All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH 5.4 000/453] 5.4.86-rc1 review
@ 2020-12-28 12:43 Greg Kroah-Hartman
  2020-12-28 12:43 ` [PATCH 5.4 001/453] ARM: dts: sun7i: bananapi: Enable RGMII RX/TX delay on Ethernet PHY Greg Kroah-Hartman
                   ` (455 more replies)
  0 siblings, 456 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, torvalds, akpm, linux, shuah, patches,
	lkft-triage, pavel, stable

This is the start of the stable review cycle for the 5.4.86 release.
There are 453 patches in this series, all will be posted as a response
to this one.  If anyone has any issues with these being applied, please
let me know.

Responses should be made by Wed, 30 Dec 2020 12:48:23 +0000.
Anything received after that time might be too late.

The whole patch series can be found in one patch at:
	https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.86-rc1.gz
or in the git tree and branch at:
	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.4.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Linux 5.4.86-rc1

Steven Rostedt (VMware) <rostedt@goodmis.org>
    Revert: "ring-buffer: Remove HAVE_64BIT_ALIGNED_ACCESS"

Nikita Shubin <nikita.shubin@maquefel.me>
    rtc: ep93xx: Fix NULL pointer dereference in ep93xx_rtc_read_time

DingHua Ma <dinghua.ma.sz@gmail.com>
    regulator: axp20x: Fix DLDO2 voltage control register mask for AXP22x

Jubin Zhong <zhongjubin@huawei.com>
    PCI: Fix pci_slot_release() NULL pointer dereference

Carlos Garnacho <carlosg@gnome.org>
    platform/x86: intel-vbtn: Allow switch events on Acer Switch Alpha 12

Dan Williams <dan.j.williams@intel.com>
    libnvdimm/namespace: Fix reaping of invalidated block-window-namespace labels

SeongJae Park <sjpark@amazon.de>
    xenbus/xenbus_backend: Disallow pending watch messages

SeongJae Park <sjpark@amazon.de>
    xen/xenbus: Count pending messages for each watch

SeongJae Park <sjpark@amazon.de>
    xen/xenbus/xen_bus_type: Support will_handle watch callback

SeongJae Park <sjpark@amazon.de>
    xen/xenbus: Add 'will_handle' callback support in xenbus_watch_path()

SeongJae Park <sjpark@amazon.de>
    xen/xenbus: Allow watches discard events before queueing

Pawel Wieczorkiewicz <wipawel@amazon.de>
    xen-blkback: set ring->xenblkd to NULL after kthread_stop()

Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
    dma-buf/dma-resv: Respect num_fences when initializing the shared fence list.

Wang Hai <wanghai38@huawei.com>
    device-dax/core: Fix memory leak when rmmod dax.ko

Nicolin Chen <nicoleotsuka@gmail.com>
    clk: tegra: Do not return 0 on failure

Terry Zhou <bjzhou@marvell.com>
    clk: mvebu: a3700: fix the XTAL MODE pin to MPP1_9

Paul Cercueil <paul@crapouillou.net>
    clk: ingenic: Fix divider calculation with div tables

Yangtao Li <frank@allwinnertech.com>
    pinctrl: sunxi: Always call chained_irq_{enter, exit} in sunxi_pinctrl_irq_handler

Zhao Heming <heming.zhao@suse.com>
    md/cluster: fix deadlock when node is doing resync job

Zhao Heming <heming.zhao@suse.com>
    md/cluster: block reshape with remote resync job

Jonathan Cameron <Jonathan.Cameron@huawei.com>
    iio:adc:ti-ads124s08: Fix alignment and data leak issues.

Jonathan Cameron <Jonathan.Cameron@huawei.com>
    iio:adc:ti-ads124s08: Fix buffer being too long.

Jonathan Cameron <Jonathan.Cameron@huawei.com>
    iio:imu:bmi160: Fix too large a buffer.

Jonathan Cameron <Jonathan.Cameron@huawei.com>
    iio:pressure:mpl3115: Force alignment of buffer

Jonathan Cameron <Jonathan.Cameron@huawei.com>
    iio:magnetometer:mag3110: Fix alignment and data leak issues.

Jonathan Cameron <Jonathan.Cameron@huawei.com>
    iio:light:st_uvis25: Fix timestamp alignment and prevent data leak.

Jonathan Cameron <Jonathan.Cameron@huawei.com>
    iio:light:rpr0521: Fix timestamp alignment and prevent data leak.

Qinglang Miao <miaoqinglang@huawei.com>
    iio: adc: rockchip_saradc: fix missing clk_disable_unprepare() on error in rockchip_saradc_resume

Nuno Sá <nuno.sa@analog.com>
    iio: buffer: Fix demux update

James Smart <james.smart@broadcom.com>
    scsi: lpfc: Re-fix use after free in lpfc_rq_buf_free()

James Smart <james.smart@broadcom.com>
    scsi: lpfc: Fix invalid sleeping context in lpfc_sli4_nvmet_alloc()

Arun Easi <aeasi@marvell.com>
    scsi: qla2xxx: Fix crash during driver load on big endian machines

Sergei Antonov <saproj@gmail.com>
    mtd: rawnand: meson: fix meson_nfc_dma_buffer_release() arguments

Praveenkumar I <ipkumar@codeaurora.org>
    mtd: rawnand: qcom: Fix DMA sync on FLASH_STATUS register read

Sven Eckelmann <sven@narfation.org>
    mtd: parser: cmdline: Fix parsing of part-names with colons

Miquel Raynal <miquel.raynal@bootlin.com>
    mtd: spinand: Fix OOB read

Evan Green <evgreen@chromium.org>
    soc: qcom: smp2p: Safely acquire spinlock without IRQs

Tudor Ambarus <tudor.ambarus@microchip.com>
    spi: atmel-quadspi: Fix AHB memory accesses

Lukas Wunner <lukas@wunner.de>
    spi: atmel-quadspi: Disable clock in probe error path

Lukas Wunner <lukas@wunner.de>
    spi: mt7621: Don't leak SPI master in probe error path

Lukas Wunner <lukas@wunner.de>
    spi: mt7621: Disable clock in probe error path

Lukas Wunner <lukas@wunner.de>
    spi: synquacer: Disable clock in probe error path

Lukas Wunner <lukas@wunner.de>
    spi: st-ssc4: Fix unbalanced pm_runtime_disable() in probe error path

Lukas Wunner <lukas@wunner.de>
    spi: sc18is602: Don't leak SPI master in probe error path

Lukas Wunner <lukas@wunner.de>
    spi: rb4xx: Don't leak SPI master in probe error path

Lukas Wunner <lukas@wunner.de>
    spi: pic32: Don't leak DMA channels in probe error path

Lukas Wunner <lukas@wunner.de>
    spi: mxic: Don't leak SPI master in probe error path

Lukas Wunner <lukas@wunner.de>
    spi: gpio: Don't leak SPI master in probe error path

Rasmus Villemoes <rasmus.villemoes@prevas.dk>
    spi: fsl: fix use of spisel_boot signal on MPC8309

Lukas Wunner <lukas@wunner.de>
    spi: davinci: Fix use-after-free on unbind

Lukas Wunner <lukas@wunner.de>
    spi: atmel-quadspi: Fix use-after-free on unbind

Lukas Wunner <lukas@wunner.de>
    spi: spi-sh: Fix use-after-free on unbind

Lukas Wunner <lukas@wunner.de>
    spi: pxa2xx: Fix use-after-free on unbind

Chris Wilson <chris@chris-wilson.co.uk>
    drm/i915: Fix mismatch between misplaced vma check and vma insert

Zwane Mwaikambo <zwane@yosper.io>
    drm/dp_aux_dev: check aux_dev before use in drm_dp_aux_dev_get_by_minor()

Stylon Wang <stylon.wang@amd.com>
    drm/amd/display: Fix memory leaks in S3 resume

Bas Nieuwenhuizen <bas@basnieuwenhuizen.nl>
    drm/amd/display: Honor the offset for plane 0.

Dave Kleikamp <dave.kleikamp@oracle.com>
    jfs: Fix array index bounds check in dbAdjTree

lizhe <lizhe67@huawei.com>
    jffs2: Fix ignoring mounting options problem during remounting

Zhe Li <lizhe67@huawei.com>
    jffs2: Fix GC exit abnormally

Richard Weinberger <richard@nod.at>
    ubifs: wbuf: Don't leak kernel memory to flash

Steve French <stfrench@microsoft.com>
    SMB3: avoid confusing warning message on mount to Azure

Luis Henriques <lhenriques@suse.de>
    ceph: fix race in concurrent __ceph_remove_cap invocations

Anton Ivanov <anton.ivanov@cambridgegreys.com>
    um: Remove use of asprinf in umid.c

Roberto Sassu <roberto.sassu@huawei.com>
    ima: Don't modify file descriptor mode on the fly

David Hildenbrand <david@redhat.com>
    powerpc/powernv/memtrace: Fix crashing the kernel when enabling concurrently

David Hildenbrand <david@redhat.com>
    powerpc/powernv/memtrace: Don't leak kernel memory to user space

Alexey Kardashevskiy <aik@ozlabs.ru>
    powerpc/powernv/npu: Do not attempt NPU2 setup on POWER8NVL NPU

Christophe Leroy <christophe.leroy@csgroup.eu>
    powerpc/mm: Fix verification of MMU_FTR_TYPE_44x

Christophe Leroy <christophe.leroy@csgroup.eu>
    powerpc/8xx: Fix early debug when SMC1 is relocated

Christophe Leroy <christophe.leroy@csgroup.eu>
    powerpc/xmon: Change printk() to pr_cont()

Christophe Leroy <christophe.leroy@csgroup.eu>
    powerpc/feature: Add CPU_FTR_NOEXECUTE to G2_LE

Tyrel Datwyler <tyreld@linux.ibm.com>
    powerpc/rtas: Fix typo of ibm,open-errinjct in RTAS filter

Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
    powerpc: Fix incorrect stw{, ux, u, x} instructions in __set_pte_at

Chuck Lever <chuck.lever@oracle.com>
    xprtrdma: Fix XDRBUF_SPARSE_PAGES support

Nicolas Ferre <nicolas.ferre@microchip.com>
    ARM: dts: at91: sama5d2: fix CAN message ram offset and size

H. Nikolaus Schaller <hns@goldelico.com>
    ARM: dts: pandaboard: fix pinmux for gpio user button of Pandaboard ES

Marc Zyngier <maz@kernel.org>
    KVM: arm64: Introduce handling of AArch32 TTBCR2 traps

Jan Kara <jack@suse.cz>
    ext4: fix deadlock with fs freezing and EA inodes

Chunguang Xu <brookxu@tencent.com>
    ext4: fix a memory leak of ext4_free_data

Qu Wenruo <wqu@suse.com>
    btrfs: trim: fix underflow in trim length to prevent access beyond device boundary

Josef Bacik <josef@toxicpanda.com>
    btrfs: do not shorten unpin len for caching block groups

Johan Hovold <johan@kernel.org>
    USB: serial: keyspan_pda: fix write unthrottling

Johan Hovold <johan@kernel.org>
    USB: serial: keyspan_pda: fix tx-unthrottle use-after-free

Johan Hovold <johan@kernel.org>
    USB: serial: keyspan_pda: fix write-wakeup use-after-free

Johan Hovold <johan@kernel.org>
    USB: serial: keyspan_pda: fix stalled writes

Johan Hovold <johan@kernel.org>
    USB: serial: keyspan_pda: fix write deadlock

Johan Hovold <johan@kernel.org>
    USB: serial: keyspan_pda: fix dropped unthrottle interrupts

Johan Hovold <johan@kernel.org>
    USB: serial: digi_acceleport: fix write-wakeup deadlocks

Johan Hovold <johan@kernel.org>
    USB: serial: mos7720: fix parallel-port state restore

Daniel Jordan <daniel.m.jordan@oracle.com>
    cpuset: fix race between hotplug work and later CPU offline

Borislav Petkov <bp@suse.de>
    EDAC/amd64: Fix PCI component registration

Qiuxu Zhuo <qiuxu.zhuo@intel.com>
    EDAC/i10nm: Use readl() to access MMIO registers

Ard Biesheuvel <ardb@kernel.org>
    crypto: arm/aes-ce - work around Cortex-A57/A72 silion errata

Ard Biesheuvel <ardb@kernel.org>
    crypto: ecdh - avoid unaligned accesses in ecdh_set_secret()

Athira Rajeev <atrajeev@linux.vnet.ibm.com>
    powerpc/perf: Exclude kernel samples while counting events in user space.

Kan Liang <kan.liang@linux.intel.com>
    perf/x86/intel: Fix rtm_abort_event encoding on Ice Lake

Kan Liang <kan.liang@linux.intel.com>
    perf/x86/intel: Add event constraint for CYCLE_ACTIVITY.STALLS_MEM_ANY

Ian Abbott <abbotti@mev.co.uk>
    staging: comedi: mf6x4: Fix AI end-of-conversion detection

Takashi Iwai <tiwai@suse.de>
    ASoC: cx2072x: Fix doubly definitions of Playback and Capture streams

Todd Kjos <tkjos@google.com>
    binder: add flag to clear buffer on txn complete

Stefan Haberland <sth@linux.ibm.com>
    s390/dasd: fix list corruption of lcu list

Stefan Haberland <sth@linux.ibm.com>
    s390/dasd: fix list corruption of pavgroup group list

Stefan Haberland <sth@linux.ibm.com>
    s390/dasd: prevent inconsistent LCU device data

Stefan Haberland <sth@linux.ibm.com>
    s390/dasd: fix hanging device offline processing

Philipp Rudo <prudo@linux.ibm.com>
    s390/kexec_file: fix diag308 subcode when loading crash kernel

Sven Schnelle <svens@linux.ibm.com>
    s390/smp: perform initial CPU reset also for SMT siblings

Robin Gong <yibin.gong@nxp.com>
    ALSA: core: memalloc: add page alignment for iram

Takashi Iwai <tiwai@suse.de>
    ALSA: usb-audio: Disable sample read check if firmware doesn't give back

Amadej Kastelic <amadejkastelic7@gmail.com>
    ALSA: usb-audio: Add VID to support native DSD reproduction on FiiO devices

Chris Chiu <chiu@endlessos.org>
    ALSA: hda/realtek: Apply jack fixup for Quanta NL3

Takashi Iwai <tiwai@suse.de>
    ALSA: hda/realtek: Add quirk for MSI-GP73

Chris Chiu <chiu@endlessos.org>
    ALSA/hda: apply jack fixup for the Acer Veriton N4640G/N6640G/N2510G

Takashi Iwai <tiwai@suse.de>
    ALSA: pcm: oss: Fix a few more UBSAN fixes

Kailang Yang <kailang@realtek.com>
    ALSA: hda/realtek - Add supported for more Lenovo ALC285 Headset Button

Chris Chiu <chiu@endlessos.org>
    ALSA: hda/realtek - Enable headset mic of ASUS Q524UQK with ALC255

Chris Chiu <chiu@endlessos.org>
    ALSA: hda/realtek - Enable headset mic of ASUS X430UN with ALC256

Hui Wang <hui.wang@canonical.com>
    ALSA: hda/realtek: make bass spk volume adjustable on a yoga laptop

Connor McAdams <conmanx360@gmail.com>
    ALSA: hda/ca0132 - Fix AE-5 rear headphone pincfg.

Takashi Iwai <tiwai@suse.de>
    ALSA: hda: Fix regressions on clear and reconfig sysfs

Hui Wang <hui.wang@canonical.com>
    ACPI: PNP: compare the string length in the matching_id()

Daniel Scally <djrscally@gmail.com>
    Revert "ACPI / resources: Use AE_CTRL_TERMINATE to terminate resources walks"

Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    PM: ACPI: PCI: Drop acpi_pm_set_bridge_wakeup()

Connor McAdams <conmanx360@gmail.com>
    ALSA: hda/ca0132 - Change Input Source enum strings.

Arnd Bergmann <arnd@arndb.de>
    Input: cyapa_gen6 - fix out-of-bounds stack access

Sakari Ailus <sakari.ailus@linux.intel.com>
    media: ipu3-cio2: Make the field on subdev format V4L2_FIELD_NONE

Sakari Ailus <sakari.ailus@linux.intel.com>
    media: ipu3-cio2: Validate mbus format in setting subdev format

Sakari Ailus <sakari.ailus@linux.intel.com>
    media: ipu3-cio2: Serialise access to pad format

Sakari Ailus <sakari.ailus@linux.intel.com>
    media: ipu3-cio2: Return actual subdev format

Sakari Ailus <sakari.ailus@linux.intel.com>
    media: ipu3-cio2: Remove traces of returned buffers

Lukas Wunner <lukas@wunner.de>
    media: netup_unidvb: Don't leak SPI master in probe error path

Sean Young <sean@mess.org>
    media: sunxi-cir: ensure IR is handled when it is continuous

Alan Stern <stern@rowland.harvard.edu>
    media: gspca: Fix memory leak in probe

Alexey Kardashevskiy <aik@ozlabs.ru>
    vfio/pci/nvlink2: Do not attempt NPU2 setup on POWER8NVL NPU

Simon Beginn <linux@simonmicro.de>
    Input: goodix - add upside-down quirk for Teclast X98 Pro tablet

Arnd Bergmann <arnd@arndb.de>
    initramfs: fix clang build failure

Dmitry Torokhov <dmitry.torokhov@gmail.com>
    Input: cros_ec_keyb - send 'scancodes' in addition to key events

Felix Kuehling <Felix.Kuehling@amd.com>
    drm/amdkfd: Fix leak in dmabuf import

Chris Park <Chris.Park@amd.com>
    drm/amd/display: Prevent bandwidth overflow

Dongdong Wang <wangdongdong.6@bytedance.com>
    lwt: Disable BH too in run_lwt_bpf()

Serge Hallyn <shallyn@cisco.com>
    fix namespaced fscaps when !CONFIG_SECURITY

Sara Sharon <sara.sharon@intel.com>
    cfg80211: initialize rekey_data

Paul Kocialkowski <contact@paulk.fr>
    ARM: sunxi: Add machine match for the Allwinner V3 SoC

Arnaldo Carvalho de Melo <acme@redhat.com>
    perf probe: Fix memory leak when synthesizing SDT probes

Masahiro Yamada <masahiroy@kernel.org>
    kconfig: fix return value of do_error_if()

Jernej Skrabec <jernej.skrabec@siol.net>
    clk: sunxi-ng: Make sure divider tables have sentinel

Christophe JAILLET <christophe.jaillet@wanadoo.fr>
    clk: s2mps11: Fix a resource leak in error handling paths in the probe function

Alexandre Belloni <alexandre.belloni@bootlin.com>
    clk: at91: sam9x60: remove atmel,osc-bypass support

Dan Carpenter <dan.carpenter@oracle.com>
    virtio_ring: Fix two use after free bugs

Dan Carpenter <dan.carpenter@oracle.com>
    virtio_net: Fix error code in probe()

Dan Carpenter <dan.carpenter@oracle.com>
    virtio_ring: Cut and paste bugs in vring_create_virtqueue_packed()

Dan Carpenter <dan.carpenter@oracle.com>
    qlcnic: Fix error code in probe

Zheng Zengkai <zhengzengkai@huawei.com>
    perf record: Fix memory leak when using '--user-regs=?' to list registers

Lokesh Vutla <lokeshvutla@ti.com>
    pwm: lp3943: Dynamically allocate PWM chip base

Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
    pwm: zx: Add missing cleanup in error path

Zhang Qilong <zhangqilong3@huawei.com>
    clk: ti: Fix memleak in ti_fapll_synth_setup

Arnd Bergmann <arnd@arndb.de>
    watchdog: coh901327: add COMMON_CLK dependency

Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
    watchdog: qcom: Avoid context switch in restart handler

Zhang Qilong <zhangqilong3@huawei.com>
    libnvdimm/label: Return -ENXIO for no slot in __blk_label_update

Vincent Stehlé <vincent.stehle@laposte.net>
    net: korina: fix return value

Christophe JAILLET <christophe.jaillet@wanadoo.fr>
    net: allwinner: Fix some resources leak in the error handling path of the probe and in the remove function

Christophe JAILLET <christophe.jaillet@wanadoo.fr>
    net: bcmgenet: Fix a resource leak in an error handling path in the probe functin

Sven Van Asbroeck <thesven73@gmail.com>
    lan743x: fix rx_napi_poll/interrupt ping-pong

Dwaipayan Ray <dwaipayanray1@gmail.com>
    checkpatch: fix unescaped left brace

Johannes Weiner <hannes@cmpxchg.org>
    mm: don't wake kswapd prematurely when watermark boosting is disabled

Matthew Wilcox (Oracle) <willy@infradead.org>
    sparc: fix handling of page table constructor failure

Vincent Stehlé <vincent.stehle@laposte.net>
    powerpc/ps3: use dma_mapping_error()

Bongsu Jeon <bongsu.jeon@samsung.com>
    nfc: s3fwrn5: Release the nfc firmware

Leon Romanovsky <leonro@nvidia.com>
    RDMA/cma: Don't overwrite sgid_attr after device is released

Dan Aloni <dan@kernelim.com>
    sunrpc: fix xs_read_xdr_buf for partial pages receive

Anton Ivanov <anton.ivanov@cambridgegreys.com>
    um: chan_xterm: Fix fd leak

Anton Ivanov <anton.ivanov@cambridgegreys.com>
    um: tty: Fix handling of close in tty lines

Anton Ivanov <anton.ivanov@cambridgegreys.com>
    um: Monitor error events in IRQ controller

Wang ShaoBo <bobo.shaobowang@huawei.com>
    ubifs: Fix error return code in ubifs_init_authentication()

Wang Wensheng <wangwensheng4@huawei.com>
    watchdog: Fix potential dereferencing of null pointer

Lingling Xu <ling_ling.xu@unisoc.com>
    watchdog: sprd: check busy bit before new loading rather than after that

Lingling Xu <ling_ling.xu@unisoc.com>
    watchdog: sprd: remove watchdog disable from resume fail path

Guenter Roeck <linux@roeck-us.net>
    watchdog: sirfsoc: Add missing dependency on HAS_IOMEM

Guenter Roeck <linux@roeck-us.net>
    watchdog: armada_37xx: Add missing dependency on HAS_IOMEM

Marc Zyngier <maz@kernel.org>
    irqchip/alpine-msi: Fix freeing of interrupts on allocation error path

Dan Carpenter <dan.carpenter@oracle.com>
    ASoC: wm_adsp: remove "ctl" from list on error in wm_adsp_create_control()

Johannes Berg <johannes.berg@intel.com>
    mac80211: don't set set TDLS STA bandwidth wider than possible

Arnd Bergmann <arnd@arndb.de>
    crypto: atmel-i2c - select CONFIG_BITREVERSE

Marek Szyprowski <m.szyprowski@samsung.com>
    extcon: max77693: Fix modalias string

Han Xu <han.xu@nxp.com>
    mtd: rawnand: gpmi: Fix the random DMA timeout issue

Dan Carpenter <dan.carpenter@oracle.com>
    mtd: rawnand: meson: Fix a resource leak in init

Zhang Qilong <zhangqilong3@huawei.com>
    mtd: rawnand: gpmi: fix reference count leak in gpmi ops

Dmitry Osipenko <digetx@gmail.com>
    clk: tegra: Fix duplicated SE clock entry

Zhang Changzhong <zhangchangzhong@huawei.com>
    remoteproc: qcom: Fix potential NULL dereference in adsp_init_mmio()

Zhang Qilong <zhangqilong3@huawei.com>
    remoteproc: qcom: fix reference leak in adsp_start

Zhang Qilong <zhangqilong3@huawei.com>
    remoteproc: q6v5-mss: fix error handling in q6v5_pds_enable

Jack Morgenstein <jackm@dev.mellanox.co.il>
    RDMA/core: Do not indicate device ready when device enablement fails

Sean Nyekjaer <sean@geanix.com>
    can: m_can: m_can_config_endisable(): remove double clearing of clock stop request bit

Huang Jianan <huangjianan@oppo.com>
    erofs: avoid using generic_block_bmap

Johannes Berg <johannes.berg@intel.com>
    iwlwifi: mvm: hook up missing RX handlers

Qinglang Miao <miaoqinglang@huawei.com>
    s390/cio: fix use-after-free in ccw_device_destroy_console

Zhang Changzhong <zhangchangzhong@huawei.com>
    bus: fsl-mc: fix error return code in fsl_mc_object_allocate()

Stephen Boyd <swboyd@chromium.org>
    platform/chrome: cros_ec_spi: Don't overwrite spi::mode

Masami Hiramatsu <mhiramat@kernel.org>
    x86/kprobes: Restore BTF if the single-stepping is cancelled

Cheng Lin <cheng.lin130@zte.com.cn>
    nfs_common: need lock during iterate through the list

kazuo ito <kzpn200@gmail.com>
    nfsd: Fix message level for normal termination

Yang Yingliang <yangyingliang@huawei.com>
    speakup: fix uninitialized flush_lock

Zhang Qilong <zhangqilong3@huawei.com>
    usb: oxu210hp-hcd: Fix memory leak in oxu_create

Zhang Qilong <zhangqilong3@huawei.com>
    usb: ehci-omap: Fix PM disable depth umbalance in ehci_hcd_omap_probe

Christophe Leroy <christophe.leroy@csgroup.eu>
    powerpc/mm: sanity_check_fault() should work for all, not only BOOK3S

Chuhong Yuan <hslester96@gmail.com>
    ASoC: amd: change clk_get() to devm_clk_get() and add missed checks

Colin Ian King <colin.king@canonical.com>
    drm/mediatek: avoid dereferencing a null hdmi_phy on an error message

Nathan Lynch <nathanl@linux.ibm.com>
    powerpc/pseries/hibernation: remove redundant cacheinfo update

Nathan Lynch <nathanl@linux.ibm.com>
    powerpc/pseries/hibernation: drop pseries_suspend_begin() from suspend ops

Vadim Pasternak <vadimp@nvidia.com>
    platform/x86: mlx-platform: Fix item counter assignment for MSN2700, MSN24xx systems

Zhang Changzhong <zhangchangzhong@huawei.com>
    scsi: fnic: Fix error return code in fnic_probe()

Arnd Bergmann <arnd@arndb.de>
    seq_buf: Avoid type mismatch for seq_buf_init

Zhang Qilong <zhangqilong3@huawei.com>
    scsi: pm80xx: Fix error return in pm8001_pci_probe()

Qinglang Miao <miaoqinglang@huawei.com>
    scsi: qedi: Fix missing destroy_workqueue() on error in __qedi_probe

Stefan Agner <stefan@agner.ch>
    arm64: dts: meson: g12a: x96-max: fix PHY deassert timing requirements

Stefan Agner <stefan@agner.ch>
    ARM: dts: meson: fix PHY deassert timing requirements

Stefan Agner <stefan@agner.ch>
    arm64: dts: meson: fix PHY deassert timing requirements

Jing Xiangfeng <jingxiangfeng@huawei.com>
    Bluetooth: btmtksdio: Add the missed release_firmware() in mtk_setup_firmware()

Jing Xiangfeng <jingxiangfeng@huawei.com>
    Bluetooth: btusb: Add the missed release_firmware() in btusb_mtk_setup_firmware()

Pali Rohár <pali@kernel.org>
    cpufreq: scpi: Add missing MODULE_ALIAS

Pali Rohár <pali@kernel.org>
    cpufreq: loongson1: Add missing MODULE_ALIAS

Pali Rohár <pali@kernel.org>
    cpufreq: sun50i: Add missing MODULE_DEVICE_TABLE

Pali Rohár <pali@kernel.org>
    cpufreq: st: Add missing MODULE_DEVICE_TABLE

Pali Rohár <pali@kernel.org>
    cpufreq: qcom: Add missing MODULE_DEVICE_TABLE

Pali Rohár <pali@kernel.org>
    cpufreq: mediatek: Add missing MODULE_DEVICE_TABLE

Pali Rohár <pali@kernel.org>
    cpufreq: highbank: Add missing MODULE_DEVICE_TABLE

Pali Rohár <pali@kernel.org>
    cpufreq: ap806: Add missing MODULE_DEVICE_TABLE

Keqian Zhu <zhukeqian1@huawei.com>
    clocksource/drivers/arm_arch_timer: Correct fault programming of CNTKCTL_EL1.EVNTI

Keqian Zhu <zhukeqian1@huawei.com>
    clocksource/drivers/arm_arch_timer: Use stable count reader in erratum sne

Wang Li <wangli74@huawei.com>
    phy: renesas: rcar-gen3-usb2: disable runtime pm in case of failure

Qinglang Miao <miaoqinglang@huawei.com>
    dm ioctl: fix error return code in target_message

Chuhong Yuan <hslester96@gmail.com>
    ASoC: jz4740-i2s: add missed checks for clk_get()

Leon Romanovsky <leonro@nvidia.com>
    net/mlx5: Properly convey driver version to firmware

Alexander Sverdlin <alexander.sverdlin@nokia.com>
    MIPS: Don't round up kernel sections size for memblock_add()

Jing Xiangfeng <jingxiangfeng@huawei.com>
    memstick: r592: Fix error return in r592_probe()

Chen-Yu Tsai <wens@csie.org>
    arm64: dts: rockchip: Fix UART pull-ups on rk3328

Yu Kuai <yukuai3@huawei.com>
    pinctrl: falcon: add missing put_device() call in pinctrl_falcon_probe()

Andrii Nakryiko <andrii@kernel.org>
    bpf: Fix bpf_put_raw_tracepoint()'s use of __module_address()

Claudiu Beznea <claudiu.beznea@microchip.com>
    ARM: dts: at91: sama5d2: map securam as device

Lars-Peter Clausen <lars@metafoo.de>
    iio: hrtimer-trigger: Mark hrtimer to expire in hard interrupt context

Yu Kuai <yukuai3@huawei.com>
    clocksource/drivers/cadence_ttc: Fix memory leak in ttc_setup_clockevent()

Yang Yingliang <yangyingliang@huawei.com>
    clocksource/drivers/orion: Add missing clk_disable_unprepare() on error path

Jordan Niethe <jniethe5@gmail.com>
    powerpc/64: Fix an EMIT_BUG_ENTRY in head_64.S

Athira Rajeev <atrajeev@linux.vnet.ibm.com>
    powerpc/perf: Fix crash with is_sier_available when pmu is not set

Dan Carpenter <dan.carpenter@oracle.com>
    media: saa7146: fix array overflow in vidioc_s_audio()

Zhang Qilong <zhangqilong3@huawei.com>
    hwmon: (ina3221) Fix PM usage counter unbalance in ina3221_write_enable

Jason Gunthorpe <jgg@nvidia.com>
    vfio-pci: Use io_remap_pfn_range() for PCI IO memory

Mickaël Salaün <mic@linux.microsoft.com>
    selftests/seccomp: Update kernel config

NeilBrown <neilb@suse.de>
    NFS: switch nfsiod to be an UNBOUND workqueue.

Calum Mackay <calum.mackay@oracle.com>
    lockd: don't use interval-based rebinding over TCP

Fedor Tokarev <ftokarev@gmail.com>
    net: sunrpc: Fix 'snprintf' return value check in 'do_xprt_debugfs'

Trond Myklebust <trond.myklebust@hammerspace.com>
    NFSv4: Fix the alignment of page data in the getdeviceinfo reply

Trond Myklebust <trond.myklebust@hammerspace.com>
    SUNRPC: xprt_load_transport() needs to support the netid "rdma6"

Olga Kornievskaia <kolga@netapp.com>
    NFSv4.2: condition READDIR's mask for security label based on LSM state

Trond Myklebust <trond.myklebust@hammerspace.com>
    SUNRPC: rpc_wake_up() should wake up tasks in the correct order

Christophe JAILLET <christophe.jaillet@wanadoo.fr>
    ath10k: Release some resources in an error handling path

Christophe JAILLET <christophe.jaillet@wanadoo.fr>
    ath10k: Fix an error handling path

Rakesh Pillai <pillair@codeaurora.org>
    ath10k: Fix the parsing error in service available event

Qinglang Miao <miaoqinglang@huawei.com>
    platform/x86: dell-smbios-base: Fix error return code in dell_smbios_init

Alexandre Belloni <alexandre.belloni@bootlin.com>
    ARM: dts: at91: at91sam9rl: fix ADC triggers

Yu Kuai <yukuai3@huawei.com>
    soc: amlogic: canvas: add missing put_device() call in meson_canvas_get()

Dongjin Kim <tobetter@gmail.com>
    arm64: dts: meson-sm1: fix typo in opp table

Artem Lapkin <art@khadas.com>
    arm64: dts: meson: fix spi-max-frequency on Khadas VIM2

Bharat Gooty <bharat.gooty@broadcom.com>
    PCI: iproc: Fix out-of-bound array accesses

Colin Ian King <colin.king@canonical.com>
    PCI: Fix overflow in command-line resource alignment requests

Bjorn Helgaas <bhelgaas@google.com>
    PCI: Bounds-check command-line resource alignment requests

Bjorn Andersson <bjorn.andersson@linaro.org>
    arm64: dts: qcom: c630: Polish i2c-hid devices

Michael Walle <michael@walle.cc>
    arm64: dts: ls1028a: fix ENETC PTP clock input

Marc Zyngier <maz@kernel.org>
    genirq/irqdomain: Don't try to free an interrupt that has no mapping

Zhang Qilong <zhangqilong3@huawei.com>
    power: supply: bq24190_charger: fix reference leak

Hans de Goede <hdegoede@redhat.com>
    power: supply: axp288_charger: Fix HP Pavilion x2 10 DMI matching

Chen-Yu Tsai <wens@csie.org>
    arm64: dts: rockchip: Set dr_mode to "host" for OTG on rk3328-roc-cc

Marek Behún <kabel@kernel.org>
    arm64: dts: armada-3720-turris-mox: update ethernet-phy handle name

Chris Packham <chris.packham@alliedtelesis.co.nz>
    ARM: dts: Remove non-existent i2c1 from 98dx3236

Jing Xiangfeng <jingxiangfeng@huawei.com>
    HSI: omap_ssi: Don't jump to free ID in ssi_add_controller()

Bjorn Andersson <bjorn.andersson@linaro.org>
    slimbus: qcom-ngd-ctrl: Avoid sending power requests without QMI

Dan Carpenter <dan.carpenter@oracle.com>
    media: max2175: fix max2175_set_csm_mode() error code

Qinglang Miao <miaoqinglang@huawei.com>
    mips: cdmm: fix use-after-free in mips_cdmm_bus_discover

Daniel Gomez <daniel@qtec.com>
    media: imx214: Fix stop streaming

Daniel T. Lee <danieltimlee@gmail.com>
    samples: bpf: Fix lwt_len_hist reusing previous BPF map

Vadim Pasternak <vadimp@nvidia.com>
    platform/x86: mlx-platform: Remove PSU EEPROM from MSN274x platform configuration

Vadim Pasternak <vadimp@nvidia.com>
    platform/x86: mlx-platform: Remove PSU EEPROM from default platform configuration

Keita Suzuki <keitasuzuki.park@sslab.ics.keio.ac.jp>
    media: siano: fix memory leak of debugfs members in smsdvb_hotplug

Vidya Sagar <vidyas@nvidia.com>
    arm64: tegra: Fix DT binding for IO High Voltage entry

Yu Kuai <yukuai3@huawei.com>
    leds: netxbig: add missing put_device() call in netxbig_leds_get_of_pdata()

Zhihao Cheng <chengzhihao1@huawei.com>
    dmaengine: mv_xor_v2: Fix error return code in mv_xor_v2_probe()

Qinglang Miao <miaoqinglang@huawei.com>
    cw1200: fix missing destroy_workqueue() on error in cw1200_init_common

Zhang Changzhong <zhangchangzhong@huawei.com>
    rsi: fix error return code in rsi_reset_card()

Wang Hai <wanghai38@huawei.com>
    qtnfmac: fix error return code in qtnf_pcie_probe()

Sebastian Andrzej Siewior <bigeasy@linutronix.de>
    orinoco: Move context allocation after processing the skb

Zhihao Cheng <chengzhihao1@huawei.com>
    mmc: pxamci: Fix error return code in pxamci_probe

Cristian Birsan <cristian.birsan@microchip.com>
    ARM: dts: at91: sama5d3_xplained: add pincontrol for USB Host

Cristian Birsan <cristian.birsan@microchip.com>
    ARM: dts: at91: sama5d4_xplained: add pincontrol for USB Host

Qinglang Miao <miaoqinglang@huawei.com>
    memstick: fix a double-free bug in memstick_check

Kamal Heib <kamalheib1@gmail.com>
    RDMA/cxgb4: Validate the number of CQEs

Kevin Hilman <khilman@baylibre.com>
    clk: meson: Kconfig: fix dependency for G12A

Zhang Qilong <zhangqilong3@huawei.com>
    Input: omap4-keypad - fix runtime PM error handling

Zhihao Cheng <chengzhihao1@huawei.com>
    drivers: soc: ti: knav_qmss_queue: Fix error return code in knav_queue_probe

Zhang Qilong <zhangqilong3@huawei.com>
    soc: ti: Fix reference imbalance in knav_dma_probe

Zhang Qilong <zhangqilong3@huawei.com>
    soc: ti: knav_qmss: fix reference leak in knav_queue_probe

Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
    spi: fix resource leak for drivers without .remove callback

Zhang Qilong <zhangqilong3@huawei.com>
    crypto: omap-aes - Fix PM disable depth imbalance in omap_aes_probe

Nathan Chancellor <natechancellor@gmail.com>
    crypto: crypto4xx - Replace bitwise OR with logical OR in crypto4xx_build_pd

Yazen Ghannam <yazen.ghannam@amd.com>
    EDAC/mce_amd: Use struct cpuinfo_x86.cpu_die_id for AMD NodeId

Christophe Leroy <christophe.leroy@csgroup.eu>
    powerpc/feature: Fix CPU_FTRS_ALWAYS by removing CPU_FTRS_GENERIC_32

Ard Biesheuvel <ardb@kernel.org>
    powerpc: Avoid broken GCC __attribute__((optimize))

Björn Töpel <bjorn.topel@gmail.com>
    selftests/bpf: Fix broken riscv build

Zhang Qilong <zhangqilong3@huawei.com>
    spi: mxs: fix reference leak in mxs_spi_probe

Yang Yingliang <yangyingliang@huawei.com>
    usb/max3421: fix return error code in max3421_probe()

Dmitry Torokhov <dmitry.torokhov@gmail.com>
    Input: ads7846 - fix unaligned access on 7845

Oleksij Rempel <linux@rempel-privat.de>
    Input: ads7846 - fix integer overflow on Rt calculation

David Jander <david@protonic.nl>
    Input: ads7846 - fix race that causes missing releases

Yang Yingliang <yangyingliang@huawei.com>
    drm/omap: dmm_tiler: fix return error code in omap_dmm_probe()

Yang Yingliang <yangyingliang@huawei.com>
    video: fbdev: atmel_lcdfb: fix return error code in atmel_lcdfb_of_init()

Qinglang Miao <miaoqinglang@huawei.com>
    media: solo6x10: fix missing snd_card_free in error handling case

Martin Wilck <mwilck@suse.com>
    scsi: core: Fix VPD LUN ID designator priorities

Jerome Brunet <jbrunet@baylibre.com>
    ASoC: meson: fix COMPILE_TEST error

Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
    media: v4l2-fwnode: Return -EINVAL for invalid bus-type

Yu Kuai <yukuai3@huawei.com>
    media: mtk-vcodec: add missing put_device() call in mtk_vcodec_init_enc_pm()

Yu Kuai <yukuai3@huawei.com>
    media: mtk-vcodec: add missing put_device() call in mtk_vcodec_release_dec_pm()

Yu Kuai <yukuai3@huawei.com>
    media: mtk-vcodec: add missing put_device() call in mtk_vcodec_init_dec_pm()

Colin Ian King <colin.king@canonical.com>
    media: tm6000: Fix sizeof() mismatches

Jing Xiangfeng <jingxiangfeng@huawei.com>
    staging: gasket: interrupt: fix the missed eventfd_ctx_put() in gasket_interrupt.c

Zhang Qilong <zhangqilong3@huawei.com>
    staging: greybus: codecs: Fix reference counter leak in error handling

Jack Xu <jack.xu@intel.com>
    crypto: qat - fix status check in qat_hal_put_rel_rd_xfer()

Necip Fazil Yildiran <fazilyildiran@gmail.com>
    MIPS: BCM47XX: fix kconfig dependency bug for BCM47XX_BCMA

Arnd Bergmann <arnd@arndb.de>
    RDMa/mthca: Work around -Wenum-conversion warning

Zhang Qilong <zhangqilong3@huawei.com>
    ASoC: arizona: Fix a wrong free in wm8997_probe

Vincent Bernat <vincent@bernat.ch>
    net: evaluate net.ipv4.conf.all.proxy_arp_pvlan

Vincent Bernat <vincent@bernat.ch>
    net: evaluate net.ipvX.conf.all.ignore_routes_with_linkdown

Zhang Qilong <zhangqilong3@huawei.com>
    spi: sprd: fix reference leak in sprd_spi_remove

Zhang Qilong <zhangqilong3@huawei.com>
    ASoC: wm8998: Fix PM disable depth imbalance on error

Hangbin Liu <liuhangbin@gmail.com>
    selftest/bpf: Add missed ip6ip6 test back

Tsuchiya Yuto <kitakar@gmail.com>
    mwifiex: fix mwifiex_shutdown_sw() causing sw reset failure

Qinglang Miao <miaoqinglang@huawei.com>
    spi: bcm63xx-hsspi: fix missing clk_disable_unprepare() on error in bcm63xx_hsspi_resume

Zhang Qilong <zhangqilong3@huawei.com>
    spi: tegra114: fix reference leak in tegra spi ops

Zhang Qilong <zhangqilong3@huawei.com>
    spi: tegra20-sflash: fix reference leak in tegra_sflash_resume

Zhang Qilong <zhangqilong3@huawei.com>
    spi: tegra20-slink: fix reference leak in slink ops of tegra20

Qinglang Miao <miaoqinglang@huawei.com>
    spi: mt7621: fix missing clk_disable_unprepare() on error in mt7621_spi_probe

Zhang Qilong <zhangqilong3@huawei.com>
    spi: spi-ti-qspi: fix reference leak in ti_qspi_setup

Anant Thazhemadam <anant.thazhemadam@gmail.com>
    Bluetooth: hci_h5: fix memory leak in h5_close

Anmol Karn <anmol.karan123@gmail.com>
    Bluetooth: Fix null pointer dereference in hci_event_packet()

Paweł Chmiel <pawel.mikolaj.chmiel@gmail.com>
    arm64: dts: exynos: Correct psci compatible used on Exynos7

Paweł Chmiel <pawel.mikolaj.chmiel@gmail.com>
    arm64: dts: exynos: Include common syscon restart/poweroff for Exynos7

Seung-Woo Kim <sw0312.kim@samsung.com>
    brcmfmac: Fix memory leak for unpaired brcmf_{alloc/free}

Zhang Qilong <zhangqilong3@huawei.com>
    spi: stm32: fix reference leak in stm32_spi_resume

Paul Moore <paul@paul-moore.com>
    selinux: fix inode_doinit_with_dentry() LABEL_INVALID error handling

Andrii Nakryiko <andrii@kernel.org>
    libbpf: Fix BTF data layout checks and allow empty BTF

Cezary Rojewski <cezary.rojewski@intel.com>
    ASoC: pcm: DRAIN support reactivation

Zhang Qilong <zhangqilong3@huawei.com>
    spi: spi-mem: fix reference leak in spi_mem_access_start

Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
    drm/msm/dsi_pll_10nm: restore VCO rate during restore_state

Jaegeuk Kim <jaegeuk@kernel.org>
    f2fs: call f2fs_get_meta_page_retry for nat page

Zhang Qilong <zhangqilong3@huawei.com>
    spi: img-spfi: fix reference leak in img_spfi_resume

Jordan Niethe <jniethe5@gmail.com>
    powerpc/64: Set up a kernel stack for secondaries before cpu_restore()

Arnd Bergmann <arnd@arndb.de>
    drm/amdgpu: fix build_coefficients() argument

Vijay Khemka <vijaykhemka@fb.com>
    ARM: dts: aspeed: tiogapass: Remove vuart

Clément Péron <peron.clem@gmail.com>
    ASoC: sun4i-i2s: Fix lrck_period computation for I2S justified mode

Colin Ian King <colin.king@canonical.com>
    crypto: inside-secure - Fix sizeof() mismatch

Christophe Leroy <christophe.leroy@csgroup.eu>
    crypto: talitos - Fix return type of current_desc_hdr()

Christophe Leroy <christophe.leroy@csgroup.eu>
    crypto: talitos - Endianess in current_desc_hdr()

Arnd Bergmann <arnd@arndb.de>
    drm/amdgpu: fix incorrect enum type

Thomas Gleixner <tglx@linutronix.de>
    sched: Reenable interrupts in do_sched_yield()

Peng Liu <iwtbavbm@gmail.com>
    sched/deadline: Fix sched_dl_global_validate()

David Woodhouse <dwmw@amazon.co.uk>
    x86/apic: Fix x2apic enablement without interrupt remapping

Ard Biesheuvel <ardb@kernel.org>
    ARM: p2v: fix handling of LPAE translation in BE mode

Arvind Sankar <nivedita@alum.mit.edu>
    x86/mm/ident_map: Check for errors from ident_pud_init()

Bob Pearson <rpearsonhpe@gmail.com>
    RDMA/rxe: Compute PSN windows correctly

Joel Stanley <joel@jms.id.au>
    ARM: dts: aspeed: s2600wf: Fix VGA memory region location

Tianyue Ren <rentianyue@kylinos.cn>
    selinux: fix error initialization in inode_doinit_with_dentry()

Dan Carpenter <dan.carpenter@oracle.com>
    rtc: pcf2127: fix pcf2127_nvmem_read/write() returns

Kamal Heib <kamalheib1@gmail.com>
    RDMA/bnxt_re: Set queue pair state when being queried

Douglas Anderson <dianders@chromium.org>
    Revert "i2c: i2c-qcom-geni: Fix DMA transfer race"

Douglas Anderson <dianders@chromium.org>
    soc: qcom: geni: More properly switch to DMA mode

Nicolas Boichat <drinkcat@chromium.org>
    soc: mediatek: Check if power domains can be powered on at boot time

Dan Carpenter <dan.carpenter@oracle.com>
    soc: renesas: rmobile-sysc: Fix some leaks in rmobile_init_pm_domains()

Biju Das <biju.das.jz@bp.renesas.com>
    arm64: dts: renesas: cat875: Remove rxc-skew-ps from ethernet-phy node

Biju Das <biju.das.jz@bp.renesas.com>
    arm64: dts: renesas: hihope-rzg2-ex: Drop rxc-skew-ps from ethernet-phy node

Krzysztof Kozlowski <krzk@kernel.org>
    drm/tve200: Fix handling of platform_get_irq() error

Krzysztof Kozlowski <krzk@kernel.org>
    drm/mcde: Fix handling of platform_get_irq() error

Randy Dunlap <rdunlap@infradead.org>
    drm/aspeed: Fix Kconfig warning & subsequent build errors

Tom Rix <trix@redhat.com>
    drm/gma500: fix double free of gma_connector

Dae R. Jeong <dae.r.jeong@kaist.ac.kr>
    md: fix a warning caused by a race between concurrent md_ioctl()s

Eric Biggers <ebiggers@google.com>
    crypto: af_alg - avoid undefined behavior accessing salg_name

Antti Palosaari <crope@iki.fi>
    media: msi2500: assign SPI bus number dynamically

Jan Kara <jack@suse.cz>
    quota: Sanity-check quota file headers on load

Peilin Ye <yepeilin.cs@gmail.com>
    Bluetooth: Fix slab-out-of-bounds read in hci_le_direct_adv_report_evt()

Alexey Kardashevskiy <aik@ozlabs.ru>
    serial_core: Check for port state when tty is in error state

Julian Sax <jsbc@gmx.de>
    HID: i2c-hid: add Vero K147 to descriptor override

Arnd Bergmann <arnd@arndb.de>
    scsi: megaraid_sas: Check user-provided offsets

Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
    coresight: etb10: Fix possible NULL ptr dereference in etb_enable_perf()

Suzuki K Poulose <suzuki.poulose@arm.com>
    coresight: tmc-etr: Fix barrier packet insertion for perf buffer

Mao Jinlong <jinlmao@codeaurora.org>
    coresight: tmc-etr: Check if page is valid before dma_map_page()

Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
    coresight: tmc-etf: Fix NULL ptr dereference in tmc_enable_etf_sink_perf()

Krzysztof Kozlowski <krzk@kernel.org>
    ARM: dts: exynos: fix USB 3.0 pins supply being turned off on Odroid XU

Krzysztof Kozlowski <krzk@kernel.org>
    ARM: dts: exynos: fix USB 3.0 VBUS control and over-current pins on Exynos5410

Krzysztof Kozlowski <krzk@kernel.org>
    ARM: dts: exynos: fix roles of USB 3.0 ports on Odroid XU

Fabio Estevam <festevam@gmail.com>
    usb: chipidea: ci_hdrc_imx: Pass DISABLE_DEVICE_STREAMING flag to imx6ul

Will McVicker <willmcvicker@google.com>
    USB: gadget: f_rndis: fix bitrate for SuperSpeed and above

Jack Pham <jackp@codeaurora.org>
    usb: gadget: f_fs: Re-use SS descriptors for SuperSpeedPlus

Will McVicker <willmcvicker@google.com>
    USB: gadget: f_midi: setup SuperSpeed Plus descriptors

taehyun.cho <taehyun.cho@samsung.com>
    USB: gadget: f_acm: add support for SuperSpeed Plus

Johan Hovold <johan@kernel.org>
    USB: serial: option: add interface-number sanity check to flag handling

Dan Carpenter <dan.carpenter@oracle.com>
    usb: mtu3: fix memory corruption in mtu3_debugfs_regset()

Nicolin Chen <nicoleotsuka@gmail.com>
    soc/tegra: fuse: Fix index bug in get_process_id

Masahiro Yamada <masahiroy@kernel.org>
    kbuild: avoid split lines in .mod files

Stephane Eranian <eranian@google.com>
    perf/x86/intel: Check PEBS status correctly

Brandon Syu <Brandon.Syu@amd.com>
    drm/amd/display: Init clock value by current vbios CLKs

Luca Coelho <luciano.coelho@intel.com>
    iwlwifi: pcie: add one missing entry for AX210

Thomas Gleixner <tglx@linutronix.de>
    dm table: Remove BUG_ON(in_interrupt())

Sreekanth Reddy <sreekanth.reddy@broadcom.com>
    scsi: mpt3sas: Increase IOCInit request timeout to 30s

Sven Eckelmann <sven@narfation.org>
    vxlan: Copy needed_tailroom from lowerdev

Sven Eckelmann <sven@narfation.org>
    vxlan: Add needed_headroom for lower device

Mark Rutland <mark.rutland@arm.com>
    arm64: syscall: exit userspace before unmasking exceptions

Ofir Bitton <obitton@habana.ai>
    habanalabs: put devices before driver removal

Qinglang Miao <miaoqinglang@huawei.com>
    drm/tegra: sor: Disable clocks on error in tegra_sor_init()

Nicholas Piggin <npiggin@gmail.com>
    kernel/cpu: add arch override for clear_tasks_mm_cpumask() mm handling

Deepak R Varma <mh12gx2825@gmail.com>
    drm/tegra: replace idr_init() by idr_init_base()

Russell King <rmk+kernel@armlinux.org.uk>
    net: mvpp2: add mvpp2_phylink_to_port() helper

Paolo Abeni <pabeni@redhat.com>
    selftests: fix poll error in udpgro.sh

Björn Töpel <bjorn.topel@intel.com>
    ixgbe: avoid premature Rx buffer reuse

Björn Töpel <bjorn.topel@intel.com>
    i40e: avoid premature Rx buffer reuse

Li RongQing <lirongqing@baidu.com>
    i40e: optimise prefetch page refcount

Björn Töpel <bjorn.topel@intel.com>
    i40e: Refactor rx_bi accesses

Leon Romanovsky <leonro@nvidia.com>
    RDMA/cm: Fix an attempt to use non-valid pointer when cleaning timewait

Toke Høiland-Jørgensen <toke@redhat.com>
    selftests/bpf/test_offload.py: Reset ethtool features after failed setting

Brett Mastbergen <brett.mastbergen@gmail.com>
    netfilter: nft_ct: Remove confirmation check for NFT_CT_ID

Chunyan Zhang <chunyan.zhang@unisoc.com>
    gpio: eic-sprd: break loop when getting NULL device resource

Baolin Wang <baolin.wang7@gmail.com>
    Revert "gpio: eic-sprd: Use devm_platform_ioremap_resource()"

David Howells <dhowells@redhat.com>
    afs: Fix memory leak when mounting with multiple source parameters

Pablo Neira Ayuso <pablo@netfilter.org>
    netfilter: nft_dynset: fix timeouts later than 23 days

Florian Westphal <fw@strlen.de>
    netfilter: nft_compat: make sure xtables destructors have run

Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
    netfilter: x_tables: Switch synchronization to RCU

Andrew Jeffery <andrew@aj.id.au>
    pinctrl: aspeed: Fix GPIO requests on pass-through banks

Douglas Anderson <dianders@chromium.org>
    blk-mq: In blk_mq_dispatch_rq_list() "no budget" is a reason to kick

Johannes Thumshirn <johannes.thumshirn@wdc.com>
    block: factor out requeue handling from dispatch code

Damien Le Moal <damien.lemoal@wdc.com>
    block: Simplify REQ_OP_ZONE_RESET_ALL handling

Geert Uytterhoeven <geert+renesas@glider.be>
    clk: renesas: r9a06g032: Drop __packed for portability

Zhang Qilong <zhangqilong3@huawei.com>
    can: softing: softing_netdev_open(): fix error handling

Xuan Zhuo <xuanzhuo@linux.alibaba.com>
    xsk: Replace datagram_poll by sock_poll_wait

Luc Van Oostenryck <luc.vanoostenryck@gmail.com>
    xsk: Fix xsk_poll()'s return type

Randy Dunlap <rdunlap@infradead.org>
    scsi: bnx2i: Requires MMU

Baruch Siach <baruch@tkos.co.il>
    gpio: mvebu: fix potential user-after-free on probe

Qinglang Miao <miaoqinglang@huawei.com>
    gpio: zynq: fix reference leak in zynq_gpio functions

Zhang Qilong <zhangqilong3@huawei.com>
    PM: runtime: Add pm_runtime_resume_and_get to deal with usage counter

Bernd Bauer <bernd.bauer@anton-paar.com>
    ARM: dts: imx6qdl-kontron-samx6i: fix I2C_PM scl pin

Fabio Estevam <festevam@gmail.com>
    ARM: dts: imx6qdl-wandboard-revd1: Remove PAD_GPIO_6 from enetgrp

Adam Sampson <ats@offog.org>
    ARM: dts: sun7i: pcduino3-nano: enable RGMII RX/TX delay on PHY

Icenowy Zheng <icenowy@aosc.io>
    ARM: dts: sun8i: v3s: fix GIC node memory range

Andy Shevchenko <andriy.shevchenko@linux.intel.com>
    pinctrl: baytrail: Avoid clearing debounce value when turning it off

Andy Shevchenko <andriy.shevchenko@linux.intel.com>
    pinctrl: merrifield: Set default bias in case no particular value given

Pablo Greco <pgreco@centosproject.org>
    ARM: dts: sun8i: v40: bananapi-m2-berry: Fix ethernet node

Pablo Greco <pgreco@centosproject.org>
    ARM: dts: sun8i: r40: bananapi-m2-berry: Fix dcdc1 regulator

Pablo Greco <pgreco@centosproject.org>
    ARM: dts: sun7i: bananapi: Enable RGMII RX/TX delay on Ethernet PHY


-------------

Diffstat:

 Documentation/networking/ip-sysctl.txt             |   3 +
 Makefile                                           |   4 +-
 arch/Kconfig                                       |  16 +++
 arch/arm/boot/dts/armada-xp-98dx3236.dtsi          |   5 -
 .../arm/boot/dts/aspeed-bmc-facebook-tiogapass.dts |   5 -
 arch/arm/boot/dts/aspeed-bmc-intel-s2600wf.dts     |   4 +-
 arch/arm/boot/dts/at91-sama5d3_xplained.dts        |   7 ++
 arch/arm/boot/dts/at91-sama5d4_xplained.dts        |   7 ++
 arch/arm/boot/dts/at91sam9rl.dtsi                  |  19 ++--
 arch/arm/boot/dts/exynos5410-odroidxu.dts          |   6 +-
 arch/arm/boot/dts/exynos5410-pinctrl.dtsi          |  28 +++++
 arch/arm/boot/dts/exynos5410.dtsi                  |   4 +
 arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi      |   2 +-
 arch/arm/boot/dts/imx6qdl-wandboard-revd1.dtsi     |   1 -
 arch/arm/boot/dts/meson8b-odroidc1.dts             |   2 +-
 arch/arm/boot/dts/meson8m2-mxiii-plus.dts          |   2 +-
 arch/arm/boot/dts/omap4-panda-es.dts               |   2 +-
 arch/arm/boot/dts/sama5d2.dtsi                     |   7 +-
 arch/arm/boot/dts/sun7i-a20-bananapi.dts           |   2 +-
 arch/arm/boot/dts/sun7i-a20-pcduino3-nano.dts      |   4 +-
 arch/arm/boot/dts/sun8i-v3s.dtsi                   |   2 +-
 arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts  |  12 +-
 arch/arm/crypto/aes-ce-core.S                      |  32 ++++--
 arch/arm/kernel/head.S                             |   6 +-
 arch/arm/mach-sunxi/sunxi.c                        |   1 +
 arch/arm64/boot/dts/amlogic/meson-g12a-x96-max.dts |   2 +-
 .../boot/dts/amlogic/meson-gxbb-nanopi-k2.dts      |   2 +-
 .../arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts |   2 +-
 .../boot/dts/amlogic/meson-gxbb-vega-s95.dtsi      |   2 +-
 arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi  |   2 +-
 .../boot/dts/amlogic/meson-gxl-s905d-p230.dts      |   2 +-
 .../boot/dts/amlogic/meson-gxm-khadas-vim2.dts     |   4 +-
 .../arm64/boot/dts/amlogic/meson-gxm-nexbox-a1.dts |   2 +-
 arch/arm64/boot/dts/amlogic/meson-gxm-q200.dts     |   2 +-
 arch/arm64/boot/dts/amlogic/meson-gxm-rbox-pro.dts |   2 +-
 arch/arm64/boot/dts/amlogic/meson-sm1.dtsi         |   2 +-
 arch/arm64/boot/dts/exynos/exynos7.dtsi            |  12 +-
 arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi     |   2 +-
 .../boot/dts/marvell/armada-3720-turris-mox.dts    |   2 +-
 arch/arm64/boot/dts/nvidia/tegra194.dtsi           |   4 +-
 .../boot/dts/qcom/sdm850-lenovo-yoga-c630.dts      |  31 ++---
 arch/arm64/boot/dts/renesas/cat875.dtsi            |   1 -
 arch/arm64/boot/dts/renesas/hihope-rzg2-ex.dtsi    |   1 -
 arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts     |   1 +
 arch/arm64/boot/dts/rockchip/rk3328.dtsi           |  16 +--
 arch/arm64/include/asm/kvm_host.h                  |   1 +
 arch/arm64/kernel/syscall.c                        |   2 +-
 arch/arm64/kvm/sys_regs.c                          |   1 +
 arch/mips/bcm47xx/Kconfig                          |   1 +
 arch/mips/kernel/setup.c                           |   4 +-
 arch/powerpc/include/asm/book3s/32/pgtable.h       |   4 +-
 arch/powerpc/include/asm/cpm1.h                    |   1 +
 arch/powerpc/include/asm/cputable.h                |   7 +-
 arch/powerpc/include/asm/nohash/pgtable.h          |   4 +-
 arch/powerpc/kernel/Makefile                       |   3 +
 arch/powerpc/kernel/head_64.S                      |  10 +-
 arch/powerpc/kernel/paca.c                         |   4 +-
 arch/powerpc/kernel/rtas.c                         |   2 +-
 arch/powerpc/kernel/setup-common.c                 |   4 +-
 arch/powerpc/kernel/setup.h                        |   6 -
 arch/powerpc/kernel/setup_64.c                     |   2 +-
 arch/powerpc/mm/fault.c                            |   8 +-
 arch/powerpc/mm/mem.c                              |   2 +-
 arch/powerpc/perf/core-book3s.c                    |  13 +++
 arch/powerpc/platforms/8xx/micropatch.c            |  11 ++
 arch/powerpc/platforms/powernv/memtrace.c          |  44 +++++--
 arch/powerpc/platforms/powernv/npu-dma.c           |  16 ++-
 arch/powerpc/platforms/pseries/suspend.c           |   4 -
 arch/powerpc/xmon/nonstdio.c                       |   2 +-
 arch/s390/kernel/smp.c                             |  18 +--
 arch/s390/purgatory/head.S                         |   9 +-
 arch/sparc/mm/init_64.c                            |   2 +-
 arch/um/drivers/chan_user.c                        |   4 +-
 arch/um/drivers/xterm.c                            |   5 +
 arch/um/os-Linux/irq.c                             |   2 +-
 arch/um/os-Linux/umid.c                            |  17 +--
 arch/x86/events/intel/core.c                       |   5 +-
 arch/x86/events/intel/ds.c                         |   2 +-
 arch/x86/include/asm/apic.h                        |   1 +
 arch/x86/kernel/apic/apic.c                        |  14 ++-
 arch/x86/kernel/apic/x2apic_phys.c                 |   9 ++
 arch/x86/kernel/kprobes/core.c                     |   5 +
 arch/x86/mm/ident_map.c                            |  12 +-
 block/blk-mq.c                                     |  37 +++---
 block/blk-zoned.c                                  |  40 +++----
 crypto/af_alg.c                                    |  10 +-
 crypto/ecdh.c                                      |   9 +-
 drivers/acpi/acpi_pnp.c                            |   3 +
 drivers/acpi/device_pm.c                           |  41 ++-----
 drivers/acpi/resource.c                            |   2 +-
 drivers/android/binder.c                           |   1 +
 drivers/android/binder_alloc.c                     |  48 ++++++++
 drivers/android/binder_alloc.h                     |   4 +-
 drivers/block/xen-blkback/xenbus.c                 |   4 +-
 drivers/bluetooth/btmtksdio.c                      |   2 +-
 drivers/bluetooth/btusb.c                          |   2 +-
 drivers/bluetooth/hci_h5.c                         |   3 +
 drivers/bus/fsl-mc/fsl-mc-allocator.c              |   4 +-
 drivers/bus/mips_cdmm.c                            |   4 +-
 drivers/clk/at91/sam9x60.c                         |   6 +-
 drivers/clk/clk-s2mps11.c                          |   1 +
 drivers/clk/ingenic/cgu.c                          |  14 ++-
 drivers/clk/meson/Kconfig                          |   1 +
 drivers/clk/mvebu/armada-37xx-xtal.c               |   4 +-
 drivers/clk/renesas/r9a06g032-clocks.c             |   2 +-
 drivers/clk/sunxi-ng/ccu-sun50i-a64.c              |   1 +
 drivers/clk/sunxi-ng/ccu-sun8i-h3.c                |   1 +
 drivers/clk/tegra/clk-dfll.c                       |   4 +-
 drivers/clk/tegra/clk-id.h                         |   1 +
 drivers/clk/tegra/clk-tegra-periph.c               |   2 +-
 drivers/clk/ti/fapll.c                             |  11 +-
 drivers/clocksource/arm_arch_timer.c               |  27 +++--
 drivers/clocksource/timer-cadence-ttc.c            |  18 +--
 drivers/clocksource/timer-orion.c                  |  11 +-
 drivers/cpufreq/armada-8k-cpufreq.c                |   6 +
 drivers/cpufreq/highbank-cpufreq.c                 |   7 ++
 drivers/cpufreq/loongson1-cpufreq.c                |   1 +
 drivers/cpufreq/mediatek-cpufreq.c                 |   1 +
 drivers/cpufreq/qcom-cpufreq-nvmem.c               |   1 +
 drivers/cpufreq/scpi-cpufreq.c                     |   1 +
 drivers/cpufreq/sti-cpufreq.c                      |   7 ++
 drivers/cpufreq/sun50i-cpufreq-nvmem.c             |   1 +
 drivers/crypto/Kconfig                             |   1 +
 drivers/crypto/amcc/crypto4xx_core.c               |   2 +-
 drivers/crypto/inside-secure/safexcel.c            |   2 +-
 drivers/crypto/omap-aes.c                          |   3 +-
 drivers/crypto/qat/qat_common/qat_hal.c            |   2 +-
 drivers/crypto/talitos.c                           |  10 +-
 drivers/dax/super.c                                |   1 +
 drivers/dma-buf/dma-resv.c                         |   2 +-
 drivers/dma/mv_xor_v2.c                            |   4 +-
 drivers/edac/amd64_edac.c                          |  26 +++--
 drivers/edac/i10nm_base.c                          |  11 +-
 drivers/edac/mce_amd.c                             |   2 +-
 drivers/extcon/extcon-max77693.c                   |   2 +-
 drivers/gpio/gpio-eic-sprd.c                       |   9 +-
 drivers/gpio/gpio-mvebu.c                          |  16 ++-
 drivers/gpio/gpio-zynq.c                           |   4 +-
 drivers/gpu/drm/amd/amdkfd/kfd_chardev.c           |   2 +
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c  |  17 ++-
 .../drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c  |  13 ++-
 drivers/gpu/drm/amd/display/dc/core/dc_link.c      |   7 +-
 drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c   |   4 +-
 .../drm/amd/display/modules/color/color_gamma.c    |   2 +-
 drivers/gpu/drm/aspeed/Kconfig                     |   1 +
 drivers/gpu/drm/drm_dp_aux_dev.c                   |   2 +-
 drivers/gpu/drm/gma500/cdv_intel_dp.c              |   2 +-
 drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c     |   2 +-
 drivers/gpu/drm/mcde/mcde_drv.c                    |   4 +-
 drivers/gpu/drm/mediatek/mtk_hdmi_phy.c            |   5 +-
 drivers/gpu/drm/msm/dsi/pll/dsi_pll_10nm.c         |   8 ++
 drivers/gpu/drm/omapdrm/omap_dmm_tiler.c           |   1 +
 drivers/gpu/drm/tegra/drm.c                        |   2 +-
 drivers/gpu/drm/tegra/sor.c                        |  10 +-
 drivers/gpu/drm/tve200/tve200_drv.c                |   4 +-
 drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c           |   8 ++
 drivers/hsi/controllers/omap_ssi_core.c            |   2 +-
 drivers/hwmon/ina3221.c                            |   2 +-
 drivers/hwtracing/coresight/coresight-etb10.c      |   4 +-
 drivers/hwtracing/coresight/coresight-priv.h       |   2 +
 drivers/hwtracing/coresight/coresight-tmc-etf.c    |   4 +-
 drivers/hwtracing/coresight/coresight-tmc-etr.c    |   4 +-
 drivers/i2c/busses/i2c-qcom-geni.c                 |   6 +-
 drivers/iio/adc/rockchip_saradc.c                  |   2 +-
 drivers/iio/adc/ti-ads124s08.c                     |  13 ++-
 drivers/iio/imu/bmi160/bmi160_core.c               |   4 +-
 drivers/iio/industrialio-buffer.c                  |   6 +-
 drivers/iio/light/rpr0521.c                        |  17 ++-
 drivers/iio/light/st_uvis25.h                      |   5 +
 drivers/iio/light/st_uvis25_core.c                 |   8 +-
 drivers/iio/magnetometer/mag3110.c                 |  13 ++-
 drivers/iio/pressure/mpl3115.c                     |   9 +-
 drivers/iio/trigger/iio-trig-hrtimer.c             |   4 +-
 drivers/infiniband/core/cm.c                       |   2 +
 drivers/infiniband/core/cma.c                      |   7 +-
 drivers/infiniband/core/device.c                   |   7 +-
 drivers/infiniband/hw/bnxt_re/ib_verbs.c           |   1 +
 drivers/infiniband/hw/cxgb4/cq.c                   |   3 +
 drivers/infiniband/hw/mthca/mthca_cq.c             |   2 +-
 drivers/infiniband/hw/mthca/mthca_dev.h            |   1 -
 drivers/infiniband/sw/rxe/rxe_req.c                |   3 +-
 drivers/input/keyboard/cros_ec_keyb.c              |   1 +
 drivers/input/keyboard/omap4-keypad.c              |  89 +++++++++------
 drivers/input/mouse/cyapa_gen6.c                   |   2 +-
 drivers/input/touchscreen/ads7846.c                |  52 +++++----
 drivers/input/touchscreen/goodix.c                 |  12 ++
 drivers/irqchip/irq-alpine-msi.c                   |   3 +-
 drivers/leds/leds-netxbig.c                        |  35 ++++--
 drivers/md/dm-ioctl.c                              |   1 +
 drivers/md/dm-table.c                              |   6 -
 drivers/md/md-cluster.c                            |  67 ++++++-----
 drivers/md/md.c                                    |  21 +++-
 drivers/media/common/siano/smsdvb-main.c           |   5 +-
 drivers/media/i2c/imx214.c                         |   2 +-
 drivers/media/i2c/max2175.c                        |   2 +-
 drivers/media/pci/intel/ipu3/ipu3-cio2.c           |  62 +++++-----
 drivers/media/pci/intel/ipu3/ipu3-cio2.h           |   1 +
 drivers/media/pci/netup_unidvb/netup_unidvb_spi.c  |   5 +-
 drivers/media/pci/saa7146/mxb.c                    |  19 ++--
 drivers/media/pci/solo6x10/solo6x10-g723.c         |   2 +-
 .../media/platform/mtk-vcodec/mtk_vcodec_dec_pm.c  |  19 +++-
 .../media/platform/mtk-vcodec/mtk_vcodec_enc_pm.c  |  26 +++--
 drivers/media/rc/sunxi-cir.c                       |   2 +
 drivers/media/usb/gspca/gspca.c                    |   1 +
 drivers/media/usb/msi2500/msi2500.c                |   2 +-
 drivers/media/usb/tm6000/tm6000-video.c            |   5 +-
 drivers/media/v4l2-core/v4l2-fwnode.c              |   6 +-
 drivers/memstick/core/memstick.c                   |   1 -
 drivers/memstick/host/r592.c                       |  12 +-
 drivers/misc/habanalabs/device.c                   |  16 +--
 drivers/mmc/host/pxamci.c                          |   1 +
 drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c         |  38 +++++--
 drivers/mtd/nand/raw/meson_nand.c                  |   7 +-
 drivers/mtd/nand/raw/qcom_nandc.c                  |   2 +
 drivers/mtd/nand/spi/core.c                        |   4 +
 drivers/mtd/parsers/cmdlinepart.c                  |  14 ++-
 drivers/net/can/m_can/m_can.c                      |   4 -
 drivers/net/can/softing/softing_main.c             |   9 +-
 drivers/net/ethernet/allwinner/sun4i-emac.c        |   7 +-
 drivers/net/ethernet/broadcom/genet/bcmgenet.c     |   4 +-
 drivers/net/ethernet/intel/i40e/i40e_txrx.c        |  46 +++++---
 drivers/net/ethernet/intel/i40e/i40e_xsk.c         |  18 ++-
 drivers/net/ethernet/intel/ixgbe/ixgbe_main.c      |  24 ++--
 drivers/net/ethernet/korina.c                      |   2 +-
 drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c    |  29 +++--
 drivers/net/ethernet/mellanox/mlx5/core/main.c     |   6 +-
 drivers/net/ethernet/microchip/lan743x_main.c      |  43 +++----
 drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c   |   1 +
 drivers/net/virtio_net.c                           |   1 +
 drivers/net/vxlan.c                                |   3 +
 drivers/net/wireless/ath/ath10k/usb.c              |   7 +-
 drivers/net/wireless/ath/ath10k/wmi-tlv.c          |   4 +-
 drivers/net/wireless/ath/ath10k/wmi.c              |   9 +-
 drivers/net/wireless/ath/ath10k/wmi.h              |   1 +
 .../wireless/broadcom/brcm80211/brcmfmac/pcie.c    |   6 +-
 .../wireless/broadcom/brcm80211/brcmfmac/sdio.c    |   1 +
 drivers/net/wireless/intel/iwlwifi/mvm/ops.c       |   6 +
 drivers/net/wireless/intel/iwlwifi/pcie/drv.c      |   1 +
 .../net/wireless/intersil/orinoco/orinoco_usb.c    |  14 +--
 drivers/net/wireless/marvell/mwifiex/main.c        |   2 +
 drivers/net/wireless/quantenna/qtnfmac/pcie/pcie.c |   6 +-
 drivers/net/wireless/rsi/rsi_91x_usb.c             |  30 ++---
 drivers/net/wireless/st/cw1200/main.c              |   2 +
 drivers/net/xen-netback/xenbus.c                   |   6 +-
 drivers/nfc/s3fwrn5/firmware.c                     |   4 +-
 drivers/nvdimm/label.c                             |  13 ++-
 drivers/pci/controller/pcie-iproc.c                |  10 +-
 drivers/pci/pci-acpi.c                             |   4 +-
 drivers/pci/pci.c                                  |  14 ++-
 drivers/pci/slot.c                                 |   6 +-
 drivers/phy/renesas/phy-rcar-gen3-usb2.c           |   6 +-
 drivers/pinctrl/aspeed/pinctrl-aspeed.c            |  74 +++++++++++-
 drivers/pinctrl/aspeed/pinmux-aspeed.h             |   7 +-
 drivers/pinctrl/intel/pinctrl-baytrail.c           |   8 +-
 drivers/pinctrl/intel/pinctrl-merrifield.c         |   8 ++
 drivers/pinctrl/pinctrl-falcon.c                   |  14 ++-
 drivers/pinctrl/sunxi/pinctrl-sunxi.c              |   6 +-
 drivers/platform/chrome/cros_ec_spi.c              |   1 -
 drivers/platform/x86/dell-smbios-base.c            |   1 +
 drivers/platform/x86/intel-vbtn.c                  |   6 +
 drivers/platform/x86/mlx-platform.c                |  16 +--
 drivers/power/supply/axp288_charger.c              |  28 +++--
 drivers/power/supply/bq24190_charger.c             |  20 +++-
 drivers/ps3/ps3stor_lib.c                          |   2 +-
 drivers/pwm/pwm-lp3943.c                           |   1 +
 drivers/pwm/pwm-zx.c                               |   1 +
 drivers/regulator/axp20x-regulator.c               |   2 +-
 drivers/remoteproc/qcom_q6v5_adsp.c                |  13 +--
 drivers/remoteproc/qcom_q6v5_mss.c                 |   5 +-
 drivers/rtc/rtc-ep93xx.c                           |   6 +-
 drivers/rtc/rtc-pcf2127.c                          |  12 +-
 drivers/s390/block/dasd_alias.c                    |  22 +++-
 drivers/s390/cio/device.c                          |   4 +-
 drivers/scsi/bnx2i/Kconfig                         |   1 +
 drivers/scsi/fnic/fnic_main.c                      |   1 +
 drivers/scsi/lpfc/lpfc_mem.c                       |   6 +-
 drivers/scsi/lpfc/lpfc_sli.c                       |  10 +-
 drivers/scsi/megaraid/megaraid_sas_base.c          |  16 ++-
 drivers/scsi/mpt3sas/mpt3sas_base.c                |   2 +-
 drivers/scsi/pm8001/pm8001_init.c                  |   3 +-
 drivers/scsi/qedi/qedi_main.c                      |   4 +-
 drivers/scsi/qla2xxx/qla_tmpl.c                    |   9 +-
 drivers/scsi/qla2xxx/qla_tmpl.h                    |   2 +-
 drivers/scsi/scsi_lib.c                            | 126 ++++++++++++++-------
 drivers/slimbus/qcom-ngd-ctrl.c                    |   6 +
 drivers/soc/amlogic/meson-canvas.c                 |   4 +-
 drivers/soc/mediatek/mtk-scpsys.c                  |   5 +-
 drivers/soc/qcom/qcom-geni-se.c                    |  17 ++-
 drivers/soc/qcom/smp2p.c                           |   5 +-
 drivers/soc/renesas/rmobile-sysc.c                 |   1 +
 drivers/soc/tegra/fuse/speedo-tegra210.c           |   2 +-
 drivers/soc/ti/knav_dma.c                          |  13 ++-
 drivers/soc/ti/knav_qmss_queue.c                   |   4 +-
 drivers/spi/atmel-quadspi.c                        |  27 +++--
 drivers/spi/spi-bcm63xx-hsspi.c                    |   4 +-
 drivers/spi/spi-davinci.c                          |   2 +-
 drivers/spi/spi-fsl-spi.c                          |  11 +-
 drivers/spi/spi-gpio.c                             |  15 +--
 drivers/spi/spi-img-spfi.c                         |   4 +-
 drivers/spi/spi-mem.c                              |   1 +
 drivers/spi/spi-mt7621.c                           |  11 +-
 drivers/spi/spi-mxic.c                             |  10 +-
 drivers/spi/spi-mxs.c                              |   1 +
 drivers/spi/spi-pic32.c                            |   1 +
 drivers/spi/spi-pxa2xx.c                           |   5 +-
 drivers/spi/spi-rb4xx.c                            |   2 +-
 drivers/spi/spi-sc18is602.c                        |  13 +--
 drivers/spi/spi-sh.c                               |  13 +--
 drivers/spi/spi-sprd.c                             |   1 +
 drivers/spi/spi-st-ssc4.c                          |   5 +-
 drivers/spi/spi-stm32.c                            |   1 +
 drivers/spi/spi-synquacer.c                        |  15 +--
 drivers/spi/spi-tegra114.c                         |   2 +
 drivers/spi/spi-tegra20-sflash.c                   |   1 +
 drivers/spi/spi-tegra20-slink.c                    |   2 +
 drivers/spi/spi-ti-qspi.c                          |   1 +
 drivers/spi/spi.c                                  |  19 ++--
 drivers/staging/comedi/drivers/mf6x4.c             |   3 +-
 drivers/staging/gasket/gasket_interrupt.c          |  15 ++-
 drivers/staging/greybus/audio_codec.c              |   2 +
 drivers/staging/speakup/speakup_dectlk.c           |   2 +-
 drivers/tty/serial/serial_core.c                   |   4 +
 drivers/usb/chipidea/ci_hdrc_imx.c                 |   3 +-
 drivers/usb/gadget/function/f_acm.c                |   2 +-
 drivers/usb/gadget/function/f_fs.c                 |   5 +-
 drivers/usb/gadget/function/f_midi.c               |   6 +
 drivers/usb/gadget/function/f_rndis.c              |   4 +-
 drivers/usb/host/ehci-omap.c                       |   1 +
 drivers/usb/host/max3421-hcd.c                     |   3 +-
 drivers/usb/host/oxu210hp-hcd.c                    |   4 +-
 drivers/usb/mtu3/mtu3_debugfs.c                    |   2 +-
 drivers/usb/serial/digi_acceleport.c               |  45 +++-----
 drivers/usb/serial/keyspan_pda.c                   |  63 ++++++-----
 drivers/usb/serial/mos7720.c                       |   2 +
 drivers/usb/serial/option.c                        |  23 +++-
 drivers/vfio/pci/vfio_pci.c                        |   4 +-
 drivers/vfio/pci/vfio_pci_nvlink2.c                |   7 +-
 drivers/video/fbdev/atmel_lcdfb.c                  |   2 +-
 drivers/virtio/virtio_ring.c                       |   8 +-
 drivers/watchdog/Kconfig                           |   4 +-
 drivers/watchdog/qcom-wdt.c                        |   2 +-
 drivers/watchdog/sprd_wdt.c                        |  34 +++---
 drivers/watchdog/watchdog_core.c                   |  22 ++--
 drivers/xen/xen-pciback/xenbus.c                   |   2 +-
 drivers/xen/xenbus/xenbus.h                        |   2 +
 drivers/xen/xenbus/xenbus_client.c                 |   8 +-
 drivers/xen/xenbus/xenbus_probe.c                  |   1 +
 drivers/xen/xenbus/xenbus_probe_backend.c          |   7 ++
 drivers/xen/xenbus/xenbus_xs.c                     |  34 ++++--
 fs/afs/super.c                                     |   3 +
 fs/btrfs/extent-tree.c                             |  22 +++-
 fs/btrfs/extent_io.h                               |   2 +
 fs/btrfs/volumes.c                                 |   4 +
 fs/ceph/caps.c                                     |  11 +-
 fs/cifs/smb2ops.c                                  |   3 +-
 fs/erofs/data.c                                    |  26 ++---
 fs/ext4/inode.c                                    |  19 +++-
 fs/ext4/mballoc.c                                  |   1 +
 fs/f2fs/node.c                                     |   2 +-
 fs/jffs2/readinode.c                               |  16 +++
 fs/jffs2/super.c                                   |  17 +++
 fs/jfs/jfs_dmap.h                                  |   2 +-
 fs/lockd/host.c                                    |  20 ++--
 fs/nfs/inode.c                                     |   2 +-
 fs/nfs/nfs4proc.c                                  |  10 +-
 fs/nfs/nfs4xdr.c                                   |  10 +-
 fs/nfs_common/grace.c                              |   6 +-
 fs/nfsd/nfssvc.c                                   |   3 +-
 fs/quota/quota_v2.c                                |  19 ++++
 fs/ubifs/auth.c                                    |   4 +-
 fs/ubifs/io.c                                      |  13 ++-
 include/acpi/acpi_bus.h                            |   5 -
 include/linux/inetdevice.h                         |   4 +-
 include/linux/netfilter/x_tables.h                 |   5 +-
 include/linux/pm_runtime.h                         |  21 ++++
 include/linux/prefetch.h                           |   8 ++
 include/linux/security.h                           |   2 +-
 include/linux/seq_buf.h                            |   2 +-
 include/linux/sunrpc/xprt.h                        |   1 +
 include/linux/trace_seq.h                          |   4 +-
 include/media/v4l2-mediabus.h                      |   2 +
 include/net/netfilter/nf_tables.h                  |   6 +
 include/uapi/linux/android/binder.h                |   1 +
 include/uapi/linux/if_alg.h                        |  16 +++
 include/xen/xenbus.h                               |  15 ++-
 init/initramfs.c                                   |   2 +-
 kernel/cgroup/cpuset.c                             |  33 +++++-
 kernel/cpu.c                                       |   6 +-
 kernel/irq/irqdomain.c                             |  11 +-
 kernel/sched/core.c                                |   6 +-
 kernel/sched/deadline.c                            |   5 +-
 kernel/sched/sched.h                               |  42 +++----
 kernel/trace/bpf_trace.c                           |   8 +-
 kernel/trace/ring_buffer.c                         |  17 ++-
 mm/page_alloc.c                                    |  13 ++-
 net/bluetooth/hci_event.c                          |  17 +--
 net/core/lwt_bpf.c                                 |   8 +-
 net/ipv4/netfilter/arp_tables.c                    |  14 +--
 net/ipv4/netfilter/ip_tables.c                     |  14 +--
 net/ipv6/netfilter/ip6_tables.c                    |  14 +--
 net/mac80211/vht.c                                 |  14 ++-
 net/netfilter/nf_tables_api.c                      |  14 ++-
 net/netfilter/nft_compat.c                         |  36 +++++-
 net/netfilter/nft_ct.c                             |   2 -
 net/netfilter/nft_dynset.c                         |   8 +-
 net/netfilter/x_tables.c                           |  49 +++-----
 net/sunrpc/debugfs.c                               |   4 +-
 net/sunrpc/sched.c                                 |  65 ++++++-----
 net/sunrpc/xprt.c                                  |  65 ++++++++---
 net/sunrpc/xprtrdma/module.c                       |   1 +
 net/sunrpc/xprtrdma/rpc_rdma.c                     |  40 +++++--
 net/sunrpc/xprtrdma/transport.c                    |   1 +
 net/sunrpc/xprtsock.c                              |   7 +-
 net/wireless/nl80211.c                             |   2 +-
 net/xdp/xsk.c                                      |  10 +-
 samples/bpf/lwt_len_hist.sh                        |   2 +
 samples/bpf/test_lwt_bpf.sh                        |   0
 scripts/Makefile.build                             |  12 +-
 scripts/checkpatch.pl                              |   2 +-
 scripts/kconfig/preprocess.c                       |   2 +-
 security/integrity/ima/ima_crypto.c                |  20 +---
 security/selinux/hooks.c                           |  16 ++-
 sound/core/memalloc.c                              |   3 +-
 sound/core/oss/pcm_oss.c                           |  22 ++--
 sound/pci/hda/hda_codec.c                          |   2 +-
 sound/pci/hda/hda_sysfs.c                          |   2 +-
 sound/pci/hda/patch_ca0132.c                       |   4 +-
 sound/pci/hda/patch_realtek.c                      |  18 +++
 sound/soc/amd/acp-da7219-max98357a.c               |   9 +-
 sound/soc/codecs/cx2072x.c                         |   4 +-
 sound/soc/codecs/wm8997.c                          |   2 +
 sound/soc/codecs/wm8998.c                          |   4 +-
 sound/soc/codecs/wm_adsp.c                         |   5 +-
 sound/soc/jz4740/jz4740-i2s.c                      |   4 +
 sound/soc/meson/Kconfig                            |   2 +-
 sound/soc/soc-pcm.c                                |   2 +
 sound/soc/sunxi/sun4i-i2s.c                        |   4 +-
 sound/usb/clock.c                                  |   6 +
 sound/usb/quirks.c                                 |   1 +
 tools/lib/bpf/btf.c                                |  16 +--
 tools/perf/util/parse-regs-options.c               |   2 +-
 tools/perf/util/probe-file.c                       |  13 ++-
 tools/testing/selftests/bpf/Makefile               |   3 +-
 .../testing/selftests/bpf/progs/test_tunnel_kern.c |  42 ++-----
 tools/testing/selftests/bpf/test_offload.py        |   1 +
 tools/testing/selftests/bpf/test_tunnel.sh         |  43 ++++++-
 tools/testing/selftests/net/udpgso_bench_rx.c      |   3 +
 tools/testing/selftests/seccomp/config             |   1 +
 448 files changed, 2712 insertions(+), 1477 deletions(-)



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 001/453] ARM: dts: sun7i: bananapi: Enable RGMII RX/TX delay on Ethernet PHY
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
@ 2020-12-28 12:43 ` Greg Kroah-Hartman
  2020-12-28 12:43 ` [PATCH 5.4 002/453] ARM: dts: sun8i: r40: bananapi-m2-berry: Fix dcdc1 regulator Greg Kroah-Hartman
                   ` (454 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Pablo Greco, Maxime Ripard, Sasha Levin

From: Pablo Greco <pgreco@centosproject.org>

[ Upstream commit 8c9cb4094ccf242eddd140efba13872c55f68a87 ]

The Ethernet PHY on the Bananapi M1 has the RX and TX delays enabled on
the PHY, using pull-ups on the RXDLY and TXDLY pins.

Fix the phy-mode description to correct reflect this so that the
implementation doesn't reconfigure the delays incorrectly. This
happened with commit bbc4d71d6354 ("net: phy: realtek: fix rtl8211e
rx/tx delay config").

Fixes: 8a5b272fbf44 ("ARM: dts: sun7i: Add Banana Pi board")
Signed-off-by: Pablo Greco <pgreco@centosproject.org>
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
Link: https://lore.kernel.org/r/1604326600-39544-1-git-send-email-pgreco@centosproject.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/sun7i-a20-bananapi.dts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/sun7i-a20-bananapi.dts b/arch/arm/boot/dts/sun7i-a20-bananapi.dts
index bb3987e101c29..0b3d9ae756503 100644
--- a/arch/arm/boot/dts/sun7i-a20-bananapi.dts
+++ b/arch/arm/boot/dts/sun7i-a20-bananapi.dts
@@ -132,7 +132,7 @@
 	pinctrl-names = "default";
 	pinctrl-0 = <&gmac_rgmii_pins>;
 	phy-handle = <&phy1>;
-	phy-mode = "rgmii";
+	phy-mode = "rgmii-id";
 	phy-supply = <&reg_gmac_3v3>;
 	status = "okay";
 };
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 002/453] ARM: dts: sun8i: r40: bananapi-m2-berry: Fix dcdc1 regulator
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
  2020-12-28 12:43 ` [PATCH 5.4 001/453] ARM: dts: sun7i: bananapi: Enable RGMII RX/TX delay on Ethernet PHY Greg Kroah-Hartman
@ 2020-12-28 12:43 ` Greg Kroah-Hartman
  2020-12-28 12:43 ` [PATCH 5.4 003/453] ARM: dts: sun8i: v40: bananapi-m2-berry: Fix ethernet node Greg Kroah-Hartman
                   ` (453 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Pablo Greco, Maxime Ripard, Sasha Levin

From: Pablo Greco <pgreco@centosproject.org>

[ Upstream commit bd5cdcdc66e1f7179ff6d172d1e5f55e43403aa8 ]

DCDC1 regulator powers many different subsystems. While some of them can
work at 3.0 V, some of them can not. For example, VCC-HDMI can only work
between 3.24 V and 3.36 V. According to OS images provided by the board
manufacturer this regulator should be set to 3.3 V.

Set DCDC1 and DCDC1SW to 3.3 V in order to fix this.

Fixes: 23edc168bd98 ("ARM: dts: sun8i: Add board dts file for Banana Pi M2 Berry")
Fixes: 27e81e1970a8 ("ARM: dts: sun8i: v40: bananapi-m2-berry: Enable GMAC ethernet controller")
Signed-off-by: Pablo Greco <pgreco@centosproject.org>
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
Link: https://lore.kernel.org/r/1604326755-39742-1-git-send-email-pgreco@centosproject.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts b/arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts
index 15c22b06fc4b6..84eb082957183 100644
--- a/arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts
+++ b/arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts
@@ -198,16 +198,16 @@
 };
 
 &reg_dc1sw {
-	regulator-min-microvolt = <3000000>;
-	regulator-max-microvolt = <3000000>;
+	regulator-min-microvolt = <3300000>;
+	regulator-max-microvolt = <3300000>;
 	regulator-name = "vcc-gmac-phy";
 };
 
 &reg_dcdc1 {
 	regulator-always-on;
-	regulator-min-microvolt = <3000000>;
-	regulator-max-microvolt = <3000000>;
-	regulator-name = "vcc-3v0";
+	regulator-min-microvolt = <3300000>;
+	regulator-max-microvolt = <3300000>;
+	regulator-name = "vcc-3v3";
 };
 
 &reg_dcdc2 {
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 003/453] ARM: dts: sun8i: v40: bananapi-m2-berry: Fix ethernet node
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
  2020-12-28 12:43 ` [PATCH 5.4 001/453] ARM: dts: sun7i: bananapi: Enable RGMII RX/TX delay on Ethernet PHY Greg Kroah-Hartman
  2020-12-28 12:43 ` [PATCH 5.4 002/453] ARM: dts: sun8i: r40: bananapi-m2-berry: Fix dcdc1 regulator Greg Kroah-Hartman
@ 2020-12-28 12:43 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.4 004/453] pinctrl: merrifield: Set default bias in case no particular value given Greg Kroah-Hartman
                   ` (452 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:43 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Pablo Greco, Maxime Ripard, Sasha Levin

From: Pablo Greco <pgreco@centosproject.org>

[ Upstream commit 8a82d91fa275aaea49be06d7f5b1407ce1c0dd4b ]

Ethernet PHY on BananaPi M2 Berry provides RX and TX delays. Fix ethernet
node to reflect that fact.

Fixes: 27e81e1970a8 ("ARM: dts: sun8i: v40: bananapi-m2-berry: Enable GMAC ethernet controller")
Signed-off-by: Pablo Greco <pgreco@centosproject.org>
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
Link: https://lore.kernel.org/r/1604326769-39802-1-git-send-email-pgreco@centosproject.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts b/arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts
index 84eb082957183..47954551f5735 100644
--- a/arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts
+++ b/arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts
@@ -120,7 +120,7 @@
 	pinctrl-names = "default";
 	pinctrl-0 = <&gmac_rgmii_pins>;
 	phy-handle = <&phy1>;
-	phy-mode = "rgmii";
+	phy-mode = "rgmii-id";
 	phy-supply = <&reg_dc1sw>;
 	status = "okay";
 };
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 004/453] pinctrl: merrifield: Set default bias in case no particular value given
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (2 preceding siblings ...)
  2020-12-28 12:43 ` [PATCH 5.4 003/453] ARM: dts: sun8i: v40: bananapi-m2-berry: Fix ethernet node Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.4 005/453] pinctrl: baytrail: Avoid clearing debounce value when turning it off Greg Kroah-Hartman
                   ` (451 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Andy Shevchenko, Mika Westerberg,
	Sasha Levin

From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>

[ Upstream commit 0fa86fc2e28227f1e64f13867e73cf864c6d25ad ]

When GPIO library asks pin control to set the bias, it doesn't pass
any value of it and argument is considered boolean (and this is true
for ACPI GpioIo() / GpioInt() resources, by the way). Thus, individual
drivers must behave well, when they got the resistance value of 1 Ohm,
i.e. transforming it to sane default.

In case of Intel Merrifield pin control hardware the 20 kOhm sounds plausible
because it gives a good trade off between weakness and minimization of leakage
current (will be only 50 uA with the above choice).

Fixes: 4e80c8f50574 ("pinctrl: intel: Add Intel Merrifield pin controller support")
Depends-on: 2956b5d94a76 ("pinctrl / gpio: Introduce .set_config() callback for GPIO chips")
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pinctrl/intel/pinctrl-merrifield.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/pinctrl/intel/pinctrl-merrifield.c b/drivers/pinctrl/intel/pinctrl-merrifield.c
index 04ca8ae95df83..9e91d83b01388 100644
--- a/drivers/pinctrl/intel/pinctrl-merrifield.c
+++ b/drivers/pinctrl/intel/pinctrl-merrifield.c
@@ -741,6 +741,10 @@ static int mrfld_config_set_pin(struct mrfld_pinctrl *mp, unsigned int pin,
 		mask |= BUFCFG_Px_EN_MASK | BUFCFG_PUPD_VAL_MASK;
 		bits |= BUFCFG_PU_EN;
 
+		/* Set default strength value in case none is given */
+		if (arg == 1)
+			arg = 20000;
+
 		switch (arg) {
 		case 50000:
 			bits |= BUFCFG_PUPD_VAL_50K << BUFCFG_PUPD_VAL_SHIFT;
@@ -761,6 +765,10 @@ static int mrfld_config_set_pin(struct mrfld_pinctrl *mp, unsigned int pin,
 		mask |= BUFCFG_Px_EN_MASK | BUFCFG_PUPD_VAL_MASK;
 		bits |= BUFCFG_PD_EN;
 
+		/* Set default strength value in case none is given */
+		if (arg == 1)
+			arg = 20000;
+
 		switch (arg) {
 		case 50000:
 			bits |= BUFCFG_PUPD_VAL_50K << BUFCFG_PUPD_VAL_SHIFT;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 005/453] pinctrl: baytrail: Avoid clearing debounce value when turning it off
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (3 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.4 004/453] pinctrl: merrifield: Set default bias in case no particular value given Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.4 006/453] ARM: dts: sun8i: v3s: fix GIC node memory range Greg Kroah-Hartman
                   ` (450 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Andy Shevchenko, Mika Westerberg,
	Sasha Levin

From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>

[ Upstream commit 0b74e40a4e41f3cbad76dff4c50850d47b525b26 ]

Baytrail pin control has a common register to set up debounce timeout.
When a pin configuration requested debounce to be disabled, the rest
of the pins may still want to have debounce enabled and thus rely on
the common timeout value. Avoid clearing debounce value when turning
it off for one pin while others may still use it.

Fixes: 658b476c742f ("pinctrl: baytrail: Add debounce configuration")
Depends-on: 04ff5a095d66 ("pinctrl: baytrail: Rectify debounce support")
Depends-on: 827e1579e1d5 ("pinctrl: baytrail: Rectify debounce support (part 2)")
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pinctrl/intel/pinctrl-baytrail.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/drivers/pinctrl/intel/pinctrl-baytrail.c b/drivers/pinctrl/intel/pinctrl-baytrail.c
index 5a1174a8e2bac..d05f20ca90d7e 100644
--- a/drivers/pinctrl/intel/pinctrl-baytrail.c
+++ b/drivers/pinctrl/intel/pinctrl-baytrail.c
@@ -1060,7 +1060,6 @@ static int byt_pin_config_set(struct pinctrl_dev *pctl_dev,
 			break;
 		case PIN_CONFIG_INPUT_DEBOUNCE:
 			debounce = readl(db_reg);
-			debounce &= ~BYT_DEBOUNCE_PULSE_MASK;
 
 			if (arg)
 				conf |= BYT_DEBOUNCE_EN;
@@ -1069,24 +1068,31 @@ static int byt_pin_config_set(struct pinctrl_dev *pctl_dev,
 
 			switch (arg) {
 			case 375:
+				debounce &= ~BYT_DEBOUNCE_PULSE_MASK;
 				debounce |= BYT_DEBOUNCE_PULSE_375US;
 				break;
 			case 750:
+				debounce &= ~BYT_DEBOUNCE_PULSE_MASK;
 				debounce |= BYT_DEBOUNCE_PULSE_750US;
 				break;
 			case 1500:
+				debounce &= ~BYT_DEBOUNCE_PULSE_MASK;
 				debounce |= BYT_DEBOUNCE_PULSE_1500US;
 				break;
 			case 3000:
+				debounce &= ~BYT_DEBOUNCE_PULSE_MASK;
 				debounce |= BYT_DEBOUNCE_PULSE_3MS;
 				break;
 			case 6000:
+				debounce &= ~BYT_DEBOUNCE_PULSE_MASK;
 				debounce |= BYT_DEBOUNCE_PULSE_6MS;
 				break;
 			case 12000:
+				debounce &= ~BYT_DEBOUNCE_PULSE_MASK;
 				debounce |= BYT_DEBOUNCE_PULSE_12MS;
 				break;
 			case 24000:
+				debounce &= ~BYT_DEBOUNCE_PULSE_MASK;
 				debounce |= BYT_DEBOUNCE_PULSE_24MS;
 				break;
 			default:
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 006/453] ARM: dts: sun8i: v3s: fix GIC node memory range
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (4 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.4 005/453] pinctrl: baytrail: Avoid clearing debounce value when turning it off Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.4 007/453] ARM: dts: sun7i: pcduino3-nano: enable RGMII RX/TX delay on PHY Greg Kroah-Hartman
                   ` (449 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Icenowy Zheng, Maxime Ripard, Sasha Levin

From: Icenowy Zheng <icenowy@aosc.io>

[ Upstream commit a98fd117a2553ab1a6d2fe3c7acae88c1eca4372 ]

Currently the GIC node in V3s DTSI follows some old DT examples, and
being broken. This leads a warning at boot.

Fix this.

Fixes: f989086ccbc6 ("ARM: dts: sunxi: add dtsi file for V3s SoC")
Signed-off-by: Icenowy Zheng <icenowy@aosc.io>
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
Link: https://lore.kernel.org/r/20201120050851.4123759-1-icenowy@aosc.io
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/sun8i-v3s.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/sun8i-v3s.dtsi b/arch/arm/boot/dts/sun8i-v3s.dtsi
index 2abcba35d27e6..50c32cf72c65c 100644
--- a/arch/arm/boot/dts/sun8i-v3s.dtsi
+++ b/arch/arm/boot/dts/sun8i-v3s.dtsi
@@ -423,7 +423,7 @@
 		gic: interrupt-controller@1c81000 {
 			compatible = "arm,gic-400";
 			reg = <0x01c81000 0x1000>,
-			      <0x01c82000 0x1000>,
+			      <0x01c82000 0x2000>,
 			      <0x01c84000 0x2000>,
 			      <0x01c86000 0x2000>;
 			interrupt-controller;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 007/453] ARM: dts: sun7i: pcduino3-nano: enable RGMII RX/TX delay on PHY
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (5 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.4 006/453] ARM: dts: sun8i: v3s: fix GIC node memory range Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.4 008/453] ARM: dts: imx6qdl-wandboard-revd1: Remove PAD_GPIO_6 from enetgrp Greg Kroah-Hartman
                   ` (448 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Adam Sampson, Maxime Ripard,
	Andrew Lunn, Chen-Yu Tsai, Sasha Levin

From: Adam Sampson <ats@offog.org>

[ Upstream commit a7361b9c4615951f52ffd2b1afa09a1384c7b4e4 ]

The RX/TX delays for the Ethernet PHY on the Linksprite pcDuino 3 Nano
are configured in hardware, using resistors that are populated to pull
the RTL8211E's RXDLY/TXDLY pins low or high as needed.

phy-mode should be set to rgmii-id to reflect this. Previously it was
set to rgmii, which used to work but now results in the delays being
disabled again as a result of the bugfix in commit bbc4d71d6354 ("net:
phy: realtek: fix rtl8211e rx/tx delay config").

Tested on two pcDuino 3 Nano boards purchased in 2015. Without this fix,
Ethernet works unreliably on one board and doesn't work at all on the
other.

Fixes: 061035d456c9 ("ARM: dts: sun7i: Add dts file for pcDuino 3 Nano board")
Signed-off-by: Adam Sampson <ats@offog.org>
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Acked-by: Chen-Yu Tsai <wens@csie.org>
Link: https://lore.kernel.org/r/20201123174739.6809-1-ats@offog.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/sun7i-a20-pcduino3-nano.dts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm/boot/dts/sun7i-a20-pcduino3-nano.dts b/arch/arm/boot/dts/sun7i-a20-pcduino3-nano.dts
index fce2f7fcd084a..bf38c66c1815b 100644
--- a/arch/arm/boot/dts/sun7i-a20-pcduino3-nano.dts
+++ b/arch/arm/boot/dts/sun7i-a20-pcduino3-nano.dts
@@ -1,5 +1,5 @@
 /*
- * Copyright 2015 Adam Sampson <ats@offog.org>
+ * Copyright 2015-2020 Adam Sampson <ats@offog.org>
  *
  * This file is dual-licensed: you can use it either under the terms
  * of the GPL or the X11 license, at your option. Note that this dual
@@ -115,7 +115,7 @@
 	pinctrl-names = "default";
 	pinctrl-0 = <&gmac_rgmii_pins>;
 	phy-handle = <&phy1>;
-	phy-mode = "rgmii";
+	phy-mode = "rgmii-id";
 	status = "okay";
 };
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 008/453] ARM: dts: imx6qdl-wandboard-revd1: Remove PAD_GPIO_6 from enetgrp
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (6 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.4 007/453] ARM: dts: sun7i: pcduino3-nano: enable RGMII RX/TX delay on PHY Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.4 009/453] ARM: dts: imx6qdl-kontron-samx6i: fix I2C_PM scl pin Greg Kroah-Hartman
                   ` (447 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Fabio Estevam, Shawn Guo, Sasha Levin

From: Fabio Estevam <festevam@gmail.com>

[ Upstream commit 58d6bca5efc73235b0f84c0d53321737177c651e ]

Since commit 8ad2d1dcce54 ("ARM: dts: imx6qdl-wandboard: Add OV5645 camera
support") the PAD_GPIO_6 is used for providing the camera sensor clock.

Remove it from the enetgrp to fix the following IOMXU conflict:

[    9.972414] imx6q-pinctrl 20e0000.pinctrl: pin MX6Q_PAD_GPIO_6 already requested by 2188000.ethernet; cannot claim for 1-003c
[    9.983857] imx6q-pinctrl 20e0000.pinctrl: pin-140 (1-003c) status -22
[    9.990514] imx6q-pinctrl 20e0000.pinctrl: could not request pin 140 (MX6Q_PAD_GPIO_6) from group ov5645grp  on device 20e0000.pinctrl

Fixes: 8ad2d1dcce54 ("ARM: dts: imx6qdl-wandboard: Add OV5645 camera support")
Signed-off-by: Fabio Estevam <festevam@gmail.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/imx6qdl-wandboard-revd1.dtsi | 1 -
 1 file changed, 1 deletion(-)

diff --git a/arch/arm/boot/dts/imx6qdl-wandboard-revd1.dtsi b/arch/arm/boot/dts/imx6qdl-wandboard-revd1.dtsi
index 93909796885a0..b9b698f72b261 100644
--- a/arch/arm/boot/dts/imx6qdl-wandboard-revd1.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-wandboard-revd1.dtsi
@@ -166,7 +166,6 @@
 				MX6QDL_PAD_RGMII_RD2__RGMII_RD2		0x1b030
 				MX6QDL_PAD_RGMII_RD3__RGMII_RD3		0x1b030
 				MX6QDL_PAD_RGMII_RX_CTL__RGMII_RX_CTL	0x1b030
-				MX6QDL_PAD_GPIO_6__ENET_IRQ		0x000b1
 			>;
 		};
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 009/453] ARM: dts: imx6qdl-kontron-samx6i: fix I2C_PM scl pin
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (7 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.4 008/453] ARM: dts: imx6qdl-wandboard-revd1: Remove PAD_GPIO_6 from enetgrp Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.4 010/453] PM: runtime: Add pm_runtime_resume_and_get to deal with usage counter Greg Kroah-Hartman
                   ` (446 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Bernd Bauer, Marco Felsch, Shawn Guo,
	Sasha Levin

From: Bernd Bauer <bernd.bauer@anton-paar.com>

[ Upstream commit 19ba8fb810c60b46869acc9f455613de454e0fca ]

Use the correct pin for the i2c scl signal else we can't access the
SoM eeprom.

Fixes: 2a51f9dae13d ("ARM: dts: imx6qdl-kontron-samx6i: Add iMX6-based Kontron SMARC-sAMX6i module")
Signed-off-by: Bernd Bauer <bernd.bauer@anton-paar.com>
[m.felsch@pengutronix.de: Adapt commit message]
Signed-off-by: Marco Felsch <m.felsch@pengutronix.de>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi b/arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi
index 81c7ebb4b3fbe..6acc8591219a7 100644
--- a/arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi
@@ -551,7 +551,7 @@
 
 	pinctrl_i2c3: i2c3grp {
 		fsl,pins = <
-			MX6QDL_PAD_GPIO_3__I2C3_SCL		0x4001b8b1
+			MX6QDL_PAD_GPIO_5__I2C3_SCL		0x4001b8b1
 			MX6QDL_PAD_GPIO_16__I2C3_SDA		0x4001b8b1
 		>;
 	};
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 010/453] PM: runtime: Add pm_runtime_resume_and_get to deal with usage counter
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (8 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.4 009/453] ARM: dts: imx6qdl-kontron-samx6i: fix I2C_PM scl pin Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.4 011/453] gpio: zynq: fix reference leak in zynq_gpio functions Greg Kroah-Hartman
                   ` (445 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Zhang Qilong, Rafael J. Wysocki,
	Jakub Kicinski, Sasha Levin

From: Zhang Qilong <zhangqilong3@huawei.com>

[ Upstream commit dd8088d5a8969dc2b42f71d7bc01c25c61a78066 ]

In many case, we need to check return value of pm_runtime_get_sync, but
it brings a trouble to the usage counter processing. Many callers forget
to decrease the usage counter when it failed, which could resulted in
reference leak. It has been discussed a lot[0][1]. So we add a function
to deal with the usage counter for better coding.

[0]https://lkml.org/lkml/2020/6/14/88
[1]https://patchwork.ozlabs.org/project/linux-tegra/list/?series=178139
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Acked-by: Rafael J. Wysocki  <rafael.j.wysocki@intel.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/pm_runtime.h | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/include/linux/pm_runtime.h b/include/linux/pm_runtime.h
index fe61e3b9a9ca2..7145795b4b9da 100644
--- a/include/linux/pm_runtime.h
+++ b/include/linux/pm_runtime.h
@@ -224,6 +224,27 @@ static inline int pm_runtime_get_sync(struct device *dev)
 	return __pm_runtime_resume(dev, RPM_GET_PUT);
 }
 
+/**
+ * pm_runtime_resume_and_get - Bump up usage counter of a device and resume it.
+ * @dev: Target device.
+ *
+ * Resume @dev synchronously and if that is successful, increment its runtime
+ * PM usage counter. Return 0 if the runtime PM usage counter of @dev has been
+ * incremented or a negative error code otherwise.
+ */
+static inline int pm_runtime_resume_and_get(struct device *dev)
+{
+	int ret;
+
+	ret = __pm_runtime_resume(dev, RPM_GET_PUT);
+	if (ret < 0) {
+		pm_runtime_put_noidle(dev);
+		return ret;
+	}
+
+	return 0;
+}
+
 static inline int pm_runtime_put(struct device *dev)
 {
 	return __pm_runtime_idle(dev, RPM_GET_PUT | RPM_ASYNC);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 011/453] gpio: zynq: fix reference leak in zynq_gpio functions
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (9 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.4 010/453] PM: runtime: Add pm_runtime_resume_and_get to deal with usage counter Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.4 012/453] gpio: mvebu: fix potential user-after-free on probe Greg Kroah-Hartman
                   ` (444 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Qinglang Miao,
	Bartosz Golaszewski, Sasha Levin

From: Qinglang Miao <miaoqinglang@huawei.com>

[ Upstream commit 7f57b295f990c0fa07f96d51ca1c82c52dbf79cc ]

pm_runtime_get_sync will increment pm usage counter even it
failed. Forgetting to putting operation will result in a
reference leak here.

A new function pm_runtime_resume_and_get is introduced in
[0] to keep usage counter balanced. So We fix the reference
leak by replacing it with new funtion.

[0] dd8088d5a896 ("PM: runtime: Add  pm_runtime_resume_and_get to deal with usage counter")

Fixes: c2df3de0d07e ("gpio: zynq: properly support runtime PM for GPIO used as interrupts")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpio/gpio-zynq.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpio/gpio-zynq.c b/drivers/gpio/gpio-zynq.c
index 7835aad6d1628..88b04d8a7fa7d 100644
--- a/drivers/gpio/gpio-zynq.c
+++ b/drivers/gpio/gpio-zynq.c
@@ -556,7 +556,7 @@ static int zynq_gpio_irq_reqres(struct irq_data *d)
 	struct gpio_chip *chip = irq_data_get_irq_chip_data(d);
 	int ret;
 
-	ret = pm_runtime_get_sync(chip->parent);
+	ret = pm_runtime_resume_and_get(chip->parent);
 	if (ret < 0)
 		return ret;
 
@@ -884,7 +884,7 @@ static int zynq_gpio_probe(struct platform_device *pdev)
 
 	pm_runtime_set_active(&pdev->dev);
 	pm_runtime_enable(&pdev->dev);
-	ret = pm_runtime_get_sync(&pdev->dev);
+	ret = pm_runtime_resume_and_get(&pdev->dev);
 	if (ret < 0)
 		goto err_pm_dis;
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 012/453] gpio: mvebu: fix potential user-after-free on probe
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (10 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.4 011/453] gpio: zynq: fix reference leak in zynq_gpio functions Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.4 013/453] scsi: bnx2i: Requires MMU Greg Kroah-Hartman
                   ` (443 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Andrew Lunn, Baruch Siach,
	Bartosz Golaszewski, Sasha Levin

From: Baruch Siach <baruch@tkos.co.il>

[ Upstream commit 7ee1a01e47403f72b9f38839a737692f6991263e ]

When mvebu_pwm_probe() fails IRQ domain is not released. Move pwm probe
before IRQ domain allocation. Add pwm cleanup code to the failure path.

Fixes: 757642f9a584 ("gpio: mvebu: Add limited PWM support")
Reported-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpio/gpio-mvebu.c | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/drivers/gpio/gpio-mvebu.c b/drivers/gpio/gpio-mvebu.c
index 6c06876943412..3985d6e1c17dc 100644
--- a/drivers/gpio/gpio-mvebu.c
+++ b/drivers/gpio/gpio-mvebu.c
@@ -1196,6 +1196,13 @@ static int mvebu_gpio_probe(struct platform_device *pdev)
 
 	devm_gpiochip_add_data(&pdev->dev, &mvchip->chip, mvchip);
 
+	/* Some MVEBU SoCs have simple PWM support for GPIO lines */
+	if (IS_ENABLED(CONFIG_PWM)) {
+		err = mvebu_pwm_probe(pdev, mvchip, id);
+		if (err)
+			return err;
+	}
+
 	/* Some gpio controllers do not provide irq support */
 	if (!have_irqs)
 		return 0;
@@ -1205,7 +1212,8 @@ static int mvebu_gpio_probe(struct platform_device *pdev)
 	if (!mvchip->domain) {
 		dev_err(&pdev->dev, "couldn't allocate irq domain %s (DT).\n",
 			mvchip->chip.label);
-		return -ENODEV;
+		err = -ENODEV;
+		goto err_pwm;
 	}
 
 	err = irq_alloc_domain_generic_chips(
@@ -1253,14 +1261,12 @@ static int mvebu_gpio_probe(struct platform_device *pdev)
 						 mvchip);
 	}
 
-	/* Some MVEBU SoCs have simple PWM support for GPIO lines */
-	if (IS_ENABLED(CONFIG_PWM))
-		return mvebu_pwm_probe(pdev, mvchip, id);
-
 	return 0;
 
 err_domain:
 	irq_domain_remove(mvchip->domain);
+err_pwm:
+	pwmchip_remove(&mvchip->mvpwm->chip);
 
 	return err;
 }
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 013/453] scsi: bnx2i: Requires MMU
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (11 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.4 012/453] gpio: mvebu: fix potential user-after-free on probe Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.4 014/453] xsk: Fix xsk_poll()s return type Greg Kroah-Hartman
                   ` (442 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, linux-scsi, Nilesh Javali,
	Manish Rangankar, GR-QLogic-Storage-Upstream,
	James E.J. Bottomley, Martin K. Petersen, Randy Dunlap,
	Sasha Levin

From: Randy Dunlap <rdunlap@infradead.org>

[ Upstream commit 2d586494c4a001312650f0b919d534e429dd1e09 ]

The SCSI_BNX2_ISCSI kconfig symbol selects CNIC and CNIC selects UIO, which
depends on MMU.

Since 'select' does not follow dependency chains, add the same MMU
dependency to SCSI_BNX2_ISCSI.

Quietens this kconfig warning:

WARNING: unmet direct dependencies detected for CNIC
  Depends on [n]: NETDEVICES [=y] && ETHERNET [=y] && NET_VENDOR_BROADCOM [=y] && PCI [=y] && (IPV6 [=m] || IPV6 [=m]=n) && MMU [=n]
  Selected by [m]:
  - SCSI_BNX2_ISCSI [=m] && SCSI_LOWLEVEL [=y] && SCSI [=y] && NET [=y] && PCI [=y] && (IPV6 [=m] || IPV6 [=m]=n)

Link: https://lore.kernel.org/r/20201129070916.3919-1-rdunlap@infradead.org
Fixes: cf4e6363859d ("[SCSI] bnx2i: Add bnx2i iSCSI driver.")
Cc: linux-scsi@vger.kernel.org
Cc: Nilesh Javali <njavali@marvell.com>
Cc: Manish Rangankar <mrangankar@marvell.com>
Cc: GR-QLogic-Storage-Upstream@marvell.com
Cc: "James E.J. Bottomley" <jejb@linux.ibm.com>
Cc: "Martin K. Petersen" <martin.petersen@oracle.com>
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/bnx2i/Kconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/scsi/bnx2i/Kconfig b/drivers/scsi/bnx2i/Kconfig
index 702dc82c9501d..a0c0791abee69 100644
--- a/drivers/scsi/bnx2i/Kconfig
+++ b/drivers/scsi/bnx2i/Kconfig
@@ -4,6 +4,7 @@ config SCSI_BNX2_ISCSI
 	depends on NET
 	depends on PCI
 	depends on (IPV6 || IPV6=n)
+	depends on MMU
 	select SCSI_ISCSI_ATTRS
 	select NETDEVICES
 	select ETHERNET
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 014/453] xsk: Fix xsk_poll()s return type
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (12 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.4 013/453] scsi: bnx2i: Requires MMU Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.4 015/453] xsk: Replace datagram_poll by sock_poll_wait Greg Kroah-Hartman
                   ` (441 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Luc Van Oostenryck, Daniel Borkmann,
	Björn Töpel, Sasha Levin

From: Luc Van Oostenryck <luc.vanoostenryck@gmail.com>

[ Upstream commit 5d946c5abbaf68083fa6a41824dd79e1f06286d8 ]

xsk_poll() is defined as returning 'unsigned int' but the
.poll method is declared as returning '__poll_t', a bitwise type.

Fix this by using the proper return type and using the EPOLL
constants instead of the POLL ones, as required for __poll_t.

Signed-off-by: Luc Van Oostenryck <luc.vanoostenryck@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Björn Töpel <bjorn.topel@intel.com>
Link: https://lore.kernel.org/bpf/20191120001042.30830-1-luc.vanoostenryck@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/xdp/xsk.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c
index f9eb5efb237c7..04652797cd374 100644
--- a/net/xdp/xsk.c
+++ b/net/xdp/xsk.c
@@ -426,10 +426,10 @@ static int xsk_sendmsg(struct socket *sock, struct msghdr *m, size_t total_len)
 	return __xsk_sendmsg(sk);
 }
 
-static unsigned int xsk_poll(struct file *file, struct socket *sock,
+static __poll_t xsk_poll(struct file *file, struct socket *sock,
 			     struct poll_table_struct *wait)
 {
-	unsigned int mask = datagram_poll(file, sock, wait);
+	__poll_t mask = datagram_poll(file, sock, wait);
 	struct sock *sk = sock->sk;
 	struct xdp_sock *xs = xdp_sk(sk);
 	struct xdp_umem *umem;
@@ -448,9 +448,9 @@ static unsigned int xsk_poll(struct file *file, struct socket *sock,
 	}
 
 	if (xs->rx && !xskq_empty_desc(xs->rx))
-		mask |= POLLIN | POLLRDNORM;
+		mask |= EPOLLIN | EPOLLRDNORM;
 	if (xs->tx && !xskq_full_desc(xs->tx))
-		mask |= POLLOUT | POLLWRNORM;
+		mask |= EPOLLOUT | EPOLLWRNORM;
 
 	return mask;
 }
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 015/453] xsk: Replace datagram_poll by sock_poll_wait
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (13 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.4 014/453] xsk: Fix xsk_poll()s return type Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.4 016/453] can: softing: softing_netdev_open(): fix error handling Greg Kroah-Hartman
                   ` (440 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Xuan Zhuo, Daniel Borkmann,
	Magnus Karlsson, Sasha Levin

From: Xuan Zhuo <xuanzhuo@linux.alibaba.com>

[ Upstream commit f5da54187e33dce9bea63170667dbb0ca8d98194 ]

datagram_poll will judge the current socket status (EPOLLIN, EPOLLOUT)
based on the traditional socket information (eg: sk_wmem_alloc), but
this does not apply to xsk. So this patch uses sock_poll_wait instead of
datagram_poll, and the mask is calculated by xsk_poll.

