSPORT_LOCAL,
 	.setup		= xs_setup_local,
+	.netid		= { "" },
 };
 
 static struct xprt_class	xs_udp_transport = {
@@ -3249,6 +3250,7 @@ static struct xprt_class	xs_udp_transport = {
 	.owner		= THIS_MODULE,
 	.ident		= XPRT_TRANSPORT_UDP,
 	.setup		= xs_setup_udp,
+	.netid		= { "udp", "udp6", "" },
 };
 
 static struct xprt_class	xs_tcp_transport = {
@@ -3257,6 +3259,7 @@ static struct xprt_class	xs_tcp_transport = {
 	.owner		= THIS_MODULE,
 	.ident		= XPRT_TRANSPORT_TCP,
 	.setup		= xs_setup_tcp,
+	.netid		= { "tcp", "tcp6", "" },
 };
 
 static struct xprt_class	xs_bc_tcp_transport = {
@@ -3265,6 +3268,7 @@ static struct xprt_class	xs_bc_tcp_transport = {
 	.owner		= THIS_MODULE,
 	.ident		= XPRT_TRANSPORT_BC_TCP,
 	.setup		= xs_setup_bc_tcp,
+	.netid		= { "" },
 };
 
 /**
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 191/346] lockd: dont use interval-based rebinding over TCP
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (189 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 4.19 190/346] SUNRPC: xprt_load_transport() needs to support the netid "rdma6" Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 4.19 192/346] NFS: switch nfsiod to be an UNBOUND workqueue Greg Kroah-Hartman
                   ` (157 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Calum Mackay, Trond Myklebust, Sasha Levin

From: Calum Mackay <calum.mackay@oracle.com>

[ Upstream commit 9b82d88d5976e5f2b8015d58913654856576ace5 ]

NLM uses an interval-based rebinding, i.e. it clears the transport's
binding under certain conditions if more than 60 seconds have elapsed
since the connection was last bound.

This rebinding is not necessary for an autobind RPC client over a
connection-oriented protocol like TCP.

It can also cause problems: it is possible for nlm_bind_host() to clear
XPRT_BOUND whilst a connection worker is in the middle of trying to
reconnect, after it had already been checked in xprt_connect().

When the connection worker notices that XPRT_BOUND has been cleared
under it, in xs_tcp_finish_connecting(), that results in:

	xs_tcp_setup_socket: connect returned unhandled error -107

Worse, it's possible that the two can get into lockstep, resulting in
the same behaviour repeated indefinitely, with the above error every
300 seconds, without ever recovering, and the connection never being
established. This has been seen in practice, with a large number of NLM
client tasks, following a server restart.

The existing callers of nlm_bind_host & nlm_rebind_host should not need
to force the rebind, for TCP, so restrict the interval-based rebinding
to UDP only.

For TCP, we will still rebind when needed, e.g. on timeout, and connection
error (including closure), since connection-related errors on an existing
connection, ECONNREFUSED when trying to connect, and rpc_check_timeout(),
already unconditionally clear XPRT_BOUND.

To avoid having to add the fix, and explanation, to both nlm_bind_host()
and nlm_rebind_host(), remove the duplicate code from the former, and
have it call the latter.

Drop the dprintk, which adds no value over a trace.

Signed-off-by: Calum Mackay <calum.mackay@oracle.com>
Fixes: 35f5a422ce1a ("SUNRPC: new interface to force an RPC rebind")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/lockd/host.c | 20 +++++++++++---------
 1 file changed, 11 insertions(+), 9 deletions(-)

diff --git a/fs/lockd/host.c b/fs/lockd/host.c
index f0b5c987d6ae1..3f6ba0cd2bd9c 100644
--- a/fs/lockd/host.c
+++ b/fs/lockd/host.c
@@ -432,12 +432,7 @@ nlm_bind_host(struct nlm_host *host)
 	 * RPC rebind is required
 	 */
 	if ((clnt = host->h_rpcclnt) != NULL) {
-		if (time_after_eq(jiffies, host->h_nextrebind)) {
-			rpc_force_rebind(clnt);
-			host->h_nextrebind = jiffies + NLM_HOST_REBIND;
-			dprintk("lockd: next rebind in %lu jiffies\n",
-					host->h_nextrebind - jiffies);
-		}
+		nlm_rebind_host(host);
 	} else {
 		unsigned long increment = nlmsvc_timeout;
 		struct rpc_timeout timeparms = {
@@ -485,13 +480,20 @@ nlm_bind_host(struct nlm_host *host)
 	return clnt;
 }
 