Fixes: c497176cb2e4 ("xsk: add Rx receive functions and poll support")
Signed-off-by: Xuan Zhuo <xuanzhuo@linux.alibaba.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Magnus Karlsson <magnus.karlsson@intel.com>
Link: https://lore.kernel.org/bpf/e82f4697438cd63edbf271ebe1918db8261b7c09.1606555939.git.xuanzhuo@linux.alibaba.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/xdp/xsk.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c
index 04652797cd374..2bc0d6e3e124c 100644
--- a/net/xdp/xsk.c
+++ b/net/xdp/xsk.c
@@ -429,11 +429,13 @@ static int xsk_sendmsg(struct socket *sock, struct msghdr *m, size_t total_len)
 static __poll_t xsk_poll(struct file *file, struct socket *sock,
 			     struct poll_table_struct *wait)
 {
-	__poll_t mask = datagram_poll(file, sock, wait);
+	__poll_t mask = 0;
 	struct sock *sk = sock->sk;
 	struct xdp_sock *xs = xdp_sk(sk);
 	struct xdp_umem *umem;
 
+	sock_poll_wait(file, sock, wait);
+
 	if (unlikely(!xsk_is_bound(xs)))
 		return mask;
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 016/453] can: softing: softing_netdev_open(): fix error handling
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (14 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.4 015/453] xsk: Replace datagram_poll by sock_poll_wait Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.4 017/453] clk: renesas: r9a06g032: Drop __packed for portability Greg Kroah-Hartman
                   ` (439 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Zhang Qilong, Kurt Van Dijck,
	Marc Kleine-Budde, Jakub Kicinski, Sasha Levin

From: Zhang Qilong <zhangqilong3@huawei.com>

[ Upstream commit 4d1be581ec6b92a338bb7ed23e1381f45ddf336f ]

If softing_netdev_open() fails, we should call close_candev() to avoid
reference leak.

Fixes: 03fd3cf5a179d ("can: add driver for Softing card")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Acked-by: Kurt Van Dijck <dev.kurt@vandijck-laurijssen.be>
Link: https://lore.kernel.org/r/20201202151632.1343786-1-zhangqilong3@huawei.com
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Link: https://lore.kernel.org/r/20201204133508.742120-2-mkl@pengutronix.de
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/can/softing/softing_main.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/drivers/net/can/softing/softing_main.c b/drivers/net/can/softing/softing_main.c
index 8242fb287cbbe..16e3f55efa311 100644
--- a/drivers/net/can/softing/softing_main.c
+++ b/drivers/net/can/softing/softing_main.c
@@ -382,8 +382,13 @@ static int softing_netdev_open(struct net_device *ndev)
 
 	/* check or determine and set bittime */
 	ret = open_candev(ndev);
-	if (!ret)
-		ret = softing_startstop(ndev, 1);
+	if (ret)
+		return ret;
+
+	ret = softing_startstop(ndev, 1);
+	if (ret < 0)
+		close_candev(ndev);
+
 	return ret;
 }
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 017/453] clk: renesas: r9a06g032: Drop __packed for portability
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (15 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.4 016/453] can: softing: softing_netdev_open(): fix error handling Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.4 018/453] block: Simplify REQ_OP_ZONE_RESET_ALL handling Greg Kroah-Hartman
                   ` (438 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Stephen Rothwell, Geert Uytterhoeven,
	Stephen Boyd, Sasha Levin

From: Geert Uytterhoeven <geert+renesas@glider.be>

[ Upstream commit ceabbf94c317c6175dee6e91805fca4a6353745a ]

The R9A06G032 clock driver uses an array of packed structures to reduce
kernel size.  However, this array contains pointers, which are no longer
aligned naturally, and cannot be relocated on PPC64.  Hence when
compile-testing this driver on PPC64 with CONFIG_RELOCATABLE=y (e.g.
PowerPC allyesconfig), the following warnings are produced:

    WARNING: 136 bad relocations
    c000000000616be3 R_PPC64_UADDR64   .rodata+0x00000000000cf338
    c000000000616bfe R_PPC64_UADDR64   .rodata+0x00000000000cf370
    ...

Fix this by dropping the __packed attribute from the r9a06g032_clkdesc
definition, trading a small size increase for portability.

This increases the 156-entry clock table by 1 byte per entry, but due to
the compiler generating more efficient code for unpacked accesses, the
net size increase is only 76 bytes (gcc 9.3.0 on arm32).

Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
Fixes: 4c3d88526eba2143 ("clk: renesas: Renesas R9A06G032 clock driver")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://lore.kernel.org/r/20201130085743.1656317-1-geert+renesas@glider.be
Tested-by: Stephen Rothwell <sfr@canb.auug.org.au> # PowerPC allyesconfig build
Acked-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/renesas/r9a06g032-clocks.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/clk/renesas/r9a06g032-clocks.c b/drivers/clk/renesas/r9a06g032-clocks.c
index 1907ee195a08c..f2dc625b745da 100644
--- a/drivers/clk/renesas/r9a06g032-clocks.c
+++ b/drivers/clk/renesas/r9a06g032-clocks.c
@@ -55,7 +55,7 @@ struct r9a06g032_clkdesc {
 			u16 sel, g1, r1, g2, r2;
 		} dual;
 	};
-} __packed;
+};
 
 #define I_GATE(_clk, _rst, _rdy, _midle, _scon, _mirack, _mistat) \
 	{ .gate = _clk, .reset = _rst, \
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 018/453] block: Simplify REQ_OP_ZONE_RESET_ALL handling
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (16 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.4 017/453] clk: renesas: r9a06g032: Drop __packed for portability Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.4 019/453] block: factor out requeue handling from dispatch code Greg Kroah-Hartman
                   ` (437 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christoph Hellwig, Damien Le Moal,
	Jens Axboe, Sasha Levin

From: Damien Le Moal <damien.lemoal@wdc.com>

[ Upstream commit c7a1d926dc4076aadad187614500afcd8de78818 ]

There is no need for the function __blkdev_reset_all_zones() as
REQ_OP_ZONE_RESET_ALL can be handled directly in blkdev_reset_zones()
bio loop with an early break from the loop. This patch removes this
function and modifies blkdev_reset_zones(), simplifying the code.

Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Damien Le Moal <damien.lemoal@wdc.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 block/blk-zoned.c | 40 +++++++++++++---------------------------
 1 file changed, 13 insertions(+), 27 deletions(-)

diff --git a/block/blk-zoned.c b/block/blk-zoned.c
index 4bc5f260248a6..b17c094cb977c 100644
--- a/block/blk-zoned.c
+++ b/block/blk-zoned.c
@@ -202,32 +202,14 @@ int blkdev_report_zones(struct block_device *bdev, sector_t sector,
 }
 EXPORT_SYMBOL_GPL(blkdev_report_zones);
 
-/*
- * Special case of zone reset operation to reset all zones in one command,
- * useful for applications like mkfs.
- */
-static int __blkdev_reset_all_zones(struct block_device *bdev, gfp_t gfp_mask)
-{
-	struct bio *bio = bio_alloc(gfp_mask, 0);
-	int ret;
-
-	/* across the zones operations, don't need any sectors */
-	bio_set_dev(bio, bdev);
-	bio_set_op_attrs(bio, REQ_OP_ZONE_RESET_ALL, 0);
-
-	ret = submit_bio_wait(bio);
-	bio_put(bio);
-
-	return ret;
-}
-
 static inline bool blkdev_allow_reset_all_zones(struct block_device *bdev,
+						sector_t sector,
 						sector_t nr_sectors)
 {
 	if (!blk_queue_zone_resetall(bdev_get_queue(bdev)))
 		return false;
 
-	if (nr_sectors != part_nr_sects_read(bdev->bd_part))
+	if (sector || nr_sectors != part_nr_sects_read(bdev->bd_part))
 		return false;
 	/*
 	 * REQ_OP_ZONE_RESET_ALL can be executed only if the block device is
@@ -271,9 +253,6 @@ int blkdev_reset_zones(struct block_device *bdev,
 		/* Out of range */
 		return -EINVAL;
 
-	if (blkdev_allow_reset_all_zones(bdev, nr_sectors))
-		return  __blkdev_reset_all_zones(bdev, gfp_mask);
-
 	/* Check alignment (handle eventual smaller last zone) */
 	zone_sectors = blk_queue_zone_sectors(q);
 	if (sector & (zone_sectors - 1))
@@ -285,17 +264,24 @@ int blkdev_reset_zones(struct block_device *bdev,
 
 	blk_start_plug(&plug);
 	while (sector < end_sector) {
-
 		bio = blk_next_bio(bio, 0, gfp_mask);
-		bio->bi_iter.bi_sector = sector;
 		bio_set_dev(bio, bdev);
-		bio_set_op_attrs(bio, REQ_OP_ZONE_RESET, 0);
 
+		/*
+		 * Special case for the zone reset operation that reset all
+		 * zones, this is useful for applications like mkfs.
+		 */
+		if (blkdev_allow_reset_all_zones(bdev, sector, nr_sectors)) {
+			bio->bi_opf = REQ_OP_ZONE_RESET_ALL;
+			break;
+		}
+
+		bio->bi_opf = REQ_OP_ZONE_RESET;
+		bio->bi_iter.bi_sector = sector;
 		sector += zone_sectors;
 
 		/* This may take a while, so be nice to others */
 		cond_resched();
-
 	}
 
 	ret = submit_bio_wait(bio);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 019/453] block: factor out requeue handling from dispatch code
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (17 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.4 018/453] block: Simplify REQ_OP_ZONE_RESET_ALL handling Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.4 020/453] blk-mq: In blk_mq_dispatch_rq_list() "no budget" is a reason to kick Greg Kroah-Hartman
                   ` (436 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Johannes Thumshirn,
	Christoph Hellwig, Jens Axboe, Sasha Levin

From: Johannes Thumshirn <johannes.thumshirn@wdc.com>

[ Upstream commit c92a41031a6d57395889b5c87cea359220a24d2a ]

Factor out the requeue handling from the dispatch code, this will make
subsequent addition of different requeueing schemes easier.

Signed-off-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 block/blk-mq.c | 29 ++++++++++++++++++-----------
 1 file changed, 18 insertions(+), 11 deletions(-)

diff --git a/block/blk-mq.c b/block/blk-mq.c
index b748d1e63f9c8..c0efd3e278da6 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -1205,6 +1205,23 @@ static void blk_mq_update_dispatch_busy(struct blk_mq_hw_ctx *hctx, bool busy)
 
 #define BLK_MQ_RESOURCE_DELAY	3		/* ms units */
 
+static void blk_mq_handle_dev_resource(struct request *rq,
+				       struct list_head *list)
+{
+	struct request *next =
+		list_first_entry_or_null(list, struct request, queuelist);
+
+	/*
+	 * If an I/O scheduler has been configured and we got a driver tag for
+	 * the next request already, free it.
+	 */
+	if (next)
+		blk_mq_put_driver_tag(next);
+
+	list_add(&rq->queuelist, list);
+	__blk_mq_requeue_request(rq);
+}
+
 /*
  * Returns true if we did some work AND can potentially do more.
  */
@@ -1274,17 +1291,7 @@ bool blk_mq_dispatch_rq_list(struct request_queue *q, struct list_head *list,
 
 		ret = q->mq_ops->queue_rq(hctx, &bd);
 		if (ret == BLK_STS_RESOURCE || ret == BLK_STS_DEV_RESOURCE) {
-			/*
-			 * If an I/O scheduler has been configured and we got a
-			 * driver tag for the next request already, free it
-			 * again.
-			 */
-			if (!list_empty(list)) {
-				nxt = list_first_entry(list, struct request, queuelist);
-				blk_mq_put_driver_tag(nxt);
-			}
-			list_add(&rq->queuelist, list);
-			__blk_mq_requeue_request(rq);
+			blk_mq_handle_dev_resource(rq, list);
 			break;
 		}
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 020/453] blk-mq: In blk_mq_dispatch_rq_list() "no budget" is a reason to kick
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (18 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.4 019/453] block: factor out requeue handling from dispatch code Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.4 021/453] pinctrl: aspeed: Fix GPIO requests on pass-through banks Greg Kroah-Hartman
                   ` (435 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Douglas Anderson, Ming Lei,
	Jens Axboe, Sasha Levin

From: Douglas Anderson <dianders@chromium.org>

[ Upstream commit ab3cee3762e5e69f27c302c43691289fdfc12316 ]

In blk_mq_dispatch_rq_list(), if blk_mq_sched_needs_restart() returns
true and the driver returns BLK_STS_RESOURCE then we'll kick the
queue.  However, there's another case where we might need to kick it.
If we were unable to get budget we can be in much the same state as
when the driver returns BLK_STS_RESOURCE, so we should treat it the
same.

It should be noted that even if we add a whole bunch of extra kicking
to the queue in other patches this patch is still important.
Specifically any kicking that happened before we re-spliced leftover
requests into 'hctx->dispatch' wouldn't have found any work, so we
really need to make sure we kick ourselves after we've done the
splicing.

Signed-off-by: Douglas Anderson <dianders@chromium.org>
Reviewed-by: Ming Lei <ming.lei@redhat.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 block/blk-mq.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/block/blk-mq.c b/block/blk-mq.c
index c0efd3e278da6..057a634396a90 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -1233,6 +1233,7 @@ bool blk_mq_dispatch_rq_list(struct request_queue *q, struct list_head *list,
 	bool no_tag = false;
 	int errors, queued;
 	blk_status_t ret = BLK_STS_OK;
+	bool no_budget_avail = false;
 
 	if (list_empty(list))
 		return false;
@@ -1251,6 +1252,7 @@ bool blk_mq_dispatch_rq_list(struct request_queue *q, struct list_head *list,
 		hctx = rq->mq_hctx;
 		if (!got_budget && !blk_mq_get_dispatch_budget(hctx)) {
 			blk_mq_put_driver_tag(rq);
+			no_budget_avail = true;
 			break;
 		}
 
@@ -1356,13 +1358,15 @@ bool blk_mq_dispatch_rq_list(struct request_queue *q, struct list_head *list,
 		 *
 		 * If driver returns BLK_STS_RESOURCE and SCHED_RESTART
 		 * bit is set, run queue after a delay to avoid IO stalls
-		 * that could otherwise occur if the queue is idle.
+		 * that could otherwise occur if the queue is idle.  We'll do
+		 * similar if we couldn't get budget and SCHED_RESTART is set.
 		 */
 		needs_restart = blk_mq_sched_needs_restart(hctx);
 		if (!needs_restart ||
 		    (no_tag && list_empty_careful(&hctx->dispatch_wait.entry)))
 			blk_mq_run_hw_queue(hctx, true);
-		else if (needs_restart && (ret == BLK_STS_RESOURCE))
+		else if (needs_restart && (ret == BLK_STS_RESOURCE ||
+					   no_budget_avail))
 			blk_mq_delay_run_hw_queue(hctx, BLK_MQ_RESOURCE_DELAY);
 
 		blk_mq_update_dispatch_busy(hctx, true);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 021/453] pinctrl: aspeed: Fix GPIO requests on pass-through banks
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (19 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.4 020/453] blk-mq: In blk_mq_dispatch_rq_list() "no budget" is a reason to kick Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.4 022/453] netfilter: x_tables: Switch synchronization to RCU Greg Kroah-Hartman
                   ` (434 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Andrew Jeffery, Joel Stanley,
	Billy Tsai, Linus Walleij, Sasha Levin

From: Andrew Jeffery <andrew@aj.id.au>

[ Upstream commit 7aeb353802611a8e655e019f09a370ff682af1a6 ]

Commit 6726fbff19bf ("pinctrl: aspeed: Fix GPI only function problem.")
fixes access to GPIO banks T and U on the AST2600. Both banks contain
input-only pins and the GPIO pin function is named GPITx and GPIUx
respectively. Unfortunately the fix had a negative impact on GPIO banks
D and E for the AST2400 and AST2500 where the GPIO pass-through
functions take similar "GPI"-style names. The net effect on the older
SoCs was that when the GPIO subsystem requested a pin in banks D or E be
muxed for GPIO, they were instead muxed for pass-through mode.
Mistakenly muxing pass-through mode e.g. breaks booting the host on
IBM's Witherspoon (AC922) platform where GPIOE0 is used for FSI.

Further exploit the names in the provided expression structure to
differentiate pass-through from pin-specific GPIO modes.

This follow-up fix gives the expected behaviour for the following tests:

Witherspoon BMC (AST2500):

1. Power-on the Witherspoon host
2. Request GPIOD1 be muxed via /sys/class/gpio/export
3. Request GPIOE1 be muxed via /sys/class/gpio/export
4. Request the balls for GPIOs E2 and E3 be muxed as GPIO pass-through
   ("GPIE2" mode) via a pinctrl hog in the devicetree

Rainier BMC (AST2600):

5. Request GPIT0 be muxed via /sys/class/gpio/export
6. Request GPIU0 be muxed via /sys/class/gpio/export

Together the tests demonstrate that all three pieces of functionality
(general GPIOs via 1, 2 and 3, input-only GPIOs via 5 and 6, pass-through
mode via 4) operate as desired across old and new SoCs.

Fixes: 9b92f5c51e9a ("pinctrl: aspeed: Fix GPI only function problem.")
Signed-off-by: Andrew Jeffery <andrew@aj.id.au>
Tested-by: Joel Stanley <joel@jms.id.au>
Reviewed-by: Joel Stanley <joel@jms.id.au>
Cc: Billy Tsai <billy_tsai@aspeedtech.com>
Cc: Joel Stanley <joel@jms.id.au>
Link: https://lore.kernel.org/r/20201126063337.489927-1-andrew@aj.id.au
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pinctrl/aspeed/pinctrl-aspeed.c | 74 +++++++++++++++++++++++--
 drivers/pinctrl/aspeed/pinmux-aspeed.h  |  7 ++-
 2 files changed, 72 insertions(+), 9 deletions(-)

diff --git a/drivers/pinctrl/aspeed/pinctrl-aspeed.c b/drivers/pinctrl/aspeed/pinctrl-aspeed.c
index 93b5654ff2828..22aca6d182c0c 100644
--- a/drivers/pinctrl/aspeed/pinctrl-aspeed.c
+++ b/drivers/pinctrl/aspeed/pinctrl-aspeed.c
@@ -277,14 +277,76 @@ int aspeed_pinmux_set_mux(struct pinctrl_dev *pctldev, unsigned int function,
 static bool aspeed_expr_is_gpio(const struct aspeed_sig_expr *expr)
 {
 	/*
-	 * The signal type is GPIO if the signal name has "GPI" as a prefix.
-	 * strncmp (rather than strcmp) is used to implement the prefix
-	 * requirement.
+	 * We need to differentiate between GPIO and non-GPIO signals to
+	 * implement the gpio_request_enable() interface. For better or worse
+	 * the ASPEED pinctrl driver uses the expression names to determine
+	 * whether an expression will mux a pin for GPIO.
 	 *
-	 * expr->signal might look like "GPIOB1" in the GPIO case.
-	 * expr->signal might look like "GPIT0" in the GPI case.
+	 * Generally we have the following - A GPIO such as B1 has:
+	 *
+	 *    - expr->signal set to "GPIOB1"
+	 *    - expr->function set to "GPIOB1"
+	 *
+	 * Using this fact we can determine whether the provided expression is
+	 * a GPIO expression by testing the signal name for the string prefix
+	 * "GPIO".
+	 *
+	 * However, some GPIOs are input-only, and the ASPEED datasheets name
+	 * them differently. An input-only GPIO such as T0 has:
+	 *
+	 *    - expr->signal set to "GPIT0"
+	 *    - expr->function set to "GPIT0"
+	 *
+	 * It's tempting to generalise the prefix test from "GPIO" to "GPI" to
+	 * account for both GPIOs and GPIs, but in doing so we run aground on
+	 * another feature:
+	 *
+	 * Some pins in the ASPEED BMC SoCs have a "pass-through" GPIO
+	 * function where the input state of one pin is replicated as the
+	 * output state of another (as if they were shorted together - a mux
+	 * configuration that is typically enabled by hardware strapping).
+	 * This feature allows the BMC to pass e.g. power button state through
+	 * to the host while the BMC is yet to boot, but take control of the
+	 * button state once the BMC has booted by muxing each pin as a
+	 * separate, pin-specific GPIO.
+	 *
+	 * Conceptually this pass-through mode is a form of GPIO and is named
+	 * as such in the datasheets, e.g. "GPID0". This naming similarity
+	 * trips us up with the simple GPI-prefixed-signal-name scheme
+	 * discussed above, as the pass-through configuration is not what we
+	 * want when muxing a pin as GPIO for the GPIO subsystem.
+	 *
+	 * On e.g. the AST2400, a pass-through function "GPID0" is grouped on
+	 * balls A18 and D16, where we have:
+	 *
+	 *    For ball A18:
+	 *    - expr->signal set to "GPID0IN"
+	 *    - expr->function set to "GPID0"
+	 *
+	 *    For ball D16:
+	 *    - expr->signal set to "GPID0OUT"
+	 *    - expr->function set to "GPID0"
+	 *
+	 * By contrast, the pin-specific GPIO expressions for the same pins are
+	 * as follows:
+	 *
+	 *    For ball A18:
+	 *    - expr->signal looks like "GPIOD0"
+	 *    - expr->function looks like "GPIOD0"
+	 *
+	 *    For ball D16:
+	 *    - expr->signal looks like "GPIOD1"
+	 *    - expr->function looks like "GPIOD1"
+	 *
+	 * Testing both the signal _and_ function names gives us the means
+	 * differentiate the pass-through GPIO pinmux configuration from the
+	 * pin-specific configuration that the GPIO subsystem is after: An
+	 * expression is a pin-specific (non-pass-through) GPIO configuration
+	 * if the signal prefix is "GPI" and the signal name matches the
+	 * function name.
 	 */
-	return strncmp(expr->signal, "GPI", 3) == 0;
+	return !strncmp(expr->signal, "GPI", 3) &&
+			!strcmp(expr->signal, expr->function);
 }
 
 static bool aspeed_gpio_in_exprs(const struct aspeed_sig_expr **exprs)
diff --git a/drivers/pinctrl/aspeed/pinmux-aspeed.h b/drivers/pinctrl/aspeed/pinmux-aspeed.h
index 140c5ce9fbc11..0aaa20653536f 100644
--- a/drivers/pinctrl/aspeed/pinmux-aspeed.h
+++ b/drivers/pinctrl/aspeed/pinmux-aspeed.h
@@ -452,10 +452,11 @@ struct aspeed_sig_desc {
  * evaluation of the descriptors.
  *
  * @signal: The signal name for the priority level on the pin. If the signal
- *          type is GPIO, then the signal name must begin with the string
- *          "GPIO", e.g. GPIOA0, GPIOT4 etc.
+ *          type is GPIO, then the signal name must begin with the
+ *          prefix "GPI", e.g. GPIOA0, GPIT0 etc.
  * @function: The name of the function the signal participates in for the
- *            associated expression
+ *            associated expression. For pin-specific GPIO, the function
+ *            name must match the signal name.
  * @ndescs: The number of signal descriptors in the expression
  * @descs: Pointer to an array of signal descriptors that comprise the
  *         function expression
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 022/453] netfilter: x_tables: Switch synchronization to RCU
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (20 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.4 021/453] pinctrl: aspeed: Fix GPIO requests on pass-through banks Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.4 023/453] netfilter: nft_compat: make sure xtables destructors have run Greg Kroah-Hartman
                   ` (433 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sean Tranchetti, kernel test robot,
	Florian Westphal, Subash Abhinov Kasiviswanathan,
	Pablo Neira Ayuso, Sasha Levin

From: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>

[ Upstream commit cc00bcaa589914096edef7fb87ca5cee4a166b5c ]

When running concurrent iptables rules replacement with data, the per CPU
sequence count is checked after the assignment of the new information.
The sequence count is used to synchronize with the packet path without the
use of any explicit locking. If there are any packets in the packet path using
the table information, the sequence count is incremented to an odd value and
is incremented to an even after the packet process completion.

The new table value assignment is followed by a write memory barrier so every
CPU should see the latest value. If the packet path has started with the old
table information, the sequence counter will be odd and the iptables
replacement will wait till the sequence count is even prior to freeing the
old table info.

However, this assumes that the new table information assignment and the memory
barrier is actually executed prior to the counter check in the replacement
thread. If CPU decides to execute the assignment later as there is no user of
the table information prior to the sequence check, the packet path in another
CPU may use the old table information. The replacement thread would then free
the table information under it leading to a use after free in the packet
processing context-

Unable to handle kernel NULL pointer dereference at virtual
address 000000000000008e
pc : ip6t_do_table+0x5d0/0x89c
lr : ip6t_do_table+0x5b8/0x89c
ip6t_do_table+0x5d0/0x89c
ip6table_filter_hook+0x24/0x30
nf_hook_slow+0x84/0x120
ip6_input+0x74/0xe0
ip6_rcv_finish+0x7c/0x128
ipv6_rcv+0xac/0xe4
__netif_receive_skb+0x84/0x17c
process_backlog+0x15c/0x1b8
napi_poll+0x88/0x284
net_rx_action+0xbc/0x23c
__do_softirq+0x20c/0x48c

This could be fixed by forcing instruction order after the new table
information assignment or by switching to RCU for the synchronization.

Fixes: 80055dab5de0 ("netfilter: x_tables: make xt_replace_table wait until old rules are not used anymore")
Reported-by: Sean Tranchetti <stranche@codeaurora.org>
Reported-by: kernel test robot <lkp@intel.com>
Suggested-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/netfilter/x_tables.h |  5 ++-
 net/ipv4/netfilter/arp_tables.c    | 14 ++++-----
 net/ipv4/netfilter/ip_tables.c     | 14 ++++-----
 net/ipv6/netfilter/ip6_tables.c    | 14 ++++-----
 net/netfilter/x_tables.c           | 49 +++++++++---------------------
 5 files changed, 40 insertions(+), 56 deletions(-)

diff --git a/include/linux/netfilter/x_tables.h b/include/linux/netfilter/x_tables.h
index 1b261c51b3a3a..f5c21b7d29748 100644
--- a/include/linux/netfilter/x_tables.h
+++ b/include/linux/netfilter/x_tables.h
@@ -227,7 +227,7 @@ struct xt_table {
 	unsigned int valid_hooks;
 
 	/* Man behind the curtain... */
-	struct xt_table_info *private;
+	struct xt_table_info __rcu *private;
 
 	/* Set this to THIS_MODULE if you are a module, otherwise NULL */
 	struct module *me;
@@ -448,6 +448,9 @@ xt_get_per_cpu_counter(struct xt_counters *cnt, unsigned int cpu)
 
 struct nf_hook_ops *xt_hook_ops_alloc(const struct xt_table *, nf_hookfn *);
 
+struct xt_table_info
+*xt_table_get_private_protected(const struct xt_table *table);
+
 #ifdef CONFIG_COMPAT
 #include <net/compat.h>
 
diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index f1f78a742b36a..8a6a4384e7916 100644
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -203,7 +203,7 @@ unsigned int arpt_do_table(struct sk_buff *skb,
 
 	local_bh_disable();
 	addend = xt_write_recseq_begin();
-	private = READ_ONCE(table->private); /* Address dependency. */
+	private = rcu_access_pointer(table->private);
 	cpu     = smp_processor_id();
 	table_base = private->entries;
 	jumpstack  = (struct arpt_entry **)private->jumpstack[cpu];
@@ -649,7 +649,7 @@ static struct xt_counters *alloc_counters(const struct xt_table *table)
 {
 	unsigned int countersize;
 	struct xt_counters *counters;
-	const struct xt_table_info *private = table->private;
+	const struct xt_table_info *private = xt_table_get_private_protected(table);
 
 	/* We need atomic snapshot of counters: rest doesn't change
 	 * (other than comefrom, which userspace doesn't care
@@ -673,7 +673,7 @@ static int copy_entries_to_user(unsigned int total_size,
 	unsigned int off, num;
 	const struct arpt_entry *e;
 	struct xt_counters *counters;
-	struct xt_table_info *private = table->private;
+	struct xt_table_info *private = xt_table_get_private_protected(table);
 	int ret = 0;
 	void *loc_cpu_entry;
 
@@ -808,7 +808,7 @@ static int get_info(struct net *net, void __user *user,
 	t = xt_request_find_table_lock(net, NFPROTO_ARP, name);
 	if (!IS_ERR(t)) {
 		struct arpt_getinfo info;
-		const struct xt_table_info *private = t->private;
+		const struct xt_table_info *private = xt_table_get_private_protected(t);
 #ifdef CONFIG_COMPAT
 		struct xt_table_info tmp;
 
@@ -861,7 +861,7 @@ static int get_entries(struct net *net, struct arpt_get_entries __user *uptr,
 
 	t = xt_find_table_lock(net, NFPROTO_ARP, get.name);
 	if (!IS_ERR(t)) {
-		const struct xt_table_info *private = t->private;
+		const struct xt_table_info *private = xt_table_get_private_protected(t);
 
 		if (get.size == private->size)
 			ret = copy_entries_to_user(private->size,
@@ -1020,7 +1020,7 @@ static int do_add_counters(struct net *net, const void __user *user,
 	}
 
 	local_bh_disable();
-	private = t->private;
+	private = xt_table_get_private_protected(t);
 	if (private->number != tmp.num_counters) {
 		ret = -EINVAL;
 		goto unlock_up_free;
@@ -1357,7 +1357,7 @@ static int compat_copy_entries_to_user(unsigned int total_size,
 				       void __user *userptr)
 {
 	struct xt_counters *counters;
-	const struct xt_table_info *private = table->private;
+	const struct xt_table_info *private = xt_table_get_private_protected(table);
 	void __user *pos;
 	unsigned int size;
 	int ret = 0;
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index 10b91ebdf2131..4852769995440 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -258,7 +258,7 @@ ipt_do_table(struct sk_buff *skb,
 	WARN_ON(!(table->valid_hooks & (1 << hook)));
 	local_bh_disable();
 	addend = xt_write_recseq_begin();
-	private = READ_ONCE(table->private); /* Address dependency. */
+	private = rcu_access_pointer(table->private);
 	cpu        = smp_processor_id();
 	table_base = private->entries;
 	jumpstack  = (struct ipt_entry **)private->jumpstack[cpu];
@@ -791,7 +791,7 @@ static struct xt_counters *alloc_counters(const struct xt_table *table)
 {
 	unsigned int countersize;
 	struct xt_counters *counters;
-	const struct xt_table_info *private = table->private;
+	const struct xt_table_info *private = xt_table_get_private_protected(table);
 
 	/* We need atomic snapshot of counters: rest doesn't change
 	   (other than comefrom, which userspace doesn't care
@@ -815,7 +815,7 @@ copy_entries_to_user(unsigned int total_size,
 	unsigned int off, num;
 	const struct ipt_entry *e;
 	struct xt_counters *counters;
-	const struct xt_table_info *private = table->private;
+	const struct xt_table_info *private = xt_table_get_private_protected(table);
 	int ret = 0;
 	const void *loc_cpu_entry;
 
@@ -965,7 +965,7 @@ static int get_info(struct net *net, void __user *user,
 	t = xt_request_find_table_lock(net, AF_INET, name);
 	if (!IS_ERR(t)) {
 		struct ipt_getinfo info;
-		const struct xt_table_info *private = t->private;
+		const struct xt_table_info *private = xt_table_get_private_protected(t);
 #ifdef CONFIG_COMPAT
 		struct xt_table_info tmp;
 
@@ -1019,7 +1019,7 @@ get_entries(struct net *net, struct ipt_get_entries __user *uptr,
 
 	t = xt_find_table_lock(net, AF_INET, get.name);
 	if (!IS_ERR(t)) {
-		const struct xt_table_info *private = t->private;
+		const struct xt_table_info *private = xt_table_get_private_protected(t);
 		if (get.size == private->size)
 			ret = copy_entries_to_user(private->size,
 						   t, uptr->entrytable);
@@ -1175,7 +1175,7 @@ do_add_counters(struct net *net, const void __user *user,
 	}
 
 	local_bh_disable();
-	private = t->private;
+	private = xt_table_get_private_protected(t);
 	if (private->number != tmp.num_counters) {
 		ret = -EINVAL;
 		goto unlock_up_free;
@@ -1570,7 +1570,7 @@ compat_copy_entries_to_user(unsigned int total_size, struct xt_table *table,
 			    void __user *userptr)
 {
 	struct xt_counters *counters;
-	const struct xt_table_info *private = table->private;
+	const struct xt_table_info *private = xt_table_get_private_protected(table);
 	void __user *pos;
 	unsigned int size;
 	int ret = 0;
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index c973ace208c51..12735ee7713a7 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -280,7 +280,7 @@ ip6t_do_table(struct sk_buff *skb,
 
 	local_bh_disable();
 	addend = xt_write_recseq_begin();
-	private = READ_ONCE(table->private); /* Address dependency. */
+	private = rcu_access_pointer(table->private);
 	cpu        = smp_processor_id();
 	table_base = private->entries;
 	jumpstack  = (struct ip6t_entry **)private->jumpstack[cpu];
@@ -807,7 +807,7 @@ static struct xt_counters *alloc_counters(const struct xt_table *table)
 {
 	unsigned int countersize;
 	struct xt_counters *counters;
-	const struct xt_table_info *private = table->private;
+	const struct xt_table_info *private = xt_table_get_private_protected(table);
 
 	/* We need atomic snapshot of counters: rest doesn't change
 	   (other than comefrom, which userspace doesn't care
@@ -831,7 +831,7 @@ copy_entries_to_user(unsigned int total_size,
 	unsigned int off, num;
 	const struct ip6t_entry *e;
 	struct xt_counters *counters;
-	const struct xt_table_info *private = table->private;
+	const struct xt_table_info *private = xt_table_get_private_protected(table);
 	int ret = 0;
 	const void *loc_cpu_entry;
 
@@ -981,7 +981,7 @@ static int get_info(struct net *net, void __user *user,
 	t = xt_request_find_table_lock(net, AF_INET6, name);
 	if (!IS_ERR(t)) {
 		struct ip6t_getinfo info;
-		const struct xt_table_info *private = t->private;
+		const struct xt_table_info *private = xt_table_get_private_protected(t);
 #ifdef CONFIG_COMPAT
 		struct xt_table_info tmp;
 
@@ -1036,7 +1036,7 @@ get_entries(struct net *net, struct ip6t_get_entries __user *uptr,
 
 	t = xt_find_table_lock(net, AF_INET6, get.name);
 	if (!IS_ERR(t)) {
-		struct xt_table_info *private = t->private;
+		struct xt_table_info *private = xt_table_get_private_protected(t);
 		if (get.size == private->size)
 			ret = copy_entries_to_user(private->size,
 						   t, uptr->entrytable);
@@ -1191,7 +1191,7 @@ do_add_counters(struct net *net, const void __user *user, unsigned int len,
 	}
 
 	local_bh_disable();
-	private = t->private;
+	private = xt_table_get_private_protected(t);
 	if (private->number != tmp.num_counters) {
 		ret = -EINVAL;
 		goto unlock_up_free;
@@ -1579,7 +1579,7 @@ compat_copy_entries_to_user(unsigned int total_size, struct xt_table *table,
 			    void __user *userptr)
 {
 	struct xt_counters *counters;
-	const struct xt_table_info *private = table->private;
+	const struct xt_table_info *private = xt_table_get_private_protected(table);
 	void __user *pos;
 	unsigned int size;
 	int ret = 0;
diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
index 44f971f319920..d1ef2d7930739 100644
--- a/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@ -1349,6 +1349,14 @@ struct xt_counters *xt_counters_alloc(unsigned int counters)
 }
 EXPORT_SYMBOL(xt_counters_alloc);
 
+struct xt_table_info
+*xt_table_get_private_protected(const struct xt_table *table)
+{
+	return rcu_dereference_protected(table->private,
+					 mutex_is_locked(&xt[table->af].mutex));
+}
+EXPORT_SYMBOL(xt_table_get_private_protected);
+
 struct xt_table_info *
 xt_replace_table(struct xt_table *table,
 	      unsigned int num_counters,
@@ -1356,7 +1364,6 @@ xt_replace_table(struct xt_table *table,
 	      int *error)
 {
 	struct xt_table_info *private;
-	unsigned int cpu;
 	int ret;
 
 	ret = xt_jumpstack_alloc(newinfo);
@@ -1366,47 +1373,20 @@ xt_replace_table(struct xt_table *table,
 	}
 
 	/* Do the substitution. */
-	local_bh_disable();
-	private = table->private;
+	private = xt_table_get_private_protected(table);
 
 	/* Check inside lock: is the old number correct? */
 	if (num_counters != private->number) {
 		pr_debug("num_counters != table->private->number (%u/%u)\n",
 			 num_counters, private->number);
-		local_bh_enable();
 		*error = -EAGAIN;
 		return NULL;
 	}
 
 	newinfo->initial_entries = private->initial_entries;
-	/*
-	 * Ensure contents of newinfo are visible before assigning to
-	 * private.
-	 */
-	smp_wmb();
-	table->private = newinfo;
-
-	/* make sure all cpus see new ->private value */
-	smp_wmb();
 
-	/*
-	 * Even though table entries have now been swapped, other CPU's
-	 * may still be using the old entries...
-	 */
-	local_bh_enable();
-
-	/* ... so wait for even xt_recseq on all cpus */
-	for_each_possible_cpu(cpu) {
-		seqcount_t *s = &per_cpu(xt_recseq, cpu);
-		u32 seq = raw_read_seqcount(s);
-
-		if (seq & 1) {
-			do {
-				cond_resched();
-				cpu_relax();
-			} while (seq == raw_read_seqcount(s));
-		}
-	}
+	rcu_assign_pointer(table->private, newinfo);
+	synchronize_rcu();
 
 #ifdef CONFIG_AUDIT
 	if (audit_enabled) {
@@ -1447,12 +1427,12 @@ struct xt_table *xt_register_table(struct net *net,
 	}
 
 	/* Simplifies replace_table code. */
-	table->private = bootstrap;
+	rcu_assign_pointer(table->private, bootstrap);
 
 	if (!xt_replace_table(table, 0, newinfo, &ret))
 		goto unlock;
 
-	private = table->private;
+	private = xt_table_get_private_protected(table);
 	pr_debug("table->private->number = %u\n", private->number);
 
 	/* save number of initial entries */
@@ -1475,7 +1455,8 @@ void *xt_unregister_table(struct xt_table *table)
 	struct xt_table_info *private;
 
 	mutex_lock(&xt[table->af].mutex);
-	private = table->private;
+	private = xt_table_get_private_protected(table);
+	RCU_INIT_POINTER(table->private, NULL);
 	list_del(&table->list);
 	mutex_unlock(&xt[table->af].mutex);
 	kfree(table);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 023/453] netfilter: nft_compat: make sure xtables destructors have run
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (21 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.4 022/453] netfilter: x_tables: Switch synchronization to RCU Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.4 024/453] netfilter: nft_dynset: fix timeouts later than 23 days Greg Kroah-Hartman
                   ` (432 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Pablo Neira Ayso, Florian Westphal,
	Sasha Levin

From: Florian Westphal <fw@strlen.de>

[ Upstream commit ffe8923f109b7ea92c0842c89e61300eefa11c94 ]

Pablo Neira found that after recent update of xt_IDLETIMER the
iptables-nft tests sometimes show an error.

He tracked this down to the delayed cleanup used by nf_tables core:
del rule (transaction A)
add rule (transaction B)

Its possible that by time transaction B (both in same netns) runs,
the xt target destructor has not been invoked yet.

For native nft expressions this is no problem because all expressions
that have such side effects make sure these are handled from the commit
phase, rather than async cleanup.

For nft_compat however this isn't true.

Instead of forcing synchronous behaviour for nft_compat, keep track
of the number of outstanding destructor calls.

When we attempt to create a new expression, flush the cleanup worker
to make sure destructors have completed.

With lots of help from Pablo Neira.

Reported-by: Pablo Neira Ayso <pablo@netfilter.org>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/net/netfilter/nf_tables.h |  2 ++
 net/netfilter/nf_tables_api.c     | 10 +++++++--
 net/netfilter/nft_compat.c        | 36 +++++++++++++++++++++++++++----
 3 files changed, 42 insertions(+), 6 deletions(-)

diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index a576bcbba2fcc..6a6fcd10d3185 100644
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -1462,4 +1462,6 @@ void nft_chain_filter_fini(void);
 
 void __init nft_chain_route_init(void);
 void nft_chain_route_fini(void);
+
+void nf_tables_trans_destroy_flush_work(void);
 #endif /* _NET_NF_TABLES_H */
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 459b7c0547115..7753d6f1467c9 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -6605,6 +6605,12 @@ static void nf_tables_trans_destroy_work(struct work_struct *w)
 	}
 }
 
+void nf_tables_trans_destroy_flush_work(void)
+{
+	flush_work(&trans_destroy_work);
+}
+EXPORT_SYMBOL_GPL(nf_tables_trans_destroy_flush_work);
+
 static int nf_tables_commit_chain_prepare(struct net *net, struct nft_chain *chain)
 {
 	struct nft_rule *rule;
@@ -6776,9 +6782,9 @@ static void nf_tables_commit_release(struct net *net)
 	spin_unlock(&nf_tables_destroy_list_lock);
 
 	nf_tables_module_autoload_cleanup(net);
-	mutex_unlock(&net->nft.commit_mutex);
-
 	schedule_work(&trans_destroy_work);
+
+	mutex_unlock(&net->nft.commit_mutex);
 }
 
 static int nf_tables_commit(struct net *net, struct sk_buff *skb)
diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c
index f9adca62ccb3d..0e3e0ff805812 100644
--- a/net/netfilter/nft_compat.c
+++ b/net/netfilter/nft_compat.c
@@ -27,6 +27,8 @@ struct nft_xt_match_priv {
 	void *info;
 };
 
+static refcount_t nft_compat_pending_destroy = REFCOUNT_INIT(1);
+
 static int nft_compat_chain_validate_dependency(const struct nft_ctx *ctx,
 						const char *tablename)
 {
@@ -236,6 +238,15 @@ nft_target_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
 
 	nft_target_set_tgchk_param(&par, ctx, target, info, &e, proto, inv);
 
+	/* xtables matches or targets can have side effects, e.g.
+	 * creation/destruction of /proc files.
+	 * The xt ->destroy functions are run asynchronously from
+	 * work queue.  If we have pending invocations we thus
+	 * need to wait for those to finish.
+	 */
+	if (refcount_read(&nft_compat_pending_destroy) > 1)
+		nf_tables_trans_destroy_flush_work();
+
 	ret = xt_check_target(&par, size, proto, inv);
 	if (ret < 0)
 		return ret;
@@ -247,6 +258,13 @@ nft_target_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
 	return 0;
 }
 
+static void __nft_mt_tg_destroy(struct module *me, const struct nft_expr *expr)
+{
+	refcount_dec(&nft_compat_pending_destroy);
+	module_put(me);
+	kfree(expr->ops);
+}
+
 static void
 nft_target_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr)
 {
@@ -262,8 +280,7 @@ nft_target_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr)
 	if (par.target->destroy != NULL)
 		par.target->destroy(&par);
 
-	module_put(me);
-	kfree(expr->ops);
+	__nft_mt_tg_destroy(me, expr);
 }
 
 static int nft_extension_dump_info(struct sk_buff *skb, int attr,
@@ -494,8 +511,7 @@ __nft_match_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr,
 	if (par.match->destroy != NULL)
 		par.match->destroy(&par);
 
-	module_put(me);
-	kfree(expr->ops);
+	__nft_mt_tg_destroy(me, expr);
 }
 
 static void
@@ -700,6 +716,14 @@ static const struct nfnetlink_subsystem nfnl_compat_subsys = {
 
 static struct nft_expr_type nft_match_type;
 
+static void nft_mt_tg_deactivate(const struct nft_ctx *ctx,
+				 const struct nft_expr *expr,
+				 enum nft_trans_phase phase)
+{
+	if (phase == NFT_TRANS_COMMIT)
+		refcount_inc(&nft_compat_pending_destroy);
+}
+
 static const struct nft_expr_ops *
 nft_match_select_ops(const struct nft_ctx *ctx,
 		     const struct nlattr * const tb[])
@@ -738,6 +762,7 @@ nft_match_select_ops(const struct nft_ctx *ctx,
 	ops->type = &nft_match_type;
 	ops->eval = nft_match_eval;
 	ops->init = nft_match_init;
+	ops->deactivate = nft_mt_tg_deactivate,
 	ops->destroy = nft_match_destroy;
 	ops->dump = nft_match_dump;
 	ops->validate = nft_match_validate;
@@ -828,6 +853,7 @@ nft_target_select_ops(const struct nft_ctx *ctx,
 	ops->size = NFT_EXPR_SIZE(XT_ALIGN(target->targetsize));
 	ops->init = nft_target_init;
 	ops->destroy = nft_target_destroy;
+	ops->deactivate = nft_mt_tg_deactivate,
 	ops->dump = nft_target_dump;
 	ops->validate = nft_target_validate;
 	ops->data = target;
@@ -891,6 +917,8 @@ static void __exit nft_compat_module_exit(void)
 	nfnetlink_subsys_unregister(&nfnl_compat_subsys);
 	nft_unregister_expr(&nft_target_type);
 	nft_unregister_expr(&nft_match_type);
+
+	WARN_ON_ONCE(refcount_read(&nft_compat_pending_destroy) != 1);
 }
 
 MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_NFT_COMPAT);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 024/453] netfilter: nft_dynset: fix timeouts later than 23 days
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (22 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.4 023/453] netfilter: nft_compat: make sure xtables destructors have run Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.4 025/453] afs: Fix memory leak when mounting with multiple source parameters Greg Kroah-Hartman
                   ` (431 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Pablo Neira Ayuso, Sasha Levin

From: Pablo Neira Ayuso <pablo@netfilter.org>

[ Upstream commit 917d80d376ffbaa9725fde9e3c0282f63643f278 ]

Use nf_msecs_to_jiffies64 and nf_jiffies64_to_msecs as provided by
8e1102d5a159 ("netfilter: nf_tables: support timeouts larger than 23
days"), otherwise ruleset listing breaks.

Fixes: a8b1e36d0d1d ("netfilter: nft_dynset: fix element timeout for HZ != 1000")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/net/netfilter/nf_tables.h | 4 ++++
 net/netfilter/nf_tables_api.c     | 4 ++--
 net/netfilter/nft_dynset.c        | 8 +++++---
 3 files changed, 11 insertions(+), 5 deletions(-)

diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index 6a6fcd10d3185..f694f08ad635b 100644
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -1464,4 +1464,8 @@ void __init nft_chain_route_init(void);
 void nft_chain_route_fini(void);
 
 void nf_tables_trans_destroy_flush_work(void);
+
+int nf_msecs_to_jiffies64(const struct nlattr *nla, u64 *result);
+__be64 nf_jiffies64_to_msecs(u64 input);
+
 #endif /* _NET_NF_TABLES_H */
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 7753d6f1467c9..40216c2a7dd72 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -3277,7 +3277,7 @@ static int nf_tables_set_alloc_name(struct nft_ctx *ctx, struct nft_set *set,
 	return 0;
 }
 
-static int nf_msecs_to_jiffies64(const struct nlattr *nla, u64 *result)
+int nf_msecs_to_jiffies64(const struct nlattr *nla, u64 *result)
 {
 	u64 ms = be64_to_cpu(nla_get_be64(nla));
 	u64 max = (u64)(~((u64)0));
@@ -3291,7 +3291,7 @@ static int nf_msecs_to_jiffies64(const struct nlattr *nla, u64 *result)
 	return 0;
 }
 
-static __be64 nf_jiffies64_to_msecs(u64 input)
+__be64 nf_jiffies64_to_msecs(u64 input)
 {
 	return cpu_to_be64(jiffies64_to_msecs(input));
 }
diff --git a/net/netfilter/nft_dynset.c b/net/netfilter/nft_dynset.c
index 8887295414dcb..217fd1bdc55e7 100644
--- a/net/netfilter/nft_dynset.c
+++ b/net/netfilter/nft_dynset.c
@@ -180,8 +180,10 @@ static int nft_dynset_init(const struct nft_ctx *ctx,
 	if (tb[NFTA_DYNSET_TIMEOUT] != NULL) {
 		if (!(set->flags & NFT_SET_TIMEOUT))
 			return -EINVAL;
-		timeout = msecs_to_jiffies(be64_to_cpu(nla_get_be64(
-						tb[NFTA_DYNSET_TIMEOUT])));
+
+		err = nf_msecs_to_jiffies64(tb[NFTA_DYNSET_TIMEOUT], &timeout);
+		if (err)
+			return err;
 	}
 
 	priv->sreg_key = nft_parse_register(tb[NFTA_DYNSET_SREG_KEY]);
@@ -296,7 +298,7 @@ static int nft_dynset_dump(struct sk_buff *skb, const struct nft_expr *expr)
 	if (nla_put_string(skb, NFTA_DYNSET_SET_NAME, priv->set->name))
 		goto nla_put_failure;
 	if (nla_put_be64(skb, NFTA_DYNSET_TIMEOUT,
-			 cpu_to_be64(jiffies_to_msecs(priv->timeout)),
+			 nf_jiffies64_to_msecs(priv->timeout),
 			 NFTA_DYNSET_PAD))
 		goto nla_put_failure;
 	if (priv->expr && nft_expr_dump(skb, NFTA_DYNSET_EXPR, priv->expr))
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 025/453] afs: Fix memory leak when mounting with multiple source parameters
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (23 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.4 024/453] netfilter: nft_dynset: fix timeouts later than 23 days Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.4 026/453] Revert "gpio: eic-sprd: Use devm_platform_ioremap_resource()" Greg Kroah-Hartman
                   ` (430 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, syzbot+86dc6632faaca40133ab,
	David Howells, Randy Dunlap, Linus Torvalds, Sasha Levin

From: David Howells <dhowells@redhat.com>

[ Upstream commit 4cb682964706deffb4861f0a91329ab3a705039f ]

There's a memory leak in afs_parse_source() whereby multiple source=
parameters overwrite fc->source in the fs_context struct without freeing
the previously recorded source.

Fix this by only permitting a single source parameter and rejecting with
an error all subsequent ones.

This was caught by syzbot with the kernel memory leak detector, showing
something like the following trace:

  unreferenced object 0xffff888114375440 (size 32):
    comm "repro", pid 5168, jiffies 4294923723 (age 569.948s)
    backtrace:
      slab_post_alloc_hook+0x42/0x79
      __kmalloc_track_caller+0x125/0x16a
      kmemdup_nul+0x24/0x3c
      vfs_parse_fs_string+0x5a/0xa1
      generic_parse_monolithic+0x9d/0xc5
      do_new_mount+0x10d/0x15a
      do_mount+0x5f/0x8e
      __do_sys_mount+0xff/0x127
      do_syscall_64+0x2d/0x3a
      entry_SYSCALL_64_after_hwframe+0x44/0xa9

Fixes: 13fcc6837049 ("afs: Add fs_context support")
Reported-by: syzbot+86dc6632faaca40133ab@syzkaller.appspotmail.com
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/afs/super.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/fs/afs/super.c b/fs/afs/super.c
index 7f8a9b3137bff..eb04dcc543289 100644
--- a/fs/afs/super.c
+++ b/fs/afs/super.c
@@ -236,6 +236,9 @@ static int afs_parse_source(struct fs_context *fc, struct fs_parameter *param)
 
 	_enter(",%s", name);
 
+	if (fc->source)
+		return invalf(fc, "kAFS: Multiple sources not supported");
+
 	if (!name) {
 		printk(KERN_ERR "kAFS: no volume name specified\n");
 		return -EINVAL;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 026/453] Revert "gpio: eic-sprd: Use devm_platform_ioremap_resource()"
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (24 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.4 025/453] afs: Fix memory leak when mounting with multiple source parameters Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.4 027/453] gpio: eic-sprd: break loop when getting NULL device resource Greg Kroah-Hartman
                   ` (429 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Baolin Wang, Linus Walleij, Sasha Levin

From: Baolin Wang <baolin.wang7@gmail.com>

[ Upstream commit 4ed7d7dd4890bb8120a3e77c16191a695fdfcc5a ]

This reverts commit 0f5cb8cc27a266c81e6523b436479802e9aafc9e.

This commit will cause below warnings, since our EIC controller can support
differnt banks on different Spreadtrum SoCs, and each bank has its own base
address, we will get invalid resource warning if the bank number is less than
SPRD_EIC_MAX_BANK on some Spreadtrum SoCs.

So we should not use devm_platform_ioremap_resource() here to remove the
warnings.

[    1.118508] sprd-eic 40210000.gpio: invalid resource
[    1.118535] sprd-eic 40210000.gpio: invalid resource
[    1.119034] sprd-eic 40210080.gpio: invalid resource
[    1.119055] sprd-eic 40210080.gpio: invalid resource
[    1.119462] sprd-eic 402100a0.gpio: invalid resource
[    1.119482] sprd-eic 402100a0.gpio: invalid resource
[    1.119893] sprd-eic 402100c0.gpio: invalid resource
[    1.119913] sprd-eic 402100c0.gpio: invalid resource

Signed-off-by: Baolin Wang <baolin.wang7@gmail.com>
Link: https://lore.kernel.org/r/8d3579f4b49bb675dc805035960f24852898be28.1585734060.git.baolin.wang7@gmail.com
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpio/gpio-eic-sprd.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/drivers/gpio/gpio-eic-sprd.c b/drivers/gpio/gpio-eic-sprd.c
index bb287f35cf408..8c97577740100 100644
--- a/drivers/gpio/gpio-eic-sprd.c
+++ b/drivers/gpio/gpio-eic-sprd.c
@@ -569,6 +569,7 @@ static int sprd_eic_probe(struct platform_device *pdev)
 	const struct sprd_eic_variant_data *pdata;
 	struct gpio_irq_chip *irq;
 	struct sprd_eic *sprd_eic;
+	struct resource *res;
 	int ret, i;
 
 	pdata = of_device_get_match_data(&pdev->dev);
@@ -595,9 +596,13 @@ static int sprd_eic_probe(struct platform_device *pdev)
 		 * have one bank EIC, thus base[1] and base[2] can be
 		 * optional.
 		 */
-		sprd_eic->base[i] = devm_platform_ioremap_resource(pdev, i);
-		if (IS_ERR(sprd_eic->base[i]))
+		res = platform_get_resource(pdev, IORESOURCE_MEM, i);
+		if (!res)
 			continue;
+
+		sprd_eic->base[i] = devm_ioremap_resource(&pdev->dev, res);
+		if (IS_ERR(sprd_eic->base[i]))
+			return PTR_ERR(sprd_eic->base[i]);
 	}
 
 	sprd_eic->chip.label = sprd_eic_label_name[sprd_eic->type];
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 027/453] gpio: eic-sprd: break loop when getting NULL device resource
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (25 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.4 026/453] Revert "gpio: eic-sprd: Use devm_platform_ioremap_resource()" Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.4 028/453] netfilter: nft_ct: Remove confirmation check for NFT_CT_ID Greg Kroah-Hartman
                   ` (428 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chunyan Zhang, Linus Walleij, Sasha Levin

From: Chunyan Zhang <chunyan.zhang@unisoc.com>

[ Upstream commit 263ade7166a2e589c5b605272690c155c0637dcb ]

EIC controller have unfixed numbers of banks on different Spreadtrum SoCs,
and each bank has its own base address, the loop of getting there base
address in driver should break if the resource gotten via
platform_get_resource() is NULL already. The later ones would be all NULL
even if the loop continues.

Fixes: 25518e024e3a ("gpio: Add Spreadtrum EIC driver support")
Signed-off-by: Chunyan Zhang <chunyan.zhang@unisoc.com>
Link: https://lore.kernel.org/r/20201209055106.840100-1-zhang.lyra@gmail.com
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpio/gpio-eic-sprd.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpio/gpio-eic-sprd.c b/drivers/gpio/gpio-eic-sprd.c
index 8c97577740100..a69b3faf51ef0 100644
--- a/drivers/gpio/gpio-eic-sprd.c
+++ b/drivers/gpio/gpio-eic-sprd.c
@@ -598,7 +598,7 @@ static int sprd_eic_probe(struct platform_device *pdev)
 		 */
 		res = platform_get_resource(pdev, IORESOURCE_MEM, i);
 		if (!res)
-			continue;
+			break;
 
 		sprd_eic->base[i] = devm_ioremap_resource(&pdev->dev, res);
 		if (IS_ERR(sprd_eic->base[i]))
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 028/453] netfilter: nft_ct: Remove confirmation check for NFT_CT_ID
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (26 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.4 027/453] gpio: eic-sprd: break loop when getting NULL device resource Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.4 029/453] selftests/bpf/test_offload.py: Reset ethtool features after failed setting Greg Kroah-Hartman
                   ` (427 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Brett Mastbergen, Florian Westphal,
	Pablo Neira Ayuso, Sasha Levin

From: Brett Mastbergen <brett.mastbergen@gmail.com>

[ Upstream commit 2d94b20b95b009eec1a267dcf026b01af627c0cd ]

Since commit 656c8e9cc1ba ("netfilter: conntrack: Use consistent ct id
hash calculation") the ct id will not change from initialization to
confirmation.  Removing the confirmation check allows for things like
adding an element to a 'typeof ct id' set in prerouting upon reception
of the first packet of a new connection, and then being able to
reference that set consistently both before and after the connection
is confirmed.

Fixes: 656c8e9cc1ba ("netfilter: conntrack: Use consistent ct id hash calculation")
Signed-off-by: Brett Mastbergen <brett.mastbergen@gmail.com>
Acked-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/netfilter/nft_ct.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/net/netfilter/nft_ct.c b/net/netfilter/nft_ct.c
index 46ca8bcca1bd5..2042c6f4629cc 100644
--- a/net/netfilter/nft_ct.c
+++ b/net/netfilter/nft_ct.c
@@ -177,8 +177,6 @@ static void nft_ct_get_eval(const struct nft_expr *expr,
 	}
 #endif
 	case NFT_CT_ID:
-		if (!nf_ct_is_confirmed(ct))
-			goto err;
 		*dest = nf_ct_get_id(ct);
 		return;
 	default:
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 029/453] selftests/bpf/test_offload.py: Reset ethtool features after failed setting
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (27 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.4 028/453] netfilter: nft_ct: Remove confirmation check for NFT_CT_ID Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.4 030/453] RDMA/cm: Fix an attempt to use non-valid pointer when cleaning timewait Greg Kroah-Hartman
                   ` (426 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Toke Høiland-Jørgensen,
	Daniel Borkmann, Jakub Kicinski, Sasha Levin

From: Toke Høiland-Jørgensen <toke@redhat.com>

[ Upstream commit 766e62b7fcd2cf1d43e6594ba37c659dc48f7ddb ]

When setting the ethtool feature flag fails (as expected for the test), the
kernel now tracks that the feature was requested to be 'off' and refuses to
subsequently disable it again. So reset it back to 'on' so a subsequent
disable (that's not supposed to fail) can succeed.

Fixes: 417ec26477a5 ("selftests/bpf: add offload test based on netdevsim")
Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Jakub Kicinski <kuba@kernel.org>
Link: https://lore.kernel.org/bpf/160752226280.110217.10696241563705667871.stgit@toke.dk
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/testing/selftests/bpf/test_offload.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tools/testing/selftests/bpf/test_offload.py b/tools/testing/selftests/bpf/test_offload.py
index 1afa22c88e42a..8f918847ddf89 100755
--- a/tools/testing/selftests/bpf/test_offload.py
+++ b/tools/testing/selftests/bpf/test_offload.py
@@ -930,6 +930,7 @@ try:
     start_test("Test disabling TC offloads is rejected while filters installed...")
     ret, _ = sim.set_ethtool_tc_offloads(False, fail=False)
     fail(ret == 0, "Driver should refuse to disable TC offloads with filters installed...")
+    sim.set_ethtool_tc_offloads(True)
 
     start_test("Test qdisc removal frees things...")
     sim.tc_flush_filters()
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 030/453] RDMA/cm: Fix an attempt to use non-valid pointer when cleaning timewait
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (28 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.4 029/453] selftests/bpf/test_offload.py: Reset ethtool features after failed setting Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44   ` [Intel-wired-lan] " Greg Kroah-Hartman
                   ` (425 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Maor Gottlieb, Amit Matityahu,
	Leon Romanovsky, Jason Gunthorpe, Sasha Levin

From: Leon Romanovsky <leonro@nvidia.com>

[ Upstream commit 340b940ea0ed12d9adbb8f72dea17d516b2019e8 ]

If cm_create_timewait_info() fails, the timewait_info pointer will contain
an error value and will be used in cm_remove_remote() later.

  general protection fault, probably for non-canonical address 0xdffffc0000000024: 0000 [#1] SMP KASAN PTI
  KASAN: null-ptr-deref in range [0×0000000000000120-0×0000000000000127]
  CPU: 2 PID: 12446 Comm: syz-executor.3 Not tainted 5.10.0-rc5-5d4c0742a60e #27
  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
  RIP: 0010:cm_remove_remote.isra.0+0x24/0×170 drivers/infiniband/core/cm.c:978
  Code: 84 00 00 00 00 00 41 54 55 53 48 89 fb 48 8d ab 2d 01 00 00 e8 7d bf 4b fe 48 89 ea 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <0f> b6 04 02 48 89 ea 83 e2 07 38 d0 7f 08 84 c0 0f 85 fc 00 00 00
  RSP: 0018:ffff888013127918 EFLAGS: 00010006
  RAX: dffffc0000000000 RBX: fffffffffffffff4 RCX: ffffc9000a18b000
  RDX: 0000000000000024 RSI: ffffffff82edc573 RDI: fffffffffffffff4
  RBP: 0000000000000121 R08: 0000000000000001 R09: ffffed1002624f1d
  R10: 0000000000000003 R11: ffffed1002624f1c R12: ffff888107760c70
  R13: ffff888107760c40 R14: fffffffffffffff4 R15: ffff888107760c9c
  FS:  00007fe1ffcc1700(0000) GS:ffff88811a600000(0000) knlGS:0000000000000000
  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  CR2: 0000001b2ff21000 CR3: 000000010f504001 CR4: 0000000000370ee0
  DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
  DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
  Call Trace:
   cm_destroy_id+0x189/0×15b0 drivers/infiniband/core/cm.c:1155
   cma_connect_ib drivers/infiniband/core/cma.c:4029 [inline]
   rdma_connect_locked+0x1100/0×17c0 drivers/infiniband/core/cma.c:4107
   rdma_connect+0x2a/0×40 drivers/infiniband/core/cma.c:4140
   ucma_connect+0x277/0×340 drivers/infiniband/core/ucma.c:1069
   ucma_write+0x236/0×2f0 drivers/infiniband/core/ucma.c:1724
   vfs_write+0x220/0×830 fs/read_write.c:603
   ksys_write+0x1df/0×240 fs/read_write.c:658
   do_syscall_64+0x33/0×40 arch/x86/entry/common.c:46
   entry_SYSCALL_64_after_hwframe+0x44/0xa9

Fixes: a977049dacde ("[PATCH] IB: Add the kernel CM implementation")
Link: https://lore.kernel.org/r/20201204064205.145795-1-leon@kernel.org
Reviewed-by: Maor Gottlieb <maorg@nvidia.com>
Reported-by: Amit Matityahu <mitm@nvidia.com>
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/core/cm.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c
index c1d6a068f50fe..fd7c84721b0de 100644
--- a/drivers/infiniband/core/cm.c
+++ b/drivers/infiniband/core/cm.c
@@ -1435,6 +1435,7 @@ int ib_send_cm_req(struct ib_cm_id *cm_id,
 							    id.local_id);
 	if (IS_ERR(cm_id_priv->timewait_info)) {
 		ret = PTR_ERR(cm_id_priv->timewait_info);
+		cm_id_priv->timewait_info = NULL;
 		goto out;
 	}
 
@@ -1961,6 +1962,7 @@ static int cm_req_handler(struct cm_work *work)
 							    id.local_id);
 	if (IS_ERR(cm_id_priv->timewait_info)) {
 		ret = PTR_ERR(cm_id_priv->timewait_info);
+		cm_id_priv->timewait_info = NULL;
 		goto destroy;
 	}
 	cm_id_priv->timewait_info->work.remote_id = req_msg->local_comm_id;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 031/453] i40e: Refactor rx_bi accesses
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
@ 2020-12-28 12:44   ` Greg Kroah-Hartman
  2020-12-28 12:43 ` [PATCH 5.4 002/453] ARM: dts: sun8i: r40: bananapi-m2-berry: Fix dcdc1 regulator Greg Kroah-Hartman
                     ` (454 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Björn Töpel,
	Alexei Starovoitov, intel-wired-lan, Sasha Levin

From: Björn Töpel <bjorn.topel@intel.com>

[ Upstream commit e1675f97367bed74d4dcfe08de9ce9b5d6b288c1 ]

As a first step to migrate i40e to the new MEM_TYPE_XSK_BUFF_POOL
APIs, code that accesses the rx_bi (SW/shadow ring) is refactored to
use an accessor function.

Signed-off-by: Björn Töpel <bjorn.topel@intel.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Cc: intel-wired-lan@lists.osuosl.org
Link: https://lore.kernel.org/bpf/20200520192103.355233-7-bjorn.topel@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/intel/i40e/i40e_txrx.c | 17 +++++++++++------
 drivers/net/ethernet/intel/i40e/i40e_xsk.c  | 18 ++++++++++++------
 2 files changed, 23 insertions(+), 12 deletions(-)

diff --git a/drivers/net/ethernet/intel/i40e/i40e_txrx.c b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
index e3f29dc8b290a..7f7f02bc2b794 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_txrx.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
@@ -1195,6 +1195,11 @@ static void i40e_update_itr(struct i40e_q_vector *q_vector,
 	rc->total_packets = 0;
 }
 
+static struct i40e_rx_buffer *i40e_rx_bi(struct i40e_ring *rx_ring, u32 idx)
+{
+	return &rx_ring->rx_bi[idx];
+}
+
 /**
  * i40e_reuse_rx_page - page flip buffer and store it back on the ring
  * @rx_ring: rx descriptor ring to store buffers on
@@ -1208,7 +1213,7 @@ static void i40e_reuse_rx_page(struct i40e_ring *rx_ring,
 	struct i40e_rx_buffer *new_buff;
 	u16 nta = rx_ring->next_to_alloc;
 
-	new_buff = &rx_ring->rx_bi[nta];
+	new_buff = i40e_rx_bi(rx_ring, nta);
 
 	/* update, and store next to alloc */
 	nta++;
@@ -1272,7 +1277,7 @@ struct i40e_rx_buffer *i40e_clean_programming_status(
 	ntc = rx_ring->next_to_clean;
 
 	/* fetch, update, and store next to clean */
-	rx_buffer = &rx_ring->rx_bi[ntc++];
+	rx_buffer = i40e_rx_bi(rx_ring, ntc++);
 	ntc = (ntc < rx_ring->count) ? ntc : 0;
 	rx_ring->next_to_clean = ntc;
 
@@ -1361,7 +1366,7 @@ void i40e_clean_rx_ring(struct i40e_ring *rx_ring)
 
 	/* Free all the Rx ring sk_buffs */
 	for (i = 0; i < rx_ring->count; i++) {
-		struct i40e_rx_buffer *rx_bi = &rx_ring->rx_bi[i];
+		struct i40e_rx_buffer *rx_bi = i40e_rx_bi(rx_ring, i);
 
 		if (!rx_bi->page)
 			continue;
@@ -1576,7 +1581,7 @@ bool i40e_alloc_rx_buffers(struct i40e_ring *rx_ring, u16 cleaned_count)
 		return false;
 
 	rx_desc = I40E_RX_DESC(rx_ring, ntu);
-	bi = &rx_ring->rx_bi[ntu];
+	bi = i40e_rx_bi(rx_ring, ntu);
 
 	do {
 		if (!i40e_alloc_mapped_page(rx_ring, bi))
@@ -1598,7 +1603,7 @@ bool i40e_alloc_rx_buffers(struct i40e_ring *rx_ring, u16 cleaned_count)
 		ntu++;
 		if (unlikely(ntu == rx_ring->count)) {
 			rx_desc = I40E_RX_DESC(rx_ring, 0);
-			bi = rx_ring->rx_bi;
+			bi = i40e_rx_bi(rx_ring, 0);
 			ntu = 0;
 		}
 
@@ -1965,7 +1970,7 @@ static struct i40e_rx_buffer *i40e_get_rx_buffer(struct i40e_ring *rx_ring,
 {
 	struct i40e_rx_buffer *rx_buffer;
 
-	rx_buffer = &rx_ring->rx_bi[rx_ring->next_to_clean];
+	rx_buffer = i40e_rx_bi(rx_ring, rx_ring->next_to_clean);
 	prefetchw(rx_buffer->page);
 
 	/* we are reusing so sync this buffer for CPU use */
diff --git a/drivers/net/ethernet/intel/i40e/i40e_xsk.c b/drivers/net/ethernet/intel/i40e/i40e_xsk.c
index 3156de786d955..c9d4534fbdf02 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_xsk.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_xsk.c
@@ -9,6 +9,11 @@
 #include "i40e_txrx_common.h"
 #include "i40e_xsk.h"
 
+static struct i40e_rx_buffer *i40e_rx_bi(struct i40e_ring *rx_ring, u32 idx)
+{
+	return &rx_ring->rx_bi[idx];
+}
+
 /**
  * i40e_xsk_umem_dma_map - DMA maps all UMEM memory for the netdev
  * @vsi: Current VSI
@@ -321,7 +326,7 @@ __i40e_alloc_rx_buffers_zc(struct i40e_ring *rx_ring, u16 count,
 	bool ok = true;
 
 	rx_desc = I40E_RX_DESC(rx_ring, ntu);
-	bi = &rx_ring->rx_bi[ntu];
+	bi = i40e_rx_bi(rx_ring, ntu);
 	do {
 		if (!alloc(rx_ring, bi)) {
 			ok = false;
@@ -340,7 +345,7 @@ __i40e_alloc_rx_buffers_zc(struct i40e_ring *rx_ring, u16 count,
 
 		if (unlikely(ntu == rx_ring->count)) {
 			rx_desc = I40E_RX_DESC(rx_ring, 0);
-			bi = rx_ring->rx_bi;
+			bi = i40e_rx_bi(rx_ring, 0);
 			ntu = 0;
 		}
 
@@ -402,7 +407,7 @@ static struct i40e_rx_buffer *i40e_get_rx_buffer_zc(struct i40e_ring *rx_ring,
 {
 	struct i40e_rx_buffer *bi;
 
-	bi = &rx_ring->rx_bi[rx_ring->next_to_clean];
+	bi = i40e_rx_bi(rx_ring, rx_ring->next_to_clean);
 
 	/* we are reusing so sync this buffer for CPU use */
 	dma_sync_single_range_for_cpu(rx_ring->dev,
@@ -424,7 +429,8 @@ static struct i40e_rx_buffer *i40e_get_rx_buffer_zc(struct i40e_ring *rx_ring,
 static void i40e_reuse_rx_buffer_zc(struct i40e_ring *rx_ring,
 				    struct i40e_rx_buffer *old_bi)
 {
-	struct i40e_rx_buffer *new_bi = &rx_ring->rx_bi[rx_ring->next_to_alloc];
+	struct i40e_rx_buffer *new_bi = i40e_rx_bi(rx_ring,
+						   rx_ring->next_to_alloc);
 	u16 nta = rx_ring->next_to_alloc;
 
 	/* update, and store next to alloc */
@@ -456,7 +462,7 @@ void i40e_zca_free(struct zero_copy_allocator *alloc, unsigned long handle)
 	mask = rx_ring->xsk_umem->chunk_mask;
 
 	nta = rx_ring->next_to_alloc;
-	bi = &rx_ring->rx_bi[nta];
+	bi = i40e_rx_bi(rx_ring, nta);
 
 	nta++;
 	rx_ring->next_to_alloc = (nta < rx_ring->count) ? nta : 0;
@@ -824,7 +830,7 @@ void i40e_xsk_clean_rx_ring(struct i40e_ring *rx_ring)
 	u16 i;
 
 	for (i = 0; i < rx_ring->count; i++) {
-		struct i40e_rx_buffer *rx_bi = &rx_ring->rx_bi[i];
+		struct i40e_rx_buffer *rx_bi = i40e_rx_bi(rx_ring, i);
 
 		if (!rx_bi->addr)
 			continue;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [Intel-wired-lan] [PATCH 5.4 031/453] i40e: Refactor rx_bi accesses
@ 2020-12-28 12:44   ` Greg Kroah-Hartman
  0 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: intel-wired-lan

From: Bj?rn T?pel <bjorn.topel@intel.com>

[ Upstream commit e1675f97367bed74d4dcfe08de9ce9b5d6b288c1 ]

As a first step to migrate i40e to the new MEM_TYPE_XSK_BUFF_POOL
APIs, code that accesses the rx_bi (SW/shadow ring) is refactored to
use an accessor function.

Signed-off-by: Bj?rn T?pel <bjorn.topel@intel.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Cc: intel-wired-lan at lists.osuosl.org
Link: https://lore.kernel.org/bpf/20200520192103.355233-7-bjorn.topel at gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/intel/i40e/i40e_txrx.c | 17 +++++++++++------
 drivers/net/ethernet/intel/i40e/i40e_xsk.c  | 18 ++++++++++++------
 2 files changed, 23 insertions(+), 12 deletions(-)

diff --git a/drivers/net/ethernet/intel/i40e/i40e_txrx.c b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
index e3f29dc8b290a..7f7f02bc2b794 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_txrx.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
@@ -1195,6 +1195,11 @@ static void i40e_update_itr(struct i40e_q_vector *q_vector,
 	rc->total_packets = 0;
 }
 
+static struct i40e_rx_buffer *i40e_rx_bi(struct i40e_ring *rx_ring, u32 idx)
+{
+	return &rx_ring->rx_bi[idx];
+}
+
 /**
  * i40e_reuse_rx_page - page flip buffer and store it back on the ring
  * @rx_ring: rx descriptor ring to store buffers on
@@ -1208,7 +1213,7 @@ static void i40e_reuse_rx_page(struct i40e_ring *rx_ring,
 	struct i40e_rx_buffer *new_buff;
 	u16 nta = rx_ring->next_to_alloc;
 
-	new_buff = &rx_ring->rx_bi[nta];
+	new_buff = i40e_rx_bi(rx_ring, nta);
 
 	/* update, and store next to alloc */
 	nta++;
@@ -1272,7 +1277,7 @@ struct i40e_rx_buffer *i40e_clean_programming_status(
 	ntc = rx_ring->next_to_clean;
 
 	/* fetch, update, and store next to clean */
-	rx_buffer = &rx_ring->rx_bi[ntc++];
+	rx_buffer = i40e_rx_bi(rx_ring, ntc++);
 	ntc = (ntc < rx_ring->count) ? ntc : 0;
 	rx_ring->next_to_clean = ntc;
 
@@ -1361,7 +1366,7 @@ void i40e_clean_rx_ring(struct i40e_ring *rx_ring)
 
 	/* Free all the Rx ring sk_buffs */
 	for (i = 0; i < rx_ring->count; i++) {
-		struct i40e_rx_buffer *rx_bi = &rx_ring->rx_bi[i];
+		struct i40e_rx_buffer *rx_bi = i40e_rx_bi(rx_ring, i);
 
 		if (!rx_bi->page)
 			continue;
@@ -1576,7 +1581,7 @@ bool i40e_alloc_rx_buffers(struct i40e_ring *rx_ring, u16 cleaned_count)
 		return false;
 
 	rx_desc = I40E_RX_DESC(rx_ring, ntu);
-	bi = &rx_ring->rx_bi[ntu];
+	bi = i40e_rx_bi(rx_ring, ntu);
 
 	do {
 		if (!i40e_alloc_mapped_page(rx_ring, bi))
@@ -1598,7 +1603,7 @@ bool i40e_alloc_rx_buffers(struct i40e_ring *rx_ring, u16 cleaned_count)
 		ntu++;
 		if (unlikely(ntu == rx_ring->count)) {
 			rx_desc = I40E_RX_DESC(rx_ring, 0);
-			bi = rx_ring->rx_bi;
+			bi = i40e_rx_bi(rx_ring, 0);
 			ntu = 0;
 		}
 
@@ -1965,7 +1970,7 @@ static struct i40e_rx_buffer *i40e_get_rx_buffer(struct i40e_ring *rx_ring,
 {
 	struct i40e_rx_buffer *rx_buffer;
 
-	rx_buffer = &rx_ring->rx_bi[rx_ring->next_to_clean];
+	rx_buffer = i40e_rx_bi(rx_ring, rx_ring->next_to_clean);
 	prefetchw(rx_buffer->page);
 
 	/* we are reusing so sync this buffer for CPU use */
diff --git a/drivers/net/ethernet/intel/i40e/i40e_xsk.c b/drivers/net/ethernet/intel/i40e/i40e_xsk.c
index 3156de786d955..c9d4534fbdf02 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_xsk.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_xsk.c
@@ -9,6 +9,11 @@
 #include "i40e_txrx_common.h"
 #include "i40e_xsk.h"
 
+static struct i40e_rx_buffer *i40e_rx_bi(struct i40e_ring *rx_ring, u32 idx)
+{
+	return &rx_ring->rx_bi[idx];
+}
+
 /**
  * i40e_xsk_umem_dma_map - DMA maps all UMEM memory for the netdev
  * @vsi: Current VSI
@@ -321,7 +326,7 @@ __i40e_alloc_rx_buffers_zc(struct i40e_ring *rx_ring, u16 count,
 	bool ok = true;
 
 	rx_desc = I40E_RX_DESC(rx_ring, ntu);
-	bi = &rx_ring->rx_bi[ntu];
+	bi = i40e_rx_bi(rx_ring, ntu);
 	do {
 		if (!alloc(rx_ring, bi)) {
 			ok = false;
@@ -340,7 +345,7 @@ __i40e_alloc_rx_buffers_zc(struct i40e_ring *rx_ring, u16 count,
 
 		if (unlikely(ntu == rx_ring->count)) {
 			rx_desc = I40E_RX_DESC(rx_ring, 0);
-			bi = rx_ring->rx_bi;
+			bi = i40e_rx_bi(rx_ring, 0);
 			ntu = 0;
 		}
 
@@ -402,7 +407,7 @@ static struct i40e_rx_buffer *i40e_get_rx_buffer_zc(struct i40e_ring *rx_ring,
 {
 	struct i40e_rx_buffer *bi;
 
-	bi = &rx_ring->rx_bi[rx_ring->next_to_clean];
+	bi = i40e_rx_bi(rx_ring, rx_ring->next_to_clean);
 
 	/* we are reusing so sync this buffer for CPU use */
 	dma_sync_single_range_for_cpu(rx_ring->dev,
@@ -424,7 +429,8 @@ static struct i40e_rx_buffer *i40e_get_rx_buffer_zc(struct i40e_ring *rx_ring,
 static void i40e_reuse_rx_buffer_zc(struct i40e_ring *rx_ring,
 				    struct i40e_rx_buffer *old_bi)
 {
-	struct i40e_rx_buffer *new_bi = &rx_ring->rx_bi[rx_ring->next_to_alloc];
+	struct i40e_rx_buffer *new_bi = i40e_rx_bi(rx_ring,
+						   rx_ring->next_to_alloc);
 	u16 nta = rx_ring->next_to_alloc;
 
 	/* update, and store next to alloc */
@@ -456,7 +462,7 @@ void i40e_zca_free(struct zero_copy_allocator *alloc, unsigned long handle)
 	mask = rx_ring->xsk_umem->chunk_mask;
 
 	nta = rx_ring->next_to_alloc;
-	bi = &rx_ring->rx_bi[nta];
+	bi = i40e_rx_bi(rx_ring, nta);
 
 	nta++;
 	rx_ring->next_to_alloc = (nta < rx_ring->count) ? nta : 0;
@@ -824,7 +830,7 @@ void i40e_xsk_clean_rx_ring(struct i40e_ring *rx_ring)
 	u16 i;
 
 	for (i = 0; i < rx_ring->count; i++) {
-		struct i40e_rx_buffer *rx_bi = &rx_ring->rx_bi[i];
+		struct i40e_rx_buffer *rx_bi = i40e_rx_bi(rx_ring, i);
 
 		if (!rx_bi->addr)
 			continue;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 032/453] i40e: optimise prefetch page refcount
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (30 preceding siblings ...)
  2020-12-28 12:44   ` [Intel-wired-lan] " Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.4 033/453] i40e: avoid premature Rx buffer reuse Greg Kroah-Hartman
                   ` (423 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, kernel test robot, Jakub Kicinski,
	Li RongQing, Jesse Brandeburg, Aaron Brown, Tony Nguyen,
	Sasha Levin

From: Li RongQing <lirongqing@baidu.com>

[ Upstream commit 1fa5cef283420b3dad93cd6ab04d7125bc1562de ]

refcount of rx_buffer page will be added here originally, so prefetchw
is needed, but after commit 1793668c3b8c ("i40e/i40evf: Update code to
better handle incrementing page count"), and refcount is not added
every time, so change prefetchw as prefetch.

Now it mainly services page_address(), but which accesses struct page
only when WANT_PAGE_VIRTUAL or HASHED_PAGE_VIRTUAL is defined otherwise
it returns address based on offset, so we prefetch it conditionally.

Jakub suggested to define prefetch_page_address in a common header.

Reported-by: kernel test robot <lkp@intel.com>
Suggested-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Li RongQing <lirongqing@baidu.com>
Reviewed-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
Tested-by: Aaron Brown <aaron.f.brown@intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/intel/i40e/i40e_txrx.c | 2 +-
 include/linux/prefetch.h                    | 8 ++++++++
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/intel/i40e/i40e_txrx.c b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
index 7f7f02bc2b794..89a3be41d6d83 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_txrx.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
@@ -1971,7 +1971,7 @@ static struct i40e_rx_buffer *i40e_get_rx_buffer(struct i40e_ring *rx_ring,
 	struct i40e_rx_buffer *rx_buffer;
 
 	rx_buffer = i40e_rx_bi(rx_ring, rx_ring->next_to_clean);
-	prefetchw(rx_buffer->page);
+	prefetch_page_address(rx_buffer->page);
 
 	/* we are reusing so sync this buffer for CPU use */
 	dma_sync_single_range_for_cpu(rx_ring->dev,
diff --git a/include/linux/prefetch.h b/include/linux/prefetch.h
index 13eafebf3549a..b83a3f944f287 100644
--- a/include/linux/prefetch.h
+++ b/include/linux/prefetch.h
@@ -15,6 +15,7 @@
 #include <asm/processor.h>
 #include <asm/cache.h>
 
+struct page;
 /*
 	prefetch(x) attempts to pre-emptively get the memory pointed to
 	by address "x" into the CPU L1 cache. 
@@ -62,4 +63,11 @@ static inline void prefetch_range(void *addr, size_t len)
 #endif
 }
 
+static inline void prefetch_page_address(struct page *page)
+{
+#if defined(WANT_PAGE_VIRTUAL) || defined(HASHED_PAGE_VIRTUAL)
+	prefetch(page);
+#endif
+}
+
 #endif
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 033/453] i40e: avoid premature Rx buffer reuse
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (31 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.4 032/453] i40e: optimise prefetch page refcount Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.4 034/453] ixgbe: " Greg Kroah-Hartman
                   ` (422 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Björn Töpel,
	George Kuruvinakunnel, Tony Nguyen, Sasha Levin, Li RongQing

From: Björn Töpel <bjorn.topel@intel.com>

[ Upstream commit 75aab4e10ae6a4593a60f66d13de755d4e91f400 ]

The page recycle code, incorrectly, relied on that a page fragment
could not be freed inside xdp_do_redirect(). This assumption leads to
that page fragments that are used by the stack/XDP redirect can be
reused and overwritten.

To avoid this, store the page count prior invoking xdp_do_redirect().

Longer explanation:

Intel NICs have a recycle mechanism. The main idea is that a page is
split into two parts. One part is owned by the driver, one part might
be owned by someone else, such as the stack.

t0: Page is allocated, and put on the Rx ring
              +---------------
used by NIC ->| upper buffer
(rx_buffer)   +---------------
              | lower buffer
              +---------------
  page count  == USHRT_MAX
  rx_buffer->pagecnt_bias == USHRT_MAX

t1: Buffer is received, and passed to the stack (e.g.)
              +---------------
              | upper buff (skb)
              +---------------
used by NIC ->| lower buffer
(rx_buffer)   +---------------
  page count  == USHRT_MAX
  rx_buffer->pagecnt_bias == USHRT_MAX - 1

t2: Buffer is received, and redirected
              +---------------
              | upper buff (skb)
              +---------------
used by NIC ->| lower buffer
(rx_buffer)   +---------------

Now, prior calling xdp_do_redirect():
  page count  == USHRT_MAX
  rx_buffer->pagecnt_bias == USHRT_MAX - 2

This means that buffer *cannot* be flipped/reused, because the skb is
still using it.

The problem arises when xdp_do_redirect() actually frees the
segment. Then we get:
  page count  == USHRT_MAX - 1
  rx_buffer->pagecnt_bias == USHRT_MAX - 2

>From a recycle perspective, the buffer can be flipped and reused,
which means that the skb data area is passed to the Rx HW ring!

To work around this, the page count is stored prior calling
xdp_do_redirect().

Note that this is not optimal, since the NIC could actually reuse the
"lower buffer" again. However, then we need to track whether
XDP_REDIRECT consumed the buffer or not.

Fixes: d9314c474d4f ("i40e: add support for XDP_REDIRECT")
Reported-and-analyzed-by: Li RongQing <lirongqing@baidu.com>
Signed-off-by: Björn Töpel <bjorn.topel@intel.com>
Tested-by: George Kuruvinakunnel <george.kuruvinakunnel@intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/intel/i40e/i40e_txrx.c | 27 +++++++++++++++------
 1 file changed, 20 insertions(+), 7 deletions(-)

diff --git a/drivers/net/ethernet/intel/i40e/i40e_txrx.c b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
index 89a3be41d6d83..f47841f3a69d5 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_txrx.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
@@ -1869,6 +1869,7 @@ static inline bool i40e_page_is_reusable(struct page *page)
  * the adapter for another receive
  *
  * @rx_buffer: buffer containing the page
+ * @rx_buffer_pgcnt: buffer page refcount pre xdp_do_redirect() call
  *
  * If page is reusable, rx_buffer->page_offset is adjusted to point to
  * an unused region in the page.
@@ -1891,7 +1892,8 @@ static inline bool i40e_page_is_reusable(struct page *page)
  *
  * In either case, if the page is reusable its refcount is increased.
  **/
-static bool i40e_can_reuse_rx_page(struct i40e_rx_buffer *rx_buffer)
+static bool i40e_can_reuse_rx_page(struct i40e_rx_buffer *rx_buffer,
+				   int rx_buffer_pgcnt)
 {
 	unsigned int pagecnt_bias = rx_buffer->pagecnt_bias;
 	struct page *page = rx_buffer->page;
@@ -1902,7 +1904,7 @@ static bool i40e_can_reuse_rx_page(struct i40e_rx_buffer *rx_buffer)
 
 #if (PAGE_SIZE < 8192)
 	/* if we are only owner of page we can reuse it */
-	if (unlikely((page_count(page) - pagecnt_bias) > 1))
+	if (unlikely((rx_buffer_pgcnt - pagecnt_bias) > 1))
 		return false;
 #else
 #define I40E_LAST_OFFSET \
@@ -1961,16 +1963,24 @@ static void i40e_add_rx_frag(struct i40e_ring *rx_ring,
  * i40e_get_rx_buffer - Fetch Rx buffer and synchronize data for use
  * @rx_ring: rx descriptor ring to transact packets on
  * @size: size of buffer to add to skb
+ * @rx_buffer_pgcnt: buffer page refcount
  *
  * This function will pull an Rx buffer from the ring and synchronize it
  * for use by the CPU.
  */
 static struct i40e_rx_buffer *i40e_get_rx_buffer(struct i40e_ring *rx_ring,
-						 const unsigned int size)
+						 const unsigned int size,
+						 int *rx_buffer_pgcnt)
 {
 	struct i40e_rx_buffer *rx_buffer;
 
 	rx_buffer = i40e_rx_bi(rx_ring, rx_ring->next_to_clean);
+	*rx_buffer_pgcnt =
+#if (PAGE_SIZE < 8192)
+		page_count(rx_buffer->page);
+#else
+		0;
+#endif
 	prefetch_page_address(rx_buffer->page);
 
 	/* we are reusing so sync this buffer for CPU use */
@@ -2125,14 +2135,16 @@ static struct sk_buff *i40e_build_skb(struct i40e_ring *rx_ring,
  * i40e_put_rx_buffer - Clean up used buffer and either recycle or free
  * @rx_ring: rx descriptor ring to transact packets on
  * @rx_buffer: rx buffer to pull data from
+ * @rx_buffer_pgcnt: rx buffer page refcount pre xdp_do_redirect() call
  *
  * This function will clean up the contents of the rx_buffer.  It will
  * either recycle the buffer or unmap it and free the associated resources.
  */
 static void i40e_put_rx_buffer(struct i40e_ring *rx_ring,
-			       struct i40e_rx_buffer *rx_buffer)
+			       struct i40e_rx_buffer *rx_buffer,
+			       int rx_buffer_pgcnt)
 {
-	if (i40e_can_reuse_rx_page(rx_buffer)) {
+	if (i40e_can_reuse_rx_page(rx_buffer, rx_buffer_pgcnt)) {
 		/* hand second half of page back to the ring */
 		i40e_reuse_rx_page(rx_ring, rx_buffer);
 	} else {
@@ -2345,6 +2357,7 @@ static int i40e_clean_rx_irq(struct i40e_ring *rx_ring, int budget)
 	while (likely(total_rx_packets < (unsigned int)budget)) {
 		struct i40e_rx_buffer *rx_buffer;
 		union i40e_rx_desc *rx_desc;
+		int rx_buffer_pgcnt;
 		unsigned int size;
 		u64 qword;
 
@@ -2384,7 +2397,7 @@ static int i40e_clean_rx_irq(struct i40e_ring *rx_ring, int budget)
 			break;
 
 		i40e_trace(clean_rx_irq, rx_ring, rx_desc, skb);
-		rx_buffer = i40e_get_rx_buffer(rx_ring, size);
+		rx_buffer = i40e_get_rx_buffer(rx_ring, size, &rx_buffer_pgcnt);
 
 		/* retrieve a buffer from the ring */
 		if (!skb) {
@@ -2424,7 +2437,7 @@ static int i40e_clean_rx_irq(struct i40e_ring *rx_ring, int budget)
 			break;
 		}
 
-		i40e_put_rx_buffer(rx_ring, rx_buffer);
+		i40e_put_rx_buffer(rx_ring, rx_buffer, rx_buffer_pgcnt);
 		cleaned_count++;
 
 		if (i40e_is_non_eop(rx_ring, rx_desc, skb))
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 034/453] ixgbe: avoid premature Rx buffer reuse
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (32 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.4 033/453] i40e: avoid premature Rx buffer reuse Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.4 035/453] selftests: fix poll error in udpgro.sh Greg Kroah-Hartman
                   ` (421 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Björn Töpel,
	Sandeep Penigalapati, Tony Nguyen, Sasha Levin, Li RongQing

From: Björn Töpel <bjorn.topel@intel.com>

[ Upstream commit a06316dc87bdc000f7f39a315476957af2ba0f05 ]

The page recycle code, incorrectly, relied on that a page fragment
could not be freed inside xdp_do_redirect(). This assumption leads to
that page fragments that are used by the stack/XDP redirect can be
reused and overwritten.

To avoid this, store the page count prior invoking xdp_do_redirect().

Fixes: 6453073987ba ("ixgbe: add initial support for xdp redirect")
Reported-and-analyzed-by: Li RongQing <lirongqing@baidu.com>
Signed-off-by: Björn Töpel <bjorn.topel@intel.com>
Tested-by: Sandeep Penigalapati <sandeep.penigalapati@intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 24 +++++++++++++------
 1 file changed, 17 insertions(+), 7 deletions(-)

diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
index 5336bfcd2d701..f605540644035 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
@@ -1947,7 +1947,8 @@ static inline bool ixgbe_page_is_reserved(struct page *page)
 	return (page_to_nid(page) != numa_mem_id()) || page_is_pfmemalloc(page);
 }
 
-static bool ixgbe_can_reuse_rx_page(struct ixgbe_rx_buffer *rx_buffer)
+static bool ixgbe_can_reuse_rx_page(struct ixgbe_rx_buffer *rx_buffer,
+				    int rx_buffer_pgcnt)
 {
 	unsigned int pagecnt_bias = rx_buffer->pagecnt_bias;
 	struct page *page = rx_buffer->page;
@@ -1958,7 +1959,7 @@ static bool ixgbe_can_reuse_rx_page(struct ixgbe_rx_buffer *rx_buffer)
 
 #if (PAGE_SIZE < 8192)
 	/* if we are only owner of page we can reuse it */
-	if (unlikely((page_ref_count(page) - pagecnt_bias) > 1))
+	if (unlikely((rx_buffer_pgcnt - pagecnt_bias) > 1))
 		return false;
 #else
 	/* The last offset is a bit aggressive in that we assume the
@@ -2023,11 +2024,18 @@ static void ixgbe_add_rx_frag(struct ixgbe_ring *rx_ring,
 static struct ixgbe_rx_buffer *ixgbe_get_rx_buffer(struct ixgbe_ring *rx_ring,
 						   union ixgbe_adv_rx_desc *rx_desc,
 						   struct sk_buff **skb,
-						   const unsigned int size)
+						   const unsigned int size,
+						   int *rx_buffer_pgcnt)
 {
 	struct ixgbe_rx_buffer *rx_buffer;
 
 	rx_buffer = &rx_ring->rx_buffer_info[rx_ring->next_to_clean];
+	*rx_buffer_pgcnt =
+#if (PAGE_SIZE < 8192)
+		page_count(rx_buffer->page);
+#else
+		0;
+#endif
 	prefetchw(rx_buffer->page);
 	*skb = rx_buffer->skb;
 
@@ -2057,9 +2065,10 @@ static struct ixgbe_rx_buffer *ixgbe_get_rx_buffer(struct ixgbe_ring *rx_ring,
 
 static void ixgbe_put_rx_buffer(struct ixgbe_ring *rx_ring,
 				struct ixgbe_rx_buffer *rx_buffer,
-				struct sk_buff *skb)
+				struct sk_buff *skb,
+				int rx_buffer_pgcnt)
 {
-	if (ixgbe_can_reuse_rx_page(rx_buffer)) {
+	if (ixgbe_can_reuse_rx_page(rx_buffer, rx_buffer_pgcnt)) {
 		/* hand second half of page back to the ring */
 		ixgbe_reuse_rx_page(rx_ring, rx_buffer);
 	} else {
@@ -2295,6 +2304,7 @@ static int ixgbe_clean_rx_irq(struct ixgbe_q_vector *q_vector,
 		union ixgbe_adv_rx_desc *rx_desc;
 		struct ixgbe_rx_buffer *rx_buffer;
 		struct sk_buff *skb;
+		int rx_buffer_pgcnt;
 		unsigned int size;
 
 		/* return some buffers to hardware, one at a time is too slow */
@@ -2314,7 +2324,7 @@ static int ixgbe_clean_rx_irq(struct ixgbe_q_vector *q_vector,
 		 */
 		dma_rmb();
 
-		rx_buffer = ixgbe_get_rx_buffer(rx_ring, rx_desc, &skb, size);
+		rx_buffer = ixgbe_get_rx_buffer(rx_ring, rx_desc, &skb, size, &rx_buffer_pgcnt);
 
 		/* retrieve a buffer from the ring */
 		if (!skb) {
@@ -2356,7 +2366,7 @@ static int ixgbe_clean_rx_irq(struct ixgbe_q_vector *q_vector,
 			break;
 		}
 
-		ixgbe_put_rx_buffer(rx_ring, rx_buffer, skb);
+		ixgbe_put_rx_buffer(rx_ring, rx_buffer, skb, rx_buffer_pgcnt);
 		cleaned_count++;
 
 		/* place incomplete frames back on ring for completion */
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 035/453] selftests: fix poll error in udpgro.sh
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (33 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.4 034/453] ixgbe: " Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.4 036/453] net: mvpp2: add mvpp2_phylink_to_port() helper Greg Kroah-Hartman
                   ` (420 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Paolo Abeni, David S. Miller, Sasha Levin

From: Paolo Abeni <pabeni@redhat.com>

[ Upstream commit 38bf8cd821be292e7d8e6f6283d67c5d9708f887 ]

The test program udpgso_bench_rx always invokes the poll()
syscall with a timeout of 10ms. If a larger timeout is specified
via the command line, udpgso_bench_rx is supposed to do multiple
poll() calls till the timeout is expired or an event is received.

Currently the poll() loop errors out after the first invocation with
no events, and may causes self-tests failure alike:

failed
 GRO with custom segment size            ./udpgso_bench_rx: poll: 0x0 expected 0x1

This change addresses the issue allowing the poll() loop to consume
all the configured timeout.

Fixes: ada641ff6ed3 ("selftests: fixes for UDP GRO")
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/testing/selftests/net/udpgso_bench_rx.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/tools/testing/selftests/net/udpgso_bench_rx.c b/tools/testing/selftests/net/udpgso_bench_rx.c
index db3d4a8b5a4c4..76a24052f4b47 100644
--- a/tools/testing/selftests/net/udpgso_bench_rx.c
+++ b/tools/testing/selftests/net/udpgso_bench_rx.c
@@ -113,6 +113,9 @@ static void do_poll(int fd, int timeout_ms)
 				interrupted = true;
 				break;
 			}
+
+			/* no events and more time to wait, do poll again */
+			continue;
 		}
 		if (pfd.revents != POLLIN)
 			error(1, errno, "poll: 0x%x expected 0x%x\n",
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 036/453] net: mvpp2: add mvpp2_phylink_to_port() helper
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (34 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.4 035/453] selftests: fix poll error in udpgro.sh Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.4 037/453] drm/tegra: replace idr_init() by idr_init_base() Greg Kroah-Hartman
                   ` (419 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Russell King, David S. Miller, Sasha Levin

From: Russell King <rmk+kernel@armlinux.org.uk>

[ Upstream commit 6c2b49eb96716e91f202756bfbd3f5fea3b2b172 ]

Add a helper to convert the struct phylink_config pointer passed in
from phylink to the drivers internal struct mvpp2_port.

Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../net/ethernet/marvell/mvpp2/mvpp2_main.c   | 29 +++++++++----------
 1 file changed, 14 insertions(+), 15 deletions(-)

diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
index 63c0334430134..931d1a56b79ca 100644
--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
@@ -4745,12 +4745,16 @@ static void mvpp2_port_copy_mac_addr(struct net_device *dev, struct mvpp2 *priv,
 	eth_hw_addr_random(dev);
 }
 
+static struct mvpp2_port *mvpp2_phylink_to_port(struct phylink_config *config)
+{
+	return container_of(config, struct mvpp2_port, phylink_config);
+}
+
 static void mvpp2_phylink_validate(struct phylink_config *config,
 				   unsigned long *supported,
 				   struct phylink_link_state *state)
 {
-	struct mvpp2_port *port = container_of(config, struct mvpp2_port,
-					       phylink_config);
+	struct mvpp2_port *port = mvpp2_phylink_to_port(config);
 	__ETHTOOL_DECLARE_LINK_MODE_MASK(mask) = { 0, };
 
 	/* Invalid combinations */
@@ -4877,8 +4881,7 @@ static void mvpp2_gmac_link_state(struct mvpp2_port *port,
 static int mvpp2_phylink_mac_link_state(struct phylink_config *config,
 					struct phylink_link_state *state)
 {
-	struct mvpp2_port *port = container_of(config, struct mvpp2_port,
-					       phylink_config);
+	struct mvpp2_port *port = mvpp2_phylink_to_port(config);
 
 	if (port->priv->hw_version == MVPP22 && port->gop_id == 0) {
 		u32 mode = readl(port->base + MVPP22_XLG_CTRL3_REG);
@@ -4896,8 +4899,7 @@ static int mvpp2_phylink_mac_link_state(struct phylink_config *config,
 
 static void mvpp2_mac_an_restart(struct phylink_config *config)
 {
-	struct mvpp2_port *port = container_of(config, struct mvpp2_port,
-					       phylink_config);
+	struct mvpp2_port *port = mvpp2_phylink_to_port(config);
 	u32 val = readl(port->base + MVPP2_GMAC_AUTONEG_CONFIG);
 
 	writel(val | MVPP2_GMAC_IN_BAND_RESTART_AN,
@@ -5085,13 +5087,12 @@ static void mvpp2_gmac_config(struct mvpp2_port *port, unsigned int mode,
 static void mvpp2_mac_config(struct phylink_config *config, unsigned int mode,
 			     const struct phylink_link_state *state)
 {
-	struct net_device *dev = to_net_dev(config->dev);
-	struct mvpp2_port *port = netdev_priv(dev);
+	struct mvpp2_port *port = mvpp2_phylink_to_port(config);
 	bool change_interface = port->phy_interface != state->interface;
 
 	/* Check for invalid configuration */
 	if (mvpp2_is_xlg(state->interface) && port->gop_id != 0) {
-		netdev_err(dev, "Invalid mode on %s\n", dev->name);
+		netdev_err(port->dev, "Invalid mode on %s\n", port->dev->name);
 		return;
 	}
 
@@ -5128,8 +5129,7 @@ static void mvpp2_mac_config(struct phylink_config *config, unsigned int mode,
 static void mvpp2_mac_link_up(struct phylink_config *config, unsigned int mode,
 			      phy_interface_t interface, struct phy_device *phy)
 {
-	struct net_device *dev = to_net_dev(config->dev);
-	struct mvpp2_port *port = netdev_priv(dev);
+	struct mvpp2_port *port = mvpp2_phylink_to_port(config);
 	u32 val;
 
 	if (!phylink_autoneg_inband(mode)) {
@@ -5150,14 +5150,13 @@ static void mvpp2_mac_link_up(struct phylink_config *config, unsigned int mode,
 
 	mvpp2_egress_enable(port);
 	mvpp2_ingress_enable(port);
-	netif_tx_wake_all_queues(dev);
+	netif_tx_wake_all_queues(port->dev);
 }
 
 static void mvpp2_mac_link_down(struct phylink_config *config,
 				unsigned int mode, phy_interface_t interface)
 {
-	struct net_device *dev = to_net_dev(config->dev);
-	struct mvpp2_port *port = netdev_priv(dev);
+	struct mvpp2_port *port = mvpp2_phylink_to_port(config);
 	u32 val;
 
 	if (!phylink_autoneg_inband(mode)) {
@@ -5174,7 +5173,7 @@ static void mvpp2_mac_link_down(struct phylink_config *config,
 		}
 	}
 
-	netif_tx_stop_all_queues(dev);
+	netif_tx_stop_all_queues(port->dev);
 	mvpp2_egress_disable(port);
 	mvpp2_ingress_disable(port);
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 037/453] drm/tegra: replace idr_init() by idr_init_base()
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (35 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.4 036/453] net: mvpp2: add mvpp2_phylink_to_port() helper Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.4 038/453] kernel/cpu: add arch override for clear_tasks_mm_cpumask() mm handling Greg Kroah-Hartman
                   ` (418 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Deepak R Varma, Thierry Reding, Sasha Levin

From: Deepak R Varma <mh12gx2825@gmail.com>

[ Upstream commit 41f71629b4c432f8dd47d70ace813be5f79d4d75 ]

idr_init() uses base 0 which is an invalid identifier for this driver.
The new function idr_init_base allows IDR to set the ID lookup from
base 1. This avoids all lookups that otherwise starts from 0 since
0 is always unused.


Signed-off-by: Deepak R Varma <mh12gx2825@gmail.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/tegra/drm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/tegra/drm.c b/drivers/gpu/drm/tegra/drm.c
index bc7cc32140f81..6833dfad7241b 100644
--- a/drivers/gpu/drm/tegra/drm.c
+++ b/drivers/gpu/drm/tegra/drm.c
@@ -256,7 +256,7 @@ static int tegra_drm_open(struct drm_device *drm, struct drm_file *filp)
 	if (!fpriv)
 		return -ENOMEM;
 
-	idr_init(&fpriv->contexts);
+	idr_init_base(&fpriv->contexts, 1);
 	mutex_init(&fpriv->lock);
 	filp->driver_priv = fpriv;
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 038/453] kernel/cpu: add arch override for clear_tasks_mm_cpumask() mm handling
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (36 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.4 037/453] drm/tegra: replace idr_init() by idr_init_base() Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.4 039/453] drm/tegra: sor: Disable clocks on error in tegra_sor_init() Greg Kroah-Hartman
                   ` (417 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Nicholas Piggin, Aneesh Kumar K.V,
	Peter Zijlstra (Intel),
	Michael Ellerman, Sasha Levin

From: Nicholas Piggin <npiggin@gmail.com>

[ Upstream commit 8ff00399b153440c1c83e20c43020385b416415b ]

powerpc/64s keeps a counter in the mm which counts bits set in
mm_cpumask as well as other things. This means it can't use generic code
to clear bits out of the mask and doesn't adjust the arch specific
counter.

Add an arch override that allows powerpc/64s to use
clear_tasks_mm_cpumask().

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20201126102530.691335-4-npiggin@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/cpu.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/kernel/cpu.c b/kernel/cpu.c
index 7527825ac7daa..fa0e5727b4d9c 100644
--- a/kernel/cpu.c
+++ b/kernel/cpu.c
@@ -815,6 +815,10 @@ void __init cpuhp_threads_init(void)
 }
 
 #ifdef CONFIG_HOTPLUG_CPU
+#ifndef arch_clear_mm_cpumask_cpu
+#define arch_clear_mm_cpumask_cpu(cpu, mm) cpumask_clear_cpu(cpu, mm_cpumask(mm))
+#endif
+
 /**
  * clear_tasks_mm_cpumask - Safely clear tasks' mm_cpumask for a CPU
  * @cpu: a CPU id
@@ -850,7 +854,7 @@ void clear_tasks_mm_cpumask(int cpu)
 		t = find_lock_task_mm(p);
 		if (!t)
 			continue;
-		cpumask_clear_cpu(cpu, mm_cpumask(t->mm));
+		arch_clear_mm_cpumask_cpu(cpu, t->mm);
 		task_unlock(t);
 	}
 	rcu_read_unlock();
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 039/453] drm/tegra: sor: Disable clocks on error in tegra_sor_init()
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (37 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.4 038/453] kernel/cpu: add arch override for clear_tasks_mm_cpumask() mm handling Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.4 040/453] habanalabs: put devices before driver removal Greg Kroah-Hartman
                   ` (416 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Qinglang Miao, Thierry Reding, Sasha Levin

From: Qinglang Miao <miaoqinglang@huawei.com>

[ Upstream commit bf3a3cdcad40e5928a22ea0fd200d17fd6d6308d ]

Fix the missing clk_disable_unprepare() before return from
tegra_sor_init() in the error handling case.

Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/tegra/sor.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/tegra/sor.c b/drivers/gpu/drm/tegra/sor.c
index 75e65d9536d54..6c3d221652393 100644
--- a/drivers/gpu/drm/tegra/sor.c
+++ b/drivers/gpu/drm/tegra/sor.c
@@ -2899,6 +2899,7 @@ static int tegra_sor_init(struct host1x_client *client)
 		if (err < 0) {
 			dev_err(sor->dev, "failed to deassert SOR reset: %d\n",
 				err);
+			clk_disable_unprepare(sor->clk);
 			return err;
 		}
 
@@ -2906,12 +2907,17 @@ static int tegra_sor_init(struct host1x_client *client)
 	}
 
 	err = clk_prepare_enable(sor->clk_safe);
-	if (err < 0)
+	if (err < 0) {
+		clk_disable_unprepare(sor->clk);
 		return err;
+	}
 
 	err = clk_prepare_enable(sor->clk_dp);
-	if (err < 0)
+	if (err < 0) {
+		clk_disable_unprepare(sor->clk_safe);
+		clk_disable_unprepare(sor->clk);
 		return err;
+	}
 
 	/*
 	 * Enable and unmask the HDA codec SCRATCH0 register interrupt. This
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 040/453] habanalabs: put devices before driver removal
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (38 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.4 039/453] drm/tegra: sor: Disable clocks on error in tegra_sor_init() Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.4 041/453] arm64: syscall: exit userspace before unmasking exceptions Greg Kroah-Hartman
                   ` (415 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ofir Bitton, Oded Gabbay, Sasha Levin

From: Ofir Bitton <obitton@habana.ai>

[ Upstream commit 5555b7c56bdec7a29c789fec27f84d40f52fbdfa ]

Driver never puts its device and control_device objects, hence
a memory leak is introduced every driver removal.

Signed-off-by: Ofir Bitton <obitton@habana.ai>
Reviewed-by: Oded Gabbay <ogabbay@kernel.org>
Signed-off-by: Oded Gabbay <ogabbay@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/misc/habanalabs/device.c | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/drivers/misc/habanalabs/device.c b/drivers/misc/habanalabs/device.c
index a7a4fed4d8995..3eeb1920ddb43 100644
--- a/drivers/misc/habanalabs/device.c
+++ b/drivers/misc/habanalabs/device.c
@@ -229,16 +229,16 @@ static int device_cdev_sysfs_add(struct hl_device *hdev)
 
 static void device_cdev_sysfs_del(struct hl_device *hdev)
 {
-	/* device_release() won't be called so must free devices explicitly */
-	if (!hdev->cdev_sysfs_created) {
-		kfree(hdev->dev_ctrl);
-		kfree(hdev->dev);
-		return;
-	}
+	if (!hdev->cdev_sysfs_created)
+		goto put_devices;
 
 	hl_sysfs_fini(hdev);
 	cdev_device_del(&hdev->cdev_ctrl, hdev->dev_ctrl);
 	cdev_device_del(&hdev->cdev, hdev->dev);
+
+put_devices:
+	put_device(hdev->dev);
+	put_device(hdev->dev_ctrl);
 }
 
 /*
@@ -1285,9 +1285,9 @@ int hl_device_init(struct hl_device *hdev, struct class *hclass)
 early_fini:
 	device_early_fini(hdev);
 free_dev_ctrl:
-	kfree(hdev->dev_ctrl);
+	put_device(hdev->dev_ctrl);
 free_dev:
-	kfree(hdev->dev);
+	put_device(hdev->dev);
 out_disabled:
 	hdev->disabled = true;
 	if (add_cdev_sysfs_on_err)
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 041/453] arm64: syscall: exit userspace before unmasking exceptions
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (39 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.4 040/453] habanalabs: put devices before driver removal Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.4 042/453] vxlan: Add needed_headroom for lower device Greg Kroah-Hartman
                   ` (414 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Mark Rutland, Catalin Marinas,
	James Morse, Will Deacon, Sasha Levin

From: Mark Rutland <mark.rutland@arm.com>

[ Upstream commit ca1314d73eed493c49bb1932c60a8605530db2e4 ]

In el0_svc_common() we unmask exceptions before we call user_exit(), and
so there's a window where an IRQ or debug exception can be taken while
RCU is not watching. In do_debug_exception() we account for this in via
debug_exception_{enter,exit}(), but in the el1_irq asm we do not and we
call trace functions which rely on RCU before we have a guarantee that
RCU is watching.

Let's avoid this by having el0_svc_common() exit userspace before
unmasking exceptions, matching what we do for all other EL0 entry paths.
We can use user_exit_irqoff() to avoid the pointless save/restore of IRQ
flags while we're sure exceptions are masked in DAIF.

The workaround for Cortex-A76 erratum 1463225 may trigger a debug
exception before this point, but the debug code invoked in this case is
safe even when RCU is not watching.

Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: James Morse <james.morse@arm.com>
Cc: Will Deacon <will@kernel.org>
Link: https://lore.kernel.org/r/20201130115950.22492-2-mark.rutland@arm.com
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/kernel/syscall.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/kernel/syscall.c b/arch/arm64/kernel/syscall.c
index 1457a0ba83dbc..f2d2dbbbfca20 100644
--- a/arch/arm64/kernel/syscall.c
+++ b/arch/arm64/kernel/syscall.c
@@ -102,8 +102,8 @@ static void el0_svc_common(struct pt_regs *regs, int scno, int sc_nr,
 	regs->syscallno = scno;
 
 	cortex_a76_erratum_1463225_svc_handler();
+	user_exit_irqoff();
 	local_daif_restore(DAIF_PROCCTX);
-	user_exit();
 
 	if (has_syscall_work(flags)) {
 		/* set default errno for user-issued syscall(-1) */
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 042/453] vxlan: Add needed_headroom for lower device
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (40 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.4 041/453] arm64: syscall: exit userspace before unmasking exceptions Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.4 043/453] vxlan: Copy needed_tailroom from lowerdev Greg Kroah-Hartman
                   ` (413 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Annika Wickert, Sven Eckelmann,
	Annika Wickert, Jakub Kicinski, Sasha Levin

From: Sven Eckelmann <sven@narfation.org>

[ Upstream commit 0a35dc41fea67ac4495ce7584406bf9557a6e7d0 ]

It was observed that sending data via batadv over vxlan (on top of
wireguard) reduced the performance massively compared to raw ethernet or
batadv on raw ethernet. A check of perf data showed that the
vxlan_build_skb was calling all the time pskb_expand_head to allocate
enough headroom for:

  min_headroom = LL_RESERVED_SPACE(dst->dev) + dst->header_len
  		+ VXLAN_HLEN + iphdr_len;

But the vxlan_config_apply only requested needed headroom for:

  lowerdev->hard_header_len + VXLAN6_HEADROOM or VXLAN_HEADROOM

So it completely ignored the needed_headroom of the lower device. The first
caller of net_dev_xmit could therefore never make sure that enough headroom
was allocated for the rest of the transmit path.

Cc: Annika Wickert <annika.wickert@exaring.de>
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Tested-by: Annika Wickert <aw@awlnx.space>
Link: https://lore.kernel.org/r/20201126125247.1047977-1-sven@narfation.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/vxlan.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index 630ac00a34ede..3753cf0942865 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -3538,6 +3538,7 @@ static void vxlan_config_apply(struct net_device *dev,
 		dev->gso_max_segs = lowerdev->gso_max_segs;
 
 		needed_headroom = lowerdev->hard_header_len;
+		needed_headroom += lowerdev->needed_headroom;
 
 		max_mtu = lowerdev->mtu - (use_ipv6 ? VXLAN6_HEADROOM :
 					   VXLAN_HEADROOM);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 043/453] vxlan: Copy needed_tailroom from lowerdev
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (41 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.4 042/453] vxlan: Add needed_headroom for lower device Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.4 044/453] scsi: mpt3sas: Increase IOCInit request timeout to 30s Greg Kroah-Hartman
                   ` (412 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sven Eckelmann, Jakub Kicinski, Sasha Levin

From: Sven Eckelmann <sven@narfation.org>

[ Upstream commit a5e74021e84bb5eadf760aaf2c583304f02269be ]

While vxlan doesn't need any extra tailroom, the lowerdev might need it. In
that case, copy it over to reduce the chance for additional (re)allocations
in the transmit path.

Signed-off-by: Sven Eckelmann <sven@narfation.org>
Link: https://lore.kernel.org/r/20201126125247.1047977-2-sven@narfation.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/vxlan.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index 3753cf0942865..5502e145aa17b 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -3540,6 +3540,8 @@ static void vxlan_config_apply(struct net_device *dev,
 		needed_headroom = lowerdev->hard_header_len;
 		needed_headroom += lowerdev->needed_headroom;
 
+		dev->needed_tailroom = lowerdev->needed_tailroom;
+
 		max_mtu = lowerdev->mtu - (use_ipv6 ? VXLAN6_HEADROOM :
 					   VXLAN_HEADROOM);
 		if (max_mtu < ETH_MIN_MTU)
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 044/453] scsi: mpt3sas: Increase IOCInit request timeout to 30s
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (42 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.4 043/453] vxlan: Copy needed_tailroom from lowerdev Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.4 045/453] dm table: Remove BUG_ON(in_interrupt()) Greg Kroah-Hartman
                   ` (411 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sreekanth Reddy, Martin K. Petersen,
	Sasha Levin

From: Sreekanth Reddy <sreekanth.reddy@broadcom.com>

[ Upstream commit 85dad327d9b58b4c9ce08189a2707167de392d23 ]

Currently the IOCInit request message timeout is set to 10s. This is not
sufficient in some scenarios such as during HBA FW downgrade operations.

Increase the IOCInit request timeout to 30s.

Link: https://lore.kernel.org/r/20201130082733.26120-1-sreekanth.reddy@broadcom.com
Signed-off-by: Sreekanth Reddy <sreekanth.reddy@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/mpt3sas/mpt3sas_base.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c
index 8be8c510fdf79..7532603aafb15 100644
--- a/drivers/scsi/mpt3sas/mpt3sas_base.c
+++ b/drivers/scsi/mpt3sas/mpt3sas_base.c
@@ -6227,7 +6227,7 @@ _base_send_ioc_init(struct MPT3SAS_ADAPTER *ioc)
 
 	r = _base_handshake_req_reply_wait(ioc,
 	    sizeof(Mpi2IOCInitRequest_t), (u32 *)&mpi_request,
-	    sizeof(Mpi2IOCInitReply_t), (u16 *)&mpi_reply, 10);
+	    sizeof(Mpi2IOCInitReply_t), (u16 *)&mpi_reply, 30);
 
 	if (r != 0) {
 		ioc_err(ioc, "%s: handshake failed (r=%d)\n", __func__, r);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 045/453] dm table: Remove BUG_ON(in_interrupt())
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (43 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.4 044/453] scsi: mpt3sas: Increase IOCInit request timeout to 30s Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.4 046/453] iwlwifi: pcie: add one missing entry for AX210 Greg Kroah-Hartman
                   ` (410 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Thomas Gleixner,
	Sebastian Andrzej Siewior, Mike Snitzer, Sasha Levin

From: Thomas Gleixner <tglx@linutronix.de>

[ Upstream commit e7b624183d921b49ef0a96329f21647d38865ee9 ]

The BUG_ON(in_interrupt()) in dm_table_event() is a historic leftover from
a rework of the dm table code which changed the calling context.

Issuing a BUG for a wrong calling context is frowned upon and
in_interrupt() is deprecated and only covering parts of the wrong
contexts. The sanity check for the context is covered by
CONFIG_DEBUG_ATOMIC_SLEEP and other debug facilities already.

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/md/dm-table.c | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
index 13ad791126618..6dd56afa048c2 100644
--- a/drivers/md/dm-table.c
+++ b/drivers/md/dm-table.c
@@ -1320,12 +1320,6 @@ void dm_table_event_callback(struct dm_table *t,
 
 void dm_table_event(struct dm_table *t)
 {
-	/*
-	 * You can no longer call dm_table_event() from interrupt
-	 * context, use a bottom half instead.
-	 */
-	BUG_ON(in_interrupt());
-
 	mutex_lock(&_event_lock);
 	if (t->event_fn)
 		t->event_fn(t->event_context);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 046/453] iwlwifi: pcie: add one missing entry for AX210
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (44 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.4 045/453] dm table: Remove BUG_ON(in_interrupt()) Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.4 047/453] drm/amd/display: Init clock value by current vbios CLKs Greg Kroah-Hartman
                   ` (409 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Luca Coelho, Kalle Valo, Sasha Levin

From: Luca Coelho <luciano.coelho@intel.com>

[ Upstream commit 5febcdef30902fa870128b9789b873199f13aff1 ]

The 0x0024 subsytem device ID was missing from the list, so some AX210
devices were not recognized.  Add it.

Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/iwlwifi.20201202143859.308eab4db42c.I3763196cd3f7bb36f3dcabf02ec4e7c4fe859c0f@changeid
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
index b0b7eca1754ed..f34297fd453c0 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
@@ -968,6 +968,7 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
 
 	{IWL_PCI_DEVICE(0x2725, 0x0090, iwlax211_2ax_cfg_so_gf_a0)},
 	{IWL_PCI_DEVICE(0x2725, 0x0020, iwlax210_2ax_cfg_ty_gf_a0)},
+	{IWL_PCI_DEVICE(0x2725, 0x0024, iwlax210_2ax_cfg_ty_gf_a0)},
 	{IWL_PCI_DEVICE(0x2725, 0x0310, iwlax210_2ax_cfg_ty_gf_a0)},
 	{IWL_PCI_DEVICE(0x2725, 0x0510, iwlax210_2ax_cfg_ty_gf_a0)},
 	{IWL_PCI_DEVICE(0x2725, 0x0A10, iwlax210_2ax_cfg_ty_gf_a0)},
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 047/453] drm/amd/display: Init clock value by current vbios CLKs
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (45 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.4 046/453] iwlwifi: pcie: add one missing entry for AX210 Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.4 048/453] perf/x86/intel: Check PEBS status correctly Greg Kroah-Hartman
                   ` (408 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Brandon Syu, Tony Cheng,
	Aurabindo Pillai, Alex Deucher, Sasha Levin

From: Brandon Syu <Brandon.Syu@amd.com>

[ Upstream commit 7e0b367db85ef7b91399006253759a024eab7653 ]

[Why]
While booting into OS, driver updates DPP/DISP CLKs.
But init clock value is zero which is invalid.

[How]
Get current clocks value to update init clocks.
To avoid underflow.

Signed-off-by: Brandon Syu <Brandon.Syu@amd.com>
Reviewed-by: Tony Cheng <Tony.Cheng@amd.com>
Acked-by: Aurabindo Pillai <aurabindo.pillai@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c   | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c
index dd92f9c295b45..9f301f8575a54 100644
--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c
+++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c
@@ -97,8 +97,17 @@ void rn_update_clocks(struct clk_mgr *clk_mgr_base,
 			new_clocks->dppclk_khz = 100000;
 	}
 
-	if (should_set_clock(safe_to_lower, new_clocks->dppclk_khz, clk_mgr->base.clks.dppclk_khz)) {
-		if (clk_mgr->base.clks.dppclk_khz > new_clocks->dppclk_khz)
+	/*
+	 * Temporally ignore thew 0 cases for disp and dpp clks.
+	 * We may have a new feature that requires 0 clks in the future.
+	 */
+	if (new_clocks->dppclk_khz == 0 || new_clocks->dispclk_khz == 0) {
+		new_clocks->dppclk_khz = clk_mgr_base->clks.dppclk_khz;
+		new_clocks->dispclk_khz = clk_mgr_base->clks.dispclk_khz;
+	}
+
+	if (should_set_clock(safe_to_lower, new_clocks->dppclk_khz, clk_mgr_base->clks.dppclk_khz)) {
+		if (clk_mgr_base->clks.dppclk_khz > new_clocks->dppclk_khz)
 			dpp_clock_lowered = true;
 		clk_mgr_base->clks.dppclk_khz = new_clocks->dppclk_khz;
 		update_dppclk = true;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 048/453] perf/x86/intel: Check PEBS status correctly
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (46 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.4 047/453] drm/amd/display: Init clock value by current vbios CLKs Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.4 049/453] kbuild: avoid split lines in .mod files Greg Kroah-Hartman
                   ` (407 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Namhyung Kim, Stephane Eranian,
	Peter Zijlstra (Intel),
	Sasha Levin

From: Stephane Eranian <eranian@google.com>

[ Upstream commit fc17db8aa4c53cbd2d5469bb0521ea0f0a6dbb27 ]

The kernel cannot disambiguate when 2+ PEBS counters overflow at the
same time. This is what the comment for this code suggests.  However,
I see the comparison is done with the unfiltered p->status which is a
copy of IA32_PERF_GLOBAL_STATUS at the time of the sample. This
register contains more than the PEBS counter overflow bits. It also
includes many other bits which could also be set.

Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Stephane Eranian <eranian@google.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/20201126110922.317681-2-namhyung@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/events/intel/ds.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/events/intel/ds.c b/arch/x86/events/intel/ds.c
index 1aaba2c8a9ba6..eb8bd0eeace7d 100644
--- a/arch/x86/events/intel/ds.c
+++ b/arch/x86/events/intel/ds.c
@@ -1912,7 +1912,7 @@ static void intel_pmu_drain_pebs_nhm(struct pt_regs *iregs)
 		 * that caused the PEBS record. It's called collision.
 		 * If collision happened, the record will be dropped.
 		 */
-		if (p->status != (1ULL << bit)) {
+		if (pebs_status != (1ULL << bit)) {
 			for_each_set_bit(i, (unsigned long *)&pebs_status, size)
 				error[i]++;
 			continue;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 049/453] kbuild: avoid split lines in .mod files
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (47 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.4 048/453] perf/x86/intel: Check PEBS status correctly Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.4 050/453] soc/tegra: fuse: Fix index bug in get_process_id Greg Kroah-Hartman
                   ` (406 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sami Tolvanen, Masahiro Yamada, Sasha Levin

From: Masahiro Yamada <masahiroy@kernel.org>

[ Upstream commit 7d32358be8acb119dcfe39b6cf67ec6d94bf1fe7 ]

"xargs echo" is not a safe way to remove line breaks because the input
may exceed the command line limit and xargs may break it up into
multiple invocations of echo. This should never happen because
scripts/gen_autoksyms.sh expects all undefined symbols are placed in
the second line of .mod files.

One possible way is to replace "xargs echo" with
"sed ':x;N;$!bx;s/\n/ /g'" or something, but I rewrote the code by
using awk because it is more readable.

This issue was reported by Sami Tolvanen; in his Clang LTO patch set,
$(multi-used-m) is no longer an ELF object, but a thin archive that
contains LLVM bitcode files. llvm-nm prints out symbols for each
archive member separately, which results a lot of dupications, in some
places, beyond the system-defined limit.

This problem must be fixed irrespective of LTO, and we must ensure
zero possibility of having this issue.

Link: https://lkml.org/lkml/2020/12/1/1658
Reported-by: Sami Tolvanen <samitolvanen@google.com>
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Reviewed-by: Sami Tolvanen <samitolvanen@google.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 scripts/Makefile.build | 12 ++++--------
 1 file changed, 4 insertions(+), 8 deletions(-)

diff --git a/scripts/Makefile.build b/scripts/Makefile.build
index 24a33c01bbf7c..9c689d011bced 100644
--- a/scripts/Makefile.build
+++ b/scripts/Makefile.build
@@ -234,6 +234,9 @@ objtool_dep = $(objtool_obj)					\
 ifdef CONFIG_TRIM_UNUSED_KSYMS
 cmd_gen_ksymdeps = \
 	$(CONFIG_SHELL) $(srctree)/scripts/gen_ksymdeps.sh $@ >> $(dot-target).cmd
+
+# List module undefined symbols
+undefined_syms = $(NM) $< | $(AWK) '$$1 == "U" { printf("%s%s", x++ ? " " : "", $$2) }';
 endif
 
 define rule_cc_o_c
@@ -253,13 +256,6 @@ define rule_as_o_S
 	$(call cmd,modversions_S)
 endef
 
-# List module undefined symbols (or empty line if not enabled)
-ifdef CONFIG_TRIM_UNUSED_KSYMS
-cmd_undef_syms = $(NM) $< | sed -n 's/^  *U //p' | xargs echo
-else
-cmd_undef_syms = echo
-endif
-
 # Built-in and composite module parts
 $(obj)/%.o: $(src)/%.c $(recordmcount_source) $(objtool_dep) FORCE
 	$(call cmd,force_checksrc)
@@ -267,7 +263,7 @@ $(obj)/%.o: $(src)/%.c $(recordmcount_source) $(objtool_dep) FORCE
 
 cmd_mod = { \
 	echo $(if $($*-objs)$($*-y)$($*-m), $(addprefix $(obj)/, $($*-objs) $($*-y) $($*-m)), $(@:.mod=.o)); \
-	$(cmd_undef_syms); \
+	$(undefined_syms) echo; \
 	} > $@
 
 $(obj)/%.mod: $(obj)/%.o FORCE
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 050/453] soc/tegra: fuse: Fix index bug in get_process_id
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (48 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.4 049/453] kbuild: avoid split lines in .mod files Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.4 051/453] usb: mtu3: fix memory corruption in mtu3_debugfs_regset() Greg Kroah-Hartman
                   ` (405 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Nicolin Chen, Thierry Reding

From: Nicolin Chen <nicoleotsuka@gmail.com>

commit b9ce9b0f83b536a4ac7de7567a265d28d13e5bea upstream.

This patch simply fixes a bug of referencing speedos[num] in every
for-loop iteration in get_process_id function.

Fixes: 0dc5a0d83675 ("soc/tegra: fuse: Add Tegra210 support")
Cc: <stable@vger.kernel.org>
Signed-off-by: Nicolin Chen <nicoleotsuka@gmail.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/soc/tegra/fuse/speedo-tegra210.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/soc/tegra/fuse/speedo-tegra210.c
+++ b/drivers/soc/tegra/fuse/speedo-tegra210.c
@@ -94,7 +94,7 @@ static int get_process_id(int value, con
 	unsigned int i;
 
 	for (i = 0; i < num; i++)
-		if (value < speedos[num])
+		if (value < speedos[i])
 			return i;
 
 	return -EINVAL;



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 051/453] usb: mtu3: fix memory corruption in mtu3_debugfs_regset()
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (49 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.4 050/453] soc/tegra: fuse: Fix index bug in get_process_id Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.4 052/453] USB: serial: option: add interface-number sanity check to flag handling Greg Kroah-Hartman
                   ` (404 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Dan Carpenter

From: Dan Carpenter <dan.carpenter@oracle.com>

commit 3f6f6343a29d9ea7429306b83b18e66dc1331d5c upstream.

This code is using the wrong sizeof() so it does not allocate enough
memory.  It allocates 32 bytes but 72 are required.  That will lead to
memory corruption.

Fixes: ae07809255d3 ("usb: mtu3: add debugfs interface files")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/X8ikqc4Mo2/0G72j@mwanda
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/mtu3/mtu3_debugfs.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/usb/mtu3/mtu3_debugfs.c
+++ b/drivers/usb/mtu3/mtu3_debugfs.c
@@ -127,7 +127,7 @@ static void mtu3_debugfs_regset(struct m
 	struct debugfs_regset32 *regset;
 	struct mtu3_regset *mregs;
 
-	mregs = devm_kzalloc(mtu->dev, sizeof(*regset), GFP_KERNEL);
+	mregs = devm_kzalloc(mtu->dev, sizeof(*mregs), GFP_KERNEL);
 	if (!mregs)
 		return;
 



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 052/453] USB: serial: option: add interface-number sanity check to flag handling
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (50 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.4 051/453] usb: mtu3: fix memory corruption in mtu3_debugfs_regset() Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.4 053/453] USB: gadget: f_acm: add support for SuperSpeed Plus Greg Kroah-Hartman
                   ` (403 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, syzbot+8881b478dad0a7971f79, Johan Hovold

From: Johan Hovold <johan@kernel.org>

commit a251963f76fa0226d0fdf0c4f989496f18d9ae7f upstream.

Add an interface-number sanity check before testing the device flags to
avoid relying on undefined behaviour when left shifting in case a device
uses an interface number greater than or equal to BITS_PER_LONG (i.e. 64
or 32).

Reported-by: syzbot+8881b478dad0a7971f79@syzkaller.appspotmail.com
Fixes: c3a65808f04a ("USB: serial: option: reimplement interface masking")
Cc: stable@vger.kernel.org
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/serial/option.c |   23 +++++++++++++++++++++--
 1 file changed, 21 insertions(+), 2 deletions(-)

--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -563,6 +563,9 @@ static void option_instat_callback(struc
 
 /* Device flags */
 
+/* Highest interface number which can be used with NCTRL() and RSVD() */
+#define FLAG_IFNUM_MAX	7
+
 /* Interface does not support modem-control requests */
 #define NCTRL(ifnum)	((BIT(ifnum) & 0xff) << 8)
 
@@ -2101,6 +2104,14 @@ static struct usb_serial_driver * const
 
 module_usb_serial_driver(serial_drivers, option_ids);
 
+static bool iface_is_reserved(unsigned long device_flags, u8 ifnum)
+{
+	if (ifnum > FLAG_IFNUM_MAX)
+		return false;
+
+	return device_flags & RSVD(ifnum);
+}
+
 static int option_probe(struct usb_serial *serial,
 			const struct usb_device_id *id)
 {
@@ -2117,7 +2128,7 @@ static int option_probe(struct usb_seria
 	 * the same class/subclass/protocol as the serial interfaces.  Look at
 	 * the Windows driver .INF files for reserved interface numbers.
 	 */
-	if (device_flags & RSVD(iface_desc->bInterfaceNumber))
+	if (iface_is_reserved(device_flags, iface_desc->bInterfaceNumber))
 		return -ENODEV;
 
 	/*
@@ -2133,6 +2144,14 @@ static int option_probe(struct usb_seria
 	return 0;
 }
 
+static bool iface_no_modem_control(unsigned long device_flags, u8 ifnum)
+{
+	if (ifnum > FLAG_IFNUM_MAX)
+		return false;
+
+	return device_flags & NCTRL(ifnum);
+}
+
 static int option_attach(struct usb_serial *serial)
 {
 	struct usb_interface_descriptor *iface_desc;
@@ -2148,7 +2167,7 @@ static int option_attach(struct usb_seri
 
 	iface_desc = &serial->interface->cur_altsetting->desc;
 
-	if (!(device_flags & NCTRL(iface_desc->bInterfaceNumber)))
+	if (!iface_no_modem_control(device_flags, iface_desc->bInterfaceNumber))
 		data->use_send_setup = 1;
 
 	if (device_flags & ZLP)



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 053/453] USB: gadget: f_acm: add support for SuperSpeed Plus
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (51 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.4 052/453] USB: serial: option: add interface-number sanity check to flag handling Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.4 054/453] USB: gadget: f_midi: setup SuperSpeed Plus descriptors Greg Kroah-Hartman
                   ` (402 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Felipe Balbi, taehyun.cho,
	Will McVicker, Peter Chen

From: taehyun.cho <taehyun.cho@samsung.com>

commit 3ee05c20656782387aa9eb010fdb9bb16982ac3f upstream.

Setup the SuperSpeed Plus descriptors for f_acm.  This allows the gadget
to work properly without crashing at SuperSpeed rates.

Cc: Felipe Balbi <balbi@kernel.org>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: taehyun.cho <taehyun.cho@samsung.com>
Signed-off-by: Will McVicker <willmcvicker@google.com>
Reviewed-by: Peter Chen <peter.chen@nxp.com>
Link: https://lore.kernel.org/r/20201127140559.381351-3-gregkh@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/gadget/function/f_acm.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/usb/gadget/function/f_acm.c
+++ b/drivers/usb/gadget/function/f_acm.c
@@ -684,7 +684,7 @@ acm_bind(struct usb_configuration *c, st
 	acm_ss_out_desc.bEndpointAddress = acm_fs_out_desc.bEndpointAddress;
 
 	status = usb_assign_descriptors(f, acm_fs_function, acm_hs_function,
-			acm_ss_function, NULL);
+			acm_ss_function, acm_ss_function);
 	if (status)
 		goto fail;
 



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 054/453] USB: gadget: f_midi: setup SuperSpeed Plus descriptors
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (52 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.4 053/453] USB: gadget: f_acm: add support for SuperSpeed Plus Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.4 055/453] usb: gadget: f_fs: Re-use SS descriptors for SuperSpeedPlus Greg Kroah-Hartman
                   ` (401 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Felipe Balbi, Will McVicker, Peter Chen

From: Will McVicker <willmcvicker@google.com>

commit 457a902ba1a73b7720666b21ca038cd19764db18 upstream.

Needed for SuperSpeed Plus support for f_midi.  This allows the
gadget to work properly without crashing at SuperSpeed rates.

Cc: Felipe Balbi <balbi@kernel.org>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Will McVicker <willmcvicker@google.com>
Reviewed-by: Peter Chen <peter.chen@nxp.com>
Link: https://lore.kernel.org/r/20201127140559.381351-4-gregkh@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/gadget/function/f_midi.c |    6 ++++++
 1 file changed, 6 insertions(+)

--- a/drivers/usb/gadget/function/f_midi.c
+++ b/drivers/usb/gadget/function/f_midi.c
@@ -1048,6 +1048,12 @@ static int f_midi_bind(struct usb_config
 		f->ss_descriptors = usb_copy_descriptors(midi_function);
 		if (!f->ss_descriptors)
 			goto fail_f_midi;
+
+		if (gadget_is_superspeed_plus(c->cdev->gadget)) {
+			f->ssp_descriptors = usb_copy_descriptors(midi_function);
+			if (!f->ssp_descriptors)
+				goto fail_f_midi;
+		}
 	}
 
 	kfree(midi_function);



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 055/453] usb: gadget: f_fs: Re-use SS descriptors for SuperSpeedPlus
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (53 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.4 054/453] USB: gadget: f_midi: setup SuperSpeed Plus descriptors Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.4 056/453] USB: gadget: f_rndis: fix bitrate for SuperSpeed and above Greg Kroah-Hartman
                   ` (400 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jack Pham

From: Jack Pham <jackp@codeaurora.org>

commit a353397b0d5dfa3c99b372505db3378fc919c6c6 upstream.

In many cases a function that supports SuperSpeed can very well
operate in SuperSpeedPlus, if a gadget controller supports it,
as the endpoint descriptors (and companion descriptors) are
generally identical and can be re-used. This is true for two
commonly used functions: Android's ADB and MTP. So we can simply
assign the usb_function's ssp_descriptors array to point to its
ss_descriptors, if available. Similarly, we need to allow an
epfile's ioctl for FUNCTIONFS_ENDPOINT_DESC to correctly
return the corresponding SuperSpeed endpoint descriptor in case
the connected speed is SuperSpeedPlus as well.

The only exception is if a function wants to implement an
Isochronous endpoint capable of transferring more than 48KB per
service interval when operating at greater than USB 3.1 Gen1
speed, in which case it would require an additional SuperSpeedPlus
Isochronous Endpoint Companion descriptor to be returned as part
of the Configuration Descriptor. Support for that would need
to be separately added to the userspace-facing FunctionFS API
which may not be a trivial task--likely a new descriptor format
(v3?) may need to be devised to allow for separate SS and SSP
descriptors to be supplied.

Signed-off-by: Jack Pham <jackp@codeaurora.org>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201027230731.9073-1-jackp@codeaurora.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/gadget/function/f_fs.c |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -1332,6 +1332,7 @@ static long ffs_epfile_ioctl(struct file
 
 		switch (epfile->ffs->gadget->speed) {
 		case USB_SPEED_SUPER:
+		case USB_SPEED_SUPER_PLUS:
 			desc_idx = 2;
 			break;
 		case USB_SPEED_HIGH:
@@ -3193,7 +3194,8 @@ static int _ffs_func_bind(struct usb_con
 	}
 
 	if (likely(super)) {
-		func->function.ss_descriptors = vla_ptr(vlabuf, d, ss_descs);
+		func->function.ss_descriptors = func->function.ssp_descriptors =
+			vla_ptr(vlabuf, d, ss_descs);
 		ss_len = ffs_do_descs(ffs->ss_descs_count,
 				vla_ptr(vlabuf, d, raw_descs) + fs_len + hs_len,
 				d_raw_descs__sz - fs_len - hs_len,
@@ -3603,6 +3605,7 @@ static void ffs_func_unbind(struct usb_c
 	func->function.fs_descriptors = NULL;
 	func->function.hs_descriptors = NULL;
 	func->function.ss_descriptors = NULL;
+	func->function.ssp_descriptors = NULL;
 	func->interfaces_nums = NULL;
 
 	ffs_event_add(ffs, FUNCTIONFS_UNBIND);



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 056/453] USB: gadget: f_rndis: fix bitrate for SuperSpeed and above
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (54 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.4 055/453] usb: gadget: f_fs: Re-use SS descriptors for SuperSpeedPlus Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.4 057/453] usb: chipidea: ci_hdrc_imx: Pass DISABLE_DEVICE_STREAMING flag to imx6ul Greg Kroah-Hartman
                   ` (399 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Felipe Balbi, EJ Hsu, Peter Chen,
	Will McVicker

From: Will McVicker <willmcvicker@google.com>

commit b00f444f9add39b64d1943fa75538a1ebd54a290 upstream.

Align the SuperSpeed Plus bitrate for f_rndis to match f_ncm's ncm_bitrate
defined by commit 1650113888fe ("usb: gadget: f_ncm: add SuperSpeed descriptors
for CDC NCM").

Cc: Felipe Balbi <balbi@kernel.org>
Cc: EJ Hsu <ejh@nvidia.com>
Cc: Peter Chen <peter.chen@nxp.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Will McVicker <willmcvicker@google.com>
Reviewed-by: Peter Chen <peter.chen@nxp.com>
Link: https://lore.kernel.org/r/20201127140559.381351-2-gregkh@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/gadget/function/f_rndis.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/drivers/usb/gadget/function/f_rndis.c
+++ b/drivers/usb/gadget/function/f_rndis.c
@@ -87,8 +87,10 @@ static inline struct f_rndis *func_to_rn
 /* peak (theoretical) bulk transfer rate in bits-per-second */
 static unsigned int bitrate(struct usb_gadget *g)
 {
+	if (gadget_is_superspeed(g) && g->speed >= USB_SPEED_SUPER_PLUS)
+		return 4250000000U;
 	if (gadget_is_superspeed(g) && g->speed == USB_SPEED_SUPER)
-		return 13 * 1024 * 8 * 1000 * 8;
+		return 3750000000U;
 	else if (gadget_is_dualspeed(g) && g->speed == USB_SPEED_HIGH)
 		return 13 * 512 * 8 * 1000 * 8;
 	else



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 057/453] usb: chipidea: ci_hdrc_imx: Pass DISABLE_DEVICE_STREAMING flag to imx6ul
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (55 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.4 056/453] USB: gadget: f_rndis: fix bitrate for SuperSpeed and above Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.4 058/453] ARM: dts: exynos: fix roles of USB 3.0 ports on Odroid XU Greg Kroah-Hartman
                   ` (398 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Fabio Estevam, Peter Chen

From: Fabio Estevam <festevam@gmail.com>

commit c7721e15f434920145c376e8fe77e1c079fc3726 upstream.

According to the i.MX6UL Errata document:
https://www.nxp.com/docs/en/errata/IMX6ULCE.pdf

ERR007881 also affects i.MX6UL, so pass the
CI_HDRC_DISABLE_DEVICE_STREAMING flag to workaround the issue.

Fixes: 52fe568e5d71 ("usb: chipidea: imx: add imx6ul usb support")
Cc: <stable@vger.kernel.org>
Signed-off-by: Fabio Estevam <festevam@gmail.com>
Signed-off-by: Peter Chen <peter.chen@nxp.com>
Link: https://lore.kernel.org/r/20201207020909.22483-2-peter.chen@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/chipidea/ci_hdrc_imx.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/usb/chipidea/ci_hdrc_imx.c
+++ b/drivers/usb/chipidea/ci_hdrc_imx.c
@@ -57,7 +57,8 @@ static const struct ci_hdrc_imx_platform
 
 static const struct ci_hdrc_imx_platform_flag imx6ul_usb_data = {
 	.flags = CI_HDRC_SUPPORTS_RUNTIME_PM |
-		CI_HDRC_TURN_VBUS_EARLY_ON,
+		CI_HDRC_TURN_VBUS_EARLY_ON |
+		CI_HDRC_DISABLE_DEVICE_STREAMING,
 };
 
 static const struct ci_hdrc_imx_platform_flag imx7d_usb_data = {



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 058/453] ARM: dts: exynos: fix roles of USB 3.0 ports on Odroid XU
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (56 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.4 057/453] usb: chipidea: ci_hdrc_imx: Pass DISABLE_DEVICE_STREAMING flag to imx6ul Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.4 059/453] ARM: dts: exynos: fix USB 3.0 VBUS control and over-current pins on Exynos5410 Greg Kroah-Hartman
                   ` (397 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Krzysztof Kozlowski, Gabriel Ribba Esteva

From: Krzysztof Kozlowski <krzk@kernel.org>

commit ecc1ff532b499d20304a4f682247137025814c34 upstream.

On Odroid XU board the USB3-0 port is a microUSB and USB3-1 port is USB
type A (host).  The roles were copied from Odroid XU3 (Exynos5422)
design which has it reversed.

Fixes: 8149afe4dbf9 ("ARM: dts: exynos: Add initial support for Odroid XU board")
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201015182044.480562-1-krzk@kernel.org
Tested-by: Gabriel Ribba Esteva <gabriel.ribbae@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/arm/boot/dts/exynos5410-odroidxu.dts |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/arch/arm/boot/dts/exynos5410-odroidxu.dts
+++ b/arch/arm/boot/dts/exynos5410-odroidxu.dts
@@ -637,11 +637,11 @@
 };
 
 &usbdrd_dwc3_0 {
-	dr_mode = "host";
+	dr_mode = "peripheral";
 };
 
 &usbdrd_dwc3_1 {
-	dr_mode = "peripheral";
+	dr_mode = "host";
 };
 
 &usbdrd3_0 {



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 059/453] ARM: dts: exynos: fix USB 3.0 VBUS control and over-current pins on Exynos5410
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (57 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.4 058/453] ARM: dts: exynos: fix roles of USB 3.0 ports on Odroid XU Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.4 060/453] ARM: dts: exynos: fix USB 3.0 pins supply being turned off on Odroid XU Greg Kroah-Hartman
                   ` (396 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Krzysztof Kozlowski, Gabriel Ribba Esteva

From: Krzysztof Kozlowski <krzk@kernel.org>

commit 3d992fd8f4e0f09c980726308d2f2725587b32d6 upstream.

The VBUS control (PWREN) and over-current pins of USB 3.0 DWC3
controllers are on Exynos5410 regular GPIOs.  This is different than for
example on Exynos5422 where these are special ETC pins with proper reset
values (pulls, functions).

Therefore these pins should be configured to enable proper USB 3.0
peripheral and host modes.  This also fixes over-current warning:

    [    6.024658] usb usb4-port1: over-current condition
    [    6.028271] usb usb3-port1: over-current condition

Fixes: cb0896562228 ("ARM: dts: exynos: Add USB to Exynos5410")
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201015182044.480562-2-krzk@kernel.org
Tested-by: Gabriel Ribba Esteva <gabriel.ribbae@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/arm/boot/dts/exynos5410-pinctrl.dtsi |   28 ++++++++++++++++++++++++++++
 arch/arm/boot/dts/exynos5410.dtsi         |    4 ++++
 2 files changed, 32 insertions(+)

--- a/arch/arm/boot/dts/exynos5410-pinctrl.dtsi
+++ b/arch/arm/boot/dts/exynos5410-pinctrl.dtsi
@@ -560,6 +560,34 @@
 		interrupt-controller;
 		#interrupt-cells = <2>;
 	};
+
+	usb3_1_oc: usb3-1-oc {
+		samsung,pins = "gpk2-4", "gpk2-5";
+		samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
+		samsung,pin-pud = <EXYNOS_PIN_PULL_UP>;
+		samsung,pin-drv = <EXYNOS5420_PIN_DRV_LV1>;
+	};
+
+	usb3_1_vbusctrl: usb3-1-vbusctrl {
+		samsung,pins = "gpk2-6", "gpk2-7";
+		samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
+		samsung,pin-pud = <EXYNOS_PIN_PULL_DOWN>;
+		samsung,pin-drv = <EXYNOS5420_PIN_DRV_LV1>;
+	};
+
+	usb3_0_oc: usb3-0-oc {
+		samsung,pins = "gpk3-0", "gpk3-1";
+		samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
+		samsung,pin-pud = <EXYNOS_PIN_PULL_UP>;
+		samsung,pin-drv = <EXYNOS5420_PIN_DRV_LV1>;
+	};
+
+	usb3_0_vbusctrl: usb3-0-vbusctrl {
+		samsung,pins = "gpk3-2", "gpk3-3";
+		samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
+		samsung,pin-pud = <EXYNOS_PIN_PULL_DOWN>;
+		samsung,pin-drv = <EXYNOS5420_PIN_DRV_LV1>;
+	};
 };
 
 &pinctrl_2 {
--- a/arch/arm/boot/dts/exynos5410.dtsi
+++ b/arch/arm/boot/dts/exynos5410.dtsi
@@ -398,6 +398,8 @@
 &usbdrd3_0 {
 	clocks = <&clock CLK_USBD300>;
 	clock-names = "usbdrd30";
+	pinctrl-names = "default";
+	pinctrl-0 = <&usb3_0_oc>, <&usb3_0_vbusctrl>;
 };
 
 &usbdrd_phy0 {
@@ -409,6 +411,8 @@
 &usbdrd3_1 {
 	clocks = <&clock CLK_USBD301>;
 	clock-names = "usbdrd30";
+	pinctrl-names = "default";
+	pinctrl-0 = <&usb3_1_oc>, <&usb3_1_vbusctrl>;
 };
 
 &usbdrd_dwc3_1 {



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 060/453] ARM: dts: exynos: fix USB 3.0 pins supply being turned off on Odroid XU
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (58 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.4 059/453] ARM: dts: exynos: fix USB 3.0 VBUS control and over-current pins on Exynos5410 Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.4 061/453] coresight: tmc-etf: Fix NULL ptr dereference in tmc_enable_etf_sink_perf() Greg Kroah-Hartman
                   ` (395 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Krzysztof Kozlowski, Gabriel Ribba Esteva

From: Krzysztof Kozlowski <krzk@kernel.org>

commit bd7e7ff56feea7810df900fb09c9741d259861d9 upstream.

On Odroid XU LDO12 and LDO15 supplies the power to USB 3.0 blocks but
the GPK GPIO pins are supplied by LDO7 (VDDQ_LCD).  LDO7 also supplies
GPJ GPIO pins.

The Exynos pinctrl driver does not take any supplies, so to have entire
GPIO block always available, make the regulator always on.

Fixes: 88644b4c750b ("ARM: dts: exynos: Configure PWM, usb3503, PMIC and thermal on Odroid XU board")
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201015182044.480562-3-krzk@kernel.org
Tested-by: Gabriel Ribba Esteva <gabriel.ribbae@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/arm/boot/dts/exynos5410-odroidxu.dts |    2 ++
 1 file changed, 2 insertions(+)

--- a/arch/arm/boot/dts/exynos5410-odroidxu.dts
+++ b/arch/arm/boot/dts/exynos5410-odroidxu.dts
@@ -327,6 +327,8 @@
 				regulator-name = "vddq_lcd";
 				regulator-min-microvolt = <1800000>;
 				regulator-max-microvolt = <1800000>;
+				/* Supplies also GPK and GPJ */
+				regulator-always-on;
 			};
 
 			ldo8_reg: LDO8 {



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 061/453] coresight: tmc-etf: Fix NULL ptr dereference in tmc_enable_etf_sink_perf()
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (59 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.4 060/453] ARM: dts: exynos: fix USB 3.0 pins supply being turned off on Odroid XU Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.4 062/453] coresight: tmc-etr: Check if page is valid before dma_map_page() Greg Kroah-Hartman
                   ` (394 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sai Prakash Ranjan, Mathieu Poirier

From: Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>

commit 868663dd5d69fef05bfb004f91da5c30e9b93461 upstream.

There was a report of NULL pointer dereference in ETF enable
path for perf CS mode with PID monitoring. It is almost 100%
reproducible when the process to monitor is something very
active such as chrome and with ETF as the sink and not ETR.
Currently in a bid to find the pid, the owner is dereferenced
via task_pid_nr() call in tmc_enable_etf_sink_perf() and with
owner being NULL, we get a NULL pointer dereference.

Looking at the ETR and other places in the kernel, ETF and the
ETB are the only places trying to dereference the task(owner)
in tmc_enable_etf_sink_perf() which is also called from the
sched_in path as in the call trace. Owner(task) is NULL even
in the case of ETR in tmc_enable_etr_sink_perf(), but since we
cache the PID in alloc_buffer() callback and it is done as part
of etm_setup_aux() when allocating buffer for ETR sink, we never
dereference this NULL pointer and we are safe. So lets do the
same thing with ETF and cache the PID to which the cs_buffer
belongs in tmc_alloc_etf_buffer() as done for ETR. This will
also remove the unnecessary function calls(task_pid_nr()) since
we are caching the PID.

Easily reproducible running below:

 perf record -e cs_etm/@tmc_etf0/ -N -p <pid>

Unable to handle kernel NULL pointer dereference at virtual address 0000000000000548
Mem abort info:
  ESR = 0x96000006
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
Data abort info:
  ISV = 0, ISS = 0x00000006
  CM = 0, WnR = 0
<snip>...
Call trace:
 tmc_enable_etf_sink+0xe4/0x280
 coresight_enable_path+0x168/0x1fc
 etm_event_start+0x8c/0xf8
 etm_event_add+0x38/0x54
 event_sched_in+0x194/0x2ac
 group_sched_in+0x54/0x12c
 flexible_sched_in+0xd8/0x120
 visit_groups_merge+0x100/0x16c
 ctx_flexible_sched_in+0x50/0x74
 ctx_sched_in+0xa4/0xa8
 perf_event_sched_in+0x60/0x6c
 perf_event_context_sched_in+0x98/0xe0
 __perf_event_task_sched_in+0x5c/0xd8
 finish_task_switch+0x184/0x1cc
 schedule_tail+0x20/0xec
 ret_from_fork+0x4/0x18

Fixes: 880af782c6e8 ("coresight: tmc-etf: Add support for CPU-wide trace scenarios")
Cc: stable@vger.kernel.org
Signed-off-by: Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
Link: https://lore.kernel.org/r/20201127175256.1092685-10-mathieu.poirier@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/hwtracing/coresight/coresight-priv.h    |    2 ++
 drivers/hwtracing/coresight/coresight-tmc-etf.c |    4 +++-
 2 files changed, 5 insertions(+), 1 deletion(-)

--- a/drivers/hwtracing/coresight/coresight-priv.h
+++ b/drivers/hwtracing/coresight/coresight-priv.h
@@ -86,6 +86,7 @@ enum cs_mode {
  * struct cs_buffer - keep track of a recording session' specifics
  * @cur:	index of the current buffer
  * @nr_pages:	max number of pages granted to us
+ * @pid:	PID this cs_buffer belongs to
  * @offset:	offset within the current buffer
  * @data_size:	how much we collected in this run
  * @snapshot:	is this run in snapshot mode
@@ -94,6 +95,7 @@ enum cs_mode {
 struct cs_buffers {
 	unsigned int		cur;
 	unsigned int		nr_pages;
+	pid_t			pid;
 	unsigned long		offset;
 	local_t			data_size;
 	bool			snapshot;
--- a/drivers/hwtracing/coresight/coresight-tmc-etf.c
+++ b/drivers/hwtracing/coresight/coresight-tmc-etf.c
@@ -227,6 +227,7 @@ static int tmc_enable_etf_sink_perf(stru
 	unsigned long flags;
 	struct tmc_drvdata *drvdata = dev_get_drvdata(csdev->dev.parent);
 	struct perf_output_handle *handle = data;
+	struct cs_buffers *buf = etm_perf_sink_config(handle);
 
 	spin_lock_irqsave(&drvdata->spinlock, flags);
 	do {
@@ -243,7 +244,7 @@ static int tmc_enable_etf_sink_perf(stru
 		}
 
 		/* Get a handle on the pid of the process to monitor */
-		pid = task_pid_nr(handle->event->owner);
+		pid = buf->pid;
 
 		if (drvdata->pid != -1 && drvdata->pid != pid) {
 			ret = -EBUSY;
@@ -399,6 +400,7 @@ static void *tmc_alloc_etf_buffer(struct
 	if (!buf)
 		return NULL;
 
+	buf->pid = task_pid_nr(event->owner);
 	buf->snapshot = overwrite;
 	buf->nr_pages = nr_pages;
 	buf->data_pages = pages;



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 062/453] coresight: tmc-etr: Check if page is valid before dma_map_page()
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (60 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.4 061/453] coresight: tmc-etf: Fix NULL ptr dereference in tmc_enable_etf_sink_perf() Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:44 ` [PATCH 5.4 063/453] coresight: tmc-etr: Fix barrier packet insertion for perf buffer Greg Kroah-Hartman
                   ` (393 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Suzuki K Poulose, Mao Jinlong,
	Sai Prakash Ranjan, Mathieu Poirier

From: Mao Jinlong <jinlmao@codeaurora.org>

commit 1cc573d5754e92372a7e30e35468644f8811e1a4 upstream.

alloc_pages_node() return should be checked before calling
dma_map_page() to make sure that valid page is mapped or
else it can lead to aborts as below:

 Unable to handle kernel paging request at virtual address ffffffc008000000
 Mem abort info:
 <snip>...
 pc : __dma_inv_area+0x40/0x58
 lr : dma_direct_map_page+0xd8/0x1c8

 Call trace:
  __dma_inv_area
  tmc_pages_alloc
  tmc_alloc_data_pages
  tmc_alloc_sg_table
  tmc_init_etr_sg_table
  tmc_alloc_etr_buf
  tmc_enable_etr_sink_sysfs
  tmc_enable_etr_sink
  coresight_enable_path
  coresight_enable
  enable_source_store
  dev_attr_store
  sysfs_kf_write

Fixes: 99443ea19e8b ("coresight: Add generic TMC sg table framework")
Cc: stable@vger.kernel.org
Reviewed-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Signed-off-by: Mao Jinlong <jinlmao@codeaurora.org>
Signed-off-by: Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
Link: https://lore.kernel.org/r/20201127175256.1092685-13-mathieu.poirier@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/hwtracing/coresight/coresight-tmc-etr.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/drivers/hwtracing/coresight/coresight-tmc-etr.c
+++ b/drivers/hwtracing/coresight/coresight-tmc-etr.c
@@ -217,6 +217,8 @@ static int tmc_pages_alloc(struct tmc_pa
 		} else {
 			page = alloc_pages_node(node,
 						GFP_KERNEL | __GFP_ZERO, 0);
+			if (!page)
+				goto err;
 		}
 		paddr = dma_map_page(real_dev, page, 0, PAGE_SIZE, dir);
 		if (dma_mapping_error(real_dev, paddr))



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 063/453] coresight: tmc-etr: Fix barrier packet insertion for perf buffer
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (61 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.4 062/453] coresight: tmc-etr: Check if page is valid before dma_map_page() Greg Kroah-Hartman
@ 2020-12-28 12:44 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.4 064/453] coresight: etb10: Fix possible NULL ptr dereference in etb_enable_perf() Greg Kroah-Hartman
                   ` (392 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:44 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Mathieu Poirier, Al Grant,
	Mike Leach, Suzuki K Poulose

From: Suzuki K Poulose <suzuki.poulose@arm.com>

commit 83be0b84fe846edf0c722fefe225482d5f0d7395 upstream.

When the ETR is used in perf mode with a larger buffer (configured
via sysfs or the default size of 1M) than the perf aux buffer size,
we end up inserting the barrier packet at the wrong offset, while
moving the offset forward. i.e, instead of the "new moved offset",
we insert it at the current hardware buffer offset. These packets
will not be visible as they are never copied and could lead to
corruption in the trace decoding side, as the decoder is not aware
that it needs to reset the decoding.

Fixes: ec13c78d7b45 ("coresight: tmc-etr: Add barrier packets when moving offset forward")
Cc: Mathieu Poirier <mathieu.poirier@linaro.org>
Cc: stable@vger.kernel.org
Reported-by: Al Grant <al.grant@arm.com>
Tested-by: Mike Leach <mike.leach@arm.com>
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
Link: https://lore.kernel.org/r/20201208182651.1597945-2-mathieu.poirier@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/hwtracing/coresight/coresight-tmc-etr.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/hwtracing/coresight/coresight-tmc-etr.c
+++ b/drivers/hwtracing/coresight/coresight-tmc-etr.c
@@ -1535,7 +1535,7 @@ tmc_update_etr_buffer(struct coresight_d
 
 	/* Insert barrier packets at the beginning, if there was an overflow */
 	if (lost)
-		tmc_etr_buf_insert_barrier_packet(etr_buf, etr_buf->offset);
+		tmc_etr_buf_insert_barrier_packet(etr_buf, offset);
 	tmc_etr_sync_perf_buffer(etr_perf, offset, size);
 
 	/*



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 064/453] coresight: etb10: Fix possible NULL ptr dereference in etb_enable_perf()
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (62 preceding siblings ...)
  2020-12-28 12:44 ` [PATCH 5.4 063/453] coresight: tmc-etr: Fix barrier packet insertion for perf buffer Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.4 065/453] scsi: megaraid_sas: Check user-provided offsets Greg Kroah-Hartman
                   ` (391 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sai Prakash Ranjan, Mathieu Poirier

From: Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>

commit 22b2beaa7f166f550424cbb3b988aeaa7ef0425a upstream.

There was a report of NULL pointer dereference in ETF enable
path for perf CS mode with PID monitoring. It is almost 100%
reproducible when the process to monitor is something very
active such as chrome and with ETF as the sink, not ETR.

But code path shows that ETB has a similar path as ETF, so
there could be possible NULL pointer dereference crash in
ETB as well. Currently in a bid to find the pid, the owner
is dereferenced via task_pid_nr() call in etb_enable_perf()
and with owner being NULL, we can get a NULL pointer
dereference, so have a similar fix as ETF where we cache PID
in alloc_buffer() callback which is called as the part of
etm_setup_aux().

Fixes: 75d7dbd38824 ("coresight: etb10: Add support for CPU-wide trace scenarios")
Cc: stable@vger.kernel.org
Signed-off-by: Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
Link: https://lore.kernel.org/r/20201127175256.1092685-11-mathieu.poirier@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/hwtracing/coresight/coresight-etb10.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/drivers/hwtracing/coresight/coresight-etb10.c
+++ b/drivers/hwtracing/coresight/coresight-etb10.c
@@ -176,6 +176,7 @@ static int etb_enable_perf(struct coresi
 	unsigned long flags;
 	struct etb_drvdata *drvdata = dev_get_drvdata(csdev->dev.parent);
 	struct perf_output_handle *handle = data;
+	struct cs_buffers *buf = etm_perf_sink_config(handle);
 
 	spin_lock_irqsave(&drvdata->spinlock, flags);
 
@@ -186,7 +187,7 @@ static int etb_enable_perf(struct coresi
 	}
 
 	/* Get a handle on the pid of the process to monitor */
-	pid = task_pid_nr(handle->event->owner);
+	pid = buf->pid;
 
 	if (drvdata->pid != -1 && drvdata->pid != pid) {
 		ret = -EBUSY;
@@ -383,6 +384,7 @@ static void *etb_alloc_buffer(struct cor
 	if (!buf)
 		return NULL;
 
+	buf->pid = task_pid_nr(event->owner);
 	buf->snapshot = overwrite;
 	buf->nr_pages = nr_pages;
 	buf->data_pages = pages;



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 065/453] scsi: megaraid_sas: Check user-provided offsets
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (63 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.4 064/453] coresight: etb10: Fix possible NULL ptr dereference in etb_enable_perf() Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.4 066/453] HID: i2c-hid: add Vero K147 to descriptor override Greg Kroah-Hartman
                   ` (390 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christoph Hellwig, Arnd Bergmann,
	Martin K. Petersen

From: Arnd Bergmann <arnd@arndb.de>

commit 381d34e376e3d9d27730fda8a0e870600e6c8196 upstream.

It sounds unwise to let user space pass an unchecked 32-bit offset into a
kernel structure in an ioctl. This is an unsigned variable, so checking the
upper bound for the size of the structure it points into is sufficient to
avoid data corruption, but as the pointer might also be unaligned, it has
to be written carefully as well.

While I stumbled over this problem by reading the code, I did not continue
checking the function for further problems like it.

Link: https://lore.kernel.org/r/20201030164450.1253641-2-arnd@kernel.org
Fixes: c4a3e0a529ab ("[SCSI] MegaRAID SAS RAID: new driver")
Cc: <stable@vger.kernel.org> # v2.6.15+
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/scsi/megaraid/megaraid_sas_base.c |   16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

--- a/drivers/scsi/megaraid/megaraid_sas_base.c
+++ b/drivers/scsi/megaraid/megaraid_sas_base.c
@@ -8038,7 +8038,7 @@ megasas_mgmt_fw_ioctl(struct megasas_ins
 	int error = 0, i;
 	void *sense = NULL;
 	dma_addr_t sense_handle;
-	unsigned long *sense_ptr;
+	void *sense_ptr;
 	u32 opcode = 0;
 
 	memset(kbuff_arr, 0, sizeof(kbuff_arr));
@@ -8160,6 +8160,13 @@ megasas_mgmt_fw_ioctl(struct megasas_ins
 	}
 
 	if (ioc->sense_len) {
+		/* make sure the pointer is part of the frame */
+		if (ioc->sense_off >
+		    (sizeof(union megasas_frame) - sizeof(__le64))) {
+			error = -EINVAL;
+			goto out;
+		}
+
 		sense = dma_alloc_coherent(&instance->pdev->dev, ioc->sense_len,
 					     &sense_handle, GFP_KERNEL);
 		if (!sense) {
@@ -8167,12 +8174,11 @@ megasas_mgmt_fw_ioctl(struct megasas_ins
 			goto out;
 		}
 
-		sense_ptr =
-		(unsigned long *) ((unsigned long)cmd->frame + ioc->sense_off);
+		sense_ptr = (void *)cmd->frame + ioc->sense_off;
 		if (instance->consistent_mask_64bit)
-			*sense_ptr = cpu_to_le64(sense_handle);
+			put_unaligned_le64(sense_handle, sense_ptr);
 		else
-			*sense_ptr = cpu_to_le32(sense_handle);
+			put_unaligned_le32(sense_handle, sense_ptr);
 	}
 
 	/*



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 066/453] HID: i2c-hid: add Vero K147 to descriptor override
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (64 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.4 065/453] scsi: megaraid_sas: Check user-provided offsets Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.4 067/453] serial_core: Check for port state when tty is in error state Greg Kroah-Hartman
                   ` (389 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Julian Sax, Hans de Goede, Jiri Kosina

From: Julian Sax <jsbc@gmx.de>

commit c870d50ce387d84b6438211a7044c60afbd5d60a upstream.

This device uses the SIPODEV SP1064 touchpad, which does not
supply descriptors, so it has to be added to the override list.

Cc: stable@vger.kernel.org
Signed-off-by: Julian Sax <jsbc@gmx.de>
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c |    8 ++++++++
 1 file changed, 8 insertions(+)

--- a/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c
+++ b/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c
@@ -405,6 +405,14 @@ static const struct dmi_system_id i2c_hi
 		},
 		.driver_data = (void *)&sipodev_desc
 	},
+	{
+		.ident = "Vero K147",
+		.matches = {
+			DMI_EXACT_MATCH(DMI_SYS_VENDOR, "VERO"),
+			DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "K147"),
+		},
+		.driver_data = (void *)&sipodev_desc
+	},
 	{ }	/* Terminate list */
 };
 



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 067/453] serial_core: Check for port state when tty is in error state
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (65 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.4 066/453] HID: i2c-hid: add Vero K147 to descriptor override Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.4 068/453] Bluetooth: Fix slab-out-of-bounds read in hci_le_direct_adv_report_evt() Greg Kroah-Hartman
                   ` (388 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Alexey Kardashevskiy

From: Alexey Kardashevskiy <aik@ozlabs.ru>

commit 2f70e49ed860020f5abae4f7015018ebc10e1f0e upstream.

At the moment opening a serial device node (such as /dev/ttyS3)
succeeds even if there is no actual serial device behind it.
Reading/writing/ioctls fail as expected because the uart port is not
initialized (the type is PORT_UNKNOWN) and the TTY_IO_ERROR error state
bit is set fot the tty.

However setting line discipline does not have these checks
8250_port.c (8250 is the default choice made by univ8250_console_init()).
As the result of PORT_UNKNOWN, uart_port::iobase is NULL which
a platform translates onto some address accessing which produces a crash
like below.

This adds tty_port_initialized() to uart_set_ldisc() to prevent the crash.

Found by syzkaller.

Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
Link: https://lore.kernel.org/r/20201203055834.45838-1-aik@ozlabs.ru
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/tty/serial/serial_core.c |    4 ++++
 1 file changed, 4 insertions(+)

--- a/drivers/tty/serial/serial_core.c
+++ b/drivers/tty/serial/serial_core.c
@@ -1465,6 +1465,10 @@ static void uart_set_ldisc(struct tty_st
 {
 	struct uart_state *state = tty->driver_data;
 	struct uart_port *uport;
+	struct tty_port *port = &state->port;
+
+	if (!tty_port_initialized(port))
+		return;
 
 	mutex_lock(&state->port.mutex);
 	uport = uart_port_check(state);



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 068/453] Bluetooth: Fix slab-out-of-bounds read in hci_le_direct_adv_report_evt()
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (66 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.4 067/453] serial_core: Check for port state when tty is in error state Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.4 069/453] quota: Sanity-check quota file headers on load Greg Kroah-Hartman
                   ` (387 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Peilin Ye, Marcel Holtmann,
	syzbot+24ebd650e20bd263ca01

From: Peilin Ye <yepeilin.cs@gmail.com>

commit f7e0e8b2f1b0a09b527885babda3e912ba820798 upstream.

`num_reports` is not being properly checked. A malformed event packet with
a large `num_reports` number makes hci_le_direct_adv_report_evt() read out
of bounds. Fix it.

Cc: stable@vger.kernel.org
Fixes: 2f010b55884e ("Bluetooth: Add support for handling LE Direct Advertising Report events")
Reported-and-tested-by: syzbot+24ebd650e20bd263ca01@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?extid=24ebd650e20bd263ca01
Signed-off-by: Peilin Ye <yepeilin.cs@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/bluetooth/hci_event.c |   12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -5711,21 +5711,19 @@ static void hci_le_direct_adv_report_evt
 					 struct sk_buff *skb)
 {
 	u8 num_reports = skb->data[0];
-	void *ptr = &skb->data[1];
+	struct hci_ev_le_direct_adv_info *ev = (void *)&skb->data[1];
 
-	hci_dev_lock(hdev);
+	if (!num_reports || skb->len < num_reports * sizeof(*ev) + 1)
+		return;
 
-	while (num_reports--) {
-		struct hci_ev_le_direct_adv_info *ev = ptr;
+	hci_dev_lock(hdev);
 
+	for (; num_reports; num_reports--, ev++)
 		process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
 				   ev->bdaddr_type, &ev->direct_addr,
 				   ev->direct_addr_type, ev->rssi, NULL, 0,
 				   false);
 
-		ptr += sizeof(*ev);
-	}
-
 	hci_dev_unlock(hdev);
 }
 



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 069/453] quota: Sanity-check quota file headers on load
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (67 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.4 068/453] Bluetooth: Fix slab-out-of-bounds read in hci_le_direct_adv_report_evt() Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.4 070/453] media: msi2500: assign SPI bus number dynamically Greg Kroah-Hartman
                   ` (386 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, syzbot+f816042a7ae2225f25ba,
	Andreas Dilger, Jan Kara

From: Jan Kara <jack@suse.cz>

commit 11c514a99bb960941535134f0587102855e8ddee upstream.

Perform basic sanity checks of quota headers to avoid kernel crashes on
corrupted quota files.

CC: stable@vger.kernel.org
Reported-by: syzbot+f816042a7ae2225f25ba@syzkaller.appspotmail.com
Reviewed-by: Andreas Dilger <adilger@dilger.ca>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/quota/quota_v2.c |   19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

--- a/fs/quota/quota_v2.c
+++ b/fs/quota/quota_v2.c
@@ -159,6 +159,25 @@ static int v2_read_file_info(struct supe
 		qinfo->dqi_entry_size = sizeof(struct v2r1_disk_dqblk);
 		qinfo->dqi_ops = &v2r1_qtree_ops;
 	}
+	ret = -EUCLEAN;
+	/* Some sanity checks of the read headers... */
+	if ((loff_t)qinfo->dqi_blocks << qinfo->dqi_blocksize_bits >
+	    i_size_read(sb_dqopt(sb)->files[type])) {
+		quota_error(sb, "Number of blocks too big for quota file size (%llu > %llu).",
+		    (loff_t)qinfo->dqi_blocks << qinfo->dqi_blocksize_bits,
+		    i_size_read(sb_dqopt(sb)->files[type]));
+		goto out;
+	}
+	if (qinfo->dqi_free_blk >= qinfo->dqi_blocks) {
+		quota_error(sb, "Free block number too big (%u >= %u).",
+			    qinfo->dqi_free_blk, qinfo->dqi_blocks);
+		goto out;
+	}
+	if (qinfo->dqi_free_entry >= qinfo->dqi_blocks) {
+		quota_error(sb, "Block with free entry too big (%u >= %u).",
+			    qinfo->dqi_free_entry, qinfo->dqi_blocks);
+		goto out;
+	}
 	ret = 0;
 out:
 	up_read(&dqopt->dqio_sem);



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 070/453] media: msi2500: assign SPI bus number dynamically
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (68 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.4 069/453] quota: Sanity-check quota file headers on load Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.4 071/453] crypto: af_alg - avoid undefined behavior accessing salg_name Greg Kroah-Hartman
                   ` (385 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Antti Palosaari,
	Mauro Carvalho Chehab, syzbot+c60ddb60b685777d9d59

From: Antti Palosaari <crope@iki.fi>

commit 9c60cc797cf72e95bb39f32316e9f0e5f85435f9 upstream.

SPI bus number must be assigned dynamically for each device, otherwise it
will crash when multiple devices are plugged to system.

Reported-and-tested-by: syzbot+c60ddb60b685777d9d59@syzkaller.appspotmail.com

Cc: stable@vger.kernel.org
Signed-off-by: Antti Palosaari <crope@iki.fi>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/media/usb/msi2500/msi2500.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/media/usb/msi2500/msi2500.c
+++ b/drivers/media/usb/msi2500/msi2500.c
@@ -1230,7 +1230,7 @@ static int msi2500_probe(struct usb_inte
 	}
 
 	dev->master = master;
-	master->bus_num = 0;
+	master->bus_num = -1;
 	master->num_chipselect = 1;
 	master->transfer_one_message = msi2500_transfer_one_message;
 	spi_master_set_devdata(master, dev);



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 071/453] crypto: af_alg - avoid undefined behavior accessing salg_name
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (69 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.4 070/453] media: msi2500: assign SPI bus number dynamically Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.4 072/453] md: fix a warning caused by a race between concurrent md_ioctl()s Greg Kroah-Hartman
                   ` (384 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, syzbot+92ead4eb8e26a26d465e,
	Eric Biggers, Herbert Xu

From: Eric Biggers <ebiggers@google.com>

commit 92eb6c3060ebe3adf381fd9899451c5b047bb14d upstream.

Commit 3f69cc60768b ("crypto: af_alg - Allow arbitrarily long algorithm
names") made the kernel start accepting arbitrarily long algorithm names
in sockaddr_alg.  However, the actual length of the salg_name field
stayed at the original 64 bytes.

This is broken because the kernel can access indices >= 64 in salg_name,
which is undefined behavior -- even though the memory that is accessed
is still located within the sockaddr structure.  It would only be
defined behavior if the array were properly marked as arbitrary-length
(either by making it a flexible array, which is the recommended way
these days, or by making it an array of length 0 or 1).

We can't simply change salg_name into a flexible array, since that would
break source compatibility with userspace programs that embed
sockaddr_alg into another struct, or (more commonly) declare a
sockaddr_alg like 'struct sockaddr_alg sa = { .salg_name = "foo" };'.

One solution would be to change salg_name into a flexible array only
when '#ifdef __KERNEL__'.  However, that would keep userspace without an
easy way to actually use the longer algorithm names.

Instead, add a new structure 'sockaddr_alg_new' that has the flexible
array field, and expose it to both userspace and the kernel.
Make the kernel use it correctly in alg_bind().

This addresses the syzbot report
"UBSAN: array-index-out-of-bounds in alg_bind"
(https://syzkaller.appspot.com/bug?extid=92ead4eb8e26a26d465e).

Reported-by: syzbot+92ead4eb8e26a26d465e@syzkaller.appspotmail.com
Fixes: 3f69cc60768b ("crypto: af_alg - Allow arbitrarily long algorithm names")
Cc: <stable@vger.kernel.org> # v4.12+
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 crypto/af_alg.c             |   10 +++++++---
 include/uapi/linux/if_alg.h |   16 ++++++++++++++++
 2 files changed, 23 insertions(+), 3 deletions(-)

--- a/crypto/af_alg.c
+++ b/crypto/af_alg.c
@@ -147,7 +147,7 @@ static int alg_bind(struct socket *sock,
 	const u32 allowed = CRYPTO_ALG_KERN_DRIVER_ONLY;
 	struct sock *sk = sock->sk;
 	struct alg_sock *ask = alg_sk(sk);
-	struct sockaddr_alg *sa = (void *)uaddr;
+	struct sockaddr_alg_new *sa = (void *)uaddr;
 	const struct af_alg_type *type;
 	void *private;
 	int err;
@@ -155,7 +155,11 @@ static int alg_bind(struct socket *sock,
 	if (sock->state == SS_CONNECTED)
 		return -EINVAL;
 
-	if (addr_len < sizeof(*sa))
+	BUILD_BUG_ON(offsetof(struct sockaddr_alg_new, salg_name) !=
+		     offsetof(struct sockaddr_alg, salg_name));
+	BUILD_BUG_ON(offsetof(struct sockaddr_alg, salg_name) != sizeof(*sa));
+
+	if (addr_len < sizeof(*sa) + 1)
 		return -EINVAL;
 
 	/* If caller uses non-allowed flag, return error. */
@@ -163,7 +167,7 @@ static int alg_bind(struct socket *sock,
 		return -EINVAL;
 
 	sa->salg_type[sizeof(sa->salg_type) - 1] = 0;
-	sa->salg_name[sizeof(sa->salg_name) + addr_len - sizeof(*sa) - 1] = 0;
+	sa->salg_name[addr_len - sizeof(*sa) - 1] = 0;
 
 	type = alg_get_type(sa->salg_type);
 	if (IS_ERR(type) && PTR_ERR(type) == -ENOENT) {
--- a/include/uapi/linux/if_alg.h
+++ b/include/uapi/linux/if_alg.h
@@ -24,6 +24,22 @@ struct sockaddr_alg {
 	__u8	salg_name[64];
 };
 
+/*
+ * Linux v4.12 and later removed the 64-byte limit on salg_name[]; it's now an
+ * arbitrary-length field.  We had to keep the original struct above for source
+ * compatibility with existing userspace programs, though.  Use the new struct
+ * below if support for very long algorithm names is needed.  To do this,
+ * allocate 'sizeof(struct sockaddr_alg_new) + strlen(algname) + 1' bytes, and
+ * copy algname (including the null terminator) into salg_name.
+ */
+struct sockaddr_alg_new {
+	__u16	salg_family;
+	__u8	salg_type[14];
+	__u32	salg_feat;
+	__u32	salg_mask;
+	__u8	salg_name[];
+};
+
 struct af_alg_iv {
 	__u32	ivlen;
 	__u8	iv[0];



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 072/453] md: fix a warning caused by a race between concurrent md_ioctl()s
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (70 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.4 071/453] crypto: af_alg - avoid undefined behavior accessing salg_name Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.4 073/453] drm/gma500: fix double free of gma_connector Greg Kroah-Hartman
                   ` (383 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, syzbot+1e46a0864c1a6e9bd3d8,
	Dae R. Jeong, Song Liu

From: Dae R. Jeong <dae.r.jeong@kaist.ac.kr>

commit c731b84b51bf7fe83448bea8f56a6d55006b0615 upstream.

Syzkaller reports a warning as belows.
WARNING: CPU: 0 PID: 9647 at drivers/md/md.c:7169
...
Call Trace:
...
RIP: 0010:md_ioctl+0x4017/0x5980 drivers/md/md.c:7169
RSP: 0018:ffff888096027950 EFLAGS: 00010293
RAX: ffff88809322c380 RBX: 0000000000000932 RCX: ffffffff84e266f2
RDX: 0000000000000000 RSI: ffffffff84e299f7 RDI: 0000000000000007
RBP: ffff888096027bc0 R08: ffff88809322c380 R09: ffffed101341a482
R10: ffff888096027940 R11: ffff88809a0d240f R12: 0000000000000932
R13: ffff8880a2c14100 R14: ffff88809a0d2268 R15: ffff88809a0d2408
 __blkdev_driver_ioctl block/ioctl.c:304 [inline]
 blkdev_ioctl+0xece/0x1c10 block/ioctl.c:606
 block_ioctl+0xee/0x130 fs/block_dev.c:1930
 vfs_ioctl fs/ioctl.c:46 [inline]
 file_ioctl fs/ioctl.c:509 [inline]
 do_vfs_ioctl+0xd5f/0x1380 fs/ioctl.c:696
 ksys_ioctl+0xab/0xd0 fs/ioctl.c:713
 __do_sys_ioctl fs/ioctl.c:720 [inline]
 __se_sys_ioctl fs/ioctl.c:718 [inline]
 __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:718
 do_syscall_64+0xfd/0x680 arch/x86/entry/common.c:301
 entry_SYSCALL_64_after_hwframe+0x49/0xbe

This is caused by a race between two concurrenct md_ioctl()s closing
the array.
CPU1 (md_ioctl())                   CPU2 (md_ioctl())
------                              ------
set_bit(MD_CLOSING, &mddev->flags);
did_set_md_closing = true;
                                    WARN_ON_ONCE(test_bit(MD_CLOSING,
                                            &mddev->flags));
if(did_set_md_closing)
    clear_bit(MD_CLOSING, &mddev->flags);

Fix the warning by returning immediately if the MD_CLOSING bit is set
in &mddev->flags which indicates that the array is being closed.

Fixes: 065e519e71b2 ("md: MD_CLOSING needs to be cleared after called md_set_readonly or do_md_stop")
Reported-by: syzbot+1e46a0864c1a6e9bd3d8@syzkaller.appspotmail.com
Cc: stable@vger.kernel.org
Signed-off-by: Dae R. Jeong <dae.r.jeong@kaist.ac.kr>
Signed-off-by: Song Liu <songliubraving@fb.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/md/md.c |    7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -7371,8 +7371,11 @@ static int md_ioctl(struct block_device
 			err = -EBUSY;
 			goto out;
 		}
-		WARN_ON_ONCE(test_bit(MD_CLOSING, &mddev->flags));
-		set_bit(MD_CLOSING, &mddev->flags);
+		if (test_and_set_bit(MD_CLOSING, &mddev->flags)) {
+			mutex_unlock(&mddev->open_mutex);
+			err = -EBUSY;
+			goto out;
+		}
 		did_set_md_closing = true;
 		mutex_unlock(&mddev->open_mutex);
 		sync_blockdev(bdev);



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 073/453] drm/gma500: fix double free of gma_connector
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (71 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.4 072/453] md: fix a warning caused by a race between concurrent md_ioctl()s Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45   ` Greg Kroah-Hartman
                   ` (382 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Tom Rix, Daniel Vetter, Sasha Levin

From: Tom Rix <trix@redhat.com>

[ Upstream commit 4e19d51ca5b28a1d435a844c7b2a8e1b1b6fa237 ]

clang static analysis reports this problem:

cdv_intel_dp.c:2101:2: warning: Attempt to free released memory
        kfree(gma_connector);
        ^~~~~~~~~~~~~~~~~~~~

In cdv_intel_dp_init() when the call to cdv_intel_edp_panel_vdd_off()
fails, the handler calls cdv_intel_dp_destroy(connector) which does
the first free of gma_connector. So adjust the goto label and skip
the second free.

Fixes: d112a8163f83 ("gma500/cdv: Add eDP support")
Signed-off-by: Tom Rix <trix@redhat.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20201003193928.18869-1-trix@redhat.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/gma500/cdv_intel_dp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/gma500/cdv_intel_dp.c b/drivers/gpu/drm/gma500/cdv_intel_dp.c
index 2ff4b35151bf8..87738650dd90b 100644
--- a/drivers/gpu/drm/gma500/cdv_intel_dp.c
+++ b/drivers/gpu/drm/gma500/cdv_intel_dp.c
@@ -2125,7 +2125,7 @@ cdv_intel_dp_init(struct drm_device *dev, struct psb_intel_mode_device *mode_dev
 			DRM_INFO("failed to retrieve link info, disabling eDP\n");
 			cdv_intel_dp_encoder_destroy(encoder);
 			cdv_intel_dp_destroy(connector);
-			goto err_priv;
+			goto err_connector;
 		} else {
         		DRM_DEBUG_KMS("DPCD: Rev=%x LN_Rate=%x LN_CNT=%x LN_DOWNSP=%x\n",
 				intel_dp->dpcd[0], intel_dp->dpcd[1], 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 074/453] drm/aspeed: Fix Kconfig warning & subsequent build errors
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
  2020-12-28 12:43 ` [PATCH 5.4 001/453] ARM: dts: sun7i: bananapi: Enable RGMII RX/TX delay on Ethernet PHY Greg Kroah-Hartman
@ 2020-12-28 12:45   ` Greg Kroah-Hartman
  2020-12-28 12:43 ` [PATCH 5.4 003/453] ARM: dts: sun8i: v40: bananapi-m2-berry: Fix ethernet node Greg Kroah-Hartman
                     ` (453 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, kernel test robot, Randy Dunlap,
	Joel Stanley, Andrew Jeffery, Daniel Vetter, Michal Simek,
	Andrew Morton, Mike Rapoport, linux-mm, linux-aspeed,
	linux-arm-kernel, David Airlie, dri-devel, Sasha Levin

From: Randy Dunlap <rdunlap@infradead.org>

[ Upstream commit bf296b35489b46780b73b74ad984d06750ed5479 ]

Kernel test robot reported build errors (undefined references)
that didn't make much sense. After reproducing them, there is also
a Kconfig warning that is the root cause of the build errors, so
fix that Kconfig problem.

Fixes this Kconfig warning:
WARNING: unmet direct dependencies detected for CMA
  Depends on [n]: MMU [=n]
  Selected by [m]:
  - DRM_ASPEED_GFX [=m] && HAS_IOMEM [=y] && DRM [=m] && OF [=y] && (COMPILE_TEST [=y] || ARCH_ASPEED) && HAVE_DMA_CONTIGUOUS [=y]

and these dependent build errors:
(.text+0x10c8c): undefined reference to `start_isolate_page_range'
microblaze-linux-ld: (.text+0x10f14): undefined reference to `test_pages_isolated'
microblaze-linux-ld: (.text+0x10fd0): undefined reference to `undo_isolate_page_range'

Fixes: 76356a966e33 ("drm: aspeed: Clean up Kconfig options")
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Reviewed-by: Joel Stanley <joel@jms.id.au>
Cc: Joel Stanley <joel@jms.id.au>
Cc: Andrew Jeffery <andrew@aj.id.au>
Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
Cc: Michal Simek <monstr@monstr.eu>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Mike Rapoport <rppt@linux.ibm.com>
Cc: linux-mm@kvack.org
Cc: linux-aspeed@lists.ozlabs.org
Cc: linux-arm-kernel@lists.infradead.org
Cc: David Airlie <airlied@linux.ie>
Cc: dri-devel@lists.freedesktop.org
Signed-off-by: Joel Stanley <joel@jms.id.au>
Link: https://patchwork.freedesktop.org/patch/msgid/20201011230131.4922-1-rdunlap@infradead.org
Signed-off-by: Joel Stanley <joel@jms.id.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/aspeed/Kconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/gpu/drm/aspeed/Kconfig b/drivers/gpu/drm/aspeed/Kconfig
index 018383cfcfa79..5e95bcea43e92 100644
--- a/drivers/gpu/drm/aspeed/Kconfig
+++ b/drivers/gpu/drm/aspeed/Kconfig
@@ -3,6 +3,7 @@ config DRM_ASPEED_GFX
 	tristate "ASPEED BMC Display Controller"
 	depends on DRM && OF
 	depends on (COMPILE_TEST || ARCH_ASPEED)
+	depends on MMU
 	select DRM_KMS_HELPER
 	select DRM_KMS_CMA_HELPER
 	select DMA_CMA if HAVE_DMA_CONTIGUOUS
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 074/453] drm/aspeed: Fix Kconfig warning & subsequent build errors
@ 2020-12-28 12:45   ` Greg Kroah-Hartman
  0 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: dri-devel, Sasha Levin, Michal Simek, kernel test robot,
	linux-aspeed, Andrew Jeffery, Greg Kroah-Hartman, David Airlie,
	Randy Dunlap, stable, Mike Rapoport, linux-mm, Joel Stanley,
	Daniel Vetter, Andrew Morton, linux-arm-kernel

From: Randy Dunlap <rdunlap@infradead.org>

[ Upstream commit bf296b35489b46780b73b74ad984d06750ed5479 ]

Kernel test robot reported build errors (undefined references)
that didn't make much sense. After reproducing them, there is also
a Kconfig warning that is the root cause of the build errors, so
fix that Kconfig problem.

Fixes this Kconfig warning:
WARNING: unmet direct dependencies detected for CMA
  Depends on [n]: MMU [=n]
  Selected by [m]:
  - DRM_ASPEED_GFX [=m] && HAS_IOMEM [=y] && DRM [=m] && OF [=y] && (COMPILE_TEST [=y] || ARCH_ASPEED) && HAVE_DMA_CONTIGUOUS [=y]

and these dependent build errors:
(.text+0x10c8c): undefined reference to `start_isolate_page_range'
microblaze-linux-ld: (.text+0x10f14): undefined reference to `test_pages_isolated'
microblaze-linux-ld: (.text+0x10fd0): undefined reference to `undo_isolate_page_range'

Fixes: 76356a966e33 ("drm: aspeed: Clean up Kconfig options")
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Reviewed-by: Joel Stanley <joel@jms.id.au>
Cc: Joel Stanley <joel@jms.id.au>
Cc: Andrew Jeffery <andrew@aj.id.au>
Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
Cc: Michal Simek <monstr@monstr.eu>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Mike Rapoport <rppt@linux.ibm.com>
Cc: linux-mm@kvack.org
Cc: linux-aspeed@lists.ozlabs.org
Cc: linux-arm-kernel@lists.infradead.org
Cc: David Airlie <airlied@linux.ie>
Cc: dri-devel@lists.freedesktop.org
Signed-off-by: Joel Stanley <joel@jms.id.au>
Link: https://patchwork.freedesktop.org/patch/msgid/20201011230131.4922-1-rdunlap@infradead.org
Signed-off-by: Joel Stanley <joel@jms.id.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/aspeed/Kconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/gpu/drm/aspeed/Kconfig b/drivers/gpu/drm/aspeed/Kconfig
index 018383cfcfa79..5e95bcea43e92 100644
--- a/drivers/gpu/drm/aspeed/Kconfig
+++ b/drivers/gpu/drm/aspeed/Kconfig
@@ -3,6 +3,7 @@ config DRM_ASPEED_GFX
 	tristate "ASPEED BMC Display Controller"
 	depends on DRM && OF
 	depends on (COMPILE_TEST || ARCH_ASPEED)
+	depends on MMU
 	select DRM_KMS_HELPER
 	select DRM_KMS_CMA_HELPER
 	select DMA_CMA if HAVE_DMA_CONTIGUOUS
-- 
2.27.0




_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 074/453] drm/aspeed: Fix Kconfig warning & subsequent build errors
@ 2020-12-28 12:45   ` Greg Kroah-Hartman
  0 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: dri-devel, Sasha Levin, Michal Simek, kernel test robot,
	linux-aspeed, Andrew Jeffery, Greg Kroah-Hartman, David Airlie,
	Randy Dunlap, stable, Mike Rapoport, linux-mm, Joel Stanley,
	Daniel Vetter, Andrew Morton, linux-arm-kernel

From: Randy Dunlap <rdunlap@infradead.org>

[ Upstream commit bf296b35489b46780b73b74ad984d06750ed5479 ]

Kernel test robot reported build errors (undefined references)
that didn't make much sense. After reproducing them, there is also
a Kconfig warning that is the root cause of the build errors, so
fix that Kconfig problem.

Fixes this Kconfig warning:
WARNING: unmet direct dependencies detected for CMA
  Depends on [n]: MMU [=n]
  Selected by [m]:
  - DRM_ASPEED_GFX [=m] && HAS_IOMEM [=y] && DRM [=m] && OF [=y] && (COMPILE_TEST [=y] || ARCH_ASPEED) && HAVE_DMA_CONTIGUOUS [=y]

and these dependent build errors:
(.text+0x10c8c): undefined reference to `start_isolate_page_range'
microblaze-linux-ld: (.text+0x10f14): undefined reference to `test_pages_isolated'
microblaze-linux-ld: (.text+0x10fd0): undefined reference to `undo_isolate_page_range'

Fixes: 76356a966e33 ("drm: aspeed: Clean up Kconfig options")
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Reviewed-by: Joel Stanley <joel@jms.id.au>
Cc: Joel Stanley <joel@jms.id.au>
Cc: Andrew Jeffery <andrew@aj.id.au>
Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
Cc: Michal Simek <monstr@monstr.eu>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Mike Rapoport <rppt@linux.ibm.com>
Cc: linux-mm@kvack.org
Cc: linux-aspeed@lists.ozlabs.org
Cc: linux-arm-kernel@lists.infradead.org
Cc: David Airlie <airlied@linux.ie>
Cc: dri-devel@lists.freedesktop.org
Signed-off-by: Joel Stanley <joel@jms.id.au>
Link: https://patchwork.freedesktop.org/patch/msgid/20201011230131.4922-1-rdunlap@infradead.org
Signed-off-by: Joel Stanley <joel@jms.id.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/aspeed/Kconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/gpu/drm/aspeed/Kconfig b/drivers/gpu/drm/aspeed/Kconfig
index 018383cfcfa79..5e95bcea43e92 100644
--- a/drivers/gpu/drm/aspeed/Kconfig
+++ b/drivers/gpu/drm/aspeed/Kconfig
@@ -3,6 +3,7 @@ config DRM_ASPEED_GFX
 	tristate "ASPEED BMC Display Controller"
 	depends on DRM && OF
 	depends on (COMPILE_TEST || ARCH_ASPEED)
+	depends on MMU
 	select DRM_KMS_HELPER
 	select DRM_KMS_CMA_HELPER
 	select DMA_CMA if HAVE_DMA_CONTIGUOUS
-- 
2.27.0



_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel

^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 075/453] drm/mcde: Fix handling of platform_get_irq() error
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (73 preceding siblings ...)
  2020-12-28 12:45   ` Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.4 076/453] drm/tve200: " Greg Kroah-Hartman
                   ` (380 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Krzysztof Kozlowski, Linus Walleij,
	Sam Ravnborg, Sasha Levin

From: Krzysztof Kozlowski <krzk@kernel.org>

[ Upstream commit e2dae672a9d5e11856fe30ede63467c65f999a81 ]

platform_get_irq() returns -ERRNO on error.  In such case comparison
to 0 would pass the check.

Fixes: 5fc537bfd000 ("drm/mcde: Add new driver for ST-Ericsson MCDE")
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Acked-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20200827071107.27429-1-krzk@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/mcde/mcde_drv.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/mcde/mcde_drv.c b/drivers/gpu/drm/mcde/mcde_drv.c
index 16e5fb9ec784d..82946ffcb6d21 100644
--- a/drivers/gpu/drm/mcde/mcde_drv.c
+++ b/drivers/gpu/drm/mcde/mcde_drv.c
@@ -410,8 +410,8 @@ static int mcde_probe(struct platform_device *pdev)
 	}
 
 	irq = platform_get_irq(pdev, 0);
-	if (!irq) {
-		ret = -EINVAL;
+	if (irq < 0) {
+		ret = irq;
 		goto clk_disable;
 	}
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 076/453] drm/tve200: Fix handling of platform_get_irq() error
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (74 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.4 075/453] drm/mcde: Fix handling of platform_get_irq() error Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.4 077/453] arm64: dts: renesas: hihope-rzg2-ex: Drop rxc-skew-ps from ethernet-phy node Greg Kroah-Hartman
                   ` (379 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Krzysztof Kozlowski, Linus Walleij,
	Sam Ravnborg, Sasha Levin

From: Krzysztof Kozlowski <krzk@kernel.org>

[ Upstream commit 77bb5aaf2bb8180e7d1bb70b4df306f511707a7d ]

platform_get_irq() returns -ERRNO on error.  In such case comparison
to 0 would pass the check.

Fixes: 179c02fe90a4 ("drm/tve200: Add new driver for TVE200")
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Acked-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20200827071107.27429-2-krzk@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/tve200/tve200_drv.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/tve200/tve200_drv.c b/drivers/gpu/drm/tve200/tve200_drv.c
index 416f24823c0aa..02836d4e80237 100644
--- a/drivers/gpu/drm/tve200/tve200_drv.c
+++ b/drivers/gpu/drm/tve200/tve200_drv.c
@@ -210,8 +210,8 @@ static int tve200_probe(struct platform_device *pdev)
 	}
 
 	irq = platform_get_irq(pdev, 0);
-	if (!irq) {
-		ret = -EINVAL;
+	if (irq < 0) {
+		ret = irq;
 		goto clk_disable;
 	}
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 077/453] arm64: dts: renesas: hihope-rzg2-ex: Drop rxc-skew-ps from ethernet-phy node
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (75 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.4 076/453] drm/tve200: " Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.4 078/453] arm64: dts: renesas: cat875: Remove " Greg Kroah-Hartman
                   ` (378 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Biju Das, Lad Prabhakar,
	Geert Uytterhoeven, Sasha Levin

From: Biju Das <biju.das.jz@bp.renesas.com>

[ Upstream commit 67d3dcf12a3d245b6fd6ca5672893f7ae4e137ed ]

HiHope RZG2[HMN] boards uses Realtek phy and the driver does not support
rxc-skew-ps property. So remove rxc-skew-ps from ethernet-phy node.

Fixes: 7433f1fb8ec8fe ("arm64: dts: renesas: Add HiHope RZ/G2M sub board support")
Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
Reviewed-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
Link: https://lore.kernel.org/r/20201015132350.8360-1-biju.das.jz@bp.renesas.com
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/renesas/hihope-rzg2-ex.dtsi | 1 -
 1 file changed, 1 deletion(-)

diff --git a/arch/arm64/boot/dts/renesas/hihope-rzg2-ex.dtsi b/arch/arm64/boot/dts/renesas/hihope-rzg2-ex.dtsi
index 4280b190dc682..6a001cdfd38e2 100644
--- a/arch/arm64/boot/dts/renesas/hihope-rzg2-ex.dtsi
+++ b/arch/arm64/boot/dts/renesas/hihope-rzg2-ex.dtsi
@@ -23,7 +23,6 @@
 	status = "okay";
 
 	phy0: ethernet-phy@0 {
-		rxc-skew-ps = <1500>;
 		reg = <0>;
 		interrupt-parent = <&gpio2>;
 		interrupts = <11 IRQ_TYPE_LEVEL_LOW>;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 078/453] arm64: dts: renesas: cat875: Remove rxc-skew-ps from ethernet-phy node
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (76 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.4 077/453] arm64: dts: renesas: hihope-rzg2-ex: Drop rxc-skew-ps from ethernet-phy node Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.4 079/453] soc: renesas: rmobile-sysc: Fix some leaks in rmobile_init_pm_domains() Greg Kroah-Hartman
                   ` (377 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Biju Das, Lad Prabhakar,
	Geert Uytterhoeven, Sasha Levin

From: Biju Das <biju.das.jz@bp.renesas.com>

[ Upstream commit 53e573dc39fba1834f3e4fa002cb754b61a30701 ]

The CAT875 sub board from Silicon Linux uses Realtek phy and the driver
does not support rxc-skew-ps property.

Fixes: 6b170cd3ed02949f ("arm64: dts: renesas: cat875: Add ethernet support")
Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
Reviewed-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
Link: https://lore.kernel.org/r/20201015132350.8360-2-biju.das.jz@bp.renesas.com
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/renesas/cat875.dtsi | 1 -
 1 file changed, 1 deletion(-)

diff --git a/arch/arm64/boot/dts/renesas/cat875.dtsi b/arch/arm64/boot/dts/renesas/cat875.dtsi
index aaefc3ae56d50..dbdb8b093e733 100644
--- a/arch/arm64/boot/dts/renesas/cat875.dtsi
+++ b/arch/arm64/boot/dts/renesas/cat875.dtsi
@@ -22,7 +22,6 @@
 	status = "okay";
 
 	phy0: ethernet-phy@0 {
-		rxc-skew-ps = <1500>;
 		reg = <0>;
 		interrupt-parent = <&gpio2>;
 		interrupts = <21 IRQ_TYPE_LEVEL_LOW>;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 079/453] soc: renesas: rmobile-sysc: Fix some leaks in rmobile_init_pm_domains()
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (77 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.4 078/453] arm64: dts: renesas: cat875: Remove " Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.4 080/453] soc: mediatek: Check if power domains can be powered on at boot time Greg Kroah-Hartman
                   ` (376 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Geert Uytterhoeven,
	Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit cf25d802e029c31efac8bdc979236927f37183bd ]

This code needs to call iounmap() on one error path.

Fixes: 2173fc7cb681 ("ARM: shmobile: R-Mobile: Add DT support for PM domains")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/20200923113142.GC1473821@mwanda
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/soc/renesas/rmobile-sysc.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/soc/renesas/rmobile-sysc.c b/drivers/soc/renesas/rmobile-sysc.c
index 54b616ad4a62a..beb1c7211c3d6 100644
--- a/drivers/soc/renesas/rmobile-sysc.c
+++ b/drivers/soc/renesas/rmobile-sysc.c
@@ -327,6 +327,7 @@ static int __init rmobile_init_pm_domains(void)
 
 		pmd = of_get_child_by_name(np, "pm-domains");
 		if (!pmd) {
+			iounmap(base);
 			pr_warn("%pOF lacks pm-domains node\n", np);
 			continue;
 		}
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 080/453] soc: mediatek: Check if power domains can be powered on at boot time
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (78 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.4 079/453] soc: renesas: rmobile-sysc: Fix some leaks in rmobile_init_pm_domains() Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.4 081/453] soc: qcom: geni: More properly switch to DMA mode Greg Kroah-Hartman
                   ` (375 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Nicolas Boichat, Matthias Brugger,
	Sasha Levin

From: Nicolas Boichat <drinkcat@chromium.org>

[ Upstream commit 4007844b05815717f522c7ea9914e24ad0ff6c79 ]

In the error case, where a power domain cannot be powered on
successfully at boot time (in mtk_register_power_domains),
pm_genpd_init would still be called with is_off=false, and the
system would later try to disable the power domain again, triggering
warnings as disabled clocks are disabled again (and other potential
issues).

Also print a warning splat in that case, as this should never
happen.

Fixes: c84e358718a66f7 ("soc: Mediatek: Add SCPSYS power domain driver")
Signed-off-by: Nicolas Boichat <drinkcat@chromium.org>
Link: https://lore.kernel.org/r/20200928113107.v2.1.I5e6f8c262031d0451fe7241b744f4f3111c1ce71@changeid
Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/soc/mediatek/mtk-scpsys.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/soc/mediatek/mtk-scpsys.c b/drivers/soc/mediatek/mtk-scpsys.c
index 503222d0d0da1..75f25f08245fd 100644
--- a/drivers/soc/mediatek/mtk-scpsys.c
+++ b/drivers/soc/mediatek/mtk-scpsys.c
@@ -446,6 +446,7 @@ static void mtk_register_power_domains(struct platform_device *pdev,
 	for (i = 0; i < num; i++) {
 		struct scp_domain *scpd = &scp->domains[i];
 		struct generic_pm_domain *genpd = &scpd->genpd;
+		bool on;
 
 		/*
 		 * Initially turn on all domains to make the domains usable
@@ -453,9 +454,9 @@ static void mtk_register_power_domains(struct platform_device *pdev,
 		 * software.  The unused domains will be switched off during
 		 * late_init time.
 		 */
-		genpd->power_on(genpd);
+		on = !WARN_ON(genpd->power_on(genpd) < 0);
 
-		pm_genpd_init(genpd, NULL, false);
+		pm_genpd_init(genpd, NULL, !on);
 	}
 
 	/*
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 081/453] soc: qcom: geni: More properly switch to DMA mode
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (79 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.4 080/453] soc: mediatek: Check if power domains can be powered on at boot time Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.4 082/453] Revert "i2c: i2c-qcom-geni: Fix DMA transfer race" Greg Kroah-Hartman
                   ` (374 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Douglas Anderson, Stephen Boyd,
	Akash Asthana, Dmitry Baryshkov, Bjorn Andersson, Sasha Levin

From: Douglas Anderson <dianders@chromium.org>

[ Upstream commit 4b6ea87be44ef34732846fc71e44c41125f0c4fa ]

On geni-i2c transfers using DMA, it was seen that if you program the
command (I2C_READ) before calling geni_se_rx_dma_prep() that it could
cause interrupts to fire.  If we get unlucky, these interrupts can
just keep firing (and not be handled) blocking further progress and
hanging the system.

In commit 02b9aec59243 ("i2c: i2c-qcom-geni: Fix DMA transfer race")
we avoided that by making sure we didn't program the command until
after geni_se_rx_dma_prep() was called.  While that avoided the
problems, it also turns out to be invalid.  At least in the TX case we
started seeing sporadic corrupted transfers.  This is easily seen by
adding an msleep() between the DMA prep and the writing of the
command, which makes the problem worse.  That means we need to revert
that commit and find another way to fix the bogus IRQs.

Specifically, after reverting commit 02b9aec59243 ("i2c:
i2c-qcom-geni: Fix DMA transfer race"), I put some traces in.  I found
that the when the interrupts were firing like crazy:
- "m_stat" had bits for M_RX_IRQ_EN, M_RX_FIFO_WATERMARK_EN set.
- "dma" was set.

Further debugging showed that I could make the problem happen more
reliably by adding an "msleep(1)" any time after geni_se_setup_m_cmd()
ran up until geni_se_rx_dma_prep() programmed the length.

A rather simple fix is to change geni_se_select_dma_mode() so it's a
true inverse of geni_se_select_fifo_mode() and disables all the FIFO
related interrupts.  Now the problematic interrupts can't fire and we
can program things in the correct order without worrying.

As part of this, let's also change the writel_relaxed() in the prepare
function to a writel() so that our DMA is guaranteed to be prepared
now that we can't rely on geni_se_setup_m_cmd()'s writel().

NOTE: the only current user of GENI_SE_DMA in mainline is i2c.

Fixes: 37692de5d523 ("i2c: i2c-qcom-geni: Add bus driver for the Qualcomm GENI I2C controller")
Fixes: 02b9aec59243 ("i2c: i2c-qcom-geni: Fix DMA transfer race")
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Reviewed-by: Stephen Boyd <swboyd@chromium.org>
Reviewed-by: Akash Asthana <akashast@codeaurora.org>
Tested-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Link: https://lore.kernel.org/r/20201013142448.v2.1.Ifdb1b69fa3367b81118e16e9e4e63299980ca798@changeid
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/soc/qcom/qcom-geni-se.c | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/drivers/soc/qcom/qcom-geni-se.c b/drivers/soc/qcom/qcom-geni-se.c
index 7d622ea1274eb..2e66098e82975 100644
--- a/drivers/soc/qcom/qcom-geni-se.c
+++ b/drivers/soc/qcom/qcom-geni-se.c
@@ -282,10 +282,23 @@ static void geni_se_select_fifo_mode(struct geni_se *se)
 
 static void geni_se_select_dma_mode(struct geni_se *se)
 {
+	u32 proto = geni_se_read_proto(se);
 	u32 val;
 
 	geni_se_irq_clear(se);
 
+	val = readl_relaxed(se->base + SE_GENI_M_IRQ_EN);
+	if (proto != GENI_SE_UART) {
+		val &= ~(M_CMD_DONE_EN | M_TX_FIFO_WATERMARK_EN);
+		val &= ~(M_RX_FIFO_WATERMARK_EN | M_RX_FIFO_LAST_EN);
+	}
+	writel_relaxed(val, se->base + SE_GENI_M_IRQ_EN);
+
+	val = readl_relaxed(se->base + SE_GENI_S_IRQ_EN);
+	if (proto != GENI_SE_UART)
+		val &= ~S_CMD_DONE_EN;
+	writel_relaxed(val, se->base + SE_GENI_S_IRQ_EN);
+
 	val = readl_relaxed(se->base + SE_GENI_DMA_MODE_EN);
 	val |= GENI_DMA_MODE_EN;
 	writel_relaxed(val, se->base + SE_GENI_DMA_MODE_EN);
@@ -644,7 +657,7 @@ int geni_se_tx_dma_prep(struct geni_se *se, void *buf, size_t len,
 	writel_relaxed(lower_32_bits(*iova), se->base + SE_DMA_TX_PTR_L);
 	writel_relaxed(upper_32_bits(*iova), se->base + SE_DMA_TX_PTR_H);
 	writel_relaxed(GENI_SE_DMA_EOT_BUF, se->base + SE_DMA_TX_ATTR);
-	writel_relaxed(len, se->base + SE_DMA_TX_LEN);
+	writel(len, se->base + SE_DMA_TX_LEN);
 	return 0;
 }
 EXPORT_SYMBOL(geni_se_tx_dma_prep);
@@ -681,7 +694,7 @@ int geni_se_rx_dma_prep(struct geni_se *se, void *buf, size_t len,
 	writel_relaxed(upper_32_bits(*iova), se->base + SE_DMA_RX_PTR_H);
 	/* RX does not have EOT buffer type bit. So just reset RX_ATTR */
 	writel_relaxed(0, se->base + SE_DMA_RX_ATTR);
-	writel_relaxed(len, se->base + SE_DMA_RX_LEN);
+	writel(len, se->base + SE_DMA_RX_LEN);
 	return 0;
 }
 EXPORT_SYMBOL(geni_se_rx_dma_prep);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 082/453] Revert "i2c: i2c-qcom-geni: Fix DMA transfer race"
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (80 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.4 081/453] soc: qcom: geni: More properly switch to DMA mode Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.4 083/453] RDMA/bnxt_re: Set queue pair state when being queried Greg Kroah-Hartman
                   ` (373 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Douglas Anderson, Stephen Boyd,
	Akash Asthana, Dmitry Baryshkov, Bjorn Andersson, Sasha Levin

From: Douglas Anderson <dianders@chromium.org>

[ Upstream commit 9cb4c67d7717135d6f4600a49ab07b470ea4ee2f ]

This reverts commit 02b9aec59243c6240fc42884acc958602146ddf6.

As talked about in the patch ("soc: qcom: geni: More properly switch
to DMA mode"), swapping the order of geni_se_setup_m_cmd() and
geni_se_xx_dma_prep() can sometimes cause corrupted transfers.  Thus
we traded one problem for another.  Now that we've debugged the
problem further and fixed the geni helper functions to more disable
FIFO interrupts when we move to DMA mode we can revert it and end up
with (hopefully) zero problems!

To be explicit, the patch ("soc: qcom: geni: More properly switch
to DMA mode") is a prerequisite for this one.

Fixes: 02b9aec59243 ("i2c: i2c-qcom-geni: Fix DMA transfer race")
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Reviewed-by: Stephen Boyd <swboyd@chromium.org>
Reviewed-by: Akash Asthana <akashast@codeaurora.org>
Tested-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Link: https://lore.kernel.org/r/20201013142448.v2.2.I7b22281453b8a18ab16ef2bfd4c641fb1cc6a92c@changeid
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/i2c/busses/i2c-qcom-geni.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/drivers/i2c/busses/i2c-qcom-geni.c b/drivers/i2c/busses/i2c-qcom-geni.c
index aafc76ee93e02..17abf60c94aeb 100644
--- a/drivers/i2c/busses/i2c-qcom-geni.c
+++ b/drivers/i2c/busses/i2c-qcom-geni.c
@@ -368,6 +368,7 @@ static int geni_i2c_rx_one_msg(struct geni_i2c_dev *gi2c, struct i2c_msg *msg,
 		geni_se_select_mode(se, GENI_SE_FIFO);
 
 	writel_relaxed(len, se->base + SE_I2C_RX_TRANS_LEN);
+	geni_se_setup_m_cmd(se, I2C_READ, m_param);
 
 	if (dma_buf && geni_se_rx_dma_prep(se, dma_buf, len, &rx_dma)) {
 		geni_se_select_mode(se, GENI_SE_FIFO);
@@ -375,8 +376,6 @@ static int geni_i2c_rx_one_msg(struct geni_i2c_dev *gi2c, struct i2c_msg *msg,
 		dma_buf = NULL;
 	}
 
-	geni_se_setup_m_cmd(se, I2C_READ, m_param);
-
 	time_left = wait_for_completion_timeout(&gi2c->done, XFER_TIMEOUT);
 	if (!time_left)
 		geni_i2c_abort_xfer(gi2c);
@@ -410,6 +409,7 @@ static int geni_i2c_tx_one_msg(struct geni_i2c_dev *gi2c, struct i2c_msg *msg,
 		geni_se_select_mode(se, GENI_SE_FIFO);
 
 	writel_relaxed(len, se->base + SE_I2C_TX_TRANS_LEN);
+	geni_se_setup_m_cmd(se, I2C_WRITE, m_param);
 
 	if (dma_buf && geni_se_tx_dma_prep(se, dma_buf, len, &tx_dma)) {
 		geni_se_select_mode(se, GENI_SE_FIFO);
@@ -417,8 +417,6 @@ static int geni_i2c_tx_one_msg(struct geni_i2c_dev *gi2c, struct i2c_msg *msg,
 		dma_buf = NULL;
 	}
 
-	geni_se_setup_m_cmd(se, I2C_WRITE, m_param);
-
 	if (!dma_buf) /* Get FIFO IRQ */
 		writel_relaxed(1, se->base + SE_GENI_TX_WATERMARK_REG);
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 083/453] RDMA/bnxt_re: Set queue pair state when being queried
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (81 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.4 082/453] Revert "i2c: i2c-qcom-geni: Fix DMA transfer race" Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.4 084/453] rtc: pcf2127: fix pcf2127_nvmem_read/write() returns Greg Kroah-Hartman
                   ` (372 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Kamal Heib, Selvin Xavier,
	Jason Gunthorpe, Sasha Levin

From: Kamal Heib <kamalheib1@gmail.com>

[ Upstream commit 53839b51a7671eeb3fb44d479d541cf3a0f2dd45 ]

The API for ib_query_qp requires the driver to set cur_qp_state on return,
add the missing set.

Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver")
Link: https://lore.kernel.org/r/20201021114952.38876-1-kamalheib1@gmail.com
Signed-off-by: Kamal Heib <kamalheib1@gmail.com>
Acked-by: Selvin Xavier <selvin.xavier@broadcom.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/hw/bnxt_re/ib_verbs.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
index 3b05c0640338f..58c021648b7c8 100644
--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c
+++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
@@ -1793,6 +1793,7 @@ int bnxt_re_query_qp(struct ib_qp *ib_qp, struct ib_qp_attr *qp_attr,
 		goto out;
 	}
 	qp_attr->qp_state = __to_ib_qp_state(qplib_qp->state);
+	qp_attr->cur_qp_state = __to_ib_qp_state(qplib_qp->cur_qp_state);
 	qp_attr->en_sqd_async_notify = qplib_qp->en_sqd_async_notify ? 1 : 0;
 	qp_attr->qp_access_flags = __to_ib_access_flags(qplib_qp->access);
 	qp_attr->pkey_index = qplib_qp->pkey_index;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 084/453] rtc: pcf2127: fix pcf2127_nvmem_read/write() returns
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (82 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.4 083/453] RDMA/bnxt_re: Set queue pair state when being queried Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.4 085/453] selinux: fix error initialization in inode_doinit_with_dentry() Greg Kroah-Hartman
                   ` (371 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Alexandre Belloni,
	Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit ba1c30bf3f2536f248d262c6f257b5a787305991 ]

These functions should return zero on success.  Non-zero returns are
treated as error.  On some paths, this doesn't matter but in
nvmem_cell_read() a non-zero return would be passed to ERR_PTR() and
lead to an Oops.

Fixes: d6c3029f32f7 ("rtc: pcf2127: add support for accessing internal static RAM")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Link: https://lore.kernel.org/r/20201022070451.GA2817669@mwanda
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/rtc/rtc-pcf2127.c | 12 ++++--------
 1 file changed, 4 insertions(+), 8 deletions(-)

diff --git a/drivers/rtc/rtc-pcf2127.c b/drivers/rtc/rtc-pcf2127.c
index 02b069caffd57..d1d37a204264c 100644
--- a/drivers/rtc/rtc-pcf2127.c
+++ b/drivers/rtc/rtc-pcf2127.c
@@ -230,10 +230,8 @@ static int pcf2127_nvmem_read(void *priv, unsigned int offset,
 	if (ret)
 		return ret;
 
-	ret = regmap_bulk_read(pcf2127->regmap, PCF2127_REG_RAM_RD_CMD,
-			       val, bytes);
-
-	return ret ?: bytes;
+	return regmap_bulk_read(pcf2127->regmap, PCF2127_REG_RAM_RD_CMD,
+				val, bytes);
 }
 
 static int pcf2127_nvmem_write(void *priv, unsigned int offset,
@@ -248,10 +246,8 @@ static int pcf2127_nvmem_write(void *priv, unsigned int offset,
 	if (ret)
 		return ret;
 
-	ret = regmap_bulk_write(pcf2127->regmap, PCF2127_REG_RAM_WRT_CMD,
-				val, bytes);
-
-	return ret ?: bytes;
+	return regmap_bulk_write(pcf2127->regmap, PCF2127_REG_RAM_WRT_CMD,
+				 val, bytes);
 }
 
 /* watchdog driver */
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 085/453] selinux: fix error initialization in inode_doinit_with_dentry()
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (83 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.4 084/453] rtc: pcf2127: fix pcf2127_nvmem_read/write() returns Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.4 086/453] ARM: dts: aspeed: s2600wf: Fix VGA memory region location Greg Kroah-Hartman
                   ` (370 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Tianyue Ren, Paul Moore, Sasha Levin

From: Tianyue Ren <rentianyue@kylinos.cn>

[ Upstream commit 83370b31a915493231e5b9addc72e4bef69f8d31 ]

Mark the inode security label as invalid if we cannot find
a dentry so that we will retry later rather than marking it
initialized with the unlabeled SID.

Fixes: 9287aed2ad1f ("selinux: Convert isec->lock into a spinlock")
Signed-off-by: Tianyue Ren <rentianyue@kylinos.cn>
[PM: minor comment tweaks]
Signed-off-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 security/selinux/hooks.c | 19 ++++++++++++++++---
 1 file changed, 16 insertions(+), 3 deletions(-)

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 212f48025db81..76f7eb5690c8e 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -1499,7 +1499,13 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent
 			 * inode_doinit with a dentry, before these inodes could
 			 * be used again by userspace.
 			 */
-			goto out;
+			isec->initialized = LABEL_INVALID;
+			/*
+			 * There is nothing useful to jump to the "out"
+			 * label, except a needless spin lock/unlock
+			 * cycle.
+			 */
+			return 0;
 		}
 
 		rc = inode_doinit_use_xattr(inode, dentry, sbsec->def_sid,
@@ -1553,8 +1559,15 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent
 			 * inode_doinit() with a dentry, before these inodes
 			 * could be used again by userspace.
 			 */
-			if (!dentry)
-				goto out;
+			if (!dentry) {
+				isec->initialized = LABEL_INVALID;
+				/*
+				 * There is nothing useful to jump to the "out"
+				 * label, except a needless spin lock/unlock
+				 * cycle.
+				 */
+				return 0;
+			}
 			rc = selinux_genfs_get_sid(dentry, sclass,
 						   sbsec->flags, &sid);
 			if (rc) {
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 086/453] ARM: dts: aspeed: s2600wf: Fix VGA memory region location
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (84 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.4 085/453] selinux: fix error initialization in inode_doinit_with_dentry() Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.4 087/453] RDMA/rxe: Compute PSN windows correctly Greg Kroah-Hartman
                   ` (369 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, John Wang, Joel Stanley, Sasha Levin

From: Joel Stanley <joel@jms.id.au>

[ Upstream commit 9e1cc9679776f5b9e42481d392b1550753ebd084 ]

The VGA memory region is always from the top of RAM. On this board, that
is 0x80000000 + 0x20000000 - 0x01000000 = 0x9f000000.

This was not an issue in practice as the region is "reserved" by the
vendor's u-boot reducing the amount of available RAM, and the only user
is the host VGA device poking at RAM over PCIe. That is, nothing from
the ARM touches it.

It is worth fixing as developers copy existing device trees when
building their machines, and the XDMA driver does use the memory region
from the ARM side.

Fixes: c4043ecac34a ("ARM: dts: aspeed: Add S2600WF BMC Machine")
Reported-by: John Wang <wangzhiqiang.bj@bytedance.com>
Link: https://lore.kernel.org/r/20200922064234.163799-1-joel@jms.id.au
Signed-off-by: Joel Stanley <joel@jms.id.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/aspeed-bmc-intel-s2600wf.dts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm/boot/dts/aspeed-bmc-intel-s2600wf.dts b/arch/arm/boot/dts/aspeed-bmc-intel-s2600wf.dts
index 22dade6393d06..d1dbe3b6ad5a7 100644
--- a/arch/arm/boot/dts/aspeed-bmc-intel-s2600wf.dts
+++ b/arch/arm/boot/dts/aspeed-bmc-intel-s2600wf.dts
@@ -22,9 +22,9 @@
 		#size-cells = <1>;
 		ranges;
 
-		vga_memory: framebuffer@7f000000 {
+		vga_memory: framebuffer@9f000000 {
 			no-map;
-			reg = <0x7f000000 0x01000000>;
+			reg = <0x9f000000 0x01000000>; /* 16M */
 		};
 	};
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 087/453] RDMA/rxe: Compute PSN windows correctly
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (85 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.4 086/453] ARM: dts: aspeed: s2600wf: Fix VGA memory region location Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.4 088/453] x86/mm/ident_map: Check for errors from ident_pud_init() Greg Kroah-Hartman
                   ` (368 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Bob Pearson, Jason Gunthorpe, Sasha Levin

From: Bob Pearson <rpearsonhpe@gmail.com>

[ Upstream commit bb3ab2979fd69db23328691cb10067861df89037 ]

The code which limited the number of unacknowledged PSNs was incorrect.
The PSNs are limited to 24 bits and wrap back to zero from 0x00ffffff.
The test was computing a 32 bit value which wraps at 32 bits so that
qp->req.psn can appear smaller than the limit when it is actually larger.

Replace '>' test with psn_compare which is used for other PSN comparisons
and correctly handles the 24 bit size.

Fixes: 8700e3e7c485 ("Soft RoCE driver")
Link: https://lore.kernel.org/r/20201013170741.3590-1-rpearson@hpe.com
Signed-off-by: Bob Pearson <rpearson@hpe.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/sw/rxe/rxe_req.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/infiniband/sw/rxe/rxe_req.c b/drivers/infiniband/sw/rxe/rxe_req.c
index e5031172c0193..a4d6e0b7901e9 100644
--- a/drivers/infiniband/sw/rxe/rxe_req.c
+++ b/drivers/infiniband/sw/rxe/rxe_req.c
@@ -664,7 +664,8 @@ next_wqe:
 	}
 
 	if (unlikely(qp_type(qp) == IB_QPT_RC &&
-		     qp->req.psn > (qp->comp.psn + RXE_MAX_UNACKED_PSNS))) {
+		psn_compare(qp->req.psn, (qp->comp.psn +
+				RXE_MAX_UNACKED_PSNS)) > 0)) {
 		qp->req.wait_psn = 1;
 		goto exit;
 	}
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 088/453] x86/mm/ident_map: Check for errors from ident_pud_init()
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (86 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.4 087/453] RDMA/rxe: Compute PSN windows correctly Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.4 089/453] ARM: p2v: fix handling of LPAE translation in BE mode Greg Kroah-Hartman
                   ` (367 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Arvind Sankar, Borislav Petkov,
	Joerg Roedel, Kirill A. Shutemov, Sasha Levin

From: Arvind Sankar <nivedita@alum.mit.edu>

[ Upstream commit 1fcd009102ee02e217f2e7635ab65517d785da8e ]

Commit

  ea3b5e60ce80 ("x86/mm/ident_map: Add 5-level paging support")

added ident_p4d_init() to support 5-level paging, but this function
doesn't check and return errors from ident_pud_init().

For example, the decompressor stub uses this code to create an identity
mapping. If it runs out of pages while trying to allocate a PMD
pagetable, the error will be currently ignored.

Fix this to propagate errors.

 [ bp: Space out statements for better readability. ]

Fixes: ea3b5e60ce80 ("x86/mm/ident_map: Add 5-level paging support")
Signed-off-by: Arvind Sankar <nivedita@alum.mit.edu>
Signed-off-by: Borislav Petkov <bp@suse.de>
Reviewed-by: Joerg Roedel <jroedel@suse.de>
Acked-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Link: https://lkml.kernel.org/r/20201027230648.1885111-1-nivedita@alum.mit.edu
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/mm/ident_map.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/arch/x86/mm/ident_map.c b/arch/x86/mm/ident_map.c
index fe7a12599d8eb..968d7005f4a72 100644
--- a/arch/x86/mm/ident_map.c
+++ b/arch/x86/mm/ident_map.c
@@ -62,6 +62,7 @@ static int ident_p4d_init(struct x86_mapping_info *info, p4d_t *p4d_page,
 			  unsigned long addr, unsigned long end)
 {
 	unsigned long next;
+	int result;
 
 	for (; addr < end; addr = next) {
 		p4d_t *p4d = p4d_page + p4d_index(addr);
@@ -73,13 +74,20 @@ static int ident_p4d_init(struct x86_mapping_info *info, p4d_t *p4d_page,
 
 		if (p4d_present(*p4d)) {
 			pud = pud_offset(p4d, 0);
-			ident_pud_init(info, pud, addr, next);
+			result = ident_pud_init(info, pud, addr, next);
+			if (result)
+				return result;
+
 			continue;
 		}
 		pud = (pud_t *)info->alloc_pgt_page(info->context);
 		if (!pud)
 			return -ENOMEM;
-		ident_pud_init(info, pud, addr, next);
+
+		result = ident_pud_init(info, pud, addr, next);
+		if (result)
+			return result;
+
 		set_p4d(p4d, __p4d(__pa(pud) | info->kernpg_flag));
 	}
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 089/453] ARM: p2v: fix handling of LPAE translation in BE mode
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (87 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.4 088/453] x86/mm/ident_map: Check for errors from ident_pud_init() Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.4 090/453] x86/apic: Fix x2apic enablement without interrupt remapping Greg Kroah-Hartman
                   ` (366 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Nicolas Pitre, Linus Walleij,
	Ard Biesheuvel, Sasha Levin

From: Ard Biesheuvel <ardb@kernel.org>

[ Upstream commit 4e79f0211b473f8e1eab8211a9fd50cc41a3a061 ]

When running in BE mode on LPAE hardware with a PA-to-VA translation
that exceeds 4 GB, we patch bits 39:32 of the offset into the wrong
byte of the opcode. So fix that, by rotating the offset in r0 to the
right by 8 bits, which will put the 8-bit immediate in bits 31:24.

Note that this will also move bit #22 in its correct place when
applying the rotation to the constant #0x400000.

Fixes: d9a790df8e984 ("ARM: 7883/1: fix mov to mvn conversion in case of 64 bit phys_addr_t and BE")
Acked-by: Nicolas Pitre <nico@fluxnic.net>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/kernel/head.S | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/arch/arm/kernel/head.S b/arch/arm/kernel/head.S
index c49b39340ddbd..f1cdc1f369575 100644
--- a/arch/arm/kernel/head.S
+++ b/arch/arm/kernel/head.S
@@ -671,12 +671,8 @@ ARM_BE8(rev16	ip, ip)
 	ldrcc	r7, [r4], #4	@ use branch for delay slot
 	bcc	1b
 	bx	lr
-#else
-#ifdef CONFIG_CPU_ENDIAN_BE8
-	moveq	r0, #0x00004000	@ set bit 22, mov to mvn instruction
 #else
 	moveq	r0, #0x400000	@ set bit 22, mov to mvn instruction
-#endif
 	b	2f
 1:	ldr	ip, [r7, r3]
 #ifdef CONFIG_CPU_ENDIAN_BE8
@@ -685,7 +681,7 @@ ARM_BE8(rev16	ip, ip)
 	tst	ip, #0x000f0000	@ check the rotation field
 	orrne	ip, ip, r6, lsl #24 @ mask in offset bits 31-24
 	biceq	ip, ip, #0x00004000 @ clear bit 22
-	orreq	ip, ip, r0      @ mask in offset bits 7-0
+	orreq	ip, ip, r0, ror #8  @ mask in offset bits 7-0
 #else
 	bic	ip, ip, #0x000000ff
 	tst	ip, #0xf00	@ check the rotation field
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 090/453] x86/apic: Fix x2apic enablement without interrupt remapping
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (88 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.4 089/453] ARM: p2v: fix handling of LPAE translation in BE mode Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.4 091/453] sched/deadline: Fix sched_dl_global_validate() Greg Kroah-Hartman
                   ` (365 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, David Woodhouse, Thomas Gleixner,
	Sasha Levin

From: David Woodhouse <dwmw@amazon.co.uk>

[ Upstream commit 26573a97746c7a99f394f9d398ce91a8853b3b89 ]

Currently, Linux as a hypervisor guest will enable x2apic only if there are
no CPUs present at boot time with an APIC ID above 255.

Hotplugging a CPU later with a higher APIC ID would result in a CPU which
cannot be targeted by external interrupts.

Add a filter in x2apic_apic_id_valid() which can be used to prevent such
CPUs from coming online, and allow x2apic to be enabled even if they are
present at boot time.

Fixes: ce69a784504 ("x86/apic: Enable x2APIC without interrupt remapping under KVM")
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Link: https://lore.kernel.org/r/20201024213535.443185-2-dwmw2@infradead.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/include/asm/apic.h        |  1 +
 arch/x86/kernel/apic/apic.c        | 14 ++++++++------
 arch/x86/kernel/apic/x2apic_phys.c |  9 +++++++++
 3 files changed, 18 insertions(+), 6 deletions(-)

diff --git a/arch/x86/include/asm/apic.h b/arch/x86/include/asm/apic.h
index 19e94af9cc5d7..6016559ed1713 100644
--- a/arch/x86/include/asm/apic.h
+++ b/arch/x86/include/asm/apic.h
@@ -259,6 +259,7 @@ static inline u64 native_x2apic_icr_read(void)
 
 extern int x2apic_mode;
 extern int x2apic_phys;
+extern void __init x2apic_set_max_apicid(u32 apicid);
 extern void __init check_x2apic(void);
 extern void x2apic_setup(void);
 static inline int x2apic_enabled(void)
diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
index fce94c799f015..06fa808d72032 100644
--- a/arch/x86/kernel/apic/apic.c
+++ b/arch/x86/kernel/apic/apic.c
@@ -1886,20 +1886,22 @@ static __init void try_to_enable_x2apic(int remap_mode)
 		return;
 
 	if (remap_mode != IRQ_REMAP_X2APIC_MODE) {
-		/* IR is required if there is APIC ID > 255 even when running
-		 * under KVM
+		/*
+		 * Using X2APIC without IR is not architecturally supported
+		 * on bare metal but may be supported in guests.
 		 */
-		if (max_physical_apicid > 255 ||
-		    !x86_init.hyper.x2apic_available()) {
+		if (!x86_init.hyper.x2apic_available()) {
 			pr_info("x2apic: IRQ remapping doesn't support X2APIC mode\n");
 			x2apic_disable();
 			return;
 		}
 
 		/*
-		 * without IR all CPUs can be addressed by IOAPIC/MSI
-		 * only in physical mode
+		 * Without IR, all CPUs can be addressed by IOAPIC/MSI only
+		 * in physical mode, and CPUs with an APIC ID that cannnot
+		 * be addressed must not be brought online.
 		 */
+		x2apic_set_max_apicid(255);
 		x2apic_phys = 1;
 	}
 	x2apic_enable();
diff --git a/arch/x86/kernel/apic/x2apic_phys.c b/arch/x86/kernel/apic/x2apic_phys.c
index bc9693841353c..e14eae6d6ea71 100644
--- a/arch/x86/kernel/apic/x2apic_phys.c
+++ b/arch/x86/kernel/apic/x2apic_phys.c
@@ -8,6 +8,12 @@
 int x2apic_phys;
 
 static struct apic apic_x2apic_phys;
+static u32 x2apic_max_apicid __ro_after_init;
+
+void __init x2apic_set_max_apicid(u32 apicid)
+{
+	x2apic_max_apicid = apicid;
+}
 
 static int __init set_x2apic_phys_mode(char *arg)
 {
@@ -98,6 +104,9 @@ static int x2apic_phys_probe(void)
 /* Common x2apic functions, also used by x2apic_cluster */
 int x2apic_apic_id_valid(u32 apicid)
 {
+	if (x2apic_max_apicid && apicid > x2apic_max_apicid)
+		return 0;
+
 	return 1;
 }
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 091/453] sched/deadline: Fix sched_dl_global_validate()
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (89 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.4 090/453] x86/apic: Fix x2apic enablement without interrupt remapping Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.4 092/453] sched: Reenable interrupts in do_sched_yield() Greg Kroah-Hartman
                   ` (364 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Peng Liu, Peter Zijlstra (Intel),
	Daniel Bristot de Oliveira, Juri Lelli, Sasha Levin

From: Peng Liu <iwtbavbm@gmail.com>

[ Upstream commit a57415f5d1e43c3a5c5d412cd85e2792d7ed9b11 ]

When change sched_rt_{runtime, period}_us, we validate that the new
settings should at least accommodate the currently allocated -dl
bandwidth:

  sched_rt_handler()
    -->	sched_dl_bandwidth_validate()
	{
		new_bw = global_rt_runtime()/global_rt_period();

		for_each_possible_cpu(cpu) {
			dl_b = dl_bw_of(cpu);
			if (new_bw < dl_b->total_bw)    <-------
				ret = -EBUSY;
		}
	}

But under CONFIG_SMP, dl_bw is per root domain , but not per CPU,
dl_b->total_bw is the allocated bandwidth of the whole root domain.
Instead, we should compare dl_b->total_bw against "cpus*new_bw",
where 'cpus' is the number of CPUs of the root domain.

Also, below annotation(in kernel/sched/sched.h) implied implementation
only appeared in SCHED_DEADLINE v2[1], then deadline scheduler kept
evolving till got merged(v9), but the annotation remains unchanged,
meaningless and misleading, update it.

* With respect to SMP, the bandwidth is given on a per-CPU basis,
* meaning that:
*  - dl_bw (< 100%) is the bandwidth of the system (group) on each CPU;
*  - dl_total_bw array contains, in the i-eth element, the currently
*    allocated bandwidth on the i-eth CPU.

[1]: https://lore.kernel.org/lkml/1267385230.13676.101.camel@Palantir/

Fixes: 332ac17ef5bf ("sched/deadline: Add bandwidth management for SCHED_DEADLINE tasks")
Signed-off-by: Peng Liu <iwtbavbm@gmail.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Daniel Bristot de Oliveira <bristot@redhat.com>
Acked-by: Juri Lelli <juri.lelli@redhat.com>
Link: https://lkml.kernel.org/r/db6bbda316048cda7a1bbc9571defde193a8d67e.1602171061.git.iwtbavbm@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/sched/deadline.c |  5 +++--
 kernel/sched/sched.h    | 42 ++++++++++++++++++-----------------------
 2 files changed, 21 insertions(+), 26 deletions(-)

diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c
index 4cb00538a207b..4ce8c11e5e4ae 100644
--- a/kernel/sched/deadline.c
+++ b/kernel/sched/deadline.c
@@ -2469,7 +2469,7 @@ int sched_dl_global_validate(void)
 	u64 period = global_rt_period();
 	u64 new_bw = to_ratio(period, runtime);
 	struct dl_bw *dl_b;
-	int cpu, ret = 0;
+	int cpu, cpus, ret = 0;
 	unsigned long flags;
 
 	/*
@@ -2484,9 +2484,10 @@ int sched_dl_global_validate(void)
 	for_each_possible_cpu(cpu) {
 		rcu_read_lock_sched();
 		dl_b = dl_bw_of(cpu);
+		cpus = dl_bw_cpus(cpu);
 
 		raw_spin_lock_irqsave(&dl_b->lock, flags);
-		if (new_bw < dl_b->total_bw)
+		if (new_bw * cpus < dl_b->total_bw)
 			ret = -EBUSY;
 		raw_spin_unlock_irqrestore(&dl_b->lock, flags);
 
diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h
index 3e7590813844f..e10fb9bf2988c 100644
--- a/kernel/sched/sched.h
+++ b/kernel/sched/sched.h
@@ -247,30 +247,6 @@ struct rt_bandwidth {
 
 void __dl_clear_params(struct task_struct *p);
 
-/*
- * To keep the bandwidth of -deadline tasks and groups under control
- * we need some place where:
- *  - store the maximum -deadline bandwidth of the system (the group);
- *  - cache the fraction of that bandwidth that is currently allocated.
- *
- * This is all done in the data structure below. It is similar to the
- * one used for RT-throttling (rt_bandwidth), with the main difference
- * that, since here we are only interested in admission control, we
- * do not decrease any runtime while the group "executes", neither we
- * need a timer to replenish it.
- *
- * With respect to SMP, the bandwidth is given on a per-CPU basis,
- * meaning that:
- *  - dl_bw (< 100%) is the bandwidth of the system (group) on each CPU;
- *  - dl_total_bw array contains, in the i-eth element, the currently
- *    allocated bandwidth on the i-eth CPU.
- * Moreover, groups consume bandwidth on each CPU, while tasks only
- * consume bandwidth on the CPU they're running on.
- * Finally, dl_total_bw_cpu is used to cache the index of dl_total_bw
- * that will be shown the next time the proc or cgroup controls will
- * be red. It on its turn can be changed by writing on its own
- * control.
- */
 struct dl_bandwidth {
 	raw_spinlock_t		dl_runtime_lock;
 	u64			dl_runtime;
@@ -282,6 +258,24 @@ static inline int dl_bandwidth_enabled(void)
 	return sysctl_sched_rt_runtime >= 0;
 }
 
+/*
+ * To keep the bandwidth of -deadline tasks under control
+ * we need some place where:
+ *  - store the maximum -deadline bandwidth of each cpu;
+ *  - cache the fraction of bandwidth that is currently allocated in
+ *    each root domain;
+ *
+ * This is all done in the data structure below. It is similar to the
+ * one used for RT-throttling (rt_bandwidth), with the main difference
+ * that, since here we are only interested in admission control, we
+ * do not decrease any runtime while the group "executes", neither we
+ * need a timer to replenish it.
+ *
+ * With respect to SMP, bandwidth is given on a per root domain basis,
+ * meaning that:
+ *  - bw (< 100%) is the deadline bandwidth of each CPU;
+ *  - total_bw is the currently allocated bandwidth in each root domain;
+ */
 struct dl_bw {
 	raw_spinlock_t		lock;
 	u64			bw;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 092/453] sched: Reenable interrupts in do_sched_yield()
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (90 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.4 091/453] sched/deadline: Fix sched_dl_global_validate() Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.4 093/453] drm/amdgpu: fix incorrect enum type Greg Kroah-Hartman
                   ` (363 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Thomas Gleixner,
	Peter Zijlstra (Intel),
	Sasha Levin

From: Thomas Gleixner <tglx@linutronix.de>

[ Upstream commit 345a957fcc95630bf5535d7668a59ed983eb49a7 ]

do_sched_yield() invokes schedule() with interrupts disabled which is
not allowed. This goes back to the pre git era to commit a6efb709806c
("[PATCH] irqlock patch 2.5.27-H6") in the history tree.