-/*
- * Force a portmap lookup of the remote lockd port
+/**
+ * nlm_rebind_host - If needed, force a portmap lookup of the peer's lockd port
+ * @host: NLM host handle for peer
+ *
+ * This is not needed when using a connection-oriented protocol, such as TCP.
+ * The existing autobind mechanism is sufficient to force a rebind when
+ * required, e.g. on connection state transitions.
  */
 void
 nlm_rebind_host(struct nlm_host *host)
 {
-	dprintk("lockd: rebind host %s\n", host->h_name);
+	if (host->h_proto != IPPROTO_UDP)
+		return;
+
 	if (host->h_rpcclnt && time_after_eq(jiffies, host->h_nextrebind)) {
 		rpc_force_rebind(host->h_rpcclnt);
 		host->h_nextrebind = jiffies + NLM_HOST_REBIND;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 192/346] NFS: switch nfsiod to be an UNBOUND workqueue.
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (190 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 4.19 191/346] lockd: dont use interval-based rebinding over TCP Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 4.19 193/346] vfio-pci: Use io_remap_pfn_range() for PCI IO memory Greg Kroah-Hartman
                   ` (156 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, NeilBrown, Trond Myklebust, Sasha Levin

From: NeilBrown <neilb@suse.de>

[ Upstream commit bf701b765eaa82dd164d65edc5747ec7288bb5c3 ]

nfsiod is currently a concurrency-managed workqueue (CMWQ).
This means that workitems scheduled to nfsiod on a given CPU are queued
behind all other work items queued on any CMWQ on the same CPU.  This
can introduce unexpected latency.

Occaionally nfsiod can even cause excessive latency.  If the work item
to complete a CLOSE request calls the final iput() on an inode, the
address_space of that inode will be dismantled.  This takes time
proportional to the number of in-memory pages, which on a large host
working on large files (e.g..  5TB), can be a large number of pages
resulting in a noticable number of seconds.

We can avoid these latency problems by switching nfsiod to WQ_UNBOUND.
This causes each concurrent work item to gets a dedicated thread which
can be scheduled to an idle CPU.

There is precedent for this as several other filesystems use WQ_UNBOUND
workqueue for handling various async events.

Signed-off-by: NeilBrown <neilb@suse.de>
Fixes: ada609ee2ac2 ("workqueue: use WQ_MEM_RECLAIM instead of WQ_RESCUER")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/nfs/inode.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
index e4cd3a2fe6989..aee66d8f13305 100644
--- a/fs/nfs/inode.c
+++ b/fs/nfs/inode.c
@@ -2142,7 +2142,7 @@ static int nfsiod_start(void)
 {
 	struct workqueue_struct *wq;
 	dprintk("RPC:       creating workqueue nfsiod\n");
-	wq = alloc_workqueue("nfsiod", WQ_MEM_RECLAIM, 0);
+	wq = alloc_workqueue("nfsiod", WQ_MEM_RECLAIM | WQ_UNBOUND, 0);
 	if (wq == NULL)
 		return -ENOMEM;
 	nfsiod_workqueue = wq;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 193/346] vfio-pci: Use io_remap_pfn_range() for PCI IO memory
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (191 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 4.19 192/346] NFS: switch nfsiod to be an UNBOUND workqueue Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 4.19 194/346] media: saa7146: fix array overflow in vidioc_s_audio() Greg Kroah-Hartman
                   ` (155 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jason Gunthorpe, Peter Xu,
	Tom Lendacky, Alex Williamson, Sasha Levin

From: Jason Gunthorpe <jgg@nvidia.com>

[ Upstream commit 7b06a56d468b756ad6bb43ac21b11e474ebc54a0 ]

commit f8f6ae5d077a ("mm: always have io_remap_pfn_range() set
pgprot_decrypted()") allows drivers using mmap to put PCI memory mapped
BAR space into userspace to work correctly on AMD SME systems that default
to all memory encrypted.