Reenable interrupts and remove the misleading comment which "explains" it.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/87r1pt7y5c.fsf@nanos.tec.linutronix.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/sched/core.c | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 4511532b08b84..7841e738e38f0 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -5679,12 +5679,8 @@ static void do_sched_yield(void)
 	schedstat_inc(rq->yld_count);
 	current->sched_class->yield_task(rq);
 
-	/*
-	 * Since we are going to call schedule() anyway, there's
-	 * no need to preempt or enable interrupts:
-	 */
 	preempt_disable();
-	rq_unlock(rq, &rf);
+	rq_unlock_irq(rq, &rf);
 	sched_preempt_enable_no_resched();
 
 	schedule();
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 093/453] drm/amdgpu: fix incorrect enum type
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (91 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.4 092/453] sched: Reenable interrupts in do_sched_yield() Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.4 094/453] crypto: talitos - Endianess in current_desc_hdr() Greg Kroah-Hartman
                   ` (362 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Arnd Bergmann, Alex Deucher, Sasha Levin

From: Arnd Bergmann <arnd@arndb.de>

[ Upstream commit a110f3750bf8b93764f13bd1402c7cba03d15d61 ]

core_link_write_dpcd() returns enum dc_status, not ddc_result:

display/dc/core/dc_link_dp.c: In function 'dp_set_panel_mode':
display/dc/core/dc_link_dp.c:4237:11: warning: implicit conversion from 'enum dc_status' to 'enum ddc_result'
[-Wenum-conversion]

Avoid the warning by using the correct enum in the caller.

Fixes: 0b226322434c ("drm/amd/display: Synchronous DisplayPort Link Training")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
index 6dd2334dd5e60..959eb075d11ed 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
@@ -3378,7 +3378,7 @@ void dp_set_panel_mode(struct dc_link *link, enum dp_panel_mode panel_mode)
 
 		if (edp_config_set.bits.PANEL_MODE_EDP
 			!= panel_mode_edp) {
-			enum ddc_result result = DDC_RESULT_UNKNOWN;
+			enum dc_status result = DC_ERROR_UNEXPECTED;
 
 			edp_config_set.bits.PANEL_MODE_EDP =
 			panel_mode_edp;
@@ -3388,7 +3388,7 @@ void dp_set_panel_mode(struct dc_link *link, enum dp_panel_mode panel_mode)
 				&edp_config_set.raw,
 				sizeof(edp_config_set.raw));
 
-			ASSERT(result == DDC_RESULT_SUCESSFULL);
+			ASSERT(result == DC_OK);
 		}
 	}
 	DC_LOG_DETECTION_DP_CAPS("Link: %d eDP panel mode supported: %d "
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 094/453] crypto: talitos - Endianess in current_desc_hdr()
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (92 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.4 093/453] drm/amdgpu: fix incorrect enum type Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.4 095/453] crypto: talitos - Fix return type of current_desc_hdr() Greg Kroah-Hartman
                   ` (361 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christophe Leroy, Herbert Xu, Sasha Levin

From: Christophe Leroy <christophe.leroy@csgroup.eu>

[ Upstream commit 195404db27f9533c71fdcb78d32a77075c2cb4a2 ]

current_desc_hdr() compares the value of the current descriptor
with the next_desc member of the talitos_desc struct.

While the current descriptor is obtained from in_be32() which
return CPU ordered bytes, next_desc member is in big endian order.

Convert the current descriptor into big endian before comparing it
with next_desc.

This fixes a sparse warning.

Fixes: 37b5e8897eb5 ("crypto: talitos - chain in buffered data for ahash on SEC1")
Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/talitos.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c
index 56e3068c9947a..261c0bfa8f185 100644
--- a/drivers/crypto/talitos.c
+++ b/drivers/crypto/talitos.c
@@ -478,7 +478,7 @@ static u32 current_desc_hdr(struct device *dev, int ch)
 
 	iter = tail;
 	while (priv->chan[ch].fifo[iter].dma_desc != cur_desc &&
-	       priv->chan[ch].fifo[iter].desc->next_desc != cur_desc) {
+	       priv->chan[ch].fifo[iter].desc->next_desc != cpu_to_be32(cur_desc)) {
 		iter = (iter + 1) & (priv->fifo_len - 1);
 		if (iter == tail) {
 			dev_err(dev, "couldn't locate current descriptor\n");
@@ -486,7 +486,7 @@ static u32 current_desc_hdr(struct device *dev, int ch)
 		}
 	}
 
-	if (priv->chan[ch].fifo[iter].desc->next_desc == cur_desc) {
+	if (priv->chan[ch].fifo[iter].desc->next_desc == cpu_to_be32(cur_desc)) {
 		struct talitos_edesc *edesc;
 
 		edesc = container_of(priv->chan[ch].fifo[iter].desc,
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 095/453] crypto: talitos - Fix return type of current_desc_hdr()
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (93 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.4 094/453] crypto: talitos - Endianess in current_desc_hdr() Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.4 096/453] crypto: inside-secure - Fix sizeof() mismatch Greg Kroah-Hartman
                   ` (360 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christophe Leroy, Herbert Xu, Sasha Levin

From: Christophe Leroy <christophe.leroy@csgroup.eu>

[ Upstream commit 0237616173fd363a54bd272aa3bd376faa1d7caa ]

current_desc_hdr() returns a u32 but in fact this is a __be32,
leading to a lot of sparse warnings.

Change the return type to __be32 and ensure it is handled as
sure by the caller.

Fixes: 3e721aeb3df3 ("crypto: talitos - handle descriptor not found in error path")
Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/talitos.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c
index 261c0bfa8f185..b7c66fc0ae0c2 100644
--- a/drivers/crypto/talitos.c
+++ b/drivers/crypto/talitos.c
@@ -460,7 +460,7 @@ DEF_TALITOS2_DONE(ch1_3, TALITOS2_ISR_CH_1_3_DONE)
 /*
  * locate current (offending) descriptor
  */
-static u32 current_desc_hdr(struct device *dev, int ch)
+static __be32 current_desc_hdr(struct device *dev, int ch)
 {
 	struct talitos_private *priv = dev_get_drvdata(dev);
 	int tail, iter;
@@ -501,13 +501,13 @@ static u32 current_desc_hdr(struct device *dev, int ch)
 /*
  * user diagnostics; report root cause of error based on execution unit status
  */
-static void report_eu_error(struct device *dev, int ch, u32 desc_hdr)
+static void report_eu_error(struct device *dev, int ch, __be32 desc_hdr)
 {
 	struct talitos_private *priv = dev_get_drvdata(dev);
 	int i;
 
 	if (!desc_hdr)
-		desc_hdr = in_be32(priv->chan[ch].reg + TALITOS_DESCBUF);
+		desc_hdr = cpu_to_be32(in_be32(priv->chan[ch].reg + TALITOS_DESCBUF));
 
 	switch (desc_hdr & DESC_HDR_SEL0_MASK) {
 	case DESC_HDR_SEL0_AFEU:
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 096/453] crypto: inside-secure - Fix sizeof() mismatch
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (94 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.4 095/453] crypto: talitos - Fix return type of current_desc_hdr() Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.4 097/453] ASoC: sun4i-i2s: Fix lrck_period computation for I2S justified mode Greg Kroah-Hartman
                   ` (359 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Colin Ian King, Antoine Tenart,
	Herbert Xu, Sasha Levin

From: Colin Ian King <colin.king@canonical.com>

[ Upstream commit c98e233062cd9d0e2f10e445a671f0799daaef67 ]

An incorrect sizeof() is being used, sizeof(priv->ring[i].rdr_req) is
not correct, it should be sizeof(*priv->ring[i].rdr_req). Note that
since the size of ** is the same size as * this is not causing any
issues.

Addresses-Coverity: ("Sizeof not portable (SIZEOF_MISMATCH)")
Fixes: 9744fec95f06 ("crypto: inside-secure - remove request list to improve performance")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Acked-by: Antoine Tenart <atenart@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/inside-secure/safexcel.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/crypto/inside-secure/safexcel.c b/drivers/crypto/inside-secure/safexcel.c
index 991a4425f006a..4d9d97c59ee36 100644
--- a/drivers/crypto/inside-secure/safexcel.c
+++ b/drivers/crypto/inside-secure/safexcel.c
@@ -1467,7 +1467,7 @@ static int safexcel_probe_generic(void *pdev,
 
 		priv->ring[i].rdr_req = devm_kcalloc(dev,
 			EIP197_DEFAULT_RING_SIZE,
-			sizeof(priv->ring[i].rdr_req),
+			sizeof(*priv->ring[i].rdr_req),
 			GFP_KERNEL);
 		if (!priv->ring[i].rdr_req)
 			return -ENOMEM;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 097/453] ASoC: sun4i-i2s: Fix lrck_period computation for I2S justified mode
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (95 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.4 096/453] crypto: inside-secure - Fix sizeof() mismatch Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.4 098/453] ARM: dts: aspeed: tiogapass: Remove vuart Greg Kroah-Hartman
                   ` (358 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Clément Péron,
	Maxime Ripard, Mark Brown, Sasha Levin

From: Clément Péron <peron.clem@gmail.com>

[ Upstream commit 93c0210671d8f3ec2262da703fab93a1497158a8 ]

Left and Right justified mode are computed using the same formula
as DSP_A and DSP_B mode.
Which is wrong and the user manual explicitly says:

LRCK_PERDIOD:
PCM Mode: Number of BCLKs within (Left + Right) channel width.
I2S/Left-Justified/Right-Justified Mode: Number of BCLKs within each
individual channel width(Left or Right)

Fix this by using the same formula as the I2S mode.

Fixes: 7ae7834ec446 ("ASoC: sun4i-i2s: Add support for DSP formats")
Signed-off-by: Clément Péron <peron.clem@gmail.com>
Acked-by: Maxime Ripard <mripard@kernel.org>
Link: https://lore.kernel.org/r/20201030144648.397824-2-peron.clem@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/sunxi/sun4i-i2s.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/sound/soc/sunxi/sun4i-i2s.c b/sound/soc/sunxi/sun4i-i2s.c
index d0a8d5810c0a5..9655dec4166b6 100644
--- a/sound/soc/sunxi/sun4i-i2s.c
+++ b/sound/soc/sunxi/sun4i-i2s.c
@@ -442,11 +442,11 @@ static int sun8i_i2s_set_chan_cfg(const struct sun4i_i2s *i2s,
 	switch (i2s->format & SND_SOC_DAIFMT_FORMAT_MASK) {
 	case SND_SOC_DAIFMT_DSP_A:
 	case SND_SOC_DAIFMT_DSP_B:
-	case SND_SOC_DAIFMT_LEFT_J:
-	case SND_SOC_DAIFMT_RIGHT_J:
 		lrck_period = params_physical_width(params) * slots;
 		break;
 
+	case SND_SOC_DAIFMT_LEFT_J:
+	case SND_SOC_DAIFMT_RIGHT_J:
 	case SND_SOC_DAIFMT_I2S:
 		lrck_period = params_physical_width(params);
 		break;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 098/453] ARM: dts: aspeed: tiogapass: Remove vuart
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (96 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.4 097/453] ASoC: sun4i-i2s: Fix lrck_period computation for I2S justified mode Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.4 099/453] drm/amdgpu: fix build_coefficients() argument Greg Kroah-Hartman
                   ` (357 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Vijay Khemka, Joel Stanley, Sasha Levin

From: Vijay Khemka <vijaykhemka@fb.com>

[ Upstream commit 14f100c00f1e35e5890340d4c6a64bda5dff4320 ]

Removed vuart for facebook tiogapass platform as it uses uart2 and
uart3 pin with aspeed uart routing feature.

Signed-off-by: Vijay Khemka <vijaykhemka@fb.com>
Reviewed-by: Joel Stanley <joel@jms.id.au>
Fixes: ffdbf494821d ("ARM: dts: aspeed: tiogapass: Enable VUART")
Link: https://lore.kernel.org/r/20200813190431.3331026-1-vijaykhemka@fb.com
Signed-off-by: Joel Stanley <joel@jms.id.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/aspeed-bmc-facebook-tiogapass.dts | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/arch/arm/boot/dts/aspeed-bmc-facebook-tiogapass.dts b/arch/arm/boot/dts/aspeed-bmc-facebook-tiogapass.dts
index 682f729ea25e1..c58230fea45f8 100644
--- a/arch/arm/boot/dts/aspeed-bmc-facebook-tiogapass.dts
+++ b/arch/arm/boot/dts/aspeed-bmc-facebook-tiogapass.dts
@@ -81,11 +81,6 @@
 	status = "okay";
 };
 
-&vuart {
-	// VUART Host Console
-	status = "okay";
-};
-
 &uart1 {
 	// Host Console
 	status = "okay";
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 099/453] drm/amdgpu: fix build_coefficients() argument
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (97 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.4 098/453] ARM: dts: aspeed: tiogapass: Remove vuart Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-29 17:58   ` Pavel Machek
  2020-12-28 12:45 ` [PATCH 5.4 100/453] powerpc/64: Set up a kernel stack for secondaries before cpu_restore() Greg Kroah-Hartman
                   ` (356 subsequent siblings)
  455 siblings, 1 reply; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Harry Wentland, Arnd Bergmann,
	Alex Deucher, Sasha Levin

From: Arnd Bergmann <arnd@arndb.de>

[ Upstream commit dbb60031dd0c2b85f10ce4c12ae604c28d3aaca4 ]

gcc -Wextra warns about a function taking an enum argument
being called with a bool:

drivers/gpu/drm/amd/amdgpu/../display/modules/color/color_gamma.c: In function 'apply_degamma_for_user_regamma':
drivers/gpu/drm/amd/amdgpu/../display/modules/color/color_gamma.c:1617:29: warning: implicit conversion from 'enum <anonymous>' to 'enum dc_transfer_func_predefined' [-Wenum-conversion]
 1617 |  build_coefficients(&coeff, true);

It appears that a patch was added using the old calling conventions
after the type was changed, and the value should actually be 0
(TRANSFER_FUNCTION_SRGB) here instead of 1 (true).

Fixes: 55a01d4023ce ("drm/amd/display: Add user_regamma to color module")
Reviewed-by: Harry Wentland <harry.wentland@amd.com>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/display/modules/color/color_gamma.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/display/modules/color/color_gamma.c b/drivers/gpu/drm/amd/display/modules/color/color_gamma.c
index 51d07a4561ce9..e042d8ce05b4a 100644
--- a/drivers/gpu/drm/amd/display/modules/color/color_gamma.c
+++ b/drivers/gpu/drm/amd/display/modules/color/color_gamma.c
@@ -1576,7 +1576,7 @@ static void apply_degamma_for_user_regamma(struct pwl_float_data_ex *rgb_regamma
 	struct pwl_float_data_ex *rgb = rgb_regamma;
 	const struct hw_x_point *coord_x = coordinates_x;
 
-	build_coefficients(&coeff, true);
+	build_coefficients(&coeff, TRANSFER_FUNCTION_SRGB);
 
 	i = 0;
 	while (i != hw_points_num + 1) {
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 100/453] powerpc/64: Set up a kernel stack for secondaries before cpu_restore()
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (98 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.4 099/453] drm/amdgpu: fix build_coefficients() argument Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.4 101/453] spi: img-spfi: fix reference leak in img_spfi_resume Greg Kroah-Hartman
                   ` (355 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jordan Niethe, Michael Ellerman, Sasha Levin

From: Jordan Niethe <jniethe5@gmail.com>

[ Upstream commit 3c0b976bf20d236c57adcefa80f86a0a1d737727 ]

Currently in generic_secondary_smp_init(), cur_cpu_spec->cpu_restore()
is called before a stack has been set up in r1. This was previously fine
as the cpu_restore() functions were implemented in assembly and did not
use a stack. However commit 5a61ef74f269 ("powerpc/64s: Support new
device tree binding for discovering CPU features") used
__restore_cpu_cpufeatures() as the cpu_restore() function for a
device-tree features based cputable entry. This is a C function and
hence uses a stack in r1.

generic_secondary_smp_init() is entered on the secondary cpus via the
primary cpu using the OPAL call opal_start_cpu(). In OPAL, each hardware
thread has its own stack. The OPAL call is ran in the primary's hardware
thread. During the call, a job is scheduled on a secondary cpu that will
start executing at the address of generic_secondary_smp_init().  Hence
the value that will be left in r1 when the secondary cpu enters the
kernel is part of that secondary cpu's individual OPAL stack. This means
that __restore_cpu_cpufeatures() will write to that OPAL stack. This is
not horribly bad as each hardware thread has its own stack and the call
that enters the kernel from OPAL never returns, but it is still wrong
and should be corrected.

Create the temp kernel stack before calling cpu_restore().

As noted by mpe, for a kexec boot, the secondary CPUs are released from
the spin loop at address 0x60 by smp_release_cpus() and then jump to
generic_secondary_smp_init(). The call to smp_release_cpus() is in
setup_arch(), and it comes before the call to emergency_stack_init().
emergency_stack_init() allocates an emergency stack in the PACA for each
CPU.  This address in the PACA is what is used to set up the temp kernel
stack in generic_secondary_smp_init(). Move releasing the secondary CPUs
to after the PACAs have been allocated an emergency stack, otherwise the
PACA stack pointer will contain garbage and hence the temp kernel stack
created from it will be broken.

Fixes: 5a61ef74f269 ("powerpc/64s: Support new device tree binding for discovering CPU features")
Signed-off-by: Jordan Niethe <jniethe5@gmail.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20201014072837.24539-1-jniethe5@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/kernel/head_64.S      | 8 ++++----
 arch/powerpc/kernel/setup-common.c | 4 ++--
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/arch/powerpc/kernel/head_64.S b/arch/powerpc/kernel/head_64.S
index 780f527eabd2c..d61b3b13a6ec8 100644
--- a/arch/powerpc/kernel/head_64.S
+++ b/arch/powerpc/kernel/head_64.S
@@ -420,6 +420,10 @@ generic_secondary_common_init:
 	/* From now on, r24 is expected to be logical cpuid */
 	mr	r24,r5
 
+	/* Create a temp kernel stack for use before relocation is on.	*/
+	ld	r1,PACAEMERGSP(r13)
+	subi	r1,r1,STACK_FRAME_OVERHEAD
+
 	/* See if we need to call a cpu state restore handler */
 	LOAD_REG_ADDR(r23, cur_cpu_spec)
 	ld	r23,0(r23)
@@ -448,10 +452,6 @@ generic_secondary_common_init:
 	sync				/* order paca.run and cur_cpu_spec */
 	isync				/* In case code patching happened */
 
-	/* Create a temp kernel stack for use before relocation is on.	*/
-	ld	r1,PACAEMERGSP(r13)
-	subi	r1,r1,STACK_FRAME_OVERHEAD
-
 	b	__secondary_start
 #endif /* SMP */
 
diff --git a/arch/powerpc/kernel/setup-common.c b/arch/powerpc/kernel/setup-common.c
index 25aaa39030009..f281d011f4b97 100644
--- a/arch/powerpc/kernel/setup-common.c
+++ b/arch/powerpc/kernel/setup-common.c
@@ -903,8 +903,6 @@ void __init setup_arch(char **cmdline_p)
 
 	/* On BookE, setup per-core TLB data structures. */
 	setup_tlb_core_data();
-
-	smp_release_cpus();
 #endif
 
 	/* Print various info about the machine that has been gathered so far. */
@@ -925,6 +923,8 @@ void __init setup_arch(char **cmdline_p)
 	exc_lvl_early_init();
 	emergency_stack_init();
 
+	smp_release_cpus();
+
 	initmem_init();
 
 	early_memtest(min_low_pfn << PAGE_SHIFT, max_low_pfn << PAGE_SHIFT);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 101/453] spi: img-spfi: fix reference leak in img_spfi_resume
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (99 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.4 100/453] powerpc/64: Set up a kernel stack for secondaries before cpu_restore() Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.4 102/453] f2fs: call f2fs_get_meta_page_retry for nat page Greg Kroah-Hartman
                   ` (354 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Zhang Qilong, Mark Brown, Sasha Levin

From: Zhang Qilong <zhangqilong3@huawei.com>

[ Upstream commit ee5558a9084584015c8754ffd029ce14a5827fa8 ]

pm_runtime_get_sync will increment pm usage counter even it
failed. Forgetting to pm_runtime_put_noidle will result in
reference leak in img_spfi_resume, so we should fix it.

Fixes: deba25800a12b ("spi: Add driver for IMG SPFI controller")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Link: https://lore.kernel.org/r/20201102145651.3875-1-zhangqilong3@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-img-spfi.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/spi/spi-img-spfi.c b/drivers/spi/spi-img-spfi.c
index f4a8f470aecc2..e9ef80983b791 100644
--- a/drivers/spi/spi-img-spfi.c
+++ b/drivers/spi/spi-img-spfi.c
@@ -771,8 +771,10 @@ static int img_spfi_resume(struct device *dev)
 	int ret;
 
 	ret = pm_runtime_get_sync(dev);
-	if (ret)
+	if (ret) {
+		pm_runtime_put_noidle(dev);
 		return ret;
+	}
 	spfi_reset(spfi);
 	pm_runtime_put(dev);
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 102/453] f2fs: call f2fs_get_meta_page_retry for nat page
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (100 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.4 101/453] spi: img-spfi: fix reference leak in img_spfi_resume Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.4 103/453] drm/msm/dsi_pll_10nm: restore VCO rate during restore_state Greg Kroah-Hartman
                   ` (353 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chao Yu, Jaegeuk Kim, Sasha Levin

From: Jaegeuk Kim <jaegeuk@kernel.org>

[ Upstream commit 3acc4522d89e0a326db69e9d0afaad8cf763a54c ]

When running fault injection test, if we don't stop checkpoint, some stale
NAT entries were flushed which breaks consistency.

Fixes: 86f33603f8c5 ("f2fs: handle errors of f2fs_get_meta_page_nofail")
Reviewed-by: Chao Yu <yuchao0@huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/f2fs/node.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c
index 2a4a382f28fed..3ac2a4b32375d 100644
--- a/fs/f2fs/node.c
+++ b/fs/f2fs/node.c
@@ -109,7 +109,7 @@ static void clear_node_page_dirty(struct page *page)
 
 static struct page *get_current_nat_page(struct f2fs_sb_info *sbi, nid_t nid)
 {
-	return f2fs_get_meta_page(sbi, current_nat_addr(sbi, nid));
+	return f2fs_get_meta_page_retry(sbi, current_nat_addr(sbi, nid));
 }
 
 static struct page *get_next_nat_page(struct f2fs_sb_info *sbi, nid_t nid)
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 103/453] drm/msm/dsi_pll_10nm: restore VCO rate during restore_state
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (101 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.4 102/453] f2fs: call f2fs_get_meta_page_retry for nat page Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.4 104/453] spi: spi-mem: fix reference leak in spi_mem_access_start Greg Kroah-Hartman
                   ` (352 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dmitry Baryshkov, Rob Clark, Sasha Levin

From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>

[ Upstream commit a4ccc37693a271330a46208afbeaed939d54fdbb ]

PHY disable/enable resets PLL registers to default values. Thus in
addition to restoring several registers we also need to restore VCO rate
settings.

Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Fixes: c6659785dfb3 ("drm/msm/dsi/pll: call vco set rate explicitly")
Signed-off-by: Rob Clark <robdclark@chromium.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/msm/dsi/pll/dsi_pll_10nm.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/gpu/drm/msm/dsi/pll/dsi_pll_10nm.c b/drivers/gpu/drm/msm/dsi/pll/dsi_pll_10nm.c
index aa9385d5bfff9..33033b94935ed 100644
--- a/drivers/gpu/drm/msm/dsi/pll/dsi_pll_10nm.c
+++ b/drivers/gpu/drm/msm/dsi/pll/dsi_pll_10nm.c
@@ -559,6 +559,7 @@ static int dsi_pll_10nm_restore_state(struct msm_dsi_pll *pll)
 	struct pll_10nm_cached_state *cached = &pll_10nm->cached_state;
 	void __iomem *phy_base = pll_10nm->phy_cmn_mmio;
 	u32 val;
+	int ret;
 
 	val = pll_read(pll_10nm->mmio + REG_DSI_10nm_PHY_PLL_PLL_OUTDIV_RATE);
 	val &= ~0x3;
@@ -573,6 +574,13 @@ static int dsi_pll_10nm_restore_state(struct msm_dsi_pll *pll)
 	val |= cached->pll_mux;
 	pll_write(phy_base + REG_DSI_10nm_PHY_CMN_CLK_CFG1, val);
 
+	ret = dsi_pll_10nm_vco_set_rate(&pll->clk_hw, pll_10nm->vco_current_rate, pll_10nm->vco_ref_clk_rate);
+	if (ret) {
+		DRM_DEV_ERROR(&pll_10nm->pdev->dev,
+			"restore vco rate failed. ret=%d\n", ret);
+		return ret;
+	}
+
 	DBG("DSI PLL%d", pll_10nm->id);
 
 	return 0;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 104/453] spi: spi-mem: fix reference leak in spi_mem_access_start
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (102 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.4 103/453] drm/msm/dsi_pll_10nm: restore VCO rate during restore_state Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.4 105/453] ASoC: pcm: DRAIN support reactivation Greg Kroah-Hartman
                   ` (351 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Zhang Qilong, Mark Brown, Sasha Levin

From: Zhang Qilong <zhangqilong3@huawei.com>

[ Upstream commit c02bb16b0e826bf0e19aa42c3ae60ea339f32cf5 ]

pm_runtime_get_sync will increment pm usage counter even it
failed. Forgetting to pm_runtime_put_noidle will result in
reference leak in spi_mem_access_start, so we should fix it.

Fixes: f86c24f479530 ("spi: spi-mem: Split spi_mem_exec_op() code")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Link: https://lore.kernel.org/r/20201103140910.3482-1-zhangqilong3@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-mem.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/spi/spi-mem.c b/drivers/spi/spi-mem.c
index de0ba3e5449fa..33115bcfc787e 100644
--- a/drivers/spi/spi-mem.c
+++ b/drivers/spi/spi-mem.c
@@ -237,6 +237,7 @@ static int spi_mem_access_start(struct spi_mem *mem)
 
 		ret = pm_runtime_get_sync(ctlr->dev.parent);
 		if (ret < 0) {
+			pm_runtime_put_noidle(ctlr->dev.parent);
 			dev_err(&ctlr->dev, "Failed to power device: %d\n",
 				ret);
 			return ret;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 105/453] ASoC: pcm: DRAIN support reactivation
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (103 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.4 104/453] spi: spi-mem: fix reference leak in spi_mem_access_start Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.4 106/453] libbpf: Fix BTF data layout checks and allow empty BTF Greg Kroah-Hartman
                   ` (350 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Cezary Rojewski, Ranjani Sridharan,
	Mark Brown, Sasha Levin

From: Cezary Rojewski <cezary.rojewski@intel.com>

[ Upstream commit 4c22b80f61540ea99d9b4af0127315338755f05b ]

soc-pcm's dpcm_fe_dai_do_trigger() supported DRAIN commnad up to kernel
v5.4 where explicit switch(cmd) has been introduced which takes into
account all SNDRV_PCM_TRIGGER_xxx but SNDRV_PCM_TRIGGER_DRAIN. Update
switch statement to reactive support for it.

As DRAIN is somewhat unique by lacking negative/stop counterpart, bring
behaviour of dpcm_fe_dai_do_trigger() for said command back to its
pre-v5.4 state by adding it to START/RESUME/PAUSE_RELEASE group.

Fixes: acbf27746ecf ("ASoC: pcm: update FE/BE trigger order based on the command")
Signed-off-by: Cezary Rojewski <cezary.rojewski@intel.com>
Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
Link: https://lore.kernel.org/r/20201026100129.8216-1-cezary.rojewski@intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/soc-pcm.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c
index cc4e9aa80fb0d..1196167364d48 100644
--- a/sound/soc/soc-pcm.c
+++ b/sound/soc/soc-pcm.c
@@ -2346,6 +2346,7 @@ static int dpcm_fe_dai_do_trigger(struct snd_pcm_substream *substream, int cmd)
 		case SNDRV_PCM_TRIGGER_START:
 		case SNDRV_PCM_TRIGGER_RESUME:
 		case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
+		case SNDRV_PCM_TRIGGER_DRAIN:
 			ret = dpcm_dai_trigger_fe_be(substream, cmd, true);
 			break;
 		case SNDRV_PCM_TRIGGER_STOP:
@@ -2363,6 +2364,7 @@ static int dpcm_fe_dai_do_trigger(struct snd_pcm_substream *substream, int cmd)
 		case SNDRV_PCM_TRIGGER_START:
 		case SNDRV_PCM_TRIGGER_RESUME:
 		case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
+		case SNDRV_PCM_TRIGGER_DRAIN:
 			ret = dpcm_dai_trigger_fe_be(substream, cmd, false);
 			break;
 		case SNDRV_PCM_TRIGGER_STOP:
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 106/453] libbpf: Fix BTF data layout checks and allow empty BTF
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (104 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.4 105/453] ASoC: pcm: DRAIN support reactivation Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 15:49   ` Naresh Kamboju
  2020-12-28 12:45 ` [PATCH 5.4 107/453] selinux: fix inode_doinit_with_dentry() LABEL_INVALID error handling Greg Kroah-Hartman
                   ` (349 subsequent siblings)
  455 siblings, 1 reply; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Andrii Nakryiko, Alexei Starovoitov,
	Sasha Levin

From: Andrii Nakryiko <andrii@kernel.org>

[ Upstream commit d8123624506cd62730c9cd9c7672c698e462703d ]

Make data section layout checks stricter, disallowing overlap of types and
strings data.

Additionally, allow BTFs with no type data. There is nothing inherently wrong
with having BTF with no types (put potentially with some strings). This could
be a situation with kernel module BTFs, if module doesn't introduce any new
type information.

Also fix invalid offset alignment check for btf->hdr->type_off.

Fixes: 8a138aed4a80 ("bpf: btf: Add BTF support to libbpf")
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://lore.kernel.org/bpf/20201105043402.2530976-8-andrii@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/lib/bpf/btf.c | 16 ++++++----------
 1 file changed, 6 insertions(+), 10 deletions(-)

diff --git a/tools/lib/bpf/btf.c b/tools/lib/bpf/btf.c
index d606a358480da..3380aadb74655 100644
--- a/tools/lib/bpf/btf.c
+++ b/tools/lib/bpf/btf.c
@@ -100,22 +100,18 @@ static int btf_parse_hdr(struct btf *btf)
 		return -EINVAL;
 	}
 
-	if (meta_left < hdr->type_off) {
-		pr_debug("Invalid BTF type section offset:%u\n", hdr->type_off);
+	if (meta_left < hdr->str_off + hdr->str_len) {
+		pr_debug("Invalid BTF total size:%u\n", btf->raw_size);
 		return -EINVAL;
 	}
 
-	if (meta_left < hdr->str_off) {
-		pr_debug("Invalid BTF string section offset:%u\n", hdr->str_off);
+	if (hdr->type_off + hdr->type_len > hdr->str_off) {
+		pr_debug("Invalid BTF data sections layout: type data at %u + %u, strings data at %u + %u\n",
+			 hdr->type_off, hdr->type_len, hdr->str_off, hdr->str_len);
 		return -EINVAL;
 	}
 
-	if (hdr->type_off >= hdr->str_off) {
-		pr_debug("BTF type section offset >= string section offset. No type?\n");
-		return -EINVAL;
-	}
-
-	if (hdr->type_off & 0x02) {
+	if (hdr->type_off % 4) {
 		pr_debug("BTF type section is not aligned to 4 bytes\n");
 		return -EINVAL;
 	}
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 107/453] selinux: fix inode_doinit_with_dentry() LABEL_INVALID error handling
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (105 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.4 106/453] libbpf: Fix BTF data layout checks and allow empty BTF Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.4 108/453] spi: stm32: fix reference leak in stm32_spi_resume Greg Kroah-Hartman
                   ` (348 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sven Schnelle, Ondrej Mosnacek,
	Paul Moore, Sasha Levin

From: Paul Moore <paul@paul-moore.com>

[ Upstream commit 200ea5a2292dc444a818b096ae6a32ba3caa51b9 ]

A previous fix, commit 83370b31a915 ("selinux: fix error initialization
in inode_doinit_with_dentry()"), changed how failures were handled
before a SELinux policy was loaded.  Unfortunately that patch was
potentially problematic for two reasons: it set the isec->initialized
state without holding a lock, and it didn't set the inode's SELinux
label to the "default" for the particular filesystem.  The later can
be a problem if/when a later attempt to revalidate the inode fails
and SELinux reverts to the existing inode label.

This patch should restore the default inode labeling that existed
before the original fix, without affecting the LABEL_INVALID marking
such that revalidation will still be attempted in the future.

Fixes: 83370b31a915 ("selinux: fix error initialization in inode_doinit_with_dentry()")
Reported-by: Sven Schnelle <svens@linux.ibm.com>
Tested-by: Sven Schnelle <svens@linux.ibm.com>
Reviewed-by: Ondrej Mosnacek <omosnace@redhat.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 security/selinux/hooks.c | 31 +++++++++++++------------------
 1 file changed, 13 insertions(+), 18 deletions(-)

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 76f7eb5690c8e..717a398ef4d05 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -1499,13 +1499,7 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent
 			 * inode_doinit with a dentry, before these inodes could
 			 * be used again by userspace.
 			 */
-			isec->initialized = LABEL_INVALID;
-			/*
-			 * There is nothing useful to jump to the "out"
-			 * label, except a needless spin lock/unlock
-			 * cycle.
-			 */
-			return 0;
+			goto out_invalid;
 		}
 
 		rc = inode_doinit_use_xattr(inode, dentry, sbsec->def_sid,
@@ -1559,15 +1553,8 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent
 			 * inode_doinit() with a dentry, before these inodes
 			 * could be used again by userspace.
 			 */
-			if (!dentry) {
-				isec->initialized = LABEL_INVALID;
-				/*
-				 * There is nothing useful to jump to the "out"
-				 * label, except a needless spin lock/unlock
-				 * cycle.
-				 */
-				return 0;
-			}
+			if (!dentry)
+				goto out_invalid;
 			rc = selinux_genfs_get_sid(dentry, sclass,
 						   sbsec->flags, &sid);
 			if (rc) {
@@ -1592,11 +1579,10 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent
 out:
 	spin_lock(&isec->lock);
 	if (isec->initialized == LABEL_PENDING) {
-		if (!sid || rc) {
+		if (rc) {
 			isec->initialized = LABEL_INVALID;
 			goto out_unlock;
 		}
-
 		isec->initialized = LABEL_INITIALIZED;
 		isec->sid = sid;
 	}
@@ -1604,6 +1590,15 @@ out:
 out_unlock:
 	spin_unlock(&isec->lock);
 	return rc;
+
+out_invalid:
+	spin_lock(&isec->lock);
+	if (isec->initialized == LABEL_PENDING) {
+		isec->initialized = LABEL_INVALID;
+		isec->sid = sid;
+	}
+	spin_unlock(&isec->lock);
+	return 0;
 }
 
 /* Convert a Linux signal to an access vector. */
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 108/453] spi: stm32: fix reference leak in stm32_spi_resume
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (106 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.4 107/453] selinux: fix inode_doinit_with_dentry() LABEL_INVALID error handling Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.4 109/453] brcmfmac: Fix memory leak for unpaired brcmf_{alloc/free} Greg Kroah-Hartman
                   ` (347 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Zhang Qilong, Alain Volmat,
	Mark Brown, Sasha Levin

From: Zhang Qilong <zhangqilong3@huawei.com>

[ Upstream commit 900ccdcb79bb61471df1566a70b2b39687a628d5 ]

pm_runtime_get_sync will increment pm usage counter even it
failed. Forgetting to pm_runtime_put_noidle will result in
reference leak in stm32_spi_resume, so we should fix it.

Fixes: db96bf976a4fc ("spi: stm32: fixes suspend/resume management")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Reviewed-by: Alain Volmat <alain.volmat@st.com>
Link: https://lore.kernel.org/r/20201106015217.140476-1-zhangqilong3@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-stm32.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/spi/spi-stm32.c b/drivers/spi/spi-stm32.c
index 9d8ceb63f7db1..ed20ad2950885 100644
--- a/drivers/spi/spi-stm32.c
+++ b/drivers/spi/spi-stm32.c
@@ -2055,6 +2055,7 @@ static int stm32_spi_resume(struct device *dev)
 
 	ret = pm_runtime_get_sync(dev);
 	if (ret < 0) {
+		pm_runtime_put_noidle(dev);
 		dev_err(dev, "Unable to power device:%d\n", ret);
 		return ret;
 	}
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 109/453] brcmfmac: Fix memory leak for unpaired brcmf_{alloc/free}
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (107 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.4 108/453] spi: stm32: fix reference leak in stm32_spi_resume Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.4 110/453] arm64: dts: exynos: Include common syscon restart/poweroff for Exynos7 Greg Kroah-Hartman
                   ` (346 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jaehoon Chung, Seung-Woo Kim,
	Arend van Spriel, Kalle Valo, Sasha Levin

From: Seung-Woo Kim <sw0312.kim@samsung.com>

[ Upstream commit 9db946284e07bb27309dd546b7fee528664ba82a ]

There are missig brcmf_free() for brcmf_alloc(). Fix memory leak
by adding missed brcmf_free().

Reported-by: Jaehoon Chung <jh80.chung@samsung.com>
Fixes: a1f5aac1765a ("brcmfmac: don't realloc wiphy during PCIe reset")
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/1603849967-22817-1-git-send-email-sw0312.kim@samsung.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c | 6 ++++--
 drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 1 +
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
index 3be60aef54650..cb68f54a9c56e 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
@@ -1936,16 +1936,18 @@ brcmf_pcie_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 	fwreq = brcmf_pcie_prepare_fw_request(devinfo);
 	if (!fwreq) {
 		ret = -ENOMEM;
-		goto fail_bus;
+		goto fail_brcmf;
 	}
 
 	ret = brcmf_fw_get_firmwares(bus->dev, fwreq, brcmf_pcie_setup);
 	if (ret < 0) {
 		kfree(fwreq);
-		goto fail_bus;
+		goto fail_brcmf;
 	}
 	return 0;
 
+fail_brcmf:
+	brcmf_free(&devinfo->pdev->dev);
 fail_bus:
 	kfree(bus->msgbuf);
 	kfree(bus);
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
index 38e6809f16c75..ef5521b9b3577 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
@@ -4433,6 +4433,7 @@ void brcmf_sdio_remove(struct brcmf_sdio *bus)
 		brcmf_sdiod_intr_unregister(bus->sdiodev);
 
 		brcmf_detach(bus->sdiodev->dev);
+		brcmf_free(bus->sdiodev->dev);
 
 		cancel_work_sync(&bus->datawork);
 		if (bus->brcmf_wq)
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 110/453] arm64: dts: exynos: Include common syscon restart/poweroff for Exynos7
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (108 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.4 109/453] brcmfmac: Fix memory leak for unpaired brcmf_{alloc/free} Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.4 111/453] arm64: dts: exynos: Correct psci compatible used on Exynos7 Greg Kroah-Hartman
                   ` (345 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Paweł Chmiel,
	Krzysztof Kozlowski, Sasha Levin

From: Paweł Chmiel <pawel.mikolaj.chmiel@gmail.com>

[ Upstream commit 73bc7510ea0dafb4ff1ae6808759627a8ec51f5a ]

Exynos7 uses the same syscon reboot and poweroff nodes as other Exynos
SoCs, so instead of duplicating code we can just include common dtsi
file, which already contains definitions of them. After this change,
poweroff node will be also available, previously this dts file did
contain only reboot node.

Fixes: fb026cb65247 ("arm64: dts: Add reboot node for exynos7")
Fixes: b9024cbc937d ("arm64: dts: Add initial device tree support for exynos7")
Signed-off-by: Paweł Chmiel <pawel.mikolaj.chmiel@gmail.com>
Link: https://lore.kernel.org/r/20201107133926.37187-1-pawel.mikolaj.chmiel@gmail.com
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/exynos/exynos7.dtsi | 8 +-------
 1 file changed, 1 insertion(+), 7 deletions(-)

diff --git a/arch/arm64/boot/dts/exynos/exynos7.dtsi b/arch/arm64/boot/dts/exynos/exynos7.dtsi
index 0821489a874de..c5be82d48c986 100644
--- a/arch/arm64/boot/dts/exynos/exynos7.dtsi
+++ b/arch/arm64/boot/dts/exynos/exynos7.dtsi
@@ -494,13 +494,6 @@
 		pmu_system_controller: system-controller@105c0000 {
 			compatible = "samsung,exynos7-pmu", "syscon";
 			reg = <0x105c0000 0x5000>;
-
-			reboot: syscon-reboot {
-				compatible = "syscon-reboot";
-				regmap = <&pmu_system_controller>;
-				offset = <0x0400>;
-				mask = <0x1>;
-			};
 		};
 
 		rtc: rtc@10590000 {
@@ -650,3 +643,4 @@
 };
 
 #include "exynos7-pinctrl.dtsi"
+#include "arm/exynos-syscon-restart.dtsi"
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 111/453] arm64: dts: exynos: Correct psci compatible used on Exynos7
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (109 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.4 110/453] arm64: dts: exynos: Include common syscon restart/poweroff for Exynos7 Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.4 112/453] Bluetooth: Fix null pointer dereference in hci_event_packet() Greg Kroah-Hartman
                   ` (344 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Paweł Chmiel,
	Krzysztof Kozlowski, Sasha Levin

From: Paweł Chmiel <pawel.mikolaj.chmiel@gmail.com>

[ Upstream commit e1e47fbca668507a81bb388fcae044b89d112ecc ]

It's not possible to reboot or poweroff Exynos7420 using PSCI. Instead
we need to use syscon reboot/poweroff drivers, like it's done for other
Exynos SoCs. This was confirmed by checking vendor source and testing it
on Samsung Galaxy S6 device based on this SoC.

To be able to use custom restart/poweroff handlers instead of PSCI
functions, we need to correct psci compatible. This also requires us to
provide function ids for CPU_ON and CPU_OFF.

Fixes: fb026cb65247 ("arm64: dts: Add reboot node for exynos7")
Fixes: b9024cbc937d ("arm64: dts: Add initial device tree support for exynos7")
Signed-off-by: Paweł Chmiel <pawel.mikolaj.chmiel@gmail.com>
Link: https://lore.kernel.org/r/20201107133926.37187-2-pawel.mikolaj.chmiel@gmail.com
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/exynos/exynos7.dtsi | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/exynos/exynos7.dtsi b/arch/arm64/boot/dts/exynos/exynos7.dtsi
index c5be82d48c986..25549d9552ae2 100644
--- a/arch/arm64/boot/dts/exynos/exynos7.dtsi
+++ b/arch/arm64/boot/dts/exynos/exynos7.dtsi
@@ -90,8 +90,10 @@
 	};
 
 	psci {
-		compatible = "arm,psci-0.2";
+		compatible = "arm,psci";
 		method = "smc";
+		cpu_off = <0x84000002>;
+		cpu_on = <0xC4000003>;
 	};
 
 	soc: soc {
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 112/453] Bluetooth: Fix null pointer dereference in hci_event_packet()
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (110 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.4 111/453] arm64: dts: exynos: Correct psci compatible used on Exynos7 Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.4 113/453] Bluetooth: hci_h5: fix memory leak in h5_close Greg Kroah-Hartman
                   ` (343 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Anmol Karn, Marcel Holtmann,
	Sasha Levin, syzbot+0bef568258653cff272f

From: Anmol Karn <anmol.karan123@gmail.com>

[ Upstream commit 6dfccd13db2ff2b709ef60a50163925d477549aa ]

AMP_MGR is getting derefernced in hci_phy_link_complete_evt(), when called
from hci_event_packet() and there is a possibility, that hcon->amp_mgr may
not be found when accessing after initialization of hcon.

- net/bluetooth/hci_event.c:4945
The bug seems to get triggered in this line:

bredr_hcon = hcon->amp_mgr->l2cap_conn->hcon;

Fix it by adding a NULL check for the hcon->amp_mgr before checking the ev-status.

Fixes: d5e911928bd8 ("Bluetooth: AMP: Process Physical Link Complete evt")
Reported-and-tested-by: syzbot+0bef568258653cff272f@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?extid=0bef568258653cff272f
Signed-off-by: Anmol Karn <anmol.karan123@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/bluetooth/hci_event.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index ada778bbbec97..0a88645f103f0 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -4791,6 +4791,11 @@ static void hci_phy_link_complete_evt(struct hci_dev *hdev,
 		return;
 	}
 
+	if (!hcon->amp_mgr) {
+		hci_dev_unlock(hdev);
+		return;
+	}
+
 	if (ev->status) {
 		hci_conn_del(hcon);
 		hci_dev_unlock(hdev);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 113/453] Bluetooth: hci_h5: fix memory leak in h5_close
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (111 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.4 112/453] Bluetooth: Fix null pointer dereference in hci_event_packet() Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.4 114/453] spi: spi-ti-qspi: fix reference leak in ti_qspi_setup Greg Kroah-Hartman
                   ` (342 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, syzbot+6ce141c55b2f7aafd1c4,
	Anant Thazhemadam, Hans de Goede, Marcel Holtmann, Sasha Levin

From: Anant Thazhemadam <anant.thazhemadam@gmail.com>

[ Upstream commit 855af2d74c870d747bf53509f8b2d7b9dc9ee2c3 ]

When h5_close() is called, h5 is directly freed when !hu->serdev.
However, h5->rx_skb is not freed, which causes a memory leak.

Freeing h5->rx_skb and setting it to NULL, fixes this memory leak.

Fixes: ce945552fde4 ("Bluetooth: hci_h5: Add support for serdev enumerated devices")
Reported-by: syzbot+6ce141c55b2f7aafd1c4@syzkaller.appspotmail.com
Tested-by: syzbot+6ce141c55b2f7aafd1c4@syzkaller.appspotmail.com
Signed-off-by: Anant Thazhemadam <anant.thazhemadam@gmail.com>
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/bluetooth/hci_h5.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/bluetooth/hci_h5.c b/drivers/bluetooth/hci_h5.c
index 5df0651b6cd55..e11af747395dd 100644
--- a/drivers/bluetooth/hci_h5.c
+++ b/drivers/bluetooth/hci_h5.c
@@ -244,6 +244,9 @@ static int h5_close(struct hci_uart *hu)
 	skb_queue_purge(&h5->rel);
 	skb_queue_purge(&h5->unrel);
 
+	kfree_skb(h5->rx_skb);
+	h5->rx_skb = NULL;
+
 	if (h5->vnd && h5->vnd->close)
 		h5->vnd->close(h5);
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 114/453] spi: spi-ti-qspi: fix reference leak in ti_qspi_setup
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (112 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.4 113/453] Bluetooth: hci_h5: fix memory leak in h5_close Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.4 115/453] spi: mt7621: fix missing clk_disable_unprepare() on error in mt7621_spi_probe Greg Kroah-Hartman
                   ` (341 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Zhang Qilong, Mark Brown, Sasha Levin

From: Zhang Qilong <zhangqilong3@huawei.com>

[ Upstream commit 45c0cba753641e5d7c3207f04241bd0e7a021698 ]

pm_runtime_get_sync will increment pm usage counter even it
failed. Forgetting to pm_runtime_put_noidle will result in
reference leak in ti_qspi_setup, so we should fix it.

Fixes: 505a14954e2d7 ("spi/qspi: Add qspi flash controller")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Link: https://lore.kernel.org/r/20201103140947.3815-1-zhangqilong3@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-ti-qspi.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/spi/spi-ti-qspi.c b/drivers/spi/spi-ti-qspi.c
index 66dcb61285392..cad2abcbd9c78 100644
--- a/drivers/spi/spi-ti-qspi.c
+++ b/drivers/spi/spi-ti-qspi.c
@@ -176,6 +176,7 @@ static int ti_qspi_setup(struct spi_device *spi)
 
 	ret = pm_runtime_get_sync(qspi->dev);
 	if (ret < 0) {
+		pm_runtime_put_noidle(qspi->dev);
 		dev_err(qspi->dev, "pm_runtime_get_sync() failed\n");
 		return ret;
 	}
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 115/453] spi: mt7621: fix missing clk_disable_unprepare() on error in mt7621_spi_probe
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (113 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.4 114/453] spi: spi-ti-qspi: fix reference leak in ti_qspi_setup Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.4 116/453] spi: tegra20-slink: fix reference leak in slink ops of tegra20 Greg Kroah-Hartman
                   ` (340 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Qinglang Miao, Mark Brown, Sasha Levin

From: Qinglang Miao <miaoqinglang@huawei.com>

[ Upstream commit 702b15cb97123cedcec56a39d9a21c5288eb9ae1 ]

Fix the missing clk_disable_unprepare() before return
from mt7621_spi_probe in the error handling case.

Fixes: cbd66c626e16 ("spi: mt7621: Move SPI driver out of staging")
Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
Link: https://lore.kernel.org/r/20201103074912.195576-1-miaoqinglang@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-mt7621.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/spi/spi-mt7621.c b/drivers/spi/spi-mt7621.c
index 2c3b7a2a1ec77..2cdae7994e2aa 100644
--- a/drivers/spi/spi-mt7621.c
+++ b/drivers/spi/spi-mt7621.c
@@ -353,6 +353,7 @@ static int mt7621_spi_probe(struct platform_device *pdev)
 	master = spi_alloc_master(&pdev->dev, sizeof(*rs));
 	if (!master) {
 		dev_info(&pdev->dev, "master allocation failed\n");
+		clk_disable_unprepare(clk);
 		return -ENOMEM;
 	}
 
@@ -377,6 +378,7 @@ static int mt7621_spi_probe(struct platform_device *pdev)
 	ret = device_reset(&pdev->dev);
 	if (ret) {
 		dev_err(&pdev->dev, "SPI reset failed!\n");
+		clk_disable_unprepare(clk);
 		return ret;
 	}
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 116/453] spi: tegra20-slink: fix reference leak in slink ops of tegra20
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (114 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.4 115/453] spi: mt7621: fix missing clk_disable_unprepare() on error in mt7621_spi_probe Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.4 117/453] spi: tegra20-sflash: fix reference leak in tegra_sflash_resume Greg Kroah-Hartman
                   ` (339 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Zhang Qilong, Mark Brown, Sasha Levin

From: Zhang Qilong <zhangqilong3@huawei.com>

[ Upstream commit 763eab7074f6e71babd85d796156f05a675f9510 ]

pm_runtime_get_sync will increment pm usage counter even it
failed. Forgetting to pm_runtime_put_noidle will result in
reference leak in two callers(tegra_slink_setup and
tegra_slink_resume), so we should fix it.

Fixes: dc4dc36056392 ("spi: tegra: add spi driver for SLINK controller")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Link: https://lore.kernel.org/r/20201103141345.6188-1-zhangqilong3@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-tegra20-slink.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/spi/spi-tegra20-slink.c b/drivers/spi/spi-tegra20-slink.c
index 374a2a32edcd3..2a1905c43a0b7 100644
--- a/drivers/spi/spi-tegra20-slink.c
+++ b/drivers/spi/spi-tegra20-slink.c
@@ -756,6 +756,7 @@ static int tegra_slink_setup(struct spi_device *spi)
 
 	ret = pm_runtime_get_sync(tspi->dev);
 	if (ret < 0) {
+		pm_runtime_put_noidle(tspi->dev);
 		dev_err(tspi->dev, "pm runtime failed, e = %d\n", ret);
 		return ret;
 	}
@@ -1192,6 +1193,7 @@ static int tegra_slink_resume(struct device *dev)
 
 	ret = pm_runtime_get_sync(dev);
 	if (ret < 0) {
+		pm_runtime_put_noidle(dev);
 		dev_err(dev, "pm runtime failed, e = %d\n", ret);
 		return ret;
 	}
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 117/453] spi: tegra20-sflash: fix reference leak in tegra_sflash_resume
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (115 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.4 116/453] spi: tegra20-slink: fix reference leak in slink ops of tegra20 Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.4 118/453] spi: tegra114: fix reference leak in tegra spi ops Greg Kroah-Hartman
                   ` (338 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Zhang Qilong, Mark Brown, Sasha Levin

From: Zhang Qilong <zhangqilong3@huawei.com>

[ Upstream commit 3482e797ab688da6703fe18d8bad52f94199f4f2 ]

pm_runtime_get_sync will increment pm usage counter even it
failed. Forgetting to pm_runtime_put_noidle will result in
reference leak in tegra_sflash_resume, so we should fix it.

Fixes: 8528547bcc336 ("spi: tegra: add spi driver for sflash controller")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Link: https://lore.kernel.org/r/20201103141323.5841-1-zhangqilong3@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-tegra20-sflash.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/spi/spi-tegra20-sflash.c b/drivers/spi/spi-tegra20-sflash.c
index a841a7250d14b..ecb620169753a 100644
--- a/drivers/spi/spi-tegra20-sflash.c
+++ b/drivers/spi/spi-tegra20-sflash.c
@@ -551,6 +551,7 @@ static int tegra_sflash_resume(struct device *dev)
 
 	ret = pm_runtime_get_sync(dev);
 	if (ret < 0) {
+		pm_runtime_put_noidle(dev);
 		dev_err(dev, "pm runtime failed, e = %d\n", ret);
 		return ret;
 	}
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 118/453] spi: tegra114: fix reference leak in tegra spi ops
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (116 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.4 117/453] spi: tegra20-sflash: fix reference leak in tegra_sflash_resume Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.4 119/453] spi: bcm63xx-hsspi: fix missing clk_disable_unprepare() on error in bcm63xx_hsspi_resume Greg Kroah-Hartman
                   ` (337 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Zhang Qilong, Mark Brown, Sasha Levin

From: Zhang Qilong <zhangqilong3@huawei.com>

[ Upstream commit a042184c7fb99961ea083d4ec192614bec671969 ]

pm_runtime_get_sync will increment pm usage counter even it
failed. Forgetting to pm_runtime_put_noidle will result in
reference leak in two callers(tegra_spi_setup and
tegra_spi_resume), so we should fix it.

Fixes: f333a331adfac ("spi/tegra114: add spi driver")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Link: https://lore.kernel.org/r/20201103141306.5607-1-zhangqilong3@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-tegra114.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/spi/spi-tegra114.c b/drivers/spi/spi-tegra114.c
index 39374c2edcf3b..594905bf89aa8 100644
--- a/drivers/spi/spi-tegra114.c
+++ b/drivers/spi/spi-tegra114.c
@@ -954,6 +954,7 @@ static int tegra_spi_setup(struct spi_device *spi)
 
 	ret = pm_runtime_get_sync(tspi->dev);
 	if (ret < 0) {
+		pm_runtime_put_noidle(tspi->dev);
 		dev_err(tspi->dev, "pm runtime failed, e = %d\n", ret);
 		if (cdata)
 			tegra_spi_cleanup(spi);
@@ -1472,6 +1473,7 @@ static int tegra_spi_resume(struct device *dev)
 
 	ret = pm_runtime_get_sync(dev);
 	if (ret < 0) {
+		pm_runtime_put_noidle(dev);
 		dev_err(dev, "pm runtime failed, e = %d\n", ret);
 		return ret;
 	}
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 119/453] spi: bcm63xx-hsspi: fix missing clk_disable_unprepare() on error in bcm63xx_hsspi_resume
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (117 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.4 118/453] spi: tegra114: fix reference leak in tegra spi ops Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.4 120/453] mwifiex: fix mwifiex_shutdown_sw() causing sw reset failure Greg Kroah-Hartman
                   ` (336 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Qinglang Miao, Mark Brown, Sasha Levin

From: Qinglang Miao <miaoqinglang@huawei.com>

[ Upstream commit 9bb9ef2b3e5d9d012876e7e2d7757eb30e865bee ]

Fix the missing clk_disable_unprepare() before return
from bcm63xx_hsspi_resume in the error handling case when
fails to prepare and enable bs->pll_clk.

Fixes: 0fd85869c2a9 ("spi/bcm63xx-hsspi: keep pll clk enabled")
Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
Link: https://lore.kernel.org/r/20201103074911.195530-1-miaoqinglang@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-bcm63xx-hsspi.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/spi/spi-bcm63xx-hsspi.c b/drivers/spi/spi-bcm63xx-hsspi.c
index 36f7eb8ab2df1..509476a2d79bb 100644
--- a/drivers/spi/spi-bcm63xx-hsspi.c
+++ b/drivers/spi/spi-bcm63xx-hsspi.c
@@ -483,8 +483,10 @@ static int bcm63xx_hsspi_resume(struct device *dev)
 
 	if (bs->pll_clk) {
 		ret = clk_prepare_enable(bs->pll_clk);
-		if (ret)
+		if (ret) {
+			clk_disable_unprepare(bs->clk);
 			return ret;
+		}
 	}
 
 	spi_master_resume(master);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 120/453] mwifiex: fix mwifiex_shutdown_sw() causing sw reset failure
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (118 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.4 119/453] spi: bcm63xx-hsspi: fix missing clk_disable_unprepare() on error in bcm63xx_hsspi_resume Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.4 121/453] selftest/bpf: Add missed ip6ip6 test back Greg Kroah-Hartman
                   ` (335 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Tsuchiya Yuto, Kalle Valo, Sasha Levin

From: Tsuchiya Yuto <kitakar@gmail.com>

[ Upstream commit fa74cb1dc0f4da46c441b735ca865ac52de42c0e ]

When a PCIe function level reset (FLR) is performed but without fw reset for
some reasons (e.g., on Microsoft Surface devices, fw reset requires other
quirks), it fails to reset wifi properly. You can trigger the issue on such
devices via debugfs entry for reset:

    $ echo 1 | sudo tee /sys/kernel/debug/mwifiex/mlan0/reset

and the resulting dmesg log:

    [   45.740508] mwifiex_pcie 0000:03:00.0: Resetting per request
    [   45.742937] mwifiex_pcie 0000:03:00.0: info: successfully disconnected from [BSSID]: reason code 3
    [   45.744666] mwifiex_pcie 0000:03:00.0: info: shutdown mwifiex...
    [   45.751530] mwifiex_pcie 0000:03:00.0: PREP_CMD: card is removed
    [   45.751539] mwifiex_pcie 0000:03:00.0: PREP_CMD: card is removed
    [   45.771691] mwifiex_pcie 0000:03:00.0: PREP_CMD: card is removed
    [   45.771695] mwifiex_pcie 0000:03:00.0: deleting the crypto keys
    [   45.771697] mwifiex_pcie 0000:03:00.0: PREP_CMD: card is removed
    [   45.771698] mwifiex_pcie 0000:03:00.0: deleting the crypto keys
    [   45.771699] mwifiex_pcie 0000:03:00.0: PREP_CMD: card is removed
    [   45.771701] mwifiex_pcie 0000:03:00.0: deleting the crypto keys
    [   45.771702] mwifiex_pcie 0000:03:00.0: PREP_CMD: card is removed
    [   45.771703] mwifiex_pcie 0000:03:00.0: deleting the crypto keys
    [   45.771704] mwifiex_pcie 0000:03:00.0: PREP_CMD: card is removed
    [   45.771705] mwifiex_pcie 0000:03:00.0: deleting the crypto keys
    [   45.771707] mwifiex_pcie 0000:03:00.0: PREP_CMD: card is removed
    [   45.771708] mwifiex_pcie 0000:03:00.0: deleting the crypto keys
    [   53.099343] mwifiex_pcie 0000:03:00.0: info: trying to associate to '[SSID]' bssid [BSSID]
    [   53.241870] mwifiex_pcie 0000:03:00.0: info: associated to bssid [BSSID] successfully
    [   75.377942] mwifiex_pcie 0000:03:00.0: cmd_wait_q terminated: -110
    [   85.385491] mwifiex_pcie 0000:03:00.0: info: successfully disconnected from [BSSID]: reason code 15
    [   87.539408] mwifiex_pcie 0000:03:00.0: cmd_wait_q terminated: -110
    [   87.539412] mwifiex_pcie 0000:03:00.0: deleting the crypto keys
    [   99.699917] mwifiex_pcie 0000:03:00.0: cmd_wait_q terminated: -110
    [   99.699925] mwifiex_pcie 0000:03:00.0: deleting the crypto keys
    [  111.859802] mwifiex_pcie 0000:03:00.0: cmd_wait_q terminated: -110
    [  111.859808] mwifiex_pcie 0000:03:00.0: deleting the crypto keys
    [...]

When comparing mwifiex_shutdown_sw() with mwifiex_pcie_remove(), it
lacks mwifiex_init_shutdown_fw().

This commit fixes mwifiex_shutdown_sw() by adding the missing
mwifiex_init_shutdown_fw().

Fixes: 4c5dae59d2e9 ("mwifiex: add PCIe function level reset support")
Signed-off-by: Tsuchiya Yuto <kitakar@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20201028142110.18144-2-kitakar@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/marvell/mwifiex/main.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/wireless/marvell/mwifiex/main.c b/drivers/net/wireless/marvell/mwifiex/main.c
index d14e55e3c9dad..5894566ec4805 100644
--- a/drivers/net/wireless/marvell/mwifiex/main.c
+++ b/drivers/net/wireless/marvell/mwifiex/main.c
@@ -1469,6 +1469,8 @@ int mwifiex_shutdown_sw(struct mwifiex_adapter *adapter)
 	priv = mwifiex_get_priv(adapter, MWIFIEX_BSS_ROLE_ANY);
 	mwifiex_deauthenticate(priv, NULL);
 
+	mwifiex_init_shutdown_fw(priv, MWIFIEX_FUNC_SHUTDOWN);
+
 	mwifiex_uninit_sw(adapter);
 	adapter->is_up = false;
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 121/453] selftest/bpf: Add missed ip6ip6 test back
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (119 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.4 120/453] mwifiex: fix mwifiex_shutdown_sw() causing sw reset failure Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.4 122/453] ASoC: wm8998: Fix PM disable depth imbalance on error Greg Kroah-Hartman
                   ` (334 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hangbin Liu, Alexei Starovoitov, Sasha Levin

From: Hangbin Liu <liuhangbin@gmail.com>

[ Upstream commit 58cfa49c2ba7f815adccc27a775e7cf8a8f7f539 ]

In comment 173ca26e9b51 ("samples/bpf: add comprehensive ipip, ipip6,
ip6ip6 test") we added ip6ip6 test for bpf tunnel testing. But in commit
933a741e3b82 ("selftests/bpf: bpf tunnel test.") when we moved it to
the current folder, we didn't add it.

This patch add the ip6ip6 test back to bpf tunnel test. Update the ipip6's
topology for both IPv4 and IPv6 testing. Since iperf test is removed as
currect framework simplified it in purpose, I also removed unused tcp
checkings in test_tunnel_kern.c.

Fixes: 933a741e3b82 ("selftests/bpf: bpf tunnel test.")
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://lore.kernel.org/bpf/20201110015013.1570716-2-liuhangbin@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../selftests/bpf/progs/test_tunnel_kern.c    | 42 +++---------------
 tools/testing/selftests/bpf/test_tunnel.sh    | 43 +++++++++++++++++--
 2 files changed, 46 insertions(+), 39 deletions(-)

diff --git a/tools/testing/selftests/bpf/progs/test_tunnel_kern.c b/tools/testing/selftests/bpf/progs/test_tunnel_kern.c
index 504df69c83df4..0f98724120deb 100644
--- a/tools/testing/selftests/bpf/progs/test_tunnel_kern.c
+++ b/tools/testing/selftests/bpf/progs/test_tunnel_kern.c
@@ -15,7 +15,6 @@
 #include <linux/ip.h>
 #include <linux/ipv6.h>
 #include <linux/types.h>
-#include <linux/tcp.h>
 #include <linux/socket.h>
 #include <linux/pkt_cls.h>
 #include <linux/erspan.h>
@@ -528,12 +527,11 @@ int _ipip_set_tunnel(struct __sk_buff *skb)
 	struct bpf_tunnel_key key = {};
 	void *data = (void *)(long)skb->data;
 	struct iphdr *iph = data;
-	struct tcphdr *tcp = data + sizeof(*iph);
 	void *data_end = (void *)(long)skb->data_end;
 	int ret;
 
 	/* single length check */
-	if (data + sizeof(*iph) + sizeof(*tcp) > data_end) {
+	if (data + sizeof(*iph) > data_end) {
 		ERROR(1);
 		return TC_ACT_SHOT;
 	}
@@ -541,16 +539,6 @@ int _ipip_set_tunnel(struct __sk_buff *skb)
 	key.tunnel_ttl = 64;
 	if (iph->protocol == IPPROTO_ICMP) {
 		key.remote_ipv4 = 0xac100164; /* 172.16.1.100 */
-	} else {
-		if (iph->protocol != IPPROTO_TCP || iph->ihl != 5)
-			return TC_ACT_SHOT;
-
-		if (tcp->dest == bpf_htons(5200))
-			key.remote_ipv4 = 0xac100164; /* 172.16.1.100 */
-		else if (tcp->dest == bpf_htons(5201))
-			key.remote_ipv4 = 0xac100165; /* 172.16.1.101 */
-		else
-			return TC_ACT_SHOT;
 	}
 
 	ret = bpf_skb_set_tunnel_key(skb, &key, sizeof(key), 0);
@@ -585,19 +573,20 @@ int _ipip6_set_tunnel(struct __sk_buff *skb)
 	struct bpf_tunnel_key key = {};
 	void *data = (void *)(long)skb->data;
 	struct iphdr *iph = data;
-	struct tcphdr *tcp = data + sizeof(*iph);
 	void *data_end = (void *)(long)skb->data_end;
 	int ret;
 
 	/* single length check */
-	if (data + sizeof(*iph) + sizeof(*tcp) > data_end) {
+	if (data + sizeof(*iph) > data_end) {
 		ERROR(1);
 		return TC_ACT_SHOT;
 	}
 
 	__builtin_memset(&key, 0x0, sizeof(key));
-	key.remote_ipv6[3] = bpf_htonl(0x11); /* ::11 */
 	key.tunnel_ttl = 64;
+	if (iph->protocol == IPPROTO_ICMP) {
+		key.remote_ipv6[3] = bpf_htonl(0x11); /* ::11 */
+	}
 
 	ret = bpf_skb_set_tunnel_key(skb, &key, sizeof(key),
 				     BPF_F_TUNINFO_IPV6);
@@ -634,35 +623,18 @@ int _ip6ip6_set_tunnel(struct __sk_buff *skb)
 	struct bpf_tunnel_key key = {};
 	void *data = (void *)(long)skb->data;
 	struct ipv6hdr *iph = data;
-	struct tcphdr *tcp = data + sizeof(*iph);
 	void *data_end = (void *)(long)skb->data_end;
 	int ret;
 
 	/* single length check */
-	if (data + sizeof(*iph) + sizeof(*tcp) > data_end) {
+	if (data + sizeof(*iph) > data_end) {
 		ERROR(1);
 		return TC_ACT_SHOT;
 	}
 
-	key.remote_ipv6[0] = bpf_htonl(0x2401db00);
 	key.tunnel_ttl = 64;
-
 	if (iph->nexthdr == 58 /* NEXTHDR_ICMP */) {
-		key.remote_ipv6[3] = bpf_htonl(1);
-	} else {
-		if (iph->nexthdr != 6 /* NEXTHDR_TCP */) {
-			ERROR(iph->nexthdr);
-			return TC_ACT_SHOT;
-		}
-
-		if (tcp->dest == bpf_htons(5200)) {
-			key.remote_ipv6[3] = bpf_htonl(1);
-		} else if (tcp->dest == bpf_htons(5201)) {
-			key.remote_ipv6[3] = bpf_htonl(2);
-		} else {
-			ERROR(tcp->dest);
-			return TC_ACT_SHOT;
-		}
+		key.remote_ipv6[3] = bpf_htonl(0x11); /* ::11 */
 	}
 
 	ret = bpf_skb_set_tunnel_key(skb, &key, sizeof(key),
diff --git a/tools/testing/selftests/bpf/test_tunnel.sh b/tools/testing/selftests/bpf/test_tunnel.sh
index bd12ec97a44df..1ccbe804e8e1c 100755
--- a/tools/testing/selftests/bpf/test_tunnel.sh
+++ b/tools/testing/selftests/bpf/test_tunnel.sh
@@ -24,12 +24,12 @@
 # Root namespace with metadata-mode tunnel + BPF
 # Device names and addresses:
 # 	veth1 IP: 172.16.1.200, IPv6: 00::22 (underlay)
-# 	tunnel dev <type>11, ex: gre11, IPv4: 10.1.1.200 (overlay)
+# 	tunnel dev <type>11, ex: gre11, IPv4: 10.1.1.200, IPv6: 1::22 (overlay)
 #
 # Namespace at_ns0 with native tunnel
 # Device names and addresses:
 # 	veth0 IPv4: 172.16.1.100, IPv6: 00::11 (underlay)
-# 	tunnel dev <type>00, ex: gre00, IPv4: 10.1.1.100 (overlay)
+# 	tunnel dev <type>00, ex: gre00, IPv4: 10.1.1.100, IPv6: 1::11 (overlay)
 #
 #
 # End-to-end ping packet flow
@@ -250,7 +250,7 @@ add_ipip_tunnel()
 	ip addr add dev $DEV 10.1.1.200/24
 }
 
-add_ipip6tnl_tunnel()
+add_ip6tnl_tunnel()
 {
 	ip netns exec at_ns0 ip addr add ::11/96 dev veth0
 	ip netns exec at_ns0 ip link set dev veth0 up
@@ -262,11 +262,13 @@ add_ipip6tnl_tunnel()
 		ip link add dev $DEV_NS type $TYPE \
 		local ::11 remote ::22
 	ip netns exec at_ns0 ip addr add dev $DEV_NS 10.1.1.100/24
+	ip netns exec at_ns0 ip addr add dev $DEV_NS 1::11/96
 	ip netns exec at_ns0 ip link set dev $DEV_NS up
 
 	# root namespace
 	ip link add dev $DEV type $TYPE external
 	ip addr add dev $DEV 10.1.1.200/24
+	ip addr add dev $DEV 1::22/96
 	ip link set dev $DEV up
 }
 
@@ -534,7 +536,7 @@ test_ipip6()
 
 	check $TYPE
 	config_device
-	add_ipip6tnl_tunnel
+	add_ip6tnl_tunnel
 	ip link set dev veth1 mtu 1500
 	attach_bpf $DEV ipip6_set_tunnel ipip6_get_tunnel
 	# underlay
@@ -553,6 +555,34 @@ test_ipip6()
         echo -e ${GREEN}"PASS: $TYPE"${NC}
 }
 
+test_ip6ip6()
+{
+	TYPE=ip6tnl
+	DEV_NS=ip6ip6tnl00
+	DEV=ip6ip6tnl11
+	ret=0
+
+	check $TYPE
+	config_device
+	add_ip6tnl_tunnel
+	ip link set dev veth1 mtu 1500
+	attach_bpf $DEV ip6ip6_set_tunnel ip6ip6_get_tunnel
+	# underlay
+	ping6 $PING_ARG ::11
+	# ip6 over ip6
+	ping6 $PING_ARG 1::11
+	check_err $?
+	ip netns exec at_ns0 ping6 $PING_ARG 1::22
+	check_err $?
+	cleanup
+
+	if [ $ret -ne 0 ]; then
+                echo -e ${RED}"FAIL: ip6$TYPE"${NC}
+                return 1
+        fi
+        echo -e ${GREEN}"PASS: ip6$TYPE"${NC}
+}
+
 setup_xfrm_tunnel()
 {
 	auth=0x$(printf '1%.0s' {1..40})
@@ -646,6 +676,7 @@ cleanup()
 	ip link del veth1 2> /dev/null
 	ip link del ipip11 2> /dev/null
 	ip link del ipip6tnl11 2> /dev/null
+	ip link del ip6ip6tnl11 2> /dev/null
 	ip link del gretap11 2> /dev/null
 	ip link del ip6gre11 2> /dev/null
 	ip link del ip6gretap11 2> /dev/null
@@ -742,6 +773,10 @@ bpf_tunnel_test()
 	test_ipip6
 	errors=$(( $errors + $? ))
 
+	echo "Testing IP6IP6 tunnel..."
+	test_ip6ip6
+	errors=$(( $errors + $? ))
+
 	echo "Testing IPSec tunnel..."
 	test_xfrm_tunnel
 	errors=$(( $errors + $? ))
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 122/453] ASoC: wm8998: Fix PM disable depth imbalance on error
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (120 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.4 121/453] selftest/bpf: Add missed ip6ip6 test back Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:45 ` [PATCH 5.4 123/453] spi: sprd: fix reference leak in sprd_spi_remove Greg Kroah-Hartman
                   ` (333 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Zhang Qilong, Richard Fitzgerald,
	Mark Brown, Sasha Levin

From: Zhang Qilong <zhangqilong3@huawei.com>

[ Upstream commit 193aa0a043645220d2a2f783ba06ae13d4601078 ]

The pm_runtime_enable will increase power disable depth. Thus
a pairing decrement is needed on the error handling path to
keep it balanced according to context.

Fixes: 31833ead95c2c ("ASoC: arizona: Move request of speaker IRQs into bus probe")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Reviewed-by: Richard Fitzgerald <rf@opensource.cirrus.com>
Link: https://lore.kernel.org/r/20201111041326.1257558-4-zhangqilong3@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/codecs/wm8998.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/sound/soc/codecs/wm8998.c b/sound/soc/codecs/wm8998.c
index 7c18992195733..817ccddd63448 100644
--- a/sound/soc/codecs/wm8998.c
+++ b/sound/soc/codecs/wm8998.c
@@ -1375,7 +1375,7 @@ static int wm8998_probe(struct platform_device *pdev)
 
 	ret = arizona_init_spk_irqs(arizona);
 	if (ret < 0)
-		return ret;
+		goto err_pm_disable;
 
 	ret = devm_snd_soc_register_component(&pdev->dev,
 					      &soc_component_dev_wm8998,
@@ -1390,6 +1390,8 @@ static int wm8998_probe(struct platform_device *pdev)
 
 err_spk_irqs:
 	arizona_free_spk_irqs(arizona);
+err_pm_disable:
+	pm_runtime_disable(&pdev->dev);
 
 	return ret;
 }
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 123/453] spi: sprd: fix reference leak in sprd_spi_remove
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (121 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.4 122/453] ASoC: wm8998: Fix PM disable depth imbalance on error Greg Kroah-Hartman
@ 2020-12-28 12:45 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.4 124/453] net: evaluate net.ipvX.conf.all.ignore_routes_with_linkdown Greg Kroah-Hartman
                   ` (332 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Zhang Qilong, Chunyan Zhang,
	Mark Brown, Sasha Levin

From: Zhang Qilong <zhangqilong3@huawei.com>

[ Upstream commit e4062765bc2a41e025e29dd56bad798505036427 ]

pm_runtime_get_sync will increment pm usage counter even it
failed. Forgetting to pm_runtime_put_noidle will result in
reference leak in sprd_spi_remove, so we should fix it.

Fixes: e7d973a31c24b ("spi: sprd: Add SPI driver for Spreadtrum SC9860")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Acked-by: Chunyan Zhang <zhang.lyra@gmail.com>
Link: https://lore.kernel.org/r/20201106015035.139574-1-zhangqilong3@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-sprd.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/spi/spi-sprd.c b/drivers/spi/spi-sprd.c
index e60aff9903951..c2bdf19ccdd26 100644
--- a/drivers/spi/spi-sprd.c
+++ b/drivers/spi/spi-sprd.c
@@ -1008,6 +1008,7 @@ static int sprd_spi_remove(struct platform_device *pdev)
 
 	ret = pm_runtime_get_sync(ss->dev);
 	if (ret < 0) {
+		pm_runtime_put_noidle(ss->dev);
 		dev_err(ss->dev, "failed to resume SPI controller\n");
 		return ret;
 	}
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 124/453] net: evaluate net.ipvX.conf.all.ignore_routes_with_linkdown
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (122 preceding siblings ...)
  2020-12-28 12:45 ` [PATCH 5.4 123/453] spi: sprd: fix reference leak in sprd_spi_remove Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.4 125/453] net: evaluate net.ipv4.conf.all.proxy_arp_pvlan Greg Kroah-Hartman
                   ` (331 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Vincent Bernat, Jakub Kicinski, Sasha Levin

From: Vincent Bernat <vincent@bernat.ch>

[ Upstream commit c0c5a60f0f1311bcf08bbe735122096d6326fb5b ]

Introduced in 0eeb075fad73, the "ignore_routes_with_linkdown" sysctl
ignores a route whose interface is down. It is provided as a
per-interface sysctl. However, while a "all" variant is exposed, it
was a noop since it was never evaluated. We use the usual "or" logic
for this kind of sysctls.

Tested with:

    ip link add type veth # veth0 + veth1
    ip link add type veth # veth1 + veth2
    ip link set up dev veth0
    ip link set up dev veth1 # link-status paired with veth0
    ip link set up dev veth2
    ip link set up dev veth3 # link-status paired with veth2

    # First available path
    ip -4 addr add 203.0.113.${uts#H}/24 dev veth0
    ip -6 addr add 2001:db8:1::${uts#H}/64 dev veth0

    # Second available path
    ip -4 addr add 192.0.2.${uts#H}/24 dev veth2
    ip -6 addr add 2001:db8:2::${uts#H}/64 dev veth2

    # More specific route through first path
    ip -4 route add 198.51.100.0/25 via 203.0.113.254 # via veth0
    ip -6 route add 2001:db8:3::/56 via 2001:db8:1::ff # via veth0

    # Less specific route through second path
    ip -4 route add 198.51.100.0/24 via 192.0.2.254 # via veth2
    ip -6 route add 2001:db8:3::/48 via 2001:db8:2::ff # via veth2

    # H1: enable on "all"
    # H2: enable on "veth0"
    for v in ipv4 ipv6; do
      case $uts in
        H1)
          sysctl -qw net.${v}.conf.all.ignore_routes_with_linkdown=1
          ;;
        H2)
          sysctl -qw net.${v}.conf.veth0.ignore_routes_with_linkdown=1
          ;;
      esac
    done

    set -xe
    # When veth0 is up, best route is through veth0
    ip -o route get 198.51.100.1 | grep -Fw veth0
    ip -o route get 2001:db8:3::1 | grep -Fw veth0

    # When veth0 is down, best route should be through veth2 on H1/H2,
    # but on veth0 on H2
    ip link set down dev veth1 # down veth0
    ip route show
    [ $uts != H3 ] || ip -o route get 198.51.100.1 | grep -Fw veth0
    [ $uts != H3 ] || ip -o route get 2001:db8:3::1 | grep -Fw veth0
    [ $uts = H3 ] || ip -o route get 198.51.100.1 | grep -Fw veth2
    [ $uts = H3 ] || ip -o route get 2001:db8:3::1 | grep -Fw veth2

Without this patch, the two last lines would fail on H1 (the one using
the "all" sysctl). With the patch, everything succeeds as expected.

Also document the sysctl in `ip-sysctl.rst`.

Fixes: 0eeb075fad73 ("net: ipv4 sysctl option to ignore routes when nexthop link is down")
Signed-off-by: Vincent Bernat <vincent@bernat.ch>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 Documentation/networking/ip-sysctl.txt | 3 +++
 include/linux/inetdevice.h             | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
index 8af3771a3ebf2..784988bab7181 100644
--- a/Documentation/networking/ip-sysctl.txt
+++ b/Documentation/networking/ip-sysctl.txt
@@ -1366,6 +1366,9 @@ igmpv3_unsolicited_report_interval - INTEGER
 	IGMPv3 report retransmit will take place.
 	Default: 1000 (1 seconds)
 
+ignore_routes_with_linkdown - BOOLEAN
+        Ignore routes whose link is down when performing a FIB lookup.
+
 promote_secondaries - BOOLEAN
 	When a primary IP address is removed from this interface
 	promote a corresponding secondary IP address instead of
diff --git a/include/linux/inetdevice.h b/include/linux/inetdevice.h
index 3515ca64e638a..3bbcddd22df8c 100644
--- a/include/linux/inetdevice.h
+++ b/include/linux/inetdevice.h
@@ -126,7 +126,7 @@ static inline void ipv4_devconf_setall(struct in_device *in_dev)
 	  IN_DEV_ORCONF((in_dev), ACCEPT_REDIRECTS)))
 
 #define IN_DEV_IGNORE_ROUTES_WITH_LINKDOWN(in_dev) \
-	IN_DEV_CONF_GET((in_dev), IGNORE_ROUTES_WITH_LINKDOWN)
+	IN_DEV_ORCONF((in_dev), IGNORE_ROUTES_WITH_LINKDOWN)
 
 #define IN_DEV_ARPFILTER(in_dev)	IN_DEV_ORCONF((in_dev), ARPFILTER)
 #define IN_DEV_ARP_ACCEPT(in_dev)	IN_DEV_ORCONF((in_dev), ARP_ACCEPT)
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 125/453] net: evaluate net.ipv4.conf.all.proxy_arp_pvlan
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (123 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.4 124/453] net: evaluate net.ipvX.conf.all.ignore_routes_with_linkdown Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.4 126/453] ASoC: arizona: Fix a wrong free in wm8997_probe Greg Kroah-Hartman
                   ` (330 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Vincent Bernat, Jakub Kicinski, Sasha Levin

From: Vincent Bernat <vincent@bernat.ch>

[ Upstream commit 1af5318c00a8acc33a90537af49b3f23f72a2c4b ]

Introduced in 65324144b50b, the "proxy_arp_vlan" sysctl is a
per-interface sysctl to tune proxy ARP support for private VLANs.
While the "all" variant is exposed, it was a noop and never evaluated.
We use the usual "or" logic for this kind of sysctls.

Fixes: 65324144b50b ("net: RFC3069, private VLAN proxy arp support")
Signed-off-by: Vincent Bernat <vincent@bernat.ch>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/inetdevice.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/linux/inetdevice.h b/include/linux/inetdevice.h
index 3bbcddd22df8c..53aa0343bf694 100644
--- a/include/linux/inetdevice.h
+++ b/include/linux/inetdevice.h
@@ -105,7 +105,7 @@ static inline void ipv4_devconf_setall(struct in_device *in_dev)
 
 #define IN_DEV_LOG_MARTIANS(in_dev)	IN_DEV_ORCONF((in_dev), LOG_MARTIANS)
 #define IN_DEV_PROXY_ARP(in_dev)	IN_DEV_ORCONF((in_dev), PROXY_ARP)
-#define IN_DEV_PROXY_ARP_PVLAN(in_dev)	IN_DEV_CONF_GET(in_dev, PROXY_ARP_PVLAN)
+#define IN_DEV_PROXY_ARP_PVLAN(in_dev)	IN_DEV_ORCONF((in_dev), PROXY_ARP_PVLAN)
 #define IN_DEV_SHARED_MEDIA(in_dev)	IN_DEV_ORCONF((in_dev), SHARED_MEDIA)
 #define IN_DEV_TX_REDIRECTS(in_dev)	IN_DEV_ORCONF((in_dev), SEND_REDIRECTS)
 #define IN_DEV_SEC_REDIRECTS(in_dev)	IN_DEV_ORCONF((in_dev), \
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 126/453] ASoC: arizona: Fix a wrong free in wm8997_probe
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (124 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.4 125/453] net: evaluate net.ipv4.conf.all.proxy_arp_pvlan Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.4 127/453] RDMa/mthca: Work around -Wenum-conversion warning Greg Kroah-Hartman
                   ` (329 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Richard Fitzgerald, Zhang Qilong,
	Mark Brown, Sasha Levin

From: Zhang Qilong <zhangqilong3@huawei.com>

[ Upstream commit 5e7aace13df24ff72511f29c14ebbfe638ef733c ]

In the normal path, we should not free the arizona,
we should return immediately. It will be free when
call remove operation.

Fixes: 31833ead95c2c ("ASoC: arizona: Move request of speaker IRQs into bus probe")
Reported-by: Richard Fitzgerald <rf@opensource.cirrus.com>
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Acked-by: Richard Fitzgerald <rf@opensource.cirrus.com>
Link: https://lore.kernel.org/r/20201111130923.220186-2-zhangqilong3@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/codecs/wm8997.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/sound/soc/codecs/wm8997.c b/sound/soc/codecs/wm8997.c
index 37e4bb3dbd8a9..229f2986cd96b 100644
--- a/sound/soc/codecs/wm8997.c
+++ b/sound/soc/codecs/wm8997.c
@@ -1177,6 +1177,8 @@ static int wm8997_probe(struct platform_device *pdev)
 		goto err_spk_irqs;
 	}
 
+	return ret;
+
 err_spk_irqs:
 	arizona_free_spk_irqs(arizona);
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 127/453] RDMa/mthca: Work around -Wenum-conversion warning
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (125 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.4 126/453] ASoC: arizona: Fix a wrong free in wm8997_probe Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.4 128/453] MIPS: BCM47XX: fix kconfig dependency bug for BCM47XX_BCMA Greg Kroah-Hartman
                   ` (328 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Arnd Bergmann, Jason Gunthorpe, Sasha Levin

From: Arnd Bergmann <arnd@arndb.de>

[ Upstream commit fbb7dc5db6dee553b5a07c27e86364a5223e244c ]

gcc points out a suspicious mixing of enum types in a function that
converts from MTHCA_OPCODE_* values to IB_WC_* values:

drivers/infiniband/hw/mthca/mthca_cq.c: In function 'mthca_poll_one':
drivers/infiniband/hw/mthca/mthca_cq.c:607:21: warning: implicit conversion from 'enum <anonymous>' to 'enum ib_wc_opcode' [-Wenum-conversion]
  607 |    entry->opcode    = MTHCA_OPCODE_INVALID;

Nothing seems to ever check for MTHCA_OPCODE_INVALID again, no idea if
this is meaningful, but it seems harmless as it deals with an invalid
input.

Remove MTHCA_OPCODE_INVALID and set the ib_wc_opcode to 0xFF, which is
still bogus, but at least doesn't make compiler warnings.

Fixes: 2a4443a69934 ("[PATCH] IB/mthca: fill in opcode field for send completions")
Link: https://lore.kernel.org/r/20201026211311.3887003-1-arnd@kernel.org
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/hw/mthca/mthca_cq.c  | 2 +-
 drivers/infiniband/hw/mthca/mthca_dev.h | 1 -
 2 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/infiniband/hw/mthca/mthca_cq.c b/drivers/infiniband/hw/mthca/mthca_cq.c
index 119b2573c9a08..26c3408dcacae 100644
--- a/drivers/infiniband/hw/mthca/mthca_cq.c
+++ b/drivers/infiniband/hw/mthca/mthca_cq.c
@@ -604,7 +604,7 @@ static inline int mthca_poll_one(struct mthca_dev *dev,
 			entry->byte_len  = MTHCA_ATOMIC_BYTE_LEN;
 			break;
 		default:
-			entry->opcode    = MTHCA_OPCODE_INVALID;
+			entry->opcode = 0xFF;
 			break;
 		}
 	} else {
diff --git a/drivers/infiniband/hw/mthca/mthca_dev.h b/drivers/infiniband/hw/mthca/mthca_dev.h
index bfd4eebc1182f..58d46449b0e86 100644
--- a/drivers/infiniband/hw/mthca/mthca_dev.h
+++ b/drivers/infiniband/hw/mthca/mthca_dev.h
@@ -105,7 +105,6 @@ enum {
 	MTHCA_OPCODE_ATOMIC_CS      = 0x11,
 	MTHCA_OPCODE_ATOMIC_FA      = 0x12,
 	MTHCA_OPCODE_BIND_MW        = 0x18,
-	MTHCA_OPCODE_INVALID        = 0xff
 };
 
 enum {
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 128/453] MIPS: BCM47XX: fix kconfig dependency bug for BCM47XX_BCMA
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (126 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.4 127/453] RDMa/mthca: Work around -Wenum-conversion warning Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.4 129/453] crypto: qat - fix status check in qat_hal_put_rel_rd_xfer() Greg Kroah-Hartman
                   ` (327 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Necip Fazil Yildiran,
	Thomas Bogendoerfer, Sasha Levin

From: Necip Fazil Yildiran <fazilyildiran@gmail.com>

[ Upstream commit 3a5fe2fb9635c43359c9729352f45044f3c8df6b ]

When BCM47XX_BCMA is enabled and BCMA_DRIVER_PCI is disabled, it results
in the following Kbuild warning:

WARNING: unmet direct dependencies detected for BCMA_DRIVER_PCI_HOSTMODE
  Depends on [n]: MIPS [=y] && BCMA_DRIVER_PCI [=n] && PCI_DRIVERS_LEGACY [=y] && BCMA [=y]=y
  Selected by [y]:
  - BCM47XX_BCMA [=y] && BCM47XX [=y] && PCI [=y]

The reason is that BCM47XX_BCMA selects BCMA_DRIVER_PCI_HOSTMODE without
depending on or selecting BCMA_DRIVER_PCI while BCMA_DRIVER_PCI_HOSTMODE
depends on BCMA_DRIVER_PCI. This can also fail building the kernel.

Honor the kconfig dependency to remove unmet direct dependency warnings
and avoid any potential build failures.

Fixes: c1d1c5d4213e ("bcm47xx: add support for bcma bus")
Link: https://bugzilla.kernel.org/show_bug.cgi?id=209879
Signed-off-by: Necip Fazil Yildiran <fazilyildiran@gmail.com>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/mips/bcm47xx/Kconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/mips/bcm47xx/Kconfig b/arch/mips/bcm47xx/Kconfig
index 6889f74e06f54..490bb6da74b7e 100644
--- a/arch/mips/bcm47xx/Kconfig
+++ b/arch/mips/bcm47xx/Kconfig
@@ -27,6 +27,7 @@ config BCM47XX_BCMA
 	select BCMA
 	select BCMA_HOST_SOC
 	select BCMA_DRIVER_MIPS
+	select BCMA_DRIVER_PCI if PCI
 	select BCMA_DRIVER_PCI_HOSTMODE if PCI
 	select BCMA_DRIVER_GPIO
 	default y
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 129/453] crypto: qat - fix status check in qat_hal_put_rel_rd_xfer()
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (127 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.4 128/453] MIPS: BCM47XX: fix kconfig dependency bug for BCM47XX_BCMA Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.4 130/453] staging: greybus: codecs: Fix reference counter leak in error handling Greg Kroah-Hartman
                   ` (326 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jack Xu, Giovanni Cabiddu,
	Fiona Trahe, Herbert Xu, Sasha Levin

From: Jack Xu <jack.xu@intel.com>

[ Upstream commit 3b5c130fb2e4c045369791c33c83b59f6e84f7d6 ]

The return value of qat_hal_rd_ae_csr() is always a CSR value and never
a status and should not be stored in the status variable of
qat_hal_put_rel_rd_xfer().

This removes the assignment as qat_hal_rd_ae_csr() is not expected to
fail.
A more comprehensive handling of the theoretical corner case which could
result in a fail will be submitted in a separate patch.

Fixes: 8c9478a400b7 ("crypto: qat - reduce stack size with KASAN")
Signed-off-by: Jack Xu <jack.xu@intel.com>
Reviewed-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Reviewed-by: Fiona Trahe <fiona.trahe@intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/qat/qat_common/qat_hal.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/crypto/qat/qat_common/qat_hal.c b/drivers/crypto/qat/qat_common/qat_hal.c
index ff149e176f649..dac130bb807ae 100644
--- a/drivers/crypto/qat/qat_common/qat_hal.c
+++ b/drivers/crypto/qat/qat_common/qat_hal.c
@@ -1189,7 +1189,7 @@ static int qat_hal_put_rel_rd_xfer(struct icp_qat_fw_loader_handle *handle,
 	unsigned short mask;
 	unsigned short dr_offset = 0x10;
 
-	status = ctx_enables = qat_hal_rd_ae_csr(handle, ae, CTX_ENABLES);
+	ctx_enables = qat_hal_rd_ae_csr(handle, ae, CTX_ENABLES);
 	if (CE_INUSE_CONTEXTS & ctx_enables) {
 		if (ctx & 0x1) {
 			pr_err("QAT: bad 4-ctx mode,ctx=0x%x\n", ctx);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 130/453] staging: greybus: codecs: Fix reference counter leak in error handling
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (128 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.4 129/453] crypto: qat - fix status check in qat_hal_put_rel_rd_xfer() Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.4 131/453] staging: gasket: interrupt: fix the missed eventfd_ctx_put() in gasket_interrupt.c Greg Kroah-Hartman
                   ` (325 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Zhang Qilong, Sasha Levin

From: Zhang Qilong <zhangqilong3@huawei.com>

[ Upstream commit 3952659a6108f77a0d062d8e8487bdbdaf52a66c ]

gb_pm_runtime_get_sync has increased the usage counter of the device here.
Forgetting to call gb_pm_runtime_put_noidle will result in usage counter
leak in the error branch of (gbcodec_hw_params and gbcodec_prepare). We
fixed it by adding it.

Fixes: c388ae7696992 ("greybus: audio: Update pm runtime support in dai_ops callback")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Link: https://lore.kernel.org/r/20201109131347.1725288-2-zhangqilong3@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/staging/greybus/audio_codec.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/staging/greybus/audio_codec.c b/drivers/staging/greybus/audio_codec.c
index 08746c85dea6d..3259bf02ba25e 100644
--- a/drivers/staging/greybus/audio_codec.c
+++ b/drivers/staging/greybus/audio_codec.c
@@ -489,6 +489,7 @@ static int gbcodec_hw_params(struct snd_pcm_substream *substream,
 	if (ret) {
 		dev_err_ratelimited(dai->dev, "%d: Error during set_config\n",
 				    ret);
+		gb_pm_runtime_put_noidle(bundle);
 		mutex_unlock(&codec->lock);
 		return ret;
 	}
@@ -565,6 +566,7 @@ static int gbcodec_prepare(struct snd_pcm_substream *substream,
 		break;
 	}
 	if (ret) {
+		gb_pm_runtime_put_noidle(bundle);
 		mutex_unlock(&codec->lock);
 		dev_err_ratelimited(dai->dev, "set_data_size failed:%d\n",
 				    ret);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 131/453] staging: gasket: interrupt: fix the missed eventfd_ctx_put() in gasket_interrupt.c
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (129 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.4 130/453] staging: greybus: codecs: Fix reference counter leak in error handling Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.4 132/453] media: tm6000: Fix sizeof() mismatches Greg Kroah-Hartman
                   ` (324 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jing Xiangfeng, Sasha Levin

From: Jing Xiangfeng <jingxiangfeng@huawei.com>

[ Upstream commit ab5b769a23af12a675b9f3d7dd529250c527f5ac ]

gasket_interrupt_set_eventfd() misses to call eventfd_ctx_put() in an
error path. We check interrupt is valid before calling
eventfd_ctx_fdget() to fix it.

There is the same issue in gasket_interrupt_clear_eventfd(), Add the
missed function call to fix it.

Fixes: 9a69f5087ccc ("drivers/staging: Gasket driver framework + Apex driver")
Signed-off-by: Jing Xiangfeng <jingxiangfeng@huawei.com>
Link: https://lore.kernel.org/r/20201112064924.99680-1-jingxiangfeng@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/staging/gasket/gasket_interrupt.c | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/drivers/staging/gasket/gasket_interrupt.c b/drivers/staging/gasket/gasket_interrupt.c
index 2d6195f7300e9..864342acfd86e 100644
--- a/drivers/staging/gasket/gasket_interrupt.c
+++ b/drivers/staging/gasket/gasket_interrupt.c
@@ -487,14 +487,16 @@ int gasket_interrupt_system_status(struct gasket_dev *gasket_dev)
 int gasket_interrupt_set_eventfd(struct gasket_interrupt_data *interrupt_data,
 				 int interrupt, int event_fd)
 {
-	struct eventfd_ctx *ctx = eventfd_ctx_fdget(event_fd);
-
-	if (IS_ERR(ctx))
-		return PTR_ERR(ctx);
+	struct eventfd_ctx *ctx;
 
 	if (interrupt < 0 || interrupt >= interrupt_data->num_interrupts)
 		return -EINVAL;
 
+	ctx = eventfd_ctx_fdget(event_fd);
+
+	if (IS_ERR(ctx))
+		return PTR_ERR(ctx);
+
 	interrupt_data->eventfd_ctxs[interrupt] = ctx;
 	return 0;
 }
@@ -505,6 +507,9 @@ int gasket_interrupt_clear_eventfd(struct gasket_interrupt_data *interrupt_data,
 	if (interrupt < 0 || interrupt >= interrupt_data->num_interrupts)
 		return -EINVAL;
 
-	interrupt_data->eventfd_ctxs[interrupt] = NULL;
+	if (interrupt_data->eventfd_ctxs[interrupt]) {
+		eventfd_ctx_put(interrupt_data->eventfd_ctxs[interrupt]);
+		interrupt_data->eventfd_ctxs[interrupt] = NULL;
+	}
 	return 0;
 }
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 132/453] media: tm6000: Fix sizeof() mismatches
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (130 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.4 131/453] staging: gasket: interrupt: fix the missed eventfd_ctx_put() in gasket_interrupt.c Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.4 133/453] media: mtk-vcodec: add missing put_device() call in mtk_vcodec_init_dec_pm() Greg Kroah-Hartman
                   ` (323 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Colin Ian King, Hans Verkuil,
	Mauro Carvalho Chehab, Sasha Levin

From: Colin Ian King <colin.king@canonical.com>

[ Upstream commit a08ad6339e0441ca12533969ed94a87e3655426e ]

The are two instances of sizeof() being used incorrectly. The
sizeof(void *) is incorrect because urb_buffer is a char ** pointer,
fix this by using sizeof(*dev->urb_buffer).  The sizeof(dma_addr_t *)
is incorrect, it should be sizeof(*dev->urb_dma), which is a dma_addr_t
and not a dma_addr_t *.  This errors did not cause any issues because
it just so happens the sizes are the same.

Addresses-Coverity: ("Sizeof not portable (SIZEOF_MISMATCH)")

Fixes: 16427faf2867 ("[media] tm6000: Add parameter to keep urb bufs allocated")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/usb/tm6000/tm6000-video.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/media/usb/tm6000/tm6000-video.c b/drivers/media/usb/tm6000/tm6000-video.c
index c07a81a6cbe29..c46cbcfafab3f 100644
--- a/drivers/media/usb/tm6000/tm6000-video.c
+++ b/drivers/media/usb/tm6000/tm6000-video.c
@@ -461,11 +461,12 @@ static int tm6000_alloc_urb_buffers(struct tm6000_core *dev)
 	if (dev->urb_buffer)
 		return 0;
 
-	dev->urb_buffer = kmalloc_array(num_bufs, sizeof(void *), GFP_KERNEL);
+	dev->urb_buffer = kmalloc_array(num_bufs, sizeof(*dev->urb_buffer),
+					GFP_KERNEL);
 	if (!dev->urb_buffer)
 		return -ENOMEM;
 
-	dev->urb_dma = kmalloc_array(num_bufs, sizeof(dma_addr_t *),
+	dev->urb_dma = kmalloc_array(num_bufs, sizeof(*dev->urb_dma),
 				     GFP_KERNEL);
 	if (!dev->urb_dma)
 		return -ENOMEM;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 133/453] media: mtk-vcodec: add missing put_device() call in mtk_vcodec_init_dec_pm()
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (131 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.4 132/453] media: tm6000: Fix sizeof() mismatches Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.4 134/453] media: mtk-vcodec: add missing put_device() call in mtk_vcodec_release_dec_pm() Greg Kroah-Hartman
                   ` (322 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yu Kuai, Hans Verkuil,
	Mauro Carvalho Chehab, Sasha Levin

From: Yu Kuai <yukuai3@huawei.com>

[ Upstream commit 5d4fa2c50125c9cda9e380d89268757cc5fa743d ]

if of_find_device_by_node() succeed, mtk_vcodec_init_dec_pm() doesn't have
a corresponding put_device(). Thus add jump target to fix the exception
handling for this function implementation.

Fixes: 590577a4e525 ("[media] vcodec: mediatek: Add Mediatek V4L2 Video Decoder Driver")
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../platform/mtk-vcodec/mtk_vcodec_dec_pm.c    | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/drivers/media/platform/mtk-vcodec/mtk_vcodec_dec_pm.c b/drivers/media/platform/mtk-vcodec/mtk_vcodec_dec_pm.c
index 5a6ec8fb52daa..01e680ede9bd5 100644
--- a/drivers/media/platform/mtk-vcodec/mtk_vcodec_dec_pm.c
+++ b/drivers/media/platform/mtk-vcodec/mtk_vcodec_dec_pm.c
@@ -48,11 +48,14 @@ int mtk_vcodec_init_dec_pm(struct mtk_vcodec_dev *mtkdev)
 		dec_clk->clk_info = devm_kcalloc(&pdev->dev,
 			dec_clk->clk_num, sizeof(*clk_info),
 			GFP_KERNEL);
-		if (!dec_clk->clk_info)
-			return -ENOMEM;
+		if (!dec_clk->clk_info) {
+			ret = -ENOMEM;
+			goto put_device;
+		}
 	} else {
 		mtk_v4l2_err("Failed to get vdec clock count");
-		return -EINVAL;
+		ret = -EINVAL;
+		goto put_device;
 	}
 
 	for (i = 0; i < dec_clk->clk_num; i++) {
@@ -61,19 +64,22 @@ int mtk_vcodec_init_dec_pm(struct mtk_vcodec_dev *mtkdev)
 			"clock-names", i, &clk_info->clk_name);
 		if (ret) {
 			mtk_v4l2_err("Failed to get clock name id = %d", i);
-			return ret;
+			goto put_device;
 		}
 		clk_info->vcodec_clk = devm_clk_get(&pdev->dev,
 			clk_info->clk_name);
 		if (IS_ERR(clk_info->vcodec_clk)) {
 			mtk_v4l2_err("devm_clk_get (%d)%s fail", i,
 				clk_info->clk_name);
-			return PTR_ERR(clk_info->vcodec_clk);
+			ret = PTR_ERR(clk_info->vcodec_clk);
+			goto put_device;
 		}
 	}
 
 	pm_runtime_enable(&pdev->dev);
-
+	return 0;
+put_device:
+	put_device(pm->larbvdec);
 	return ret;
 }
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 134/453] media: mtk-vcodec: add missing put_device() call in mtk_vcodec_release_dec_pm()
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (132 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.4 133/453] media: mtk-vcodec: add missing put_device() call in mtk_vcodec_init_dec_pm() Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.4 135/453] media: mtk-vcodec: add missing put_device() call in mtk_vcodec_init_enc_pm() Greg Kroah-Hartman
                   ` (321 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yu Kuai, Hans Verkuil,
	Mauro Carvalho Chehab, Sasha Levin

From: Yu Kuai <yukuai3@huawei.com>

[ Upstream commit 27c3943683f74e35e1d390ceb2e3639eff616ad6 ]

mtk_vcodec_release_dec_pm() will be called in two places:

a. mtk_vcodec_init_dec_pm() succeed while mtk_vcodec_probe() return error.
b. mtk_vcodec_dec_remove().

In both cases put_device() call is needed, since of_find_device_by_node()
was called in mtk_vcodec_init_dec_pm() previously.

Thus add put_devices() call in mtk_vcodec_release_dec_pm()

Fixes: 590577a4e525 ("[media] vcodec: mediatek: Add Mediatek V4L2 Video Decoder Driver")
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/mtk-vcodec/mtk_vcodec_dec_pm.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/media/platform/mtk-vcodec/mtk_vcodec_dec_pm.c b/drivers/media/platform/mtk-vcodec/mtk_vcodec_dec_pm.c
index 01e680ede9bd5..f9bbd0000bf3e 100644
--- a/drivers/media/platform/mtk-vcodec/mtk_vcodec_dec_pm.c
+++ b/drivers/media/platform/mtk-vcodec/mtk_vcodec_dec_pm.c
@@ -86,6 +86,7 @@ put_device:
 void mtk_vcodec_release_dec_pm(struct mtk_vcodec_dev *dev)
 {
 	pm_runtime_disable(dev->pm.dev);
+	put_device(dev->pm.larbvdec);
 }
 
 void mtk_vcodec_dec_pw_on(struct mtk_vcodec_pm *pm)
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 135/453] media: mtk-vcodec: add missing put_device() call in mtk_vcodec_init_enc_pm()
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (133 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.4 134/453] media: mtk-vcodec: add missing put_device() call in mtk_vcodec_release_dec_pm() Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.4 136/453] media: v4l2-fwnode: Return -EINVAL for invalid bus-type Greg Kroah-Hartman
                   ` (320 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yu Kuai, Hans Verkuil,
	Mauro Carvalho Chehab, Sasha Levin

From: Yu Kuai <yukuai3@huawei.com>

[ Upstream commit 4affafd7bec7c65da31777f18bd20420f1aeb5f8 ]

if of_find_device_by_node() succeed, mtk_vcodec_init_enc_pm() doesn't have
a corresponding put_device(). Thus add jump target to fix the exception
handling for this function implementation.

Fixes: 4e855a6efa54 ("[media] vcodec: mediatek: Add Mediatek V4L2 Video Encoder Driver")
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../platform/mtk-vcodec/mtk_vcodec_enc_pm.c   | 26 ++++++++++++++-----
 1 file changed, 19 insertions(+), 7 deletions(-)

diff --git a/drivers/media/platform/mtk-vcodec/mtk_vcodec_enc_pm.c b/drivers/media/platform/mtk-vcodec/mtk_vcodec_enc_pm.c
index 3e2bfded79a66..e682bdb1ed453 100644
--- a/drivers/media/platform/mtk-vcodec/mtk_vcodec_enc_pm.c
+++ b/drivers/media/platform/mtk-vcodec/mtk_vcodec_enc_pm.c
@@ -49,14 +49,16 @@ int mtk_vcodec_init_enc_pm(struct mtk_vcodec_dev *mtkdev)
 	node = of_parse_phandle(dev->of_node, "mediatek,larb", 1);
 	if (!node) {
 		mtk_v4l2_err("no mediatek,larb found");
-		return -ENODEV;
+		ret = -ENODEV;
+		goto put_larbvenc;
 	}
 
 	pdev = of_find_device_by_node(node);
 	of_node_put(node);
 	if (!pdev) {
 		mtk_v4l2_err("no mediatek,larb device found");
-		return -ENODEV;
+		ret = -ENODEV;
+		goto put_larbvenc;
 	}
 
 	pm->larbvenclt = &pdev->dev;
@@ -69,11 +71,14 @@ int mtk_vcodec_init_enc_pm(struct mtk_vcodec_dev *mtkdev)
 		enc_clk->clk_info = devm_kcalloc(&pdev->dev,
 			enc_clk->clk_num, sizeof(*clk_info),
 			GFP_KERNEL);
-		if (!enc_clk->clk_info)
-			return -ENOMEM;
+		if (!enc_clk->clk_info) {
+			ret = -ENOMEM;
+			goto put_larbvenclt;
+		}
 	} else {
 		mtk_v4l2_err("Failed to get venc clock count");
-		return -EINVAL;
+		ret = -EINVAL;
+		goto put_larbvenclt;
 	}
 
 	for (i = 0; i < enc_clk->clk_num; i++) {
@@ -82,17 +87,24 @@ int mtk_vcodec_init_enc_pm(struct mtk_vcodec_dev *mtkdev)
 			"clock-names", i, &clk_info->clk_name);
 		if (ret) {
 			mtk_v4l2_err("venc failed to get clk name %d", i);
-			return ret;
+			goto put_larbvenclt;
 		}
 		clk_info->vcodec_clk = devm_clk_get(&pdev->dev,
 			clk_info->clk_name);
 		if (IS_ERR(clk_info->vcodec_clk)) {
 			mtk_v4l2_err("venc devm_clk_get (%d)%s fail", i,
 				clk_info->clk_name);
-			return PTR_ERR(clk_info->vcodec_clk);
+			ret = PTR_ERR(clk_info->vcodec_clk);
+			goto put_larbvenclt;
 		}
 	}
 
+	return 0;
+
+put_larbvenclt:
+	put_device(pm->larbvenclt);
+put_larbvenc:
+	put_device(pm->larbvenc);
 	return ret;
 }
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 136/453] media: v4l2-fwnode: Return -EINVAL for invalid bus-type
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (134 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.4 135/453] media: mtk-vcodec: add missing put_device() call in mtk_vcodec_init_enc_pm() Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.4 137/453] ASoC: meson: fix COMPILE_TEST error Greg Kroah-Hartman
                   ` (319 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lad Prabhakar, Sakari Ailus,
	Mauro Carvalho Chehab, Sasha Levin

From: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>

[ Upstream commit 69baf338fc16a4d55c78da8874ce3f06feb38c78 ]

Return -EINVAL if invalid bus-type is detected while parsing endpoints.

Fixes: 26c1126c9b56 ("media: v4l: fwnode: Use media bus type for bus parser selection")
Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/v4l2-core/v4l2-fwnode.c | 6 +++++-
 include/media/v4l2-mediabus.h         | 2 ++
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/drivers/media/v4l2-core/v4l2-fwnode.c b/drivers/media/v4l2-core/v4l2-fwnode.c
index 3bd1888787eb3..48c3b9f72722a 100644
--- a/drivers/media/v4l2-core/v4l2-fwnode.c
+++ b/drivers/media/v4l2-core/v4l2-fwnode.c
@@ -93,7 +93,7 @@ v4l2_fwnode_bus_type_to_mbus(enum v4l2_fwnode_bus_type type)
 	const struct v4l2_fwnode_bus_conv *conv =
 		get_v4l2_fwnode_bus_conv_by_fwnode_bus(type);
 
-	return conv ? conv->mbus_type : V4L2_MBUS_UNKNOWN;
+	return conv ? conv->mbus_type : V4L2_MBUS_INVALID;
 }
 
 static const char *
@@ -436,6 +436,10 @@ static int __v4l2_fwnode_endpoint_parse(struct fwnode_handle *fwnode,
 		 v4l2_fwnode_mbus_type_to_string(vep->bus_type),
 		 vep->bus_type);
 	mbus_type = v4l2_fwnode_bus_type_to_mbus(bus_type);
+	if (mbus_type == V4L2_MBUS_INVALID) {
+		pr_debug("unsupported bus type %u\n", bus_type);
+		return -EINVAL;
+	}
 
 	if (vep->bus_type != V4L2_MBUS_UNKNOWN) {
 		if (mbus_type != V4L2_MBUS_UNKNOWN &&
diff --git a/include/media/v4l2-mediabus.h b/include/media/v4l2-mediabus.h
index 45f88f0248c4e..c072ed1418113 100644
--- a/include/media/v4l2-mediabus.h
+++ b/include/media/v4l2-mediabus.h
@@ -78,6 +78,7 @@
  * @V4L2_MBUS_CCP2:	CCP2 (Compact Camera Port 2)
  * @V4L2_MBUS_CSI2_DPHY: MIPI CSI-2 serial interface, with D-PHY
  * @V4L2_MBUS_CSI2_CPHY: MIPI CSI-2 serial interface, with C-PHY
+ * @V4L2_MBUS_INVALID:	invalid bus type (keep as last)
  */
 enum v4l2_mbus_type {
 	V4L2_MBUS_UNKNOWN,
@@ -87,6 +88,7 @@ enum v4l2_mbus_type {
 	V4L2_MBUS_CCP2,
 	V4L2_MBUS_CSI2_DPHY,
 	V4L2_MBUS_CSI2_CPHY,
+	V4L2_MBUS_INVALID,
 };
 
 /**
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 137/453] ASoC: meson: fix COMPILE_TEST error
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (135 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.4 136/453] media: v4l2-fwnode: Return -EINVAL for invalid bus-type Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.4 138/453] scsi: core: Fix VPD LUN ID designator priorities Greg Kroah-Hartman
                   ` (318 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, kernel test robot, Jerome Brunet,
	Mark Brown, Sasha Levin

From: Jerome Brunet <jbrunet@baylibre.com>

[ Upstream commit 299fe9937dbd1a4d9a1da6a2b6f222298534ca57 ]

When compiled with CONFIG_HAVE_CLK, the kernel need to get provider for the
clock API. This is usually selected by the platform and the sound drivers
should not really care about this. However COMPILE_TEST is special and the
platform required may not have been selected, leading to this type of
error:

> aiu-encoder-spdif.c:(.text+0x3a0): undefined reference to `clk_set_parent'

Since we need a sane provider of the API with COMPILE_TEST, depends on
COMMON_CLK.

Fixes: 6dc4fa179fb8 ("ASoC: meson: add axg fifo base driver")
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
Link: https://lore.kernel.org/r/20201116172423.546855-1-jbrunet@baylibre.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/meson/Kconfig | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sound/soc/meson/Kconfig b/sound/soc/meson/Kconfig
index 2e3676147ceaf..e0d24592ebd70 100644
--- a/sound/soc/meson/Kconfig
+++ b/sound/soc/meson/Kconfig
@@ -1,6 +1,6 @@
 # SPDX-License-Identifier: GPL-2.0-only
 menu "ASoC support for Amlogic platforms"
-	depends on ARCH_MESON || COMPILE_TEST
+	depends on ARCH_MESON || (COMPILE_TEST && COMMON_CLK)
 
 config SND_MESON_AXG_FIFO
 	tristate
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 138/453] scsi: core: Fix VPD LUN ID designator priorities
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (136 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.4 137/453] ASoC: meson: fix COMPILE_TEST error Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.4 139/453] media: solo6x10: fix missing snd_card_free in error handling case Greg Kroah-Hartman
                   ` (317 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hannes Reinecke, Martin Wilck,
	Martin K. Petersen, Sasha Levin

From: Martin Wilck <mwilck@suse.com>

[ Upstream commit 2e4209b3806cda9b89c30fd5e7bfecb7044ec78b ]

The current implementation of scsi_vpd_lun_id() uses the designator length
as an implicit measure of priority. This works most of the time, but not
always. For example, some Hitachi storage arrays return this in VPD 0x83:

VPD INQUIRY: Device Identification page
  Designation descriptor number 1, descriptor length: 24
    designator_type: T10 vendor identification,  code_set: ASCII
    associated with the Addressed logical unit
      vendor id: HITACHI
      vendor specific: 5030C3502025
  Designation descriptor number 2, descriptor length: 6
    designator_type: vendor specific [0x0],  code_set: Binary
    associated with the Target port
      vendor specific: 08 03
  Designation descriptor number 3, descriptor length: 20
    designator_type: NAA,  code_set: Binary
    associated with the Addressed logical unit
      NAA 6, IEEE Company_id: 0x60e8
      Vendor Specific Identifier: 0x7c35000
      Vendor Specific Identifier Extension: 0x30c35000002025
      [0x60060e8007c350000030c35000002025]

The current code would use the first descriptor because it's longer than
the NAA descriptor. But this is wrong, the kernel is supposed to prefer NAA
descriptors over T10 vendor ID. Designator length should only be used to
compare designators of the same type.

This patch addresses the issue by separating designator priority and
length.

Link: https://lore.kernel.org/r/20201029170846.14786-1-mwilck@suse.com
Fixes: 9983bed3907c ("scsi: Add scsi_vpd_lun_id()")
Reviewed-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: Martin Wilck <mwilck@suse.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/scsi_lib.c | 126 +++++++++++++++++++++++++++-------------
 1 file changed, 86 insertions(+), 40 deletions(-)

diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index e6944e1cba2ba..b5867e1566f42 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -2930,6 +2930,78 @@ void sdev_enable_disk_events(struct scsi_device *sdev)
 }
 EXPORT_SYMBOL(sdev_enable_disk_events);
 
+static unsigned char designator_prio(const unsigned char *d)
+{
+	if (d[1] & 0x30)
+		/* not associated with LUN */
+		return 0;
+
+	if (d[3] == 0)
+		/* invalid length */
+		return 0;
+
+	/*
+	 * Order of preference for lun descriptor:
+	 * - SCSI name string
+	 * - NAA IEEE Registered Extended
+	 * - EUI-64 based 16-byte
+	 * - EUI-64 based 12-byte
+	 * - NAA IEEE Registered
+	 * - NAA IEEE Extended
+	 * - EUI-64 based 8-byte
+	 * - SCSI name string (truncated)
+	 * - T10 Vendor ID
+	 * as longer descriptors reduce the likelyhood
+	 * of identification clashes.
+	 */
+
+	switch (d[1] & 0xf) {
+	case 8:
+		/* SCSI name string, variable-length UTF-8 */
+		return 9;
+	case 3:
+		switch (d[4] >> 4) {
+		case 6:
+			/* NAA registered extended */
+			return 8;
+		case 5:
+			/* NAA registered */
+			return 5;
+		case 4:
+			/* NAA extended */
+			return 4;
+		case 3:
+			/* NAA locally assigned */
+			return 1;
+		default:
+			break;
+		}
+		break;
+	case 2:
+		switch (d[3]) {
+		case 16:
+			/* EUI64-based, 16 byte */
+			return 7;
+		case 12:
+			/* EUI64-based, 12 byte */
+			return 6;
+		case 8:
+			/* EUI64-based, 8 byte */
+			return 3;
+		default:
+			break;
+		}
+		break;
+	case 1:
+		/* T10 vendor ID */
+		return 1;
+	default:
+		break;
+	}
+
+	return 0;
+}
+
 /**
  * scsi_vpd_lun_id - return a unique device identification
  * @sdev: SCSI device
@@ -2946,7 +3018,7 @@ EXPORT_SYMBOL(sdev_enable_disk_events);
  */
 int scsi_vpd_lun_id(struct scsi_device *sdev, char *id, size_t id_len)
 {
-	u8 cur_id_type = 0xff;
+	u8 cur_id_prio = 0;
 	u8 cur_id_size = 0;
 	const unsigned char *d, *cur_id_str;
 	const struct scsi_vpd *vpd_pg83;
@@ -2959,20 +3031,6 @@ int scsi_vpd_lun_id(struct scsi_device *sdev, char *id, size_t id_len)
 		return -ENXIO;
 	}
 
-	/*
-	 * Look for the correct descriptor.
-	 * Order of preference for lun descriptor:
-	 * - SCSI name string
-	 * - NAA IEEE Registered Extended
-	 * - EUI-64 based 16-byte
-	 * - EUI-64 based 12-byte
-	 * - NAA IEEE Registered
-	 * - NAA IEEE Extended
-	 * - T10 Vendor ID
-	 * as longer descriptors reduce the likelyhood
-	 * of identification clashes.
-	 */
-
 	/* The id string must be at least 20 bytes + terminating NULL byte */
 	if (id_len < 21) {
 		rcu_read_unlock();
@@ -2982,8 +3040,9 @@ int scsi_vpd_lun_id(struct scsi_device *sdev, char *id, size_t id_len)
 	memset(id, 0, id_len);
 	d = vpd_pg83->data + 4;
 	while (d < vpd_pg83->data + vpd_pg83->len) {
-		/* Skip designators not referring to the LUN */
-		if ((d[1] & 0x30) != 0x00)
+		u8 prio = designator_prio(d);
+
+		if (prio == 0 || cur_id_prio > prio)
 			goto next_desig;
 
 		switch (d[1] & 0xf) {
@@ -2991,28 +3050,19 @@ int scsi_vpd_lun_id(struct scsi_device *sdev, char *id, size_t id_len)
 			/* T10 Vendor ID */
 			if (cur_id_size > d[3])
 				break;
-			/* Prefer anything */
-			if (cur_id_type > 0x01 && cur_id_type != 0xff)
-				break;
+			cur_id_prio = prio;
 			cur_id_size = d[3];
 			if (cur_id_size + 4 > id_len)
 				cur_id_size = id_len - 4;
 			cur_id_str = d + 4;
-			cur_id_type = d[1] & 0xf;
 			id_size = snprintf(id, id_len, "t10.%*pE",
 					   cur_id_size, cur_id_str);
 			break;
 		case 0x2:
 			/* EUI-64 */
-			if (cur_id_size > d[3])
-				break;
-			/* Prefer NAA IEEE Registered Extended */
-			if (cur_id_type == 0x3 &&
-			    cur_id_size == d[3])
-				break;
+			cur_id_prio = prio;
 			cur_id_size = d[3];
 			cur_id_str = d + 4;
-			cur_id_type = d[1] & 0xf;
 			switch (cur_id_size) {
 			case 8:
 				id_size = snprintf(id, id_len,
@@ -3030,17 +3080,14 @@ int scsi_vpd_lun_id(struct scsi_device *sdev, char *id, size_t id_len)
 						   cur_id_str);
 				break;
 			default:
-				cur_id_size = 0;
 				break;
 			}
 			break;
 		case 0x3:
 			/* NAA */
-			if (cur_id_size > d[3])
-				break;
+			cur_id_prio = prio;
 			cur_id_size = d[3];
 			cur_id_str = d + 4;
-			cur_id_type = d[1] & 0xf;
 			switch (cur_id_size) {
 			case 8:
 				id_size = snprintf(id, id_len,
@@ -3053,26 +3100,25 @@ int scsi_vpd_lun_id(struct scsi_device *sdev, char *id, size_t id_len)
 						   cur_id_str);
 				break;
 			default:
-				cur_id_size = 0;
 				break;
 			}
 			break;
 		case 0x8:
 			/* SCSI name string */
-			if (cur_id_size + 4 > d[3])
+			if (cur_id_size > d[3])
 				break;
 			/* Prefer others for truncated descriptor */
-			if (cur_id_size && d[3] > id_len)
-				break;
+			if (d[3] > id_len) {
+				prio = 2;
+				if (cur_id_prio > prio)
+					break;
+			}
+			cur_id_prio = prio;
 			cur_id_size = id_size = d[3];
 			cur_id_str = d + 4;
-			cur_id_type = d[1] & 0xf;
 			if (cur_id_size >= id_len)
 				cur_id_size = id_len - 1;
 			memcpy(id, cur_id_str, cur_id_size);
-			/* Decrease priority for truncated descriptor */
-			if (cur_id_size != id_size)
-				cur_id_size = 6;
 			break;
 		default:
 			break;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 139/453] media: solo6x10: fix missing snd_card_free in error handling case
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (137 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.4 138/453] scsi: core: Fix VPD LUN ID designator priorities Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.4 140/453] video: fbdev: atmel_lcdfb: fix return error code in atmel_lcdfb_of_init() Greg Kroah-Hartman
                   ` (316 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Qinglang Miao,
	Hans Verkuil, Mauro Carvalho Chehab, Sasha Levin

From: Qinglang Miao <miaoqinglang@huawei.com>

[ Upstream commit dcdff74fa6bc00c32079d0bebd620764c26f2d89 ]

Fix to goto snd_error in error handling case when fails
to do snd_ctl_add, as done elsewhere in this function.

Fixes: 28cae868cd24 ("[media] solo6x10: move out of staging into drivers/media/pci.")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/pci/solo6x10/solo6x10-g723.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/pci/solo6x10/solo6x10-g723.c b/drivers/media/pci/solo6x10/solo6x10-g723.c
index 30c8f2ec9c3cc..809e4e65bb6e7 100644
--- a/drivers/media/pci/solo6x10/solo6x10-g723.c
+++ b/drivers/media/pci/solo6x10/solo6x10-g723.c
@@ -399,7 +399,7 @@ int solo_g723_init(struct solo_dev *solo_dev)
 
 	ret = snd_ctl_add(card, snd_ctl_new1(&kctl, solo_dev));
 	if (ret < 0)
-		return ret;
+		goto snd_error;
 
 	ret = solo_snd_pcm_init(solo_dev);
 	if (ret < 0)
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 140/453] video: fbdev: atmel_lcdfb: fix return error code in atmel_lcdfb_of_init()
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (138 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.4 139/453] media: solo6x10: fix missing snd_card_free in error handling case Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.4 141/453] drm/omap: dmm_tiler: fix return error code in omap_dmm_probe() Greg Kroah-Hartman
                   ` (315 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Yang Yingliang,
	Thomas Zimmermann, Sasha Levin

From: Yang Yingliang <yangyingliang@huawei.com>

[ Upstream commit ba236455ee750270f33998df57f982433cea4d8e ]

If devm_kzalloc() failed after the first time, atmel_lcdfb_of_init()
can't return -ENOMEM, fix this by putting the error code in loop.

Fixes: b985172b328a ("video: atmel_lcdfb: add device tree suport")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://patchwork.freedesktop.org/patch/msgid/20201117061350.3453742-1-yangyingliang@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/video/fbdev/atmel_lcdfb.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/video/fbdev/atmel_lcdfb.c b/drivers/video/fbdev/atmel_lcdfb.c
index 5ff8e0320d95b..cf2bfff2efbf1 100644
--- a/drivers/video/fbdev/atmel_lcdfb.c
+++ b/drivers/video/fbdev/atmel_lcdfb.c
@@ -987,8 +987,8 @@ static int atmel_lcdfb_of_init(struct atmel_lcdfb_info *sinfo)
 	}
 
 	INIT_LIST_HEAD(&pdata->pwr_gpios);
-	ret = -ENOMEM;
 	for (i = 0; i < gpiod_count(dev, "atmel,power-control"); i++) {
+		ret = -ENOMEM;
 		gpiod = devm_gpiod_get_index(dev, "atmel,power-control",
 					     i, GPIOD_ASIS);
 		if (IS_ERR(gpiod))
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 141/453] drm/omap: dmm_tiler: fix return error code in omap_dmm_probe()
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (139 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.4 140/453] video: fbdev: atmel_lcdfb: fix return error code in atmel_lcdfb_of_init() Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.4 142/453] Input: ads7846 - fix race that causes missing releases Greg Kroah-Hartman
                   ` (314 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Yang Yingliang,
	Thomas Zimmermann, Sasha Levin

From: Yang Yingliang <yangyingliang@huawei.com>

[ Upstream commit 723ae803218da993143387bf966042eccefac077 ]

Return -ENOMEM when allocating refill memory failed.

Fixes: 71e8831f6407 ("drm/omap: DMM/TILER support for OMAP4+ platform")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://patchwork.freedesktop.org/patch/msgid/20201117061045.3452287-1-yangyingliang@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/omapdrm/omap_dmm_tiler.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c b/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c
index 252f5ebb1acc4..3dd6c0087edb6 100644
--- a/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c
+++ b/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c
@@ -891,6 +891,7 @@ static int omap_dmm_probe(struct platform_device *dev)
 					   &omap_dmm->refill_pa, GFP_KERNEL);
 	if (!omap_dmm->refill_va) {
 		dev_err(&dev->dev, "could not allocate refill memory\n");
+		ret = -ENOMEM;
 		goto fail;
 	}
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 142/453] Input: ads7846 - fix race that causes missing releases
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (140 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.4 141/453] drm/omap: dmm_tiler: fix return error code in omap_dmm_probe() Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.4 143/453] Input: ads7846 - fix integer overflow on Rt calculation Greg Kroah-Hartman
                   ` (313 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, David Jander, Oleksij Rempel,
	Dmitry Torokhov, Sasha Levin

From: David Jander <david@protonic.nl>

[ Upstream commit e52cd628a03f72a547dbf90ccb703ee64800504a ]

If touchscreen is released while busy reading HWMON device, the release
can be missed. The IRQ thread is not started because no touch is active
and BTN_TOUCH release event is never sent.

Fixes: f5a28a7d4858f94a ("Input: ads7846 - avoid pen up/down when reading hwmon")
Co-developed-by: Oleksij Rempel <o.rempel@pengutronix.de>
Signed-off-by: David Jander <david@protonic.nl>
Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
Link: https://lore.kernel.org/r/20201027105416.18773-1-o.rempel@pengutronix.de
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/input/touchscreen/ads7846.c | 44 +++++++++++++++++------------
 1 file changed, 26 insertions(+), 18 deletions(-)

diff --git a/drivers/input/touchscreen/ads7846.c b/drivers/input/touchscreen/ads7846.c
index 51ddb204ca1ba..1e19af0da13a3 100644
--- a/drivers/input/touchscreen/ads7846.c
+++ b/drivers/input/touchscreen/ads7846.c
@@ -199,6 +199,26 @@ struct ads7846 {
 #define	REF_ON	(READ_12BIT_DFR(x, 1, 1))
 #define	REF_OFF	(READ_12BIT_DFR(y, 0, 0))
 
+static int get_pendown_state(struct ads7846 *ts)
+{
+	if (ts->get_pendown_state)
+		return ts->get_pendown_state();
+
+	return !gpio_get_value(ts->gpio_pendown);
+}
+
+static void ads7846_report_pen_up(struct ads7846 *ts)
+{
+	struct input_dev *input = ts->input;
+
+	input_report_key(input, BTN_TOUCH, 0);
+	input_report_abs(input, ABS_PRESSURE, 0);
+	input_sync(input);
+
+	ts->pendown = false;
+	dev_vdbg(&ts->spi->dev, "UP\n");
+}
+
 /* Must be called with ts->lock held */
 static void ads7846_stop(struct ads7846 *ts)
 {
@@ -215,6 +235,10 @@ static void ads7846_stop(struct ads7846 *ts)
 static void ads7846_restart(struct ads7846 *ts)
 {
 	if (!ts->disabled && !ts->suspended) {
+		/* Check if pen was released since last stop */
+		if (ts->pendown && !get_pendown_state(ts))
+			ads7846_report_pen_up(ts);
+
 		/* Tell IRQ thread that it may poll the device. */
 		ts->stopped = false;
 		mb();
@@ -605,14 +629,6 @@ static const struct attribute_group ads784x_attr_group = {
 
 /*--------------------------------------------------------------------------*/
 
-static int get_pendown_state(struct ads7846 *ts)
-{
-	if (ts->get_pendown_state)
-		return ts->get_pendown_state();
-
-	return !gpio_get_value(ts->gpio_pendown);
-}
-
 static void null_wait_for_sync(void)
 {
 }
@@ -867,16 +883,8 @@ static irqreturn_t ads7846_irq(int irq, void *handle)
 				   msecs_to_jiffies(TS_POLL_PERIOD));
 	}
 
-	if (ts->pendown && !ts->stopped) {
-		struct input_dev *input = ts->input;
-
-		input_report_key(input, BTN_TOUCH, 0);
-		input_report_abs(input, ABS_PRESSURE, 0);
-		input_sync(input);
-
-		ts->pendown = false;
-		dev_vdbg(&ts->spi->dev, "UP\n");
-	}
+	if (ts->pendown && !ts->stopped)
+		ads7846_report_pen_up(ts);
 
 	return IRQ_HANDLED;
 }
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 143/453] Input: ads7846 - fix integer overflow on Rt calculation
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (141 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.4 142/453] Input: ads7846 - fix race that causes missing releases Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.4 144/453] Input: ads7846 - fix unaligned access on 7845 Greg Kroah-Hartman
                   ` (312 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, David Jander, Oleksij Rempel,
	Dmitry Torokhov, Sasha Levin

From: Oleksij Rempel <o.rempel@pengutronix.de>

[ Upstream commit 820830ec918f6c3dcd77a54a1c6198ab57407916 ]

In some rare cases the 32 bit Rt value will overflow if z2 and x is max,
z1 is minimal value and x_plate_ohms is relatively high (for example 800
ohm). This would happen on some screen age with low pressure.

There are two possible fixes:
- make Rt 64bit
- reorder calculation to avoid overflow

The second variant seems to be preferable, since 64 bit calculation on
32 bit system is a bit more expensive.

Fixes: ffa458c1bd9b6f653008d450f337602f3d52a646 ("spi: ads7846 driver")
Co-developed-by: David Jander <david@protonic.nl>
Signed-off-by: David Jander <david@protonic.nl>
Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
Link: https://lore.kernel.org/r/20201113112240.1360-1-o.rempel@pengutronix.de
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/input/touchscreen/ads7846.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/input/touchscreen/ads7846.c b/drivers/input/touchscreen/ads7846.c
index 1e19af0da13a3..a5b1b41464f99 100644
--- a/drivers/input/touchscreen/ads7846.c
+++ b/drivers/input/touchscreen/ads7846.c
@@ -801,10 +801,11 @@ static void ads7846_report_state(struct ads7846 *ts)
 		/* compute touch pressure resistance using equation #2 */
 		Rt = z2;
 		Rt -= z1;
-		Rt *= x;
 		Rt *= ts->x_plate_ohms;
+		Rt = DIV_ROUND_CLOSEST(Rt, 16);
+		Rt *= x;
 		Rt /= z1;
-		Rt = (Rt + 2047) >> 12;
+		Rt = DIV_ROUND_CLOSEST(Rt, 256);
 	} else {
 		Rt = 0;
 	}
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 144/453] Input: ads7846 - fix unaligned access on 7845
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (142 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.4 143/453] Input: ads7846 - fix integer overflow on Rt calculation Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.4 145/453] usb/max3421: fix return error code in max3421_probe() Greg Kroah-Hartman
                   ` (311 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Dmitry Torokhov, Sasha Levin

From: Dmitry Torokhov <dmitry.torokhov@gmail.com>

[ Upstream commit 03e2c9c782f721b661a0e42b1b58f394b5298544 ]

req->sample[1] is not naturally aligned at word boundary, and therefore we
should use get_unaligned_be16() when accessing it.

Fixes: 3eac5c7e44f3 ("Input: ads7846 - extend the driver for ads7845 controller support")
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/input/touchscreen/ads7846.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/input/touchscreen/ads7846.c b/drivers/input/touchscreen/ads7846.c
index a5b1b41464f99..d247d0ae82d26 100644
--- a/drivers/input/touchscreen/ads7846.c
+++ b/drivers/input/touchscreen/ads7846.c
@@ -33,6 +33,7 @@
 #include <linux/regulator/consumer.h>
 #include <linux/module.h>
 #include <asm/irq.h>
+#include <asm/unaligned.h>
 
 /*
  * This code has been heavily tested on a Nokia 770, and lightly
@@ -434,7 +435,7 @@ static int ads7845_read12_ser(struct device *dev, unsigned command)
 
 	if (status == 0) {
 		/* BE12 value, then padding */
-		status = be16_to_cpu(*((u16 *)&req->sample[1]));
+		status = get_unaligned_be16(&req->sample[1]);
 		status = status >> 3;
 		status &= 0x0fff;
 	}
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 145/453] usb/max3421: fix return error code in max3421_probe()
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (143 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.4 144/453] Input: ads7846 - fix unaligned access on 7845 Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.4 146/453] spi: mxs: fix reference leak in mxs_spi_probe Greg Kroah-Hartman
                   ` (310 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Yang Yingliang, Sasha Levin

From: Yang Yingliang <yangyingliang@huawei.com>

[ Upstream commit 5a569343e8a618dc73edebe0957eb42f2ab476bd ]

retval may be reassigned to 0 after max3421_of_vbus_en_pin(),
if allocate memory failed after this, max3421_probe() cann't
return ENOMEM, fix this by moving assign retval afther max3421_probe().

Fixes: 721fdc83b31b ("usb: max3421: Add devicetree support")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Link: https://lore.kernel.org/r/20201117061500.3454223-1-yangyingliang@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/host/max3421-hcd.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/host/max3421-hcd.c b/drivers/usb/host/max3421-hcd.c
index 8819f502b6a68..903abdf30b5a0 100644
--- a/drivers/usb/host/max3421-hcd.c
+++ b/drivers/usb/host/max3421-hcd.c
@@ -1847,7 +1847,7 @@ max3421_probe(struct spi_device *spi)
 	struct max3421_hcd *max3421_hcd;
 	struct usb_hcd *hcd = NULL;
 	struct max3421_hcd_platform_data *pdata = NULL;
-	int retval = -ENOMEM;
+	int retval;
 
 	if (spi_setup(spi) < 0) {
 		dev_err(&spi->dev, "Unable to setup SPI bus");
@@ -1889,6 +1889,7 @@ max3421_probe(struct spi_device *spi)
 		goto error;
 	}
 
+	retval = -ENOMEM;
 	hcd = usb_create_hcd(&max3421_hcd_desc, &spi->dev,
 			     dev_name(&spi->dev));
 	if (!hcd) {
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 146/453] spi: mxs: fix reference leak in mxs_spi_probe
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (144 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.4 145/453] usb/max3421: fix return error code in max3421_probe() Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.4 147/453] selftests/bpf: Fix broken riscv build Greg Kroah-Hartman
                   ` (309 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Zhang Qilong, Mark Brown, Sasha Levin

From: Zhang Qilong <zhangqilong3@huawei.com>

[ Upstream commit 03fc41afaa6549baa2dab7a84e1afaf5cadb5b18 ]

pm_runtime_get_sync will increment pm usage counter even it
failed. Forgetting to pm_runtime_put_noidle will result in
reference leak in mxs_spi_probe, so we should fix it.

Fixes: b7969caf41a1d ("spi: mxs: implement runtime pm")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Link: https://lore.kernel.org/r/20201106012421.95420-1-zhangqilong3@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-mxs.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/spi/spi-mxs.c b/drivers/spi/spi-mxs.c
index 996c1c8a9c719..34856c9ad931a 100644
--- a/drivers/spi/spi-mxs.c
+++ b/drivers/spi/spi-mxs.c
@@ -608,6 +608,7 @@ static int mxs_spi_probe(struct platform_device *pdev)
 
 	ret = pm_runtime_get_sync(ssp->dev);
 	if (ret < 0) {
+		pm_runtime_put_noidle(ssp->dev);
 		dev_err(ssp->dev, "runtime_get_sync failed\n");
 		goto out_pm_runtime_disable;
 	}
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 147/453] selftests/bpf: Fix broken riscv build
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (145 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.4 146/453] spi: mxs: fix reference leak in mxs_spi_probe Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.4 148/453] powerpc: Avoid broken GCC __attribute__((optimize)) Greg Kroah-Hartman
                   ` (308 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Björn Töpel,
	Andrii Nakryiko, Luke Nelson, Sasha Levin

From: Björn Töpel <bjorn.topel@gmail.com>

[ Upstream commit 6016df8fe874e1cf36f6357d71438b384198ce06 ]

The selftests/bpf Makefile includes system include directories from
the host, when building BPF programs. On RISC-V glibc requires that
__riscv_xlen is defined. This is not the case for "clang -target bpf",
which messes up __WORDSIZE (errno.h -> ... -> wordsize.h) and breaks
the build.

By explicitly defining __risc_xlen correctly for riscv, we can
workaround this.

Fixes: 167381f3eac0 ("selftests/bpf: Makefile fix "missing" headers on build with -idirafter")
Signed-off-by: Björn Töpel <bjorn.topel@gmail.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Acked-by: Luke Nelson <luke.r.nels@gmail.com>
Link: https://lore.kernel.org/bpf/20201118071640.83773-2-bjorn.topel@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/testing/selftests/bpf/Makefile | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/tools/testing/selftests/bpf/Makefile b/tools/testing/selftests/bpf/Makefile
index 6889c19a628c2..544bd1028baee 100644
--- a/tools/testing/selftests/bpf/Makefile
+++ b/tools/testing/selftests/bpf/Makefile
@@ -144,7 +144,8 @@ endif
 # build would have failed anyways.
 define get_sys_includes
 $(shell $(1) -v -E - </dev/null 2>&1 \
-	| sed -n '/<...> search starts here:/,/End of search list./{ s| \(/.*\)|-idirafter \1|p }')
+	| sed -n '/<...> search starts here:/,/End of search list./{ s| \(/.*\)|-idirafter \1|p }') \
+$(shell $(1) -dM -E - </dev/null | grep '#define __riscv_xlen ' | sed 's/#define /-D/' | sed 's/ /=/')
 endef
 CLANG_SYS_INCLUDES = $(call get_sys_includes,$(CLANG))
 BPF_CFLAGS = -I. -I./include/uapi -I../../../include/uapi \
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 148/453] powerpc: Avoid broken GCC __attribute__((optimize))
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (146 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.4 147/453] selftests/bpf: Fix broken riscv build Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.4 149/453] powerpc/feature: Fix CPU_FTRS_ALWAYS by removing CPU_FTRS_GENERIC_32 Greg Kroah-Hartman
                   ` (307 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ard Biesheuvel, Michael Ellerman,
	Sasha Levin

From: Ard Biesheuvel <ardb@kernel.org>

[ Upstream commit a7223f5bfcaeade4a86d35263493bcda6c940891 ]

Commit 7053f80d9696 ("powerpc/64: Prevent stack protection in early
boot") introduced a couple of uses of __attribute__((optimize)) with
function scope, to disable the stack protector in some early boot
code.

Unfortunately, and this is documented in the GCC man pages [0],
overriding function attributes for optimization is broken, and is only
supported for debug scenarios, not for production: the problem appears
to be that setting GCC -f flags using this method will cause it to
forget about some or all other optimization settings that have been
applied.

So the only safe way to disable the stack protector is to disable it
for the entire source file.

[0] https://gcc.gnu.org/onlinedocs/gcc/Common-Function-Attributes.html

Fixes: 7053f80d9696 ("powerpc/64: Prevent stack protection in early boot")
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
[mpe: Drop one remaining use of __nostackprotector, reported by snowpatch]
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20201028080433.26799-1-ardb@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/kernel/Makefile   | 3 +++
 arch/powerpc/kernel/paca.c     | 4 ++--
 arch/powerpc/kernel/setup.h    | 6 ------
 arch/powerpc/kernel/setup_64.c | 2 +-
 4 files changed, 6 insertions(+), 9 deletions(-)

diff --git a/arch/powerpc/kernel/Makefile b/arch/powerpc/kernel/Makefile
index 59260eb962916..afbd47b0a75cc 100644
--- a/arch/powerpc/kernel/Makefile
+++ b/arch/powerpc/kernel/Makefile
@@ -181,6 +181,9 @@ KCOV_INSTRUMENT_cputable.o := n
 KCOV_INSTRUMENT_setup_64.o := n
 KCOV_INSTRUMENT_paca.o := n
 
+CFLAGS_setup_64.o		+= -fno-stack-protector
+CFLAGS_paca.o			+= -fno-stack-protector
+
 extra-$(CONFIG_PPC_FPU)		+= fpu.o
 extra-$(CONFIG_ALTIVEC)		+= vector.o
 extra-$(CONFIG_PPC64)		+= entry_64.o
diff --git a/arch/powerpc/kernel/paca.c b/arch/powerpc/kernel/paca.c
index 4ea0cca52e162..c786adfb9413f 100644
--- a/arch/powerpc/kernel/paca.c
+++ b/arch/powerpc/kernel/paca.c
@@ -176,7 +176,7 @@ static struct slb_shadow * __init new_slb_shadow(int cpu, unsigned long limit)
 struct paca_struct **paca_ptrs __read_mostly;
 EXPORT_SYMBOL(paca_ptrs);
 
-void __init __nostackprotector initialise_paca(struct paca_struct *new_paca, int cpu)
+void __init initialise_paca(struct paca_struct *new_paca, int cpu)
 {
 #ifdef CONFIG_PPC_PSERIES
 	new_paca->lppaca_ptr = NULL;
@@ -205,7 +205,7 @@ void __init __nostackprotector initialise_paca(struct paca_struct *new_paca, int
 }
 
 /* Put the paca pointer into r13 and SPRG_PACA */
-void __nostackprotector setup_paca(struct paca_struct *new_paca)
+void setup_paca(struct paca_struct *new_paca)
 {
 	/* Setup r13 */
 	local_paca = new_paca;
diff --git a/arch/powerpc/kernel/setup.h b/arch/powerpc/kernel/setup.h
index 1b02d338a5f55..c82577c4b15d3 100644
--- a/arch/powerpc/kernel/setup.h
+++ b/arch/powerpc/kernel/setup.h
@@ -8,12 +8,6 @@
 #ifndef __ARCH_POWERPC_KERNEL_SETUP_H
 #define __ARCH_POWERPC_KERNEL_SETUP_H
 
-#ifdef CONFIG_CC_IS_CLANG
-#define __nostackprotector
-#else
-#define __nostackprotector __attribute__((__optimize__("no-stack-protector")))
-#endif
-
 void initialize_cache_info(void);
 void irqstack_early_init(void);
 
diff --git a/arch/powerpc/kernel/setup_64.c b/arch/powerpc/kernel/setup_64.c
index 480c236724da2..5bc7e753df4d0 100644
--- a/arch/powerpc/kernel/setup_64.c
+++ b/arch/powerpc/kernel/setup_64.c
@@ -284,7 +284,7 @@ void __init record_spr_defaults(void)
  * device-tree is not accessible via normal means at this point.
  */
 
-void __init __nostackprotector early_setup(unsigned long dt_ptr)
+void __init early_setup(unsigned long dt_ptr)
 {
 	static __initdata struct paca_struct boot_paca;
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 149/453] powerpc/feature: Fix CPU_FTRS_ALWAYS by removing CPU_FTRS_GENERIC_32
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (147 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.4 148/453] powerpc: Avoid broken GCC __attribute__((optimize)) Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.4 150/453] EDAC/mce_amd: Use struct cpuinfo_x86.cpu_die_id for AMD NodeId Greg Kroah-Hartman
                   ` (306 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christophe Leroy, Michael Ellerman,
	Sasha Levin

From: Christophe Leroy <christophe.leroy@csgroup.eu>

[ Upstream commit 78665179e569c7e1fe102fb6c21d0f5b6951f084 ]

On 8xx, we get the following features:

[    0.000000] cpu_features      = 0x0000000000000100
[    0.000000]   possible        = 0x0000000000000120
[    0.000000]   always          = 0x0000000000000000

This is not correct. As CONFIG_PPC_8xx is mutually exclusive with all
other configurations, the three lines should be equal.

The problem is due to CPU_FTRS_GENERIC_32 which is taken when
CONFIG_BOOK3S_32 is NOT selected. This CPU_FTRS_GENERIC_32 is
pointless because there is no generic configuration supporting
all 32 bits but book3s/32.

Remove this pointless generic features definition to unbreak the
calculation of 'possible' features and 'always' features.

Fixes: 76bc080ef5a3 ("[POWERPC] Make default cputable entries reflect selected CPU family")
Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/76a85f30bf981d1aeaae00df99321235494da254.1604426550.git.christophe.leroy@csgroup.eu
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/include/asm/cputable.h | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/arch/powerpc/include/asm/cputable.h b/arch/powerpc/include/asm/cputable.h
index cf00ff0d121de..dc8e8552bd487 100644
--- a/arch/powerpc/include/asm/cputable.h
+++ b/arch/powerpc/include/asm/cputable.h
@@ -407,7 +407,6 @@ static inline void cpu_feature_keys_init(void) { }
 	    CPU_FTR_DBELL | CPU_FTR_POPCNTB | CPU_FTR_POPCNTD | \
 	    CPU_FTR_DEBUG_LVL_EXC | CPU_FTR_EMB_HV | CPU_FTR_ALTIVEC_COMP | \
 	    CPU_FTR_CELL_TB_BUG | CPU_FTR_SMT)
-#define CPU_FTRS_GENERIC_32	(CPU_FTR_COMMON | CPU_FTR_NODSISRALIGN)
 
 /* 64-bit CPUs */
 #define CPU_FTRS_PPC970	(CPU_FTR_LWSYNC | \
@@ -507,8 +506,6 @@ enum {
 	    CPU_FTRS_7447 | CPU_FTRS_7447A | CPU_FTRS_82XX |
 	    CPU_FTRS_G2_LE | CPU_FTRS_E300 | CPU_FTRS_E300C2 |
 	    CPU_FTRS_CLASSIC32 |
-#else
-	    CPU_FTRS_GENERIC_32 |
 #endif
 #ifdef CONFIG_PPC_8xx
 	    CPU_FTRS_8XX |
@@ -585,8 +582,6 @@ enum {
 	    CPU_FTRS_7447 & CPU_FTRS_7447A & CPU_FTRS_82XX &
 	    CPU_FTRS_G2_LE & CPU_FTRS_E300 & CPU_FTRS_E300C2 &
 	    CPU_FTRS_CLASSIC32 &
-#else
-	    CPU_FTRS_GENERIC_32 &
 #endif
 #ifdef CONFIG_PPC_8xx
 	    CPU_FTRS_8XX &
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 150/453] EDAC/mce_amd: Use struct cpuinfo_x86.cpu_die_id for AMD NodeId
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (148 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.4 149/453] powerpc/feature: Fix CPU_FTRS_ALWAYS by removing CPU_FTRS_GENERIC_32 Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 15:54   ` Borislav Petkov
  2020-12-28 12:46 ` [PATCH 5.4 151/453] crypto: crypto4xx - Replace bitwise OR with logical OR in crypto4xx_build_pd Greg Kroah-Hartman
                   ` (305 subsequent siblings)
  455 siblings, 1 reply; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yazen Ghannam, Borislav Petkov, Sasha Levin

From: Yazen Ghannam <yazen.ghannam@amd.com>

[ Upstream commit 8de0c9917cc1297bc5543b61992d5bdee4ce621a ]

The edac_mce_amd module calls decode_dram_ecc() on AMD Family17h and
later systems. This function is used in amd64_edac_mod to do
system-specific decoding for DRAM ECC errors. The function takes a
"NodeId" as a parameter.

In AMD documentation, NodeId is used to identify a physical die in a
system. This can be used to identify a node in the AMD_NB code and also
it is used with umc_normaddr_to_sysaddr().

However, the input used for decode_dram_ecc() is currently the NUMA node
of a logical CPU. In the default configuration, the NUMA node and
physical die will be equivalent, so this doesn't have an impact.

But the NUMA node configuration can be adjusted with optional memory
interleaving modes. This will cause the NUMA node enumeration to not
match the physical die enumeration. The mismatch will cause the address
translation function to fail or report incorrect results.

Use struct cpuinfo_x86.cpu_die_id for the node_id parameter to ensure the
physical ID is used.

Fixes: fbe63acf62f5 ("EDAC, mce_amd: Use cpu_to_node() to find the node ID")
Signed-off-by: Yazen Ghannam <yazen.ghannam@amd.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Link: https://lkml.kernel.org/r/20201109210659.754018-4-Yazen.Ghannam@amd.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/edac/mce_amd.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/edac/mce_amd.c b/drivers/edac/mce_amd.c
index ea622c6f3a393..c19640a453f22 100644
--- a/drivers/edac/mce_amd.c
+++ b/drivers/edac/mce_amd.c
@@ -975,7 +975,7 @@ static void decode_smca_error(struct mce *m)
 	}
 
 	if (bank_type == SMCA_UMC && xec == 0 && decode_dram_ecc)
-		decode_dram_ecc(cpu_to_node(m->extcpu), m);
+		decode_dram_ecc(topology_die_id(m->extcpu), m);
 }
 
 static inline void amd_decode_err_code(u16 ec)
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 151/453] crypto: crypto4xx - Replace bitwise OR with logical OR in crypto4xx_build_pd
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (149 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.4 150/453] EDAC/mce_amd: Use struct cpuinfo_x86.cpu_die_id for AMD NodeId Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.4 152/453] crypto: omap-aes - Fix PM disable depth imbalance in omap_aes_probe Greg Kroah-Hartman
                   ` (304 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Nathan Chancellor,
	Christian Lamparter, Herbert Xu, Sasha Levin

From: Nathan Chancellor <natechancellor@gmail.com>

[ Upstream commit 5bdad829c31a09069fd508534f03c2ea1576ac75 ]

Clang warns:

drivers/crypto/amcc/crypto4xx_core.c:921:60: warning: operator '?:' has
lower precedence than '|'; '|' will be evaluated first
[-Wbitwise-conditional-parentheses]
                 (crypto_tfm_alg_type(req->tfm) == CRYPTO_ALG_TYPE_AEAD) ?
                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ^
drivers/crypto/amcc/crypto4xx_core.c:921:60: note: place parentheses
around the '|' expression to silence this warning
                 (crypto_tfm_alg_type(req->tfm) == CRYPTO_ALG_TYPE_AEAD) ?
                                                                         ^
                                                                        )
drivers/crypto/amcc/crypto4xx_core.c:921:60: note: place parentheses
around the '?:' expression to evaluate it first
                 (crypto_tfm_alg_type(req->tfm) == CRYPTO_ALG_TYPE_AEAD) ?
                                                                         ^
                 (
1 warning generated.

It looks like this should have been a logical OR so that
PD_CTL_HASH_FINAL gets added to the w bitmask if crypto_tfm_alg_type
is either CRYPTO_ALG_TYPE_AHASH or CRYPTO_ALG_TYPE_AEAD. Change the
operator so that everything works properly.

Fixes: 4b5b79998af6 ("crypto: crypto4xx - fix stalls under heavy load")
Link: https://github.com/ClangBuiltLinux/linux/issues/1198
Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
Reviewed-by: Christian Lamparter <chunkeey@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/amcc/crypto4xx_core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/crypto/amcc/crypto4xx_core.c b/drivers/crypto/amcc/crypto4xx_core.c
index 7d6b695c4ab3f..230e8902c727c 100644
--- a/drivers/crypto/amcc/crypto4xx_core.c
+++ b/drivers/crypto/amcc/crypto4xx_core.c
@@ -916,7 +916,7 @@ int crypto4xx_build_pd(struct crypto_async_request *req,
 	}
 
 	pd->pd_ctl.w = PD_CTL_HOST_READY |
-		((crypto_tfm_alg_type(req->tfm) == CRYPTO_ALG_TYPE_AHASH) |
+		((crypto_tfm_alg_type(req->tfm) == CRYPTO_ALG_TYPE_AHASH) ||
 		 (crypto_tfm_alg_type(req->tfm) == CRYPTO_ALG_TYPE_AEAD) ?
 			PD_CTL_HASH_FINAL : 0);
 	pd->pd_ctl_len.w = 0x00400000 | (assoclen + datalen);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 152/453] crypto: omap-aes - Fix PM disable depth imbalance in omap_aes_probe
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (150 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.4 151/453] crypto: crypto4xx - Replace bitwise OR with logical OR in crypto4xx_build_pd Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.4 153/453] spi: fix resource leak for drivers without .remove callback Greg Kroah-Hartman
                   ` (303 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Zhang Qilong, Herbert Xu, Sasha Levin

From: Zhang Qilong <zhangqilong3@huawei.com>

[ Upstream commit ff8107200367f4abe0e5bce66a245e8d0f2d229e ]

The pm_runtime_enable will increase power disable depth.
Thus a pairing decrement is needed on the error handling
path to keep it balanced according to context.

Fixes: f7b2b5dd6a62a ("crypto: omap-aes - add error check for pm_runtime_get_sync")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/omap-aes.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/crypto/omap-aes.c b/drivers/crypto/omap-aes.c
index 2f53fbb741001..103e704c14697 100644
--- a/drivers/crypto/omap-aes.c
+++ b/drivers/crypto/omap-aes.c
@@ -1157,7 +1157,7 @@ static int omap_aes_probe(struct platform_device *pdev)
 	if (err < 0) {
 		dev_err(dev, "%s: failed to get_sync(%d)\n",
 			__func__, err);
-		goto err_res;
+		goto err_pm_disable;
 	}
 
 	omap_aes_dma_stop(dd);
@@ -1267,6 +1267,7 @@ err_engine:
 	omap_aes_dma_cleanup(dd);
 err_irq:
 	tasklet_kill(&dd->done_task);
+err_pm_disable:
 	pm_runtime_disable(dev);
 err_res:
 	dd = NULL;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 153/453] spi: fix resource leak for drivers without .remove callback
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (151 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.4 152/453] crypto: omap-aes - Fix PM disable depth imbalance in omap_aes_probe Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.4 154/453] soc: ti: knav_qmss: fix reference leak in knav_queue_probe Greg Kroah-Hartman
                   ` (302 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Uwe Kleine-König, Mark Brown,
	Sasha Levin

From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>

[ Upstream commit 440408dbadfe47a615afd0a0a4a402e629be658a ]

Consider an spi driver with a .probe but without a .remove callback (e.g.
rtc-ds1347). The function spi_drv_probe() is called to bind a device and
so dev_pm_domain_attach() is called. As there is no remove callback
spi_drv_remove() isn't called at unbind time however and so calling
dev_pm_domain_detach() is missed and the pm domain keeps active.

To fix this always use both spi_drv_probe() and spi_drv_remove() and
make them handle the respective callback not being set. This has the
side effect that for a (hypothetical) driver that has neither .probe nor
remove the clk and pm domain setup is done.

Fixes: 33cf00e57082 ("spi: attach/detach SPI device to the ACPI power domain")
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Link: https://lore.kernel.org/r/20201119161604.2633521-1-u.kleine-koenig@pengutronix.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi.c | 19 ++++++++++---------
 1 file changed, 10 insertions(+), 9 deletions(-)

diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index 4c96c7c9e335e..e1205d72be523 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -405,9 +405,11 @@ static int spi_drv_probe(struct device *dev)
 	if (ret)
 		return ret;
 
-	ret = sdrv->probe(spi);
-	if (ret)
-		dev_pm_domain_detach(dev, true);
+	if (sdrv->probe) {
+		ret = sdrv->probe(spi);
+		if (ret)
+			dev_pm_domain_detach(dev, true);
+	}
 
 	return ret;
 }
@@ -415,9 +417,10 @@ static int spi_drv_probe(struct device *dev)
 static int spi_drv_remove(struct device *dev)
 {
 	const struct spi_driver		*sdrv = to_spi_driver(dev->driver);
-	int ret;
+	int ret = 0;
 
-	ret = sdrv->remove(to_spi_device(dev));
+	if (sdrv->remove)
+		ret = sdrv->remove(to_spi_device(dev));
 	dev_pm_domain_detach(dev, true);
 
 	return ret;
@@ -442,10 +445,8 @@ int __spi_register_driver(struct module *owner, struct spi_driver *sdrv)
 {
 	sdrv->driver.owner = owner;
 	sdrv->driver.bus = &spi_bus_type;
-	if (sdrv->probe)
-		sdrv->driver.probe = spi_drv_probe;
-	if (sdrv->remove)
-		sdrv->driver.remove = spi_drv_remove;
+	sdrv->driver.probe = spi_drv_probe;
+	sdrv->driver.remove = spi_drv_remove;
 	if (sdrv->shutdown)
 		sdrv->driver.shutdown = spi_drv_shutdown;
 	return driver_register(&sdrv->driver);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 154/453] soc: ti: knav_qmss: fix reference leak in knav_queue_probe
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (152 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.4 153/453] spi: fix resource leak for drivers without .remove callback Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.4 155/453] soc: ti: Fix reference imbalance in knav_dma_probe Greg Kroah-Hartman
                   ` (301 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Zhang Qilong, Santosh Shilimkar, Sasha Levin

From: Zhang Qilong <zhangqilong3@huawei.com>

[ Upstream commit ec8684847d8062496c4619bc3fcff31c19d56847 ]

pm_runtime_get_sync will increment pm usage counter even it
failed. Forgetting to pm_runtime_put_noidle will result in
reference leak in knav_queue_probe, so we should fix it.

Fixes: 41f93af900a20 ("soc: ti: add Keystone Navigator QMSS driver")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Signed-off-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/soc/ti/knav_qmss_queue.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/soc/ti/knav_qmss_queue.c b/drivers/soc/ti/knav_qmss_queue.c
index 1ccc9064e1eb5..dbbf15e7ef6e1 100644
--- a/drivers/soc/ti/knav_qmss_queue.c
+++ b/drivers/soc/ti/knav_qmss_queue.c
@@ -1791,6 +1791,7 @@ static int knav_queue_probe(struct platform_device *pdev)
 	pm_runtime_enable(&pdev->dev);
 	ret = pm_runtime_get_sync(&pdev->dev);
 	if (ret < 0) {
+		pm_runtime_put_noidle(&pdev->dev);
 		dev_err(dev, "Failed to enable QMSS\n");
 		return ret;
 	}
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 155/453] soc: ti: Fix reference imbalance in knav_dma_probe
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (153 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.4 154/453] soc: ti: knav_qmss: fix reference leak in knav_queue_probe Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.4 156/453] drivers: soc: ti: knav_qmss_queue: Fix error return code in knav_queue_probe Greg Kroah-Hartman
                   ` (300 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Zhang Qilong, Santosh Shilimkar, Sasha Levin

From: Zhang Qilong <zhangqilong3@huawei.com>

[ Upstream commit b4fa73358c306d747a2200aec6f7acb97e5750e6 ]

The patch fix two reference leak.

  1) pm_runtime_get_sync will increment pm usage counter even it
     failed. Forgetting to call put operation will result in
     reference leak.

  2) The pm_runtime_enable will increase power disable depth. Thus
     a pairing decrement is needed on the error handling path to
     keep it balanced.

We fix it by: 1) adding call pm_runtime_put_noidle or
pm_runtime_put_sync in error handling. 2) adding pm_runtime_disable
in error handling, to keep usage counter and disable depth balanced.

Fixes: 88139ed030583 ("soc: ti: add Keystone Navigator DMA support")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Signed-off-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/soc/ti/knav_dma.c | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/drivers/soc/ti/knav_dma.c b/drivers/soc/ti/knav_dma.c
index 6285cd8efb21b..981a9014c9c4e 100644
--- a/drivers/soc/ti/knav_dma.c
+++ b/drivers/soc/ti/knav_dma.c
@@ -759,8 +759,9 @@ static int knav_dma_probe(struct platform_device *pdev)
 	pm_runtime_enable(kdev->dev);
 	ret = pm_runtime_get_sync(kdev->dev);
 	if (ret < 0) {
+		pm_runtime_put_noidle(kdev->dev);
 		dev_err(kdev->dev, "unable to enable pktdma, err %d\n", ret);
-		return ret;
+		goto err_pm_disable;
 	}
 
 	/* Initialise all packet dmas */
@@ -774,7 +775,8 @@ static int knav_dma_probe(struct platform_device *pdev)
 
 	if (list_empty(&kdev->list)) {
 		dev_err(dev, "no valid dma instance\n");
-		return -ENODEV;
+		ret = -ENODEV;
+		goto err_put_sync;
 	}
 
 	debugfs_create_file("knav_dma", S_IFREG | S_IRUGO, NULL, NULL,
@@ -782,6 +784,13 @@ static int knav_dma_probe(struct platform_device *pdev)
 
 	device_ready = true;
 	return ret;
+
+err_put_sync:
+	pm_runtime_put_sync(kdev->dev);
+err_pm_disable:
+	pm_runtime_disable(kdev->dev);
+
+	return ret;
 }
 
 static int knav_dma_remove(struct platform_device *pdev)
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 156/453] drivers: soc: ti: knav_qmss_queue: Fix error return code in knav_queue_probe
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (154 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.4 155/453] soc: ti: Fix reference imbalance in knav_dma_probe Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.4 157/453] Input: omap4-keypad - fix runtime PM error handling Greg Kroah-Hartman
                   ` (299 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Zhihao Cheng,
	Santosh Shilimkar, Sasha Levin

From: Zhihao Cheng <chengzhihao1@huawei.com>

[ Upstream commit 4cba398f37f868f515ff12868418dc28574853a1 ]

Fix to return the error code from of_get_child_by_name() instaed of 0
in knav_queue_probe().

Fixes: 41f93af900a20d1a0a ("soc: ti: add Keystone Navigator QMSS driver")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
Signed-off-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/soc/ti/knav_qmss_queue.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/soc/ti/knav_qmss_queue.c b/drivers/soc/ti/knav_qmss_queue.c
index dbbf15e7ef6e1..b8210479ec997 100644
--- a/drivers/soc/ti/knav_qmss_queue.c
+++ b/drivers/soc/ti/knav_qmss_queue.c
@@ -1859,9 +1859,10 @@ static int knav_queue_probe(struct platform_device *pdev)
 	if (ret)
 		goto err;
 
-	regions =  of_get_child_by_name(node, "descriptor-regions");
+	regions = of_get_child_by_name(node, "descriptor-regions");
 	if (!regions) {
 		dev_err(dev, "descriptor-regions not specified\n");
+		ret = -ENODEV;
 		goto err;
 	}
 	ret = knav_queue_setup_regions(kdev, regions);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 157/453] Input: omap4-keypad - fix runtime PM error handling
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (155 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.4 156/453] drivers: soc: ti: knav_qmss_queue: Fix error return code in knav_queue_probe Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.4 158/453] clk: meson: Kconfig: fix dependency for G12A Greg Kroah-Hartman
                   ` (298 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Zhang Qilong, Dmitry Torokhov, Sasha Levin

From: Zhang Qilong <zhangqilong3@huawei.com>

[ Upstream commit 59bbf83835f591b95c3bdd09d900f3584fa227af ]

In omap4_keypad_probe, the patch fix several bugs.

  1) pm_runtime_get_sync will increment pm usage counter even it
     failed. Forgetting to pm_runtime_put_noidle will result in
     reference leak.

  2) In err_unmap, forget to disable runtime of device,
     pm_runtime_enable will increase power disable depth. Thus a
     pairing decrement is needed on the error handling path to keep
     it balanced.

  3) In err_pm_disable, it will call pm_runtime_put_sync twice not
     one time.

To fix this we factor out code reading revision and disabling touchpad, and
drop PM reference once we are done talking to the device.

Fixes: f77621cc640a7 ("Input: omap-keypad - dynamically handle register offsets")
Fixes: 5ad567ffbaf20 ("Input: omap4-keypad - wire up runtime PM handling")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Link: https://lore.kernel.org/r/20201120133918.2559681-1-zhangqilong3@huawei.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/input/keyboard/omap4-keypad.c | 89 ++++++++++++++++-----------
 1 file changed, 53 insertions(+), 36 deletions(-)

diff --git a/drivers/input/keyboard/omap4-keypad.c b/drivers/input/keyboard/omap4-keypad.c
index d6c924032aaa8..dd16f7b3c7ef6 100644
--- a/drivers/input/keyboard/omap4-keypad.c
+++ b/drivers/input/keyboard/omap4-keypad.c
@@ -186,12 +186,8 @@ static int omap4_keypad_open(struct input_dev *input)
 	return 0;
 }
 
-static void omap4_keypad_close(struct input_dev *input)
+static void omap4_keypad_stop(struct omap4_keypad *keypad_data)
 {
-	struct omap4_keypad *keypad_data = input_get_drvdata(input);
-
-	disable_irq(keypad_data->irq);
-
 	/* Disable interrupts and wake-up events */
 	kbd_write_irqreg(keypad_data, OMAP4_KBD_IRQENABLE,
 			 OMAP4_VAL_IRQDISABLE);
@@ -200,7 +196,15 @@ static void omap4_keypad_close(struct input_dev *input)
 	/* clear pending interrupts */
 	kbd_write_irqreg(keypad_data, OMAP4_KBD_IRQSTATUS,
 			 kbd_read_irqreg(keypad_data, OMAP4_KBD_IRQSTATUS));
+}
+
+static void omap4_keypad_close(struct input_dev *input)
+{
+	struct omap4_keypad *keypad_data;
 
+	keypad_data = input_get_drvdata(input);
+	disable_irq(keypad_data->irq);
+	omap4_keypad_stop(keypad_data);
 	enable_irq(keypad_data->irq);
 
 	pm_runtime_put_sync(input->dev.parent);
@@ -223,13 +227,37 @@ static int omap4_keypad_parse_dt(struct device *dev,
 	return 0;
 }
 
+static int omap4_keypad_check_revision(struct device *dev,
+				       struct omap4_keypad *keypad_data)
+{
+	unsigned int rev;
+
+	rev = __raw_readl(keypad_data->base + OMAP4_KBD_REVISION);
+	rev &= 0x03 << 30;
+	rev >>= 30;
+	switch (rev) {
+	case KBD_REVISION_OMAP4:
+		keypad_data->reg_offset = 0x00;
+		keypad_data->irqreg_offset = 0x00;
+		break;
+	case KBD_REVISION_OMAP5:
+		keypad_data->reg_offset = 0x10;
+		keypad_data->irqreg_offset = 0x0c;
+		break;
+	default:
+		dev_err(dev, "Keypad reports unsupported revision %d", rev);
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
 static int omap4_keypad_probe(struct platform_device *pdev)
 {
 	struct omap4_keypad *keypad_data;
 	struct input_dev *input_dev;
 	struct resource *res;
 	unsigned int max_keys;
-	int rev;
 	int irq;
 	int error;
 
@@ -269,41 +297,33 @@ static int omap4_keypad_probe(struct platform_device *pdev)
 		goto err_release_mem;
 	}
 
+	pm_runtime_enable(&pdev->dev);
 
 	/*
 	 * Enable clocks for the keypad module so that we can read
 	 * revision register.
 	 */
-	pm_runtime_enable(&pdev->dev);
 	error = pm_runtime_get_sync(&pdev->dev);
 	if (error) {
 		dev_err(&pdev->dev, "pm_runtime_get_sync() failed\n");
-		goto err_unmap;
-	}
-	rev = __raw_readl(keypad_data->base + OMAP4_KBD_REVISION);
-	rev &= 0x03 << 30;
-	rev >>= 30;
-	switch (rev) {
-	case KBD_REVISION_OMAP4:
-		keypad_data->reg_offset = 0x00;
-		keypad_data->irqreg_offset = 0x00;
-		break;
-	case KBD_REVISION_OMAP5:
-		keypad_data->reg_offset = 0x10;
-		keypad_data->irqreg_offset = 0x0c;
-		break;
-	default:
-		dev_err(&pdev->dev,
-			"Keypad reports unsupported revision %d", rev);
-		error = -EINVAL;
-		goto err_pm_put_sync;
+		pm_runtime_put_noidle(&pdev->dev);
+	} else {
+		error = omap4_keypad_check_revision(&pdev->dev,
+						    keypad_data);
+		if (!error) {
+			/* Ensure device does not raise interrupts */
+			omap4_keypad_stop(keypad_data);
+		}
+		pm_runtime_put_sync(&pdev->dev);
 	}
+	if (error)
+		goto err_pm_disable;
 
 	/* input device allocation */
 	keypad_data->input = input_dev = input_allocate_device();
 	if (!input_dev) {
 		error = -ENOMEM;
-		goto err_pm_put_sync;
+		goto err_pm_disable;
 	}
 
 	input_dev->name = pdev->name;
@@ -349,28 +369,25 @@ static int omap4_keypad_probe(struct platform_device *pdev)
 		goto err_free_keymap;
 	}
 
-	device_init_wakeup(&pdev->dev, true);
-	pm_runtime_put_sync(&pdev->dev);
-
 	error = input_register_device(keypad_data->input);
 	if (error < 0) {
 		dev_err(&pdev->dev, "failed to register input device\n");
-		goto err_pm_disable;
+		goto err_free_irq;
 	}
 
+	device_init_wakeup(&pdev->dev, true);
 	platform_set_drvdata(pdev, keypad_data);
+
 	return 0;
 
-err_pm_disable:
-	pm_runtime_disable(&pdev->dev);
+err_free_irq:
 	free_irq(keypad_data->irq, keypad_data);
 err_free_keymap:
 	kfree(keypad_data->keymap);
 err_free_input:
 	input_free_device(input_dev);
-err_pm_put_sync:
-	pm_runtime_put_sync(&pdev->dev);
-err_unmap:
+err_pm_disable:
+	pm_runtime_disable(&pdev->dev);
 	iounmap(keypad_data->base);
 err_release_mem:
 	release_mem_region(res->start, resource_size(res));
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 158/453] clk: meson: Kconfig: fix dependency for G12A
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (156 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.4 157/453] Input: omap4-keypad - fix runtime PM error handling Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.4 159/453] RDMA/cxgb4: Validate the number of CQEs Greg Kroah-Hartman
                   ` (297 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Kevin Hilman, Jerome Brunet, Sasha Levin

From: Kevin Hilman <khilman@baylibre.com>

[ Upstream commit bae69bfa3a586493469078ec4ca35499b754ba5c ]

When building only G12A, ensure that VID_PLL_DIV clock driver is
selected, otherwise results in this build error:

ERROR: modpost: "meson_vid_pll_div_ro_ops" [drivers/clk/meson/g12a.ko] undefined!

Fixes: 085a4ea93d54 ("clk: meson: g12a: add peripheral clock controller")
Signed-off-by: Kevin Hilman <khilman@baylibre.com>
Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
Link: https://lore.kernel.org/r/20201118190930.34352-1-khilman@baylibre.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/meson/Kconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/clk/meson/Kconfig b/drivers/clk/meson/Kconfig
index dabeb435d0678..3f8dcdcdde499 100644
--- a/drivers/clk/meson/Kconfig
+++ b/drivers/clk/meson/Kconfig
@@ -103,6 +103,7 @@ config COMMON_CLK_G12A
 	select COMMON_CLK_MESON_AO_CLKC
 	select COMMON_CLK_MESON_EE_CLKC
 	select COMMON_CLK_MESON_CPU_DYNDIV
+	select COMMON_CLK_MESON_VID_PLL_DIV
 	select MFD_SYSCON
 	help
 	  Support for the clock controller on Amlogic S905D2, S905X2 and S905Y2
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 159/453] RDMA/cxgb4: Validate the number of CQEs
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (157 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.4 158/453] clk: meson: Kconfig: fix dependency for G12A Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.4 160/453] memstick: fix a double-free bug in memstick_check Greg Kroah-Hartman
                   ` (296 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Kamal Heib, Jason Gunthorpe, Sasha Levin

From: Kamal Heib <kamalheib1@gmail.com>

[ Upstream commit 6d8285e604e0221b67bd5db736921b7ddce37d00 ]

Before create CQ, make sure that the requested number of CQEs is in the
supported range.

Fixes: cfdda9d76436 ("RDMA/cxgb4: Add driver for Chelsio T4 RNIC")
Link: https://lore.kernel.org/r/20201108132007.67537-1-kamalheib1@gmail.com
Signed-off-by: Kamal Heib <kamalheib1@gmail.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/hw/cxgb4/cq.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/infiniband/hw/cxgb4/cq.c b/drivers/infiniband/hw/cxgb4/cq.c
index b1bb61c65f4f6..16b74591a68db 100644
--- a/drivers/infiniband/hw/cxgb4/cq.c
+++ b/drivers/infiniband/hw/cxgb4/cq.c
@@ -1007,6 +1007,9 @@ int c4iw_create_cq(struct ib_cq *ibcq, const struct ib_cq_init_attr *attr,
 	if (attr->flags)
 		return -EINVAL;
 
+	if (entries < 1 || entries > ibdev->attrs.max_cqe)
+		return -EINVAL;
+
 	if (vector >= rhp->rdev.lldi.nciq)
 		return -EINVAL;
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 160/453] memstick: fix a double-free bug in memstick_check
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (158 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.4 159/453] RDMA/cxgb4: Validate the number of CQEs Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.4 161/453] ARM: dts: at91: sama5d4_xplained: add pincontrol for USB Host Greg Kroah-Hartman
                   ` (295 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Qinglang Miao,
	Ulf Hansson, Sasha Levin

From: Qinglang Miao <miaoqinglang@huawei.com>

[ Upstream commit e3e9ced5c93803d5b2ea1942c4bf0192622531d6 ]

kfree(host->card) has been called in put_device so that
another kfree would raise cause a double-free bug.

Fixes: 0193383a5833 ("memstick: core: fix device_register() error handling")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
Link: https://lore.kernel.org/r/20201120074846.31322-1-miaoqinglang@huawei.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/memstick/core/memstick.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/memstick/core/memstick.c b/drivers/memstick/core/memstick.c
index ef03d6fafc5ce..12bc3f5a6cbbd 100644
--- a/drivers/memstick/core/memstick.c
+++ b/drivers/memstick/core/memstick.c
@@ -468,7 +468,6 @@ static void memstick_check(struct work_struct *work)
 			host->card = card;
 			if (device_register(&card->dev)) {
 				put_device(&card->dev);
-				kfree(host->card);
 				host->card = NULL;
 			}
 		} else
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 161/453] ARM: dts: at91: sama5d4_xplained: add pincontrol for USB Host
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (159 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.4 160/453] memstick: fix a double-free bug in memstick_check Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.4 162/453] ARM: dts: at91: sama5d3_xplained: " Greg Kroah-Hartman
                   ` (294 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Cristian Birsan, Alexandre Belloni,
	Ludovic Desroches, Sasha Levin

From: Cristian Birsan <cristian.birsan@microchip.com>

[ Upstream commit be4dd2d448816a27c1446f8f37fce375daf64148 ]

The pincontrol node is needed for USB Host since Linux v5.7-rc1. Without
it the driver probes but VBus is not powered because of wrong pincontrol
configuration.

Fixes: 38153a017896f ("ARM: at91/dt: sama5d4: add dts for sama5d4 xplained board")
Signed-off-by: Cristian Birsan <cristian.birsan@microchip.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Acked-by: Ludovic Desroches <ludovic.desroches@microchip.com>
Link: https://lore.kernel.org/r/20201118120019.1257580-3-cristian.birsan@microchip.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/at91-sama5d4_xplained.dts | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/arch/arm/boot/dts/at91-sama5d4_xplained.dts b/arch/arm/boot/dts/at91-sama5d4_xplained.dts
index fdfc37d716e01..1d101067371b4 100644
--- a/arch/arm/boot/dts/at91-sama5d4_xplained.dts
+++ b/arch/arm/boot/dts/at91-sama5d4_xplained.dts
@@ -133,6 +133,11 @@
 						atmel,pins =
 							<AT91_PIOE 31 AT91_PERIPH_GPIO AT91_PINCTRL_DEGLITCH>;
 					};
+					pinctrl_usb_default: usb_default {
+						atmel,pins =
+							<AT91_PIOE 11 AT91_PERIPH_GPIO AT91_PINCTRL_NONE
+							 AT91_PIOE 14 AT91_PERIPH_GPIO AT91_PINCTRL_NONE>;
+					};
 					pinctrl_key_gpio: key_gpio_0 {
 						atmel,pins =
 							<AT91_PIOE 8 AT91_PERIPH_GPIO AT91_PINCTRL_PULL_UP_DEGLITCH>;
@@ -158,6 +163,8 @@
 					   &pioE 11 GPIO_ACTIVE_HIGH
 					   &pioE 14 GPIO_ACTIVE_HIGH
 					  >;
+			pinctrl-names = "default";
+			pinctrl-0 = <&pinctrl_usb_default>;
 			status = "okay";
 		};
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 162/453] ARM: dts: at91: sama5d3_xplained: add pincontrol for USB Host
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (160 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.4 161/453] ARM: dts: at91: sama5d4_xplained: add pincontrol for USB Host Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.4 163/453] mmc: pxamci: Fix error return code in pxamci_probe Greg Kroah-Hartman
                   ` (293 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Cristian Birsan, Alexandre Belloni,
	Ludovic Desroches, Sasha Levin

From: Cristian Birsan <cristian.birsan@microchip.com>

[ Upstream commit e1062fa7292f1e3744db0a487c4ac0109e09b03d ]

The pincontrol node is needed for USB Host since Linux v5.7-rc1. Without
it the driver probes but VBus is not powered because of wrong pincontrol
configuration.

Fixes: b7c2b61570798 ("ARM: at91: add Atmel's SAMA5D3 Xplained board")
Signed-off-by: Cristian Birsan <cristian.birsan@microchip.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Acked-by: Ludovic Desroches <ludovic.desroches@microchip.com>
Link: https://lore.kernel.org/r/20201118120019.1257580-4-cristian.birsan@microchip.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/at91-sama5d3_xplained.dts | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/arch/arm/boot/dts/at91-sama5d3_xplained.dts b/arch/arm/boot/dts/at91-sama5d3_xplained.dts
index 61f068a7b362a..400eaf640fe42 100644
--- a/arch/arm/boot/dts/at91-sama5d3_xplained.dts
+++ b/arch/arm/boot/dts/at91-sama5d3_xplained.dts
@@ -242,6 +242,11 @@
 						atmel,pins =
 							<AT91_PIOE 9 AT91_PERIPH_GPIO AT91_PINCTRL_DEGLITCH>;	/* PE9, conflicts with A9 */
 					};
+					pinctrl_usb_default: usb_default {
+						atmel,pins =
+							<AT91_PIOE 3 AT91_PERIPH_GPIO AT91_PINCTRL_NONE
+							 AT91_PIOE 4 AT91_PERIPH_GPIO AT91_PINCTRL_NONE>;
+					};
 				};
 			};
 		};
@@ -259,6 +264,8 @@
 					   &pioE 3 GPIO_ACTIVE_LOW
 					   &pioE 4 GPIO_ACTIVE_LOW
 					  >;
+			pinctrl-names = "default";
+			pinctrl-0 = <&pinctrl_usb_default>;
 			status = "okay";
 		};
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 163/453] mmc: pxamci: Fix error return code in pxamci_probe
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (161 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.4 162/453] ARM: dts: at91: sama5d3_xplained: " Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.4 164/453] orinoco: Move context allocation after processing the skb Greg Kroah-Hartman
                   ` (292 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Zhihao Cheng,
	Ulf Hansson, Sasha Levin

From: Zhihao Cheng <chengzhihao1@huawei.com>

[ Upstream commit d7b819b5d33869d41bdaa427aeb98ae24c57a38b ]

Fix to return the error code from devm_gpiod_get_optional() instaed
of 0 in pxamci_probe().

Fixes: f54005b508b9a9d9c ("mmc: pxa: Use GPIO descriptor for power")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
Link: https://lore.kernel.org/r/20201121021431.3168506-1-chengzhihao1@huawei.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mmc/host/pxamci.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/mmc/host/pxamci.c b/drivers/mmc/host/pxamci.c
index b2bbcb09a49e6..953e7457137a2 100644
--- a/drivers/mmc/host/pxamci.c
+++ b/drivers/mmc/host/pxamci.c
@@ -729,6 +729,7 @@ static int pxamci_probe(struct platform_device *pdev)
 
 		host->power = devm_gpiod_get_optional(dev, "power", GPIOD_OUT_LOW);
 		if (IS_ERR(host->power)) {
+			ret = PTR_ERR(host->power);
 			dev_err(dev, "Failed requesting gpio_power\n");
 			goto out;
 		}
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 164/453] orinoco: Move context allocation after processing the skb
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (162 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.4 163/453] mmc: pxamci: Fix error return code in pxamci_probe Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.4 165/453] qtnfmac: fix error return code in qtnf_pcie_probe() Greg Kroah-Hartman
                   ` (291 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sebastian Andrzej Siewior,
	Kalle Valo, Sasha Levin

From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>

[ Upstream commit a31eb615646a63370aa1da1053c45439c7653d83 ]

ezusb_xmit() allocates a context which is leaked if
orinoco_process_xmit_skb() returns an error.

Move ezusb_alloc_ctx() after the invocation of
orinoco_process_xmit_skb() because the context is not needed so early.
ezusb_access_ltv() will cleanup the context in case of an error.

Fixes: bac6fafd4d6a0 ("orinoco: refactor xmit path")
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20201113212252.2243570-2-bigeasy@linutronix.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../net/wireless/intersil/orinoco/orinoco_usb.c    | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/drivers/net/wireless/intersil/orinoco/orinoco_usb.c b/drivers/net/wireless/intersil/orinoco/orinoco_usb.c
index e753f43e0162f..e2368bfe3e468 100644
--- a/drivers/net/wireless/intersil/orinoco/orinoco_usb.c
+++ b/drivers/net/wireless/intersil/orinoco/orinoco_usb.c
@@ -1234,13 +1234,6 @@ static netdev_tx_t ezusb_xmit(struct sk_buff *skb, struct net_device *dev)
 	if (skb->len < ETH_HLEN)
 		goto drop;
 
-	ctx = ezusb_alloc_ctx(upriv, EZUSB_RID_TX, 0);
-	if (!ctx)
-		goto busy;
-
-	memset(ctx->buf, 0, BULK_BUF_SIZE);
-	buf = ctx->buf->data;
-
 	tx_control = 0;
 
 	err = orinoco_process_xmit_skb(skb, dev, priv, &tx_control,
@@ -1248,6 +1241,13 @@ static netdev_tx_t ezusb_xmit(struct sk_buff *skb, struct net_device *dev)
 	if (err)
 		goto drop;
 
+	ctx = ezusb_alloc_ctx(upriv, EZUSB_RID_TX, 0);
+	if (!ctx)
+		goto drop;
+
+	memset(ctx->buf, 0, BULK_BUF_SIZE);
+	buf = ctx->buf->data;
+
 	{
 		__le16 *tx_cntl = (__le16 *)buf;
 		*tx_cntl = cpu_to_le16(tx_control);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 165/453] qtnfmac: fix error return code in qtnf_pcie_probe()
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (163 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.4 164/453] orinoco: Move context allocation after processing the skb Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.4 166/453] rsi: fix error return code in rsi_reset_card() Greg Kroah-Hartman
                   ` (290 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Wang Hai, Kalle Valo,
	Sasha Levin

From: Wang Hai <wanghai38@huawei.com>

[ Upstream commit 31e07aa33fa7cdc93fa91c3f78f031e8d38862c2 ]

Fix to return a negative error code from the error handling
case instead of 0, as done elsewhere in this function.

Fixes: b7da53cd6cd1 ("qtnfmac_pcie: use single PCIe driver for all platforms")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Wang Hai <wanghai38@huawei.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20201114123347.29632-1-wanghai38@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/quantenna/qtnfmac/pcie/pcie.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/net/wireless/quantenna/qtnfmac/pcie/pcie.c b/drivers/net/wireless/quantenna/qtnfmac/pcie/pcie.c
index 4824be0c6231e..2b8db3f73d00b 100644
--- a/drivers/net/wireless/quantenna/qtnfmac/pcie/pcie.c
+++ b/drivers/net/wireless/quantenna/qtnfmac/pcie/pcie.c
@@ -299,19 +299,19 @@ static int qtnf_pcie_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 	sysctl_bar = qtnf_map_bar(pdev, QTN_SYSCTL_BAR);
 	if (IS_ERR(sysctl_bar)) {
 		pr_err("failed to map BAR%u\n", QTN_SYSCTL_BAR);
-		return ret;
+		return PTR_ERR(sysctl_bar);
 	}
 
 	dmareg_bar = qtnf_map_bar(pdev, QTN_DMA_BAR);
 	if (IS_ERR(dmareg_bar)) {
 		pr_err("failed to map BAR%u\n", QTN_DMA_BAR);
-		return ret;
+		return PTR_ERR(dmareg_bar);
 	}
 
 	epmem_bar = qtnf_map_bar(pdev, QTN_SHMEM_BAR);
 	if (IS_ERR(epmem_bar)) {
 		pr_err("failed to map BAR%u\n", QTN_SHMEM_BAR);
-		return ret;
+		return PTR_ERR(epmem_bar);
 	}
 
 	chipid = qtnf_chip_id_get(sysctl_bar);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 166/453] rsi: fix error return code in rsi_reset_card()
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (164 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.4 165/453] qtnfmac: fix error return code in qtnf_pcie_probe() Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.4 167/453] cw1200: fix missing destroy_workqueue() on error in cw1200_init_common Greg Kroah-Hartman
                   ` (289 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Zhang Changzhong,
	Kalle Valo, Sasha Levin

From: Zhang Changzhong <zhangchangzhong@huawei.com>

[ Upstream commit fb21d14694bd46a538258d86498736490b3ba855 ]

Fix to return a negative error code from the error handling
case instead of 0, as done elsewhere in this function.

Fixes: 17ff2c794f39 ("rsi: reset device changes for 9116")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/1605582454-39649-1-git-send-email-zhangchangzhong@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/rsi/rsi_91x_usb.c | 30 +++++++++++++-------------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/drivers/net/wireless/rsi/rsi_91x_usb.c b/drivers/net/wireless/rsi/rsi_91x_usb.c
index 4b9e406b84612..a296f4e0d324a 100644
--- a/drivers/net/wireless/rsi/rsi_91x_usb.c
+++ b/drivers/net/wireless/rsi/rsi_91x_usb.c
@@ -733,24 +733,24 @@ static int rsi_reset_card(struct rsi_hw *adapter)
 		if (ret < 0)
 			goto fail;
 	} else {
-		if ((rsi_usb_master_reg_write(adapter,
-					      NWP_WWD_INTERRUPT_TIMER,
-					      NWP_WWD_INT_TIMER_CLKS,
-					      RSI_9116_REG_SIZE)) < 0) {
+		ret = rsi_usb_master_reg_write(adapter,
+					       NWP_WWD_INTERRUPT_TIMER,
+					       NWP_WWD_INT_TIMER_CLKS,
+					       RSI_9116_REG_SIZE);
+		if (ret < 0)
 			goto fail;
-		}
-		if ((rsi_usb_master_reg_write(adapter,
-					      NWP_WWD_SYSTEM_RESET_TIMER,
-					      NWP_WWD_SYS_RESET_TIMER_CLKS,
-					      RSI_9116_REG_SIZE)) < 0) {
+		ret = rsi_usb_master_reg_write(adapter,
+					       NWP_WWD_SYSTEM_RESET_TIMER,
+					       NWP_WWD_SYS_RESET_TIMER_CLKS,
+					       RSI_9116_REG_SIZE);
+		if (ret < 0)
 			goto fail;
-		}
-		if ((rsi_usb_master_reg_write(adapter,
-					      NWP_WWD_MODE_AND_RSTART,
-					      NWP_WWD_TIMER_DISABLE,
-					      RSI_9116_REG_SIZE)) < 0) {
+		ret = rsi_usb_master_reg_write(adapter,
+					       NWP_WWD_MODE_AND_RSTART,
+					       NWP_WWD_TIMER_DISABLE,
+					       RSI_9116_REG_SIZE);
+		if (ret < 0)
 			goto fail;
-		}
 	}
 
 	rsi_dbg(INFO_ZONE, "Reset card done\n");
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 167/453] cw1200: fix missing destroy_workqueue() on error in cw1200_init_common
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (165 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.4 166/453] rsi: fix error return code in rsi_reset_card() Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.4 168/453] dmaengine: mv_xor_v2: Fix error return code in mv_xor_v2_probe() Greg Kroah-Hartman
                   ` (288 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Qinglang Miao,
	Kalle Valo, Sasha Levin

From: Qinglang Miao <miaoqinglang@huawei.com>

[ Upstream commit 7ec8a926188eb8e7a3cbaca43ec44f2d7146d71b ]

Add the missing destroy_workqueue() before return from
cw1200_init_common in the error handling case.

Fixes: a910e4a94f69 ("cw1200: add driver for the ST-E CW1100 & CW1200 WLAN chipsets")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20201119070842.1011-1-miaoqinglang@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/st/cw1200/main.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/wireless/st/cw1200/main.c b/drivers/net/wireless/st/cw1200/main.c
index f7fe56affbcd2..326b1cc1d2bcb 100644
--- a/drivers/net/wireless/st/cw1200/main.c
+++ b/drivers/net/wireless/st/cw1200/main.c
@@ -381,6 +381,7 @@ static struct ieee80211_hw *cw1200_init_common(const u8 *macaddr,
 				    CW1200_LINK_ID_MAX,
 				    cw1200_skb_dtor,
 				    priv)) {
+		destroy_workqueue(priv->workqueue);
 		ieee80211_free_hw(hw);
 		return NULL;
 	}
@@ -392,6 +393,7 @@ static struct ieee80211_hw *cw1200_init_common(const u8 *macaddr,
 			for (; i > 0; i--)
 				cw1200_queue_deinit(&priv->tx_queue[i - 1]);
 			cw1200_queue_stats_deinit(&priv->tx_queue_stats);
+			destroy_workqueue(priv->workqueue);
 			ieee80211_free_hw(hw);
 			return NULL;
 		}
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 168/453] dmaengine: mv_xor_v2: Fix error return code in mv_xor_v2_probe()
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (166 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.4 167/453] cw1200: fix missing destroy_workqueue() on error in cw1200_init_common Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.4 169/453] leds: netxbig: add missing put_device() call in netxbig_leds_get_of_pdata() Greg Kroah-Hartman
                   ` (287 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Zhihao Cheng, Vinod Koul,
	Sasha Levin

From: Zhihao Cheng <chengzhihao1@huawei.com>

[ Upstream commit c95e6515a8c065862361f7e0e452978ade7f94ec ]

Return the corresponding error code when first_msi_entry() returns
NULL in mv_xor_v2_probe().

Fixes: 19a340b1a820430 ("dmaengine: mv_xor_v2: new driver")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
Link: https://lore.kernel.org/r/20201124010813.1939095-1-chengzhihao1@huawei.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/dma/mv_xor_v2.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/dma/mv_xor_v2.c b/drivers/dma/mv_xor_v2.c
index e3850f04f6763..889a94af4c851 100644
--- a/drivers/dma/mv_xor_v2.c
+++ b/drivers/dma/mv_xor_v2.c
@@ -766,8 +766,10 @@ static int mv_xor_v2_probe(struct platform_device *pdev)
 		goto disable_clk;
 
 	msi_desc = first_msi_entry(&pdev->dev);
-	if (!msi_desc)
+	if (!msi_desc) {
+		ret = -ENODEV;
 		goto free_msi_irqs;
+	}
 	xor_dev->msi_desc = msi_desc;
 
 	ret = devm_request_irq(&pdev->dev, msi_desc->irq,
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 169/453] leds: netxbig: add missing put_device() call in netxbig_leds_get_of_pdata()
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (167 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.4 168/453] dmaengine: mv_xor_v2: Fix error return code in mv_xor_v2_probe() Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.4 170/453] arm64: tegra: Fix DT binding for IO High Voltage entry Greg Kroah-Hartman
                   ` (286 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yu Kuai, Pavel Machek, Sasha Levin

From: Yu Kuai <yukuai3@huawei.com>

[ Upstream commit 311066aa9ebcd6f1789c829da5039ca02f2dfe46 ]

if of_find_device_by_node() succeed, netxbig_leds_get_of_pdata() doesn't
have a corresponding put_device(). Thus add jump target to fix the
exception handling for this function implementation.

Fixes: 2976b1798909 ("leds: netxbig: add device tree binding")
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
Signed-off-by: Pavel Machek <pavel@ucw.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/leds/leds-netxbig.c | 35 ++++++++++++++++++++++++-----------
 1 file changed, 24 insertions(+), 11 deletions(-)

diff --git a/drivers/leds/leds-netxbig.c b/drivers/leds/leds-netxbig.c
index 14ef4ccdda3a8..c8699454418df 100644
--- a/drivers/leds/leds-netxbig.c
+++ b/drivers/leds/leds-netxbig.c
@@ -430,31 +430,39 @@ static int netxbig_leds_get_of_pdata(struct device *dev,
 	gpio_ext = devm_kzalloc(dev, sizeof(*gpio_ext), GFP_KERNEL);
 	if (!gpio_ext) {
 		of_node_put(gpio_ext_np);
-		return -ENOMEM;
+		ret = -ENOMEM;
+		goto put_device;
 	}
 	ret = gpio_ext_get_of_pdata(dev, gpio_ext_np, gpio_ext);
 	of_node_put(gpio_ext_np);
 	if (ret)
-		return ret;
+		goto put_device;
 	pdata->gpio_ext = gpio_ext;
 
 	/* Timers (optional) */
 	ret = of_property_count_u32_elems(np, "timers");
 	if (ret > 0) {
-		if (ret % 3)
-			return -EINVAL;
+		if (ret % 3) {
+			ret = -EINVAL;
+			goto put_device;
+		}
+
 		num_timers = ret / 3;
 		timers = devm_kcalloc(dev, num_timers, sizeof(*timers),
 				      GFP_KERNEL);
-		if (!timers)
-			return -ENOMEM;
+		if (!timers) {
+			ret = -ENOMEM;
+			goto put_device;
+		}
 		for (i = 0; i < num_timers; i++) {
 			u32 tmp;
 
 			of_property_read_u32_index(np, "timers", 3 * i,
 						   &timers[i].mode);
-			if (timers[i].mode >= NETXBIG_LED_MODE_NUM)
-				return -EINVAL;
+			if (timers[i].mode >= NETXBIG_LED_MODE_NUM) {
+				ret = -EINVAL;
+				goto put_device;
+			}
 			of_property_read_u32_index(np, "timers",
 						   3 * i + 1, &tmp);
 			timers[i].delay_on = tmp;
@@ -470,12 +478,15 @@ static int netxbig_leds_get_of_pdata(struct device *dev,
 	num_leds = of_get_child_count(np);
 	if (!num_leds) {
 		dev_err(dev, "No LED subnodes found in DT\n");
-		return -ENODEV;
+		ret = -ENODEV;
+		goto put_device;
 	}
 
 	leds = devm_kcalloc(dev, num_leds, sizeof(*leds), GFP_KERNEL);
-	if (!leds)
-		return -ENOMEM;
+	if (!leds) {
+		ret = -ENOMEM;
+		goto put_device;
+	}
 
 	led = leds;
 	for_each_child_of_node(np, child) {
@@ -556,6 +567,8 @@ static int netxbig_leds_get_of_pdata(struct device *dev,
 
 err_node_put:
 	of_node_put(child);
+put_device:
+	put_device(gpio_ext_dev);
 	return ret;
 }
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 170/453] arm64: tegra: Fix DT binding for IO High Voltage entry
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (168 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.4 169/453] leds: netxbig: add missing put_device() call in netxbig_leds_get_of_pdata() Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.4 171/453] media: siano: fix memory leak of debugfs members in smsdvb_hotplug Greg Kroah-Hartman
                   ` (285 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Vidya Sagar, Thierry Reding, Sasha Levin

From: Vidya Sagar <vidyas@nvidia.com>

[ Upstream commit 6b26c1a034885923822f6c4d94f8644d32bc2481 ]

Fix the device-tree entry that represents I/O High Voltage property
by replacing 'nvidia,io-high-voltage' with 'nvidia,io-hv' as the former
entry is deprecated.

Fixes: dbb72e2c305b ("arm64: tegra: Add configuration for PCIe C5 sideband signals")
Signed-off-by: Vidya Sagar <vidyas@nvidia.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/nvidia/tegra194.dtsi | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm64/boot/dts/nvidia/tegra194.dtsi b/arch/arm64/boot/dts/nvidia/tegra194.dtsi
index 78f7e6e50beb0..0821754f0fd6d 100644
--- a/arch/arm64/boot/dts/nvidia/tegra194.dtsi
+++ b/arch/arm64/boot/dts/nvidia/tegra194.dtsi
@@ -144,7 +144,7 @@
 					nvidia,schmitt = <TEGRA_PIN_DISABLE>;
 					nvidia,lpdr = <TEGRA_PIN_ENABLE>;
 					nvidia,enable-input = <TEGRA_PIN_DISABLE>;
-					nvidia,io-high-voltage = <TEGRA_PIN_ENABLE>;
+					nvidia,io-hv = <TEGRA_PIN_ENABLE>;
 					nvidia,tristate = <TEGRA_PIN_DISABLE>;
 					nvidia,pull = <TEGRA_PIN_PULL_NONE>;
 				};
@@ -156,7 +156,7 @@
 					nvidia,schmitt = <TEGRA_PIN_DISABLE>;
 					nvidia,lpdr = <TEGRA_PIN_ENABLE>;
 					nvidia,enable-input = <TEGRA_PIN_ENABLE>;
-					nvidia,io-high-voltage = <TEGRA_PIN_ENABLE>;
+					nvidia,io-hv = <TEGRA_PIN_ENABLE>;
 					nvidia,tristate = <TEGRA_PIN_DISABLE>;
 					nvidia,pull = <TEGRA_PIN_PULL_NONE>;
 				};
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 171/453] media: siano: fix memory leak of debugfs members in smsdvb_hotplug
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (169 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.4 170/453] arm64: tegra: Fix DT binding for IO High Voltage entry Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.4 172/453] platform/x86: mlx-platform: Remove PSU EEPROM from default platform configuration Greg Kroah-Hartman
                   ` (284 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Keita Suzuki, Sean Young,
	Mauro Carvalho Chehab, Sasha Levin

From: Keita Suzuki <keitasuzuki.park@sslab.ics.keio.ac.jp>

[ Upstream commit abf287eeff4c6da6aa804bbd429dfd9d0dfb6ea7 ]

When dvb_create_media_graph fails, the debugfs kept inside client should
be released. However, the current implementation does not release them.

Fix this by adding a new goto label to call smsdvb_debugfs_release.

Fixes: 0d3ab8410dcb ("[media] dvb core: must check dvb_create_media_graph()")
Signed-off-by: Keita Suzuki <keitasuzuki.park@sslab.ics.keio.ac.jp>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/common/siano/smsdvb-main.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/media/common/siano/smsdvb-main.c b/drivers/media/common/siano/smsdvb-main.c
index 88f90dfd368b1..ae17407e477a4 100644
--- a/drivers/media/common/siano/smsdvb-main.c
+++ b/drivers/media/common/siano/smsdvb-main.c
@@ -1169,12 +1169,15 @@ static int smsdvb_hotplug(struct smscore_device_t *coredev,
 	rc = dvb_create_media_graph(&client->adapter, true);
 	if (rc < 0) {
 		pr_err("dvb_create_media_graph failed %d\n", rc);
-		goto client_error;
+		goto media_graph_error;
 	}
 
 	pr_info("DVB interface registered.\n");
 	return 0;
 
+media_graph_error:
+	smsdvb_debugfs_release(client);
+
 client_error:
 	dvb_unregister_frontend(&client->frontend);
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 172/453] platform/x86: mlx-platform: Remove PSU EEPROM from default platform configuration
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (170 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.4 171/453] media: siano: fix memory leak of debugfs members in smsdvb_hotplug Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.4 173/453] platform/x86: mlx-platform: Remove PSU EEPROM from MSN274x " Greg Kroah-Hartman
                   ` (283 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Vadim Pasternak, Hans de Goede, Sasha Levin

From: Vadim Pasternak <vadimp@nvidia.com>

[ Upstream commit 2bf5046bdb649908df8bcc0a012c56eee931a9af ]

Remove PSU EEPROM configuration for systems class equipped with
Mellanox chip Spectrum and Celeron CPU - system types MSN2700, MSN2100.
Till now all the systems from this class used few types of power units,
all equipped with EEPROM device with address space two bytes. Thus, all
these devices have been handled by EEPROM driver "24c02".

There is a new requirement is to support power unit replacement by "off
the shelf" device, matching electrical required parameters. Such device
can be equipped with different EEPROM type, which could be one byte
address space addressing or even could be not equipped with EEPROM.
In such case "24c02" will not work.

Fixes: c6acad68e ("platform/mellanox: mlxreg-hotplug: Modify to use a regmap interface")
Fixes: ba814fdd0 ("platform/x86: mlx-platform: Use defines for bus assignment")
Signed-off-by: Vadim Pasternak <vadimp@nvidia.com>
Link: https://lore.kernel.org/r/20201125101056.174708-2-vadimp@nvidia.com
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/x86/mlx-platform.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/drivers/platform/x86/mlx-platform.c b/drivers/platform/x86/mlx-platform.c
index 59b5b7eebb05a..bd57d3bbaa432 100644
--- a/drivers/platform/x86/mlx-platform.c
+++ b/drivers/platform/x86/mlx-platform.c
@@ -273,15 +273,13 @@ static struct mlxreg_core_data mlxplat_mlxcpld_default_psu_items_data[] = {
 		.label = "psu1",
 		.reg = MLXPLAT_CPLD_LPC_REG_PSU_OFFSET,
 		.mask = BIT(0),
-		.hpdev.brdinfo = &mlxplat_mlxcpld_psu[0],
-		.hpdev.nr = MLXPLAT_CPLD_PSU_DEFAULT_NR,
+		.hpdev.nr = MLXPLAT_CPLD_NR_NONE,
 	},
 	{
 		.label = "psu2",
 		.reg = MLXPLAT_CPLD_LPC_REG_PSU_OFFSET,
 		.mask = BIT(1),
-		.hpdev.brdinfo = &mlxplat_mlxcpld_psu[1],
-		.hpdev.nr = MLXPLAT_CPLD_PSU_DEFAULT_NR,
+		.hpdev.nr = MLXPLAT_CPLD_NR_NONE,
 	},
 };
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 173/453] platform/x86: mlx-platform: Remove PSU EEPROM from MSN274x platform configuration
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (171 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.4 172/453] platform/x86: mlx-platform: Remove PSU EEPROM from default platform configuration Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.4 174/453] samples: bpf: Fix lwt_len_hist reusing previous BPF map Greg Kroah-Hartman
                   ` (282 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Vadim Pasternak, Hans de Goede, Sasha Levin

From: Vadim Pasternak <vadimp@nvidia.com>

[ Upstream commit 912b341585e302ee44fc5a2733f7bcf505e2c86f ]

Remove PSU EEPROM configuration for systems class equipped with
Mellanox chip Spectrum and ATOM CPU - system types MSN274x. Till now
all the systems from this class used few types of power units, all
equipped with EEPROM device with address space two bytes. Thus, all
these devices have been handled by EEPROM driver "24c02".

There is a new requirement is to support power unit replacement by "off
the shelf" device, matching electrical required parameters. Such device
can be equipped with different EEPROM type, which could be one byte
address space addressing or even could be not equipped with EEPROM.
In such case "24c02" will not work.

Fixes: ef08e14a3 ("platform/x86: mlx-platform: Add support for new msn274x system type")
Signed-off-by: Vadim Pasternak <vadimp@nvidia.com>
Link: https://lore.kernel.org/r/20201125101056.174708-3-vadimp@nvidia.com
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/x86/mlx-platform.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/drivers/platform/x86/mlx-platform.c b/drivers/platform/x86/mlx-platform.c
index bd57d3bbaa432..4b3d94c4a939a 100644
--- a/drivers/platform/x86/mlx-platform.c
+++ b/drivers/platform/x86/mlx-platform.c
@@ -442,15 +442,13 @@ static struct mlxreg_core_data mlxplat_mlxcpld_msn274x_psu_items_data[] = {
 		.label = "psu1",
 		.reg = MLXPLAT_CPLD_LPC_REG_PSU_OFFSET,
 		.mask = BIT(0),
-		.hpdev.brdinfo = &mlxplat_mlxcpld_psu[0],
-		.hpdev.nr = MLXPLAT_CPLD_PSU_MSNXXXX_NR,
+		.hpdev.nr = MLXPLAT_CPLD_NR_NONE,
 	},
 	{
 		.label = "psu2",
 		.reg = MLXPLAT_CPLD_LPC_REG_PSU_OFFSET,
 		.mask = BIT(1),
-		.hpdev.brdinfo = &mlxplat_mlxcpld_psu[1],
-		.hpdev.nr = MLXPLAT_CPLD_PSU_MSNXXXX_NR,
+		.hpdev.nr = MLXPLAT_CPLD_NR_NONE,
 	},
 };
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 174/453] samples: bpf: Fix lwt_len_hist reusing previous BPF map
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (172 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.4 173/453] platform/x86: mlx-platform: Remove PSU EEPROM from MSN274x " Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.4 175/453] media: imx214: Fix stop streaming Greg Kroah-Hartman
                   ` (281 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Daniel T. Lee, Andrii Nakryiko, Sasha Levin

From: Daniel T. Lee <danieltimlee@gmail.com>

[ Upstream commit 0afe0a998c40085a6342e1aeb4c510cccba46caf ]

Currently, lwt_len_hist's map lwt_len_hist_map is uses pinning, and the
map isn't cleared on test end. This leds to reuse of that map for
each test, which prevents the results of the test from being accurate.

This commit fixes the problem by removing of pinned map from bpffs.
Also, this commit add the executable permission to shell script
files.

Fixes: f74599f7c5309 ("bpf: Add tests and samples for LWT-BPF")
Signed-off-by: Daniel T. Lee <danieltimlee@gmail.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20201124090310.24374-7-danieltimlee@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 samples/bpf/lwt_len_hist.sh | 2 ++
 samples/bpf/test_lwt_bpf.sh | 0
 2 files changed, 2 insertions(+)
 mode change 100644 => 100755 samples/bpf/lwt_len_hist.sh
 mode change 100644 => 100755 samples/bpf/test_lwt_bpf.sh

diff --git a/samples/bpf/lwt_len_hist.sh b/samples/bpf/lwt_len_hist.sh
old mode 100644
new mode 100755
index 090b96eaf7f76..0eda9754f50b8
--- a/samples/bpf/lwt_len_hist.sh
+++ b/samples/bpf/lwt_len_hist.sh
@@ -8,6 +8,8 @@ VETH1=tst_lwt1b
 TRACE_ROOT=/sys/kernel/debug/tracing
 
 function cleanup {
+	# To reset saved histogram, remove pinned map
+	rm /sys/fs/bpf/tc/globals/lwt_len_hist_map
 	ip route del 192.168.253.2/32 dev $VETH0 2> /dev/null
 	ip link del $VETH0 2> /dev/null
 	ip link del $VETH1 2> /dev/null
diff --git a/samples/bpf/test_lwt_bpf.sh b/samples/bpf/test_lwt_bpf.sh
old mode 100644
new mode 100755
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 175/453] media: imx214: Fix stop streaming
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (173 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.4 174/453] samples: bpf: Fix lwt_len_hist reusing previous BPF map Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.4 176/453] mips: cdmm: fix use-after-free in mips_cdmm_bus_discover Greg Kroah-Hartman
                   ` (280 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Daniel Gomez, Ricardo Ribalda,
	Mauro Carvalho Chehab, Sasha Levin

From: Daniel Gomez <daniel@qtec.com>

[ Upstream commit eeb76afbe8d91e112396c6281cd020725160f006 ]

Stop video streaming when requested.

When s_stream is called to stop the video streaming, if/else condition calls
start_streaming function instead of the one for stopping it.

Fixes: 436190596241 ("media: imx214: Add imx214 camera sensor driver")
Signed-off-by: Daniel Gomez <daniel@qtec.com>
Signed-off-by: Ricardo Ribalda <ribalda@kernel.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/i2c/imx214.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/i2c/imx214.c b/drivers/media/i2c/imx214.c
index 159a3a604f0ed..24659cb0d0833 100644
--- a/drivers/media/i2c/imx214.c
+++ b/drivers/media/i2c/imx214.c
@@ -785,7 +785,7 @@ static int imx214_s_stream(struct v4l2_subdev *subdev, int enable)
 		if (ret < 0)
 			goto err_rpm_put;
 	} else {
-		ret = imx214_start_streaming(imx214);
+		ret = imx214_stop_streaming(imx214);
 		if (ret < 0)
 			goto err_rpm_put;
 		pm_runtime_put(imx214->dev);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 176/453] mips: cdmm: fix use-after-free in mips_cdmm_bus_discover
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (174 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.4 175/453] media: imx214: Fix stop streaming Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.4 177/453] media: max2175: fix max2175_set_csm_mode() error code Greg Kroah-Hartman
                   ` (279 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Qinglang Miao,
	Serge Semin, Thomas Bogendoerfer, Sasha Levin

From: Qinglang Miao <miaoqinglang@huawei.com>

[ Upstream commit f0e82242b16826077a2775eacfe201d803bb7a22 ]

kfree(dev) has been called inside put_device so anther
kfree would cause a use-after-free bug/

Fixes: 8286ae03308c ("MIPS: Add CDMM bus support")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
Acked-by: Serge Semin <fancer.lancer@gmail.com>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/bus/mips_cdmm.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/drivers/bus/mips_cdmm.c b/drivers/bus/mips_cdmm.c
index 1b14256376d24..7c1da45be166e 100644
--- a/drivers/bus/mips_cdmm.c
+++ b/drivers/bus/mips_cdmm.c
@@ -544,10 +544,8 @@ static void mips_cdmm_bus_discover(struct mips_cdmm_bus *bus)
 		dev_set_name(&dev->dev, "cdmm%u-%u", cpu, id);
 		++id;
 		ret = device_register(&dev->dev);
-		if (ret) {
+		if (ret)
 			put_device(&dev->dev);
-			kfree(dev);
-		}
 	}
 }
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 177/453] media: max2175: fix max2175_set_csm_mode() error code
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (175 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.4 176/453] mips: cdmm: fix use-after-free in mips_cdmm_bus_discover Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.4 178/453] slimbus: qcom-ngd-ctrl: Avoid sending power requests without QMI Greg Kroah-Hartman
                   ` (278 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Mauro Carvalho Chehab,
	Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit 9b1b0cb0636166187478ef68d5b95f5caea062ec ]

This is supposed to return negative error codes but the type is bool so
it returns true instead.

Fixes: b47b79d8a231 ("[media] media: i2c: max2175: Add MAX2175 support")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/i2c/max2175.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/i2c/max2175.c b/drivers/media/i2c/max2175.c
index 19a3ceea3bc20..a62d7e2ac3567 100644
--- a/drivers/media/i2c/max2175.c
+++ b/drivers/media/i2c/max2175.c
@@ -503,7 +503,7 @@ static void max2175_set_bbfilter(struct max2175 *ctx)
 	}
 }
 
-static bool max2175_set_csm_mode(struct max2175 *ctx,
+static int max2175_set_csm_mode(struct max2175 *ctx,
 			  enum max2175_csm_mode new_mode)
 {
 	int ret = max2175_poll_csm_ready(ctx);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 178/453] slimbus: qcom-ngd-ctrl: Avoid sending power requests without QMI
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (176 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.4 177/453] media: max2175: fix max2175_set_csm_mode() error code Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.4 179/453] HSI: omap_ssi: Dont jump to free ID in ssi_add_controller() Greg Kroah-Hartman
                   ` (277 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Bjorn Andersson, Srinivas Kandagatla,
	Sasha Levin

From: Bjorn Andersson <bjorn.andersson@linaro.org>

[ Upstream commit 39014ce6d6028614a46395923a2c92d058b6fa87 ]

Attempting to send a power request during PM operations, when the QMI
handle isn't initialized results in a NULL pointer dereference. So check
if the QMI handle has been initialized before attempting to post the
power requests.

Fixes: 917809e2280b ("slimbus: ngd: Add qcom SLIMBus NGD driver")
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Link: https://lore.kernel.org/r/20201127102451.17114-7-srinivas.kandagatla@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/slimbus/qcom-ngd-ctrl.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/slimbus/qcom-ngd-ctrl.c b/drivers/slimbus/qcom-ngd-ctrl.c
index ce265bf7de868..b60541c3f72da 100644
--- a/drivers/slimbus/qcom-ngd-ctrl.c
+++ b/drivers/slimbus/qcom-ngd-ctrl.c
@@ -1201,6 +1201,9 @@ static int qcom_slim_ngd_runtime_resume(struct device *dev)
 	struct qcom_slim_ngd_ctrl *ctrl = dev_get_drvdata(dev);
 	int ret = 0;
 
+	if (!ctrl->qmi.handle)
+		return 0;
+
 	if (ctrl->state >= QCOM_SLIM_NGD_CTRL_ASLEEP)
 		ret = qcom_slim_ngd_power_up(ctrl);
 	if (ret) {
@@ -1497,6 +1500,9 @@ static int __maybe_unused qcom_slim_ngd_runtime_suspend(struct device *dev)
 	struct qcom_slim_ngd_ctrl *ctrl = dev_get_drvdata(dev);
 	int ret = 0;
 
+	if (!ctrl->qmi.handle)
+		return 0;
+
 	ret = qcom_slim_qmi_power_request(ctrl, false);
 	if (ret && ret != -EBUSY)
 		dev_info(ctrl->dev, "slim resource not idle:%d\n", ret);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 179/453] HSI: omap_ssi: Dont jump to free ID in ssi_add_controller()
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (177 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.4 178/453] slimbus: qcom-ngd-ctrl: Avoid sending power requests without QMI Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.4 180/453] ARM: dts: Remove non-existent i2c1 from 98dx3236 Greg Kroah-Hartman
                   ` (276 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jing Xiangfeng, Sebastian Reichel,
	Sasha Levin

From: Jing Xiangfeng <jingxiangfeng@huawei.com>

[ Upstream commit 41fff6e19bc8d6d8bca79ea388427c426e72e097 ]

In current code, it jumps to ida_simple_remove() when ida_simple_get()
failes to allocate an ID. Just return to fix it.

Fixes: 0fae198988b8 ("HSI: omap_ssi: built omap_ssi and omap_ssi_port into one module")
Signed-off-by: Jing Xiangfeng <jingxiangfeng@huawei.com>
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hsi/controllers/omap_ssi_core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/hsi/controllers/omap_ssi_core.c b/drivers/hsi/controllers/omap_ssi_core.c
index 4bc4a201f0f6c..2be9c01e175ca 100644
--- a/drivers/hsi/controllers/omap_ssi_core.c
+++ b/drivers/hsi/controllers/omap_ssi_core.c
@@ -355,7 +355,7 @@ static int ssi_add_controller(struct hsi_controller *ssi,
 
 	err = ida_simple_get(&platform_omap_ssi_ida, 0, 0, GFP_KERNEL);
 	if (err < 0)
-		goto out_err;
+		return err;
 	ssi->id = err;
 
 	ssi->owner = THIS_MODULE;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 180/453] ARM: dts: Remove non-existent i2c1 from 98dx3236
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (178 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.4 179/453] HSI: omap_ssi: Dont jump to free ID in ssi_add_controller() Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.4 181/453] arm64: dts: armada-3720-turris-mox: update ethernet-phy handle name Greg Kroah-Hartman
                   ` (275 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chris Packham, Andrew Lunn,
	Gregory CLEMENT, Sasha Levin

From: Chris Packham <chris.packham@alliedtelesis.co.nz>

[ Upstream commit 7f24479ead579459106bb55c2320a000135731f9 ]

The switches with integrated CPUs have only got a single i2c controller.
They incorrectly gained one when they were split from the Armada-XP.

Fixes: 43e28ba87708 ("ARM: dts: Use armada-370-xp as a base for armada-xp-98dx3236")
Signed-off-by: Chris Packham <chris.packham@alliedtelesis.co.nz>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/armada-xp-98dx3236.dtsi | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/arch/arm/boot/dts/armada-xp-98dx3236.dtsi b/arch/arm/boot/dts/armada-xp-98dx3236.dtsi
index 267d0c178e55c..30abb4b64a1b6 100644
--- a/arch/arm/boot/dts/armada-xp-98dx3236.dtsi
+++ b/arch/arm/boot/dts/armada-xp-98dx3236.dtsi
@@ -266,11 +266,6 @@
 	reg = <0x11000 0x100>;
 };
 
-&i2c1 {
-	compatible = "marvell,mv78230-i2c", "marvell,mv64xxx-i2c";
-	reg = <0x11100 0x100>;
-};
-
 &mpic {
 	reg = <0x20a00 0x2d0>, <0x21070 0x58>;
 };
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 181/453] arm64: dts: armada-3720-turris-mox: update ethernet-phy handle name
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (179 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.4 180/453] ARM: dts: Remove non-existent i2c1 from 98dx3236 Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.4 182/453] arm64: dts: rockchip: Set dr_mode to "host" for OTG on rk3328-roc-cc Greg Kroah-Hartman
                   ` (274 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Marek Behún, Gregory CLEMENT,
	Andrew Lunn, Rob Herring, devicetree, Sasha Levin

From: Marek Behún <kabel@kernel.org>

[ Upstream commit 3aa669a994c9110a2dc7e08a5c0958a9ea5eb17c ]

Use property name `phy-handle` instead of the deprecated `phy` to
connect eth2 to the PHY.

Signed-off-by: Marek Behún <kabel@kernel.org>
Fixes: 7109d817db2e ("arm64: dts: marvell: add DTS for Turris Mox")
Cc: Gregory CLEMENT <gregory.clement@bootlin.com>
Cc: Andrew Lunn <andrew@lunn.ch>
Cc: Rob Herring <robh+dt@kernel.org>
Cc: devicetree@vger.kernel.org
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts b/arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts
index c3668187b8446..aa52927e2e9c2 100644
--- a/arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts
+++ b/arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts
@@ -144,7 +144,7 @@
 	pinctrl-names = "default";
 	pinctrl-0 = <&rgmii_pins>;
 	phy-mode = "rgmii-id";
-	phy = <&phy1>;
+	phy-handle = <&phy1>;
 	status = "okay";
 };
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 182/453] arm64: dts: rockchip: Set dr_mode to "host" for OTG on rk3328-roc-cc
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (180 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.4 181/453] arm64: dts: armada-3720-turris-mox: update ethernet-phy handle name Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:46 ` [PATCH 5.4 183/453] power: supply: axp288_charger: Fix HP Pavilion x2 10 DMI matching Greg Kroah-Hartman
                   ` (273 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chen-Yu Tsai, Heiko Stuebner, Sasha Levin

From: Chen-Yu Tsai <wens@csie.org>

[ Upstream commit 4076a007bd0f6171434bdb119a0b8797749b0502 ]

The board has a standard USB A female port connected to the USB OTG
controller's data pins. Set dr_mode in the OTG controller node to
indicate this usage, instead of having the implementation guess.

Fixes: 2171f4fdac06 ("arm64: dts: rockchip: add roc-rk3328-cc board")
Signed-off-by: Chen-Yu Tsai <wens@csie.org>
Link: https://lore.kernel.org/r/20201126073336.30794-2-wens@kernel.org
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts b/arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts
index bb40c163b05dc..6c3368f795ca3 100644
--- a/arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts
+++ b/arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts
@@ -333,6 +333,7 @@
 };
 
 &usb20_otg {
+	dr_mode = "host";
 	status = "okay";
 };
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 183/453] power: supply: axp288_charger: Fix HP Pavilion x2 10 DMI matching
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (181 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.4 182/453] arm64: dts: rockchip: Set dr_mode to "host" for OTG on rk3328-roc-cc Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.4 184/453] power: supply: bq24190_charger: fix reference leak Greg Kroah-Hartman
                   ` (272 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hans de Goede, Sebastian Reichel,
	Sasha Levin

From: Hans de Goede <hdegoede@redhat.com>

[ Upstream commit a0f1ccd96c7049377d892a4299b6d5e47ec9179d ]

Commit 9c80662a74cd ("power: supply: axp288_charger: Add special handling
for HP Pavilion x2 10") added special handling for HP Pavilion x2 10
models which use the weird combination of a Type-C connector and the
non Type-C aware AXP288 PMIC.

This special handling was activated by a DMI match a the product-name
of "HP Pavilion x2 Detachable". Recently I've learned that there are
also older "HP Pavilion x2 Detachable" models with an AXP288 PMIC +
a micro-usb connector where we should not activate the special handling
for the Type-C connectors.

Extend the matching to also match on the DMI board-name and match on the
2 boards (one Bay Trail based one Cherry Trail based) of which we are
certain that they use the AXP288 + Type-C connector combination.

Note the DSDT code from these older (AXP288 + micro-USB) models contains
some AML code (which never runs under Linux) which reads the micro-USB
connector id-pin and if it is pulled to ground, which would normally mean
the port is in host mode!, then it sets the input-current-limit to 3A,
it seems HP is using the micro-USB port as a charging only connector
and identifies their own 3A capable charger though this hack which is a
major violation of the USB specs. Note HP also hardcodes a 2A limit
when the id-pin is not pulled to ground, which is also in violation
of the specs.

I've no intention to add support for HP's hack to support 3A charging
on these older models. By making the DMI matches for the Type-C equipped
models workaround more tighter, these older models will be treated just
like any other AXP288 + micro-USB equipped device and the input-current
limit will follow the BC 1.2 spec (using the defacto standard values
there where the BC 1.2 spec defines a range).

Fixes: 9c80662a74cd ("power: supply: axp288_charger: Add special handling for HP Pavilion x2 10")
BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1896924
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/power/supply/axp288_charger.c | 28 ++++++++++++++++-----------
 1 file changed, 17 insertions(+), 11 deletions(-)

diff --git a/drivers/power/supply/axp288_charger.c b/drivers/power/supply/axp288_charger.c
index cf4c67b2d2359..7d09e49f04d3b 100644
--- a/drivers/power/supply/axp288_charger.c
+++ b/drivers/power/supply/axp288_charger.c
@@ -548,14 +548,15 @@ out:
 
 /*
  * The HP Pavilion x2 10 series comes in a number of variants:
- * Bay Trail SoC    + AXP288 PMIC, DMI_BOARD_NAME: "815D"
- * Cherry Trail SoC + AXP288 PMIC, DMI_BOARD_NAME: "813E"
- * Cherry Trail SoC + TI PMIC,     DMI_BOARD_NAME: "827C" or "82F4"
+ * Bay Trail SoC    + AXP288 PMIC, Micro-USB, DMI_BOARD_NAME: "8021"
+ * Bay Trail SoC    + AXP288 PMIC, Type-C,    DMI_BOARD_NAME: "815D"
+ * Cherry Trail SoC + AXP288 PMIC, Type-C,    DMI_BOARD_NAME: "813E"
+ * Cherry Trail SoC + TI PMIC,     Type-C,    DMI_BOARD_NAME: "827C" or "82F4"
  *
- * The variants with the AXP288 PMIC are all kinds of special:
+ * The variants with the AXP288 + Type-C connector are all kinds of special:
  *
- * 1. All variants use a Type-C connector which the AXP288 does not support, so
- * when using a Type-C charger it is not recognized. Unlike most AXP288 devices,
+ * 1. They use a Type-C connector which the AXP288 does not support, so when
+ * using a Type-C charger it is not recognized. Unlike most AXP288 devices,
  * this model actually has mostly working ACPI AC / Battery code, the ACPI code
  * "solves" this by simply setting the input_current_limit to 3A.
  * There are still some issues with the ACPI code, so we use this native driver,
@@ -578,12 +579,17 @@ out:
  */
 static const struct dmi_system_id axp288_hp_x2_dmi_ids[] = {
 	{
-		/*
-		 * Bay Trail model has "Hewlett-Packard" as sys_vendor, Cherry
-		 * Trail model has "HP", so we only match on product_name.
-		 */
 		.matches = {
-			DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion x2 Detachable"),
+			DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+			DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "HP Pavilion x2 Detachable"),
+			DMI_EXACT_MATCH(DMI_BOARD_NAME, "815D"),
+		},
+	},
+	{
+		.matches = {
+			DMI_EXACT_MATCH(DMI_SYS_VENDOR, "HP"),
+			DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "HP Pavilion x2 Detachable"),
+			DMI_EXACT_MATCH(DMI_BOARD_NAME, "813E"),
 		},
 	},
 	{} /* Terminating entry */
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 184/453] power: supply: bq24190_charger: fix reference leak
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (182 preceding siblings ...)
  2020-12-28 12:46 ` [PATCH 5.4 183/453] power: supply: axp288_charger: Fix HP Pavilion x2 10 DMI matching Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.4 185/453] genirq/irqdomain: Dont try to free an interrupt that has no mapping Greg Kroah-Hartman
                   ` (271 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Zhang Qilong, Sebastian Reichel, Sasha Levin

From: Zhang Qilong <zhangqilong3@huawei.com>

[ Upstream commit b2f6cb78eaa1cad57dd3fe11d0458cd4fae9a584 ]

pm_runtime_get_sync will increment pm usage counter even it
failed. Forgetting to call pm_runtime_put_noidle will result
in reference leak in callers(bq24190_sysfs_show,
bq24190_charger_get_property, bq24190_charger_set_property,
bq24190_battery_get_property, bq24190_battery_set_property),
so we should fix it.

Fixes: f385e6e2a1532 ("power: bq24190_charger: Use PM runtime autosuspend")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/power/supply/bq24190_charger.c | 20 +++++++++++++++-----
 1 file changed, 15 insertions(+), 5 deletions(-)

diff --git a/drivers/power/supply/bq24190_charger.c b/drivers/power/supply/bq24190_charger.c
index 453d6332d43a7..1ae5d6d42c9e3 100644
--- a/drivers/power/supply/bq24190_charger.c
+++ b/drivers/power/supply/bq24190_charger.c
@@ -448,8 +448,10 @@ static ssize_t bq24190_sysfs_show(struct device *dev,
 		return -EINVAL;
 
 	ret = pm_runtime_get_sync(bdi->dev);
-	if (ret < 0)
+	if (ret < 0) {
+		pm_runtime_put_noidle(bdi->dev);
 		return ret;
+	}
 
 	ret = bq24190_read_mask(bdi, info->reg, info->mask, info->shift, &v);
 	if (ret)
@@ -1075,8 +1077,10 @@ static int bq24190_charger_get_property(struct power_supply *psy,
 	dev_dbg(bdi->dev, "prop: %d\n", psp);
 
 	ret = pm_runtime_get_sync(bdi->dev);
-	if (ret < 0)
+	if (ret < 0) {
+		pm_runtime_put_noidle(bdi->dev);
 		return ret;
+	}
 
 	switch (psp) {
 	case POWER_SUPPLY_PROP_CHARGE_TYPE:
@@ -1147,8 +1151,10 @@ static int bq24190_charger_set_property(struct power_supply *psy,
 	dev_dbg(bdi->dev, "prop: %d\n", psp);
 
 	ret = pm_runtime_get_sync(bdi->dev);
-	if (ret < 0)
+	if (ret < 0) {
+		pm_runtime_put_noidle(bdi->dev);
 		return ret;
+	}
 
 	switch (psp) {
 	case POWER_SUPPLY_PROP_ONLINE:
@@ -1408,8 +1414,10 @@ static int bq24190_battery_get_property(struct power_supply *psy,
 	dev_dbg(bdi->dev, "prop: %d\n", psp);
 
 	ret = pm_runtime_get_sync(bdi->dev);
-	if (ret < 0)
+	if (ret < 0) {
+		pm_runtime_put_noidle(bdi->dev);
 		return ret;
+	}
 
 	switch (psp) {
 	case POWER_SUPPLY_PROP_STATUS:
@@ -1454,8 +1462,10 @@ static int bq24190_battery_set_property(struct power_supply *psy,
 	dev_dbg(bdi->dev, "prop: %d\n", psp);
 
 	ret = pm_runtime_get_sync(bdi->dev);
-	if (ret < 0)
+	if (ret < 0) {
+		pm_runtime_put_noidle(bdi->dev);
 		return ret;
+	}
 
 	switch (psp) {
 	case POWER_SUPPLY_PROP_ONLINE:
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 185/453] genirq/irqdomain: Dont try to free an interrupt that has no mapping
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (183 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.4 184/453] power: supply: bq24190_charger: fix reference leak Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.4 186/453] arm64: dts: ls1028a: fix ENETC PTP clock input Greg Kroah-Hartman
                   ` (270 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Marc Zyngier, Thomas Gleixner, Sasha Levin

From: Marc Zyngier <maz@kernel.org>

[ Upstream commit 4615fbc3788ddc8e7c6d697714ad35a53729aa2c ]

When an interrupt allocation fails for N interrupts, it is pretty
common for the error handling code to free the same number of interrupts,
no matter how many interrupts have actually been allocated.

This may result in the domain freeing code to be unexpectedly called
for interrupts that have no mapping in that domain. Things end pretty
badly.

Instead, add some checks to irq_domain_free_irqs_hierarchy() to make sure
that thiss does not follow the hierarchy if no mapping exists for a given
interrupt.

Fixes: 6a6544e520abe ("genirq/irqdomain: Remove auto-recursive hierarchy support")
Signed-off-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Link: https://lore.kernel.org/r/20201129135551.396777-1-maz@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/irq/irqdomain.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/kernel/irq/irqdomain.c b/kernel/irq/irqdomain.c
index 5a60de39457c7..5e03cbee70d67 100644
--- a/kernel/irq/irqdomain.c
+++ b/kernel/irq/irqdomain.c
@@ -1288,8 +1288,15 @@ static void irq_domain_free_irqs_hierarchy(struct irq_domain *domain,
 					   unsigned int irq_base,
 					   unsigned int nr_irqs)
 {
-	if (domain->ops->free)
-		domain->ops->free(domain, irq_base, nr_irqs);
+	unsigned int i;
+
+	if (!domain->ops->free)
+		return;
+
+	for (i = 0; i < nr_irqs; i++) {
+		if (irq_domain_get_irq_data(domain, irq_base + i))
+			domain->ops->free(domain, irq_base + i, 1);
+	}
 }
 
 int irq_domain_alloc_irqs_hierarchy(struct irq_domain *domain,
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 186/453] arm64: dts: ls1028a: fix ENETC PTP clock input
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (184 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.4 185/453] genirq/irqdomain: Dont try to free an interrupt that has no mapping Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.4 187/453] arm64: dts: qcom: c630: Polish i2c-hid devices Greg Kroah-Hartman
                   ` (269 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Michael Walle, Shawn Guo, Sasha Levin

From: Michael Walle <michael@walle.cc>

[ Upstream commit d0570a575aa83116bd0f6a99c4de548af773d950 ]

On the LS1028A the ENETC reference clock is connected to 4th HWA output,
see Figure 7 "Clock subsystem block diagram".

The PHC may run with a wrong frequency. ptp_qoriq_auto_config() will read
the clock speed of the clock given in the device tree. It is likely that,
on the reference board this wasn't noticed because both clocks have the
same frequency. But this must not be always the case. Fix it.

Fixes: 49401003e260 ("arm64: dts: fsl: ls1028a: add ENETC 1588 timer node")
Signed-off-by: Michael Walle <michael@walle.cc>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi b/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi
index 9589b15693d6e..795d6ca4bbd1f 100644
--- a/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi
+++ b/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi
@@ -673,7 +673,7 @@
 			ethernet@0,4 {
 				compatible = "fsl,enetc-ptp";
 				reg = <0x000400 0 0 0 0>;
-				clocks = <&clockgen 4 0>;
+				clocks = <&clockgen 2 3>;
 				little-endian;
 			};
 		};
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 187/453] arm64: dts: qcom: c630: Polish i2c-hid devices
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (185 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.4 186/453] arm64: dts: ls1028a: fix ENETC PTP clock input Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.4 188/453] PCI: Bounds-check command-line resource alignment requests Greg Kroah-Hartman
                   ` (268 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Steev Klimaszewski, Bjorn Andersson,
	Sasha Levin

From: Bjorn Andersson <bjorn.andersson@linaro.org>

[ Upstream commit 11d0e4f281565ef757479764ce7fd8d35eeb01b0 ]

The numbering of the i2c busses differs from ACPI and a number of typos
was made in the original patch. Further more the irq flags for the
various resources was not correct and i2c3 only has one of the two
client devices active in any one device.

Also label the various devices, for easier comparison with the ACPI
tables.

Tested-by: Steev Klimaszewski <steev@kali.org>
Fixes: 44acee207844 ("arm64: dts: qcom: Add Lenovo Yoga C630")
Link: https://lore.kernel.org/r/20201130165924.319708-1-bjorn.andersson@linaro.org
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../boot/dts/qcom/sdm850-lenovo-yoga-c630.dts | 31 +++++++++++--------
 1 file changed, 18 insertions(+), 13 deletions(-)

diff --git a/arch/arm64/boot/dts/qcom/sdm850-lenovo-yoga-c630.dts b/arch/arm64/boot/dts/qcom/sdm850-lenovo-yoga-c630.dts
index ded120d3aef58..f539b3655f6b9 100644
--- a/arch/arm64/boot/dts/qcom/sdm850-lenovo-yoga-c630.dts
+++ b/arch/arm64/boot/dts/qcom/sdm850-lenovo-yoga-c630.dts
@@ -244,23 +244,28 @@
 	status = "okay";
 	clock-frequency = <400000>;
 
-	hid@15 {
+	tsel: hid@15 {
 		compatible = "hid-over-i2c";
 		reg = <0x15>;
 		hid-descr-addr = <0x1>;
 
-		interrupts-extended = <&tlmm 37 IRQ_TYPE_EDGE_RISING>;
+		interrupts-extended = <&tlmm 37 IRQ_TYPE_LEVEL_HIGH>;
+
+		pinctrl-names = "default";
+		pinctrl-0 = <&i2c3_hid_active>;
 	};
 
-	hid@2c {
+	tsc2: hid@2c {
 		compatible = "hid-over-i2c";
 		reg = <0x2c>;
 		hid-descr-addr = <0x20>;
 
-		interrupts-extended = <&tlmm 37 IRQ_TYPE_EDGE_RISING>;
+		interrupts-extended = <&tlmm 37 IRQ_TYPE_LEVEL_HIGH>;
 
 		pinctrl-names = "default";
-		pinctrl-0 = <&i2c2_hid_active>;
+		pinctrl-0 = <&i2c3_hid_active>;
+
+		status = "disabled";
 	};
 };
 
@@ -268,15 +273,15 @@
 	status = "okay";
 	clock-frequency = <400000>;
 
-	hid@10 {
+	tsc1: hid@10 {
 		compatible = "hid-over-i2c";
 		reg = <0x10>;
 		hid-descr-addr = <0x1>;
 
-		interrupts-extended = <&tlmm 125 IRQ_TYPE_EDGE_FALLING>;
+		interrupts-extended = <&tlmm 125 IRQ_TYPE_LEVEL_LOW>;
 
 		pinctrl-names = "default";
-		pinctrl-0 = <&i2c6_hid_active>;
+		pinctrl-0 = <&i2c5_hid_active>;
 	};
 };
 
@@ -284,7 +289,7 @@
 	status = "okay";
 	clock-frequency = <400000>;
 
-	hid@5c {
+	ecsh: hid@5c {
 		compatible = "hid-over-i2c";
 		reg = <0x5c>;
 		hid-descr-addr = <0x1>;
@@ -292,7 +297,7 @@
 		interrupts-extended = <&tlmm 92 IRQ_TYPE_LEVEL_LOW>;
 
 		pinctrl-names = "default";
-		pinctrl-0 = <&i2c12_hid_active>;
+		pinctrl-0 = <&i2c11_hid_active>;
 	};
 };
 
@@ -335,7 +340,7 @@
 &tlmm {
 	gpio-reserved-ranges = <0 4>, <81 4>;
 
-	i2c2_hid_active: i2c2-hid-active {
+	i2c3_hid_active: i2c2-hid-active {
 		pins = <37>;
 		function = "gpio";
 
@@ -344,7 +349,7 @@
 		drive-strength = <2>;
 	};
 
-	i2c6_hid_active: i2c6-hid-active {
+	i2c5_hid_active: i2c5-hid-active {
 		pins = <125>;
 		function = "gpio";
 
@@ -353,7 +358,7 @@
 		drive-strength = <2>;
 	};
 
-	i2c12_hid_active: i2c12-hid-active {
+	i2c11_hid_active: i2c11-hid-active {
 		pins = <92>;
 		function = "gpio";
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 188/453] PCI: Bounds-check command-line resource alignment requests
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (186 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.4 187/453] arm64: dts: qcom: c630: Polish i2c-hid devices Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.4 189/453] PCI: Fix overflow in " Greg Kroah-Hartman
                   ` (267 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Bjorn Helgaas, Sasha Levin

From: Bjorn Helgaas <bhelgaas@google.com>

[ Upstream commit 6534aac198b58309ff2337981d3f893e0be1d19d ]

32-bit BARs are limited to 2GB size (2^31).  By extension, I assume 64-bit
BARs are limited to 2^63 bytes.  Limit the alignment requested by the
"pci=resource_alignment=" command-line parameter to 2^63.