Since vfio_pci_mmap_fault() is working with PCI memory mapped BAR space it
should be calling io_remap_pfn_range() otherwise it will not work on SME
systems.

Fixes: 11c4cd07ba11 ("vfio-pci: Fault mmaps to enable vma tracking")
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Acked-by: Peter Xu <peterx@redhat.com>
Tested-by: Tom Lendacky <thomas.lendacky@amd.com>
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/vfio/pci/vfio_pci.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
index 58e7336b2748b..5e23e4aa5b0a3 100644
--- a/drivers/vfio/pci/vfio_pci.c
+++ b/drivers/vfio/pci/vfio_pci.c
@@ -1380,8 +1380,8 @@ static vm_fault_t vfio_pci_mmap_fault(struct vm_fault *vmf)
 
 	mutex_unlock(&vdev->vma_lock);
 
-	if (remap_pfn_range(vma, vma->vm_start, vma->vm_pgoff,
-			    vma->vm_end - vma->vm_start, vma->vm_page_prot))
+	if (io_remap_pfn_range(vma, vma->vm_start, vma->vm_pgoff,
+			       vma->vm_end - vma->vm_start, vma->vm_page_prot))
 		ret = VM_FAULT_SIGBUS;
 
 up_out:
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 194/346] media: saa7146: fix array overflow in vidioc_s_audio()
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (192 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 4.19 193/346] vfio-pci: Use io_remap_pfn_range() for PCI IO memory Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 4.19 195/346] clocksource/drivers/cadence_ttc: Fix memory leak in ttc_setup_clockevent() Greg Kroah-Hartman
                   ` (154 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Hans Verkuil,
	Mauro Carvalho Chehab, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit 8e4d86e241cf035d6d3467cd346e7ce490681937 ]

The "a->index" value comes from the user via the ioctl.  The problem is
that the shift can wrap resulting in setting "mxb->cur_audinput" to an
invalid value, which later results in an array overflow.

Fixes: 6680427791c9 ("[media] mxb: fix audio handling")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/pci/saa7146/mxb.c | 19 ++++++++++---------
 1 file changed, 10 insertions(+), 9 deletions(-)

diff --git a/drivers/media/pci/saa7146/mxb.c b/drivers/media/pci/saa7146/mxb.c
index 6b5582b7c5955..6e25654da2567 100644
--- a/drivers/media/pci/saa7146/mxb.c
+++ b/drivers/media/pci/saa7146/mxb.c
@@ -653,16 +653,17 @@ static int vidioc_s_audio(struct file *file, void *fh, const struct v4l2_audio *
 	struct mxb *mxb = (struct mxb *)dev->ext_priv;
 
 	DEB_D("VIDIOC_S_AUDIO %d\n", a->index);
-	if (mxb_inputs[mxb->cur_input].audioset & (1 << a->index)) {
-		if (mxb->cur_audinput != a->index) {
-			mxb->cur_audinput = a->index;
-			tea6420_route(mxb, a->index);
-			if (mxb->cur_audinput == 0)
-				mxb_update_audmode(mxb);
-		}
-		return 0;
+	if (a->index >= 32 ||
+	    !(mxb_inputs[mxb->cur_input].audioset & (1 << a->index)))
+		return -EINVAL;
+
+	if (mxb->cur_audinput != a->index) {
+		mxb->cur_audinput = a->index;
+		tea6420_route(mxb, a->index);
+		if (mxb->cur_audinput == 0)
+			mxb_update_audmode(mxb);
 	}
-	return -EINVAL;
+	return 0;
 }
 
 #ifdef CONFIG_VIDEO_ADV_DEBUG
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 195/346] clocksource/drivers/cadence_ttc: Fix memory leak in ttc_setup_clockevent()
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (193 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 4.19 194/346] media: saa7146: fix array overflow in vidioc_s_audio() Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 4.19 196/346] ARM: dts: at91: sama5d2: map securam as device Greg Kroah-Hartman
                   ` (153 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Yu Kuai, Daniel Lezcano,
	Sasha Levin

From: Yu Kuai <yukuai3@huawei.com>

[ Upstream commit eee422c46e6840a81c9db18a497b74387a557b29 ]

If clk_notifier_register() failed, ttc_setup_clockevent() will return
without freeing 'ttcce', which will leak memory.

Fixes: 70504f311d4b ("clocksource/drivers/cadence_ttc: Convert init function to return error")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Link: https://lore.kernel.org/r/20201116135123.2164033-1-yukuai3@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clocksource/cadence_ttc_timer.c | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/drivers/clocksource/cadence_ttc_timer.c b/drivers/clocksource/cadence_ttc_timer.c
index 29d51755e18b2..a7eb858a84a0f 100644
--- a/drivers/clocksource/cadence_ttc_timer.c
+++ b/drivers/clocksource/cadence_ttc_timer.c
@@ -419,10 +419,8 @@ static int __init ttc_setup_clockevent(struct clk *clk,
 	ttcce->ttc.clk = clk;
 
 	err = clk_prepare_enable(ttcce->ttc.clk);
-	if (err) {
-		kfree(ttcce);
-		return err;
-	}
+	if (err)
+		goto out_kfree;
 
 	ttcce->ttc.clk_rate_change_nb.notifier_call =
 		ttc_rate_change_clockevent_cb;
@@ -432,7 +430,7 @@ static int __init ttc_setup_clockevent(struct clk *clk,
 				    &ttcce->ttc.clk_rate_change_nb);
 	if (err) {
 		pr_warn("Unable to register clock notifier.\n");
-		return err;
+		goto out_kfree;
 	}
 
 	ttcce->ttc.freq = clk_get_rate(ttcce->ttc.clk);
@@ -461,15 +459,17 @@ static int __init ttc_setup_clockevent(struct clk *clk,
 
 	err = request_irq(irq, ttc_clock_event_interrupt,
 			  IRQF_TIMER, ttcce->ce.name, ttcce);
-	if (err) {
-		kfree(ttcce);
-		return err;
-	}
+	if (err)
+		goto out_kfree;
 
 	clockevents_config_and_register(&ttcce->ce,
 			ttcce->ttc.freq / PRESCALE, 1, 0xfffe);
 
 	return 0;
+
+out_kfree:
+	kfree(ttcce);
+	return err;
 }
 
 /**
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 196/346] ARM: dts: at91: sama5d2: map securam as device
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (194 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 4.19 195/346] clocksource/drivers/cadence_ttc: Fix memory leak in ttc_setup_clockevent() Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 4.19 197/346] pinctrl: falcon: add missing put_device() call in pinctrl_falcon_probe() Greg Kroah-Hartman
                   ` (152 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Claudiu Beznea, Alexandre Belloni,
	Nicolas Ferre, Sasha Levin

From: Claudiu Beznea <claudiu.beznea@microchip.com>

[ Upstream commit 9b5dcc8d427e2bcb84c49eb03ffefe11e7537a55 ]

Due to strobe signal not being propagated from CPU to securam
the securam needs to be mapped as device or strongly ordered memory
to work properly. Otherwise, updating to one offset may affect
the adjacent locations in securam.

Fixes: d4ce5f44d4409 ("ARM: dts: at91: sama5d2: Add securam node")
Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Acked-by: Nicolas Ferre <nicolas.ferre@microchip.com>
Link: https://lore.kernel.org/r/1606903025-14197-3-git-send-email-claudiu.beznea@microchip.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/sama5d2.dtsi | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/arm/boot/dts/sama5d2.dtsi b/arch/arm/boot/dts/sama5d2.dtsi
index b405992eb6016..d57be54f5df9c 100644
--- a/arch/arm/boot/dts/sama5d2.dtsi
+++ b/arch/arm/boot/dts/sama5d2.dtsi
@@ -1247,6 +1247,7 @@
 				clocks = <&securam_clk>;
 				#address-cells = <1>;
 				#size-cells = <1>;
+				no-memory-wc;
 				ranges = <0 0xf8044000 0x1420>;
 			};
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 197/346] pinctrl: falcon: add missing put_device() call in pinctrl_falcon_probe()
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (195 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 4.19 196/346] ARM: dts: at91: sama5d2: map securam as device Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 4.19 198/346] arm64: dts: rockchip: Fix UART pull-ups on rk3328 Greg Kroah-Hartman
                   ` (151 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yu Kuai, Linus Walleij, Sasha Levin

From: Yu Kuai <yukuai3@huawei.com>

[ Upstream commit 89cce2b3f247a434ee174ab6803698041df98014 ]

if of_find_device_by_node() succeed, pinctrl_falcon_probe() doesn't have
a corresponding put_device(). Thus add put_device() to fix the exception
handling for this function implementation.