Link: https://lore.kernel.org/r/20201007123045.GS4282@kadam
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/pci.c | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index b1b2c8ddbc927..158a7aa2a8e6e 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -6129,19 +6129,21 @@ static resource_size_t pci_specified_resource_alignment(struct pci_dev *dev,
 	while (*p) {
 		count = 0;
 		if (sscanf(p, "%d%n", &align_order, &count) == 1 &&
-							p[count] == '@') {
+		    p[count] == '@') {
 			p += count + 1;
+			if (align_order > 63) {
+				pr_err("PCI: Invalid requested alignment (order %d)\n",
+				       align_order);
+				align_order = PAGE_SHIFT;
+			}
 		} else {
-			align_order = -1;
+			align_order = PAGE_SHIFT;
 		}
 
 		ret = pci_dev_str_match(dev, p, &p);
 		if (ret == 1) {
 			*resize = true;
-			if (align_order == -1)
-				align = PAGE_SIZE;
-			else
-				align = 1 << align_order;
+			align = 1 << align_order;
 			break;
 		} else if (ret < 0) {
 			pr_err("PCI: Can't parse resource_alignment parameter: %s\n",
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 189/453] PCI: Fix overflow in command-line resource alignment requests
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (187 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.4 188/453] PCI: Bounds-check command-line resource alignment requests Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.4 190/453] PCI: iproc: Fix out-of-bound array accesses Greg Kroah-Hartman
                   ` (266 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Colin Ian King, Bjorn Helgaas,
	Logan Gunthorpe, Sasha Levin

From: Colin Ian King <colin.king@canonical.com>

[ Upstream commit cc73eb321d246776e5a9f7723d15708809aa3699 ]

The shift of 1 by align_order is evaluated using 32 bit arithmetic and the
result is assigned to a resource_size_t type variable that is a 64 bit
unsigned integer on 64 bit platforms. Fix an overflow before widening issue
by making the 1 a ULL.

Addresses-Coverity: ("Unintentional integer overflow")
Fixes: 32a9a682bef2 ("PCI: allow assignment of memory resources with a specified alignment")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Logan Gunthorpe <logang@deltatee.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/pci.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index 158a7aa2a8e6e..89dece8a41321 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -6143,7 +6143,7 @@ static resource_size_t pci_specified_resource_alignment(struct pci_dev *dev,
 		ret = pci_dev_str_match(dev, p, &p);
 		if (ret == 1) {
 			*resize = true;
-			align = 1 << align_order;
+			align = 1ULL << align_order;
 			break;
 		} else if (ret < 0) {
 			pr_err("PCI: Can't parse resource_alignment parameter: %s\n",
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 190/453] PCI: iproc: Fix out-of-bound array accesses
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (188 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.4 189/453] PCI: Fix overflow in " Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.4 191/453] arm64: dts: meson: fix spi-max-frequency on Khadas VIM2 Greg Kroah-Hartman
                   ` (265 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Bharat Gooty, Lorenzo Pieralisi, Sasha Levin

From: Bharat Gooty <bharat.gooty@broadcom.com>

[ Upstream commit a3ff529f5d368a17ff35ada8009e101162ebeaf9 ]

Declare the full size array for all revisions of PAX register sets
to avoid potentially out of bound access of the register array
when they are being initialized in iproc_pcie_rev_init().

Link: https://lore.kernel.org/r/20201001060054.6616-2-srinath.mannam@broadcom.com
Fixes: 06324ede76cdf ("PCI: iproc: Improve core register population")
Signed-off-by: Bharat Gooty <bharat.gooty@broadcom.com>
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/controller/pcie-iproc.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/pci/controller/pcie-iproc.c b/drivers/pci/controller/pcie-iproc.c
index 933a4346ae5d6..c6b1c18165e5c 100644
--- a/drivers/pci/controller/pcie-iproc.c
+++ b/drivers/pci/controller/pcie-iproc.c
@@ -307,7 +307,7 @@ enum iproc_pcie_reg {
 };
 
 /* iProc PCIe PAXB BCMA registers */
-static const u16 iproc_pcie_reg_paxb_bcma[] = {
+static const u16 iproc_pcie_reg_paxb_bcma[IPROC_PCIE_MAX_NUM_REG] = {
 	[IPROC_PCIE_CLK_CTRL]		= 0x000,
 	[IPROC_PCIE_CFG_IND_ADDR]	= 0x120,
 	[IPROC_PCIE_CFG_IND_DATA]	= 0x124,
@@ -318,7 +318,7 @@ static const u16 iproc_pcie_reg_paxb_bcma[] = {
 };
 
 /* iProc PCIe PAXB registers */
-static const u16 iproc_pcie_reg_paxb[] = {
+static const u16 iproc_pcie_reg_paxb[IPROC_PCIE_MAX_NUM_REG] = {
 	[IPROC_PCIE_CLK_CTRL]		= 0x000,
 	[IPROC_PCIE_CFG_IND_ADDR]	= 0x120,
 	[IPROC_PCIE_CFG_IND_DATA]	= 0x124,
@@ -334,7 +334,7 @@ static const u16 iproc_pcie_reg_paxb[] = {
 };
 
 /* iProc PCIe PAXB v2 registers */
-static const u16 iproc_pcie_reg_paxb_v2[] = {
+static const u16 iproc_pcie_reg_paxb_v2[IPROC_PCIE_MAX_NUM_REG] = {
 	[IPROC_PCIE_CLK_CTRL]		= 0x000,
 	[IPROC_PCIE_CFG_IND_ADDR]	= 0x120,
 	[IPROC_PCIE_CFG_IND_DATA]	= 0x124,
@@ -363,7 +363,7 @@ static const u16 iproc_pcie_reg_paxb_v2[] = {
 };
 
 /* iProc PCIe PAXC v1 registers */
-static const u16 iproc_pcie_reg_paxc[] = {
+static const u16 iproc_pcie_reg_paxc[IPROC_PCIE_MAX_NUM_REG] = {
 	[IPROC_PCIE_CLK_CTRL]		= 0x000,
 	[IPROC_PCIE_CFG_IND_ADDR]	= 0x1f0,
 	[IPROC_PCIE_CFG_IND_DATA]	= 0x1f4,
@@ -372,7 +372,7 @@ static const u16 iproc_pcie_reg_paxc[] = {
 };
 
 /* iProc PCIe PAXC v2 registers */
-static const u16 iproc_pcie_reg_paxc_v2[] = {
+static const u16 iproc_pcie_reg_paxc_v2[IPROC_PCIE_MAX_NUM_REG] = {
 	[IPROC_PCIE_MSI_GIC_MODE]	= 0x050,
 	[IPROC_PCIE_MSI_BASE_ADDR]	= 0x074,
 	[IPROC_PCIE_MSI_WINDOW_SIZE]	= 0x078,
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 191/453] arm64: dts: meson: fix spi-max-frequency on Khadas VIM2
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (189 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.4 190/453] PCI: iproc: Fix out-of-bound array accesses Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.4 192/453] arm64: dts: meson-sm1: fix typo in opp table Greg Kroah-Hartman
                   ` (264 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Artem Lapkin, Neil Armstrong,
	Kevin Hilman, Sasha Levin

From: Artem Lapkin <art@khadas.com>

[ Upstream commit b6c605e00ce8910d7ec3d9a54725d78b14db49b9 ]

The max frequency for the w25q32 (VIM v1.2) and w25q128 (VIM v1.4) spifc
chip should be 104Mhz not 30MHz.

Fixes: b8b74dda3908 ("ARM64: dts: meson-gxm: Add support for Khadas VIM2")
Signed-off-by: Artem Lapkin <art@khadas.com>
Reviewed-by: Neil Armstrong <narmstrong@baylibre.com>
Signed-off-by: Kevin Hilman <khilman@baylibre.com>
Link: https://lore.kernel.org/r/20201125024001.19036-1-christianshewitt@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts b/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts
index 3f43716d5c453..fa8bd0690e89a 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts
@@ -395,7 +395,7 @@
 		#size-cells = <1>;
 		compatible = "winbond,w25q16", "jedec,spi-nor";
 		reg = <0>;
-		spi-max-frequency = <3000000>;
+		spi-max-frequency = <104000000>;
 	};
 };
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 192/453] arm64: dts: meson-sm1: fix typo in opp table
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (190 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.4 191/453] arm64: dts: meson: fix spi-max-frequency on Khadas VIM2 Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.4 193/453] soc: amlogic: canvas: add missing put_device() call in meson_canvas_get() Greg Kroah-Hartman
                   ` (263 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dongjin Kim, Neil Armstrong,
	Kevin Hilman, Sasha Levin

From: Dongjin Kim <tobetter@gmail.com>

[ Upstream commit b6a1c8a1eaa73b1e2ae251399308e9445d74cef7 ]

The freqency 1512000000 should be 1500000000.

Signed-off-by: Dongjin Kim <tobetter@gmail.com>
Fixes: 3d9e76483049 ("arm64: dts: meson-sm1-sei610: enable DVFS")
Reviewed-by: Neil Armstrong <narmstrong@baylibre.com>
Signed-off-by: Kevin Hilman <khilman@baylibre.com>
Link: https://lore.kernel.org/r/20201130060320.GA30098@anyang-linuxfactory-or-kr
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/amlogic/meson-sm1.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/amlogic/meson-sm1.dtsi b/arch/arm64/boot/dts/amlogic/meson-sm1.dtsi
index 521573f3a5bab..8ba3555ca3693 100644
--- a/arch/arm64/boot/dts/amlogic/meson-sm1.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-sm1.dtsi
@@ -90,7 +90,7 @@
 			opp-microvolt = <790000>;
 		};
 
-		opp-1512000000 {
+		opp-1500000000 {
 			opp-hz = /bits/ 64 <1500000000>;
 			opp-microvolt = <800000>;
 		};
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 193/453] soc: amlogic: canvas: add missing put_device() call in meson_canvas_get()
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (191 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.4 192/453] arm64: dts: meson-sm1: fix typo in opp table Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.4 194/453] ARM: dts: at91: at91sam9rl: fix ADC triggers Greg Kroah-Hartman
                   ` (262 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yu Kuai, Neil Armstrong,
	Kevin Hilman, Sasha Levin

From: Yu Kuai <yukuai3@huawei.com>

[ Upstream commit 28f851e6afa858f182802e23ac60c3ed7d1c04a1 ]

if of_find_device_by_node() succeed, meson_canvas_get() doesn't have
a corresponding put_device(). Thus add put_device() to fix the exception
handling for this function implementation.

Fixes: 382f8be04551 ("soc: amlogic: canvas: Fix meson_canvas_get when probe failed")
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
Reviewed-by: Neil Armstrong <narmstrong@baylibre.com>
Signed-off-by: Kevin Hilman <khilman@baylibre.com>
Link: https://lore.kernel.org/r/20201117011322.522477-1-yukuai3@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/soc/amlogic/meson-canvas.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/soc/amlogic/meson-canvas.c b/drivers/soc/amlogic/meson-canvas.c
index c655f5f92b124..d0329ad170d13 100644
--- a/drivers/soc/amlogic/meson-canvas.c
+++ b/drivers/soc/amlogic/meson-canvas.c
@@ -72,8 +72,10 @@ struct meson_canvas *meson_canvas_get(struct device *dev)
 	 * current state, this driver probe cannot return -EPROBE_DEFER
 	 */
 	canvas = dev_get_drvdata(&canvas_pdev->dev);
-	if (!canvas)
+	if (!canvas) {
+		put_device(&canvas_pdev->dev);
 		return ERR_PTR(-EINVAL);
+	}
 
 	return canvas;
 }
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 194/453] ARM: dts: at91: at91sam9rl: fix ADC triggers
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (192 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.4 193/453] soc: amlogic: canvas: add missing put_device() call in meson_canvas_get() Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.4 195/453] platform/x86: dell-smbios-base: Fix error return code in dell_smbios_init Greg Kroah-Hartman
                   ` (261 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Alexandre Belloni, Sasha Levin

From: Alexandre Belloni <alexandre.belloni@bootlin.com>

[ Upstream commit 851a95da583c26e2ddeb7281e9b61f0d76ea5aba ]

The triggers for the ADC were taken from at91sam9260 dtsi but are not
correct.

Fixes: a4c1d6c75822 ("ARM: at91/dt: sam9rl: add lcd, adc, usb gadget and pwm support")
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Link: https://lore.kernel.org/r/20201128222818.1910764-10-alexandre.belloni@bootlin.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/at91sam9rl.dtsi | 19 +++++++++++--------
 1 file changed, 11 insertions(+), 8 deletions(-)

diff --git a/arch/arm/boot/dts/at91sam9rl.dtsi b/arch/arm/boot/dts/at91sam9rl.dtsi
index ea024e4b6e095..0121bb0ecde16 100644
--- a/arch/arm/boot/dts/at91sam9rl.dtsi
+++ b/arch/arm/boot/dts/at91sam9rl.dtsi
@@ -278,23 +278,26 @@
 				atmel,adc-use-res = "highres";
 
 				trigger0 {
-					trigger-name = "timer-counter-0";
+					trigger-name = "external-rising";
 					trigger-value = <0x1>;
+					trigger-external;
 				};
+
 				trigger1 {
-					trigger-name = "timer-counter-1";
-					trigger-value = <0x3>;
+					trigger-name = "external-falling";
+					trigger-value = <0x2>;
+					trigger-external;
 				};
 
 				trigger2 {
-					trigger-name = "timer-counter-2";
-					trigger-value = <0x5>;
+					trigger-name = "external-any";
+					trigger-value = <0x3>;
+					trigger-external;
 				};
 
 				trigger3 {
-					trigger-name = "external";
-					trigger-value = <0x13>;
-					trigger-external;
+					trigger-name = "continuous";
+					trigger-value = <0x6>;
 				};
 			};
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 195/453] platform/x86: dell-smbios-base: Fix error return code in dell_smbios_init
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (193 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.4 194/453] ARM: dts: at91: at91sam9rl: fix ADC triggers Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.4 196/453] ath10k: Fix the parsing error in service available event Greg Kroah-Hartman
                   ` (260 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Qinglang Miao,
	Mario Limonciello, Hans de Goede, Sasha Levin

From: Qinglang Miao <miaoqinglang@huawei.com>

[ Upstream commit 2425ccd30fd78ce35237350fe8baac31dc18bd45 ]

Fix to return the error code -ENODEV when fails to init wmi and
smm.

Fixes: 41e36f2f85af ("platform/x86: dell-smbios: Link all dell-smbios-* modules together")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
Reviewed-by: Mario Limonciello <mario.limonciello@dell.com>
Link: https://lore.kernel.org/r/20201125065032.154125-1-miaoqinglang@huawei.com
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/x86/dell-smbios-base.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/platform/x86/dell-smbios-base.c b/drivers/platform/x86/dell-smbios-base.c
index fe59b0ebff314..ceb8e701028df 100644
--- a/drivers/platform/x86/dell-smbios-base.c
+++ b/drivers/platform/x86/dell-smbios-base.c
@@ -594,6 +594,7 @@ static int __init dell_smbios_init(void)
 	if (wmi && smm) {
 		pr_err("No SMBIOS backends available (wmi: %d, smm: %d)\n",
 			wmi, smm);
+		ret = -ENODEV;
 		goto fail_create_group;
 	}
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 196/453] ath10k: Fix the parsing error in service available event
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (194 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.4 195/453] platform/x86: dell-smbios-base: Fix error return code in dell_smbios_init Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.4 197/453] ath10k: Fix an error handling path Greg Kroah-Hartman
                   ` (259 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Rakesh Pillai, Douglas Anderson,
	Kalle Valo, Sasha Levin

From: Rakesh Pillai <pillair@codeaurora.org>

[ Upstream commit c7cee9c0f499f27ec6de06bea664b61320534768 ]

The wmi service available event has been
extended to contain extra 128 bit for new services
to be indicated by firmware.

Currently the presence of any optional TLVs in
the wmi service available event leads to a parsing
error with the below error message:
ath10k_snoc 18800000.wifi: failed to parse svc_avail tlv: -71

The wmi service available event parsing should
not return error for the newly added optional TLV.
Fix this parsing for service available event message.

Tested-on: WCN3990 hw1.0 SNOC WLAN.HL.3.2.2-00720-QCAHLSWMTPL-1

Fixes: cea19a6ce8bf ("ath10k: add WMI_SERVICE_AVAILABLE_EVENT support")
Signed-off-by: Rakesh Pillai <pillair@codeaurora.org>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/1605501291-23040-1-git-send-email-pillair@codeaurora.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath10k/wmi-tlv.c | 4 +++-
 drivers/net/wireless/ath/ath10k/wmi.c     | 9 +++++++--
 drivers/net/wireless/ath/ath10k/wmi.h     | 1 +
 3 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/drivers/net/wireless/ath/ath10k/wmi-tlv.c b/drivers/net/wireless/ath/ath10k/wmi-tlv.c
index 9d5b9df29c352..3ec71f52e8fe1 100644
--- a/drivers/net/wireless/ath/ath10k/wmi-tlv.c
+++ b/drivers/net/wireless/ath/ath10k/wmi-tlv.c
@@ -1260,13 +1260,15 @@ static int ath10k_wmi_tlv_svc_avail_parse(struct ath10k *ar, u16 tag, u16 len,
 
 	switch (tag) {
 	case WMI_TLV_TAG_STRUCT_SERVICE_AVAILABLE_EVENT:
+		arg->service_map_ext_valid = true;
 		arg->service_map_ext_len = *(__le32 *)ptr;
 		arg->service_map_ext = ptr + sizeof(__le32);
 		return 0;
 	default:
 		break;
 	}
-	return -EPROTO;
+
+	return 0;
 }
 
 static int ath10k_wmi_tlv_op_pull_svc_avail(struct ath10k *ar,
diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c
index 2675174cc4fec..91604a14a8f46 100644
--- a/drivers/net/wireless/ath/ath10k/wmi.c
+++ b/drivers/net/wireless/ath/ath10k/wmi.c
@@ -5659,8 +5659,13 @@ void ath10k_wmi_event_service_available(struct ath10k *ar, struct sk_buff *skb)
 			    ret);
 	}
 
-	ath10k_wmi_map_svc_ext(ar, arg.service_map_ext, ar->wmi.svc_map,
-			       __le32_to_cpu(arg.service_map_ext_len));
+	/*
+	 * Initialization of "arg.service_map_ext_valid" to ZERO is necessary
+	 * for the below logic to work.
+	 */
+	if (arg.service_map_ext_valid)
+		ath10k_wmi_map_svc_ext(ar, arg.service_map_ext, ar->wmi.svc_map,
+				       __le32_to_cpu(arg.service_map_ext_len));
 }
 
 static int ath10k_wmi_event_temperature(struct ath10k *ar, struct sk_buff *skb)
diff --git a/drivers/net/wireless/ath/ath10k/wmi.h b/drivers/net/wireless/ath/ath10k/wmi.h
index e80dbe7e8f4cf..761bc4a7064df 100644
--- a/drivers/net/wireless/ath/ath10k/wmi.h
+++ b/drivers/net/wireless/ath/ath10k/wmi.h
@@ -6857,6 +6857,7 @@ struct wmi_svc_rdy_ev_arg {
 };
 
 struct wmi_svc_avail_ev_arg {
+	bool service_map_ext_valid;
 	__le32 service_map_ext_len;
 	const __le32 *service_map_ext;
 };
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 197/453] ath10k: Fix an error handling path
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (195 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.4 196/453] ath10k: Fix the parsing error in service available event Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.4 198/453] ath10k: Release some resources in " Greg Kroah-Hartman
                   ` (258 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christophe JAILLET, Kalle Valo, Sasha Levin

From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>

[ Upstream commit ed3573bc3943c27d2d8e405a242f87ed14572ca1 ]

If 'ath10k_usb_create()' fails, we should release some resources and report
an error instead of silently continuing.

Fixes: 4db66499df91 ("ath10k: add initial USB support")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20201122170342.1346011-1-christophe.jaillet@wanadoo.fr
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath10k/usb.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/wireless/ath/ath10k/usb.c b/drivers/net/wireless/ath/ath10k/usb.c
index 1e0343081be91..3f3675aa782fb 100644
--- a/drivers/net/wireless/ath/ath10k/usb.c
+++ b/drivers/net/wireless/ath/ath10k/usb.c
@@ -1009,6 +1009,8 @@ static int ath10k_usb_probe(struct usb_interface *interface,
 
 	ar_usb = ath10k_usb_priv(ar);
 	ret = ath10k_usb_create(ar, interface);
+	if (ret)
+		goto err;
 	ar_usb->ar = ar;
 
 	ar->dev_id = product_id;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 198/453] ath10k: Release some resources in an error handling path
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (196 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.4 197/453] ath10k: Fix an error handling path Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.4 199/453] SUNRPC: rpc_wake_up() should wake up tasks in the correct order Greg Kroah-Hartman
                   ` (257 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christophe JAILLET, Kalle Valo, Sasha Levin

From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>

[ Upstream commit 6364e693f4a7a89a2fb3dd2cbd6cc06d5fd6e26d ]

Should an error occur after calling 'ath10k_usb_create()', it should be
undone by a corresponding 'ath10k_usb_destroy()' call

Fixes: 4db66499df91 ("ath10k: add initial USB support")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20201122170358.1346065-1-christophe.jaillet@wanadoo.fr
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath10k/usb.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/ath/ath10k/usb.c b/drivers/net/wireless/ath/ath10k/usb.c
index 3f3675aa782fb..05c0d5e92475e 100644
--- a/drivers/net/wireless/ath/ath10k/usb.c
+++ b/drivers/net/wireless/ath/ath10k/usb.c
@@ -1023,7 +1023,7 @@ static int ath10k_usb_probe(struct usb_interface *interface,
 	ret = ath10k_core_register(ar, &bus_params);
 	if (ret) {
 		ath10k_warn(ar, "failed to register driver core: %d\n", ret);
-		goto err;
+		goto err_usb_destroy;
 	}
 
 	/* TODO: remove this once USB support is fully implemented */
@@ -1031,6 +1031,9 @@ static int ath10k_usb_probe(struct usb_interface *interface,
 
 	return 0;
 
+err_usb_destroy:
+	ath10k_usb_destroy(ar);
+
 err:
 	ath10k_core_destroy(ar);
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 199/453] SUNRPC: rpc_wake_up() should wake up tasks in the correct order
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (197 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.4 198/453] ath10k: Release some resources in " Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.4 200/453] NFSv4.2: condition READDIRs mask for security label based on LSM state Greg Kroah-Hartman
                   ` (256 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Trond Myklebust, Sasha Levin

From: Trond Myklebust <trond.myklebust@hammerspace.com>

[ Upstream commit e4c72201b6ec3173dfe13fa2e2335a3ad78d4921 ]

Currently, we wake up the tasks by priority queue ordering, which means
that we ignore the batching that is supposed to help with QoS issues.

Fixes: c049f8ea9a0d ("SUNRPC: Remove the bh-safe lock requirement on the rpc_wait_queue->lock")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/sunrpc/sched.c | 65 +++++++++++++++++++++++++---------------------
 1 file changed, 35 insertions(+), 30 deletions(-)

diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
index 53d8b82eda006..7afbf15bcbd9a 100644
--- a/net/sunrpc/sched.c
+++ b/net/sunrpc/sched.c
@@ -699,6 +699,23 @@ struct rpc_task *rpc_wake_up_next(struct rpc_wait_queue *queue)
 }
 EXPORT_SYMBOL_GPL(rpc_wake_up_next);
 
+/**
+ * rpc_wake_up_locked - wake up all rpc_tasks
+ * @queue: rpc_wait_queue on which the tasks are sleeping
+ *
+ */
+static void rpc_wake_up_locked(struct rpc_wait_queue *queue)
+{
+	struct rpc_task *task;
+
+	for (;;) {
+		task = __rpc_find_next_queued(queue);
+		if (task == NULL)
+			break;
+		rpc_wake_up_task_queue_locked(queue, task);
+	}
+}
+
 /**
  * rpc_wake_up - wake up all rpc_tasks
  * @queue: rpc_wait_queue on which the tasks are sleeping
@@ -707,25 +724,28 @@ EXPORT_SYMBOL_GPL(rpc_wake_up_next);
  */
 void rpc_wake_up(struct rpc_wait_queue *queue)
 {
-	struct list_head *head;
-
 	spin_lock(&queue->lock);
-	head = &queue->tasks[queue->maxpriority];
+	rpc_wake_up_locked(queue);
+	spin_unlock(&queue->lock);
+}
+EXPORT_SYMBOL_GPL(rpc_wake_up);
+
+/**
+ * rpc_wake_up_status_locked - wake up all rpc_tasks and set their status value.
+ * @queue: rpc_wait_queue on which the tasks are sleeping
+ * @status: status value to set
+ */
+static void rpc_wake_up_status_locked(struct rpc_wait_queue *queue, int status)
+{
+	struct rpc_task *task;
+
 	for (;;) {
-		while (!list_empty(head)) {
-			struct rpc_task *task;
-			task = list_first_entry(head,
-					struct rpc_task,
-					u.tk_wait.list);
-			rpc_wake_up_task_queue_locked(queue, task);
-		}
-		if (head == &queue->tasks[0])
+		task = __rpc_find_next_queued(queue);
+		if (task == NULL)
 			break;
-		head--;
+		rpc_wake_up_task_queue_set_status_locked(queue, task, status);
 	}
-	spin_unlock(&queue->lock);
 }
-EXPORT_SYMBOL_GPL(rpc_wake_up);
 
 /**
  * rpc_wake_up_status - wake up all rpc_tasks and set their status value.
@@ -736,23 +756,8 @@ EXPORT_SYMBOL_GPL(rpc_wake_up);
  */
 void rpc_wake_up_status(struct rpc_wait_queue *queue, int status)
 {
-	struct list_head *head;
-
 	spin_lock(&queue->lock);
-	head = &queue->tasks[queue->maxpriority];
-	for (;;) {
-		while (!list_empty(head)) {
-			struct rpc_task *task;
-			task = list_first_entry(head,
-					struct rpc_task,
-					u.tk_wait.list);
-			task->tk_status = status;
-			rpc_wake_up_task_queue_locked(queue, task);
-		}
-		if (head == &queue->tasks[0])
-			break;
-		head--;
-	}
+	rpc_wake_up_status_locked(queue, status);
 	spin_unlock(&queue->lock);
 }
 EXPORT_SYMBOL_GPL(rpc_wake_up_status);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 200/453] NFSv4.2: condition READDIRs mask for security label based on LSM state
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (198 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.4 199/453] SUNRPC: rpc_wake_up() should wake up tasks in the correct order Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.4 201/453] SUNRPC: xprt_load_transport() needs to support the netid "rdma6" Greg Kroah-Hartman
                   ` (255 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ondrej Mosnacek, Scott Mayhew,
	Olga Kornievskaia, Trond Myklebust, Sasha Levin

From: Olga Kornievskaia <kolga@netapp.com>

[ Upstream commit 05ad917561fca39a03338cb21fe9622f998b0f9c ]

Currently, the client will always ask for security_labels if the server
returns that it supports that feature regardless of any LSM modules
(such as Selinux) enforcing security policy. This adds performance
penalty to the READDIR operation.

Client adjusts superblock's support of the security_label based on
the server's support but also current client's configuration of the
LSM modules. Thus, prior to using the default bitmask in READDIR,
this patch checks the server's capabilities and then instructs
READDIR to remove FATTR4_WORD2_SECURITY_LABEL from the bitmask.

v5: fixing silly mistakes of the rushed v4
v4: simplifying logic
v3: changing label's initialization per Ondrej's comment
v2: dropping selinux hook and using the sb cap.

Suggested-by: Ondrej Mosnacek <omosnace@redhat.com>
Suggested-by: Scott Mayhew <smayhew@redhat.com>
Signed-off-by: Olga Kornievskaia <kolga@netapp.com>
Fixes: 2b0143b5c986 ("VFS: normal filesystems (and lustre): d_inode() annotations")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/nfs/nfs4proc.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index ddc900df461c8..8598eba3fc234 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -4899,12 +4899,12 @@ static int _nfs4_proc_readdir(struct dentry *dentry, const struct cred *cred,
 		u64 cookie, struct page **pages, unsigned int count, bool plus)
 {
 	struct inode		*dir = d_inode(dentry);
+	struct nfs_server	*server = NFS_SERVER(dir);
 	struct nfs4_readdir_arg args = {
 		.fh = NFS_FH(dir),
 		.pages = pages,
 		.pgbase = 0,
 		.count = count,
-		.bitmask = NFS_SERVER(d_inode(dentry))->attr_bitmask,
 		.plus = plus,
 	};
 	struct nfs4_readdir_res res;
@@ -4919,9 +4919,15 @@ static int _nfs4_proc_readdir(struct dentry *dentry, const struct cred *cred,
 	dprintk("%s: dentry = %pd2, cookie = %Lu\n", __func__,
 			dentry,
 			(unsigned long long)cookie);
+	if (!(server->caps & NFS_CAP_SECURITY_LABEL))
+		args.bitmask = server->attr_bitmask_nl;
+	else
+		args.bitmask = server->attr_bitmask;
+
 	nfs4_setup_readdir(cookie, NFS_I(dir)->cookieverf, dentry, &args);
 	res.pgbase = args.pgbase;
-	status = nfs4_call_sync(NFS_SERVER(dir)->client, NFS_SERVER(dir), &msg, &args.seq_args, &res.seq_res, 0);
+	status = nfs4_call_sync(server->client, server, &msg, &args.seq_args,
+			&res.seq_res, 0);
 	if (status >= 0) {
 		memcpy(NFS_I(dir)->cookieverf, res.verifier.data, NFS4_VERIFIER_SIZE);
 		status += args.pgbase;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 201/453] SUNRPC: xprt_load_transport() needs to support the netid "rdma6"
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (199 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.4 200/453] NFSv4.2: condition READDIRs mask for security label based on LSM state Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.4 202/453] NFSv4: Fix the alignment of page data in the getdeviceinfo reply Greg Kroah-Hartman
                   ` (254 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Trond Myklebust, Sasha Levin

From: Trond Myklebust <trond.myklebust@hammerspace.com>

[ Upstream commit d5aa6b22e2258f05317313ecc02efbb988ed6d38 ]

According to RFC5666, the correct netid for an IPv6 addressed RDMA
transport is "rdma6", which we've supported as a mount option since
Linux-4.7. The problem is when we try to load the module "xprtrdma6",
that will fail, since there is no modulealias of that name.

Fixes: 181342c5ebe8 ("xprtrdma: Add rdma6 option to support NFS/RDMA IPv6")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/sunrpc/xprt.h     |  1 +
 net/sunrpc/xprt.c               | 65 +++++++++++++++++++++++++--------
 net/sunrpc/xprtrdma/module.c    |  1 +
 net/sunrpc/xprtrdma/transport.c |  1 +
 net/sunrpc/xprtsock.c           |  4 ++
 5 files changed, 56 insertions(+), 16 deletions(-)

diff --git a/include/linux/sunrpc/xprt.h b/include/linux/sunrpc/xprt.h
index d783e15ba898c..d7ef5b97174ce 100644
--- a/include/linux/sunrpc/xprt.h
+++ b/include/linux/sunrpc/xprt.h
@@ -330,6 +330,7 @@ struct xprt_class {
 	struct rpc_xprt *	(*setup)(struct xprt_create *);
 	struct module		*owner;
 	char			name[32];
+	const char *		netid[];
 };
 
 /*
diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
index a6fee86f400ec..639837b3a5d90 100644
--- a/net/sunrpc/xprt.c
+++ b/net/sunrpc/xprt.c
@@ -151,31 +151,64 @@ out:
 }
 EXPORT_SYMBOL_GPL(xprt_unregister_transport);
 
+static void
+xprt_class_release(const struct xprt_class *t)
+{
+	module_put(t->owner);
+}
+
+static const struct xprt_class *
+xprt_class_find_by_netid_locked(const char *netid)
+{
+	const struct xprt_class *t;
+	unsigned int i;
+
+	list_for_each_entry(t, &xprt_list, list) {
+		for (i = 0; t->netid[i][0] != '\0'; i++) {
+			if (strcmp(t->netid[i], netid) != 0)
+				continue;
+			if (!try_module_get(t->owner))
+				continue;
+			return t;
+		}
+	}
+	return NULL;
+}
+
+static const struct xprt_class *
+xprt_class_find_by_netid(const char *netid)
+{
+	const struct xprt_class *t;
+
+	spin_lock(&xprt_list_lock);
+	t = xprt_class_find_by_netid_locked(netid);
+	if (!t) {
+		spin_unlock(&xprt_list_lock);
+		request_module("rpc%s", netid);
+		spin_lock(&xprt_list_lock);
+		t = xprt_class_find_by_netid_locked(netid);
+	}
+	spin_unlock(&xprt_list_lock);
+	return t;
+}
+
 /**
  * xprt_load_transport - load a transport implementation
- * @transport_name: transport to load
+ * @netid: transport to load
  *
  * Returns:
  * 0:		transport successfully loaded
  * -ENOENT:	transport module not available
  */
-int xprt_load_transport(const char *transport_name)
+int xprt_load_transport(const char *netid)
 {
-	struct xprt_class *t;
-	int result;
+	const struct xprt_class *t;
 
-	result = 0;
-	spin_lock(&xprt_list_lock);
-	list_for_each_entry(t, &xprt_list, list) {
-		if (strcmp(t->name, transport_name) == 0) {
-			spin_unlock(&xprt_list_lock);
-			goto out;
-		}
-	}
-	spin_unlock(&xprt_list_lock);
-	result = request_module("xprt%s", transport_name);
-out:
-	return result;
+	t = xprt_class_find_by_netid(netid);
+	if (!t)
+		return -ENOENT;
+	xprt_class_release(t);
+	return 0;
 }
 EXPORT_SYMBOL_GPL(xprt_load_transport);
 
diff --git a/net/sunrpc/xprtrdma/module.c b/net/sunrpc/xprtrdma/module.c
index 620327c01302c..45c5b41ac8dc9 100644
--- a/net/sunrpc/xprtrdma/module.c
+++ b/net/sunrpc/xprtrdma/module.c
@@ -24,6 +24,7 @@ MODULE_DESCRIPTION("RPC/RDMA Transport");
 MODULE_LICENSE("Dual BSD/GPL");
 MODULE_ALIAS("svcrdma");
 MODULE_ALIAS("xprtrdma");
+MODULE_ALIAS("rpcrdma6");
 
 static void __exit rpc_rdma_cleanup(void)
 {
diff --git a/net/sunrpc/xprtrdma/transport.c b/net/sunrpc/xprtrdma/transport.c
index c67d465dc0620..2f21e3c52bfc1 100644
--- a/net/sunrpc/xprtrdma/transport.c
+++ b/net/sunrpc/xprtrdma/transport.c
@@ -827,6 +827,7 @@ static struct xprt_class xprt_rdma = {
 	.owner			= THIS_MODULE,
 	.ident			= XPRT_TRANSPORT_RDMA,
 	.setup			= xprt_setup_rdma,
+	.netid			= { "rdma", "rdma6", "" },
 };
 
 void xprt_rdma_cleanup(void)
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index 934e30e675375..449f193b5a886 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -3204,6 +3204,7 @@ static struct xprt_class	xs_local_transport = {
 	.owner		= THIS_MODULE,
 	.ident		= XPRT_TRANSPORT_LOCAL,
 	.setup		= xs_setup_local,
+	.netid		= { "" },
 };
 
 static struct xprt_class	xs_udp_transport = {
@@ -3212,6 +3213,7 @@ static struct xprt_class	xs_udp_transport = {
 	.owner		= THIS_MODULE,
 	.ident		= XPRT_TRANSPORT_UDP,
 	.setup		= xs_setup_udp,
+	.netid		= { "udp", "udp6", "" },
 };
 
 static struct xprt_class	xs_tcp_transport = {
@@ -3220,6 +3222,7 @@ static struct xprt_class	xs_tcp_transport = {
 	.owner		= THIS_MODULE,
 	.ident		= XPRT_TRANSPORT_TCP,
 	.setup		= xs_setup_tcp,
+	.netid		= { "tcp", "tcp6", "" },
 };
 
 static struct xprt_class	xs_bc_tcp_transport = {
@@ -3228,6 +3231,7 @@ static struct xprt_class	xs_bc_tcp_transport = {
 	.owner		= THIS_MODULE,
 	.ident		= XPRT_TRANSPORT_BC_TCP,
 	.setup		= xs_setup_bc_tcp,
+	.netid		= { "" },
 };
 
 /**
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 202/453] NFSv4: Fix the alignment of page data in the getdeviceinfo reply
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (200 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.4 201/453] SUNRPC: xprt_load_transport() needs to support the netid "rdma6" Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.4 203/453] net: sunrpc: Fix snprintf return value check in do_xprt_debugfs Greg Kroah-Hartman
                   ` (253 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Trond Myklebust, Sasha Levin

From: Trond Myklebust <trond.myklebust@hammerspace.com>

[ Upstream commit 046e5ccb4198b990190e11fb52fd9cfd264402eb ]

We can fit the device_addr4 opaque data padding in the pages.

Fixes: cf500bac8fd4 ("SUNRPC: Introduce rpc_prepare_reply_pages()")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/nfs/nfs4xdr.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
index 677751bc3a334..9a022a4fb9643 100644
--- a/fs/nfs/nfs4xdr.c
+++ b/fs/nfs/nfs4xdr.c
@@ -3012,15 +3012,19 @@ static void nfs4_xdr_enc_getdeviceinfo(struct rpc_rqst *req,
 	struct compound_hdr hdr = {
 		.minorversion = nfs4_xdr_minorversion(&args->seq_args),
 	};
+	uint32_t replen;
 
 	encode_compound_hdr(xdr, req, &hdr);
 	encode_sequence(xdr, &args->seq_args, &hdr);
+
+	replen = hdr.replen + op_decode_hdr_maxsz;
+
 	encode_getdeviceinfo(xdr, args, &hdr);
 
-	/* set up reply kvec. Subtract notification bitmap max size (2)
-	 * so that notification bitmap is put in xdr_buf tail */
+	/* set up reply kvec. device_addr4 opaque data is read into the
+	 * pages */
 	rpc_prepare_reply_pages(req, args->pdev->pages, args->pdev->pgbase,
-				args->pdev->pglen, hdr.replen - 2);
+				args->pdev->pglen, replen + 2 + 1);
 	encode_nops(&hdr);
 }
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 203/453] net: sunrpc: Fix snprintf return value check in do_xprt_debugfs
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (201 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.4 202/453] NFSv4: Fix the alignment of page data in the getdeviceinfo reply Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.4 204/453] lockd: dont use interval-based rebinding over TCP Greg Kroah-Hartman
                   ` (252 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Fedor Tokarev, Trond Myklebust, Sasha Levin

From: Fedor Tokarev <ftokarev@gmail.com>

[ Upstream commit 35a6d396721e28ba161595b0fc9e8896c00399bb ]

'snprintf' returns the number of characters which would have been written
if enough space had been available, excluding the terminating null byte.
Thus, the return value of 'sizeof(buf)' means that the last character
has been dropped.

Signed-off-by: Fedor Tokarev <ftokarev@gmail.com>
Fixes: 2f34b8bfae19 ("SUNRPC: add links for all client xprts to debugfs")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/sunrpc/debugfs.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/sunrpc/debugfs.c b/net/sunrpc/debugfs.c
index fd9bca2427242..56029e3af6ff0 100644
--- a/net/sunrpc/debugfs.c
+++ b/net/sunrpc/debugfs.c
@@ -128,13 +128,13 @@ static int do_xprt_debugfs(struct rpc_clnt *clnt, struct rpc_xprt *xprt, void *n
 		return 0;
 	len = snprintf(name, sizeof(name), "../../rpc_xprt/%s",
 		       xprt->debugfs->d_name.name);
-	if (len > sizeof(name))
+	if (len >= sizeof(name))
 		return -1;
 	if (*nump == 0)
 		strcpy(link, "xprt");
 	else {
 		len = snprintf(link, sizeof(link), "xprt%d", *nump);
-		if (len > sizeof(link))
+		if (len >= sizeof(link))
 			return -1;
 	}
 	debugfs_create_symlink(link, clnt->cl_debugfs, name);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 204/453] lockd: dont use interval-based rebinding over TCP
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (202 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.4 203/453] net: sunrpc: Fix snprintf return value check in do_xprt_debugfs Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.4 205/453] NFS: switch nfsiod to be an UNBOUND workqueue Greg Kroah-Hartman
                   ` (251 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Calum Mackay, Trond Myklebust, Sasha Levin

From: Calum Mackay <calum.mackay@oracle.com>

[ Upstream commit 9b82d88d5976e5f2b8015d58913654856576ace5 ]

NLM uses an interval-based rebinding, i.e. it clears the transport's
binding under certain conditions if more than 60 seconds have elapsed
since the connection was last bound.

This rebinding is not necessary for an autobind RPC client over a
connection-oriented protocol like TCP.

It can also cause problems: it is possible for nlm_bind_host() to clear
XPRT_BOUND whilst a connection worker is in the middle of trying to
reconnect, after it had already been checked in xprt_connect().

When the connection worker notices that XPRT_BOUND has been cleared
under it, in xs_tcp_finish_connecting(), that results in:

	xs_tcp_setup_socket: connect returned unhandled error -107

Worse, it's possible that the two can get into lockstep, resulting in
the same behaviour repeated indefinitely, with the above error every
300 seconds, without ever recovering, and the connection never being
established. This has been seen in practice, with a large number of NLM
client tasks, following a server restart.

The existing callers of nlm_bind_host & nlm_rebind_host should not need
to force the rebind, for TCP, so restrict the interval-based rebinding
to UDP only.

For TCP, we will still rebind when needed, e.g. on timeout, and connection
error (including closure), since connection-related errors on an existing
connection, ECONNREFUSED when trying to connect, and rpc_check_timeout(),
already unconditionally clear XPRT_BOUND.

To avoid having to add the fix, and explanation, to both nlm_bind_host()
and nlm_rebind_host(), remove the duplicate code from the former, and
have it call the latter.

Drop the dprintk, which adds no value over a trace.

Signed-off-by: Calum Mackay <calum.mackay@oracle.com>
Fixes: 35f5a422ce1a ("SUNRPC: new interface to force an RPC rebind")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/lockd/host.c | 20 +++++++++++---------
 1 file changed, 11 insertions(+), 9 deletions(-)

diff --git a/fs/lockd/host.c b/fs/lockd/host.c
index 7d46fafdbbe5a..584c03e11844e 100644
--- a/fs/lockd/host.c
+++ b/fs/lockd/host.c
@@ -439,12 +439,7 @@ nlm_bind_host(struct nlm_host *host)
 	 * RPC rebind is required
 	 */
 	if ((clnt = host->h_rpcclnt) != NULL) {
-		if (time_after_eq(jiffies, host->h_nextrebind)) {
-			rpc_force_rebind(clnt);
-			host->h_nextrebind = jiffies + NLM_HOST_REBIND;
-			dprintk("lockd: next rebind in %lu jiffies\n",
-					host->h_nextrebind - jiffies);
-		}
+		nlm_rebind_host(host);
 	} else {
 		unsigned long increment = nlmsvc_timeout;
 		struct rpc_timeout timeparms = {
@@ -493,13 +488,20 @@ nlm_bind_host(struct nlm_host *host)
 	return clnt;
 }
 
-/*
- * Force a portmap lookup of the remote lockd port
+/**
+ * nlm_rebind_host - If needed, force a portmap lookup of the peer's lockd port
+ * @host: NLM host handle for peer
+ *
+ * This is not needed when using a connection-oriented protocol, such as TCP.
+ * The existing autobind mechanism is sufficient to force a rebind when
+ * required, e.g. on connection state transitions.
  */
 void
 nlm_rebind_host(struct nlm_host *host)
 {
-	dprintk("lockd: rebind host %s\n", host->h_name);
+	if (host->h_proto != IPPROTO_UDP)
+		return;
+
 	if (host->h_rpcclnt && time_after_eq(jiffies, host->h_nextrebind)) {
 		rpc_force_rebind(host->h_rpcclnt);
 		host->h_nextrebind = jiffies + NLM_HOST_REBIND;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 205/453] NFS: switch nfsiod to be an UNBOUND workqueue.
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (203 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.4 204/453] lockd: dont use interval-based rebinding over TCP Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.4 206/453] selftests/seccomp: Update kernel config Greg Kroah-Hartman
                   ` (250 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, NeilBrown, Trond Myklebust, Sasha Levin

From: NeilBrown <neilb@suse.de>

[ Upstream commit bf701b765eaa82dd164d65edc5747ec7288bb5c3 ]

nfsiod is currently a concurrency-managed workqueue (CMWQ).
This means that workitems scheduled to nfsiod on a given CPU are queued
behind all other work items queued on any CMWQ on the same CPU.  This
can introduce unexpected latency.

Occaionally nfsiod can even cause excessive latency.  If the work item
to complete a CLOSE request calls the final iput() on an inode, the
address_space of that inode will be dismantled.  This takes time
proportional to the number of in-memory pages, which on a large host
working on large files (e.g..  5TB), can be a large number of pages
resulting in a noticable number of seconds.

We can avoid these latency problems by switching nfsiod to WQ_UNBOUND.
This causes each concurrent work item to gets a dedicated thread which
can be scheduled to an idle CPU.

There is precedent for this as several other filesystems use WQ_UNBOUND
workqueue for handling various async events.

Signed-off-by: NeilBrown <neilb@suse.de>
Fixes: ada609ee2ac2 ("workqueue: use WQ_MEM_RECLAIM instead of WQ_RESCUER")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/nfs/inode.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
index 6de41f7412808..53604cc090ca5 100644
--- a/fs/nfs/inode.c
+++ b/fs/nfs/inode.c
@@ -2151,7 +2151,7 @@ static int nfsiod_start(void)
 {
 	struct workqueue_struct *wq;
 	dprintk("RPC:       creating workqueue nfsiod\n");
-	wq = alloc_workqueue("nfsiod", WQ_MEM_RECLAIM, 0);
+	wq = alloc_workqueue("nfsiod", WQ_MEM_RECLAIM | WQ_UNBOUND, 0);
 	if (wq == NULL)
 		return -ENOMEM;
 	nfsiod_workqueue = wq;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 206/453] selftests/seccomp: Update kernel config
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (204 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.4 205/453] NFS: switch nfsiod to be an UNBOUND workqueue Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.4 207/453] vfio-pci: Use io_remap_pfn_range() for PCI IO memory Greg Kroah-Hartman
                   ` (249 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Kees Cook, Shuah Khan,
	Mickaël Salaün, Tycho Andersen, Sasha Levin

From: Mickaël Salaün <mic@linux.microsoft.com>

[ Upstream commit 2c07343abd8932200a45ff7b10950e71081e9e77 ]

seccomp_bpf.c uses unshare(CLONE_NEWPID), which requires CONFIG_PID_NS
to be set.

Cc: Kees Cook <keescook@chromium.org>
Cc: Shuah Khan <shuah@kernel.org>
Fixes: 6a21cc50f0c7 ("seccomp: add a return code to trap to userspace")
Signed-off-by: Mickaël Salaün <mic@linux.microsoft.com>
Acked-by: Tycho Andersen <tycho@tycho.pizza>
Signed-off-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/20201202162643.249276-1-mic@digikod.net
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/testing/selftests/seccomp/config | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tools/testing/selftests/seccomp/config b/tools/testing/selftests/seccomp/config
index db1e11b08c8a4..764af1f853f95 100644
--- a/tools/testing/selftests/seccomp/config
+++ b/tools/testing/selftests/seccomp/config
@@ -1,2 +1,3 @@
+CONFIG_PID_NS=y
 CONFIG_SECCOMP=y
 CONFIG_SECCOMP_FILTER=y
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 207/453] vfio-pci: Use io_remap_pfn_range() for PCI IO memory
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (205 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.4 206/453] selftests/seccomp: Update kernel config Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.4 208/453] hwmon: (ina3221) Fix PM usage counter unbalance in ina3221_write_enable Greg Kroah-Hartman
                   ` (248 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jason Gunthorpe, Peter Xu,
	Tom Lendacky, Alex Williamson, Sasha Levin

From: Jason Gunthorpe <jgg@nvidia.com>

[ Upstream commit 7b06a56d468b756ad6bb43ac21b11e474ebc54a0 ]

commit f8f6ae5d077a ("mm: always have io_remap_pfn_range() set
pgprot_decrypted()") allows drivers using mmap to put PCI memory mapped
BAR space into userspace to work correctly on AMD SME systems that default
to all memory encrypted.

Since vfio_pci_mmap_fault() is working with PCI memory mapped BAR space it
should be calling io_remap_pfn_range() otherwise it will not work on SME
systems.

Fixes: 11c4cd07ba11 ("vfio-pci: Fault mmaps to enable vma tracking")
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Acked-by: Peter Xu <peterx@redhat.com>
Tested-by: Tom Lendacky <thomas.lendacky@amd.com>
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/vfio/pci/vfio_pci.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
index 443a35dde7f52..632653cd70e3b 100644
--- a/drivers/vfio/pci/vfio_pci.c
+++ b/drivers/vfio/pci/vfio_pci.c
@@ -1451,8 +1451,8 @@ static vm_fault_t vfio_pci_mmap_fault(struct vm_fault *vmf)
 
 	mutex_unlock(&vdev->vma_lock);
 
-	if (remap_pfn_range(vma, vma->vm_start, vma->vm_pgoff,
-			    vma->vm_end - vma->vm_start, vma->vm_page_prot))
+	if (io_remap_pfn_range(vma, vma->vm_start, vma->vm_pgoff,
+			       vma->vm_end - vma->vm_start, vma->vm_page_prot))
 		ret = VM_FAULT_SIGBUS;
 
 up_out:
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 208/453] hwmon: (ina3221) Fix PM usage counter unbalance in ina3221_write_enable
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (206 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.4 207/453] vfio-pci: Use io_remap_pfn_range() for PCI IO memory Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.4 209/453] media: saa7146: fix array overflow in vidioc_s_audio() Greg Kroah-Hartman
                   ` (247 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Zhang Qilong, Guenter Roeck, Sasha Levin

From: Zhang Qilong <zhangqilong3@huawei.com>

[ Upstream commit bce776f10069c806290eaac712ba73432ae8ecd7 ]

pm_runtime_get_sync will increment pm usage counter
even it failed. Forgetting to putting operation will
result in reference leak here. We fix it by replacing
it with pm_runtime_resume_and_get to keep usage counter
balanced. It depends on the mainline commit[PM: runtime:
Add pm_runtime_resume_and_get to deal with usagecounter].

Fixes: 323aeb0eb5d9a ("hwmon: (ina3221) Add PM runtime support")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Link: https://lore.kernel.org/r/20201202145320.1135614-1-zhangqilong3@huawei.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hwmon/ina3221.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/hwmon/ina3221.c b/drivers/hwmon/ina3221.c
index 8a51dcf055eab..026f70d7c5a43 100644
--- a/drivers/hwmon/ina3221.c
+++ b/drivers/hwmon/ina3221.c
@@ -403,7 +403,7 @@ static int ina3221_write_enable(struct device *dev, int channel, bool enable)
 
 	/* For enabling routine, increase refcount and resume() at first */
 	if (enable) {
-		ret = pm_runtime_get_sync(ina->pm_dev);
+		ret = pm_runtime_resume_and_get(ina->pm_dev);
 		if (ret < 0) {
 			dev_err(dev, "Failed to get PM runtime\n");
 			return ret;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 209/453] media: saa7146: fix array overflow in vidioc_s_audio()
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (207 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.4 208/453] hwmon: (ina3221) Fix PM usage counter unbalance in ina3221_write_enable Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.4 210/453] powerpc/perf: Fix crash with is_sier_available when pmu is not set Greg Kroah-Hartman
                   ` (246 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Hans Verkuil,
	Mauro Carvalho Chehab, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit 8e4d86e241cf035d6d3467cd346e7ce490681937 ]

The "a->index" value comes from the user via the ioctl.  The problem is
that the shift can wrap resulting in setting "mxb->cur_audinput" to an
invalid value, which later results in an array overflow.

Fixes: 6680427791c9 ("[media] mxb: fix audio handling")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/pci/saa7146/mxb.c | 19 ++++++++++---------
 1 file changed, 10 insertions(+), 9 deletions(-)

diff --git a/drivers/media/pci/saa7146/mxb.c b/drivers/media/pci/saa7146/mxb.c
index e6a71c17566d2..952ea250feda0 100644
--- a/drivers/media/pci/saa7146/mxb.c
+++ b/drivers/media/pci/saa7146/mxb.c
@@ -641,16 +641,17 @@ static int vidioc_s_audio(struct file *file, void *fh, const struct v4l2_audio *
 	struct mxb *mxb = (struct mxb *)dev->ext_priv;
 
 	DEB_D("VIDIOC_S_AUDIO %d\n", a->index);
-	if (mxb_inputs[mxb->cur_input].audioset & (1 << a->index)) {
-		if (mxb->cur_audinput != a->index) {
-			mxb->cur_audinput = a->index;
-			tea6420_route(mxb, a->index);
-			if (mxb->cur_audinput == 0)
-				mxb_update_audmode(mxb);
-		}
-		return 0;
+	if (a->index >= 32 ||
+	    !(mxb_inputs[mxb->cur_input].audioset & (1 << a->index)))
+		return -EINVAL;
+
+	if (mxb->cur_audinput != a->index) {
+		mxb->cur_audinput = a->index;
+		tea6420_route(mxb, a->index);
+		if (mxb->cur_audinput == 0)
+			mxb_update_audmode(mxb);
 	}
-	return -EINVAL;
+	return 0;
 }
 
 #ifdef CONFIG_VIDEO_ADV_DEBUG
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 210/453] powerpc/perf: Fix crash with is_sier_available when pmu is not set
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (208 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.4 209/453] media: saa7146: fix array overflow in vidioc_s_audio() Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.4 211/453] powerpc/64: Fix an EMIT_BUG_ENTRY in head_64.S Greg Kroah-Hartman
                   ` (245 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sachin Sant, Athira Rajeev,
	Michael Ellerman, Sasha Levin

From: Athira Rajeev <atrajeev@linux.vnet.ibm.com>

[ Upstream commit f75e7d73bdf73f07b0701a6d21c111ef5d9021dd ]

On systems without any specific PMU driver support registered, running
'perf record' with —intr-regs  will crash ( perf record -I <workload> ).

The relevant portion from crash logs and Call Trace:

Unable to handle kernel paging request for data at address 0x00000068
Faulting instruction address: 0xc00000000013eb18
Oops: Kernel access of bad area, sig: 11 [#1]
CPU: 2 PID: 13435 Comm: kill Kdump: loaded Not tainted 4.18.0-193.el8.ppc64le #1
NIP:  c00000000013eb18 LR: c000000000139f2c CTR: c000000000393d80
REGS: c0000004a07ab4f0 TRAP: 0300   Not tainted  (4.18.0-193.el8.ppc64le)
NIP [c00000000013eb18] is_sier_available+0x18/0x30
LR [c000000000139f2c] perf_reg_value+0x6c/0xb0
Call Trace:
[c0000004a07ab770] [c0000004a07ab7c8] 0xc0000004a07ab7c8 (unreliable)
[c0000004a07ab7a0] [c0000000003aa77c] perf_output_sample+0x60c/0xac0
[c0000004a07ab840] [c0000000003ab3f0] perf_event_output_forward+0x70/0xb0
[c0000004a07ab8c0] [c00000000039e208] __perf_event_overflow+0x88/0x1a0
[c0000004a07ab910] [c00000000039e42c] perf_swevent_hrtimer+0x10c/0x1d0
[c0000004a07abc50] [c000000000228b9c] __hrtimer_run_queues+0x17c/0x480
[c0000004a07abcf0] [c00000000022aaf4] hrtimer_interrupt+0x144/0x520
[c0000004a07abdd0] [c00000000002a864] timer_interrupt+0x104/0x2f0
[c0000004a07abe30] [c0000000000091c4] decrementer_common+0x114/0x120

When perf record session is started with "-I" option, capturing registers
on each sample calls is_sier_available() to check for the
SIER (Sample Instruction Event Register) availability in the platform.
This function in core-book3s accesses 'ppmu->flags'. If a platform specific
PMU driver is not registered, ppmu is set to NULL and accessing its
members results in a crash. Fix the crash by returning false in
is_sier_available() if ppmu is not set.

Fixes: 333804dc3b7a ("powerpc/perf: Update perf_regs structure to include SIER")
Reported-by: Sachin Sant <sachinp@linux.vnet.ibm.com>
Signed-off-by: Athira Rajeev <atrajeev@linux.vnet.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/1606185640-1720-1-git-send-email-atrajeev@linux.vnet.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/perf/core-book3s.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/arch/powerpc/perf/core-book3s.c b/arch/powerpc/perf/core-book3s.c
index f582aa2d98078..7bf1adcdfdaa1 100644
--- a/arch/powerpc/perf/core-book3s.c
+++ b/arch/powerpc/perf/core-book3s.c
@@ -133,6 +133,9 @@ static void pmao_restore_workaround(bool ebb) { }
 
 bool is_sier_available(void)
 {
+	if (!ppmu)
+		return false;
+
 	if (ppmu->flags & PPMU_HAS_SIER)
 		return true;
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 211/453] powerpc/64: Fix an EMIT_BUG_ENTRY in head_64.S
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (209 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.4 210/453] powerpc/perf: Fix crash with is_sier_available when pmu is not set Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.4 212/453] clocksource/drivers/orion: Add missing clk_disable_unprepare() on error path Greg Kroah-Hartman
                   ` (244 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jordan Niethe, Michael Ellerman, Sasha Levin

From: Jordan Niethe <jniethe5@gmail.com>

[ Upstream commit fe18a35e685c9bdabc8b11b3e19deb85a068b75d ]

Commit 63ce271b5e37 ("powerpc/prom: convert PROM_BUG() to standard
trap") added an EMIT_BUG_ENTRY for the trap after the branch to
start_kernel(). The EMIT_BUG_ENTRY was for the address "0b", however the
trap was not labeled with "0". Hence the address used for bug is in
relative_toc() where the previous "0" label is. Label the trap as "0" so
the correct address is used.

Fixes: 63ce271b5e37 ("powerpc/prom: convert PROM_BUG() to standard trap")
Signed-off-by: Jordan Niethe <jniethe5@gmail.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20201130004404.30953-1-jniethe5@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/kernel/head_64.S | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/powerpc/kernel/head_64.S b/arch/powerpc/kernel/head_64.S
index d61b3b13a6ec8..9019f1395d39a 100644
--- a/arch/powerpc/kernel/head_64.S
+++ b/arch/powerpc/kernel/head_64.S
@@ -992,7 +992,7 @@ start_here_common:
 	bl	start_kernel
 
 	/* Not reached */
-	trap
+0:	trap
 	EMIT_BUG_ENTRY 0b, __FILE__, __LINE__, 0
 
 /*
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 212/453] clocksource/drivers/orion: Add missing clk_disable_unprepare() on error path
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (210 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.4 211/453] powerpc/64: Fix an EMIT_BUG_ENTRY in head_64.S Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.4 213/453] clocksource/drivers/cadence_ttc: Fix memory leak in ttc_setup_clockevent() Greg Kroah-Hartman
                   ` (243 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Yang Yingliang,
	Daniel Lezcano, Sasha Levin

From: Yang Yingliang <yangyingliang@huawei.com>

[ Upstream commit c1e6cad00aa2f17845e7270e38ff3cc82c7b022a ]

After calling clk_prepare_enable(), clk_disable_unprepare() need
be called on error path.

Fixes: fbe4b3566ddc ("clocksource/drivers/orion: Convert init function...")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Link: https://lore.kernel.org/r/20201111064706.3397156-1-yangyingliang@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clocksource/timer-orion.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/drivers/clocksource/timer-orion.c b/drivers/clocksource/timer-orion.c
index 7d487107e3cd8..32b2563e2ad1b 100644
--- a/drivers/clocksource/timer-orion.c
+++ b/drivers/clocksource/timer-orion.c
@@ -149,7 +149,8 @@ static int __init orion_timer_init(struct device_node *np)
 	irq = irq_of_parse_and_map(np, 1);
 	if (irq <= 0) {
 		pr_err("%pOFn: unable to parse timer1 irq\n", np);
-		return -EINVAL;
+		ret = -EINVAL;
+		goto out_unprep_clk;
 	}
 
 	rate = clk_get_rate(clk);
@@ -166,7 +167,7 @@ static int __init orion_timer_init(struct device_node *np)
 				    clocksource_mmio_readl_down);
 	if (ret) {
 		pr_err("Failed to initialize mmio timer\n");
-		return ret;
+		goto out_unprep_clk;
 	}
 
 	sched_clock_register(orion_read_sched_clock, 32, rate);
@@ -175,7 +176,7 @@ static int __init orion_timer_init(struct device_node *np)
 	ret = setup_irq(irq, &orion_clkevt_irq);
 	if (ret) {
 		pr_err("%pOFn: unable to setup irq\n", np);
-		return ret;
+		goto out_unprep_clk;
 	}
 
 	ticks_per_jiffy = (clk_get_rate(clk) + HZ/2) / HZ;
@@ -188,5 +189,9 @@ static int __init orion_timer_init(struct device_node *np)
 	orion_delay_timer_init(rate);
 
 	return 0;
+
+out_unprep_clk:
+	clk_disable_unprepare(clk);
+	return ret;
 }
 TIMER_OF_DECLARE(orion_timer, "marvell,orion-timer", orion_timer_init);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 213/453] clocksource/drivers/cadence_ttc: Fix memory leak in ttc_setup_clockevent()
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (211 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.4 212/453] clocksource/drivers/orion: Add missing clk_disable_unprepare() on error path Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.4 214/453] iio: hrtimer-trigger: Mark hrtimer to expire in hard interrupt context Greg Kroah-Hartman
                   ` (242 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Yu Kuai, Daniel Lezcano,
	Sasha Levin

From: Yu Kuai <yukuai3@huawei.com>

[ Upstream commit eee422c46e6840a81c9db18a497b74387a557b29 ]

If clk_notifier_register() failed, ttc_setup_clockevent() will return
without freeing 'ttcce', which will leak memory.

Fixes: 70504f311d4b ("clocksource/drivers/cadence_ttc: Convert init function to return error")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Link: https://lore.kernel.org/r/20201116135123.2164033-1-yukuai3@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clocksource/timer-cadence-ttc.c | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/drivers/clocksource/timer-cadence-ttc.c b/drivers/clocksource/timer-cadence-ttc.c
index 88fe2e9ba9a35..160bc6597de5b 100644
--- a/drivers/clocksource/timer-cadence-ttc.c
+++ b/drivers/clocksource/timer-cadence-ttc.c
@@ -411,10 +411,8 @@ static int __init ttc_setup_clockevent(struct clk *clk,
 	ttcce->ttc.clk = clk;
 
 	err = clk_prepare_enable(ttcce->ttc.clk);
-	if (err) {
-		kfree(ttcce);
-		return err;
-	}
+	if (err)
+		goto out_kfree;
 
 	ttcce->ttc.clk_rate_change_nb.notifier_call =
 		ttc_rate_change_clockevent_cb;
@@ -424,7 +422,7 @@ static int __init ttc_setup_clockevent(struct clk *clk,
 				    &ttcce->ttc.clk_rate_change_nb);
 	if (err) {
 		pr_warn("Unable to register clock notifier.\n");
-		return err;
+		goto out_kfree;
 	}
 
 	ttcce->ttc.freq = clk_get_rate(ttcce->ttc.clk);
@@ -453,15 +451,17 @@ static int __init ttc_setup_clockevent(struct clk *clk,
 
 	err = request_irq(irq, ttc_clock_event_interrupt,
 			  IRQF_TIMER, ttcce->ce.name, ttcce);
-	if (err) {
-		kfree(ttcce);
-		return err;
-	}
+	if (err)
+		goto out_kfree;
 
 	clockevents_config_and_register(&ttcce->ce,
 			ttcce->ttc.freq / PRESCALE, 1, 0xfffe);
 
 	return 0;
+
+out_kfree:
+	kfree(ttcce);
+	return err;
 }
 
 /**
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 214/453] iio: hrtimer-trigger: Mark hrtimer to expire in hard interrupt context
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (212 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.4 213/453] clocksource/drivers/cadence_ttc: Fix memory leak in ttc_setup_clockevent() Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.4 215/453] ARM: dts: at91: sama5d2: map securam as device Greg Kroah-Hartman
                   ` (241 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christian Eggers, Lars-Peter Clausen,
	Sebastian Andrzej Siewior, Jonathan Cameron, Sasha Levin

From: Lars-Peter Clausen <lars@metafoo.de>

[ Upstream commit 0178297c1e6898e2197fe169ef3be723e019b971 ]

On PREEMPT_RT enabled kernels unmarked hrtimers are moved into soft
interrupt expiry mode by default.

The IIO hrtimer-trigger needs to run in hard interrupt context since it
will end up calling generic_handle_irq() which has the requirement to run
in hard interrupt context.

Explicitly specify that the timer needs to run in hard interrupt context by
using the HRTIMER_MODE_REL_HARD flag.

Fixes: f5c2f0215e36 ("hrtimer: Move unmarked hrtimers to soft interrupt expiry on RT")
Reported-by: Christian Eggers <ceggers@arri.de>
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Acked-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Link: https://lore.kernel.org/r/20201117103751.16131-1-lars@metafoo.de
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iio/trigger/iio-trig-hrtimer.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/iio/trigger/iio-trig-hrtimer.c b/drivers/iio/trigger/iio-trig-hrtimer.c
index a5e670726717f..58c1c30d5612b 100644
--- a/drivers/iio/trigger/iio-trig-hrtimer.c
+++ b/drivers/iio/trigger/iio-trig-hrtimer.c
@@ -102,7 +102,7 @@ static int iio_trig_hrtimer_set_state(struct iio_trigger *trig, bool state)
 
 	if (state)
 		hrtimer_start(&trig_info->timer, trig_info->period,
-			      HRTIMER_MODE_REL);
+			      HRTIMER_MODE_REL_HARD);
 	else
 		hrtimer_cancel(&trig_info->timer);
 
@@ -132,7 +132,7 @@ static struct iio_sw_trigger *iio_trig_hrtimer_probe(const char *name)
 	trig_info->swt.trigger->ops = &iio_hrtimer_trigger_ops;
 	trig_info->swt.trigger->dev.groups = iio_hrtimer_attr_groups;
 
-	hrtimer_init(&trig_info->timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
+	hrtimer_init(&trig_info->timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL_HARD);
 	trig_info->timer.function = iio_hrtimer_trig_handler;
 
 	trig_info->sampling_frequency = HRTIMER_DEFAULT_SAMPLING_FREQUENCY;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 215/453] ARM: dts: at91: sama5d2: map securam as device
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (213 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.4 214/453] iio: hrtimer-trigger: Mark hrtimer to expire in hard interrupt context Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.4 216/453] bpf: Fix bpf_put_raw_tracepoint()s use of __module_address() Greg Kroah-Hartman
                   ` (240 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Claudiu Beznea, Alexandre Belloni,
	Nicolas Ferre, Sasha Levin

From: Claudiu Beznea <claudiu.beznea@microchip.com>

[ Upstream commit 9b5dcc8d427e2bcb84c49eb03ffefe11e7537a55 ]

Due to strobe signal not being propagated from CPU to securam
the securam needs to be mapped as device or strongly ordered memory
to work properly. Otherwise, updating to one offset may affect
the adjacent locations in securam.

Fixes: d4ce5f44d4409 ("ARM: dts: at91: sama5d2: Add securam node")
Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Acked-by: Nicolas Ferre <nicolas.ferre@microchip.com>
Link: https://lore.kernel.org/r/1606903025-14197-3-git-send-email-claudiu.beznea@microchip.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/sama5d2.dtsi | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/arm/boot/dts/sama5d2.dtsi b/arch/arm/boot/dts/sama5d2.dtsi
index 2e2c1a7b1d1dc..5ea9aa9c060a0 100644
--- a/arch/arm/boot/dts/sama5d2.dtsi
+++ b/arch/arm/boot/dts/sama5d2.dtsi
@@ -648,6 +648,7 @@
 				clocks = <&pmc PMC_TYPE_PERIPHERAL 51>;
 				#address-cells = <1>;
 				#size-cells = <1>;
+				no-memory-wc;
 				ranges = <0 0xf8044000 0x1420>;
 			};
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 216/453] bpf: Fix bpf_put_raw_tracepoint()s use of __module_address()
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (214 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.4 215/453] ARM: dts: at91: sama5d2: map securam as device Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.4 217/453] pinctrl: falcon: add missing put_device() call in pinctrl_falcon_probe() Greg Kroah-Hartman
                   ` (239 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Andrii Nakryiko, Alexei Starovoitov,
	Martin KaFai Lau, Sasha Levin

From: Andrii Nakryiko <andrii@kernel.org>

[ Upstream commit 12cc126df82c96c89706aa207ad27c56f219047c ]

__module_address() needs to be called with preemption disabled or with
module_mutex taken. preempt_disable() is enough for read-only uses, which is
what this fix does. Also, module_put() does internal check for NULL, so drop
it as well.

Fixes: a38d1107f937 ("bpf: support raw tracepoints in modules")
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Martin KaFai Lau <kafai@fb.com>
Link: https://lore.kernel.org/bpf/20201203204634.1325171-2-andrii@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/trace/bpf_trace.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
index 2372b861f2cfa..74c1db7178cff 100644
--- a/kernel/trace/bpf_trace.c
+++ b/kernel/trace/bpf_trace.c
@@ -1320,10 +1320,12 @@ struct bpf_raw_event_map *bpf_get_raw_tracepoint(const char *name)
 
 void bpf_put_raw_tracepoint(struct bpf_raw_event_map *btp)
 {
-	struct module *mod = __module_address((unsigned long)btp);
+	struct module *mod;
 
-	if (mod)
-		module_put(mod);
+	preempt_disable();
+	mod = __module_address((unsigned long)btp);
+	module_put(mod);
+	preempt_enable();
 }
 
 static __always_inline
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 217/453] pinctrl: falcon: add missing put_device() call in pinctrl_falcon_probe()
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (215 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.4 216/453] bpf: Fix bpf_put_raw_tracepoint()s use of __module_address() Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.4 218/453] arm64: dts: rockchip: Fix UART pull-ups on rk3328 Greg Kroah-Hartman
                   ` (238 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yu Kuai, Linus Walleij, Sasha Levin

From: Yu Kuai <yukuai3@huawei.com>

[ Upstream commit 89cce2b3f247a434ee174ab6803698041df98014 ]

if of_find_device_by_node() succeed, pinctrl_falcon_probe() doesn't have
a corresponding put_device(). Thus add put_device() to fix the exception
handling for this function implementation.

Fixes: e316cb2b16bb ("OF: pinctrl: MIPS: lantiq: adds support for FALCON SoC")
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
Link: https://lore.kernel.org/r/20201119011219.2248232-1-yukuai3@huawei.com
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pinctrl/pinctrl-falcon.c | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/drivers/pinctrl/pinctrl-falcon.c b/drivers/pinctrl/pinctrl-falcon.c
index 62c02b969327f..7521a924dffb0 100644
--- a/drivers/pinctrl/pinctrl-falcon.c
+++ b/drivers/pinctrl/pinctrl-falcon.c
@@ -431,24 +431,28 @@ static int pinctrl_falcon_probe(struct platform_device *pdev)
 
 	/* load and remap the pad resources of the different banks */
 	for_each_compatible_node(np, NULL, "lantiq,pad-falcon") {
-		struct platform_device *ppdev = of_find_device_by_node(np);
 		const __be32 *bank = of_get_property(np, "lantiq,bank", NULL);
 		struct resource res;
+		struct platform_device *ppdev;
 		u32 avail;
 		int pins;
 
 		if (!of_device_is_available(np))
 			continue;
 
-		if (!ppdev) {
-			dev_err(&pdev->dev, "failed to find pad pdev\n");
-			continue;
-		}
 		if (!bank || *bank >= PORTS)
 			continue;
 		if (of_address_to_resource(np, 0, &res))
 			continue;
+
+		ppdev = of_find_device_by_node(np);
+		if (!ppdev) {
+			dev_err(&pdev->dev, "failed to find pad pdev\n");
+			continue;
+		}
+
 		falcon_info.clk[*bank] = clk_get(&ppdev->dev, NULL);
+		put_device(&ppdev->dev);
 		if (IS_ERR(falcon_info.clk[*bank])) {
 			dev_err(&ppdev->dev, "failed to get clock\n");
 			of_node_put(np);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 218/453] arm64: dts: rockchip: Fix UART pull-ups on rk3328
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (216 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.4 217/453] pinctrl: falcon: add missing put_device() call in pinctrl_falcon_probe() Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.4 219/453] memstick: r592: Fix error return in r592_probe() Greg Kroah-Hartman
                   ` (237 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chen-Yu Tsai, Heiko Stuebner, Sasha Levin

From: Chen-Yu Tsai <wens@csie.org>

[ Upstream commit 94dad6bed3c86c00050bf7c2b2ad6b630facae31 ]

For UARTs, the local pull-ups should be on the RX pin, not the TX pin.
UARTs transmit active-low, so a disconnected RX pin should be pulled
high instead of left floating to prevent noise being interpreted as
transmissions.

This gets rid of bogus sysrq events when the UART console is not
connected.

Fixes: 52e02d377a72 ("arm64: dts: rockchip: add core dtsi file for RK3328 SoCs")
Signed-off-by: Chen-Yu Tsai <wens@csie.org>
Link: https://lore.kernel.org/r/20201204064805.6480-1-wens@kernel.org
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/rockchip/rk3328.dtsi | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/arch/arm64/boot/dts/rockchip/rk3328.dtsi b/arch/arm64/boot/dts/rockchip/rk3328.dtsi
index 31cc1541f1f59..e0ed323935a4d 100644
--- a/arch/arm64/boot/dts/rockchip/rk3328.dtsi
+++ b/arch/arm64/boot/dts/rockchip/rk3328.dtsi
@@ -1190,8 +1190,8 @@
 
 		uart0 {
 			uart0_xfer: uart0-xfer {
-				rockchip,pins = <1 RK_PB1 1 &pcfg_pull_up>,
-						<1 RK_PB0 1 &pcfg_pull_none>;
+				rockchip,pins = <1 RK_PB1 1 &pcfg_pull_none>,
+						<1 RK_PB0 1 &pcfg_pull_up>;
 			};
 
 			uart0_cts: uart0-cts {
@@ -1209,8 +1209,8 @@
 
 		uart1 {
 			uart1_xfer: uart1-xfer {
-				rockchip,pins = <3 RK_PA4 4 &pcfg_pull_up>,
-						<3 RK_PA6 4 &pcfg_pull_none>;
+				rockchip,pins = <3 RK_PA4 4 &pcfg_pull_none>,
+						<3 RK_PA6 4 &pcfg_pull_up>;
 			};
 
 			uart1_cts: uart1-cts {
@@ -1228,15 +1228,15 @@
 
 		uart2-0 {
 			uart2m0_xfer: uart2m0-xfer {
-				rockchip,pins = <1 RK_PA0 2 &pcfg_pull_up>,
-						<1 RK_PA1 2 &pcfg_pull_none>;
+				rockchip,pins = <1 RK_PA0 2 &pcfg_pull_none>,
+						<1 RK_PA1 2 &pcfg_pull_up>;
 			};
 		};
 
 		uart2-1 {
 			uart2m1_xfer: uart2m1-xfer {
-				rockchip,pins = <2 RK_PA0 1 &pcfg_pull_up>,
-						<2 RK_PA1 1 &pcfg_pull_none>;
+				rockchip,pins = <2 RK_PA0 1 &pcfg_pull_none>,
+						<2 RK_PA1 1 &pcfg_pull_up>;
 			};
 		};
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 219/453] memstick: r592: Fix error return in r592_probe()
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (217 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.4 218/453] arm64: dts: rockchip: Fix UART pull-ups on rk3328 Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.4 220/453] MIPS: Dont round up kernel sections size for memblock_add() Greg Kroah-Hartman
                   ` (236 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jing Xiangfeng, Ulf Hansson, Sasha Levin

From: Jing Xiangfeng <jingxiangfeng@huawei.com>

[ Upstream commit db29d3d1c2451e673e29c7257471e3ce9d50383a ]

Fix to return a error code from the error handling case instead of 0.

Fixes: 926341250102 ("memstick: add driver for Ricoh R5C592 card reader")
Signed-off-by: Jing Xiangfeng <jingxiangfeng@huawei.com>
Link: https://lore.kernel.org/r/20201125014718.153563-1-jingxiangfeng@huawei.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/memstick/host/r592.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/drivers/memstick/host/r592.c b/drivers/memstick/host/r592.c
index dd3a1f3dcc191..d2ef46337191c 100644
--- a/drivers/memstick/host/r592.c
+++ b/drivers/memstick/host/r592.c
@@ -759,8 +759,10 @@ static int r592_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 		goto error3;
 
 	dev->mmio = pci_ioremap_bar(pdev, 0);
-	if (!dev->mmio)
+	if (!dev->mmio) {
+		error = -ENOMEM;
 		goto error4;
+	}
 
 	dev->irq = pdev->irq;
 	spin_lock_init(&dev->irq_lock);
@@ -786,12 +788,14 @@ static int r592_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 		&dev->dummy_dma_page_physical_address, GFP_KERNEL);
 	r592_stop_dma(dev , 0);
 
-	if (request_irq(dev->irq, &r592_irq, IRQF_SHARED,
-			  DRV_NAME, dev))
+	error = request_irq(dev->irq, &r592_irq, IRQF_SHARED,
+			  DRV_NAME, dev);
+	if (error)
 		goto error6;
 
 	r592_update_card_detect(dev);
-	if (memstick_add_host(host))
+	error = memstick_add_host(host);
+	if (error)
 		goto error7;
 
 	message("driver successfully loaded");
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 220/453] MIPS: Dont round up kernel sections size for memblock_add()
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (218 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.4 219/453] memstick: r592: Fix error return in r592_probe() Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.4 221/453] net/mlx5: Properly convey driver version to firmware Greg Kroah-Hartman
                   ` (235 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Alexander Sverdlin,
	Thomas Bogendoerfer, Sasha Levin

From: Alexander Sverdlin <alexander.sverdlin@nokia.com>

[ Upstream commit d121f125af22a16f0f679293756d28a9691fa46d ]

Linux doesn't own the memory immediately after the kernel image. On Octeon
bootloader places a shared structure right close after the kernel _end,
refer to "struct cvmx_bootinfo *octeon_bootinfo" in cavium-octeon/setup.c.

If check_kernel_sections_mem() rounds the PFNs up, first memblock_alloc()
inside early_init_dt_alloc_memory_arch() <= device_tree_init() returns
memory block overlapping with the above octeon_bootinfo structure, which
is being overwritten afterwards.

Fixes: a94e4f24ec83 ("MIPS: init: Drop boot_mem_map")
Signed-off-by: Alexander Sverdlin <alexander.sverdlin@nokia.com>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/mips/kernel/setup.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/mips/kernel/setup.c b/arch/mips/kernel/setup.c
index b8884de89c81e..82e44b31aad59 100644
--- a/arch/mips/kernel/setup.c
+++ b/arch/mips/kernel/setup.c
@@ -529,8 +529,8 @@ static void __init request_crashkernel(struct resource *res)
 
 static void __init check_kernel_sections_mem(void)
 {
-	phys_addr_t start = PFN_PHYS(PFN_DOWN(__pa_symbol(&_text)));
-	phys_addr_t size = PFN_PHYS(PFN_UP(__pa_symbol(&_end))) - start;
+	phys_addr_t start = __pa_symbol(&_text);
+	phys_addr_t size = __pa_symbol(&_end) - start;
 
 	if (!memblock_is_region_memory(start, size)) {
 		pr_info("Kernel sections are not in the memory maps\n");
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 221/453] net/mlx5: Properly convey driver version to firmware
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (219 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.4 220/453] MIPS: Dont round up kernel sections size for memblock_add() Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.4 222/453] ASoC: jz4740-i2s: add missed checks for clk_get() Greg Kroah-Hartman
                   ` (234 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Leon Romanovsky, Sasha Levin

From: Leon Romanovsky <leonro@nvidia.com>

[ Upstream commit 907af0f0cab4ee5d5604f182ecec2c5b5119d294 ]

mlx5 firmware expects driver version in specific format X.X.X, so
make it always correct and based on real kernel version aligned with
the driver.

Fixes: 012e50e109fd ("net/mlx5: Set driver version into firmware")
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/mellanox/mlx5/core/main.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
index 7c0a726277b00..f2657cd3ffa4f 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
@@ -50,6 +50,7 @@
 #ifdef CONFIG_RFS_ACCEL
 #include <linux/cpu_rmap.h>
 #endif
+#include <linux/version.h>
 #include <net/devlink.h>
 #include "mlx5_core.h"
 #include "lib/eq.h"
@@ -227,7 +228,10 @@ static void mlx5_set_driver_version(struct mlx5_core_dev *dev)
 	strncat(string, ",", remaining_size);
 
 	remaining_size = max_t(int, 0, driver_ver_sz - strlen(string));
-	strncat(string, DRIVER_VERSION, remaining_size);
+
+	snprintf(string + strlen(string), remaining_size, "%u.%u.%u",
+		 (u8)((LINUX_VERSION_CODE >> 16) & 0xff), (u8)((LINUX_VERSION_CODE >> 8) & 0xff),
+		 (u16)(LINUX_VERSION_CODE & 0xffff));
 
 	/*Send the command*/
 	MLX5_SET(set_driver_version_in, in, opcode,
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 222/453] ASoC: jz4740-i2s: add missed checks for clk_get()
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (220 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.4 221/453] net/mlx5: Properly convey driver version to firmware Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.4 223/453] dm ioctl: fix error return code in target_message Greg Kroah-Hartman
                   ` (233 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chuhong Yuan, Mark Brown, Sasha Levin

From: Chuhong Yuan <hslester96@gmail.com>

[ Upstream commit 1c1fb2653a0c2e3f310c07eacd8fc3a10e08c97a ]

jz4740_i2s_set_sysclk() does not check the return values of clk_get(),
while the file dereferences the pointers in clk_put().
Add the missed checks to fix it.

Fixes: 11bd3dd1b7c2 ("ASoC: Add JZ4740 ASoC support")
Signed-off-by: Chuhong Yuan <hslester96@gmail.com>
Link: https://lore.kernel.org/r/20201203144227.418194-1-hslester96@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/jz4740/jz4740-i2s.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/sound/soc/jz4740/jz4740-i2s.c b/sound/soc/jz4740/jz4740-i2s.c
index 0bbd86390be59..9bfd2aabbfe63 100644
--- a/sound/soc/jz4740/jz4740-i2s.c
+++ b/sound/soc/jz4740/jz4740-i2s.c
@@ -309,10 +309,14 @@ static int jz4740_i2s_set_sysclk(struct snd_soc_dai *dai, int clk_id,
 	switch (clk_id) {
 	case JZ4740_I2S_CLKSRC_EXT:
 		parent = clk_get(NULL, "ext");
+		if (IS_ERR(parent))
+			return PTR_ERR(parent);
 		clk_set_parent(i2s->clk_i2s, parent);
 		break;
 	case JZ4740_I2S_CLKSRC_PLL:
 		parent = clk_get(NULL, "pll half");
+		if (IS_ERR(parent))
+			return PTR_ERR(parent);
 		clk_set_parent(i2s->clk_i2s, parent);
 		ret = clk_set_rate(i2s->clk_i2s, freq);
 		break;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 223/453] dm ioctl: fix error return code in target_message
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (221 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.4 222/453] ASoC: jz4740-i2s: add missed checks for clk_get() Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.4 224/453] phy: renesas: rcar-gen3-usb2: disable runtime pm in case of failure Greg Kroah-Hartman
                   ` (232 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Qinglang Miao,
	Mike Snitzer, Sasha Levin

From: Qinglang Miao <miaoqinglang@huawei.com>

[ Upstream commit 4d7659bfbe277a43399a4a2d90fca141e70f29e1 ]

Fix to return a negative error code from the error handling
case instead of 0, as done elsewhere in this function.

Fixes: 2ca4c92f58f9 ("dm ioctl: prevent empty message")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/md/dm-ioctl.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c
index ac83f5002ce5f..1c5133f71af39 100644
--- a/drivers/md/dm-ioctl.c
+++ b/drivers/md/dm-ioctl.c
@@ -1600,6 +1600,7 @@ static int target_message(struct file *filp, struct dm_ioctl *param, size_t para
 
 	if (!argc) {
 		DMWARN("Empty message received.");
+		r = -EINVAL;
 		goto out_argv;
 	}
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 224/453] phy: renesas: rcar-gen3-usb2: disable runtime pm in case of failure
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (222 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.4 223/453] dm ioctl: fix error return code in target_message Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.4 225/453] clocksource/drivers/arm_arch_timer: Use stable count reader in erratum sne Greg Kroah-Hartman
                   ` (231 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Wang Li, Vinod Koul, Sasha Levin

From: Wang Li <wangli74@huawei.com>

[ Upstream commit 51e339deab1e51443f6ac3b1bd5cd6cc8e8fe1d9 ]

pm_runtime_enable() will decrease power disable depth. Thus a pairing
increment is needed on the error handling path to keep it balanced.

Fixes: 5d8042e95fd4 ("phy: rcar-gen3-usb2: Add support for r8a77470")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Wang Li <wangli74@huawei.com>
Link: https://lore.kernel.org/r/20201126024412.4046845-1-wangli74@huawei.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/phy/renesas/phy-rcar-gen3-usb2.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/phy/renesas/phy-rcar-gen3-usb2.c b/drivers/phy/renesas/phy-rcar-gen3-usb2.c
index 5087b7c44d55b..cfb98bba7715b 100644
--- a/drivers/phy/renesas/phy-rcar-gen3-usb2.c
+++ b/drivers/phy/renesas/phy-rcar-gen3-usb2.c
@@ -654,8 +654,10 @@ static int rcar_gen3_phy_usb2_probe(struct platform_device *pdev)
 	 */
 	pm_runtime_enable(dev);
 	phy_usb2_ops = of_device_get_match_data(dev);
-	if (!phy_usb2_ops)
-		return -EINVAL;
+	if (!phy_usb2_ops) {
+		ret = -EINVAL;
+		goto error;
+	}
 
 	mutex_init(&channel->lock);
 	for (i = 0; i < NUM_OF_PHYS; i++) {
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 225/453] clocksource/drivers/arm_arch_timer: Use stable count reader in erratum sne
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (223 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.4 224/453] phy: renesas: rcar-gen3-usb2: disable runtime pm in case of failure Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.4 226/453] clocksource/drivers/arm_arch_timer: Correct fault programming of CNTKCTL_EL1.EVNTI Greg Kroah-Hartman
                   ` (230 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Marc Zyngier, Keqian Zhu,
	Daniel Lezcano, Sasha Levin

From: Keqian Zhu <zhukeqian1@huawei.com>

[ Upstream commit d8cc3905b8073c7cfbff94af889fa8dc71f21dd5 ]

In commit 0ea415390cd3 ("clocksource/arm_arch_timer: Use arch_timer_read_counter
to access stable counters"), we separate stable and normal count reader to omit
unnecessary overhead on systems that have no timer erratum.

However, in erratum_set_next_event_tval_generic(), count reader becomes normal
reader. This converts it to stable reader.

Fixes: 0ea415390cd3 ("clocksource/arm_arch_timer: Use arch_timer_read_counter to access stable counters")
Acked-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Keqian Zhu <zhukeqian1@huawei.com>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Link: https://lore.kernel.org/r/20201204073126.6920-2-zhukeqian1@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clocksource/arm_arch_timer.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/clocksource/arm_arch_timer.c b/drivers/clocksource/arm_arch_timer.c
index 4be83b4de2a0a..d2120fcf1f3f6 100644
--- a/drivers/clocksource/arm_arch_timer.c
+++ b/drivers/clocksource/arm_arch_timer.c
@@ -392,10 +392,10 @@ static void erratum_set_next_event_tval_generic(const int access, unsigned long
 	ctrl &= ~ARCH_TIMER_CTRL_IT_MASK;
 
 	if (access == ARCH_TIMER_PHYS_ACCESS) {
-		cval = evt + arch_counter_get_cntpct();
+		cval = evt + arch_counter_get_cntpct_stable();
 		write_sysreg(cval, cntp_cval_el0);
 	} else {
-		cval = evt + arch_counter_get_cntvct();
+		cval = evt + arch_counter_get_cntvct_stable();
 		write_sysreg(cval, cntv_cval_el0);
 	}
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 226/453] clocksource/drivers/arm_arch_timer: Correct fault programming of CNTKCTL_EL1.EVNTI
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (224 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.4 225/453] clocksource/drivers/arm_arch_timer: Use stable count reader in erratum sne Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.4 227/453] cpufreq: ap806: Add missing MODULE_DEVICE_TABLE Greg Kroah-Hartman
                   ` (229 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Marc Zyngier, Keqian Zhu,
	Daniel Lezcano, Sasha Levin

From: Keqian Zhu <zhukeqian1@huawei.com>

[ Upstream commit 8b7770b877d187bfdae1eaf587bd2b792479a31c ]

ARM virtual counter supports event stream, it can only trigger an event
when the trigger bit (the value of CNTKCTL_EL1.EVNTI) of CNTVCT_EL0 changes,
so the actual period of event stream is 2^(cntkctl_evnti + 1). For example,
when the trigger bit is 0, then virtual counter trigger an event for every
two cycles.

While we're at it, rework the way we compute the trigger bit position
by making it more obvious that when bits [n:n-1] are both set (with n
being the most significant bit), we pick bit (n + 1).

Fixes: 037f637767a8 ("drivers: clocksource: add support for ARM architected timer event stream")
Suggested-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Keqian Zhu <zhukeqian1@huawei.com>
Acked-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Link: https://lore.kernel.org/r/20201204073126.6920-3-zhukeqian1@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clocksource/arm_arch_timer.c | 23 ++++++++++++++++-------
 1 file changed, 16 insertions(+), 7 deletions(-)

diff --git a/drivers/clocksource/arm_arch_timer.c b/drivers/clocksource/arm_arch_timer.c
index d2120fcf1f3f6..39cdda2c9a98b 100644
--- a/drivers/clocksource/arm_arch_timer.c
+++ b/drivers/clocksource/arm_arch_timer.c
@@ -818,15 +818,24 @@ static void arch_timer_evtstrm_enable(int divider)
 
 static void arch_timer_configure_evtstream(void)
 {
-	int evt_stream_div, pos;
+	int evt_stream_div, lsb;
+
+	/*
+	 * As the event stream can at most be generated at half the frequency
+	 * of the counter, use half the frequency when computing the divider.
+	 */
+	evt_stream_div = arch_timer_rate / ARCH_TIMER_EVT_STREAM_FREQ / 2;
+
+	/*
+	 * Find the closest power of two to the divisor. If the adjacent bit
+	 * of lsb (last set bit, starts from 0) is set, then we use (lsb + 1).
+	 */
+	lsb = fls(evt_stream_div) - 1;
+	if (lsb > 0 && (evt_stream_div & BIT(lsb - 1)))
+		lsb++;
 
-	/* Find the closest power of two to the divisor */
-	evt_stream_div = arch_timer_rate / ARCH_TIMER_EVT_STREAM_FREQ;
-	pos = fls(evt_stream_div);
-	if (pos > 1 && !(evt_stream_div & (1 << (pos - 2))))
-		pos--;
 	/* enable event stream */
-	arch_timer_evtstrm_enable(min(pos, 15));
+	arch_timer_evtstrm_enable(max(0, min(lsb, 15)));
 }
 
 static void arch_counter_set_user_access(void)
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 227/453] cpufreq: ap806: Add missing MODULE_DEVICE_TABLE
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (225 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.4 226/453] clocksource/drivers/arm_arch_timer: Correct fault programming of CNTKCTL_EL1.EVNTI Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.4 228/453] cpufreq: highbank: " Greg Kroah-Hartman
                   ` (228 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Pali Rohár, Viresh Kumar, Sasha Levin

From: Pali Rohár <pali@kernel.org>

[ Upstream commit 925a5bcefe105f2790ecbdc252eb2315573f309d ]

This patch adds missing MODULE_DEVICE_TABLE definition which generates
correct modalias for automatic loading of this cpufreq driver when it is
compiled as an external module.

Signed-off-by: Pali Rohár <pali@kernel.org>
Fixes: f525a670533d9 ("cpufreq: ap806: add cpufreq driver for Armada 8K")
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/cpufreq/armada-8k-cpufreq.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/cpufreq/armada-8k-cpufreq.c b/drivers/cpufreq/armada-8k-cpufreq.c
index 39e34f5066d3d..b0fc5e84f8570 100644
--- a/drivers/cpufreq/armada-8k-cpufreq.c
+++ b/drivers/cpufreq/armada-8k-cpufreq.c
@@ -204,6 +204,12 @@ static void __exit armada_8k_cpufreq_exit(void)
 }
 module_exit(armada_8k_cpufreq_exit);
 
+static const struct of_device_id __maybe_unused armada_8k_cpufreq_of_match[] = {
+	{ .compatible = "marvell,ap806-cpu-clock" },
+	{ },
+};
+MODULE_DEVICE_TABLE(of, armada_8k_cpufreq_of_match);
+
 MODULE_AUTHOR("Gregory Clement <gregory.clement@bootlin.com>");
 MODULE_DESCRIPTION("Armada 8K cpufreq driver");
 MODULE_LICENSE("GPL");
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 228/453] cpufreq: highbank: Add missing MODULE_DEVICE_TABLE
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (226 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.4 227/453] cpufreq: ap806: Add missing MODULE_DEVICE_TABLE Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.4 229/453] cpufreq: mediatek: " Greg Kroah-Hartman
                   ` (227 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Pali Rohár, Viresh Kumar, Sasha Levin

From: Pali Rohár <pali@kernel.org>

[ Upstream commit 9433777a6e0aae27468d3434b75cd51bb88ff711 ]

This patch adds missing MODULE_DEVICE_TABLE definition which generates
correct modalias for automatic loading of this cpufreq driver when it is
compiled as an external module.

Signed-off-by: Pali Rohár <pali@kernel.org>
Fixes: 6754f556103be ("cpufreq / highbank: add support for highbank cpufreq")
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/cpufreq/highbank-cpufreq.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/cpufreq/highbank-cpufreq.c b/drivers/cpufreq/highbank-cpufreq.c
index 5a7f6dafcddb6..ac57cddc5f2fe 100644
--- a/drivers/cpufreq/highbank-cpufreq.c
+++ b/drivers/cpufreq/highbank-cpufreq.c
@@ -101,6 +101,13 @@ out_put_node:
 }
 module_init(hb_cpufreq_driver_init);
 
+static const struct of_device_id __maybe_unused hb_cpufreq_of_match[] = {
+	{ .compatible = "calxeda,highbank" },
+	{ .compatible = "calxeda,ecx-2000" },
+	{ },
+};
+MODULE_DEVICE_TABLE(of, hb_cpufreq_of_match);
+
 MODULE_AUTHOR("Mark Langsdorf <mark.langsdorf@calxeda.com>");
 MODULE_DESCRIPTION("Calxeda Highbank cpufreq driver");
 MODULE_LICENSE("GPL");
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 229/453] cpufreq: mediatek: Add missing MODULE_DEVICE_TABLE
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (227 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.4 228/453] cpufreq: highbank: " Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.4 230/453] cpufreq: qcom: " Greg Kroah-Hartman
                   ` (226 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Pali Rohár, Viresh Kumar, Sasha Levin

From: Pali Rohár <pali@kernel.org>

[ Upstream commit af6eca06501118af3e2ad46eee8edab20624b74e ]

This patch adds missing MODULE_DEVICE_TABLE definition which generates
correct modalias for automatic loading of this cpufreq driver when it is
compiled as an external module.

Signed-off-by: Pali Rohár <pali@kernel.org>
Fixes: 501c574f4e3a5 ("cpufreq: mediatek: Add support of cpufreq to MT2701/MT7623 SoC")
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/cpufreq/mediatek-cpufreq.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/cpufreq/mediatek-cpufreq.c b/drivers/cpufreq/mediatek-cpufreq.c
index 0c98dd08273d0..927ebc582a385 100644
--- a/drivers/cpufreq/mediatek-cpufreq.c
+++ b/drivers/cpufreq/mediatek-cpufreq.c
@@ -540,6 +540,7 @@ static const struct of_device_id mtk_cpufreq_machines[] __initconst = {
 
 	{ }
 };
+MODULE_DEVICE_TABLE(of, mtk_cpufreq_machines);
 
 static int __init mtk_cpufreq_driver_init(void)
 {
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 230/453] cpufreq: qcom: Add missing MODULE_DEVICE_TABLE
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (228 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.4 229/453] cpufreq: mediatek: " Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.4 231/453] cpufreq: st: " Greg Kroah-Hartman
                   ` (225 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Pali Rohár, Viresh Kumar, Sasha Levin

From: Pali Rohár <pali@kernel.org>

[ Upstream commit a5a6031663bc1dd0a10babd49d1bcb3153a8327f ]

This patch adds missing MODULE_DEVICE_TABLE definition which generates
correct modalias for automatic loading of this cpufreq driver when it is
compiled as an external module.

Signed-off-by: Pali Rohár <pali@kernel.org>
Fixes: 46e2856b8e188 ("cpufreq: Add Kryo CPU scaling driver")
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/cpufreq/qcom-cpufreq-nvmem.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/cpufreq/qcom-cpufreq-nvmem.c b/drivers/cpufreq/qcom-cpufreq-nvmem.c
index f0d2d5035413b..1e77d190f19f9 100644
--- a/drivers/cpufreq/qcom-cpufreq-nvmem.c
+++ b/drivers/cpufreq/qcom-cpufreq-nvmem.c
@@ -305,6 +305,7 @@ static const struct of_device_id qcom_cpufreq_match_list[] __initconst = {
 	{ .compatible = "qcom,qcs404", .data = &match_data_qcs404 },
 	{},
 };
+MODULE_DEVICE_TABLE(of, qcom_cpufreq_match_list);
 
 /*
  * Since the driver depends on smem and nvmem drivers, which may
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 231/453] cpufreq: st: Add missing MODULE_DEVICE_TABLE
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (229 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.4 230/453] cpufreq: qcom: " Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.4 232/453] cpufreq: sun50i: " Greg Kroah-Hartman
                   ` (224 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Pali Rohár, Viresh Kumar, Sasha Levin

From: Pali Rohár <pali@kernel.org>

[ Upstream commit 183747ab52654eb406fc6b5bfb40806b75d31811 ]

This patch adds missing MODULE_DEVICE_TABLE definition which generates
correct modalias for automatic loading of this cpufreq driver when it is
compiled as an external module.

Signed-off-by: Pali Rohár <pali@kernel.org>
Fixes: ab0ea257fc58d ("cpufreq: st: Provide runtime initialised driver for ST's platforms")
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/cpufreq/sti-cpufreq.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/cpufreq/sti-cpufreq.c b/drivers/cpufreq/sti-cpufreq.c
index 2855b7878a204..7ade4070ca827 100644
--- a/drivers/cpufreq/sti-cpufreq.c
+++ b/drivers/cpufreq/sti-cpufreq.c
@@ -292,6 +292,13 @@ register_cpufreq_dt:
 }
 module_init(sti_cpufreq_init);
 
+static const struct of_device_id __maybe_unused sti_cpufreq_of_match[] = {
+	{ .compatible = "st,stih407" },
+	{ .compatible = "st,stih410" },
+	{ },
+};
+MODULE_DEVICE_TABLE(of, sti_cpufreq_of_match);
+
 MODULE_DESCRIPTION("STMicroelectronics CPUFreq/OPP driver");
 MODULE_AUTHOR("Ajitpal Singh <ajitpal.singh@st.com>");
 MODULE_AUTHOR("Lee Jones <lee.jones@linaro.org>");
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 232/453] cpufreq: sun50i: Add missing MODULE_DEVICE_TABLE
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (230 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.4 231/453] cpufreq: st: " Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.4 233/453] cpufreq: loongson1: Add missing MODULE_ALIAS Greg Kroah-Hartman
                   ` (223 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Pali Rohár, Yangtao Li,
	Viresh Kumar, Sasha Levin

From: Pali Rohár <pali@kernel.org>

[ Upstream commit af2096f285077e3339eb835ad06c50bdd59f01b5 ]

This patch adds missing MODULE_DEVICE_TABLE definition which generates
correct modalias for automatic loading of this cpufreq driver when it is
compiled as an external module.

Signed-off-by: Pali Rohár <pali@kernel.org>
Fixes: f328584f7bff8 ("cpufreq: Add sun50i nvmem based CPU scaling driver")
Reviewed-by: Yangtao Li <tiny.windzz@gmail.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/cpufreq/sun50i-cpufreq-nvmem.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/cpufreq/sun50i-cpufreq-nvmem.c b/drivers/cpufreq/sun50i-cpufreq-nvmem.c
index 9907a165135b7..2deed8d8773fa 100644
--- a/drivers/cpufreq/sun50i-cpufreq-nvmem.c
+++ b/drivers/cpufreq/sun50i-cpufreq-nvmem.c
@@ -167,6 +167,7 @@ static const struct of_device_id sun50i_cpufreq_match_list[] = {
 	{ .compatible = "allwinner,sun50i-h6" },
 	{}
 };
+MODULE_DEVICE_TABLE(of, sun50i_cpufreq_match_list);
 
 static const struct of_device_id *sun50i_cpufreq_match_node(void)
 {
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 233/453] cpufreq: loongson1: Add missing MODULE_ALIAS
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (231 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.4 232/453] cpufreq: sun50i: " Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.4 234/453] cpufreq: scpi: " Greg Kroah-Hartman
                   ` (222 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Pali Rohár, Viresh Kumar, Sasha Levin

From: Pali Rohár <pali@kernel.org>

[ Upstream commit b9acab091842ca8b288882798bb809f7abf5408a ]

This patch adds missing MODULE_ALIAS for automatic loading of this cpufreq
driver when it is compiled as an external module.

Signed-off-by: Pali Rohár <pali@kernel.org>
Fixes: a0a22cf14472f ("cpufreq: Loongson1: Add cpufreq driver for Loongson1B")
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/cpufreq/loongson1-cpufreq.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/cpufreq/loongson1-cpufreq.c b/drivers/cpufreq/loongson1-cpufreq.c
index 0ea88778882ac..86f612593e497 100644
--- a/drivers/cpufreq/loongson1-cpufreq.c
+++ b/drivers/cpufreq/loongson1-cpufreq.c
@@ -216,6 +216,7 @@ static struct platform_driver ls1x_cpufreq_platdrv = {
 
 module_platform_driver(ls1x_cpufreq_platdrv);
 
+MODULE_ALIAS("platform:ls1x-cpufreq");
 MODULE_AUTHOR("Kelvin Cheung <keguang.zhang@gmail.com>");
 MODULE_DESCRIPTION("Loongson1 CPUFreq driver");
 MODULE_LICENSE("GPL");
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 234/453] cpufreq: scpi: Add missing MODULE_ALIAS
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (232 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.4 233/453] cpufreq: loongson1: Add missing MODULE_ALIAS Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.4 235/453] Bluetooth: btusb: Add the missed release_firmware() in btusb_mtk_setup_firmware() Greg Kroah-Hartman
                   ` (221 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Pali Rohár, Viresh Kumar, Sasha Levin

From: Pali Rohár <pali@kernel.org>

[ Upstream commit c0382d049d2def37b81e907a8b22661a4a4a6eb5 ]

This patch adds missing MODULE_ALIAS for automatic loading of this cpufreq
driver when it is compiled as an external module.

Signed-off-by: Pali Rohár <pali@kernel.org>
Fixes: 8def31034d033 ("cpufreq: arm_big_little: add SCPI interface driver")
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/cpufreq/scpi-cpufreq.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/cpufreq/scpi-cpufreq.c b/drivers/cpufreq/scpi-cpufreq.c
index 2b51e0718c9f6..b341ffbf56bc3 100644
--- a/drivers/cpufreq/scpi-cpufreq.c
+++ b/drivers/cpufreq/scpi-cpufreq.c
@@ -239,6 +239,7 @@ static struct platform_driver scpi_cpufreq_platdrv = {
 };
 module_platform_driver(scpi_cpufreq_platdrv);
 
+MODULE_ALIAS("platform:scpi-cpufreq");
 MODULE_AUTHOR("Sudeep Holla <sudeep.holla@arm.com>");
 MODULE_DESCRIPTION("ARM SCPI CPUFreq interface driver");
 MODULE_LICENSE("GPL v2");
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 235/453] Bluetooth: btusb: Add the missed release_firmware() in btusb_mtk_setup_firmware()
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (233 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.4 234/453] cpufreq: scpi: " Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.4 236/453] Bluetooth: btmtksdio: Add the missed release_firmware() in mtk_setup_firmware() Greg Kroah-Hartman
                   ` (220 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jing Xiangfeng, Marcel Holtmann,
	Johan Hedberg, Sasha Levin

From: Jing Xiangfeng <jingxiangfeng@huawei.com>

[ Upstream commit d1e9d232e1e60fa63df1b836ec3ecba5abd3fa9d ]

btusb_mtk_setup_firmware() misses to call release_firmware() in an error
path. Jump to err_release_fw to fix it.

Fixes: f645125711c8 ("Bluetooth: btusb: fix up firmware download sequence")
Signed-off-by: Jing Xiangfeng <jingxiangfeng@huawei.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/bluetooth/btusb.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index b326eeddaadf0..b92bd97b1c399 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -2812,7 +2812,7 @@ static int btusb_mtk_setup_firmware(struct hci_dev *hdev, const char *fwname)
 	err = btusb_mtk_hci_wmt_sync(hdev, &wmt_params);
 	if (err < 0) {
 		bt_dev_err(hdev, "Failed to power on data RAM (%d)", err);
-		return err;
+		goto err_release_fw;
 	}
 
 	fw_ptr = fw->data;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 236/453] Bluetooth: btmtksdio: Add the missed release_firmware() in mtk_setup_firmware()
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (234 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.4 235/453] Bluetooth: btusb: Add the missed release_firmware() in btusb_mtk_setup_firmware() Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.4 237/453] arm64: dts: meson: fix PHY deassert timing requirements Greg Kroah-Hartman
                   ` (219 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jing Xiangfeng, Marcel Holtmann,
	Johan Hedberg, Sasha Levin

From: Jing Xiangfeng <jingxiangfeng@huawei.com>

[ Upstream commit b73b5781a85c03113476f62346c390f0277baa4b ]

mtk_setup_firmware() misses to call release_firmware() in an error
path. Jump to free_fw to fix it.

Fixes: 737cd06072a7 ("Bluetooth: btmtksdio: fix up firmware download sequence")
Signed-off-by: Jing Xiangfeng <jingxiangfeng@huawei.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/bluetooth/btmtksdio.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/bluetooth/btmtksdio.c b/drivers/bluetooth/btmtksdio.c
index b7de7cb8cca90..304178be1ef40 100644
--- a/drivers/bluetooth/btmtksdio.c
+++ b/drivers/bluetooth/btmtksdio.c
@@ -703,7 +703,7 @@ static int mtk_setup_firmware(struct hci_dev *hdev, const char *fwname)
 	err = mtk_hci_wmt_sync(hdev, &wmt_params);
 	if (err < 0) {
 		bt_dev_err(hdev, "Failed to power on data RAM (%d)", err);
-		return err;
+		goto free_fw;
 	}
 
 	fw_ptr = fw->data;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 237/453] arm64: dts: meson: fix PHY deassert timing requirements
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (235 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.4 236/453] Bluetooth: btmtksdio: Add the missed release_firmware() in mtk_setup_firmware() Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.4 238/453] ARM: " Greg Kroah-Hartman
                   ` (218 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Martin Blumenstingl, Stefan Agner,
	Kevin Hilman, Sasha Levin

From: Stefan Agner <stefan@agner.ch>

[ Upstream commit c183c406c4321002fe85b345b51bc1a3a04b6d33 ]

According to the datasheet (Rev. 1.9) the RTL8211F requires at least
72ms "for internal circuits settling time" before accessing the PHY
registers. This fixes an issue seen on ODROID-C2 where the Ethernet
link doesn't come up when using ip link set down/up:
  [ 6630.714855] meson8b-dwmac c9410000.ethernet eth0: Link is Down
  [ 6630.785775] meson8b-dwmac c9410000.ethernet eth0: PHY [stmmac-0:00] driver [RTL8211F Gigabit Ethernet] (irq=36)
  [ 6630.893071] meson8b-dwmac c9410000.ethernet: Failed to reset the dma
  [ 6630.893800] meson8b-dwmac c9410000.ethernet eth0: stmmac_hw_setup: DMA engine initialization failed
  [ 6630.902835] meson8b-dwmac c9410000.ethernet eth0: stmmac_open: Hw setup failed

Fixes: f29cabf240ed ("arm64: dts: meson: use the generic Ethernet PHY reset GPIO bindings")
Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Signed-off-by: Stefan Agner <stefan@agner.ch>
Signed-off-by: Kevin Hilman <khilman@baylibre.com>
Link: https://lore.kernel.org/r/4a322c198b86e4c8b3dda015560a683babea4d63.1607363522.git.stefan@agner.ch
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts  | 2 +-
 arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts   | 2 +-
 arch/arm64/boot/dts/amlogic/meson-gxbb-vega-s95.dtsi  | 2 +-
 arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi     | 2 +-
 arch/arm64/boot/dts/amlogic/meson-gxl-s905d-p230.dts  | 2 +-
 arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts | 2 +-
 arch/arm64/boot/dts/amlogic/meson-gxm-nexbox-a1.dts   | 2 +-
 arch/arm64/boot/dts/amlogic/meson-gxm-q200.dts        | 2 +-
 arch/arm64/boot/dts/amlogic/meson-gxm-rbox-pro.dts    | 2 +-
 9 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts b/arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts
index 233eb1cd79671..d94b695916a35 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts
@@ -165,7 +165,7 @@
 			reg = <0>;
 
 			reset-assert-us = <10000>;
-			reset-deassert-us = <30000>;
+			reset-deassert-us = <80000>;
 			reset-gpios = <&gpio GPIOZ_14 GPIO_ACTIVE_LOW>;
 
 			interrupt-parent = <&gpio_intc>;
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts b/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts
index b0b12e3898350..8828acb3fd4c5 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts
@@ -138,7 +138,7 @@
 			reg = <0>;
 
 			reset-assert-us = <10000>;
-			reset-deassert-us = <30000>;
+			reset-deassert-us = <80000>;
 			reset-gpios = <&gpio GPIOZ_14 GPIO_ACTIVE_LOW>;
 
 			interrupt-parent = <&gpio_intc>;
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-vega-s95.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxbb-vega-s95.dtsi
index 43b11e3dfe119..29976215e1446 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxbb-vega-s95.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-vega-s95.dtsi
@@ -126,7 +126,7 @@
 			reg = <0>;
 
 			reset-assert-us = <10000>;
-			reset-deassert-us = <30000>;
+			reset-deassert-us = <80000>;
 			reset-gpios = <&gpio GPIOZ_14 GPIO_ACTIVE_LOW>;
 
 			interrupt-parent = <&gpio_intc>;
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi
index 4c539881fbb73..e3d17569d98ad 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi
@@ -147,7 +147,7 @@
 			reg = <0>;
 
 			reset-assert-us = <10000>;
-			reset-deassert-us = <30000>;
+			reset-deassert-us = <80000>;
 			reset-gpios = <&gpio GPIOZ_14 GPIO_ACTIVE_LOW>;
 		};
 	};
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905d-p230.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s905d-p230.dts
index b08c4537f260d..b2ab05c220903 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905d-p230.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905d-p230.dts
@@ -82,7 +82,7 @@
 
 		/* External PHY reset is shared with internal PHY Led signal */
 		reset-assert-us = <10000>;
-		reset-deassert-us = <30000>;
+		reset-deassert-us = <80000>;
 		reset-gpios = <&gpio GPIOZ_14 GPIO_ACTIVE_LOW>;
 
 		interrupt-parent = <&gpio_intc>;
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts b/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts
index fa8bd0690e89a..c8a4205117f15 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts
@@ -251,7 +251,7 @@
 		reg = <0>;
 
 		reset-assert-us = <10000>;
-		reset-deassert-us = <30000>;
+		reset-deassert-us = <80000>;
 		reset-gpios = <&gpio GPIOZ_14 GPIO_ACTIVE_LOW>;
 
 		interrupt-parent = <&gpio_intc>;
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxm-nexbox-a1.dts b/arch/arm64/boot/dts/amlogic/meson-gxm-nexbox-a1.dts
index c2bd4dbbf38c5..8dccf91d68da7 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxm-nexbox-a1.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-gxm-nexbox-a1.dts
@@ -112,7 +112,7 @@
 		max-speed = <1000>;
 
 		reset-assert-us = <10000>;
-		reset-deassert-us = <30000>;
+		reset-deassert-us = <80000>;
 		reset-gpios = <&gpio GPIOZ_14 GPIO_ACTIVE_LOW>;
 	};
 };
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxm-q200.dts b/arch/arm64/boot/dts/amlogic/meson-gxm-q200.dts
index ea45ae0c71b7f..8edbfe040805c 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxm-q200.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-gxm-q200.dts
@@ -64,7 +64,7 @@
 
 		/* External PHY reset is shared with internal PHY Led signal */
 		reset-assert-us = <10000>;
-		reset-deassert-us = <30000>;
+		reset-deassert-us = <80000>;
 		reset-gpios = <&gpio GPIOZ_14 GPIO_ACTIVE_LOW>;
 
 		interrupt-parent = <&gpio_intc>;
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxm-rbox-pro.dts b/arch/arm64/boot/dts/amlogic/meson-gxm-rbox-pro.dts
index 5cd4d35006d09..f72d29e33a9e4 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxm-rbox-pro.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-gxm-rbox-pro.dts
@@ -114,7 +114,7 @@
 		max-speed = <1000>;
 
 		reset-assert-us = <10000>;
-		reset-deassert-us = <30000>;
+		reset-deassert-us = <80000>;
 		reset-gpios = <&gpio GPIOZ_14 GPIO_ACTIVE_LOW>;
 	};
 };
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 238/453] ARM: dts: meson: fix PHY deassert timing requirements
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (236 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.4 237/453] arm64: dts: meson: fix PHY deassert timing requirements Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.4 239/453] arm64: dts: meson: g12a: x96-max: " Greg Kroah-Hartman
                   ` (217 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Martin Blumenstingl, Stefan Agner,
	Kevin Hilman, Sasha Levin

From: Stefan Agner <stefan@agner.ch>

[ Upstream commit 656ab1bdcd2b755dc161a9774201100d5bf74b8d ]

According to the datasheet (Rev. 1.9) the RTL8211F requires at least
72ms "for internal circuits settling time" before accessing the PHY
registers. On similar boards with the same PHY this fixes an issue where
Ethernet link would not come up when using ip link set down/up.

Fixes: a2c6e82e5341 ("ARM: dts: meson: switch to the generic Ethernet PHY reset bindings")
Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Tested-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com> # on Odroid-C1+
Signed-off-by: Stefan Agner <stefan@agner.ch>
Signed-off-by: Kevin Hilman <khilman@baylibre.com>
Link: https://lore.kernel.org/r/ff78772b306411e145769c46d4090554344db41e.1607363522.git.stefan@agner.ch
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/meson8b-odroidc1.dts    | 2 +-
 arch/arm/boot/dts/meson8m2-mxiii-plus.dts | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm/boot/dts/meson8b-odroidc1.dts b/arch/arm/boot/dts/meson8b-odroidc1.dts
index a24eccc354b95..0f9c71137bed5 100644
--- a/arch/arm/boot/dts/meson8b-odroidc1.dts
+++ b/arch/arm/boot/dts/meson8b-odroidc1.dts
@@ -219,7 +219,7 @@
 			reg = <0>;
 
 			reset-assert-us = <10000>;
-			reset-deassert-us = <30000>;
+			reset-deassert-us = <80000>;
 			reset-gpios = <&gpio GPIOH_4 GPIO_ACTIVE_LOW>;
 
 			interrupt-parent = <&gpio_intc>;
diff --git a/arch/arm/boot/dts/meson8m2-mxiii-plus.dts b/arch/arm/boot/dts/meson8m2-mxiii-plus.dts
index d54477b1001ca..84b6ed51099db 100644
--- a/arch/arm/boot/dts/meson8m2-mxiii-plus.dts
+++ b/arch/arm/boot/dts/meson8m2-mxiii-plus.dts
@@ -83,7 +83,7 @@
 			reg = <0>;
 
 			reset-assert-us = <10000>;
-			reset-deassert-us = <30000>;
+			reset-deassert-us = <80000>;
 			reset-gpios = <&gpio GPIOH_4 GPIO_ACTIVE_LOW>;
 		};
 	};
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 239/453] arm64: dts: meson: g12a: x96-max: fix PHY deassert timing requirements
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (237 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.4 238/453] ARM: " Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.4 240/453] scsi: qedi: Fix missing destroy_workqueue() on error in __qedi_probe Greg Kroah-Hartman
                   ` (216 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Martin Blumenstingl, Stefan Agner,
	Kevin Hilman, Sasha Levin

From: Stefan Agner <stefan@agner.ch>

[ Upstream commit 3d07c3b3a886fefd583c1b485b5e4e3c4e2da493 ]

According to the datasheet (Rev. 1.9) the RTL8211F requires at least
72ms "for internal circuits settling time" before accessing the PHY
registers. On similar boards with the same PHY this fixes an issue where
Ethernet link would not come up when using ip link set down/up.

Fixes: ed5e8f689154 ("arm64: dts: meson: g12a: x96-max: fix the Ethernet PHY reset line")
Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Signed-off-by: Stefan Agner <stefan@agner.ch>
Signed-off-by: Kevin Hilman <khilman@baylibre.com>
Link: https://lore.kernel.org/r/12506964ca5d5f936579a280ad0a7e7f9a0a2d4c.1607363522.git.stefan@agner.ch
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/amlogic/meson-g12a-x96-max.dts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/amlogic/meson-g12a-x96-max.dts b/arch/arm64/boot/dts/amlogic/meson-g12a-x96-max.dts
index 17155fb73fce9..c48125bf9d1e3 100644
--- a/arch/arm64/boot/dts/amlogic/meson-g12a-x96-max.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-g12a-x96-max.dts
@@ -340,7 +340,7 @@
 		eee-broken-1000t;
 
 		reset-assert-us = <10000>;
-		reset-deassert-us = <30000>;
+		reset-deassert-us = <80000>;
 		reset-gpios = <&gpio GPIOZ_15 (GPIO_ACTIVE_LOW | GPIO_OPEN_DRAIN)>;
 
 		interrupt-parent = <&gpio_intc>;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 240/453] scsi: qedi: Fix missing destroy_workqueue() on error in __qedi_probe
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (238 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.4 239/453] arm64: dts: meson: g12a: x96-max: " Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.4 241/453] scsi: pm80xx: Fix error return in pm8001_pci_probe() Greg Kroah-Hartman
                   ` (215 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Mike Christie, Qinglang Miao,
	Martin K. Petersen, Sasha Levin

From: Qinglang Miao <miaoqinglang@huawei.com>

[ Upstream commit 62eebd5247c4e4ce08826ad5995cf4dd7ce919dd ]

Add the missing destroy_workqueue() before return from __qedi_probe in the
error handling case when fails to create workqueue qedi->offload_thread.

Link: https://lore.kernel.org/r/20201109091518.55941-1-miaoqinglang@huawei.com
Fixes: ace7f46ba5fd ("scsi: qedi: Add QLogic FastLinQ offload iSCSI driver framework.")
Reviewed-by: Mike Christie <michael.christie@oracle.com>
Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/qedi/qedi_main.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/scsi/qedi/qedi_main.c b/drivers/scsi/qedi/qedi_main.c
index acb930b8c6a64..35c96ea2653be 100644
--- a/drivers/scsi/qedi/qedi_main.c
+++ b/drivers/scsi/qedi/qedi_main.c
@@ -2630,7 +2630,7 @@ static int __qedi_probe(struct pci_dev *pdev, int mode)
 			QEDI_ERR(&qedi->dbg_ctx,
 				 "Unable to start offload thread!\n");
 			rc = -ENODEV;
-			goto free_cid_que;
+			goto free_tmf_thread;
 		}
 
 		/* F/w needs 1st task context memory entry for performance */
@@ -2650,6 +2650,8 @@ static int __qedi_probe(struct pci_dev *pdev, int mode)
 
 	return 0;
 
+free_tmf_thread:
+	destroy_workqueue(qedi->tmf_thread);
 free_cid_que:
 	qedi_release_cid_que(qedi);
 free_uio:
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 241/453] scsi: pm80xx: Fix error return in pm8001_pci_probe()
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (239 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.4 240/453] scsi: qedi: Fix missing destroy_workqueue() on error in __qedi_probe Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.4 242/453] seq_buf: Avoid type mismatch for seq_buf_init Greg Kroah-Hartman
                   ` (214 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jack Wang, Zhang Qilong,
	Martin K. Petersen, Sasha Levin

From: Zhang Qilong <zhangqilong3@huawei.com>

[ Upstream commit 97031ccffa4f62728602bfea8439dd045cd3aeb2 ]

The driver did not return an error in the case where
pm8001_configure_phy_settings() failed.

Use rc to store the return value of pm8001_configure_phy_settings().

Link: https://lore.kernel.org/r/20201205115551.2079471-1-zhangqilong3@huawei.com
Fixes: 279094079a44 ("[SCSI] pm80xx: Phy settings support for motherboard controller.")
Acked-by: Jack Wang <jinpu.wang@cloud.ionos.com>
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/pm8001/pm8001_init.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/scsi/pm8001/pm8001_init.c b/drivers/scsi/pm8001/pm8001_init.c
index 3374f553c617a..8882ba33ca87c 100644
--- a/drivers/scsi/pm8001/pm8001_init.c
+++ b/drivers/scsi/pm8001/pm8001_init.c
@@ -1040,7 +1040,8 @@ static int pm8001_pci_probe(struct pci_dev *pdev,
 
 	pm8001_init_sas_add(pm8001_ha);
 	/* phy setting support for motherboard controller */
-	if (pm8001_configure_phy_settings(pm8001_ha))
+	rc = pm8001_configure_phy_settings(pm8001_ha);
+	if (rc)
 		goto err_out_shost;
 
 	pm8001_post_sas_ha_init(shost, chip);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 242/453] seq_buf: Avoid type mismatch for seq_buf_init
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (240 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.4 241/453] scsi: pm80xx: Fix error return in pm8001_pci_probe() Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:47 ` [PATCH 5.4 243/453] scsi: fnic: Fix error return code in fnic_probe() Greg Kroah-Hartman
                   ` (213 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Cezary Rojewski, Arnd Bergmann,
	Steven Rostedt (VMware),
	Sasha Levin

From: Arnd Bergmann <arnd@arndb.de>

[ Upstream commit d9a9280a0d0ae51dc1d4142138b99242b7ec8ac6 ]

Building with W=2 prints a number of warnings for one function that
has a pointer type mismatch:

linux/seq_buf.h: In function 'seq_buf_init':
linux/seq_buf.h:35:12: warning: pointer targets in assignment from 'unsigned char *' to 'char *' differ in signedness [-Wpointer-sign]

Change the type in the function prototype according to the type in
the structure.

Link: https://lkml.kernel.org/r/20201026161108.3707783-1-arnd@kernel.org

Fixes: 9a7777935c34 ("tracing: Convert seq_buf fields to be like seq_file fields")
Reviewed-by: Cezary Rojewski <cezary.rojewski@intel.com>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/seq_buf.h   | 2 +-
 include/linux/trace_seq.h | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/include/linux/seq_buf.h b/include/linux/seq_buf.h
index aa5deb041c25d..7cc952282e8be 100644
--- a/include/linux/seq_buf.h
+++ b/include/linux/seq_buf.h
@@ -30,7 +30,7 @@ static inline void seq_buf_clear(struct seq_buf *s)
 }
 
 static inline void
-seq_buf_init(struct seq_buf *s, unsigned char *buf, unsigned int size)
+seq_buf_init(struct seq_buf *s, char *buf, unsigned int size)
 {
 	s->buffer = buf;
 	s->size = size;
diff --git a/include/linux/trace_seq.h b/include/linux/trace_seq.h
index 6609b39a72326..6db257466af68 100644
--- a/include/linux/trace_seq.h
+++ b/include/linux/trace_seq.h
@@ -12,7 +12,7 @@
  */
 
 struct trace_seq {
-	unsigned char		buffer[PAGE_SIZE];
+	char			buffer[PAGE_SIZE];
 	struct seq_buf		seq;
 	int			full;
 };
@@ -51,7 +51,7 @@ static inline int trace_seq_used(struct trace_seq *s)
  * that is about to be written to and then return the result
  * of that write.
  */
-static inline unsigned char *
+static inline char *
 trace_seq_buffer_ptr(struct trace_seq *s)
 {
 	return s->buffer + seq_buf_used(&s->seq);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 243/453] scsi: fnic: Fix error return code in fnic_probe()
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (241 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.4 242/453] seq_buf: Avoid type mismatch for seq_buf_init Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.4 244/453] platform/x86: mlx-platform: Fix item counter assignment for MSN2700, MSN24xx systems Greg Kroah-Hartman
                   ` (212 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Karan Tilak Kumar,
	Zhang Changzhong, Martin K. Petersen, Sasha Levin

From: Zhang Changzhong <zhangchangzhong@huawei.com>

[ Upstream commit d4fc94fe65578738ded138e9fce043db6bfc3241 ]

Return a negative error code from the error handling case instead of 0 as
done elsewhere in this function.

Link: https://lore.kernel.org/r/1607068060-31203-1-git-send-email-zhangchangzhong@huawei.com
Fixes: 5df6d737dd4b ("[SCSI] fnic: Add new Cisco PCI-Express FCoE HBA")
Reported-by: Hulk Robot <hulkci@huawei.com>
Reviewed-by: Karan Tilak Kumar <kartilak@cisco.com>
Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/fnic/fnic_main.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/scsi/fnic/fnic_main.c b/drivers/scsi/fnic/fnic_main.c
index 18584ab27c329..3a2618bcce67b 100644
--- a/drivers/scsi/fnic/fnic_main.c
+++ b/drivers/scsi/fnic/fnic_main.c
@@ -741,6 +741,7 @@ static int fnic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 	for (i = 0; i < FNIC_IO_LOCKS; i++)
 		spin_lock_init(&fnic->io_req_lock[i]);
 
+	err = -ENOMEM;
 	fnic->io_req_pool = mempool_create_slab_pool(2, fnic_io_req_cache);
 	if (!fnic->io_req_pool)
 		goto err_out_free_resources;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 244/453] platform/x86: mlx-platform: Fix item counter assignment for MSN2700, MSN24xx systems
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (242 preceding siblings ...)
  2020-12-28 12:47 ` [PATCH 5.4 243/453] scsi: fnic: Fix error return code in fnic_probe() Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.4 245/453] powerpc/pseries/hibernation: drop pseries_suspend_begin() from suspend ops Greg Kroah-Hartman
                   ` (211 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Vadim Pasternak, Hans de Goede, Sasha Levin

From: Vadim Pasternak <vadimp@nvidia.com>

[ Upstream commit ba4939f1dd46dde08c2f9b9d7ac86ed3ea7ead86 ]

Fix array names to match assignments for data items and data items
counter in 'mlxplat_mlxcpld_default_items' structure for:
	.data = mlxplat_mlxcpld_default_pwr_items_data,
	.count = ARRAY_SIZE(mlxplat_mlxcpld_pwr),
and
	.data = mlxplat_mlxcpld_default_fan_items_data,
	.count = ARRAY_SIZE(mlxplat_mlxcpld_fan),

Replace:
- 'mlxplat_mlxcpld_pwr' by 'mlxplat_mlxcpld_default_pwr_items_data' for
   ARRAY_SIZE() calculation.
- 'mlxplat_mlxcpld_fan' by 'mlxplat_mlxcpld_default_fan_items_data'
   for ARRAY_SIZE() calculation.

Fixes: c6acad68eb2d ("platform/mellanox: mlxreg-hotplug: Modify to use a regmap interface")
Signed-off-by: Vadim Pasternak <vadimp@nvidia.com>
Link: https://lore.kernel.org/r/20201207174745.22889-2-vadimp@nvidia.com
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/x86/mlx-platform.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/platform/x86/mlx-platform.c b/drivers/platform/x86/mlx-platform.c
index 4b3d94c4a939a..acb094ddf8e61 100644
--- a/drivers/platform/x86/mlx-platform.c
+++ b/drivers/platform/x86/mlx-platform.c
@@ -355,7 +355,7 @@ static struct mlxreg_core_item mlxplat_mlxcpld_default_items[] = {
 		.aggr_mask = MLXPLAT_CPLD_AGGR_PWR_MASK_DEF,
 		.reg = MLXPLAT_CPLD_LPC_REG_PWR_OFFSET,
 		.mask = MLXPLAT_CPLD_PWR_MASK,
-		.count = ARRAY_SIZE(mlxplat_mlxcpld_pwr),
+		.count = ARRAY_SIZE(mlxplat_mlxcpld_default_pwr_items_data),
 		.inversed = 0,
 		.health = false,
 	},
@@ -364,7 +364,7 @@ static struct mlxreg_core_item mlxplat_mlxcpld_default_items[] = {
 		.aggr_mask = MLXPLAT_CPLD_AGGR_FAN_MASK_DEF,
 		.reg = MLXPLAT_CPLD_LPC_REG_FAN_OFFSET,
 		.mask = MLXPLAT_CPLD_FAN_MASK,
-		.count = ARRAY_SIZE(mlxplat_mlxcpld_fan),
+		.count = ARRAY_SIZE(mlxplat_mlxcpld_default_fan_items_data),
 		.inversed = 1,
 		.health = false,
 	},
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 245/453] powerpc/pseries/hibernation: drop pseries_suspend_begin() from suspend ops
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (243 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.4 244/453] platform/x86: mlx-platform: Fix item counter assignment for MSN2700, MSN24xx systems Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.4 246/453] powerpc/pseries/hibernation: remove redundant cacheinfo update Greg Kroah-Hartman
                   ` (210 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Nathan Lynch, Michael Ellerman, Sasha Levin

From: Nathan Lynch <nathanl@linux.ibm.com>

[ Upstream commit 52719fce3f4c7a8ac9eaa191e8d75a697f9fbcbc ]

There are three ways pseries_suspend_begin() can be reached:

1. When "mem" is written to /sys/power/state:

kobj_attr_store()
-> state_store()
  -> pm_suspend()
    -> suspend_devices_and_enter()
      -> pseries_suspend_begin()

This never works because there is no way to supply a valid stream id
using this interface, and H_VASI_STATE is called with a stream id of
zero. So this call path is useless at best.

2. When a stream id is written to /sys/devices/system/power/hibernate.
pseries_suspend_begin() is polled directly from store_hibernate()
until the stream is in the "Suspending" state (i.e. the platform is
ready for the OS to suspend execution):

dev_attr_store()
-> store_hibernate()
  -> pseries_suspend_begin()

3. When a stream id is written to /sys/devices/system/power/hibernate
(continued). After #2, pseries_suspend_begin() is called once again
from the pm core:

dev_attr_store()
-> store_hibernate()
  -> pm_suspend()
    -> suspend_devices_and_enter()
      -> pseries_suspend_begin()

This is redundant because the VASI suspend state is already known to
be Suspending.

The begin() callback of platform_suspend_ops is optional, so we can
simply remove that assignment with no loss of function.

Fixes: 32d8ad4e621d ("powerpc/pseries: Partition hibernation support")
Signed-off-by: Nathan Lynch <nathanl@linux.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20201207215200.1785968-18-nathanl@linux.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/platforms/pseries/suspend.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/arch/powerpc/platforms/pseries/suspend.c b/arch/powerpc/platforms/pseries/suspend.c
index f789693f61f40..0749ccb994002 100644
--- a/arch/powerpc/platforms/pseries/suspend.c
+++ b/arch/powerpc/platforms/pseries/suspend.c
@@ -190,7 +190,6 @@ static struct bus_type suspend_subsys = {
 
 static const struct platform_suspend_ops pseries_suspend_ops = {
 	.valid		= suspend_valid_only_mem,
-	.begin		= pseries_suspend_begin,
 	.prepare_late	= pseries_prepare_late,
 	.enter		= pseries_suspend_enter,
 };
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 246/453] powerpc/pseries/hibernation: remove redundant cacheinfo update
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (244 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.4 245/453] powerpc/pseries/hibernation: drop pseries_suspend_begin() from suspend ops Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.4 247/453] drm/mediatek: avoid dereferencing a null hdmi_phy on an error message Greg Kroah-Hartman
                   ` (209 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Nathan Lynch, Michael Ellerman, Sasha Levin

From: Nathan Lynch <nathanl@linux.ibm.com>

[ Upstream commit b866459489fe8ef0e92cde3cbd6bbb1af6c4e99b ]

Partitions with cache nodes in the device tree can encounter the
following warning on resume:

CPU 0 already accounted in PowerPC,POWER9@0(Data)
WARNING: CPU: 0 PID: 3177 at arch/powerpc/kernel/cacheinfo.c:197 cacheinfo_cpu_online+0x640/0x820

These calls to cacheinfo_cpu_offline/online have been redundant since
commit e610a466d16a ("powerpc/pseries/mobility: rebuild cacheinfo
hierarchy post-migration").

Fixes: e610a466d16a ("powerpc/pseries/mobility: rebuild cacheinfo hierarchy post-migration")
Signed-off-by: Nathan Lynch <nathanl@linux.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20201207215200.1785968-25-nathanl@linux.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/platforms/pseries/suspend.c | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/arch/powerpc/platforms/pseries/suspend.c b/arch/powerpc/platforms/pseries/suspend.c
index 0749ccb994002..e5ecadfb5dea2 100644
--- a/arch/powerpc/platforms/pseries/suspend.c
+++ b/arch/powerpc/platforms/pseries/suspend.c
@@ -13,7 +13,6 @@
 #include <asm/mmu.h>
 #include <asm/rtas.h>
 #include <asm/topology.h>
-#include "../../kernel/cacheinfo.h"
 
 static u64 stream_id;
 static struct device suspend_dev;
@@ -78,9 +77,7 @@ static void pseries_suspend_enable_irqs(void)
 	 * Update configuration which can be modified based on device tree
 	 * changes during resume.
 	 */
-	cacheinfo_cpu_offline(smp_processor_id());
 	post_mobility_fixup();
-	cacheinfo_cpu_online(smp_processor_id());
 }
 
 /**
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 247/453] drm/mediatek: avoid dereferencing a null hdmi_phy on an error message
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (245 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.4 246/453] powerpc/pseries/hibernation: remove redundant cacheinfo update Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.4 248/453] ASoC: amd: change clk_get() to devm_clk_get() and add missed checks Greg Kroah-Hartman
                   ` (208 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Colin Ian King, Vinod Koul, Sasha Levin

From: Colin Ian King <colin.king@canonical.com>

[ Upstream commit b097efba9580d1f7cbc80cda84e768983e3de541 ]

Currently there is a null pointer check for hdmi_phy that implies it
may be null, however a dev_err messages dereferences this potential null
pointer.  Avoid a null pointer dereference by only emitting the dev_err
message if hdmi_phy is non-null.  It is a moot point if the error message
needs to be printed at all, but since this is a relatively new piece of
code it may be useful to keep the message in for the moment in case there
are unforseen errors that need to be reported.

Fixes: be28b6507c46 ("drm/mediatek: separate hdmi phy to different file")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Addresses-Coverity: ("Dereference after null check")
Link: https://lore.kernel.org/r/20201207150937.170435-1-colin.king@canonical.com
[vkoul: fix indent of return call]
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/mediatek/mtk_hdmi_phy.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/mediatek/mtk_hdmi_phy.c b/drivers/gpu/drm/mediatek/mtk_hdmi_phy.c
index 5223498502c49..23a74eb5d7f81 100644
--- a/drivers/gpu/drm/mediatek/mtk_hdmi_phy.c
+++ b/drivers/gpu/drm/mediatek/mtk_hdmi_phy.c
@@ -84,8 +84,9 @@ mtk_hdmi_phy_dev_get_ops(const struct mtk_hdmi_phy *hdmi_phy)
 	    hdmi_phy->conf->hdmi_phy_disable_tmds)
 		return &mtk_hdmi_phy_dev_ops;
 
-	dev_err(hdmi_phy->dev, "Failed to get dev ops of phy\n");
-		return NULL;
+	if (hdmi_phy)
+		dev_err(hdmi_phy->dev, "Failed to get dev ops of phy\n");
+	return NULL;
 }
 
 static void mtk_hdmi_phy_clk_get_data(struct mtk_hdmi_phy *hdmi_phy,
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 248/453] ASoC: amd: change clk_get() to devm_clk_get() and add missed checks
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (246 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.4 247/453] drm/mediatek: avoid dereferencing a null hdmi_phy on an error message Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.4 249/453] powerpc/mm: sanity_check_fault() should work for all, not only BOOK3S Greg Kroah-Hartman
                   ` (207 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chuhong Yuan, Mark Brown, Sasha Levin

From: Chuhong Yuan <hslester96@gmail.com>

[ Upstream commit 95d3befbc5e1ee39fc8a78713924cf7ed2b3cabe ]

cz_da7219_init() does not check the return values of clk_get(),
while da7219_clk_enable() calls clk_set_rate() to dereference
the pointers.
Add checks to fix the problems.
Also, change clk_get() to devm_clk_get() to avoid data leak after
failures.

Fixes: bb24a31ed584 ("ASoC: AMD: Configure wclk and bclk of master codec")
Signed-off-by: Chuhong Yuan <hslester96@gmail.com>
Link: https://lore.kernel.org/r/20201204063610.513556-1-hslester96@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/amd/acp-da7219-max98357a.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/sound/soc/amd/acp-da7219-max98357a.c b/sound/soc/amd/acp-da7219-max98357a.c
index f4ee6798154af..1612ec65aaf66 100644
--- a/sound/soc/amd/acp-da7219-max98357a.c
+++ b/sound/soc/amd/acp-da7219-max98357a.c
@@ -73,8 +73,13 @@ static int cz_da7219_init(struct snd_soc_pcm_runtime *rtd)
 		return ret;
 	}
 
-	da7219_dai_wclk = clk_get(component->dev, "da7219-dai-wclk");
-	da7219_dai_bclk = clk_get(component->dev, "da7219-dai-bclk");
+	da7219_dai_wclk = devm_clk_get(component->dev, "da7219-dai-wclk");
+	if (IS_ERR(da7219_dai_wclk))
+		return PTR_ERR(da7219_dai_wclk);
+
+	da7219_dai_bclk = devm_clk_get(component->dev, "da7219-dai-bclk");
+	if (IS_ERR(da7219_dai_bclk))
+		return PTR_ERR(da7219_dai_bclk);
 
 	ret = snd_soc_card_jack_new(card, "Headset Jack",
 				SND_JACK_HEADSET | SND_JACK_LINEOUT |
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 249/453] powerpc/mm: sanity_check_fault() should work for all, not only BOOK3S
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (247 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.4 248/453] ASoC: amd: change clk_get() to devm_clk_get() and add missed checks Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.4 250/453] usb: ehci-omap: Fix PM disable depth umbalance in ehci_hcd_omap_probe Greg Kroah-Hartman
                   ` (206 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christophe Leroy, Nicholas Piggin,
	Michael Ellerman, Sasha Levin

From: Christophe Leroy <christophe.leroy@csgroup.eu>

[ Upstream commit 7ceb40027e19567a0a066e3b380cc034cdd9a124 ]

The verification and message introduced by commit 374f3f5979f9
("powerpc/mm/hash: Handle user access of kernel address gracefully")
applies to all platforms, it should not be limited to BOOK3S.

Make the BOOK3S version of sanity_check_fault() the one for all,
and bail out earlier if not BOOK3S.

Fixes: 374f3f5979f9 ("powerpc/mm/hash: Handle user access of kernel address gracefully")
Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Reviewed-by: Nicholas Piggin <npiggin@gmail.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/fe199d5af3578d3bf80035d203a94d742a7a28af.1607491748.git.christophe.leroy@csgroup.eu
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/mm/fault.c | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/arch/powerpc/mm/fault.c b/arch/powerpc/mm/fault.c
index 187047592d53c..bb01a862aaf8d 100644
--- a/arch/powerpc/mm/fault.c
+++ b/arch/powerpc/mm/fault.c
@@ -349,7 +349,6 @@ static inline void cmo_account_page_fault(void)
 static inline void cmo_account_page_fault(void) { }
 #endif /* CONFIG_PPC_SMLPAR */
 
-#ifdef CONFIG_PPC_BOOK3S
 static void sanity_check_fault(bool is_write, bool is_user,
 			       unsigned long error_code, unsigned long address)
 {
@@ -366,6 +365,9 @@ static void sanity_check_fault(bool is_write, bool is_user,
 		return;
 	}
 
+	if (!IS_ENABLED(CONFIG_PPC_BOOK3S))
+		return;
+
 	/*
 	 * For hash translation mode, we should never get a
 	 * PROTFAULT. Any update to pte to reduce access will result in us
@@ -400,10 +402,6 @@ static void sanity_check_fault(bool is_write, bool is_user,
 
 	WARN_ON_ONCE(error_code & DSISR_PROTFAULT);
 }
-#else
-static void sanity_check_fault(bool is_write, bool is_user,
-			       unsigned long error_code, unsigned long address) { }
-#endif /* CONFIG_PPC_BOOK3S */
 
 /*
  * Define the correct "is_write" bit in error_code based
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 250/453] usb: ehci-omap: Fix PM disable depth umbalance in ehci_hcd_omap_probe
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (248 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.4 249/453] powerpc/mm: sanity_check_fault() should work for all, not only BOOK3S Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.4 251/453] usb: oxu210hp-hcd: Fix memory leak in oxu_create Greg Kroah-Hartman
                   ` (205 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Alan Stern, Zhang Qilong, Sasha Levin

From: Zhang Qilong <zhangqilong3@huawei.com>

[ Upstream commit d6ff32478d7e95d6ca199b5c852710d6964d5811 ]

The pm_runtime_enable will decrement the power disable depth. Imbalance
depth will resulted in enabling runtime PM of device fails later.  Thus
a pairing decrement must be needed on the error handling path to keep it
balanced.

Fixes: 6c984b066d84b ("ARM: OMAP: USBHOST: Replace usbhs core driver APIs by Runtime pm APIs")
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Link: https://lore.kernel.org/r/20201123145719.1455849-1-zhangqilong3@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/host/ehci-omap.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/usb/host/ehci-omap.c b/drivers/usb/host/ehci-omap.c
index fc125b3d06e7d..03122dc332eda 100644
--- a/drivers/usb/host/ehci-omap.c
+++ b/drivers/usb/host/ehci-omap.c
@@ -220,6 +220,7 @@ static int ehci_hcd_omap_probe(struct platform_device *pdev)
 
 err_pm_runtime:
 	pm_runtime_put_sync(dev);
+	pm_runtime_disable(dev);
 
 err_phy:
 	for (i = 0; i < omap->nports; i++) {
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 251/453] usb: oxu210hp-hcd: Fix memory leak in oxu_create
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (249 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.4 250/453] usb: ehci-omap: Fix PM disable depth umbalance in ehci_hcd_omap_probe Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.4 252/453] speakup: fix uninitialized flush_lock Greg Kroah-Hartman
                   ` (204 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Zhang Qilong, Sasha Levin

From: Zhang Qilong <zhangqilong3@huawei.com>

[ Upstream commit e5548b05631ec3e6bfdaef1cad28c799545b791b ]

usb_create_hcd will alloc memory for hcd, and we should
call usb_put_hcd to free it when adding fails to prevent
memory leak.

Fixes: b92a78e582b1a ("usb host: Oxford OXU210HP HCD driver")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Link: https://lore.kernel.org/r/20201123145809.1456541-1-zhangqilong3@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/host/oxu210hp-hcd.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/host/oxu210hp-hcd.c b/drivers/usb/host/oxu210hp-hcd.c
index e67242e437edc..65985247fc00f 100644
--- a/drivers/usb/host/oxu210hp-hcd.c
+++ b/drivers/usb/host/oxu210hp-hcd.c
@@ -4149,8 +4149,10 @@ static struct usb_hcd *oxu_create(struct platform_device *pdev,
 	oxu->is_otg = otg;
 
 	ret = usb_add_hcd(hcd, irq, IRQF_SHARED);
-	if (ret < 0)
+	if (ret < 0) {
+		usb_put_hcd(hcd);
 		return ERR_PTR(ret);
+	}
 
 	device_wakeup_enable(hcd->self.controller);
 	return hcd;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 252/453] speakup: fix uninitialized flush_lock
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (250 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.4 251/453] usb: oxu210hp-hcd: Fix memory leak in oxu_create Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.4 253/453] nfsd: Fix message level for normal termination Greg Kroah-Hartman
                   ` (203 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Samuel Thibault,
	Yang Yingliang, Sasha Levin

From: Yang Yingliang <yangyingliang@huawei.com>

[ Upstream commit d1b928ee1cfa965a3327bbaa59bfa005d97fa0fe ]

The flush_lock is uninitialized, use DEFINE_SPINLOCK
to define and initialize flush_lock.

Fixes: c6e3fd22cd53 ("Staging: add speakup to the staging directory")
Reported-by: Hulk Robot <hulkci@huawei.com>
Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Link: https://lore.kernel.org/r/20201117012229.3395186-1-yangyingliang@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/staging/speakup/speakup_dectlk.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/speakup/speakup_dectlk.c b/drivers/staging/speakup/speakup_dectlk.c
index dccb4ea29d379..45ac48d031805 100644
--- a/drivers/staging/speakup/speakup_dectlk.c
+++ b/drivers/staging/speakup/speakup_dectlk.c
@@ -37,7 +37,7 @@ static unsigned char get_index(struct spk_synth *synth);
 static int in_escape;
 static int is_flushing;
 
-static spinlock_t flush_lock;
+static DEFINE_SPINLOCK(flush_lock);
 static DECLARE_WAIT_QUEUE_HEAD(flush);
 
 static struct var_t vars[] = {
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 253/453] nfsd: Fix message level for normal termination
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (251 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.4 252/453] speakup: fix uninitialized flush_lock Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.4 254/453] nfs_common: need lock during iterate through the list Greg Kroah-Hartman
                   ` (202 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, kazuo ito, Chuck Lever, Sasha Levin

From: kazuo ito <kzpn200@gmail.com>

[ Upstream commit 4420440c57892779f265108f46f83832a88ca795 ]

The warning message from nfsd terminating normally
can confuse system adminstrators or monitoring software.

Though it's not exactly fair to pin-point a commit where it
originated, the current form in the current place started
to appear in:

Fixes: e096bbc6488d ("knfsd: remove special handling for SIGHUP")
Signed-off-by: kazuo ito <kzpn200@gmail.com>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/nfsd/nfssvc.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/fs/nfsd/nfssvc.c b/fs/nfsd/nfssvc.c
index e8bee8ff30c59..155a4e43b24ee 100644
--- a/fs/nfsd/nfssvc.c
+++ b/fs/nfsd/nfssvc.c
@@ -516,8 +516,7 @@ static void nfsd_last_thread(struct svc_serv *serv, struct net *net)
 		return;
 
 	nfsd_shutdown_net(net);
-	printk(KERN_WARNING "nfsd: last server has exited, flushing export "
-			    "cache\n");
+	pr_info("nfsd: last server has exited, flushing export cache\n");
 	nfsd_export_flush(net);
 }
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 254/453] nfs_common: need lock during iterate through the list
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (252 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.4 253/453] nfsd: Fix message level for normal termination Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.4 255/453] x86/kprobes: Restore BTF if the single-stepping is cancelled Greg Kroah-Hartman
                   ` (201 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable,  Cheng Lin ,
	 Yi Wang ,
	Chuck Lever, Sasha Levin

From: Cheng Lin <cheng.lin130@zte.com.cn>

[ Upstream commit 4a9d81caf841cd2c0ae36abec9c2963bf21d0284 ]

If the elem is deleted during be iterated on it, the iteration
process will fall into an endless loop.

kernel: NMI watchdog: BUG: soft lockup - CPU#4 stuck for 22s! [nfsd:17137]

PID: 17137  TASK: ffff8818d93c0000  CPU: 4   COMMAND: "nfsd"
    [exception RIP: __state_in_grace+76]
    RIP: ffffffffc00e817c  RSP: ffff8818d3aefc98  RFLAGS: 00000246
    RAX: ffff881dc0c38298  RBX: ffffffff81b03580  RCX: ffff881dc02c9f50
    RDX: ffff881e3fce8500  RSI: 0000000000000001  RDI: ffffffff81b03580
    RBP: ffff8818d3aefca0   R8: 0000000000000020   R9: ffff8818d3aefd40
    R10: ffff88017fc03800  R11: ffff8818e83933c0  R12: ffff8818d3aefd40
    R13: 0000000000000000  R14: ffff8818e8391068  R15: ffff8818fa6e4000
    CS: 0010  SS: 0018
 #0 [ffff8818d3aefc98] opens_in_grace at ffffffffc00e81e3 [grace]
 #1 [ffff8818d3aefca8] nfs4_preprocess_stateid_op at ffffffffc02a3e6c [nfsd]
 #2 [ffff8818d3aefd18] nfsd4_write at ffffffffc028ed5b [nfsd]
 #3 [ffff8818d3aefd80] nfsd4_proc_compound at ffffffffc0290a0d [nfsd]
 #4 [ffff8818d3aefdd0] nfsd_dispatch at ffffffffc027b800 [nfsd]
 #5 [ffff8818d3aefe08] svc_process_common at ffffffffc02017f3 [sunrpc]
 #6 [ffff8818d3aefe70] svc_process at ffffffffc0201ce3 [sunrpc]
 #7 [ffff8818d3aefe98] nfsd at ffffffffc027b117 [nfsd]
 #8 [ffff8818d3aefec8] kthread at ffffffff810b88c1
 #9 [ffff8818d3aeff50] ret_from_fork at ffffffff816d1607

The troublemake elem:
crash> lock_manager ffff881dc0c38298
struct lock_manager {
  list = {
    next = 0xffff881dc0c38298,
    prev = 0xffff881dc0c38298
  },
  block_opens = false
}

Fixes: c87fb4a378f9 ("lockd: NLM grace period shouldn't block NFSv4 opens")
Signed-off-by: Cheng Lin <cheng.lin130@zte.com.cn>
Signed-off-by: Yi Wang <wang.yi59@zte.com.cn>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/nfs_common/grace.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/fs/nfs_common/grace.c b/fs/nfs_common/grace.c
index b73d9dd37f73c..26f2a50eceac9 100644
--- a/fs/nfs_common/grace.c
+++ b/fs/nfs_common/grace.c
@@ -69,10 +69,14 @@ __state_in_grace(struct net *net, bool open)
 	if (!open)
 		return !list_empty(grace_list);
 
+	spin_lock(&grace_lock);
 	list_for_each_entry(lm, grace_list, list) {
-		if (lm->block_opens)
+		if (lm->block_opens) {
+			spin_unlock(&grace_lock);
 			return true;
+		}
 	}
+	spin_unlock(&grace_lock);
 	return false;
 }
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 255/453] x86/kprobes: Restore BTF if the single-stepping is cancelled
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (253 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.4 254/453] nfs_common: need lock during iterate through the list Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.4 256/453] platform/chrome: cros_ec_spi: Dont overwrite spi::mode Greg Kroah-Hartman
                   ` (200 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Masami Hiramatsu,
	Peter Zijlstra (Intel),
	Sasha Levin

From: Masami Hiramatsu <mhiramat@kernel.org>

[ Upstream commit 78ff2733ff352175eb7f4418a34654346e1b6cd2 ]

Fix to restore BTF if single-stepping causes a page fault and
it is cancelled.

Usually the BTF flag was restored when the single stepping is done
(in resume_execution()). However, if a page fault happens on the
single stepping instruction, the fault handler is invoked and
the single stepping is cancelled. Thus, the BTF flag is not
restored.

Fixes: 1ecc798c6764 ("x86: debugctlmsr kprobes")
Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/160389546985.106936.12727996109376240993.stgit@devnote2
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/kernel/kprobes/core.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c
index 62c39baea39e3..5294018535d0c 100644
--- a/arch/x86/kernel/kprobes/core.c
+++ b/arch/x86/kernel/kprobes/core.c
@@ -1019,6 +1019,11 @@ int kprobe_fault_handler(struct pt_regs *regs, int trapnr)
 		 * So clear it by resetting the current kprobe:
 		 */
 		regs->flags &= ~X86_EFLAGS_TF;
+		/*
+		 * Since the single step (trap) has been cancelled,
+		 * we need to restore BTF here.
+		 */
+		restore_btf();
 
 		/*
 		 * If the TF flag was set before the kprobe hit,
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 256/453] platform/chrome: cros_ec_spi: Dont overwrite spi::mode
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (254 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.4 255/453] x86/kprobes: Restore BTF if the single-stepping is cancelled Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.4 257/453] bus: fsl-mc: fix error return code in fsl_mc_object_allocate() Greg Kroah-Hartman
                   ` (199 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Simon Glass, Gwendal Grignou,
	Douglas Anderson, Enric Balletbo i Serra, Alexandru M Stan,
	Stephen Boyd, Mark Brown, Sasha Levin

From: Stephen Boyd <swboyd@chromium.org>

[ Upstream commit 74639cbf51d7c0304342544a83dfda354a6bd208 ]

There isn't any need to overwrite the mode here in the driver with what
has been detected by the firmware, such as DT or ACPI. In fact, if we
use the SPI CS gpio descriptor feature we will overwrite the mode with
SPI_MODE_0 where it already contains SPI_MODE_0 and more importantly
SPI_CS_HIGH. Clearing the SPI_CS_HIGH bit causes the CS line to toggle
when the device is probed when it shouldn't change, confusing the driver
and making it fail to probe. Drop the assignment and let the spi core
take care of it.

Fixes: a17d94f0b6e1 ("mfd: Add ChromeOS EC SPI driver")
Cc: Simon Glass <sjg@chromium.org>
Cc: Gwendal Grignou <gwendal@chromium.org>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Tested-by: Douglas Anderson <dianders@chromium.org>
Acked-by: Enric Balletbo i Serra <enric.balletbo@collabora.com>
Cc: Alexandru M Stan <amstan@chromium.org>
Signed-off-by: Stephen Boyd <swboyd@chromium.org>
Reviewed-by: Simon Glass <sjg@chromium.org>
Link: https://lore.kernel.org/r/20201204193540.3047030-2-swboyd@chromium.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/chrome/cros_ec_spi.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/platform/chrome/cros_ec_spi.c b/drivers/platform/chrome/cros_ec_spi.c
index a831bd5a5b2ff..5e4521b014280 100644
--- a/drivers/platform/chrome/cros_ec_spi.c
+++ b/drivers/platform/chrome/cros_ec_spi.c
@@ -739,7 +739,6 @@ static int cros_ec_spi_probe(struct spi_device *spi)
 	int err;
 
 	spi->bits_per_word = 8;
-	spi->mode = SPI_MODE_0;
 	spi->rt = true;
 	err = spi_setup(spi);
 	if (err < 0)
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 257/453] bus: fsl-mc: fix error return code in fsl_mc_object_allocate()
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (255 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.4 256/453] platform/chrome: cros_ec_spi: Dont overwrite spi::mode Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.4 258/453] s390/cio: fix use-after-free in ccw_device_destroy_console Greg Kroah-Hartman
                   ` (198 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Laurentiu Tudor,
	Zhang Changzhong, Sasha Levin

From: Zhang Changzhong <zhangchangzhong@huawei.com>

[ Upstream commit 3d70fb03711c37bc64e8e9aea5830f498835f6bf ]

Fix to return a negative error code from the error handling
case instead of 0, as done elsewhere in this function.

Fixes: 197f4d6a4a00 ("staging: fsl-mc: fsl-mc object allocator driver")
Reported-by: Hulk Robot <hulkci@huawei.com>
Acked-by: Laurentiu Tudor <laurentiu.tudor@nxp.com>
Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
Link: https://lore.kernel.org/r/1607068967-31991-1-git-send-email-zhangchangzhong@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/bus/fsl-mc/fsl-mc-allocator.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/bus/fsl-mc/fsl-mc-allocator.c b/drivers/bus/fsl-mc/fsl-mc-allocator.c
index cc7bb900f5249..95672306d3714 100644
--- a/drivers/bus/fsl-mc/fsl-mc-allocator.c
+++ b/drivers/bus/fsl-mc/fsl-mc-allocator.c
@@ -292,8 +292,10 @@ int __must_check fsl_mc_object_allocate(struct fsl_mc_device *mc_dev,
 		goto error;
 
 	mc_adev = resource->data;
-	if (!mc_adev)
+	if (!mc_adev) {
+		error = -EINVAL;
 		goto error;
+	}
 
 	mc_adev->consumer_link = device_link_add(&mc_dev->dev,
 						 &mc_adev->dev,
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 258/453] s390/cio: fix use-after-free in ccw_device_destroy_console
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (256 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.4 257/453] bus: fsl-mc: fix error return code in fsl_mc_object_allocate() Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.4 259/453] iwlwifi: mvm: hook up missing RX handlers Greg Kroah-Hartman
                   ` (197 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Cornelia Huck,
	Qinglang Miao, Vineeth Vijayan, Heiko Carstens, Sasha Levin

From: Qinglang Miao <miaoqinglang@huawei.com>

[ Upstream commit 14d4c4fa46eeaa3922e8e1c4aa727eb0a1412804 ]

Use of sch->dev reference after the put_device() call could trigger
the use-after-free bugs.

Fix this by simply adjusting the position of put_device.

Fixes: 37db8985b211 ("s390/cio: add basic protected virtualization support")
Reported-by: Hulk Robot <hulkci@huawei.com>
Suggested-by: Cornelia Huck <cohuck@redhat.com>
Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
Reviewed-by: Cornelia Huck <cohuck@redhat.com>
Reviewed-by: Vineeth Vijayan <vneethv@linux.ibm.com>
[vneethv@linux.ibm.com: Slight modification in the commit-message]
Signed-off-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/s390/cio/device.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/s390/cio/device.c b/drivers/s390/cio/device.c
index 983f9c9e08deb..23e9227e60fd7 100644
--- a/drivers/s390/cio/device.c
+++ b/drivers/s390/cio/device.c
@@ -1664,10 +1664,10 @@ void __init ccw_device_destroy_console(struct ccw_device *cdev)
 	struct io_subchannel_private *io_priv = to_io_private(sch);
 
 	set_io_private(sch, NULL);
-	put_device(&sch->dev);
-	put_device(&cdev->dev);
 	dma_free_coherent(&sch->dev, sizeof(*io_priv->dma_area),
 			  io_priv->dma_area, io_priv->dma_area_dma);
+	put_device(&sch->dev);
+	put_device(&cdev->dev);
 	kfree(io_priv);
 }
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 259/453] iwlwifi: mvm: hook up missing RX handlers
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (257 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.4 258/453] s390/cio: fix use-after-free in ccw_device_destroy_console Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.4 260/453] erofs: avoid using generic_block_bmap Greg Kroah-Hartman
                   ` (196 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Johannes Berg, Luca Coelho, Sasha Levin

From: Johannes Berg <johannes.berg@intel.com>

[ Upstream commit 8a59d39033c35bb484f6bd91891db86ebe07fdc2 ]

The RX handlers for probe response data and channel switch weren't
hooked up properly, fix that.

Fixes: 86e177d80ff7 ("iwlwifi: mvm: add NOA and CSA to a probe response")
Fixes: d3a108a48dc6 ("iwlwifi: mvm: Support CSA countdown offloading")
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20201209231352.2d07dcee0d35.I07a61b5d734478db57d9434ff303e4c90bf6c32b@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/intel/iwlwifi/mvm/ops.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
index 3acbd5b7ab4b2..b04cc6214bac8 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
@@ -316,6 +316,12 @@ static const struct iwl_rx_handlers iwl_mvm_rx_handlers[] = {
 		       iwl_mvm_mu_mimo_grp_notif, RX_HANDLER_SYNC),
 	RX_HANDLER_GRP(DATA_PATH_GROUP, STA_PM_NOTIF,
 		       iwl_mvm_sta_pm_notif, RX_HANDLER_SYNC),
+	RX_HANDLER_GRP(MAC_CONF_GROUP, PROBE_RESPONSE_DATA_NOTIF,
+		       iwl_mvm_probe_resp_data_notif,
+		       RX_HANDLER_ASYNC_LOCKED),
+	RX_HANDLER_GRP(MAC_CONF_GROUP, CHANNEL_SWITCH_NOA_NOTIF,
+		       iwl_mvm_channel_switch_noa_notif,
+		       RX_HANDLER_SYNC),
 };
 #undef RX_HANDLER
 #undef RX_HANDLER_GRP
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 260/453] erofs: avoid using generic_block_bmap
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (258 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.4 259/453] iwlwifi: mvm: hook up missing RX handlers Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.4 261/453] can: m_can: m_can_config_endisable(): remove double clearing of clock stop request bit Greg Kroah-Hartman
                   ` (195 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chao Yu, Gao Xiang, Huang Jianan,
	Guo Weichao, Sasha Levin

From: Huang Jianan <huangjianan@oppo.com>

[ Upstream commit d8b3df8b1048405e73558b88cba2adf29490d468 ]

Surprisingly, `block' in sector_t indicates the number of
i_blkbits-sized blocks rather than sectors for bmap.

In addition, considering buffer_head limits mapped size to 32-bits,
should avoid using generic_block_bmap.

Link: https://lore.kernel.org/r/20201209115740.18802-1-huangjianan@oppo.com
Fixes: 9da681e017a3 ("staging: erofs: support bmap")
Reviewed-by: Chao Yu <yuchao0@huawei.com>
Reviewed-by: Gao Xiang <hsiangkao@redhat.com>
Signed-off-by: Huang Jianan <huangjianan@oppo.com>
Signed-off-by: Guo Weichao <guoweichao@oppo.com>
[ Gao Xiang: slightly update the commit message description. ]
Signed-off-by: Gao Xiang <hsiangkao@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/erofs/data.c | 26 +++++++-------------------
 1 file changed, 7 insertions(+), 19 deletions(-)

diff --git a/fs/erofs/data.c b/fs/erofs/data.c
index fc3a8d8064f84..b22a08ac53a23 100644
--- a/fs/erofs/data.c
+++ b/fs/erofs/data.c
@@ -323,27 +323,12 @@ static int erofs_raw_access_readpages(struct file *filp,
 	return 0;
 }
 
-static int erofs_get_block(struct inode *inode, sector_t iblock,
-			   struct buffer_head *bh, int create)
-{
-	struct erofs_map_blocks map = {
-		.m_la = iblock << 9,
-	};
-	int err;
-
-	err = erofs_map_blocks(inode, &map, EROFS_GET_BLOCKS_RAW);
-	if (err)
-		return err;
-
-	if (map.m_flags & EROFS_MAP_MAPPED)
-		bh->b_blocknr = erofs_blknr(map.m_pa);
-
-	return err;
-}
-
 static sector_t erofs_bmap(struct address_space *mapping, sector_t block)
 {
 	struct inode *inode = mapping->host;
+	struct erofs_map_blocks map = {
+		.m_la = blknr_to_addr(block),
+	};
 
 	if (EROFS_I(inode)->datalayout == EROFS_INODE_FLAT_INLINE) {
 		erofs_blk_t blks = i_size_read(inode) >> LOG_BLOCK_SIZE;
@@ -352,7 +337,10 @@ static sector_t erofs_bmap(struct address_space *mapping, sector_t block)
 			return 0;
 	}
 
-	return generic_block_bmap(mapping, block, erofs_get_block);
+	if (!erofs_map_blocks(inode, &map, EROFS_GET_BLOCKS_RAW))
+		return erofs_blknr(map.m_pa);
+
+	return 0;
 }
 
 /* for uncompressed (aligned) files and raw access for other files */
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 261/453] can: m_can: m_can_config_endisable(): remove double clearing of clock stop request bit
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (259 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.4 260/453] erofs: avoid using generic_block_bmap Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.4 262/453] RDMA/core: Do not indicate device ready when device enablement fails Greg Kroah-Hartman
                   ` (194 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sean Nyekjaer, Sriram Dash,
	Dan Murphy, Marc Kleine-Budde, Sasha Levin

From: Sean Nyekjaer <sean@geanix.com>

[ Upstream commit c9f4cad6cdfe350ce2637e57f7f2aa7ff326bcc6 ]

The CSR bit is already cleared when arriving here so remove this section of
duplicate code.

The registers set in m_can_config_endisable() is set to same exact values as
before this patch.

Signed-off-by: Sean Nyekjaer <sean@geanix.com>
Acked-by: Sriram Dash <sriram.dash@samsung.com>
Acked-by: Dan Murphy <dmurphy@ti.com>
Link: https://lore.kernel.org/r/20191211063227.84259-1-sean@geanix.com
Fixes: f524f829b75a ("can: m_can: Create a m_can platform framework")
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/can/m_can/m_can.c | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c
index c84114b44ee07..d2bb9a87eff9a 100644
--- a/drivers/net/can/m_can/m_can.c
+++ b/drivers/net/can/m_can/m_can.c
@@ -379,10 +379,6 @@ void m_can_config_endisable(struct m_can_classdev *cdev, bool enable)
 		cccr &= ~CCCR_CSR;
 
 	if (enable) {
-		/* Clear the Clock stop request if it was set */
-		if (cccr & CCCR_CSR)
-			cccr &= ~CCCR_CSR;
-
 		/* enable m_can configuration */
 		m_can_write(cdev, M_CAN_CCCR, cccr | CCCR_INIT);
 		udelay(5);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 262/453] RDMA/core: Do not indicate device ready when device enablement fails
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (260 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.4 261/453] can: m_can: m_can_config_endisable(): remove double clearing of clock stop request bit Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.4 263/453] remoteproc: q6v5-mss: fix error handling in q6v5_pds_enable Greg Kroah-Hartman
                   ` (193 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Leon Romanovsky, Jack Morgenstein,
	Leon Romanovsky, Jason Gunthorpe, Sasha Levin

From: Jack Morgenstein <jackm@dev.mellanox.co.il>

[ Upstream commit 779e0bf47632c609c59f527f9711ecd3214dccb0 ]

In procedure ib_register_device, procedure kobject_uevent is called
(advertising that the device is ready for userspace usage) even when
device_enable_and_get() returned an error.

As a result, various RDMA modules attempted to register for the device
even while the device driver was preparing to unregister the device.

Fix this by advertising the device availability only after enabling the
device succeeds.

Fixes: e7a5b4aafd82 ("RDMA/device: Don't fire uevent before device is fully initialized")
Link: https://lore.kernel.org/r/20201208073545.9723-3-leon@kernel.org
Suggested-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il>
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/core/device.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c
index 59dc9f3cfb376..256d379bba676 100644
--- a/drivers/infiniband/core/device.c
+++ b/drivers/infiniband/core/device.c
@@ -1387,9 +1387,6 @@ int ib_register_device(struct ib_device *device, const char *name)
 	}
 
 	ret = enable_device_and_get(device);
-	dev_set_uevent_suppress(&device->dev, false);
-	/* Mark for userspace that device is ready */
-	kobject_uevent(&device->dev.kobj, KOBJ_ADD);
 	if (ret) {
 		void (*dealloc_fn)(struct ib_device *);
 
@@ -1409,8 +1406,12 @@ int ib_register_device(struct ib_device *device, const char *name)
 		ib_device_put(device);
 		__ib_unregister_device(device);
 		device->ops.dealloc_driver = dealloc_fn;
+		dev_set_uevent_suppress(&device->dev, false);
 		return ret;
 	}
+	dev_set_uevent_suppress(&device->dev, false);
+	/* Mark for userspace that device is ready */
+	kobject_uevent(&device->dev.kobj, KOBJ_ADD);
 	ib_device_put(device);
 
 	return 0;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 263/453] remoteproc: q6v5-mss: fix error handling in q6v5_pds_enable
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (261 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.4 262/453] RDMA/core: Do not indicate device ready when device enablement fails Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.4 264/453] remoteproc: qcom: fix reference leak in adsp_start Greg Kroah-Hartman
                   ` (192 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Zhang Qilong, Bjorn Andersson, Sasha Levin

From: Zhang Qilong <zhangqilong3@huawei.com>

[ Upstream commit a24723050037303e4008b37f1f8dcc99c58901aa ]

If the pm_runtime_get_sync failed in q6v5_pds_enable when
loop (i), The unroll_pd_votes will start from (i - 1), and
it will resulted in following problems:

  1) pm_runtime_get_sync will increment pm usage counter even it
     failed. Forgetting to pm_runtime_put_noidle will result in
     reference leak.

  2) Have not reset pds[i] performance state.

Then we fix it.

Fixes: 4760a896be88e ("remoteproc: q6v5-mss: Vote for rpmh power domains")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Link: https://lore.kernel.org/r/20201102143433.143996-1-zhangqilong3@huawei.com
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/remoteproc/qcom_q6v5_mss.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/remoteproc/qcom_q6v5_mss.c b/drivers/remoteproc/qcom_q6v5_mss.c
index a67c55785b4de..5e54e6f5edb1a 100644
--- a/drivers/remoteproc/qcom_q6v5_mss.c
+++ b/drivers/remoteproc/qcom_q6v5_mss.c
@@ -331,8 +331,11 @@ static int q6v5_pds_enable(struct q6v5 *qproc, struct device **pds,
 	for (i = 0; i < pd_count; i++) {
 		dev_pm_genpd_set_performance_state(pds[i], INT_MAX);
 		ret = pm_runtime_get_sync(pds[i]);
-		if (ret < 0)
+		if (ret < 0) {
+			pm_runtime_put_noidle(pds[i]);
+			dev_pm_genpd_set_performance_state(pds[i], 0);
 			goto unroll_pd_votes;
+		}
 	}
 
 	return 0;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 264/453] remoteproc: qcom: fix reference leak in adsp_start
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (262 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.4 263/453] remoteproc: q6v5-mss: fix error handling in q6v5_pds_enable Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.4 265/453] remoteproc: qcom: Fix potential NULL dereference in adsp_init_mmio() Greg Kroah-Hartman
                   ` (191 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Zhang Qilong, Bjorn Andersson, Sasha Levin

From: Zhang Qilong <zhangqilong3@huawei.com>

[ Upstream commit aa37448f597c09844942da87d042fc6793f989c2 ]

pm_runtime_get_sync will increment pm usage counter even it
failed. Forgetting to pm_runtime_put_noidle will result in
reference leak in adsp_start, so we should fix it.

Fixes: dc160e4491222 ("remoteproc: qcom: Introduce Non-PAS ADSP PIL driver")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Link: https://lore.kernel.org/r/20201102143534.144484-1-zhangqilong3@huawei.com
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/remoteproc/qcom_q6v5_adsp.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/remoteproc/qcom_q6v5_adsp.c b/drivers/remoteproc/qcom_q6v5_adsp.c
index e953886b2eb77..cd88ceabf03e9 100644
--- a/drivers/remoteproc/qcom_q6v5_adsp.c
+++ b/drivers/remoteproc/qcom_q6v5_adsp.c
@@ -184,8 +184,10 @@ static int adsp_start(struct rproc *rproc)
 
 	dev_pm_genpd_set_performance_state(adsp->dev, INT_MAX);
 	ret = pm_runtime_get_sync(adsp->dev);
-	if (ret)
+	if (ret) {
+		pm_runtime_put_noidle(adsp->dev);
 		goto disable_xo_clk;
+	}
 
 	ret = clk_bulk_prepare_enable(adsp->num_clks, adsp->clks);
 	if (ret) {
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 265/453] remoteproc: qcom: Fix potential NULL dereference in adsp_init_mmio()
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (263 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.4 264/453] remoteproc: qcom: fix reference leak in adsp_start Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.4 266/453] clk: tegra: Fix duplicated SE clock entry Greg Kroah-Hartman
                   ` (190 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Zhang Changzhong, Bjorn Andersson,
	Sasha Levin

From: Zhang Changzhong <zhangchangzhong@huawei.com>

[ Upstream commit c3d4e5b12672bbdf63f4cc933e3169bc6bbec8da ]

platform_get_resource() may fail and in this case a NULL dereference
will occur.

Fix it to use devm_platform_ioremap_resource() instead of calling
platform_get_resource() and devm_ioremap().

This is detected by Coccinelle semantic patch.

@@
expression pdev, res, n, t, e, e1, e2;
@@

res = \(platform_get_resource\|platform_get_resource_byname\)(pdev, t,
n);
+ if (!res)
+   return -EINVAL;
... when != res == NULL
e = devm_ioremap(e1, res->start, e2);

Fixes: dc160e449122 ("remoteproc: qcom: Introduce Non-PAS ADSP PIL driver")
Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
Link: https://lore.kernel.org/r/1607392460-20516-1-git-send-email-zhangchangzhong@huawei.com
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/remoteproc/qcom_q6v5_adsp.c | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/drivers/remoteproc/qcom_q6v5_adsp.c b/drivers/remoteproc/qcom_q6v5_adsp.c
index cd88ceabf03e9..24e8b7e271773 100644
--- a/drivers/remoteproc/qcom_q6v5_adsp.c
+++ b/drivers/remoteproc/qcom_q6v5_adsp.c
@@ -347,15 +347,12 @@ static int adsp_init_mmio(struct qcom_adsp *adsp,
 				struct platform_device *pdev)
 {
 	struct device_node *syscon;
-	struct resource *res;
 	int ret;
 
-	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-	adsp->qdsp6ss_base = devm_ioremap(&pdev->dev, res->start,
-			resource_size(res));
-	if (!adsp->qdsp6ss_base) {
+	adsp->qdsp6ss_base = devm_platform_ioremap_resource(pdev, 0);
+	if (IS_ERR(adsp->qdsp6ss_base)) {
 		dev_err(adsp->dev, "failed to map QDSP6SS registers\n");
-		return -ENOMEM;
+		return PTR_ERR(adsp->qdsp6ss_base);
 	}
 
 	syscon = of_parse_phandle(pdev->dev.of_node, "qcom,halt-regs", 0);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 266/453] clk: tegra: Fix duplicated SE clock entry
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (264 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.4 265/453] remoteproc: qcom: Fix potential NULL dereference in adsp_init_mmio() Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.4 267/453] mtd: rawnand: gpmi: fix reference count leak in gpmi ops Greg Kroah-Hartman
                   ` (189 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dmitry Osipenko, Thierry Reding,
	Stephen Boyd, Sasha Levin

From: Dmitry Osipenko <digetx@gmail.com>

[ Upstream commit 5bf5861d6ea6c3f4b38fc8fda2062b2dc44ac63d ]

The periph_clks[] array contains duplicated entry for Security Engine
clock which was meant to be defined for T210, but it wasn't added
properly. This patch corrects the T210 SE entry and fixes the following
error message on T114/T124: "Tegra clk 127: register failed with -17".

Fixes: dc37fec48314 ("clk: tegra: periph: Add new periph clks and muxes for Tegra210")
Tested-by Nicolas Chauvet <kwizart@gmail.com>
Reported-by Nicolas Chauvet <kwizart@gmail.com>
Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
Link: https://lore.kernel.org/r/20201025224212.7790-1-digetx@gmail.com
Acked-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/tegra/clk-id.h           | 1 +
 drivers/clk/tegra/clk-tegra-periph.c | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/clk/tegra/clk-id.h b/drivers/clk/tegra/clk-id.h
index de466b4446da9..0efcb200dde5a 100644
--- a/drivers/clk/tegra/clk-id.h
+++ b/drivers/clk/tegra/clk-id.h
@@ -233,6 +233,7 @@ enum clk_id {
 	tegra_clk_sdmmc4,
 	tegra_clk_sdmmc4_8,
 	tegra_clk_se,
+	tegra_clk_se_10,
 	tegra_clk_soc_therm,
 	tegra_clk_soc_therm_8,
 	tegra_clk_sor0,
diff --git a/drivers/clk/tegra/clk-tegra-periph.c b/drivers/clk/tegra/clk-tegra-periph.c
index 49b9f2f85bad6..4dc11e1e61ba8 100644
--- a/drivers/clk/tegra/clk-tegra-periph.c
+++ b/drivers/clk/tegra/clk-tegra-periph.c
@@ -636,7 +636,7 @@ static struct tegra_periph_init_data periph_clks[] = {
 	INT8("host1x", mux_pllm_pllc2_c_c3_pllp_plla, CLK_SOURCE_HOST1X, 28, 0, tegra_clk_host1x_8),
 	INT8("host1x", mux_pllc4_out1_pllc_pllc4_out2_pllp_clkm_plla_pllc4_out0, CLK_SOURCE_HOST1X, 28, 0, tegra_clk_host1x_9),
 	INT8("se", mux_pllp_pllc2_c_c3_pllm_clkm, CLK_SOURCE_SE, 127, TEGRA_PERIPH_ON_APB, tegra_clk_se),
-	INT8("se", mux_pllp_pllc2_c_c3_clkm, CLK_SOURCE_SE, 127, TEGRA_PERIPH_ON_APB, tegra_clk_se),
+	INT8("se", mux_pllp_pllc2_c_c3_clkm, CLK_SOURCE_SE, 127, TEGRA_PERIPH_ON_APB, tegra_clk_se_10),
 	INT8("2d", mux_pllm_pllc2_c_c3_pllp_plla, CLK_SOURCE_2D, 21, 0, tegra_clk_gr2d_8),
 	INT8("3d", mux_pllm_pllc2_c_c3_pllp_plla, CLK_SOURCE_3D, 24, 0, tegra_clk_gr3d_8),
 	INT8("vic03", mux_pllm_pllc_pllp_plla_pllc2_c3_clkm, CLK_SOURCE_VIC03, 178, 0, tegra_clk_vic03),
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 267/453] mtd: rawnand: gpmi: fix reference count leak in gpmi ops
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (265 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.4 266/453] clk: tegra: Fix duplicated SE clock entry Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.4 268/453] mtd: rawnand: meson: Fix a resource leak in init Greg Kroah-Hartman
                   ` (188 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Zhang Qilong, Han Xu, Miquel Raynal,
	Sasha Levin

From: Zhang Qilong <zhangqilong3@huawei.com>

[ Upstream commit 1b391c7f2e863985668d705f525af3ceb55bc800 ]

pm_runtime_get_sync() will increment pm usage at first and it
will resume the device later. If runtime of the device has
error or device is in inaccessible state(or other error state),
resume operation will fail. If we do not call put operation to
decrease the reference, it will result in reference leak in
the two functions(gpmi_init and gpmi_nfc_exec_op). Moreover,
this device cannot enter the idle state and always stay busy or
other non-idle state later. So we fixed it through adding
pm_runtime_put_noidle.

Fixes: 5bc6bb603b4d0 ("mtd: rawnand: gpmi: Fix suspend/resume problem")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Acked-by: Han Xu <han.xu@nxp.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20201107110552.1568742-1-zhangqilong3@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
index ef89947ee3191..89239d9c4ea63 100644
--- a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
+++ b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
@@ -149,8 +149,10 @@ static int gpmi_init(struct gpmi_nand_data *this)
 	int ret;
 
 	ret = pm_runtime_get_sync(this->dev);
-	if (ret < 0)
+	if (ret < 0) {
+		pm_runtime_put_noidle(this->dev);
 		return ret;
+	}
 
 	ret = gpmi_reset_block(r->gpmi_regs, false);
 	if (ret)
@@ -2414,8 +2416,10 @@ static int gpmi_nfc_exec_op(struct nand_chip *chip,
 		this->transfers[i].direction = DMA_NONE;
 
 	ret = pm_runtime_get_sync(this->dev);
-	if (ret < 0)
+	if (ret < 0) {
+		pm_runtime_put_noidle(this->dev);
 		return ret;
+	}
 
 	/*
 	 * This driver currently supports only one NAND chip. Plus, dies share
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 268/453] mtd: rawnand: meson: Fix a resource leak in init
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (266 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.4 267/453] mtd: rawnand: gpmi: fix reference count leak in gpmi ops Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.4 269/453] mtd: rawnand: gpmi: Fix the random DMA timeout issue Greg Kroah-Hartman
                   ` (187 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Miquel Raynal, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit ad8566d3555c4731e6b48823b92d3929b0394c14 ]

Call clk_disable_unprepare(nfc->phase_rx) if the clk_set_rate() function
fails to avoid a resource leak.

Fixes: 8fae856c5350 ("mtd: rawnand: meson: add support for Amlogic NAND flash controller")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/X8ikVCnUsfTpffFB@mwanda
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mtd/nand/raw/meson_nand.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/mtd/nand/raw/meson_nand.c b/drivers/mtd/nand/raw/meson_nand.c
index 1b82b687e5a50..58eaa3845da4d 100644
--- a/drivers/mtd/nand/raw/meson_nand.c
+++ b/drivers/mtd/nand/raw/meson_nand.c
@@ -1041,9 +1041,12 @@ static int meson_nfc_clk_init(struct meson_nfc *nfc)
 
 	ret = clk_set_rate(nfc->device_clk, 24000000);
 	if (ret)
-		goto err_phase_rx;
+		goto err_disable_rx;
 
 	return 0;
+
+err_disable_rx:
+	clk_disable_unprepare(nfc->phase_rx);
 err_phase_rx:
 	clk_disable_unprepare(nfc->phase_tx);
 err_phase_tx:
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 269/453] mtd: rawnand: gpmi: Fix the random DMA timeout issue
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (267 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.4 268/453] mtd: rawnand: meson: Fix a resource leak in init Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.4 270/453] extcon: max77693: Fix modalias string Greg Kroah-Hartman
                   ` (186 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Han Xu, Sascha Hauer, Miquel Raynal,
	Sasha Levin

From: Han Xu <han.xu@nxp.com>

[ Upstream commit 7671edeb193910482a9b0c22cd32176e7de7b2ed ]

To get better performance, current gpmi driver collected and chained all
small DMA transfers in gpmi_nfc_exec_op, the whole chain triggered and
wait for complete at the end.

But some random DMA timeout found in this new driver, with the help of
ftrace, we found the root cause is as follows:

Take gpmi_ecc_read_page() as an example, gpmi_nfc_exec_op collected 6
DMA transfers and the DMA chain triggered at the end. It waits for bch
completion and check jiffies if it's timeout. The typical function graph
shown below,

   63.216351 |   1)               |  gpmi_ecc_read_page() {
   63.216352 |   1)   0.750 us    |    gpmi_bch_layout_std();
   63.216354 |   1)               |    gpmi_nfc_exec_op() {
   63.216355 |   1)               |      gpmi_chain_command() {
   63.216356 |   1)               |        mxs_dma_prep_slave_sg() {
   63.216357 |   1)               |          /* mxs chan ccw idx: 0 */
   63.216358 |   1)   1.750 us    |        }
   63.216359 |   1)               |        mxs_dma_prep_slave_sg() {
   63.216360 |   1)               |          /* mxs chan ccw idx: 1 */
   63.216361 |   1)   2.000 us    |        }
   63.216361 |   1)   6.500 us    |      }
   63.216362 |   1)               |      gpmi_chain_command() {
   63.216363 |   1)               |        mxs_dma_prep_slave_sg() {
   63.216364 |   1)               |          /* mxs chan ccw idx: 2 */
   63.216365 |   1)   1.750 us    |        }
   63.216366 |   1)               |        mxs_dma_prep_slave_sg() {
   63.216367 |   1)               |          /* mxs chan ccw idx: 3 */
   63.216367 |   1)   1.750 us    |        }
   63.216368 |   1)   5.875 us    |      }
   63.216369 |   1)               |      /* gpmi_chain_wait_ready */
   63.216370 |   1)               |      mxs_dma_prep_slave_sg() {
   63.216372 |   1)               |        /* mxs chan ccw idx: 4 */
   63.216373 |   1)   3.000 us    |      }
   63.216374 |   1)               |      /* gpmi_chain_data_read */
   63.216376 |   1)               |      mxs_dma_prep_slave_sg() {
   63.216377 |   1)               |        /* mxs chan ccw idx: 5 */
   63.216378 |   1)   2.000 us    |      }
   63.216379 |   1)   1.125 us    |      mxs_dma_tx_submit();
   63.216381 |   1)   1.000 us    |      mxs_dma_enable_chan();
   63.216712 |   0)   2.625 us    |  mxs_dma_int_handler();
   63.216717 |   0)   4.250 us    |  bch_irq();
   63.216723 |   0)   1.250 us    |  mxs_dma_tasklet();
   63.216723 |   1)               |      /* jiffies left 250 */
   63.216725 |   1) ! 372.000 us  |    }
   63.216726 |   1)   2.625 us    |    gpmi_count_bitflips();
   63.216730 |   1) ! 379.125 us  |  }

but it's not gurantee that bch irq handled always after dma irq handled,
sometimes bch_irq comes first and gpmi_nfc_exec_op won't wait anymore,
another gpmi_nfc_exec_op may get invoked before last DMA chain IRQ
handled, this messed up the next DMA chain and causes DMA timeout. Check
the trace log when issue happened.

   63.218923 |   1)               |  gpmi_ecc_read_page() {
   63.218924 |   1)   0.625 us    |    gpmi_bch_layout_std();
   63.218926 |   1)               |    gpmi_nfc_exec_op() {
   63.218927 |   1)               |      gpmi_chain_command() {
   63.218928 |   1)               |        mxs_dma_prep_slave_sg() {
   63.218929 |   1)               |          /* mxs chan ccw idx: 0 */
   63.218929 |   1)   1.625 us    |        }
   63.218931 |   1)               |        mxs_dma_prep_slave_sg() {
   63.218931 |   1)               |          /* mxs chan ccw idx: 1 */
   63.218932 |   1)   1.750 us    |        }
   63.218933 |   1)   5.875 us    |      }
   63.218934 |   1)               |      gpmi_chain_command() {
   63.218934 |   1)               |        mxs_dma_prep_slave_sg() {
   63.218935 |   1)               |          /* mxs chan ccw idx: 2 */
   63.218936 |   1)   1.875 us    |        }
   63.218937 |   1)               |        mxs_dma_prep_slave_sg() {
   63.218938 |   1)               |          /* mxs chan ccw idx: 3 */
   63.218939 |   1)   1.625 us    |        }
   63.218939 |   1)   5.875 us    |      }
   63.218940 |   1)               |      /* gpmi_chain_wait_ready */
   63.218941 |   1)               |      mxs_dma_prep_slave_sg() {
   63.218942 |   1)               |        /* mxs chan ccw idx: 4 */
   63.218942 |   1)   1.625 us    |      }
   63.218943 |   1)               |      /* gpmi_chain_data_read */
   63.218944 |   1)               |      mxs_dma_prep_slave_sg() {
   63.218945 |   1)               |        /* mxs chan ccw idx: 5 */
   63.218947 |   1)   2.375 us    |      }
   63.218948 |   1)   0.625 us    |      mxs_dma_tx_submit();
   63.218949 |   1)   1.000 us    |      mxs_dma_enable_chan();
   63.219276 |   0)   5.125 us    |  bch_irq();                  <----
   63.219283 |   1)               |      /* jiffies left 250 */
   63.219285 |   1) ! 358.625 us  |    }
   63.219286 |   1)   2.750 us    |    gpmi_count_bitflips();
   63.219289 |   1) ! 366.000 us  |  }
   63.219290 |   1)               |  gpmi_ecc_read_page() {
   63.219291 |   1)   0.750 us    |    gpmi_bch_layout_std();
   63.219293 |   1)               |    gpmi_nfc_exec_op() {
   63.219294 |   1)               |      gpmi_chain_command() {
   63.219295 |   1)               |        mxs_dma_prep_slave_sg() {
   63.219295 |   0)   1.875 us    |  mxs_dma_int_handler();      <----
   63.219296 |   1)               |          /* mxs chan ccw idx: 6 */
   63.219297 |   1)   2.250 us    |        }
   63.219298 |   1)               |        mxs_dma_prep_slave_sg() {
   63.219298 |   0)   1.000 us    |  mxs_dma_tasklet();
   63.219299 |   1)               |          /* mxs chan ccw idx: 0 */
   63.219300 |   1)   1.625 us    |        }
   63.219300 |   1)   6.375 us    |      }
   63.219301 |   1)               |      gpmi_chain_command() {
   63.219302 |   1)               |        mxs_dma_prep_slave_sg() {
   63.219303 |   1)               |          /* mxs chan ccw idx: 1 */
   63.219304 |   1)   1.625 us    |        }
   63.219305 |   1)               |        mxs_dma_prep_slave_sg() {
   63.219306 |   1)               |          /* mxs chan ccw idx: 2 */
   63.219306 |   1)   1.875 us    |        }
   63.219307 |   1)   6.000 us    |      }
   63.219308 |   1)               |      /* gpmi_chain_wait_ready */
   63.219308 |   1)               |      mxs_dma_prep_slave_sg() {
   63.219309 |   1)               |        /* mxs chan ccw idx: 3 */
   63.219310 |   1)   2.000 us    |      }
   63.219311 |   1)               |      /* gpmi_chain_data_read */
   63.219312 |   1)               |      mxs_dma_prep_slave_sg() {
   63.219313 |   1)               |        /* mxs chan ccw idx: 4 */
   63.219314 |   1)   1.750 us    |      }
   63.219315 |   1)   0.625 us    |      mxs_dma_tx_submit();
   63.219316 |   1)   0.875 us    |      mxs_dma_enable_chan();
   64.224227 |   1)               |      /* jiffies left 0 */

In the first gpmi_nfc_exec_op, bch_irq comes first and gpmi_nfc_exec_op
exits, but DMA IRQ still not happened yet until the middle of following
gpmi_nfc_exec_op, the first DMA transfer index get messed and DMA get
timeout.

To fix the issue, when there is bch ops in DMA chain, the
gpmi_nfc_exec_op should wait for both completions rather than bch
completion only.

Fixes: ef347c0cfd61 ("mtd: rawnand: gpmi: Implement exec_op")
Signed-off-by: Han Xu <han.xu@nxp.com>
Reviewed-by: Sascha Hauer <s.hauer@pengutronix.de>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20201209035104.22679-3-han.xu@nxp.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c | 30 +++++++++++++++-------
 1 file changed, 21 insertions(+), 9 deletions(-)

diff --git a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
index 89239d9c4ea63..2390ed077a2fc 100644
--- a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
+++ b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
@@ -2408,7 +2408,7 @@ static int gpmi_nfc_exec_op(struct nand_chip *chip,
 	void *buf_read = NULL;
 	const void *buf_write = NULL;
 	bool direct = false;
-	struct completion *completion;
+	struct completion *dma_completion, *bch_completion;
 	unsigned long to;
 
 	this->ntransfers = 0;
@@ -2502,22 +2502,24 @@ static int gpmi_nfc_exec_op(struct nand_chip *chip,
 		       this->resources.bch_regs + HW_BCH_FLASH0LAYOUT1);
 	}
 
+	desc->callback = dma_irq_callback;
+	desc->callback_param = this;
+	dma_completion = &this->dma_done;
+	bch_completion = NULL;
+
+	init_completion(dma_completion);
+
 	if (this->bch && buf_read) {
 		writel(BM_BCH_CTRL_COMPLETE_IRQ_EN,
 		       this->resources.bch_regs + HW_BCH_CTRL_SET);
-		completion = &this->bch_done;
-	} else {
-		desc->callback = dma_irq_callback;
-		desc->callback_param = this;
-		completion = &this->dma_done;
+		bch_completion = &this->bch_done;
+		init_completion(bch_completion);
 	}
 
-	init_completion(completion);
-
 	dmaengine_submit(desc);
 	dma_async_issue_pending(get_dma_chan(this));
 
-	to = wait_for_completion_timeout(completion, msecs_to_jiffies(1000));
+	to = wait_for_completion_timeout(dma_completion, msecs_to_jiffies(1000));
 	if (!to) {
 		dev_err(this->dev, "DMA timeout, last DMA\n");
 		gpmi_dump_info(this);
@@ -2525,6 +2527,16 @@ static int gpmi_nfc_exec_op(struct nand_chip *chip,
 		goto unmap;
 	}
 
+	if (this->bch && buf_read) {
+		to = wait_for_completion_timeout(bch_completion, msecs_to_jiffies(1000));
+		if (!to) {
+			dev_err(this->dev, "BCH timeout, last DMA\n");
+			gpmi_dump_info(this);
+			ret = -ETIMEDOUT;
+			goto unmap;
+		}
+	}
+
 	writel(BM_BCH_CTRL_COMPLETE_IRQ_EN,
 	       this->resources.bch_regs + HW_BCH_CTRL_CLR);
 	gpmi_clear_bch(this);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 270/453] extcon: max77693: Fix modalias string
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (268 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.4 269/453] mtd: rawnand: gpmi: Fix the random DMA timeout issue Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.4 271/453] crypto: atmel-i2c - select CONFIG_BITREVERSE Greg Kroah-Hartman
                   ` (185 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Marek Szyprowski, Chanwoo Choi, Sasha Levin

From: Marek Szyprowski <m.szyprowski@samsung.com>

[ Upstream commit e1efdb604f5c9903a5d92ef42244009d3c04880f ]

The platform device driver name is "max77693-muic", so advertise it
properly in the modalias string. This fixes automated module loading when
this driver is compiled as a module.

Fixes: db1b9037424b ("extcon: MAX77693: Add extcon-max77693 driver to support Maxim MAX77693 MUIC device")
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/extcon/extcon-max77693.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/extcon/extcon-max77693.c b/drivers/extcon/extcon-max77693.c
index 32fc5a66ffa98..26c7041f70698 100644
--- a/drivers/extcon/extcon-max77693.c
+++ b/drivers/extcon/extcon-max77693.c
@@ -1277,4 +1277,4 @@ module_platform_driver(max77693_muic_driver);
 MODULE_DESCRIPTION("Maxim MAX77693 Extcon driver");
 MODULE_AUTHOR("Chanwoo Choi <cw00.choi@samsung.com>");
 MODULE_LICENSE("GPL");
-MODULE_ALIAS("platform:extcon-max77693");
+MODULE_ALIAS("platform:max77693-muic");
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 271/453] crypto: atmel-i2c - select CONFIG_BITREVERSE
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (269 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.4 270/453] extcon: max77693: Fix modalias string Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.4 272/453] mac80211: dont set set TDLS STA bandwidth wider than possible Greg Kroah-Hartman
                   ` (184 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Arnd Bergmann, Herbert Xu, Sasha Levin

From: Arnd Bergmann <arnd@arndb.de>

[ Upstream commit d33a23b0532d5d1b5b700e8641661261e7dbef61 ]

The bitreverse helper is almost always built into the kernel,
but in a rare randconfig build it is possible to hit a case
in which it is a loadable module while the atmel-i2c driver
is built-in:

arm-linux-gnueabi-ld: drivers/crypto/atmel-i2c.o: in function `atmel_i2c_checksum':
atmel-i2c.c:(.text+0xa0): undefined reference to `byte_rev_table'

Add one more 'select' statement to prevent this.

Fixes: 11105693fa05 ("crypto: atmel-ecc - introduce Microchip / Atmel ECC driver")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/Kconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/crypto/Kconfig b/drivers/crypto/Kconfig
index 0952f059d967c..1f6308cdf79a2 100644
--- a/drivers/crypto/Kconfig
+++ b/drivers/crypto/Kconfig
@@ -544,6 +544,7 @@ config CRYPTO_DEV_ATMEL_SHA
 
 config CRYPTO_DEV_ATMEL_I2C
 	tristate
+	select BITREVERSE
 
 config CRYPTO_DEV_ATMEL_ECC
 	tristate "Support for Microchip / Atmel ECC hw accelerator"
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 272/453] mac80211: dont set set TDLS STA bandwidth wider than possible
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (270 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.4 271/453] crypto: atmel-i2c - select CONFIG_BITREVERSE Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.4 273/453] ASoC: wm_adsp: remove "ctl" from list on error in wm_adsp_create_control() Greg Kroah-Hartman
                   ` (183 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Johannes Berg, Luca Coelho, Sasha Levin

From: Johannes Berg <johannes.berg@intel.com>

[ Upstream commit f65607cdbc6b0da356ef5a22552ddd9313cf87a0 ]

When we set up a TDLS station, we set sta->sta.bandwidth solely based
on the capabilities, because the "what's the current bandwidth" check
is bypassed and only applied for other types of stations.

This leads to the unfortunate scenario that the sta->sta.bandwidth is
160 MHz if both stations support it, but we never actually configure
this bandwidth unless the AP is already using 160 MHz; even for wider
bandwidth support we only go up to 80 MHz (at least right now.)

For iwlwifi, this can also lead to firmware asserts, telling us that
we've configured the TX rates for a higher bandwidth than is actually
available due to the PHY configuration.

For non-TDLS, we check against the interface's requested bandwidth,
but we explicitly skip this check for TDLS to cope with the wider BW
case. Change this to
 (a) still limit to the TDLS peer's own chandef, which gets factored
     into the overall PHY configuration we request from the driver,
     and
 (b) limit it to when the TDLS peer is authorized, because it's only
     factored into the channel context in this case.

Fixes: 504871e602d9 ("mac80211: fix bandwidth computation for TDLS peers")
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20201206145305.fcc7d29c4590.I11f77e9e25ddf871a3c8d5604650c763e2c5887a@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/mac80211/vht.c | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/net/mac80211/vht.c b/net/mac80211/vht.c
index aabc63dadf176..cea83fa5fc5b9 100644
--- a/net/mac80211/vht.c
+++ b/net/mac80211/vht.c
@@ -446,12 +446,18 @@ enum ieee80211_sta_rx_bandwidth ieee80211_sta_cur_vht_bw(struct sta_info *sta)
 	 * IEEE80211-2016 specification makes higher bandwidth operation
 	 * possible on the TDLS link if the peers have wider bandwidth
 	 * capability.
+	 *
+	 * However, in this case, and only if the TDLS peer is authorized,
+	 * limit to the tdls_chandef so that the configuration here isn't
+	 * wider than what's actually requested on the channel context.
 	 */
 	if (test_sta_flag(sta, WLAN_STA_TDLS_PEER) &&
-	    test_sta_flag(sta, WLAN_STA_TDLS_WIDER_BW))
-		return bw;
-
-	bw = min(bw, ieee80211_chan_width_to_rx_bw(bss_width));
+	    test_sta_flag(sta, WLAN_STA_TDLS_WIDER_BW) &&
+	    test_sta_flag(sta, WLAN_STA_AUTHORIZED) &&
+	    sta->tdls_chandef.chan)
+		bw = min(bw, ieee80211_chan_width_to_rx_bw(sta->tdls_chandef.width));
+	else
+		bw = min(bw, ieee80211_chan_width_to_rx_bw(bss_width));
 
 	return bw;
 }
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 273/453] ASoC: wm_adsp: remove "ctl" from list on error in wm_adsp_create_control()
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (271 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.4 272/453] mac80211: dont set set TDLS STA bandwidth wider than possible Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.4 274/453] irqchip/alpine-msi: Fix freeing of interrupts on allocation error path Greg Kroah-Hartman
                   ` (182 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Charles Keepax,
	Mark Brown, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit 85a7555575a0e48f9b73db310d0d762a08a46d63 ]

The error handling frees "ctl" but it's still on the "dsp->ctl_list"
list so that could result in a use after free.  Remove it from the list
before returning.

Fixes: 2323736dca72 ("ASoC: wm_adsp: Add basic support for rev 1 firmware file format")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Link: https://lore.kernel.org/r/X9B0keV/02wrx9Xs@mwanda
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/codecs/wm_adsp.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/sound/soc/codecs/wm_adsp.c b/sound/soc/codecs/wm_adsp.c
index 4c56b782500db..13672928da997 100644
--- a/sound/soc/codecs/wm_adsp.c
+++ b/sound/soc/codecs/wm_adsp.c
@@ -1496,7 +1496,7 @@ static int wm_adsp_create_control(struct wm_adsp *dsp,
 	ctl_work = kzalloc(sizeof(*ctl_work), GFP_KERNEL);
 	if (!ctl_work) {
 		ret = -ENOMEM;
-		goto err_ctl_cache;
+		goto err_list_del;
 	}
 
 	ctl_work->dsp = dsp;
@@ -1506,7 +1506,8 @@ static int wm_adsp_create_control(struct wm_adsp *dsp,
 
 	return 0;
 
-err_ctl_cache:
+err_list_del:
+	list_del(&ctl->list);
 	kfree(ctl->cache);
 err_ctl_name:
 	kfree(ctl->name);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 274/453] irqchip/alpine-msi: Fix freeing of interrupts on allocation error path
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (272 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.4 273/453] ASoC: wm_adsp: remove "ctl" from list on error in wm_adsp_create_control() Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.4 275/453] watchdog: armada_37xx: Add missing dependency on HAS_IOMEM Greg Kroah-Hartman
                   ` (181 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Marc Zyngier, Antoine Tenart,
	Tsahee Zidenberg, Sasha Levin

From: Marc Zyngier <maz@kernel.org>

[ Upstream commit 3841245e8498a789c65dedd7ffa8fb2fee2c0684 ]

The alpine-msi driver has an interesting allocation error handling,
where it frees the same interrupts repeatedly. Hilarity follows.

This code is probably never executed, but let's fix it nonetheless.

Fixes: e6b78f2c3e14 ("irqchip: Add the Alpine MSIX interrupt controller")
Signed-off-by: Marc Zyngier <maz@kernel.org>
Reviewed-by: Antoine Tenart <atenart@kernel.org>
Cc: Tsahee Zidenberg <tsahee@annapurnalabs.com>
Cc: Antoine Tenart <atenart@kernel.org>
Link: https://lore.kernel.org/r/20201129135525.396671-1-maz@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/irqchip/irq-alpine-msi.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/irqchip/irq-alpine-msi.c b/drivers/irqchip/irq-alpine-msi.c
index 23a3b877f7f1d..ede02dc2bcd0b 100644
--- a/drivers/irqchip/irq-alpine-msi.c
+++ b/drivers/irqchip/irq-alpine-msi.c
@@ -165,8 +165,7 @@ static int alpine_msix_middle_domain_alloc(struct irq_domain *domain,
 	return 0;
 
 err_sgi:
-	while (--i >= 0)
-		irq_domain_free_irqs_parent(domain, virq, i);
+	irq_domain_free_irqs_parent(domain, virq, i - 1);
 	alpine_msix_free_sgi(priv, sgi, nr_irqs);
 	return err;
 }
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 275/453] watchdog: armada_37xx: Add missing dependency on HAS_IOMEM
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (273 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.4 274/453] irqchip/alpine-msi: Fix freeing of interrupts on allocation error path Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.4 276/453] watchdog: sirfsoc: " Greg Kroah-Hartman
                   ` (180 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Necip Fazil Yildiran, Guenter Roeck,
	Wim Van Sebroeck, Sasha Levin

From: Guenter Roeck <linux@roeck-us.net>

[ Upstream commit 7f6f1dfb2dcbe5d2bfa213f2df5d74c147cd5954 ]

The following kbuild warning is seen on a system without HAS_IOMEM.

WARNING: unmet direct dependencies detected for MFD_SYSCON
  Depends on [n]: HAS_IOMEM [=n]
  Selected by [y]:
  - ARMADA_37XX_WATCHDOG [=y] && WATCHDOG [=y] && (ARCH_MVEBU || COMPILE_TEST

This results in a subsequent compile error.

drivers/watchdog/armada_37xx_wdt.o: in function `armada_37xx_wdt_probe':
armada_37xx_wdt.c:(.text+0xdc): undefined reference to `devm_ioremap'

Add the missing dependency.

Reported-by: Necip Fazil Yildiran <fazilyildiran@gmail.com>
Fixes: 54e3d9b518c8 ("watchdog: Add support for Armada 37xx CPU watchdog")
Link: https://lore.kernel.org/r/20201108162550.27660-1-linux@roeck-us.net
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/watchdog/Kconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/watchdog/Kconfig b/drivers/watchdog/Kconfig
index e2745f6861960..fce2f5e3ac51d 100644
--- a/drivers/watchdog/Kconfig
+++ b/drivers/watchdog/Kconfig
@@ -374,6 +374,7 @@ config ARM_SBSA_WATCHDOG
 config ARMADA_37XX_WATCHDOG
 	tristate "Armada 37xx watchdog"
 	depends on ARCH_MVEBU || COMPILE_TEST
+	depends on HAS_IOMEM
 	select MFD_SYSCON
 	select WATCHDOG_CORE
 	help
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 276/453] watchdog: sirfsoc: Add missing dependency on HAS_IOMEM
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (274 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.4 275/453] watchdog: armada_37xx: Add missing dependency on HAS_IOMEM Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.4 277/453] watchdog: sprd: remove watchdog disable from resume fail path Greg Kroah-Hartman
                   ` (179 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Necip Fazil Yildiran, Guenter Roeck,
	Wim Van Sebroeck, Sasha Levin

From: Guenter Roeck <linux@roeck-us.net>

[ Upstream commit 8ae2511112d2e18bc7d324b77f965d34083a25a2 ]

If HAS_IOMEM is not defined and SIRFSOC_WATCHDOG is enabled,
the build fails with the following error.

drivers/watchdog/sirfsoc_wdt.o: in function `sirfsoc_wdt_probe':
sirfsoc_wdt.c:(.text+0x112):
	undefined reference to `devm_platform_ioremap_resource'

Reported-by: Necip Fazil Yildiran <fazilyildiran@gmail.com>
Fixes: da2a68b3eb47 ("watchdog: Enable COMPILE_TEST where possible")
Link: https://lore.kernel.org/r/20201108162550.27660-2-linux@roeck-us.net
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/watchdog/Kconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/watchdog/Kconfig b/drivers/watchdog/Kconfig
index fce2f5e3ac51d..6cdffbdaf98a5 100644
--- a/drivers/watchdog/Kconfig
+++ b/drivers/watchdog/Kconfig
@@ -775,6 +775,7 @@ config MOXART_WDT
 
 config SIRFSOC_WATCHDOG
 	tristate "SiRFSOC watchdog"
+	depends on HAS_IOMEM
 	depends on ARCH_SIRF || COMPILE_TEST
 	select WATCHDOG_CORE
 	default y
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 277/453] watchdog: sprd: remove watchdog disable from resume fail path
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (275 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.4 276/453] watchdog: sirfsoc: " Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.4 278/453] watchdog: sprd: check busy bit before new loading rather than after that Greg Kroah-Hartman
                   ` (178 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lingling Xu, Chunyan Zhang,
	Guenter Roeck, Wim Van Sebroeck, Sasha Levin

From: Lingling Xu <ling_ling.xu@unisoc.com>

[ Upstream commit f61a59acb462840bebcc192f754fe71b6a16ff99 ]

sprd_wdt_start() would return fail if the loading operation is not completed
in a certain time, disabling watchdog for that case would probably cause
the kernel crash when kick watchdog later, that's too bad, so remove the
watchdog disable operation for the fail case to make sure other parts in
the kernel can run normally.

[ chunyan: Massaged changelog ]

Fixes: 477603467009 ("watchdog: Add Spreadtrum watchdog driver")
Signed-off-by: Lingling Xu <ling_ling.xu@unisoc.com>
Signed-off-by: Chunyan Zhang <chunyan.zhang@unisoc.com>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Link: https://lore.kernel.org/r/20201029023933.24548-2-zhang.lyra@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/watchdog/sprd_wdt.c | 9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

diff --git a/drivers/watchdog/sprd_wdt.c b/drivers/watchdog/sprd_wdt.c
index 65cb55f3916fc..f3c90b4afead1 100644
--- a/drivers/watchdog/sprd_wdt.c
+++ b/drivers/watchdog/sprd_wdt.c
@@ -345,15 +345,10 @@ static int __maybe_unused sprd_wdt_pm_resume(struct device *dev)
 	if (ret)
 		return ret;
 
-	if (watchdog_active(&wdt->wdd)) {
+	if (watchdog_active(&wdt->wdd))
 		ret = sprd_wdt_start(&wdt->wdd);
-		if (ret) {
-			sprd_wdt_disable(wdt);
-			return ret;
-		}
-	}
 
-	return 0;
+	return ret;
 }
 
 static const struct dev_pm_ops sprd_wdt_pm_ops = {
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 278/453] watchdog: sprd: check busy bit before new loading rather than after that
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (276 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.4 277/453] watchdog: sprd: remove watchdog disable from resume fail path Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.4 279/453] watchdog: Fix potential dereferencing of null pointer Greg Kroah-Hartman
                   ` (177 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lingling Xu, Chunyan Zhang,
	Guenter Roeck, Wim Van Sebroeck, Sasha Levin

From: Lingling Xu <ling_ling.xu@unisoc.com>

[ Upstream commit 3e07d240939803bed9feb2a353d94686a411a7ca ]

As the specification described, users must check busy bit before start
a new loading operation to make sure that the previous loading is done
and the device is ready to accept a new one.

[ chunyan: Massaged changelog ]

Fixes: 477603467009 ("watchdog: Add Spreadtrum watchdog driver")
Signed-off-by: Lingling Xu <ling_ling.xu@unisoc.com>
Signed-off-by: Chunyan Zhang <chunyan.zhang@unisoc.com>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Link: https://lore.kernel.org/r/20201029023933.24548-3-zhang.lyra@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/watchdog/sprd_wdt.c | 25 +++++++++++++------------
 1 file changed, 13 insertions(+), 12 deletions(-)

diff --git a/drivers/watchdog/sprd_wdt.c b/drivers/watchdog/sprd_wdt.c
index f3c90b4afead1..b9b1daa9e2a4c 100644
--- a/drivers/watchdog/sprd_wdt.c
+++ b/drivers/watchdog/sprd_wdt.c
@@ -108,18 +108,6 @@ static int sprd_wdt_load_value(struct sprd_wdt *wdt, u32 timeout,
 	u32 tmr_step = timeout * SPRD_WDT_CNT_STEP;
 	u32 prtmr_step = pretimeout * SPRD_WDT_CNT_STEP;
 
-	sprd_wdt_unlock(wdt->base);
-	writel_relaxed((tmr_step >> SPRD_WDT_CNT_HIGH_SHIFT) &
-		      SPRD_WDT_LOW_VALUE_MASK, wdt->base + SPRD_WDT_LOAD_HIGH);
-	writel_relaxed((tmr_step & SPRD_WDT_LOW_VALUE_MASK),
-		       wdt->base + SPRD_WDT_LOAD_LOW);
-	writel_relaxed((prtmr_step >> SPRD_WDT_CNT_HIGH_SHIFT) &
-			SPRD_WDT_LOW_VALUE_MASK,
-		       wdt->base + SPRD_WDT_IRQ_LOAD_HIGH);
-	writel_relaxed(prtmr_step & SPRD_WDT_LOW_VALUE_MASK,
-		       wdt->base + SPRD_WDT_IRQ_LOAD_LOW);
-	sprd_wdt_lock(wdt->base);
-
 	/*
 	 * Waiting the load value operation done,
 	 * it needs two or three RTC clock cycles.
@@ -134,6 +122,19 @@ static int sprd_wdt_load_value(struct sprd_wdt *wdt, u32 timeout,
 
 	if (delay_cnt >= SPRD_WDT_LOAD_TIMEOUT)
 		return -EBUSY;
+
+	sprd_wdt_unlock(wdt->base);
+	writel_relaxed((tmr_step >> SPRD_WDT_CNT_HIGH_SHIFT) &
+		      SPRD_WDT_LOW_VALUE_MASK, wdt->base + SPRD_WDT_LOAD_HIGH);
+	writel_relaxed((tmr_step & SPRD_WDT_LOW_VALUE_MASK),
+		       wdt->base + SPRD_WDT_LOAD_LOW);
+	writel_relaxed((prtmr_step >> SPRD_WDT_CNT_HIGH_SHIFT) &
+			SPRD_WDT_LOW_VALUE_MASK,
+		       wdt->base + SPRD_WDT_IRQ_LOAD_HIGH);
+	writel_relaxed(prtmr_step & SPRD_WDT_LOW_VALUE_MASK,
+		       wdt->base + SPRD_WDT_IRQ_LOAD_LOW);
+	sprd_wdt_lock(wdt->base);
+
 	return 0;
 }
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 279/453] watchdog: Fix potential dereferencing of null pointer
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (277 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.4 278/453] watchdog: sprd: check busy bit before new loading rather than after that Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.4 280/453] ubifs: Fix error return code in ubifs_init_authentication() Greg Kroah-Hartman
                   ` (176 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Wang Wensheng, Guenter Roeck,
	Wim Van Sebroeck, Sasha Levin

From: Wang Wensheng <wangwensheng4@huawei.com>

[ Upstream commit 6f733cb2e7db38f8141b14740bcde577844a03b7 ]

A reboot notifier, which stops the WDT by calling the stop hook without
any check, would be registered when we set WDOG_STOP_ON_REBOOT flag.

Howerer we allow the WDT driver to omit the stop hook since commit
"d0684c8a93549" ("watchdog: Make stop function optional") and provide
a module parameter for user that controls the WDOG_STOP_ON_REBOOT flag
in commit 9232c80659e94 ("watchdog: Add stop_on_reboot parameter to
control reboot policy"). Together that commits make user potential to
insert a watchdog driver that don't provide a stop hook but with the
stop_on_reboot parameter set, then dereferencing of null pointer occurs
on system reboot.

Check the stop hook before registering the reboot notifier to fix the
issue.

Fixes: d0684c8a9354 ("watchdog: Make stop function optional")
Signed-off-by: Wang Wensheng <wangwensheng4@huawei.com>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Link: https://lore.kernel.org/r/20201109130512.28121-1-wangwensheng4@huawei.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/watchdog/watchdog_core.c | 22 +++++++++++++---------
 1 file changed, 13 insertions(+), 9 deletions(-)

diff --git a/drivers/watchdog/watchdog_core.c b/drivers/watchdog/watchdog_core.c
index 861daf4f37b28..faa46a666f4c5 100644
--- a/drivers/watchdog/watchdog_core.c
+++ b/drivers/watchdog/watchdog_core.c
@@ -255,15 +255,19 @@ static int __watchdog_register_device(struct watchdog_device *wdd)
 	}
 
 	if (test_bit(WDOG_STOP_ON_REBOOT, &wdd->status)) {
-		wdd->reboot_nb.notifier_call = watchdog_reboot_notifier;
-
-		ret = register_reboot_notifier(&wdd->reboot_nb);
-		if (ret) {
-			pr_err("watchdog%d: Cannot register reboot notifier (%d)\n",
-			       wdd->id, ret);
-			watchdog_dev_unregister(wdd);
-			ida_simple_remove(&watchdog_ida, id);
-			return ret;
+		if (!wdd->ops->stop)
+			pr_warn("watchdog%d: stop_on_reboot not supported\n", wdd->id);
+		else {
+			wdd->reboot_nb.notifier_call = watchdog_reboot_notifier;
+
+			ret = register_reboot_notifier(&wdd->reboot_nb);
+			if (ret) {
+				pr_err("watchdog%d: Cannot register reboot notifier (%d)\n",
+					wdd->id, ret);
+				watchdog_dev_unregister(wdd);
+				ida_simple_remove(&watchdog_ida, id);
+				return ret;
+			}
 		}
 	}
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 280/453] ubifs: Fix error return code in ubifs_init_authentication()
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (278 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.4 279/453] watchdog: Fix potential dereferencing of null pointer Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.4 281/453] um: Monitor error events in IRQ controller Greg Kroah-Hartman
                   ` (175 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Wang ShaoBo, Sascha Hauer,
	Richard Weinberger, Sasha Levin

From: Wang ShaoBo <bobo.shaobowang@huawei.com>

[ Upstream commit 3cded66330591cfd2554a3fd5edca8859ea365a2 ]

Fix to return PTR_ERR() error code from the error handling case where
ubifs_hash_get_desc() failed instead of 0 in ubifs_init_authentication(),
as done elsewhere in this function.

Fixes: 49525e5eecca5 ("ubifs: Add helper functions for authentication support")
Signed-off-by: Wang ShaoBo <bobo.shaobowang@huawei.com>
Reviewed-by: Sascha Hauer <s.hauer@pengutronix.de>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ubifs/auth.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/fs/ubifs/auth.c b/fs/ubifs/auth.c
index f985a3fbbb36a..b10418b5fb719 100644
--- a/fs/ubifs/auth.c
+++ b/fs/ubifs/auth.c
@@ -352,8 +352,10 @@ int ubifs_init_authentication(struct ubifs_info *c)
 	c->authenticated = true;
 
 	c->log_hash = ubifs_hash_get_desc(c);
-	if (IS_ERR(c->log_hash))
+	if (IS_ERR(c->log_hash)) {
+		err = PTR_ERR(c->log_hash);
 		goto out_free_hmac;
+	}
 
 	err = 0;
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 281/453] um: Monitor error events in IRQ controller
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (279 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.4 280/453] ubifs: Fix error return code in ubifs_init_authentication() Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.4 282/453] um: tty: Fix handling of close in tty lines Greg Kroah-Hartman
                   ` (174 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Anton Ivanov, Richard Weinberger,
	Sasha Levin

From: Anton Ivanov <anton.ivanov@cambridgegreys.com>

[ Upstream commit e3a01cbee9c5f2c6fc813dd6af007716e60257e7 ]

Ensure that file closes, connection closes, etc are propagated
as interrupts in the interrupt controller.

Fixes: ff6a17989c08 ("Epoll based IRQ controller")
Signed-off-by: Anton Ivanov <anton.ivanov@cambridgegreys.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/um/os-Linux/irq.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/um/os-Linux/irq.c b/arch/um/os-Linux/irq.c
index d508310ee5e1e..f1732c308c615 100644
--- a/arch/um/os-Linux/irq.c
+++ b/arch/um/os-Linux/irq.c
@@ -48,7 +48,7 @@ int os_epoll_triggered(int index, int events)
 int os_event_mask(int irq_type)
 {
 	if (irq_type == IRQ_READ)
-		return EPOLLIN | EPOLLPRI;
+		return EPOLLIN | EPOLLPRI | EPOLLERR | EPOLLHUP | EPOLLRDHUP;
 	if (irq_type == IRQ_WRITE)
 		return EPOLLOUT;
 	return 0;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 282/453] um: tty: Fix handling of close in tty lines
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (280 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.4 281/453] um: Monitor error events in IRQ controller Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.4 283/453] um: chan_xterm: Fix fd leak Greg Kroah-Hartman
                   ` (173 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Anton Ivanov, Richard Weinberger,
	Sasha Levin

From: Anton Ivanov <anton.ivanov@cambridgegreys.com>

[ Upstream commit 9b1c0c0e25dcccafd30e7d4c150c249cc65550eb ]

Fix a logical error in tty reading. We get 0 and errno == EAGAIN
on the first attempt to read from a closed file descriptor.

Compared to that a true EAGAIN is EAGAIN and -1.

If we check errno for EAGAIN first, before checking the return
value we miss the fact that the descriptor is closed.

This bug is as old as the driver. It was not showing up with
the original POLL based IRQ controller, because it was
producing multiple events. Switching to EPOLL unmasked it.

Fixes: ff6a17989c08 ("Epoll based IRQ controller")
Signed-off-by: Anton Ivanov <anton.ivanov@cambridgegreys.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/um/drivers/chan_user.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/um/drivers/chan_user.c b/arch/um/drivers/chan_user.c
index 4d80526a4236e..d8845d4aac6a7 100644
--- a/arch/um/drivers/chan_user.c
+++ b/arch/um/drivers/chan_user.c
@@ -26,10 +26,10 @@ int generic_read(int fd, char *c_out, void *unused)
 	n = read(fd, c_out, sizeof(*c_out));
 	if (n > 0)
 		return n;
-	else if (errno == EAGAIN)
-		return 0;
 	else if (n == 0)
 		return -EIO;
+	else if (errno == EAGAIN)
+		return 0;
 	return -errno;
 }
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 283/453] um: chan_xterm: Fix fd leak
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (281 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.4 282/453] um: tty: Fix handling of close in tty lines Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.4 284/453] sunrpc: fix xs_read_xdr_buf for partial pages receive Greg Kroah-Hartman
                   ` (172 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Anton Ivanov, Richard Weinberger,
	Sasha Levin

From: Anton Ivanov <anton.ivanov@cambridgegreys.com>

[ Upstream commit 9431f7c199ab0d02da1482d62255e0b4621cb1b5 ]

xterm serial channel was leaking a fd used in setting up the
port helper

This bug is prehistoric - it predates switching to git. The "fixes"
header here is really just to mark all the versions we would like this to
apply to which is "Anything from the Cretaceous period onwards".

No dinosaurs were harmed in fixing this bug.

Fixes: b40997b872cd ("um: drivers/xterm.c: fix a file descriptor leak")
Signed-off-by: Anton Ivanov <anton.ivanov@cambridgegreys.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/um/drivers/xterm.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/arch/um/drivers/xterm.c b/arch/um/drivers/xterm.c
index fc7f1e7467032..87ca4a47cd66e 100644
--- a/arch/um/drivers/xterm.c
+++ b/arch/um/drivers/xterm.c
@@ -18,6 +18,7 @@
 struct xterm_chan {
 	int pid;
 	int helper_pid;
+	int chan_fd;
 	char *title;
 	int device;
 	int raw;
@@ -33,6 +34,7 @@ static void *xterm_init(char *str, int device, const struct chan_opts *opts)
 		return NULL;
 	*data = ((struct xterm_chan) { .pid 		= -1,
 				       .helper_pid 	= -1,
+				       .chan_fd		= -1,
 				       .device 		= device,
 				       .title 		= opts->xterm_title,
 				       .raw  		= opts->raw } );
@@ -149,6 +151,7 @@ static int xterm_open(int input, int output, int primary, void *d,
 		goto out_kill;
 	}
 
+	data->chan_fd = fd;
 	new = xterm_fd(fd, &data->helper_pid);
 	if (new < 0) {
 		err = new;
@@ -206,6 +209,8 @@ static void xterm_close(int fd, void *d)
 		os_kill_process(data->helper_pid, 0);
 	data->helper_pid = -1;
 
+	if (data->chan_fd != -1)
+		os_close_file(data->chan_fd);
 	os_close_file(fd);
 }
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 284/453] sunrpc: fix xs_read_xdr_buf for partial pages receive
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (282 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.4 283/453] um: chan_xterm: Fix fd leak Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.4 285/453] RDMA/cma: Dont overwrite sgid_attr after device is released Greg Kroah-Hartman
                   ` (171 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Aloni, Trond Myklebust, Sasha Levin

From: Dan Aloni <dan@kernelim.com>

[ Upstream commit ac9645c87380e39a8fa87a1b51721efcdea89dbf ]

When receiving pages data, return value 'ret' when positive includes
`buf->page_base`, so we should subtract that before it is used for
changing `offset` and comparing against `want`.

This was discovered on the very rare cases where the server returned a
chunk of bytes that when added to the already received amount of bytes
for the pages happened to match the current `recv.len`, for example
on this case:

     buf->page_base : 258356
     actually received from socket: 1740
     ret : 260096
     want : 260096

In this case neither of the two 'if ... goto out' trigger, and we
continue to tail parsing.

Worth to mention that the ensuing EMSGSIZE from the continued execution of
`xs_read_xdr_buf` may be observed by an application due to 4 superfluous
bytes being added to the pages data.

Fixes: 277e4ab7d530 ("SUNRPC: Simplify TCP receive code by switching to using iterators")
Signed-off-by: Dan Aloni <dan@kernelim.com>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/sunrpc/xprtsock.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index 449f193b5a886..8ffc54b6661f8 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -432,7 +432,8 @@ xs_read_xdr_buf(struct socket *sock, struct msghdr *msg, int flags,
 		if (ret <= 0)
 			goto sock_err;
 		xs_flush_bvec(buf->bvec, ret, seek + buf->page_base);
-		offset += ret - buf->page_base;
+		ret -= buf->page_base;
+		offset += ret;
 		if (offset == count || msg->msg_flags & (MSG_EOR|MSG_TRUNC))
 			goto out;
 		if (ret != want)
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 285/453] RDMA/cma: Dont overwrite sgid_attr after device is released
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (283 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.4 284/453] sunrpc: fix xs_read_xdr_buf for partial pages receive Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.4 286/453] nfc: s3fwrn5: Release the nfc firmware Greg Kroah-Hartman
                   ` (170 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Leon Romanovsky, Jason Gunthorpe,
	Sasha Levin

From: Leon Romanovsky <leonro@nvidia.com>

[ Upstream commit e246b7c035d74abfb3507fa10082d0c42cc016c3 ]

As part of the cma_dev release, that pointer will be set to NULL.  In case
it happens in rdma_bind_addr() (part of an error flow), the next call to
addr_handler() will have a call to cma_acquire_dev_by_src_ip() which will
overwrite sgid_attr without releasing it.

  WARNING: CPU: 2 PID: 108 at drivers/infiniband/core/cma.c:606 cma_bind_sgid_attr drivers/infiniband/core/cma.c:606 [inline]
  WARNING: CPU: 2 PID: 108 at drivers/infiniband/core/cma.c:606 cma_acquire_dev_by_src_ip+0x470/0x4b0 drivers/infiniband/core/cma.c:649
  CPU: 2 PID: 108 Comm: kworker/u8:1 Not tainted 5.10.0-rc6+ #257
  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
  Workqueue: ib_addr process_one_req
  RIP: 0010:cma_bind_sgid_attr drivers/infiniband/core/cma.c:606 [inline]
  RIP: 0010:cma_acquire_dev_by_src_ip+0x470/0x4b0 drivers/infiniband/core/cma.c:649
  Code: 66 d9 4a ff 4d 8b 6e 10 49 8d bd 1c 08 00 00 e8 b6 d6 4a ff 45 0f b6 bd 1c 08 00 00 41 83 e7 01 e9 49 fd ff ff e8 90 c5 29 ff <0f> 0b e9 80 fe ff ff e8 84 c5 29 ff 4c 89 f7 e8 2c d9 4a ff 4d 8b
  RSP: 0018:ffff8881047c7b40 EFLAGS: 00010293
  RAX: ffff888104789c80 RBX: 0000000000000001 RCX: ffffffff820b8ef8
  RDX: 0000000000000000 RSI: ffffffff820b9080 RDI: ffff88810cd4c998
  RBP: ffff8881047c7c08 R08: ffff888104789c80 R09: ffffed10209f4036
  R10: ffff888104fa01ab R11: ffffed10209f4035 R12: ffff88810cd4c800
  R13: ffff888105750e28 R14: ffff888108f0a100 R15: ffff88810cd4c998
  FS:  0000000000000000(0000) GS:ffff888119c00000(0000) knlGS:0000000000000000
  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  CR2: 0000000000000000 CR3: 0000000104e60005 CR4: 0000000000370ea0
  DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
  DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
  Call Trace:
   addr_handler+0x266/0x350 drivers/infiniband/core/cma.c:3190
   process_one_req+0xa3/0x300 drivers/infiniband/core/addr.c:645
   process_one_work+0x54c/0x930 kernel/workqueue.c:2272
   worker_thread+0x82/0x830 kernel/workqueue.c:2418
   kthread+0x1ca/0x220 kernel/kthread.c:292
   ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296

Fixes: ff11c6cd521f ("RDMA/cma: Introduce and use cma_acquire_dev_by_src_ip()")
Link: https://lore.kernel.org/r/20201213132940.345554-5-leon@kernel.org
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/core/cma.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index 98d2d74b96f78..ecac62a7b59e8 100644
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -530,6 +530,10 @@ static void cma_release_dev(struct rdma_id_private *id_priv)
 	list_del(&id_priv->list);
 	cma_deref_dev(id_priv->cma_dev);
 	id_priv->cma_dev = NULL;
+	if (id_priv->id.route.addr.dev_addr.sgid_attr) {
+		rdma_put_gid_attr(id_priv->id.route.addr.dev_addr.sgid_attr);
+		id_priv->id.route.addr.dev_addr.sgid_attr = NULL;
+	}
 	mutex_unlock(&lock);
 }
 
@@ -1879,9 +1883,6 @@ void rdma_destroy_id(struct rdma_cm_id *id)
 
 	kfree(id_priv->id.route.path_rec);
 
-	if (id_priv->id.route.addr.dev_addr.sgid_attr)
-		rdma_put_gid_attr(id_priv->id.route.addr.dev_addr.sgid_attr);
-
 	put_net(id_priv->id.route.addr.dev_addr.net);
 	kfree(id_priv);
 }
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 286/453] nfc: s3fwrn5: Release the nfc firmware
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (284 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.4 285/453] RDMA/cma: Dont overwrite sgid_attr after device is released Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.4 287/453] powerpc/ps3: use dma_mapping_error() Greg Kroah-Hartman
                   ` (169 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Bongsu Jeon, Krzysztof Kozlowski,
	Jakub Kicinski, Sasha Levin

From: Bongsu Jeon <bongsu.jeon@samsung.com>

[ Upstream commit a4485baefa1efa596702ebffd5a9c760d42b14b5 ]

add the code to release the nfc firmware when the firmware image size is
wrong.

Fixes: c04c674fadeb ("nfc: s3fwrn5: Add driver for Samsung S3FWRN5 NFC Chip")
Signed-off-by: Bongsu Jeon <bongsu.jeon@samsung.com>
Reviewed-by: Krzysztof Kozlowski <krzk@kernel.org>
Link: https://lore.kernel.org/r/20201213095850.28169-1-bongsu.jeon@samsung.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nfc/s3fwrn5/firmware.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/nfc/s3fwrn5/firmware.c b/drivers/nfc/s3fwrn5/firmware.c
index be110d9cef022..310773a4ca66e 100644
--- a/drivers/nfc/s3fwrn5/firmware.c
+++ b/drivers/nfc/s3fwrn5/firmware.c
@@ -293,8 +293,10 @@ static int s3fwrn5_fw_request_firmware(struct s3fwrn5_fw_info *fw_info)
 	if (ret < 0)
 		return ret;
 
-	if (fw->fw->size < S3FWRN5_FW_IMAGE_HEADER_SIZE)
+	if (fw->fw->size < S3FWRN5_FW_IMAGE_HEADER_SIZE) {
+		release_firmware(fw->fw);
 		return -EINVAL;
+	}
 
 	memcpy(fw->date, fw->fw->data + 0x00, 12);
 	fw->date[12] = '\0';
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 287/453] powerpc/ps3: use dma_mapping_error()
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (285 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.4 286/453] nfc: s3fwrn5: Release the nfc firmware Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.4 288/453] sparc: fix handling of page table constructor failure Greg Kroah-Hartman
                   ` (168 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Vincent Stehlé,
	Geert Uytterhoeven, Michael Ellerman, Sasha Levin

From: Vincent Stehlé <vincent.stehle@laposte.net>

[ Upstream commit d0edaa28a1f7830997131cbce87b6c52472825d1 ]

The DMA address returned by dma_map_single() should be checked with
dma_mapping_error(). Fix the ps3stor_setup() function accordingly.

Fixes: 80071802cb9c ("[POWERPC] PS3: Storage Driver Core")
Signed-off-by: Vincent Stehlé <vincent.stehle@laposte.net>
Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20201213182622.23047-1-vincent.stehle@laposte.net
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/ps3/ps3stor_lib.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/ps3/ps3stor_lib.c b/drivers/ps3/ps3stor_lib.c
index 333ba83006e48..a12a1ad9b5fe3 100644
--- a/drivers/ps3/ps3stor_lib.c
+++ b/drivers/ps3/ps3stor_lib.c
@@ -189,7 +189,7 @@ int ps3stor_setup(struct ps3_storage_device *dev, irq_handler_t handler)
 	dev->bounce_lpar = ps3_mm_phys_to_lpar(__pa(dev->bounce_buf));
 	dev->bounce_dma = dma_map_single(&dev->sbd.core, dev->bounce_buf,
 					 dev->bounce_size, DMA_BIDIRECTIONAL);
-	if (!dev->bounce_dma) {
+	if (dma_mapping_error(&dev->sbd.core, dev->bounce_dma)) {
 		dev_err(&dev->sbd.core, "%s:%u: map DMA region failed\n",
 			__func__, __LINE__);
 		error = -ENODEV;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 288/453] sparc: fix handling of page table constructor failure
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (286 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.4 287/453] powerpc/ps3: use dma_mapping_error() Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.4 289/453] mm: dont wake kswapd prematurely when watermark boosting is disabled Greg Kroah-Hartman
                   ` (167 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Matthew Wilcox (Oracle),
	David Hildenbrand, Mike Rapoport, Vlastimil Babka, David Miller,
	Andrew Morton, Linus Torvalds, Sasha Levin

From: Matthew Wilcox (Oracle) <willy@infradead.org>

[ Upstream commit 06517c9a336f4c20f2064611bf4b1e7881a95fe1 ]

The page has just been allocated, so its refcount is 1.  free_unref_page()
is for use on pages which have a zero refcount.  Use __free_page() like
the other implementations of pte_alloc_one().

Link: https://lkml.kernel.org/r/20201125034655.27687-1-willy@infradead.org
Fixes: 1ae9ae5f7df7 ("sparc: handle pgtable_page_ctor() fail")
Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
Reviewed-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Mike Rapoport <rppt@linux.ibm.com>
Acked-by: Vlastimil Babka <vbabka@suse.cz>
Cc: David Miller <davem@davemloft.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/sparc/mm/init_64.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/sparc/mm/init_64.c b/arch/sparc/mm/init_64.c
index e6d91819da921..28b9ffd85db0b 100644
--- a/arch/sparc/mm/init_64.c
+++ b/arch/sparc/mm/init_64.c
@@ -2904,7 +2904,7 @@ pgtable_t pte_alloc_one(struct mm_struct *mm)
 	if (!page)
 		return NULL;
 	if (!pgtable_pte_page_ctor(page)) {
-		free_unref_page(page);
+		__free_page(page);
 		return NULL;
 	}
 	return (pte_t *) page_address(page);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 289/453] mm: dont wake kswapd prematurely when watermark boosting is disabled
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (287 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.4 288/453] sparc: fix handling of page table constructor failure Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.4 290/453] checkpatch: fix unescaped left brace Greg Kroah-Hartman
                   ` (166 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Johannes Weiner, Mel Gorman,
	Andrew Morton, Linus Torvalds, Sasha Levin

From: Johannes Weiner <hannes@cmpxchg.org>

[ Upstream commit 597c892038e08098b17ccfe65afd9677e6979800 ]

On 2-node NUMA hosts we see bursts of kswapd reclaim and subsequent
pressure spikes and stalls from cache refaults while there is plenty of
free memory in the system.

Usually, kswapd is woken up when all eligible nodes in an allocation are
full.  But the code related to watermark boosting can wake kswapd on one
full node while the other one is mostly empty.  This may be justified to
fight fragmentation, but is currently unconditionally done whether
watermark boosting is occurring or not.

In our case, many of our workloads' throughput scales with available
memory, and pure utilization is a more tangible concern than trends
around longer-term fragmentation.  As a result we generally disable
watermark boosting.

Wake kswapd only woken when watermark boosting is requested.