Fixes: e316cb2b16bb ("OF: pinctrl: MIPS: lantiq: adds support for FALCON SoC")
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
Link: https://lore.kernel.org/r/20201119011219.2248232-1-yukuai3@huawei.com
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pinctrl/pinctrl-falcon.c | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/drivers/pinctrl/pinctrl-falcon.c b/drivers/pinctrl/pinctrl-falcon.c
index fb73dcbb5ef37..68dcf53aaac34 100644
--- a/drivers/pinctrl/pinctrl-falcon.c
+++ b/drivers/pinctrl/pinctrl-falcon.c
@@ -438,24 +438,28 @@ static int pinctrl_falcon_probe(struct platform_device *pdev)
 
 	/* load and remap the pad resources of the different banks */
 	for_each_compatible_node(np, NULL, "lantiq,pad-falcon") {
-		struct platform_device *ppdev = of_find_device_by_node(np);
 		const __be32 *bank = of_get_property(np, "lantiq,bank", NULL);
 		struct resource res;
+		struct platform_device *ppdev;
 		u32 avail;
 		int pins;
 
 		if (!of_device_is_available(np))
 			continue;
 
-		if (!ppdev) {
-			dev_err(&pdev->dev, "failed to find pad pdev\n");
-			continue;
-		}
 		if (!bank || *bank >= PORTS)
 			continue;
 		if (of_address_to_resource(np, 0, &res))
 			continue;
+
+		ppdev = of_find_device_by_node(np);
+		if (!ppdev) {
+			dev_err(&pdev->dev, "failed to find pad pdev\n");
+			continue;
+		}
+
 		falcon_info.clk[*bank] = clk_get(&ppdev->dev, NULL);
+		put_device(&ppdev->dev);
 		if (IS_ERR(falcon_info.clk[*bank])) {
 			dev_err(&ppdev->dev, "failed to get clock\n");
 			return PTR_ERR(falcon_info.clk[*bank]);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 198/346] arm64: dts: rockchip: Fix UART pull-ups on rk3328
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (196 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 4.19 197/346] pinctrl: falcon: add missing put_device() call in pinctrl_falcon_probe() Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 4.19 199/346] memstick: r592: Fix error return in r592_probe() Greg Kroah-Hartman
                   ` (150 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chen-Yu Tsai, Heiko Stuebner, Sasha Levin

From: Chen-Yu Tsai <wens@csie.org>

[ Upstream commit 94dad6bed3c86c00050bf7c2b2ad6b630facae31 ]

For UARTs, the local pull-ups should be on the RX pin, not the TX pin.
UARTs transmit active-low, so a disconnected RX pin should be pulled
high instead of left floating to prevent noise being interpreted as
transmissions.

This gets rid of bogus sysrq events when the UART console is not
connected.

Fixes: 52e02d377a72 ("arm64: dts: rockchip: add core dtsi file for RK3328 SoCs")
Signed-off-by: Chen-Yu Tsai <wens@csie.org>
Link: https://lore.kernel.org/r/20201204064805.6480-1-wens@kernel.org
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/rockchip/rk3328.dtsi | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/arch/arm64/boot/dts/rockchip/rk3328.dtsi b/arch/arm64/boot/dts/rockchip/rk3328.dtsi
index 92186edefeb96..6be7c67584ba9 100644
--- a/arch/arm64/boot/dts/rockchip/rk3328.dtsi
+++ b/arch/arm64/boot/dts/rockchip/rk3328.dtsi
@@ -1085,8 +1085,8 @@
 
 		uart0 {
 			uart0_xfer: uart0-xfer {
-				rockchip,pins = <1 RK_PB1 1 &pcfg_pull_up>,
-						<1 RK_PB0 1 &pcfg_pull_none>;
+				rockchip,pins = <1 RK_PB1 1 &pcfg_pull_none>,
+						<1 RK_PB0 1 &pcfg_pull_up>;
 			};
 
 			uart0_cts: uart0-cts {
@@ -1104,8 +1104,8 @@
 
 		uart1 {
 			uart1_xfer: uart1-xfer {
-				rockchip,pins = <3 RK_PA4 4 &pcfg_pull_up>,
-						<3 RK_PA6 4 &pcfg_pull_none>;
+				rockchip,pins = <3 RK_PA4 4 &pcfg_pull_none>,
+						<3 RK_PA6 4 &pcfg_pull_up>;
 			};
 
 			uart1_cts: uart1-cts {
@@ -1123,15 +1123,15 @@
 
 		uart2-0 {
 			uart2m0_xfer: uart2m0-xfer {
-				rockchip,pins = <1 RK_PA0 2 &pcfg_pull_up>,
-						<1 RK_PA1 2 &pcfg_pull_none>;
+				rockchip,pins = <1 RK_PA0 2 &pcfg_pull_none>,
+						<1 RK_PA1 2 &pcfg_pull_up>;
 			};
 		};
 
 		uart2-1 {
 			uart2m1_xfer: uart2m1-xfer {
-				rockchip,pins = <2 RK_PA0 1 &pcfg_pull_up>,
-						<2 RK_PA1 1 &pcfg_pull_none>;
+				rockchip,pins = <2 RK_PA0 1 &pcfg_pull_none>,
+						<2 RK_PA1 1 &pcfg_pull_up>;
 			};
 		};
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 199/346] memstick: r592: Fix error return in r592_probe()
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (197 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 4.19 198/346] arm64: dts: rockchip: Fix UART pull-ups on rk3328 Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 4.19 200/346] net/mlx5: Properly convey driver version to firmware Greg Kroah-Hartman
                   ` (149 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jing Xiangfeng, Ulf Hansson, Sasha Levin

From: Jing Xiangfeng <jingxiangfeng@huawei.com>

[ Upstream commit db29d3d1c2451e673e29c7257471e3ce9d50383a ]

Fix to return a error code from the error handling case instead of 0.

Fixes: 926341250102 ("memstick: add driver for Ricoh R5C592 card reader")
Signed-off-by: Jing Xiangfeng <jingxiangfeng@huawei.com>
Link: https://lore.kernel.org/r/20201125014718.153563-1-jingxiangfeng@huawei.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/memstick/host/r592.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/drivers/memstick/host/r592.c b/drivers/memstick/host/r592.c
index 627d6e62fe313..4559593ecd5a9 100644
--- a/drivers/memstick/host/r592.c
+++ b/drivers/memstick/host/r592.c
@@ -762,8 +762,10 @@ static int r592_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 		goto error3;
 
 	dev->mmio = pci_ioremap_bar(pdev, 0);
-	if (!dev->mmio)
+	if (!dev->mmio) {
+		error = -ENOMEM;
 		goto error4;
+	}
 
 	dev->irq = pdev->irq;
 	spin_lock_init(&dev->irq_lock);
@@ -789,12 +791,14 @@ static int r592_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 		&dev->dummy_dma_page_physical_address, GFP_KERNEL);
 	r592_stop_dma(dev , 0);
 
-	if (request_irq(dev->irq, &r592_irq, IRQF_SHARED,
-			  DRV_NAME, dev))
+	error = request_irq(dev->irq, &r592_irq, IRQF_SHARED,
+			  DRV_NAME, dev);
+	if (error)
 		goto error6;
 
 	r592_update_card_detect(dev);
-	if (memstick_add_host(host))
+	error = memstick_add_host(host);
+	if (error)
 		goto error7;
 
 	message("driver successfully loaded");
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 200/346] net/mlx5: Properly convey driver version to firmware
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (198 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 4.19 199/346] memstick: r592: Fix error return in r592_probe() Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 4.19 201/346] ASoC: jz4740-i2s: add missed checks for clk_get() Greg Kroah-Hartman
                   ` (148 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Leon Romanovsky, Sasha Levin

From: Leon Romanovsky <leonro@nvidia.com>

[ Upstream commit 907af0f0cab4ee5d5604f182ecec2c5b5119d294 ]

mlx5 firmware expects driver version in specific format X.X.X, so
make it always correct and based on real kernel version aligned with
the driver.

Fixes: 012e50e109fd ("net/mlx5: Set driver version into firmware")
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/mellanox/mlx5/core/main.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
index 5fac00ea62457..a2b25afa24722 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
@@ -51,6 +51,7 @@
 #ifdef CONFIG_RFS_ACCEL
 #include <linux/cpu_rmap.h>
 #endif
+#include <linux/version.h>
 #include <net/devlink.h>
 #include "mlx5_core.h"
 #include "fs_core.h"
@@ -211,7 +212,10 @@ static void mlx5_set_driver_version(struct mlx5_core_dev *dev)
 	strncat(string, ",", remaining_size);
 
 	remaining_size = max_t(int, 0, driver_ver_sz - strlen(string));
-	strncat(string, DRIVER_VERSION, remaining_size);
+
+	snprintf(string + strlen(string), remaining_size, "%u.%u.%u",
+		 (u8)((LINUX_VERSION_CODE >> 16) & 0xff), (u8)((LINUX_VERSION_CODE >> 8) & 0xff),
+		 (u16)(LINUX_VERSION_CODE & 0xffff));
 
 	/*Send the command*/
 	MLX5_SET(set_driver_version_in, in, opcode,
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 201/346] ASoC: jz4740-i2s: add missed checks for clk_get()
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (199 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 4.19 200/346] net/mlx5: Properly convey driver version to firmware Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 4.19 202/346] dm ioctl: fix error return code in target_message Greg Kroah-Hartman
                   ` (147 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chuhong Yuan, Mark Brown, Sasha Levin

From: Chuhong Yuan <hslester96@gmail.com>

[ Upstream commit 1c1fb2653a0c2e3f310c07eacd8fc3a10e08c97a ]

jz4740_i2s_set_sysclk() does not check the return values of clk_get(),
while the file dereferences the pointers in clk_put().
Add the missed checks to fix it.

Fixes: 11bd3dd1b7c2 ("ASoC: Add JZ4740 ASoC support")
Signed-off-by: Chuhong Yuan <hslester96@gmail.com>
Link: https://lore.kernel.org/r/20201203144227.418194-1-hslester96@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/jz4740/jz4740-i2s.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/sound/soc/jz4740/jz4740-i2s.c b/sound/soc/jz4740/jz4740-i2s.c
index e099c0505b765..2c6b0ac97c684 100644
--- a/sound/soc/jz4740/jz4740-i2s.c
+++ b/sound/soc/jz4740/jz4740-i2s.c
@@ -318,10 +318,14 @@ static int jz4740_i2s_set_sysclk(struct snd_soc_dai *dai, int clk_id,
 	switch (clk_id) {
 	case JZ4740_I2S_CLKSRC_EXT:
 		parent = clk_get(NULL, "ext");
+		if (IS_ERR(parent))
+			return PTR_ERR(parent);
 		clk_set_parent(i2s->clk_i2s, parent);
 		break;
 	case JZ4740_I2S_CLKSRC_PLL:
 		parent = clk_get(NULL, "pll half");
+		if (IS_ERR(parent))
+			return PTR_ERR(parent);
 		clk_set_parent(i2s->clk_i2s, parent);
 		ret = clk_set_rate(i2s->clk_i2s, freq);
 		break;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 202/346] dm ioctl: fix error return code in target_message
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (200 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 4.19 201/346] ASoC: jz4740-i2s: add missed checks for clk_get() Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 4.19 203/346] clocksource/drivers/arm_arch_timer: Correct fault programming of CNTKCTL_EL1.EVNTI Greg Kroah-Hartman
                   ` (146 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Qinglang Miao,
	Mike Snitzer, Sasha Levin

From: Qinglang Miao <miaoqinglang@huawei.com>

[ Upstream commit 4d7659bfbe277a43399a4a2d90fca141e70f29e1 ]

Fix to return a negative error code from the error handling
case instead of 0, as done elsewhere in this function.

Fixes: 2ca4c92f58f9 ("dm ioctl: prevent empty message")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/md/dm-ioctl.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c
index f666778ad2372..439277f48ff8b 100644
--- a/drivers/md/dm-ioctl.c
+++ b/drivers/md/dm-ioctl.c
@@ -1575,6 +1575,7 @@ static int target_message(struct file *filp, struct dm_ioctl *param, size_t para
 
 	if (!argc) {
 		DMWARN("Empty message received.");
+		r = -EINVAL;
 		goto out_argv;
 	}
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 203/346] clocksource/drivers/arm_arch_timer: Correct fault programming of CNTKCTL_EL1.EVNTI
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (201 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 4.19 202/346] dm ioctl: fix error return code in target_message Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 4.19 204/346] cpufreq: highbank: Add missing MODULE_DEVICE_TABLE Greg Kroah-Hartman
                   ` (145 subsequent siblings)
  348 siblings, 0 replies; 359+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Marc Zyngier, Keqian Zhu,
	Daniel Lezcano, Sasha Levin

From: Keqian Zhu <zhukeqian1@huawei.com>

[ Upstream commit 8b7770b877d187bfdae1eaf587bd2b792479a31c ]

ARM virtual counter supports event stream, it can only trigger an event
when the trigger bit (the value of CNTKCTL_EL1.EVNTI) of CNTVCT_EL0 changes,
so the actual period of event stream is 2^(cntkctl_evnti + 1). For example,
when the trigger bit is 0, then virtual counter trigger an event for every
two cycles.

While we're at it, rework the way we compute the trigger bit position
by making it more obvious that when bits [n:n-1] are both set (with n
being the most significant bit), we pick bit (n + 1).

Fixes: 037f637767a8 ("drivers: clocksource: add support for ARM architected timer event stream")
Suggested-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Keqian Zhu <zhukeqian1@huawei.com>
Acked-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Link: https://lore.kernel.org/r/20201204073126.6920-3-zhukeqian1@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clocksource/arm_arch_timer.c | 23 ++++++++++++++++-------
 1 file changed, 16 insertions(+), 7 deletions(-)

diff --git a/drivers/clocksource/arm_arch_timer.c b/drivers/clocksource/arm_arch_timer.c
index 0445ad7e559e5..e67ab217eef41 100644
--- a/drivers/clocksource/arm_arch_timer.c
+++ b/drivers/clocksource/arm_arch_timer.c
@@ -827,15 +827,24 @@ static void arch_timer_evtstrm_enable(int divider)
 
 static void arch_timer_configure_evtstream(void)
 {
-	int evt_stream_div, pos;
+	int evt_stream_div, lsb;
+
+	/*
+	 * As the event stream can at most be generated at half the frequency
+	 * of the counter, use half the frequency when computing the divider.
+	 */
+	evt_stream_div = arch_timer_rate / ARCH_TIMER_EVT_STREAM_FREQ / 2;
+
+	/*
+	 * Find the closest power of two to the divisor. If the adjacent bit
+	 * of lsb (last set bit, starts from 0) is set, then we use (lsb + 1).
+	 */
+	lsb = fls(evt_stream_div) - 1;
+	if (lsb > 0 && (evt_stream_div & BIT(lsb - 1)))
+		lsb++;
 
-	/* Find the closest power of two to the divisor */
-	evt_stream_div = arch_timer_rate / ARCH_TIMER_EVT_STREAM_FREQ;
-	pos = fls(evt_stream_div);
-	if (pos > 1 && !(evt_stream_div & (1 << (pos - 2))))
-		pos--;
 	/* enable event stream */
-	arch_timer_evtstrm_enable(min(pos, 15));
+	arch_timer_evtstrm_enable(max(0, min(lsb, 15)));
 }
 
 static void arch_counter_set_user_access(void)
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 359+ messages in thread

* [PATCH 4.19 204/346] cpufreq: highbank: Add missing MODULE_DEVICE_TABLE
  2020-12-28 12:45 [PATCH 4.19 000/346] 4.19.164-rc1 review Greg Kroah-Hartman
                   ` (202 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 4.19 203/346] clocksource/drivers/arm_arch_timer: Correct fault programming of CNTKCTL_EL1.EVNTI Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 4.19 205/346] cpufreq: mediatek: " Greg Kroah-Hartman
                   ` (