Link: https://lkml.kernel.org/r/20201020175833.397286-1-hannes@cmpxchg.org
Fixes: 1c30844d2dfe ("mm: reclaim small amounts of memory when an external fragmentation event occurs")
Signed-off-by: Johannes Weiner <hannes@cmpxchg.org>
Acked-by: Mel Gorman <mgorman@suse.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 mm/page_alloc.c | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 1c869c6b825f3..4357f5475a504 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -2346,12 +2346,12 @@ static bool can_steal_fallback(unsigned int order, int start_mt)
 	return false;
 }
 
-static inline void boost_watermark(struct zone *zone)
+static inline bool boost_watermark(struct zone *zone)
 {
 	unsigned long max_boost;
 
 	if (!watermark_boost_factor)
-		return;
+		return false;
 	/*
 	 * Don't bother in zones that are unlikely to produce results.
 	 * On small machines, including kdump capture kernels running
@@ -2359,7 +2359,7 @@ static inline void boost_watermark(struct zone *zone)
 	 * memory situation immediately.
 	 */
 	if ((pageblock_nr_pages * 4) > zone_managed_pages(zone))
-		return;
+		return false;
 
 	max_boost = mult_frac(zone->_watermark[WMARK_HIGH],
 			watermark_boost_factor, 10000);
@@ -2373,12 +2373,14 @@ static inline void boost_watermark(struct zone *zone)
 	 * boosted watermark resulting in a hang.
 	 */
 	if (!max_boost)
-		return;
+		return false;
 
 	max_boost = max(pageblock_nr_pages, max_boost);
 
 	zone->watermark_boost = min(zone->watermark_boost + pageblock_nr_pages,
 		max_boost);
+
+	return true;
 }
 
 /*
@@ -2417,8 +2419,7 @@ static void steal_suitable_fallback(struct zone *zone, struct page *page,
 	 * likelihood of future fallbacks. Wake kswapd now as the node
 	 * may be balanced overall and kswapd will not wake naturally.
 	 */
-	boost_watermark(zone);
-	if (alloc_flags & ALLOC_KSWAPD)
+	if (boost_watermark(zone) && (alloc_flags & ALLOC_KSWAPD))
 		set_bit(ZONE_BOOSTED_WATERMARK, &zone->flags);
 
 	/* We are not allowed to try stealing from the whole block */
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 290/453] checkpatch: fix unescaped left brace
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (288 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.4 289/453] mm: dont wake kswapd prematurely when watermark boosting is disabled Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.4 291/453] lan743x: fix rx_napi_poll/interrupt ping-pong Greg Kroah-Hartman
                   ` (165 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dwaipayan Ray, Joe Perches,
	Andrew Morton, Linus Torvalds, Sasha Levin

From: Dwaipayan Ray <dwaipayanray1@gmail.com>

[ Upstream commit 03f4935135b9efeb780b970ba023c201f81cf4e6 ]

There is an unescaped left brace in a regex in OPEN_BRACE check.  This
throws a runtime error when checkpatch is run with --fix flag and the
OPEN_BRACE check is executed.

Fix it by escaping the left brace.

Link: https://lkml.kernel.org/r/20201115202928.81955-1-dwaipayanray1@gmail.com
Fixes: 8d1824780f2f ("checkpatch: add --fix option for a couple OPEN_BRACE misuses")
Signed-off-by: Dwaipayan Ray <dwaipayanray1@gmail.com>
Acked-by: Joe Perches <joe@perches.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 scripts/checkpatch.pl | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl
index 0c9b114202796..a358af93cd7fc 100755
--- a/scripts/checkpatch.pl
+++ b/scripts/checkpatch.pl
@@ -4150,7 +4150,7 @@ sub process {
 			    $fix) {
 				fix_delete_line($fixlinenr, $rawline);
 				my $fixed_line = $rawline;
-				$fixed_line =~ /(^..*$Type\s*$Ident\(.*\)\s*){(.*)$/;
+				$fixed_line =~ /(^..*$Type\s*$Ident\(.*\)\s*)\{(.*)$/;
 				my $line1 = $1;
 				my $line2 = $2;
 				fix_insert_line($fixlinenr, ltrim($line1));
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 291/453] lan743x: fix rx_napi_poll/interrupt ping-pong
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (289 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.4 290/453] checkpatch: fix unescaped left brace Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.4 292/453] net: bcmgenet: Fix a resource leak in an error handling path in the probe functin Greg Kroah-Hartman
                   ` (164 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sven Van Asbroeck, Jakub Kicinski,
	Sasha Levin

From: Sven Van Asbroeck <thesven73@gmail.com>

[ Upstream commit 57030a0b620f735bf557696e5ceb9f32c2b3bb8f ]

Even if there is more rx data waiting on the chip, the rx napi poll fn
will never run more than once - it will always read a few buffers, then
bail out and re-arm interrupts. Which results in ping-pong between napi
and interrupt.

This defeats the purpose of napi, and is bad for performance.

Fix by making the rx napi poll behave identically to other ethernet
drivers:
1. initialize rx napi polling with an arbitrary budget (64).
2. in the polling fn, return full weight if rx queue is not depleted,
   this tells the napi core to "keep polling".
3. update the rx tail ("ring the doorbell") once for every 8 processed
   rx ring buffers.

Thanks to Jakub Kicinski, Eric Dumazet and Andrew Lunn for their expert
opinions and suggestions.

Tested with 20 seconds of full bandwidth receive (iperf3):
        rx irqs      softirqs(NET_RX)
        -----------------------------
before  23827        33620
after   129          4081

Tested-by: Sven Van Asbroeck <thesven73@gmail.com> # lan7430
Fixes: 23f0703c125be ("lan743x: Add main source files for new lan743x driver")
Signed-off-by: Sven Van Asbroeck <thesven73@gmail.com>
Link: https://lore.kernel.org/r/20201215161954.5950-1-TheSven73@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/microchip/lan743x_main.c | 43 ++++++++++---------
 1 file changed, 23 insertions(+), 20 deletions(-)

diff --git a/drivers/net/ethernet/microchip/lan743x_main.c b/drivers/net/ethernet/microchip/lan743x_main.c
index 7526af27a59da..4bbdc53eaf3f3 100644
--- a/drivers/net/ethernet/microchip/lan743x_main.c
+++ b/drivers/net/ethernet/microchip/lan743x_main.c
@@ -1899,6 +1899,14 @@ static struct sk_buff *lan743x_rx_allocate_skb(struct lan743x_rx *rx)
 				  length, GFP_ATOMIC | GFP_DMA);
 }
 
+static void lan743x_rx_update_tail(struct lan743x_rx *rx, int index)
+{
+	/* update the tail once per 8 descriptors */
+	if ((index & 7) == 7)
+		lan743x_csr_write(rx->adapter, RX_TAIL(rx->channel_number),
+				  index);
+}
+
 static int lan743x_rx_init_ring_element(struct lan743x_rx *rx, int index,
 					struct sk_buff *skb)
 {
@@ -1929,6 +1937,7 @@ static int lan743x_rx_init_ring_element(struct lan743x_rx *rx, int index,
 	descriptor->data0 = (RX_DESC_DATA0_OWN_ |
 			    (length & RX_DESC_DATA0_BUF_LENGTH_MASK_));
 	skb_reserve(buffer_info->skb, RX_HEAD_PADDING);
+	lan743x_rx_update_tail(rx, index);
 
 	return 0;
 }
@@ -1947,6 +1956,7 @@ static void lan743x_rx_reuse_ring_element(struct lan743x_rx *rx, int index)
 	descriptor->data0 = (RX_DESC_DATA0_OWN_ |
 			    ((buffer_info->buffer_length) &
 			    RX_DESC_DATA0_BUF_LENGTH_MASK_));
+	lan743x_rx_update_tail(rx, index);
 }
 
 static void lan743x_rx_release_ring_element(struct lan743x_rx *rx, int index)
@@ -2158,6 +2168,7 @@ static int lan743x_rx_napi_poll(struct napi_struct *napi, int weight)
 {
 	struct lan743x_rx *rx = container_of(napi, struct lan743x_rx, napi);
 	struct lan743x_adapter *adapter = rx->adapter;
+	int result = RX_PROCESS_RESULT_NOTHING_TO_DO;
 	u32 rx_tail_flags = 0;
 	int count;
 
@@ -2166,27 +2177,19 @@ static int lan743x_rx_napi_poll(struct napi_struct *napi, int weight)
 		lan743x_csr_write(adapter, DMAC_INT_STS,
 				  DMAC_INT_BIT_RXFRM_(rx->channel_number));
 	}
-	count = 0;
-	while (count < weight) {
-		int rx_process_result = lan743x_rx_process_packet(rx);
-
-		if (rx_process_result == RX_PROCESS_RESULT_PACKET_RECEIVED) {
-			count++;
-		} else if (rx_process_result ==
-			RX_PROCESS_RESULT_NOTHING_TO_DO) {
+	for (count = 0; count < weight; count++) {
+		result = lan743x_rx_process_packet(rx);
+		if (result == RX_PROCESS_RESULT_NOTHING_TO_DO)
 			break;
-		} else if (rx_process_result ==
-			RX_PROCESS_RESULT_PACKET_DROPPED) {
-			continue;
-		}
 	}
 	rx->frame_count += count;
-	if (count == weight)
-		goto done;
+	if (count == weight || result == RX_PROCESS_RESULT_PACKET_RECEIVED)
+		return weight;
 
 	if (!napi_complete_done(napi, count))
-		goto done;
+		return count;
 
+	/* re-arm interrupts, must write to rx tail on some chip variants */
 	if (rx->vector_flags & LAN743X_VECTOR_FLAG_VECTOR_ENABLE_AUTO_SET)
 		rx_tail_flags |= RX_TAIL_SET_TOP_INT_VEC_EN_;
 	if (rx->vector_flags & LAN743X_VECTOR_FLAG_SOURCE_ENABLE_AUTO_SET) {
@@ -2196,10 +2199,10 @@ static int lan743x_rx_napi_poll(struct napi_struct *napi, int weight)
 				  INT_BIT_DMA_RX_(rx->channel_number));
 	}
 
-	/* update RX_TAIL */
-	lan743x_csr_write(adapter, RX_TAIL(rx->channel_number),
-			  rx_tail_flags | rx->last_tail);
-done:
+	if (rx_tail_flags)
+		lan743x_csr_write(adapter, RX_TAIL(rx->channel_number),
+				  rx_tail_flags | rx->last_tail);
+
 	return count;
 }
 
@@ -2344,7 +2347,7 @@ static int lan743x_rx_open(struct lan743x_rx *rx)
 
 	netif_napi_add(adapter->netdev,
 		       &rx->napi, lan743x_rx_napi_poll,
-		       rx->ring_size - 1);
+		       NAPI_POLL_WEIGHT);
 
 	lan743x_csr_write(adapter, DMAC_CMD,
 			  DMAC_CMD_RX_SWR_(rx->channel_number));
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 292/453] net: bcmgenet: Fix a resource leak in an error handling path in the probe functin
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (290 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.4 291/453] lan743x: fix rx_napi_poll/interrupt ping-pong Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.4 293/453] net: allwinner: Fix some resources leak in the error handling path of the probe and in the remove function Greg Kroah-Hartman
                   ` (163 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christophe JAILLET, Florian Fainelli,
	Jakub Kicinski, Sasha Levin

From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>

[ Upstream commit 4375ada01963d1ebf733d60d1bb6e5db401e1ac6 ]

If the 'register_netdev()' call fails, we must undo a previous
'bcmgenet_mii_init()' call.

Fixes: 1c1008c793fa ("net: bcmgenet: add main driver file")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Acked-by: Florian Fainelli <f.fainelli@gmail.com>
Link: https://lore.kernel.org/r/20201212182005.120437-1-christophe.jaillet@wanadoo.fr
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/broadcom/genet/bcmgenet.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
index 03f82786c0b98..b27da024aa9d9 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
@@ -3584,8 +3584,10 @@ static int bcmgenet_probe(struct platform_device *pdev)
 	clk_disable_unprepare(priv->clk);
 
 	err = register_netdev(dev);
-	if (err)
+	if (err) {
+		bcmgenet_mii_exit(dev);
 		goto err;
+	}
 
 	return err;
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 293/453] net: allwinner: Fix some resources leak in the error handling path of the probe and in the remove function
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (291 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.4 292/453] net: bcmgenet: Fix a resource leak in an error handling path in the probe functin Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.4 294/453] net: korina: fix return value Greg Kroah-Hartman
                   ` (162 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christophe JAILLET, Jakub Kicinski,
	Sasha Levin

From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>

[ Upstream commit 322e53d1e2529ae9d501f5e0f20604a79b873aef ]

'irq_of_parse_and_map()' should be balanced by a corresponding
'irq_dispose_mapping()' call. Otherwise, there is some resources leaks.

Add such a call in the error handling path of the probe function and in the
remove function.

Fixes: 492205050d77 ("net: Add EMAC ethernet driver found on Allwinner A10 SoC's")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Link: https://lore.kernel.org/r/20201214202117.146293-1-christophe.jaillet@wanadoo.fr
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/allwinner/sun4i-emac.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/allwinner/sun4i-emac.c b/drivers/net/ethernet/allwinner/sun4i-emac.c
index ff318472a3eef..95155a1f9f9dc 100644
--- a/drivers/net/ethernet/allwinner/sun4i-emac.c
+++ b/drivers/net/ethernet/allwinner/sun4i-emac.c
@@ -845,13 +845,13 @@ static int emac_probe(struct platform_device *pdev)
 	db->clk = devm_clk_get(&pdev->dev, NULL);
 	if (IS_ERR(db->clk)) {
 		ret = PTR_ERR(db->clk);
-		goto out_iounmap;
+		goto out_dispose_mapping;
 	}
 
 	ret = clk_prepare_enable(db->clk);
 	if (ret) {
 		dev_err(&pdev->dev, "Error couldn't enable clock (%d)\n", ret);
-		goto out_iounmap;
+		goto out_dispose_mapping;
 	}
 
 	ret = sunxi_sram_claim(&pdev->dev);
@@ -910,6 +910,8 @@ out_release_sram:
 	sunxi_sram_release(&pdev->dev);
 out_clk_disable_unprepare:
 	clk_disable_unprepare(db->clk);
+out_dispose_mapping:
+	irq_dispose_mapping(ndev->irq);
 out_iounmap:
 	iounmap(db->membase);
 out:
@@ -928,6 +930,7 @@ static int emac_remove(struct platform_device *pdev)
 	unregister_netdev(ndev);
 	sunxi_sram_release(&pdev->dev);
 	clk_disable_unprepare(db->clk);
+	irq_dispose_mapping(ndev->irq);
 	iounmap(db->membase);
 	free_netdev(ndev);
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 294/453] net: korina: fix return value
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (292 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.4 293/453] net: allwinner: Fix some resources leak in the error handling path of the probe and in the remove function Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.4 295/453] libnvdimm/label: Return -ENXIO for no slot in __blk_label_update Greg Kroah-Hartman
                   ` (161 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jakub Kicinski, Vincent Stehlé,
	Florian Fainelli, Sasha Levin

From: Vincent Stehlé <vincent.stehle@laposte.net>

[ Upstream commit 7eb000bdbe7c7da811ef51942b356f6e819b13ba ]

The ndo_start_xmit() method must not attempt to free the skb to transmit
when returning NETDEV_TX_BUSY. Therefore, make sure the
korina_send_packet() function returns NETDEV_TX_OK when it frees a packet.

Fixes: ef11291bcd5f ("Add support the Korina (IDT RC32434) Ethernet MAC")
Suggested-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Vincent Stehlé <vincent.stehle@laposte.net>
Acked-by: Florian Fainelli <f.fainelli@gmail.com>
Link: https://lore.kernel.org/r/20201214220952.19935-1-vincent.stehle@laposte.net
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/korina.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/korina.c b/drivers/net/ethernet/korina.c
index 993f495e2bf7b..9f804e2aba359 100644
--- a/drivers/net/ethernet/korina.c
+++ b/drivers/net/ethernet/korina.c
@@ -219,7 +219,7 @@ static int korina_send_packet(struct sk_buff *skb, struct net_device *dev)
 			dev_kfree_skb_any(skb);
 			spin_unlock_irqrestore(&lp->lock, flags);
 
-			return NETDEV_TX_BUSY;
+			return NETDEV_TX_OK;
 		}
 	}
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 295/453] libnvdimm/label: Return -ENXIO for no slot in __blk_label_update
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (293 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.4 294/453] net: korina: fix return value Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.4 296/453] watchdog: qcom: Avoid context switch in restart handler Greg Kroah-Hartman
                   ` (160 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Zhang Qilong, Dan Williams, Sasha Levin

From: Zhang Qilong <zhangqilong3@huawei.com>

[ Upstream commit 4c46764733c85b82c07e9559b39da4d00a7dd659 ]

Forget to set error code when nd_label_alloc_slot failed, and we
add it to avoid overwritten error code.

Fixes: 0ba1c634892b ("libnvdimm: write blk label set")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Link: https://lore.kernel.org/r/20201205115056.2076523-1-zhangqilong3@huawei.com
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nvdimm/label.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/nvdimm/label.c b/drivers/nvdimm/label.c
index 47a4828b8b310..05c1f186a6be8 100644
--- a/drivers/nvdimm/label.c
+++ b/drivers/nvdimm/label.c
@@ -999,8 +999,10 @@ static int __blk_label_update(struct nd_region *nd_region,
 		if (is_old_resource(res, old_res_list, old_num_resources))
 			continue; /* carry-over */
 		slot = nd_label_alloc_slot(ndd);
-		if (slot == UINT_MAX)
+		if (slot == UINT_MAX) {
+			rc = -ENXIO;
 			goto abort;
+		}
 		dev_dbg(ndd->dev, "allocated: %d\n", slot);
 
 		nd_label = to_label(ndd, slot);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 296/453] watchdog: qcom: Avoid context switch in restart handler
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (294 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.4 295/453] libnvdimm/label: Return -ENXIO for no slot in __blk_label_update Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.4 297/453] watchdog: coh901327: add COMMON_CLK dependency Greg Kroah-Hartman
                   ` (159 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Manivannan Sadhasivam, Guenter Roeck,
	Wim Van Sebroeck, Sasha Levin

From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>

[ Upstream commit 7948fab26bcc468aa2a76462f441291b5fb0d5c7 ]

The use of msleep() in the restart handler will cause scheduler to
induce a context switch which is not desirable. This generates below
warning on SDX55 when WDT is the only available restart source:

[   39.800188] reboot: Restarting system
[   39.804115] ------------[ cut here ]------------
[   39.807855] WARNING: CPU: 0 PID: 678 at kernel/rcu/tree_plugin.h:297 rcu_note_context_switch+0x190/0x764
[   39.812538] Modules linked in:
[   39.821954] CPU: 0 PID: 678 Comm: reboot Not tainted 5.10.0-rc1-00063-g33a9990d1d66-dirty #47
[   39.824854] Hardware name: Generic DT based system
[   39.833470] [<c0310fbc>] (unwind_backtrace) from [<c030c544>] (show_stack+0x10/0x14)
[   39.838154] [<c030c544>] (show_stack) from [<c0c218f0>] (dump_stack+0x8c/0xa0)
[   39.846049] [<c0c218f0>] (dump_stack) from [<c0322f80>] (__warn+0xd8/0xf0)
[   39.853058] [<c0322f80>] (__warn) from [<c0c1dc08>] (warn_slowpath_fmt+0x64/0xc8)
[   39.859925] [<c0c1dc08>] (warn_slowpath_fmt) from [<c038b6f4>] (rcu_note_context_switch+0x190/0x764)
[   39.867503] [<c038b6f4>] (rcu_note_context_switch) from [<c0c2aa3c>] (__schedule+0x84/0x640)
[   39.876685] [<c0c2aa3c>] (__schedule) from [<c0c2b050>] (schedule+0x58/0x10c)
[   39.885095] [<c0c2b050>] (schedule) from [<c0c2eed0>] (schedule_timeout+0x1e8/0x3d4)
[   39.892135] [<c0c2eed0>] (schedule_timeout) from [<c039ad40>] (msleep+0x2c/0x38)
[   39.899947] [<c039ad40>] (msleep) from [<c0a59d0c>] (qcom_wdt_restart+0xc4/0xcc)
[   39.907319] [<c0a59d0c>] (qcom_wdt_restart) from [<c0a58290>] (watchdog_restart_notifier+0x18/0x28)
[   39.914715] [<c0a58290>] (watchdog_restart_notifier) from [<c03468e0>] (atomic_notifier_call_chain+0x60/0x84)
[   39.923487] [<c03468e0>] (atomic_notifier_call_chain) from [<c030ae64>] (machine_restart+0x78/0x7c)
[   39.933551] [<c030ae64>] (machine_restart) from [<c0348048>] (__do_sys_reboot+0xdc/0x1e0)
[   39.942397] [<c0348048>] (__do_sys_reboot) from [<c0300060>] (ret_fast_syscall+0x0/0x54)
[   39.950721] Exception stack(0xc3e0bfa8 to 0xc3e0bff0)
[   39.958855] bfa0:                   0001221c bed2fe24 fee1dead 28121969 01234567 00000000
[   39.963832] bfc0: 0001221c bed2fe24 00000003 00000058 000225e0 00000000 00000000 00000000
[   39.971985] bfe0: b6e62560 bed2fc84 00010fd8 b6e62580
[   39.980124] ---[ end trace 3f578288bad866e4 ]---

Hence, replace msleep() with mdelay() to fix this issue.

Fixes: 05e487d905ab ("watchdog: qcom: register a restart notifier")
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Link: https://lore.kernel.org/r/20201207060005.21293-1-manivannan.sadhasivam@linaro.org
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/watchdog/qcom-wdt.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/watchdog/qcom-wdt.c b/drivers/watchdog/qcom-wdt.c
index eb47fe5ed2805..ea8a6abd64ecb 100644
--- a/drivers/watchdog/qcom-wdt.c
+++ b/drivers/watchdog/qcom-wdt.c
@@ -143,7 +143,7 @@ static int qcom_wdt_restart(struct watchdog_device *wdd, unsigned long action,
 	 */
 	wmb();
 
-	msleep(150);
+	mdelay(150);
 	return 0;
 }
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 297/453] watchdog: coh901327: add COMMON_CLK dependency
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (295 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.4 296/453] watchdog: qcom: Avoid context switch in restart handler Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.4 298/453] clk: ti: Fix memleak in ti_fapll_synth_setup Greg Kroah-Hartman
                   ` (158 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Arnd Bergmann, Guenter Roeck,
	Wim Van Sebroeck, Sasha Levin

From: Arnd Bergmann <arnd@arndb.de>

[ Upstream commit 36c47df85ee8e1f8a35366ac11324f8875de00eb ]

clang produces a build failure in configurations without COMMON_CLK
when a timeout calculation goes wrong:

arm-linux-gnueabi-ld: drivers/watchdog/coh901327_wdt.o: in function `coh901327_enable':
coh901327_wdt.c:(.text+0x50): undefined reference to `__bad_udelay'

Add a Kconfig dependency to only do build testing when COMMON_CLK
is enabled.

Fixes: da2a68b3eb47 ("watchdog: Enable COMPILE_TEST where possible")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Link: https://lore.kernel.org/r/20201203223358.1269372-1-arnd@kernel.org
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/watchdog/Kconfig | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/watchdog/Kconfig b/drivers/watchdog/Kconfig
index 6cdffbdaf98a5..1aa42e879e633 100644
--- a/drivers/watchdog/Kconfig
+++ b/drivers/watchdog/Kconfig
@@ -618,7 +618,7 @@ config SUNXI_WATCHDOG
 
 config COH901327_WATCHDOG
 	bool "ST-Ericsson COH 901 327 watchdog"
-	depends on ARCH_U300 || (ARM && COMPILE_TEST)
+	depends on ARCH_U300 || (ARM && COMMON_CLK && COMPILE_TEST)
 	default y if MACH_U300
 	select WATCHDOG_CORE
 	help
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 298/453] clk: ti: Fix memleak in ti_fapll_synth_setup
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (296 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.4 297/453] watchdog: coh901327: add COMMON_CLK dependency Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.4 299/453] pwm: zx: Add missing cleanup in error path Greg Kroah-Hartman
                   ` (157 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Zhang Qilong,
	Tony Lindgren, Stephen Boyd, Sasha Levin

From: Zhang Qilong <zhangqilong3@huawei.com>

[ Upstream commit 8c6239f6e95f583bb763d0228e02d4dd0fb3d492 ]

If clk_register fails, we should goto free branch
before function returns to prevent memleak.

Fixes: 163152cbbe321 ("clk: ti: Add support for FAPLL on dm816x")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Link: https://lore.kernel.org/r/20201113131623.2098222-1-zhangqilong3@huawei.com
Acked-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/ti/fapll.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/drivers/clk/ti/fapll.c b/drivers/clk/ti/fapll.c
index 95e36ba64accf..8024c6d2b9e95 100644
--- a/drivers/clk/ti/fapll.c
+++ b/drivers/clk/ti/fapll.c
@@ -498,6 +498,7 @@ static struct clk * __init ti_fapll_synth_setup(struct fapll_data *fd,
 {
 	struct clk_init_data *init;
 	struct fapll_synth *synth;
+	struct clk *clk = ERR_PTR(-ENOMEM);
 
 	init = kzalloc(sizeof(*init), GFP_KERNEL);
 	if (!init)
@@ -520,13 +521,19 @@ static struct clk * __init ti_fapll_synth_setup(struct fapll_data *fd,
 	synth->hw.init = init;
 	synth->clk_pll = pll_clk;
 
-	return clk_register(NULL, &synth->hw);
+	clk = clk_register(NULL, &synth->hw);
+	if (IS_ERR(clk)) {
+		pr_err("failed to register clock\n");
+		goto free;
+	}
+
+	return clk;
 
 free:
 	kfree(synth);
 	kfree(init);
 
-	return ERR_PTR(-ENOMEM);
+	return clk;
 }
 
 static void __init ti_fapll_setup(struct device_node *node)
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 299/453] pwm: zx: Add missing cleanup in error path
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (297 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.4 298/453] clk: ti: Fix memleak in ti_fapll_synth_setup Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.4 301/453] perf record: Fix memory leak when using --user-regs=? to list registers Greg Kroah-Hartman
                   ` (156 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Uwe Kleine-König, Shawn Guo,
	Thierry Reding, Sasha Levin

From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>

[ Upstream commit 269effd03f6142df4c74814cfdd5f0b041b30bf9 ]

zx_pwm_probe() called clk_prepare_enable() before; this must be undone
in the error path.

Fixes: 4836193c435c ("pwm: Add ZTE ZX PWM device driver")
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Acked-by: Shawn Guo <shawn.guo@linaro.org>
Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pwm/pwm-zx.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/pwm/pwm-zx.c b/drivers/pwm/pwm-zx.c
index e2c21cc34a96a..3763ce5311ac2 100644
--- a/drivers/pwm/pwm-zx.c
+++ b/drivers/pwm/pwm-zx.c
@@ -238,6 +238,7 @@ static int zx_pwm_probe(struct platform_device *pdev)
 	ret = pwmchip_add(&zpc->chip);
 	if (ret < 0) {
 		dev_err(&pdev->dev, "failed to add PWM chip: %d\n", ret);
+		clk_disable_unprepare(zpc->pclk);
 		return ret;
 	}
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 301/453] perf record: Fix memory leak when using --user-regs=? to list registers
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (298 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.4 299/453] pwm: zx: Add missing cleanup in error path Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.4 302/453] qlcnic: Fix error code in probe Greg Kroah-Hartman
                   ` (155 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Zheng Zengkai, Jiri Olsa,
	Alexander Shishkin, Li Bin, Mark Rutland, Namhyung Kim,
	Arnaldo Carvalho de Melo, Sasha Levin

From: Zheng Zengkai <zhengzengkai@huawei.com>

[ Upstream commit 2eb5dd418034ecea2f7031e3d33f2991a878b148 ]

When using 'perf record's option '-I' or '--user-regs=' along with
argument '?' to list available register names, memory of variable 'os'
allocated by strdup() needs to be released before __parse_regs()
returns, otherwise memory leak will occur.

Fixes: bcc84ec65ad1 ("perf record: Add ability to name registers to record")
Signed-off-by: Zheng Zengkai <zhengzengkai@huawei.com>
Acked-by: Jiri Olsa <jolsa@redhat.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Li Bin <huawei.libin@huawei.com>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Link: https://lore.kernel.org/r/20200703093344.189450-1-zhengzengkai@huawei.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/perf/util/parse-regs-options.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/perf/util/parse-regs-options.c b/tools/perf/util/parse-regs-options.c
index ef46c28488085..869ef7e22bd91 100644
--- a/tools/perf/util/parse-regs-options.c
+++ b/tools/perf/util/parse-regs-options.c
@@ -52,7 +52,7 @@ __parse_regs(const struct option *opt, const char *str, int unset, bool intr)
 				}
 				fputc('\n', stderr);
 				/* just printing available regs */
-				return -1;
+				goto error;
 			}
 			for (r = sample_reg_masks; r->name; r++) {
 				if ((r->mask & mask) && !strcasecmp(s, r->name))
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 302/453] qlcnic: Fix error code in probe
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (299 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.4 301/453] perf record: Fix memory leak when using --user-regs=? to list registers Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:48 ` [PATCH 5.4 303/453] virtio_ring: Cut and paste bugs in vring_create_virtqueue_packed() Greg Kroah-Hartman
                   ` (154 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Jakub Kicinski, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit 0d52848632a357948028eab67ff9b7cc0c12a0fb ]

Return -EINVAL if we can't find the correct device.  Currently it
returns success.

Fixes: 13159183ec7a ("qlcnic: 83xx base driver")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/X9nHbMqEyI/xPfGd@mwanda
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
index c07438db30ba1..f2e5f494462b3 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
@@ -2509,6 +2509,7 @@ qlcnic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 		qlcnic_sriov_vf_register_map(ahw);
 		break;
 	default:
+		err = -EINVAL;
 		goto err_out_free_hw_res;
 	}
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 303/453] virtio_ring: Cut and paste bugs in vring_create_virtqueue_packed()
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (300 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.4 302/453] qlcnic: Fix error code in probe Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.4 304/453] virtio_net: Fix error code in probe() Greg Kroah-Hartman
                   ` (153 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Robert Buhren, Felicitas Hetzelt,
	Dan Carpenter, Michael S. Tsirkin, Jason Wang, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit ae93d8ea0fa701e84ab9df0db9fb60ec6c80d7b8 ]

There is a copy and paste bug in the error handling of this code and
it uses "ring_dma_addr" three times instead of "device_event_dma_addr"
and "driver_event_dma_addr".

Fixes: 1ce9e6055fa0 (" virtio_ring: introduce packed ring support")
Reported-by: Robert Buhren <robert.buhren@sect.tu-berlin.de>
Reported-by: Felicitas Hetzelt <file@sect.tu-berlin.de>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/X8pGRJlEzyn+04u2@mwanda
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/virtio/virtio_ring.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
index 4f7c73e6052f6..e3e8cab81abdf 100644
--- a/drivers/virtio/virtio_ring.c
+++ b/drivers/virtio/virtio_ring.c
@@ -1676,9 +1676,9 @@ err_desc_extra:
 err_desc_state:
 	kfree(vq);
 err_vq:
-	vring_free_queue(vdev, event_size_in_bytes, device, ring_dma_addr);
+	vring_free_queue(vdev, event_size_in_bytes, device, device_event_dma_addr);
 err_device:
-	vring_free_queue(vdev, event_size_in_bytes, driver, ring_dma_addr);
+	vring_free_queue(vdev, event_size_in_bytes, driver, driver_event_dma_addr);
 err_driver:
 	vring_free_queue(vdev, ring_size_in_bytes, ring, ring_dma_addr);
 err_ring:
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 304/453] virtio_net: Fix error code in probe()
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (301 preceding siblings ...)
  2020-12-28 12:48 ` [PATCH 5.4 303/453] virtio_ring: Cut and paste bugs in vring_create_virtqueue_packed() Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.4 305/453] virtio_ring: Fix two use after free bugs Greg Kroah-Hartman
                   ` (152 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Robert Buhren, Felicitas Hetzelt,
	Dan Carpenter, Michael S. Tsirkin, Jason Wang, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit 411ea23a76526e6efed0b601abb603d3c981b333 ]

Set a negative error code intead of returning success if the MTU has
been changed to something invalid.

Fixes: fe36cbe0671e ("virtio_net: clear MTU when out of range")
Reported-by: Robert Buhren <robert.buhren@sect.tu-berlin.de>
Reported-by: Felicitas Hetzelt <file@sect.tu-berlin.de>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/X8pGVJSeeCdII1Ys@mwanda
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/virtio_net.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 99e1a7bc06886..7cc8f405be1ad 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -3114,6 +3114,7 @@ static int virtnet_probe(struct virtio_device *vdev)
 			dev_err(&vdev->dev,
 				"device MTU appears to have changed it is now %d < %d",
 				mtu, dev->min_mtu);
+			err = -EINVAL;
 			goto free;
 		}
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 305/453] virtio_ring: Fix two use after free bugs
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (302 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.4 304/453] virtio_net: Fix error code in probe() Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.4 306/453] clk: at91: sam9x60: remove atmel,osc-bypass support Greg Kroah-Hartman
                   ` (151 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Robert Buhren, Felicitas Hetzelt,
	Dan Carpenter, Michael S. Tsirkin, Jason Wang, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit e152d8af4220a05c9797591609151d404866beaa ]

The "vq" struct is added to the "vdev->vqs" list prematurely.  If we
encounter an error later in the function then the "vq" is freed, but
since it is still on the list that could lead to a use after free bug.

Fixes: cbeedb72b97a ("virtio_ring: allocate desc state for split ring separately")
Reported-by: Robert Buhren <robert.buhren@sect.tu-berlin.de>
Reported-by: Felicitas Hetzelt <file@sect.tu-berlin.de>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/X8pGaG/zkI3jk8mk@mwanda
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/virtio/virtio_ring.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
index e3e8cab81abdf..97e8a195e18f5 100644
--- a/drivers/virtio/virtio_ring.c
+++ b/drivers/virtio/virtio_ring.c
@@ -1608,7 +1608,6 @@ static struct virtqueue *vring_create_virtqueue_packed(
 	vq->num_added = 0;
 	vq->packed_ring = true;
 	vq->use_dma_api = vring_use_dma_api(vdev);
-	list_add_tail(&vq->vq.list, &vdev->vqs);
 #ifdef DEBUG
 	vq->in_use = false;
 	vq->last_add_time_valid = false;
@@ -1669,6 +1668,7 @@ static struct virtqueue *vring_create_virtqueue_packed(
 			cpu_to_le16(vq->packed.event_flags_shadow);
 	}
 
+	list_add_tail(&vq->vq.list, &vdev->vqs);
 	return &vq->vq;
 
 err_desc_extra:
@@ -2085,7 +2085,6 @@ struct virtqueue *__vring_new_virtqueue(unsigned int index,
 	vq->last_used_idx = 0;
 	vq->num_added = 0;
 	vq->use_dma_api = vring_use_dma_api(vdev);
-	list_add_tail(&vq->vq.list, &vdev->vqs);
 #ifdef DEBUG
 	vq->in_use = false;
 	vq->last_add_time_valid = false;
@@ -2127,6 +2126,7 @@ struct virtqueue *__vring_new_virtqueue(unsigned int index,
 	memset(vq->split.desc_state, 0, vring.num *
 			sizeof(struct vring_desc_state_split));
 
+	list_add_tail(&vq->vq.list, &vdev->vqs);
 	return &vq->vq;
 }
 EXPORT_SYMBOL_GPL(__vring_new_virtqueue);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 306/453] clk: at91: sam9x60: remove atmel,osc-bypass support
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (303 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.4 305/453] virtio_ring: Fix two use after free bugs Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.4 307/453] clk: s2mps11: Fix a resource leak in error handling paths in the probe function Greg Kroah-Hartman
                   ` (150 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Claudiu Beznea, Alexandre Belloni,
	Stephen Boyd, Sasha Levin

From: Alexandre Belloni <alexandre.belloni@bootlin.com>

[ Upstream commit 01324f9e88b5cfc1f4c26eef66bdcb52596c9af8 ]

The sam9x60 doesn't have the MOSCXTBY bit to enable the crystal oscillator
bypass.

Fixes: 01e2113de9a5 ("clk: at91: add sam9x60 pmc driver")
Reported-by: Claudiu Beznea <claudiu.beznea@microchip.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Link: https://lore.kernel.org/r/20201202125816.168618-1-alexandre.belloni@bootlin.com
Reviewed-by: Claudiu Beznea <claudiu.beznea@microchip.com>
Tested-by: Claudiu Beznea <claudiu.beznea@microchip.com>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/at91/sam9x60.c | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/drivers/clk/at91/sam9x60.c b/drivers/clk/at91/sam9x60.c
index 7338a3bc71eb1..e3f4c8f20223a 100644
--- a/drivers/clk/at91/sam9x60.c
+++ b/drivers/clk/at91/sam9x60.c
@@ -162,7 +162,6 @@ static void __init sam9x60_pmc_setup(struct device_node *np)
 	struct regmap *regmap;
 	struct clk_hw *hw;
 	int i;
-	bool bypass;
 
 	i = of_property_match_string(np, "clock-names", "td_slck");
 	if (i < 0)
@@ -197,10 +196,7 @@ static void __init sam9x60_pmc_setup(struct device_node *np)
 	if (IS_ERR(hw))
 		goto err_free;
 
-	bypass = of_property_read_bool(np, "atmel,osc-bypass");
-
-	hw = at91_clk_register_main_osc(regmap, "main_osc", mainxtal_name,
-					bypass);
+	hw = at91_clk_register_main_osc(regmap, "main_osc", mainxtal_name, 0);
 	if (IS_ERR(hw))
 		goto err_free;
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 307/453] clk: s2mps11: Fix a resource leak in error handling paths in the probe function
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (304 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.4 306/453] clk: at91: sam9x60: remove atmel,osc-bypass support Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.4 308/453] clk: sunxi-ng: Make sure divider tables have sentinel Greg Kroah-Hartman
                   ` (149 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christophe JAILLET,
	Krzysztof Kozlowski, Stephen Boyd, Sasha Levin

From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>

[ Upstream commit d2d94fc567624f96187e8b52083795620f93e69f ]

Some resource should be released in the error handling path of the probe
function, as already done in the remove function.

The remove function was fixed in commit bf416bd45738 ("clk: s2mps11: Add
missing of_node_put and of_clk_del_provider")

Fixes: 7cc560dea415 ("clk: s2mps11: Add support for s2mps11")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Link: https://lore.kernel.org/r/20201212122818.86195-1-christophe.jaillet@wanadoo.fr
Reviewed-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/clk-s2mps11.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/clk/clk-s2mps11.c b/drivers/clk/clk-s2mps11.c
index 2ce370c804aae..f19994ce7ca15 100644
--- a/drivers/clk/clk-s2mps11.c
+++ b/drivers/clk/clk-s2mps11.c
@@ -195,6 +195,7 @@ static int s2mps11_clk_probe(struct platform_device *pdev)
 	return ret;
 
 err_reg:
+	of_node_put(s2mps11_clks[0].clk_np);
 	while (--i >= 0)
 		clkdev_drop(s2mps11_clks[i].lookup);
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 308/453] clk: sunxi-ng: Make sure divider tables have sentinel
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (305 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.4 307/453] clk: s2mps11: Fix a resource leak in error handling paths in the probe function Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.4 309/453] kconfig: fix return value of do_error_if() Greg Kroah-Hartman
                   ` (148 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jernej Skrabec, Maxime Ripard,
	Stephen Boyd, Sasha Levin

From: Jernej Skrabec <jernej.skrabec@siol.net>

[ Upstream commit 48f68de00c1405351fa0e7bc44bca067c49cd0a3 ]

Two clock divider tables are missing sentinel at the end. Effect of that
is that clock framework reads past the last entry. Fix that with adding
sentinel at the end.

Issue was discovered with KASan.

Fixes: 0577e4853bfb ("clk: sunxi-ng: Add H3 clocks")
Fixes: c6a0637460c2 ("clk: sunxi-ng: Add A64 clocks")
Signed-off-by: Jernej Skrabec <jernej.skrabec@siol.net>
Link: https://lore.kernel.org/r/20201202203817.438713-1-jernej.skrabec@siol.net
Acked-by: Maxime Ripard <mripard@kernel.org>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/sunxi-ng/ccu-sun50i-a64.c | 1 +
 drivers/clk/sunxi-ng/ccu-sun8i-h3.c   | 1 +
 2 files changed, 2 insertions(+)

diff --git a/drivers/clk/sunxi-ng/ccu-sun50i-a64.c b/drivers/clk/sunxi-ng/ccu-sun50i-a64.c
index 5f66bf8797723..149cfde817cba 100644
--- a/drivers/clk/sunxi-ng/ccu-sun50i-a64.c
+++ b/drivers/clk/sunxi-ng/ccu-sun50i-a64.c
@@ -389,6 +389,7 @@ static struct clk_div_table ths_div_table[] = {
 	{ .val = 1, .div = 2 },
 	{ .val = 2, .div = 4 },
 	{ .val = 3, .div = 6 },
+	{ /* Sentinel */ },
 };
 static const char * const ths_parents[] = { "osc24M" };
 static struct ccu_div ths_clk = {
diff --git a/drivers/clk/sunxi-ng/ccu-sun8i-h3.c b/drivers/clk/sunxi-ng/ccu-sun8i-h3.c
index 6b636362379ee..7e629a4493afd 100644
--- a/drivers/clk/sunxi-ng/ccu-sun8i-h3.c
+++ b/drivers/clk/sunxi-ng/ccu-sun8i-h3.c
@@ -322,6 +322,7 @@ static struct clk_div_table ths_div_table[] = {
 	{ .val = 1, .div = 2 },
 	{ .val = 2, .div = 4 },
 	{ .val = 3, .div = 6 },
+	{ /* Sentinel */ },
 };
 static SUNXI_CCU_DIV_TABLE_WITH_GATE(ths_clk, "ths", "osc24M",
 				     0x074, 0, 2, ths_div_table, BIT(31), 0);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 309/453] kconfig: fix return value of do_error_if()
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (306 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.4 308/453] clk: sunxi-ng: Make sure divider tables have sentinel Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.4 310/453] perf probe: Fix memory leak when synthesizing SDT probes Greg Kroah-Hartman
                   ` (147 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Masahiro Yamada, Sasha Levin

From: Masahiro Yamada <masahiroy@kernel.org>

[ Upstream commit 135b4957eac43af2aedf8e2a277b9540f33c2558 ]

$(error-if,...) is expanded to an empty string. Currently, it relies on
eval_clause() returning xstrdup("") when all attempts for expansion fail,
but the correct implementation is to make do_error_if() return xstrdup("").

Fixes: 1d6272e6fe43 ("kconfig: add 'info', 'warning-if', and 'error-if' built-in functions")
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 scripts/kconfig/preprocess.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/kconfig/preprocess.c b/scripts/kconfig/preprocess.c
index 0243086fb1685..0590f86df6e40 100644
--- a/scripts/kconfig/preprocess.c
+++ b/scripts/kconfig/preprocess.c
@@ -114,7 +114,7 @@ static char *do_error_if(int argc, char *argv[])
 	if (!strcmp(argv[0], "y"))
 		pperror("%s", argv[1]);
 
-	return NULL;
+	return xstrdup("");
 }
 
 static char *do_filename(int argc, char *argv[])
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 310/453] perf probe: Fix memory leak when synthesizing SDT probes
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (307 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.4 309/453] kconfig: fix return value of do_error_if() Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.4 311/453] ARM: sunxi: Add machine match for the Allwinner V3 SoC Greg Kroah-Hartman
                   ` (146 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Adrian Hunter, Alexander Shishkin,
	Alexandre Truong, Alexis Berlemont, He Zhe, Ian Rogers,
	Ingo Molnar, Jiri Olsa, John Garry, Mark Rutland,
	Masami Hiramatsu, Mathieu Poirier, Namhyung Kim, Peter Zijlstra,
	Sumanth Korikkar, Thomas Richter, Will Deacon,
	Arnaldo Carvalho de Melo, Sasha Levin

From: Arnaldo Carvalho de Melo <acme@redhat.com>

[ Upstream commit 5149303fdfe5c67ddb51c911e23262f781cd75eb ]

The argv_split() function must be paired with argv_free(), else we must
keep a reference to the argv array received or do the freeing ourselves,
in synthesize_sdt_probe_command() we were simply leaking that argv[]
array.

Fixes: 3b1f8311f6963cd1 ("perf probe: Add sdt probes arguments into the uprobe cmd string")
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Alexandre Truong <alexandre.truong@arm.com>
Cc: Alexis Berlemont <alexis.berlemont@gmail.com>
Cc: He Zhe <zhe.he@windriver.com>
Cc: Ian Rogers <irogers@google.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: John Garry <john.garry@huawei.com>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Mathieu Poirier <mathieu.poirier@linaro.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Sumanth Korikkar <sumanthk@linux.ibm.com>
Cc: Thomas Richter <tmricht@linux.ibm.com>
Cc: Will Deacon <will@kernel.org>
Link: https://lore.kernel.org/r/20201224135139.GF477817@kernel.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/perf/util/probe-file.c | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/tools/perf/util/probe-file.c b/tools/perf/util/probe-file.c
index bf50f464234fe..f778f8e7e65a3 100644
--- a/tools/perf/util/probe-file.c
+++ b/tools/perf/util/probe-file.c
@@ -777,7 +777,7 @@ static char *synthesize_sdt_probe_command(struct sdt_note *note,
 					const char *sdtgrp)
 {
 	struct strbuf buf;
-	char *ret = NULL, **args;
+	char *ret = NULL;
 	int i, args_count, err;
 	unsigned long long ref_ctr_offset;
 
@@ -799,12 +799,19 @@ static char *synthesize_sdt_probe_command(struct sdt_note *note,
 		goto out;
 
 	if (note->args) {
-		args = argv_split(note->args, &args_count);
+		char **args = argv_split(note->args, &args_count);
+
+		if (args == NULL)
+			goto error;
 
 		for (i = 0; i < args_count; ++i) {
-			if (synthesize_sdt_probe_arg(&buf, i, args[i]) < 0)
+			if (synthesize_sdt_probe_arg(&buf, i, args[i]) < 0) {
+				argv_free(args);
 				goto error;
+			}
 		}
+
+		argv_free(args);
 	}
 
 out:
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 311/453] ARM: sunxi: Add machine match for the Allwinner V3 SoC
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (308 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.4 310/453] perf probe: Fix memory leak when synthesizing SDT probes Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.4 312/453] cfg80211: initialize rekey_data Greg Kroah-Hartman
                   ` (145 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Paul Kocialkowski, Maxime Ripard,
	Sasha Levin

From: Paul Kocialkowski <contact@paulk.fr>

[ Upstream commit ad2091f893bd5dfe2824f0d6819600d120698e9f ]

The Allwinner V3 SoC shares the same base as the V3s but comes with
extra pins and features available. As a result, it has its dedicated
compatible string (already used in device trees), which is added here.

Signed-off-by: Paul Kocialkowski <contact@paulk.fr>
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
Link: https://lore.kernel.org/r/20201031182137.1879521-2-contact@paulk.fr
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/mach-sunxi/sunxi.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/arm/mach-sunxi/sunxi.c b/arch/arm/mach-sunxi/sunxi.c
index 933b6930f024f..a0ca5e7a68de2 100644
--- a/arch/arm/mach-sunxi/sunxi.c
+++ b/arch/arm/mach-sunxi/sunxi.c
@@ -66,6 +66,7 @@ static const char * const sun8i_board_dt_compat[] = {
 	"allwinner,sun8i-h2-plus",
 	"allwinner,sun8i-h3",
 	"allwinner,sun8i-r40",
+	"allwinner,sun8i-v3",
 	"allwinner,sun8i-v3s",
 	NULL,
 };
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 312/453] cfg80211: initialize rekey_data
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (309 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.4 311/453] ARM: sunxi: Add machine match for the Allwinner V3 SoC Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.4 313/453] [SECURITY] fix namespaced fscaps when !CONFIG_SECURITY Greg Kroah-Hartman
                   ` (144 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sara Sharon, Luca Coelho,
	Johannes Berg, Sasha Levin

From: Sara Sharon <sara.sharon@intel.com>

[ Upstream commit f495acd8851d7b345e5f0e521b2645b1e1f928a0 ]

In case we have old supplicant, the akm field is uninitialized.

Signed-off-by: Sara Sharon <sara.sharon@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20201129172929.930f0ab7ebee.Ic546e384efab3f4a89f318eafddc3eb7d556aecb@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/wireless/nl80211.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index dbac5c0995a0f..5bb2316befb98 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -12033,7 +12033,7 @@ static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
 	struct net_device *dev = info->user_ptr[1];
 	struct wireless_dev *wdev = dev->ieee80211_ptr;
 	struct nlattr *tb[NUM_NL80211_REKEY_DATA];
-	struct cfg80211_gtk_rekey_data rekey_data;
+	struct cfg80211_gtk_rekey_data rekey_data = {};
 	int err;
 
 	if (!info->attrs[NL80211_ATTR_REKEY_DATA])
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 313/453] [SECURITY] fix namespaced fscaps when !CONFIG_SECURITY
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (310 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.4 312/453] cfg80211: initialize rekey_data Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.4 314/453] lwt: Disable BH too in run_lwt_bpf() Greg Kroah-Hartman
                   ` (143 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hervé Guillemet,
	Casey Schaufler, Serge Hallyn, Andrew G. Morgan, James Morris,
	Sasha Levin

From: Serge Hallyn <shallyn@cisco.com>

[ Upstream commit ed9b25d1970a4787ac6a39c2091e63b127ecbfc1 ]

Namespaced file capabilities were introduced in 8db6c34f1dbc .
When userspace reads an xattr for a namespaced capability, a
virtualized representation of it is returned if the caller is
in a user namespace owned by the capability's owning rootid.
The function which performs this virtualization was not hooked
up if CONFIG_SECURITY=n.  Therefore in that case the original
xattr was shown instead of the virtualized one.

To test this using libcap-bin (*1),

$ v=$(mktemp)
$ unshare -Ur setcap cap_sys_admin-eip $v
$ unshare -Ur setcap -v cap_sys_admin-eip $v
/tmp/tmp.lSiIFRvt8Y: OK

"setcap -v" verifies the values instead of setting them, and
will check whether the rootid value is set.  Therefore, with
this bug un-fixed, and with CONFIG_SECURITY=n, setcap -v will
fail:

$ v=$(mktemp)
$ unshare -Ur setcap cap_sys_admin=eip $v
$ unshare -Ur setcap -v cap_sys_admin=eip $v
nsowner[got=1000, want=0],/tmp/tmp.HHDiOOl9fY differs in []

Fix this bug by calling cap_inode_getsecurity() in
security_inode_getsecurity() instead of returning
-EOPNOTSUPP, when CONFIG_SECURITY=n.

*1 - note, if libcap is too old for getcap to have the '-n'
option, then use verify-caps instead.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=209689
Cc: Hervé Guillemet <herve@guillemet.org>
Acked-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: Serge Hallyn <shallyn@cisco.com>
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
Signed-off-by: James Morris <jamorris@linux.microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/security.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/linux/security.h b/include/linux/security.h
index fd022768e91df..df90399a8af98 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -852,7 +852,7 @@ static inline int security_inode_killpriv(struct dentry *dentry)
 
 static inline int security_inode_getsecurity(struct inode *inode, const char *name, void **buffer, bool alloc)
 {
-	return -EOPNOTSUPP;
+	return cap_inode_getsecurity(inode, name, buffer, alloc);
 }
 
 static inline int security_inode_setsecurity(struct inode *inode, const char *name, const void *value, size_t size, int flags)
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 314/453] lwt: Disable BH too in run_lwt_bpf()
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (311 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.4 313/453] [SECURITY] fix namespaced fscaps when !CONFIG_SECURITY Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.4 315/453] drm/amd/display: Prevent bandwidth overflow Greg Kroah-Hartman
                   ` (142 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dongdong Wang, Alexei Starovoitov,
	Cong Wang, Sasha Levin

From: Dongdong Wang <wangdongdong.6@bytedance.com>

[ Upstream commit d9054a1ff585ba01029584ab730efc794603d68f ]

The per-cpu bpf_redirect_info is shared among all skb_do_redirect()
and BPF redirect helpers. Callers on RX path are all in BH context,
disabling preemption is not sufficient to prevent BH interruption.

In production, we observed strange packet drops because of the race
condition between LWT xmit and TC ingress, and we verified this issue
is fixed after we disable BH.

Although this bug was technically introduced from the beginning, that
is commit 3a0af8fd61f9 ("bpf: BPF for lightweight tunnel infrastructure"),
at that time call_rcu() had to be call_rcu_bh() to match the RCU context.
So this patch may not work well before RCU flavor consolidation has been
completed around v5.0.

Update the comments above the code too, as call_rcu() is now BH friendly.

Signed-off-by: Dongdong Wang <wangdongdong.6@bytedance.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Reviewed-by: Cong Wang <cong.wang@bytedance.com>
Link: https://lore.kernel.org/bpf/20201205075946.497763-1-xiyou.wangcong@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/core/lwt_bpf.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/net/core/lwt_bpf.c b/net/core/lwt_bpf.c
index 99a6de52b21da..a5502c5aa44e7 100644
--- a/net/core/lwt_bpf.c
+++ b/net/core/lwt_bpf.c
@@ -39,12 +39,11 @@ static int run_lwt_bpf(struct sk_buff *skb, struct bpf_lwt_prog *lwt,
 {
 	int ret;
 
-	/* Preempt disable is needed to protect per-cpu redirect_info between
-	 * BPF prog and skb_do_redirect(). The call_rcu in bpf_prog_put() and
-	 * access to maps strictly require a rcu_read_lock() for protection,
-	 * mixing with BH RCU lock doesn't work.
+	/* Preempt disable and BH disable are needed to protect per-cpu
+	 * redirect_info between BPF prog and skb_do_redirect().
 	 */
 	preempt_disable();
+	local_bh_disable();
 	bpf_compute_data_pointers(skb);
 	ret = bpf_prog_run_save_cb(lwt->prog, skb);
 
@@ -78,6 +77,7 @@ static int run_lwt_bpf(struct sk_buff *skb, struct bpf_lwt_prog *lwt,
 		break;
 	}
 
+	local_bh_enable();
 	preempt_enable();
 
 	return ret;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 315/453] drm/amd/display: Prevent bandwidth overflow
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (312 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.4 314/453] lwt: Disable BH too in run_lwt_bpf() Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.4 316/453] drm/amdkfd: Fix leak in dmabuf import Greg Kroah-Hartman
                   ` (141 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chris Park, Wenjing Liu, Eryk Brol,
	Alex Deucher, Sasha Levin

From: Chris Park <Chris.Park@amd.com>

[ Upstream commit 80089dd8410f356d5104496d5ab71a66a4f4646b ]

[Why]
At very high pixel clock, bandwidth calculation exceeds 32 bit size
and overflow value. This causes the resulting selection of link rate
to be inaccurate.

[How]
Change order of operation and use fixed point to deal with integer
accuracy. Also address bug found when forcing link rate.

Signed-off-by: Chris Park <Chris.Park@amd.com>
Reviewed-by: Wenjing Liu <Wenjing.Liu@amd.com>
Acked-by: Eryk Brol <eryk.brol@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/display/dc/core/dc_link.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link.c b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
index 47cefc05fd3f5..f933791f1fbbb 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_link.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
@@ -2906,11 +2906,14 @@ uint32_t dc_bandwidth_in_kbps_from_timing(
 {
 	uint32_t bits_per_channel = 0;
 	uint32_t kbps;
+	struct fixed31_32 link_bw_kbps;
 
 #ifdef CONFIG_DRM_AMD_DC_DSC_SUPPORT
 	if (timing->flags.DSC) {
-		kbps = (timing->pix_clk_100hz * timing->dsc_cfg.bits_per_pixel);
-		kbps = kbps / 160 + ((kbps % 160) ? 1 : 0);
+		link_bw_kbps = dc_fixpt_from_int(timing->pix_clk_100hz);
+		link_bw_kbps = dc_fixpt_div_int(link_bw_kbps, 160);
+		link_bw_kbps = dc_fixpt_mul_int(link_bw_kbps, timing->dsc_cfg.bits_per_pixel);
+		kbps = dc_fixpt_ceil(link_bw_kbps);
 		return kbps;
 	}
 #endif
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 316/453] drm/amdkfd: Fix leak in dmabuf import
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (313 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.4 315/453] drm/amd/display: Prevent bandwidth overflow Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.4 317/453] Input: cros_ec_keyb - send scancodes in addition to key events Greg Kroah-Hartman
                   ` (140 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Felix Kuehling, Kent Russell,
	Alex Deucher, Sasha Levin

From: Felix Kuehling <Felix.Kuehling@amd.com>

[ Upstream commit c897934da15f182ce99536007f8ef61c4748c07e ]

Release dmabuf reference before returning from kfd_ioctl_import_dmabuf.
amdgpu_amdkfd_gpuvm_import_dmabuf takes a reference to the underlying
GEM BO and doesn't keep the reference to the dmabuf wrapper.

Signed-off-by: Felix Kuehling <Felix.Kuehling@amd.com>
Reviewed-by: Kent Russell <kent.russell@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
index 1d3cd5c50d5f2..4a0ef9268918c 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
@@ -1664,6 +1664,7 @@ static int kfd_ioctl_import_dmabuf(struct file *filep,
 	}
 
 	mutex_unlock(&p->mutex);
+	dma_buf_put(dmabuf);
 
 	args->handle = MAKE_HANDLE(args->gpu_id, idr_handle);
 
@@ -1673,6 +1674,7 @@ err_free:
 	amdgpu_amdkfd_gpuvm_free_memory_of_gpu(dev->kgd, (struct kgd_mem *)mem);
 err_unlock:
 	mutex_unlock(&p->mutex);
+	dma_buf_put(dmabuf);
 	return r;
 }
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 317/453] Input: cros_ec_keyb - send scancodes in addition to key events
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (314 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.4 316/453] drm/amdkfd: Fix leak in dmabuf import Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.4 318/453] initramfs: fix clang build failure Greg Kroah-Hartman
                   ` (139 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Rajat Jain, Dmitry Torokhov, Sasha Levin

From: Dmitry Torokhov <dmitry.torokhov@gmail.com>

[ Upstream commit 80db2a087f425b63f0163bc95217abd01c637cb5 ]

To let userspace know what 'scancodes' should be used in EVIOCGKEYCODE
and EVIOCSKEYCODE ioctls, we should send EV_MSC/MSC_SCAN events in
addition to EV_KEY/KEY_* events. The driver already declared MSC_SCAN
capability, so it is only matter of actually sending the events.

Link: https://lore.kernel.org/r/X87aOaSptPTvZ3nZ@google.com
Acked-by: Rajat Jain <rajatja@google.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/input/keyboard/cros_ec_keyb.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/input/keyboard/cros_ec_keyb.c b/drivers/input/keyboard/cros_ec_keyb.c
index 8d4d9786cc745..cae262b6ff398 100644
--- a/drivers/input/keyboard/cros_ec_keyb.c
+++ b/drivers/input/keyboard/cros_ec_keyb.c
@@ -183,6 +183,7 @@ static void cros_ec_keyb_process(struct cros_ec_keyb *ckdev,
 					"changed: [r%d c%d]: byte %02x\n",
 					row, col, new_state);
 
+				input_event(idev, EV_MSC, MSC_SCAN, pos);
 				input_report_key(idev, keycodes[pos],
 						 new_state);
 			}
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 318/453] initramfs: fix clang build failure
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (315 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.4 317/453] Input: cros_ec_keyb - send scancodes in addition to key events Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.4 319/453] Input: goodix - add upside-down quirk for Teclast X98 Pro tablet Greg Kroah-Hartman
                   ` (138 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Arnd Bergmann, Nathan Chancellor,
	Nick Desaulniers, Barret Rhoden, Andrew Morton, Linus Torvalds,
	Sasha Levin

From: Arnd Bergmann <arnd@arndb.de>

[ Upstream commit 55d5b7dd6451b58489ce384282ca5a4a289eb8d5 ]

There is only one function in init/initramfs.c that is in the .text
section, and it is marked __weak.  When building with clang-12 and the
integrated assembler, this leads to a bug with recordmcount:

  ./scripts/recordmcount  "init/initramfs.o"
  Cannot find symbol for section 2: .text.
  init/initramfs.o: failed

I'm not quite sure what exactly goes wrong, but I notice that this
function is only ever called from an __init function, and normally
inlined.  Marking it __init as well is clearly correct and it leads to
recordmcount no longer complaining.

Link: https://lkml.kernel.org/r/20201204165742.3815221-1-arnd@kernel.org
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Cc: Nathan Chancellor <natechancellor@gmail.com>
Cc: Nick Desaulniers <ndesaulniers@google.com>
Cc: Barret Rhoden <brho@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 init/initramfs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/init/initramfs.c b/init/initramfs.c
index 5feee4f616d55..00a32799a38b0 100644
--- a/init/initramfs.c
+++ b/init/initramfs.c
@@ -527,7 +527,7 @@ extern unsigned long __initramfs_size;
 #include <linux/initrd.h>
 #include <linux/kexec.h>
 
-void __weak free_initrd_mem(unsigned long start, unsigned long end)
+void __weak __init free_initrd_mem(unsigned long start, unsigned long end)
 {
 	free_reserved_area((void *)start, (void *)end, POISON_FREE_INITMEM,
 			"initrd");
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 319/453] Input: goodix - add upside-down quirk for Teclast X98 Pro tablet
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (316 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.4 318/453] initramfs: fix clang build failure Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.4 320/453] vfio/pci/nvlink2: Do not attempt NPU2 setup on POWER8NVL NPU Greg Kroah-Hartman
                   ` (137 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Simon Beginn, Bastien Nocera,
	Dmitry Torokhov, Sasha Levin

From: Simon Beginn <linux@simonmicro.de>

[ Upstream commit cffdd6d90482316e18d686060a4397902ea04bd2 ]

The touchscreen on the Teclast x98 Pro is also mounted upside-down in
relation to the display orientation.

Signed-off-by: Simon Beginn <linux@simonmicro.de>
Signed-off-by: Bastien Nocera <hadess@hadess.net>
Link: https://lore.kernel.org/r/20201117004253.27A5A27EFD@localhost
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/input/touchscreen/goodix.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/drivers/input/touchscreen/goodix.c b/drivers/input/touchscreen/goodix.c
index 37b35ab97beb2..bfb945fc33a17 100644
--- a/drivers/input/touchscreen/goodix.c
+++ b/drivers/input/touchscreen/goodix.c
@@ -137,6 +137,18 @@ static const struct dmi_system_id rotated_screen[] = {
 			DMI_MATCH(DMI_BIOS_DATE, "12/19/2014"),
 		},
 	},
+	{
+		.ident = "Teclast X98 Pro",
+		.matches = {
+			/*
+			 * Only match BIOS date, because the manufacturers
+			 * BIOS does not report the board name at all
+			 * (sometimes)...
+			 */
+			DMI_MATCH(DMI_BOARD_VENDOR, "TECLAST"),
+			DMI_MATCH(DMI_BIOS_DATE, "10/28/2015"),
+		},
+	},
 	{
 		.ident = "WinBook TW100",
 		.matches = {
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 469+ messages in thread

* [PATCH 5.4 320/453] vfio/pci/nvlink2: Do not attempt NPU2 setup on POWER8NVL NPU
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (317 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.4 319/453] Input: goodix - add upside-down quirk for Teclast X98 Pro tablet Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.4 321/453] media: gspca: Fix memory leak in probe Greg Kroah-Hartman
                   ` (136 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Alexey Kardashevskiy, Alex Williamson

From: Alexey Kardashevskiy <aik@ozlabs.ru>

commit d22f9a6c92de96304c81792942ae7c306f08ac77 upstream.

We execute certain NPU2 setup code (such as mapping an LPID to a device
in NPU2) unconditionally if an Nvlink bridge is detected. However this
cannot succeed on POWER8NVL machines as the init helpers return an error
other than ENODEV which means the device is there is and setup failed so
vfio_pci_enable() fails and pass through is not possible.

This changes the two NPU2 related init helpers to return -ENODEV if
there is no "memory-region" device tree property as this is
the distinction between NPU and NPU2.

Tested on
- POWER9 pvr=004e1201, Ubuntu 19.04 host, Ubuntu 18.04 vm,
  NVIDIA GV100 10de:1db1 driver 418.39
- POWER8 pvr=004c0100, RHEL 7.6 host, Ubuntu 16.10 vm,
  NVIDIA P100 10de:15f9 driver 396.47

Fixes: 7f92891778df ("vfio_pci: Add NVIDIA GV100GL [Tesla V100 SXM2] subdriver")
Cc: stable@vger.kernel.org # 5.0
Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/vfio/pci/vfio_pci_nvlink2.c |    7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

--- a/drivers/vfio/pci/vfio_pci_nvlink2.c
+++ b/drivers/vfio/pci/vfio_pci_nvlink2.c
@@ -231,7 +231,7 @@ int vfio_pci_nvdia_v100_nvlink2_init(str
 		return -EINVAL;
 
 	if (of_property_read_u32(npu_node, "memory-region", &mem_phandle))
-		return -EINVAL;
+		return -ENODEV;
 
 	mem_node = of_find_node_by_phandle(mem_phandle);
 	if (!mem_node)
@@ -393,7 +393,7 @@ int vfio_pci_ibm_npu2_init(struct vfio_p
 	int ret;
 	struct vfio_pci_npu2_data *data;
 	struct device_node *nvlink_dn;
-	u32 nvlink_index = 0;
+	u32 nvlink_index = 0, mem_phandle = 0;
 	struct pci_dev *npdev = vdev->pdev;
 	struct device_node *npu_node = pci_device_to_OF_node(npdev);
 	struct pci_controller *hose = pci_bus_to_host(npdev->bus);
@@ -408,6 +408,9 @@ int vfio_pci_ibm_npu2_init(struct vfio_p
 	if (!pnv_pci_get_gpu_dev(vdev->pdev))
 		return -ENODEV;
 
+	if (of_property_read_u32(npu_node, "memory-region", &mem_phandle))
+		return -ENODEV;
+
 	/*
 	 * NPU2 normally has 8 ATSD registers (for concurrency) and 6 links
 	 * so we can allocate one register per link, using nvlink index as



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 321/453] media: gspca: Fix memory leak in probe
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (318 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.4 320/453] vfio/pci/nvlink2: Do not attempt NPU2 setup on POWER8NVL NPU Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.4 322/453] media: sunxi-cir: ensure IR is handled when it is continuous Greg Kroah-Hartman
                   ` (135 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Alan Stern, Hans Verkuil,
	Mauro Carvalho Chehab, syzbot+44e64397bd81d5e84cba

From: Alan Stern <stern@rowland.harvard.edu>

commit e469d0b09a19496e1972a20974bbf55b728151eb upstream.

The gspca driver leaks memory when a probe fails.  gspca_dev_probe2()
calls v4l2_device_register(), which takes a reference to the
underlying device node (in this case, a USB interface).  But the
failure pathway neglects to call v4l2_device_unregister(), the routine
responsible for dropping this reference.  Consequently the memory for
the USB interface and its device never gets released.

This patch adds the missing function call.

Reported-and-tested-by: syzbot+44e64397bd81d5e84cba@syzkaller.appspotmail.com

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
CC: <stable@vger.kernel.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/media/usb/gspca/gspca.c |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/media/usb/gspca/gspca.c
+++ b/drivers/media/usb/gspca/gspca.c
@@ -1575,6 +1575,7 @@ out:
 		input_unregister_device(gspca_dev->input_dev);
 #endif
 	v4l2_ctrl_handler_free(gspca_dev->vdev.ctrl_handler);
+	v4l2_device_unregister(&gspca_dev->v4l2_dev);
 	kfree(gspca_dev->usb_buf);
 	kfree(gspca_dev);
 	return ret;



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 322/453] media: sunxi-cir: ensure IR is handled when it is continuous
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (319 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.4 321/453] media: gspca: Fix memory leak in probe Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.4 323/453] media: netup_unidvb: Dont leak SPI master in probe error path Greg Kroah-Hartman
                   ` (134 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hans Verkuil, Maxime Ripard,
	Sean Young, Mauro Carvalho Chehab

From: Sean Young <sean@mess.org>

commit 3f56df4c8ffeb120ed41906d3aae71799b7e726a upstream.

If a user holds a button down on a remote, then no ir idle interrupt will
be generated until the user releases the button, depending on how quickly
the remote repeats. No IR is processed until that point, which means that
holding down a button may not do anything.

This also resolves an issue on a Cubieboard 1 where the IR receiver is
picking up ambient infrared as IR and spews out endless
"rc rc0: IR event FIFO is full!" messages unless you choose to live in
the dark.

Cc: stable@vger.kernel.org
Tested-by: Hans Verkuil <hverkuil@xs4all.nl>
Acked-by: Maxime Ripard <mripard@kernel.org>
Reported-by: Hans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/media/rc/sunxi-cir.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/drivers/media/rc/sunxi-cir.c
+++ b/drivers/media/rc/sunxi-cir.c
@@ -137,6 +137,8 @@ static irqreturn_t sunxi_ir_irq(int irqn
 	} else if (status & REG_RXSTA_RPE) {
 		ir_raw_event_set_idle(ir->rc, true);
 		ir_raw_event_handle(ir->rc);
+	} else {
+		ir_raw_event_handle(ir->rc);
 	}
 
 	spin_unlock(&ir->ir_lock);



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 323/453] media: netup_unidvb: Dont leak SPI master in probe error path
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (320 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.4 322/453] media: sunxi-cir: ensure IR is handled when it is continuous Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.4 324/453] media: ipu3-cio2: Remove traces of returned buffers Greg Kroah-Hartman
                   ` (133 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lukas Wunner, Mauro Carvalho Chehab,
	Kozlov Sergey, Mark Brown

From: Lukas Wunner <lukas@wunner.de>

commit e297ddf296de35037fa97f4302782def196d350a upstream.

If the call to spi_register_master() fails on probe of the NetUP
Universal DVB driver, the spi_master struct is erroneously not freed.

Likewise, if spi_new_device() fails, the spi_controller struct is
not unregistered.  Plug the leaks.

While at it, fix an ordering issue in netup_spi_release() wherein
spi_unregister_master() is called after fiddling with the IRQ control
register.  The correct order is to call spi_unregister_master() *before*
this teardown step because bus accesses may still be ongoing until that
function returns.

Fixes: 52b1eaf4c59a ("[media] netup_unidvb: NetUP Universal DVB-S/S2/T/T2/C PCI-E card driver")
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Reviewed-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Cc: <stable@vger.kernel.org> # v4.3+: 5e844cc37a5c: spi: Introduce device-managed SPI controller allocation
Cc: <stable@vger.kernel.org> # v4.3+
Cc: Kozlov Sergey <serjk@netup.ru>
Link: https://lore.kernel.org/r/c4c24f333fc7840f4a3db24789e6e10dd660bede.1607286887.git.lukas@wunner.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/media/pci/netup_unidvb/netup_unidvb_spi.c |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

--- a/drivers/media/pci/netup_unidvb/netup_unidvb_spi.c
+++ b/drivers/media/pci/netup_unidvb/netup_unidvb_spi.c
@@ -175,7 +175,7 @@ int netup_spi_init(struct netup_unidvb_d
 	struct spi_master *master;
 	struct netup_spi *nspi;
 
-	master = spi_alloc_master(&ndev->pci_dev->dev,
+	master = devm_spi_alloc_master(&ndev->pci_dev->dev,
 		sizeof(struct netup_spi));
 	if (!master) {
 		dev_err(&ndev->pci_dev->dev,
@@ -208,6 +208,7 @@ int netup_spi_init(struct netup_unidvb_d
 		ndev->pci_slot,
 		ndev->pci_func);
 	if (!spi_new_device(master, &netup_spi_board)) {
+		spi_unregister_master(master);
 		ndev->spi = NULL;
 		dev_err(&ndev->pci_dev->dev,
 			"%s(): unable to create SPI device\n", __func__);
@@ -226,13 +227,13 @@ void netup_spi_release(struct netup_unid
 	if (!spi)
 		return;
 
+	spi_unregister_master(spi->master);
 	spin_lock_irqsave(&spi->lock, flags);
 	reg = readw(&spi->regs->control_stat);
 	writew(reg | NETUP_SPI_CTRL_IRQ, &spi->regs->control_stat);
 	reg = readw(&spi->regs->control_stat);
 	writew(reg & ~NETUP_SPI_CTRL_IMASK, &spi->regs->control_stat);
 	spin_unlock_irqrestore(&spi->lock, flags);
-	spi_unregister_master(spi->master);
 	ndev->spi = NULL;
 }
 



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 324/453] media: ipu3-cio2: Remove traces of returned buffers
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (321 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.4 323/453] media: netup_unidvb: Dont leak SPI master in probe error path Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.4 325/453] media: ipu3-cio2: Return actual subdev format Greg Kroah-Hartman
                   ` (132 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sakari Ailus, Andy Shevchenko,
	Laurent Pinchart, Mauro Carvalho Chehab

From: Sakari Ailus <sakari.ailus@linux.intel.com>

commit 61e7f892b5ee1dd10ea8bff805f3c3fe6e535959 upstream.

If starting a video buffer queue fails, the buffers are returned to
videobuf2. Remove the reference to the buffer from the driver's queue as
well.

Fixes: c2a6a07afe4a ("media: intel-ipu3: cio2: add new MIPI-CSI2 driver")
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Cc: stable@vger.kernel.org # v4.16 and up
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/media/pci/intel/ipu3/ipu3-cio2.c |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/media/pci/intel/ipu3/ipu3-cio2.c
+++ b/drivers/media/pci/intel/ipu3/ipu3-cio2.c
@@ -799,6 +799,7 @@ static void cio2_vb2_return_all_buffers(
 			atomic_dec(&q->bufs_queued);
 			vb2_buffer_done(&q->bufs[i]->vbb.vb2_buf,
 					state);
+			q->bufs[i] = NULL;
 		}
 	}
 }



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 325/453] media: ipu3-cio2: Return actual subdev format
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (322 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.4 324/453] media: ipu3-cio2: Remove traces of returned buffers Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.4 326/453] media: ipu3-cio2: Serialise access to pad format Greg Kroah-Hartman
                   ` (131 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Tsuchiya Yuto, Sakari Ailus,
	Laurent Pinchart, Bingbu Cao, Andy Shevchenko,
	Mauro Carvalho Chehab

From: Sakari Ailus <sakari.ailus@linux.intel.com>

commit 8160e86702e0807bd36d40f82648f9f9820b9d5a upstream.

Return actual subdev format on ipu3-cio2 subdev pads. The earlier
implementation was based on an infinite recursion that exhausted the
stack.

Reported-by: Tsuchiya Yuto <kitakar@gmail.com>
Fixes: c2a6a07afe4a ("media: intel-ipu3: cio2: add new MIPI-CSI2 driver")
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Reviewed-by: Bingbu Cao <bingbu.cao@intel.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Cc: stable@vger.kernel.org # v4.16 and up
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/media/pci/intel/ipu3/ipu3-cio2.c |   24 +++---------------------
 1 file changed, 3 insertions(+), 21 deletions(-)

--- a/drivers/media/pci/intel/ipu3/ipu3-cio2.c
+++ b/drivers/media/pci/intel/ipu3/ipu3-cio2.c
@@ -1244,29 +1244,11 @@ static int cio2_subdev_get_fmt(struct v4
 			       struct v4l2_subdev_format *fmt)
 {
 	struct cio2_queue *q = container_of(sd, struct cio2_queue, subdev);
-	struct v4l2_subdev_format format;
-	int ret;
 
-	if (fmt->which == V4L2_SUBDEV_FORMAT_TRY) {
+	if (fmt->which == V4L2_SUBDEV_FORMAT_TRY)
 		fmt->format = *v4l2_subdev_get_try_format(sd, cfg, fmt->pad);
-		return 0;
-	}
-
-	if (fmt->pad == CIO2_PAD_SINK) {
-		format.which = V4L2_SUBDEV_FORMAT_ACTIVE;
-		ret = v4l2_subdev_call(sd, pad, get_fmt, NULL,
-				       &format);
-
-		if (ret)
-			return ret;
-		/* update colorspace etc */
-		q->subdev_fmt.colorspace = format.format.colorspace;
-		q->subdev_fmt.ycbcr_enc = format.format.ycbcr_enc;
-		q->subdev_fmt.quantization = format.format.quantization;
-		q->subdev_fmt.xfer_func = format.format.xfer_func;
-	}
-
-	fmt->format = q->subdev_fmt;
+	else
+		fmt->format = q->subdev_fmt;
 
 	return 0;
 }



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 326/453] media: ipu3-cio2: Serialise access to pad format
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (323 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.4 325/453] media: ipu3-cio2: Return actual subdev format Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.4 327/453] media: ipu3-cio2: Validate mbus format in setting subdev format Greg Kroah-Hartman
                   ` (130 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sakari Ailus, Laurent Pinchart,
	Bingbu Cao, Andy Shevchenko, Mauro Carvalho Chehab

From: Sakari Ailus <sakari.ailus@linux.intel.com>

commit 55a6c6b2be3d6670bf5772364d8208bd8dc17da4 upstream.

Pad format can be accessed from user space. Serialise access to it.

Fixes: c2a6a07afe4a ("media: intel-ipu3: cio2: add new MIPI-CSI2 driver")
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Reviewed-by: Bingbu Cao <bingbu.cao@intel.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Cc: stable@vger.kernel.org # v4.16 and up
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/media/pci/intel/ipu3/ipu3-cio2.c |   11 +++++++++++
 drivers/media/pci/intel/ipu3/ipu3-cio2.h |    1 +
 2 files changed, 12 insertions(+)

--- a/drivers/media/pci/intel/ipu3/ipu3-cio2.c
+++ b/drivers/media/pci/intel/ipu3/ipu3-cio2.c
@@ -1245,11 +1245,15 @@ static int cio2_subdev_get_fmt(struct v4
 {
 	struct cio2_queue *q = container_of(sd, struct cio2_queue, subdev);
 
+	mutex_lock(&q->subdev_lock);
+
 	if (fmt->which == V4L2_SUBDEV_FORMAT_TRY)
 		fmt->format = *v4l2_subdev_get_try_format(sd, cfg, fmt->pad);
 	else
 		fmt->format = q->subdev_fmt;
 
+	mutex_unlock(&q->subdev_lock);
+
 	return 0;
 }
 
@@ -1273,6 +1277,8 @@ static int cio2_subdev_set_fmt(struct v4
 	if (fmt->pad == CIO2_PAD_SOURCE)
 		return cio2_subdev_get_fmt(sd, cfg, fmt);
 
+	mutex_lock(&q->subdev_lock);
+
 	if (fmt->which == V4L2_SUBDEV_FORMAT_TRY) {
 		*v4l2_subdev_get_try_format(sd, cfg, fmt->pad) = fmt->format;
 	} else {
@@ -1283,6 +1289,8 @@ static int cio2_subdev_set_fmt(struct v4
 		fmt->format = q->subdev_fmt;
 	}
 
+	mutex_unlock(&q->subdev_lock);
+
 	return 0;
 }
 
@@ -1541,6 +1549,7 @@ static int cio2_queue_init(struct cio2_d
 
 	/* Initialize miscellaneous variables */
 	mutex_init(&q->lock);
+	mutex_init(&q->subdev_lock);
 
 	/* Initialize formats to default values */
 	fmt = &q->subdev_fmt;
@@ -1659,6 +1668,7 @@ fail_vdev_media_entity:
 fail_subdev_media_entity:
 	cio2_fbpt_exit(q, &cio2->pci_dev->dev);
 fail_fbpt:
+	mutex_destroy(&q->subdev_lock);
 	mutex_destroy(&q->lock);
 
 	return r;
@@ -1672,6 +1682,7 @@ static void cio2_queue_exit(struct cio2_
 	v4l2_device_unregister_subdev(&q->subdev);
 	media_entity_cleanup(&q->subdev.entity);
 	cio2_fbpt_exit(q, &cio2->pci_dev->dev);
+	mutex_destroy(&q->subdev_lock);
 	mutex_destroy(&q->lock);
 }
 
--- a/drivers/media/pci/intel/ipu3/ipu3-cio2.h
+++ b/drivers/media/pci/intel/ipu3/ipu3-cio2.h
@@ -332,6 +332,7 @@ struct cio2_queue {
 
 	/* Subdev, /dev/v4l-subdevX */
 	struct v4l2_subdev subdev;
+	struct mutex subdev_lock; /* Serialise acces to subdev_fmt field */
 	struct media_pad subdev_pads[CIO2_PADS];
 	struct v4l2_mbus_framefmt subdev_fmt;
 	atomic_t frame_sequence;



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 327/453] media: ipu3-cio2: Validate mbus format in setting subdev format
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (324 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.4 326/453] media: ipu3-cio2: Serialise access to pad format Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.4 328/453] media: ipu3-cio2: Make the field on subdev format V4L2_FIELD_NONE Greg Kroah-Hartman
                   ` (129 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sakari Ailus, Andy Shevchenko,
	Laurent Pinchart, Mauro Carvalho Chehab

From: Sakari Ailus <sakari.ailus@linux.intel.com>

commit a86cf9b29e8b12811cf53c4970eefe0c1d290476 upstream.

Validate media bus code, width and height when setting the subdev format.

This effectively reworks how setting subdev format is implemented in the
driver.

Fixes: c2a6a07afe4a ("media: intel-ipu3: cio2: add new MIPI-CSI2 driver")
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Cc: stable@vger.kernel.org # v4.16 and up
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/media/pci/intel/ipu3/ipu3-cio2.c |   29 ++++++++++++++++++++---------
 1 file changed, 20 insertions(+), 9 deletions(-)

--- a/drivers/media/pci/intel/ipu3/ipu3-cio2.c
+++ b/drivers/media/pci/intel/ipu3/ipu3-cio2.c
@@ -1269,6 +1269,9 @@ static int cio2_subdev_set_fmt(struct v4
 			       struct v4l2_subdev_format *fmt)
 {
 	struct cio2_queue *q = container_of(sd, struct cio2_queue, subdev);
+	struct v4l2_mbus_framefmt *mbus;
+	u32 mbus_code = fmt->format.code;
+	unsigned int i;
 
 	/*
 	 * Only allow setting sink pad format;
@@ -1277,18 +1280,26 @@ static int cio2_subdev_set_fmt(struct v4
 	if (fmt->pad == CIO2_PAD_SOURCE)
 		return cio2_subdev_get_fmt(sd, cfg, fmt);
 
-	mutex_lock(&q->subdev_lock);
+	if (fmt->which == V4L2_SUBDEV_FORMAT_TRY)
+		mbus = v4l2_subdev_get_try_format(sd, cfg, fmt->pad);
+	else
+		mbus = &q->subdev_fmt;
+
+	fmt->format.code = formats[0].mbus_code;
 
-	if (fmt->which == V4L2_SUBDEV_FORMAT_TRY) {
-		*v4l2_subdev_get_try_format(sd, cfg, fmt->pad) = fmt->format;
-	} else {
-		/* It's the sink, allow changing frame size */
-		q->subdev_fmt.width = fmt->format.width;
-		q->subdev_fmt.height = fmt->format.height;
-		q->subdev_fmt.code = fmt->format.code;
-		fmt->format = q->subdev_fmt;
+	for (i = 0; i < ARRAY_SIZE(formats); i++) {
+		if (formats[i].mbus_code == fmt->format.code) {
+			fmt->format.code = mbus_code;
+			break;
+		}
 	}
 
+	fmt->format.width = min_t(u32, fmt->format.width, CIO2_IMAGE_MAX_WIDTH);
+	fmt->format.height = min_t(u32, fmt->format.height,
+				   CIO2_IMAGE_MAX_LENGTH);
+
+	mutex_lock(&q->subdev_lock);
+	*mbus = fmt->format;
 	mutex_unlock(&q->subdev_lock);
 
 	return 0;



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 328/453] media: ipu3-cio2: Make the field on subdev format V4L2_FIELD_NONE
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (325 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.4 327/453] media: ipu3-cio2: Validate mbus format in setting subdev format Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.4 329/453] Input: cyapa_gen6 - fix out-of-bounds stack access Greg Kroah-Hartman
                   ` (128 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sakari Ailus, Bingbu Cao,
	Andy Shevchenko, Laurent Pinchart, Mauro Carvalho Chehab

From: Sakari Ailus <sakari.ailus@linux.intel.com>

commit 219a8b9c04e54872f9a4d566633fb42f08bcbe2a upstream.

The ipu3-cio2 doesn't make use of the field and this is reflected in V4L2
buffers as well as the try format. Do this in active format, too.

Fixes: c2a6a07afe4a ("media: intel-ipu3: cio2: add new MIPI-CSI2 driver")
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Reviewed-by: Bingbu Cao <bingbu.cao@intel.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Cc: stable@vger.kernel.org # v4.16 and up
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/media/pci/intel/ipu3/ipu3-cio2.c |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/media/pci/intel/ipu3/ipu3-cio2.c
+++ b/drivers/media/pci/intel/ipu3/ipu3-cio2.c
@@ -1297,6 +1297,7 @@ static int cio2_subdev_set_fmt(struct v4
 	fmt->format.width = min_t(u32, fmt->format.width, CIO2_IMAGE_MAX_WIDTH);
 	fmt->format.height = min_t(u32, fmt->format.height,
 				   CIO2_IMAGE_MAX_LENGTH);
+	fmt->format.field = V4L2_FIELD_NONE;
 
 	mutex_lock(&q->subdev_lock);
 	*mbus = fmt->format;



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 329/453] Input: cyapa_gen6 - fix out-of-bounds stack access
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (326 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.4 328/453] media: ipu3-cio2: Make the field on subdev format V4L2_FIELD_NONE Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.4 330/453] ALSA: hda/ca0132 - Change Input Source enum strings Greg Kroah-Hartman
                   ` (127 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Arnd Bergmann, Dmitry Torokhov

From: Arnd Bergmann <arnd@arndb.de>

commit f051ae4f6c732c231046945b36234e977f8467c6 upstream.

gcc -Warray-bounds warns about a serious bug in
cyapa_pip_retrieve_data_structure:

drivers/input/mouse/cyapa_gen6.c: In function 'cyapa_pip_retrieve_data_structure.constprop':
include/linux/unaligned/access_ok.h:40:17: warning: array subscript -1 is outside array bounds of 'struct retrieve_data_struct_cmd[1]' [-Warray-bounds]
   40 |  *((__le16 *)p) = cpu_to_le16(val);
drivers/input/mouse/cyapa_gen6.c:569:13: note: while referencing 'cmd'
  569 |  } __packed cmd;
      |             ^~~

Apparently the '-2' was added to the pointer instead of the value,
writing garbage into the stack next to this variable.

Fixes: c2c06c41f700 ("Input: cyapa - add gen6 device module support")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Link: https://lore.kernel.org/r/20201026161332.3708389-1-arnd@kernel.org
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/input/mouse/cyapa_gen6.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/input/mouse/cyapa_gen6.c
+++ b/drivers/input/mouse/cyapa_gen6.c
@@ -573,7 +573,7 @@ static int cyapa_pip_retrieve_data_struc
 
 	memset(&cmd, 0, sizeof(cmd));
 	put_unaligned_le16(PIP_OUTPUT_REPORT_ADDR, &cmd.head.addr);
-	put_unaligned_le16(sizeof(cmd), &cmd.head.length - 2);
+	put_unaligned_le16(sizeof(cmd) - 2, &cmd.head.length);
 	cmd.head.report_id = PIP_APP_CMD_REPORT_ID;
 	cmd.head.cmd_code = PIP_RETRIEVE_DATA_STRUCTURE;
 	put_unaligned_le16(read_offset, &cmd.read_offset);



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 330/453] ALSA: hda/ca0132 - Change Input Source enum strings.
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (327 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.4 329/453] Input: cyapa_gen6 - fix out-of-bounds stack access Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.4 331/453] PM: ACPI: PCI: Drop acpi_pm_set_bridge_wakeup() Greg Kroah-Hartman
                   ` (126 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, stable, Connor McAdams, Takashi Iwai

From: Connor McAdams <conmanx360@gmail.com>

commit 7079f785b50055a32b72eddcb7d9ba5688db24d0 upstream.

Change the Input Source enumerated control's strings to make it play
nice with pulseaudio.

Fixes: 7cb9d94c05de9 ("ALSA: hda/ca0132: add alt_select_in/out for R3Di + SBZ")
Cc: <stable@kernel.org>
Signed-off-by: Connor McAdams <conmanx360@gmail.com>
Link: https://lore.kernel.org/r/20201208195223.424753-2-conmanx360@gmail.com
Link: https://lore.kernel.org/r/20201210173550.2968-2-conmanx360@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/pci/hda/patch_ca0132.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/sound/pci/hda/patch_ca0132.c
+++ b/sound/pci/hda/patch_ca0132.c
@@ -93,7 +93,7 @@ enum {
 };
 
 /* Strings for Input Source Enum Control */
-static const char *const in_src_str[3] = {"Rear Mic", "Line", "Front Mic" };
+static const char *const in_src_str[3] = { "Microphone", "Line In", "Front Microphone" };
 #define IN_SRC_NUM_OF_INPUTS 3
 enum {
 	REAR_MIC,



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 331/453] PM: ACPI: PCI: Drop acpi_pm_set_bridge_wakeup()
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (328 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.4 330/453] ALSA: hda/ca0132 - Change Input Source enum strings Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.4 332/453] Revert "ACPI / resources: Use AE_CTRL_TERMINATE to terminate resources walks" Greg Kroah-Hartman
                   ` (125 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Rafael J. Wysocki, Mika Westerberg,
	Bjorn Helgaas

From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>

commit 7482c5cb90e5a7f9e9e12dd154d405e0219656e3 upstream.

The idea behind acpi_pm_set_bridge_wakeup() was to allow bridges to
be reference counted for wakeup enabling, because they may be enabled
to signal wakeup on behalf of their subordinate devices and that
may happen for multiple times in a row, whereas for the other devices
it only makes sense to enable wakeup signaling once.

However, this becomes problematic if the bridge itself is suspended,
because it is treated as a "regular" device in that case and the
reference counting doesn't work.

For instance, suppose that there are two devices below a bridge and
they both can signal wakeup.  Every time one of them is suspended,
wakeup signaling is enabled for the bridge, so when they both have
been suspended, the bridge's wakeup reference counter value is 2.

Say that the bridge is suspended subsequently and acpi_pci_wakeup()
is called for it.  Because the bridge can signal wakeup, that
function will invoke acpi_pm_set_device_wakeup() to configure it
and __acpi_pm_set_device_wakeup() will be called with the last
argument equal to 1.  This causes __acpi_device_wakeup_enable()
invoked by it to omit the reference counting, because the reference
counter of the target device (the bridge) is 2 at that time.

Now say that the bridge resumes and one of the device below it
resumes too, so the bridge's reference counter becomes 0 and
wakeup signaling is disabled for it, but there is still the other
suspended device which may need the bridge to signal wakeup on its
behalf and that is not going to work.

To address this scenario, use wakeup enable reference counting for
all devices, not just for bridges, so drop the last argument from
__acpi_device_wakeup_enable() and __acpi_pm_set_device_wakeup(),
which causes acpi_pm_set_device_wakeup() and
acpi_pm_set_bridge_wakeup() to become identical, so drop the latter
and use the former instead of it everywhere.

Fixes: 1ba51a7c1496 ("ACPI / PCI / PM: Rework acpi_pci_propagate_wakeup()")
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Acked-by: Bjorn Helgaas <bhelgaas@google.com>
Cc: 4.14+ <stable@vger.kernel.org> # 4.14+
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/acpi/device_pm.c |   41 ++++++++++++-----------------------------
 drivers/pci/pci-acpi.c   |    4 ++--
 include/acpi/acpi_bus.h  |    5 -----
 3 files changed, 14 insertions(+), 36 deletions(-)

--- a/drivers/acpi/device_pm.c
+++ b/drivers/acpi/device_pm.c
@@ -749,7 +749,7 @@ static void acpi_pm_notify_work_func(str
 static DEFINE_MUTEX(acpi_wakeup_lock);
 
 static int __acpi_device_wakeup_enable(struct acpi_device *adev,
-				       u32 target_state, int max_count)
+				       u32 target_state)
 {
 	struct acpi_device_wakeup *wakeup = &adev->wakeup;
 	acpi_status status;
@@ -757,9 +757,10 @@ static int __acpi_device_wakeup_enable(s
 
 	mutex_lock(&acpi_wakeup_lock);
 
-	if (wakeup->enable_count >= max_count)
+	if (wakeup->enable_count >= INT_MAX) {
+		acpi_handle_info(adev->handle, "Wakeup enable count out of bounds!\n");
 		goto out;
-
+	}
 	if (wakeup->enable_count > 0)
 		goto inc;
 
@@ -799,7 +800,7 @@ out:
  */
 static int acpi_device_wakeup_enable(struct acpi_device *adev, u32 target_state)
 {
-	return __acpi_device_wakeup_enable(adev, target_state, 1);
+	return __acpi_device_wakeup_enable(adev, target_state);
 }
 
 /**
@@ -829,8 +830,12 @@ out:
 	mutex_unlock(&acpi_wakeup_lock);
 }
 
-static int __acpi_pm_set_device_wakeup(struct device *dev, bool enable,
-				       int max_count)
+/**
+ * acpi_pm_set_device_wakeup - Enable/disable remote wakeup for given device.
+ * @dev: Device to enable/disable to generate wakeup events.
+ * @enable: Whether to enable or disable the wakeup functionality.
+ */
+int acpi_pm_set_device_wakeup(struct device *dev, bool enable)
 {
 	struct acpi_device *adev;
 	int error;
@@ -850,37 +855,15 @@ static int __acpi_pm_set_device_wakeup(s
 		return 0;
 	}
 
-	error = __acpi_device_wakeup_enable(adev, acpi_target_system_state(),
-					    max_count);
+	error = __acpi_device_wakeup_enable(adev, acpi_target_system_state());
 	if (!error)
 		dev_dbg(dev, "Wakeup enabled by ACPI\n");
 
 	return error;
 }
-
-/**
- * acpi_pm_set_device_wakeup - Enable/disable remote wakeup for given device.
- * @dev: Device to enable/disable to generate wakeup events.
- * @enable: Whether to enable or disable the wakeup functionality.
- */
-int acpi_pm_set_device_wakeup(struct device *dev, bool enable)
-{
-	return __acpi_pm_set_device_wakeup(dev, enable, 1);
-}
 EXPORT_SYMBOL_GPL(acpi_pm_set_device_wakeup);
 
 /**
- * acpi_pm_set_bridge_wakeup - Enable/disable remote wakeup for given bridge.
- * @dev: Bridge device to enable/disable to generate wakeup events.
- * @enable: Whether to enable or disable the wakeup functionality.
- */
-int acpi_pm_set_bridge_wakeup(struct device *dev, bool enable)
-{
-	return __acpi_pm_set_device_wakeup(dev, enable, INT_MAX);
-}
-EXPORT_SYMBOL_GPL(acpi_pm_set_bridge_wakeup);
-
-/**
  * acpi_dev_pm_low_power - Put ACPI device into a low-power state.
  * @dev: Device to put into a low-power state.
  * @adev: ACPI device node corresponding to @dev.
--- a/drivers/pci/pci-acpi.c
+++ b/drivers/pci/pci-acpi.c
@@ -1060,7 +1060,7 @@ static int acpi_pci_propagate_wakeup(str
 {
 	while (bus->parent) {
 		if (acpi_pm_device_can_wakeup(&bus->self->dev))
-			return acpi_pm_set_bridge_wakeup(&bus->self->dev, enable);
+			return acpi_pm_set_device_wakeup(&bus->self->dev, enable);
 
 		bus = bus->parent;
 	}
@@ -1068,7 +1068,7 @@ static int acpi_pci_propagate_wakeup(str
 	/* We have reached the root bus. */
 	if (bus->bridge) {
 		if (acpi_pm_device_can_wakeup(bus->bridge))
-			return acpi_pm_set_bridge_wakeup(bus->bridge, enable);
+			return acpi_pm_set_device_wakeup(bus->bridge, enable);
 	}
 	return 0;
 }
--- a/include/acpi/acpi_bus.h
+++ b/include/acpi/acpi_bus.h
@@ -614,7 +614,6 @@ acpi_status acpi_remove_pm_notifier(stru
 bool acpi_pm_device_can_wakeup(struct device *dev);
 int acpi_pm_device_sleep_state(struct device *, int *, int);
 int acpi_pm_set_device_wakeup(struct device *dev, bool enable);
-int acpi_pm_set_bridge_wakeup(struct device *dev, bool enable);
 #else
 static inline void acpi_pm_wakeup_event(struct device *dev)
 {
@@ -645,10 +644,6 @@ static inline int acpi_pm_set_device_wak
 {
 	return -ENODEV;
 }
-static inline int acpi_pm_set_bridge_wakeup(struct device *dev, bool enable)
-{
-	return -ENODEV;
-}
 #endif
 
 #ifdef CONFIG_ACPI_SYSTEM_POWER_STATES_SUPPORT



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 332/453] Revert "ACPI / resources: Use AE_CTRL_TERMINATE to terminate resources walks"
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (329 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.4 331/453] PM: ACPI: PCI: Drop acpi_pm_set_bridge_wakeup() Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.4 333/453] ACPI: PNP: compare the string length in the matching_id() Greg Kroah-Hartman
                   ` (124 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Daniel Scally, Rafael J. Wysocki

From: Daniel Scally <djrscally@gmail.com>

commit 12fc4dad94dfac25599f31257aac181c691ca96f upstream.

This reverts commit 8a66790b7850a6669129af078768a1d42076a0ef.

Switching this function to AE_CTRL_TERMINATE broke the documented
behaviour of acpi_dev_get_resources() - AE_CTRL_TERMINATE does not, in
fact, terminate the resource walk because acpi_walk_resource_buffer()
ignores it (specifically converting it to AE_OK), referring to that
value as "an OK termination by the user function". This means that
acpi_dev_get_resources() does not abort processing when the preproc
function returns a negative value.

Signed-off-by: Daniel Scally <djrscally@gmail.com>
Cc: 3.10+ <stable@vger.kernel.org> # 3.10+
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/acpi/resource.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/acpi/resource.c
+++ b/drivers/acpi/resource.c
@@ -541,7 +541,7 @@ static acpi_status acpi_dev_process_reso
 		ret = c->preproc(ares, c->preproc_data);
 		if (ret < 0) {
 			c->error = ret;
-			return AE_CTRL_TERMINATE;
+			return AE_ABORT_METHOD;
 		} else if (ret > 0) {
 			return AE_OK;
 		}



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 333/453] ACPI: PNP: compare the string length in the matching_id()
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (330 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.4 332/453] Revert "ACPI / resources: Use AE_CTRL_TERMINATE to terminate resources walks" Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.4 334/453] ALSA: hda: Fix regressions on clear and reconfig sysfs Greg Kroah-Hartman
                   ` (123 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Rafael J. Wysocki, Hui Wang

From: Hui Wang <hui.wang@canonical.com>

commit b08221c40febcbda9309dd70c61cf1b0ebb0e351 upstream.

Recently we met a touchscreen problem on some Thinkpad machines, the
touchscreen driver (i2c-hid) is not loaded and the touchscreen can't
work.

An i2c ACPI device with the name WACF2200 is defined in the BIOS, with
the current rule in matching_id(), this device will be regarded as
a PNP device since there is WACFXXX in the acpi_pnp_device_ids[] and
this PNP device is attached to the acpi device as the 1st
physical_node, this will make the i2c bus match fail when i2c bus
calls acpi_companion_match() to match the acpi_id_table in the i2c-hid
driver.

WACF2200 is an i2c device instead of a PNP device, after adding the
string length comparing, the matching_id() will return false when
matching WACF2200 and WACFXXX, and it is reasonable to compare the
string length when matching two IDs.

Suggested-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Hui Wang <hui.wang@canonical.com>
Cc: All applicable <stable@vger.kernel.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/acpi/acpi_pnp.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/drivers/acpi/acpi_pnp.c
+++ b/drivers/acpi/acpi_pnp.c
@@ -317,6 +317,9 @@ static bool matching_id(const char *idst
 {
 	int i;
 
+	if (strlen(idstr) != strlen(list_id))
+		return false;
+
 	if (memcmp(idstr, list_id, 3))
 		return false;
 



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 334/453] ALSA: hda: Fix regressions on clear and reconfig sysfs
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (331 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.4 333/453] ACPI: PNP: compare the string length in the matching_id() Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.4 335/453] ALSA: hda/ca0132 - Fix AE-5 rear headphone pincfg Greg Kroah-Hartman
                   ` (122 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Takashi Iwai

From: Takashi Iwai <tiwai@suse.de>

commit 2506318e382c4c7daa77bdc48f80a0ee82804588 upstream.

It seems that the HD-audio clear and reconfig sysfs don't work any
longer after the recent driver core change.  There are multiple issues
around that: the linked list corruption and the dead device handling.
The former issue is fixed by another patch for the driver core itself,
while the latter patch needs to be addressed in HD-audio side.

This patch corresponds to the latter, it recovers those broken
functions by replacing the device detach and attach actions with the
standard core API functions, which are almost equivalent with unbind
and bind actions.

Fixes: 654888327e9f ("driver core: Avoid binding drivers to dead devices")
Cc: <stable@vger.kernel.org>
BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=209207
Link: https://lore.kernel.org/r/20201209150119.7705-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/pci/hda/hda_codec.c |    2 +-
 sound/pci/hda/hda_sysfs.c |    2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

--- a/sound/pci/hda/hda_codec.c
+++ b/sound/pci/hda/hda_codec.c
@@ -1798,7 +1798,7 @@ int snd_hda_codec_reset(struct hda_codec
 		return -EBUSY;
 
 	/* OK, let it free */
-	snd_hdac_device_unregister(&codec->core);
+	device_release_driver(hda_codec_dev(codec));
 
 	/* allow device access again */
 	snd_hda_unlock_devices(bus);
--- a/sound/pci/hda/hda_sysfs.c
+++ b/sound/pci/hda/hda_sysfs.c
@@ -139,7 +139,7 @@ static int reconfig_codec(struct hda_cod
 			   "The codec is being used, can't reconfigure.\n");
 		goto error;
 	}
-	err = snd_hda_codec_configure(codec);
+	err = device_reprobe(hda_codec_dev(codec));
 	if (err < 0)
 		goto error;
 	err = snd_card_register(codec->card);



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 335/453] ALSA: hda/ca0132 - Fix AE-5 rear headphone pincfg.
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (332 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.4 334/453] ALSA: hda: Fix regressions on clear and reconfig sysfs Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.4 336/453] ALSA: hda/realtek: make bass spk volume adjustable on a yoga laptop Greg Kroah-Hartman
                   ` (121 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, stable, Connor McAdams, Takashi Iwai

From: Connor McAdams <conmanx360@gmail.com>

commit c697ba85a94b8f65bf90dec5ef9af5c39c3e73b2 upstream.

The Windows driver sets the pincfg for the AE-5's rear-headphone to
report as a microphone. This causes issues with Pulseaudio mistakenly
believing there is no headphone plugged in. In Linux, we should instead
set it to be a headphone.

Fixes: a6b0961b39896 ("ALSA: hda/ca0132 - fix AE-5 pincfg")
Cc: <stable@kernel.org>
Signed-off-by: Connor McAdams <conmanx360@gmail.com>
Link: https://lore.kernel.org/r/20201208195223.424753-1-conmanx360@gmail.com
Link: https://lore.kernel.org/r/20201210173550.2968-1-conmanx360@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/pci/hda/patch_ca0132.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/sound/pci/hda/patch_ca0132.c
+++ b/sound/pci/hda/patch_ca0132.c
@@ -1147,7 +1147,7 @@ static const struct hda_pintbl ae5_pincf
 	{ 0x0e, 0x01c510f0 }, /* SPDIF In */
 	{ 0x0f, 0x01017114 }, /* Port A -- Rear L/R. */
 	{ 0x10, 0x01017012 }, /* Port D -- Center/LFE or FP Hp */
-	{ 0x11, 0x01a170ff }, /* Port B -- LineMicIn2 / Rear Headphone */
+	{ 0x11, 0x012170ff }, /* Port B -- LineMicIn2 / Rear Headphone */
 	{ 0x12, 0x01a170f0 }, /* Port C -- LineIn1 */
 	{ 0x13, 0x908700f0 }, /* What U Hear In*/
 	{ 0x18, 0x50d000f0 }, /* N/A */



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 336/453] ALSA: hda/realtek: make bass spk volume adjustable on a yoga laptop
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (333 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.4 335/453] ALSA: hda/ca0132 - Fix AE-5 rear headphone pincfg Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.4 337/453] ALSA: hda/realtek - Enable headset mic of ASUS X430UN with ALC256 Greg Kroah-Hartman
                   ` (120 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Hui Wang, Takashi Iwai

From: Hui Wang <hui.wang@canonical.com>

commit c72b9bfe0f914639cc475585f45722a3eb57a56d upstream.

This change could fix 2 issues on this machine:
 - the bass speaker's output volume can't be adjusted, that is because
   the bass speaker is routed to the DAC (Nid 0x6) which has no volume
   control.
 - after plugging a headset with vol+, vol- and pause buttons on it,
   press those buttons, nothing happens, this means those buttons
   don't work at all. This machine has alc287 codec, need to add the
   codec id to the disable/enable_headset_jack_key(), then the headset
   button could work.

The quirk of ALC285_FIXUP_THINKPAD_HEADSET_JACK could fix both of these
2 issues.

Cc: <stable@vger.kernel.org>
Signed-off-by: Hui Wang <hui.wang@canonical.com>
Link: https://lore.kernel.org/r/20201205051130.8122-1-hui.wang@canonical.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/pci/hda/patch_realtek.c |    7 +++++++
 1 file changed, 7 insertions(+)

--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -3094,6 +3094,7 @@ static void alc_disable_headset_jack_key
 	case 0x10ec0215:
 	case 0x10ec0225:
 	case 0x10ec0285:
+	case 0x10ec0287:
 	case 0x10ec0295:
 	case 0x10ec0289:
 	case 0x10ec0299:
@@ -3120,6 +3121,7 @@ static void alc_enable_headset_jack_key(
 	case 0x10ec0215:
 	case 0x10ec0225:
 	case 0x10ec0285:
+	case 0x10ec0287:
 	case 0x10ec0295:
 	case 0x10ec0289:
 	case 0x10ec0299:
@@ -8526,6 +8528,11 @@ static const struct snd_hda_pin_quirk al
 		{0x14, 0x90170110},
 		{0x19, 0x04a11040},
 		{0x21, 0x04211020}),
+	SND_HDA_PIN_QUIRK(0x10ec0287, 0x17aa, "Lenovo", ALC285_FIXUP_THINKPAD_HEADSET_JACK,
+		{0x14, 0x90170110},
+		{0x17, 0x90170111},
+		{0x19, 0x03a11030},
+		{0x21, 0x03211020}),
 	SND_HDA_PIN_QUIRK(0x10ec0286, 0x1025, "Acer", ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE,
 		{0x12, 0x90a60130},
 		{0x17, 0x90170110},



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 337/453] ALSA: hda/realtek - Enable headset mic of ASUS X430UN with ALC256
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (334 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.4 336/453] ALSA: hda/realtek: make bass spk volume adjustable on a yoga laptop Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.4 338/453] ALSA: hda/realtek - Enable headset mic of ASUS Q524UQK with ALC255 Greg Kroah-Hartman
                   ` (119 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chris Chiu, Jian-Hong Pan, Takashi Iwai

From: Chris Chiu <chiu@endlessos.org>

commit 5cfca59604e423f720297e30a9dc493eea623493 upstream.

The ASUS laptop X430UN with ALC256 can't detect the headset microphone
until ALC256_FIXUP_ASUS_MIC_NO_PRESENCE quirk applied.

Signed-off-by: Chris Chiu <chiu@endlessos.org>
Signed-off-by: Jian-Hong Pan <jhp@endlessos.org>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201207072755.16210-1-chiu@endlessos.org
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/pci/hda/patch_realtek.c |    1 +
 1 file changed, 1 insertion(+)

--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -7884,6 +7884,7 @@ static const struct snd_pci_quirk alc269
 	SND_PCI_QUIRK(0x1043, 0x10d0, "ASUS X540LA/X540LJ", ALC255_FIXUP_ASUS_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1043, 0x115d, "Asus 1015E", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
 	SND_PCI_QUIRK(0x1043, 0x11c0, "ASUS X556UR", ALC255_FIXUP_ASUS_MIC_NO_PRESENCE),
+	SND_PCI_QUIRK(0x1043, 0x1271, "ASUS X430UN", ALC256_FIXUP_ASUS_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1043, 0x1290, "ASUS X441SA", ALC233_FIXUP_EAPD_COEF_AND_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1043, 0x12a0, "ASUS X441UV", ALC233_FIXUP_EAPD_COEF_AND_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1043, 0x12f0, "ASUS X541UV", ALC256_FIXUP_ASUS_MIC),



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 338/453] ALSA: hda/realtek - Enable headset mic of ASUS Q524UQK with ALC255
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (335 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.4 337/453] ALSA: hda/realtek - Enable headset mic of ASUS X430UN with ALC256 Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.4 339/453] ALSA: hda/realtek - Add supported for more Lenovo ALC285 Headset Button Greg Kroah-Hartman
                   ` (118 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chris Chiu, Jian-Hong Pan, Takashi Iwai

From: Chris Chiu <chiu@endlessos.org>

commit 7e413528474d5895e3e315c019fb0c43522eb6d9 upstream.

The ASUS laptop Q524UQK with ALC255 codec can't detect the headset
microphone until ALC255_FIXUP_ASUS_MIC_NO_PRESENCE quirk applied.

Signed-off-by: Chris Chiu <chiu@endlessos.org>
Signed-off-by: Jian-Hong Pan <jhp@endlessos.org>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201209045730.9972-1-chiu@endlessos.org
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/pci/hda/patch_realtek.c |    1 +
 1 file changed, 1 insertion(+)

--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -7905,6 +7905,7 @@ static const struct snd_pci_quirk alc269
 	SND_PCI_QUIRK(0x1043, 0x1b13, "Asus U41SV", ALC269_FIXUP_INV_DMIC),
 	SND_PCI_QUIRK(0x1043, 0x1bbd, "ASUS Z550MA", ALC255_FIXUP_ASUS_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1043, 0x1c23, "Asus X55U", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+	SND_PCI_QUIRK(0x1043, 0x125e, "ASUS Q524UQK", ALC255_FIXUP_ASUS_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1043, 0x1ccd, "ASUS X555UB", ALC256_FIXUP_ASUS_MIC),
 	SND_PCI_QUIRK(0x1043, 0x1d4e, "ASUS TM420", ALC256_FIXUP_ASUS_HPE),
 	SND_PCI_QUIRK(0x1043, 0x1e11, "ASUS Zephyrus G15", ALC289_FIXUP_ASUS_GA502),



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 339/453] ALSA: hda/realtek - Add supported for more Lenovo ALC285 Headset Button
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (336 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.4 338/453] ALSA: hda/realtek - Enable headset mic of ASUS Q524UQK with ALC255 Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.4 340/453] ALSA: pcm: oss: Fix a few more UBSAN fixes Greg Kroah-Hartman
                   ` (117 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Kailang Yang, Takashi Iwai

From: Kailang Yang <kailang@realtek.com>

commit 607184cb1635eaee239fe3fb9648a8b82a5232d7 upstream.

Add supported for more Lenovo ALC285 Headset Button.

Signed-off-by: Kailang Yang <kailang@realtek.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/bb1f1da1526d460885aa4257be81eb94@realtek.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/pci/hda/patch_realtek.c |    4 ++++
 1 file changed, 4 insertions(+)

--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -8525,6 +8525,10 @@ static const struct snd_hda_pin_quirk al
 		{0x12, 0x90a60130},
 		{0x19, 0x03a11020},
 		{0x21, 0x0321101f}),
+	SND_HDA_PIN_QUIRK(0x10ec0285, 0x17aa, "Lenovo", ALC285_FIXUP_THINKPAD_NO_BASS_SPK_HEADSET_JACK,
+		{0x14, 0x90170110},
+		{0x19, 0x04a11040},
+		{0x21, 0x04211020}),
 	SND_HDA_PIN_QUIRK(0x10ec0285, 0x17aa, "Lenovo", ALC285_FIXUP_LENOVO_PC_BEEP_IN_NOISE,
 		{0x12, 0x90a60130},
 		{0x14, 0x90170110},



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 340/453] ALSA: pcm: oss: Fix a few more UBSAN fixes
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (337 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.4 339/453] ALSA: hda/realtek - Add supported for more Lenovo ALC285 Headset Button Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.4 341/453] ALSA/hda: apply jack fixup for the Acer Veriton N4640G/N6640G/N2510G Greg Kroah-Hartman
                   ` (116 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, syzbot+33ef0b6639a8d2d42b4c, Takashi Iwai

From: Takashi Iwai <tiwai@suse.de>

commit 11cb881bf075cea41092a20236ba708b18e1dbb2 upstream.

There are a few places that call round{up|down}_pow_of_two() with the
value zero, and this causes undefined behavior warnings.  Avoid
calling those macros if such a nonsense value is passed; it's a minor
optimization as well, as we handle it as either an error or a value to
be skipped, instead.

Reported-by: syzbot+33ef0b6639a8d2d42b4c@syzkaller.appspotmail.com
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201218161730.26596-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/core/oss/pcm_oss.c |   22 ++++++++++++++--------
 1 file changed, 14 insertions(+), 8 deletions(-)

--- a/sound/core/oss/pcm_oss.c
+++ b/sound/core/oss/pcm_oss.c
@@ -693,6 +693,8 @@ static int snd_pcm_oss_period_size(struc
 
 	oss_buffer_size = snd_pcm_plug_client_size(substream,
 						   snd_pcm_hw_param_value_max(slave_params, SNDRV_PCM_HW_PARAM_BUFFER_SIZE, NULL)) * oss_frame_size;
+	if (!oss_buffer_size)
+		return -EINVAL;
 	oss_buffer_size = rounddown_pow_of_two(oss_buffer_size);
 	if (atomic_read(&substream->mmap_count)) {
 		if (oss_buffer_size > runtime->oss.mmap_bytes)
@@ -728,17 +730,21 @@ static int snd_pcm_oss_period_size(struc
 
 	min_period_size = snd_pcm_plug_client_size(substream,
 						   snd_pcm_hw_param_value_min(slave_params, SNDRV_PCM_HW_PARAM_PERIOD_SIZE, NULL));
-	min_period_size *= oss_frame_size;
-	min_period_size = roundup_pow_of_two(min_period_size);
-	if (oss_period_size < min_period_size)
-		oss_period_size = min_period_size;
+	if (min_period_size) {
+		min_period_size *= oss_frame_size;
+		min_period_size = roundup_pow_of_two(min_period_size);
+		if (oss_period_size < min_period_size)
+			oss_period_size = min_period_size;
+	}
 
 	max_period_size = snd_pcm_plug_client_size(substream,
 						   snd_pcm_hw_param_value_max(slave_params, SNDRV_PCM_HW_PARAM_PERIOD_SIZE, NULL));
-	max_period_size *= oss_frame_size;
-	max_period_size = rounddown_pow_of_two(max_period_size);
-	if (oss_period_size > max_period_size)
-		oss_period_size = max_period_size;
+	if (max_period_size) {
+		max_period_size *= oss_frame_size;
+		max_period_size = rounddown_pow_of_two(max_period_size);
+		if (oss_period_size > max_period_size)
+			oss_period_size = max_period_size;
+	}
 
 	oss_periods = oss_buffer_size / oss_period_size;
 



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 341/453] ALSA/hda: apply jack fixup for the Acer Veriton N4640G/N6640G/N2510G
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (338 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.4 340/453] ALSA: pcm: oss: Fix a few more UBSAN fixes Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.4 342/453] ALSA: hda/realtek: Add quirk for MSI-GP73 Greg Kroah-Hartman
                   ` (115 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chris Chiu, Jian-Hong Pan, Takashi Iwai

From: Chris Chiu <chiu@endlessos.org>

commit 13be30f156fda725b168ac89fc91f78651575307 upstream.

This Acer Veriton N4640G/N6640G/N2510G desktops have 2 headphone
jacks(front and rear), and a separate Mic In jack.

The rear headphone jack is actually a line out jack but always silent
while playing audio. The front 'Mic In' also fails the jack sensing.
Apply the ALC269_FIXUP_LIFEBOOK to have all audio jacks to work as
expected.

Signed-off-by: Chris Chiu <chiu@endlessos.org>
Signed-off-by: Jian-Hong Pan <jhp@endlessos.org>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201222150459.9545-2-chiu@endlessos.org
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/pci/hda/patch_realtek.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -7735,11 +7735,14 @@ static const struct snd_pci_quirk alc269
 	SND_PCI_QUIRK(0x1025, 0x0762, "Acer Aspire E1-472", ALC271_FIXUP_HP_GATE_MIC_JACK_E1_572),
 	SND_PCI_QUIRK(0x1025, 0x0775, "Acer Aspire E1-572", ALC271_FIXUP_HP_GATE_MIC_JACK_E1_572),
 	SND_PCI_QUIRK(0x1025, 0x079b, "Acer Aspire V5-573G", ALC282_FIXUP_ASPIRE_V5_PINS),
+	SND_PCI_QUIRK(0x1025, 0x101c, "Acer Veriton N2510G", ALC269_FIXUP_LIFEBOOK),
 	SND_PCI_QUIRK(0x1025, 0x102b, "Acer Aspire C24-860", ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1025, 0x1065, "Acer Aspire C20-820", ALC269VC_FIXUP_ACER_HEADSET_MIC),
 	SND_PCI_QUIRK(0x1025, 0x106d, "Acer Cloudbook 14", ALC283_FIXUP_CHROME_BOOK),
 	SND_PCI_QUIRK(0x1025, 0x1099, "Acer Aspire E5-523G", ALC255_FIXUP_ACER_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1025, 0x110e, "Acer Aspire ES1-432", ALC255_FIXUP_ACER_MIC_NO_PRESENCE),
+	SND_PCI_QUIRK(0x1025, 0x1166, "Acer Veriton N4640G", ALC269_FIXUP_LIFEBOOK),
+	SND_PCI_QUIRK(0x1025, 0x1167, "Acer Veriton N6640G", ALC269_FIXUP_LIFEBOOK),
 	SND_PCI_QUIRK(0x1025, 0x1246, "Acer Predator Helios 500", ALC299_FIXUP_PREDATOR_SPK),
 	SND_PCI_QUIRK(0x1025, 0x1247, "Acer vCopperbox", ALC269VC_FIXUP_ACER_VCOPPERBOX_PINS),
 	SND_PCI_QUIRK(0x1025, 0x1248, "Acer Veriton N4660G", ALC269VC_FIXUP_ACER_MIC_NO_PRESENCE),



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 342/453] ALSA: hda/realtek: Add quirk for MSI-GP73
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (339 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.4 341/453] ALSA/hda: apply jack fixup for the Acer Veriton N4640G/N6640G/N2510G Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.4 343/453] ALSA: hda/realtek: Apply jack fixup for Quanta NL3 Greg Kroah-Hartman
                   ` (114 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Takashi Iwai

From: Takashi Iwai <tiwai@suse.de>

commit 09926202e939fd699650ac0fc0baa5757e069390 upstream.

MSI-GP73 (with SSID 1462:1229) requires yet again
ALC1220_FIXUP_CLEVO_P950 quirk like other MSI models.

BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=210793
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201220080943.24839-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/pci/hda/patch_realtek.c |    1 +
 1 file changed, 1 insertion(+)

--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -2506,6 +2506,7 @@ static const struct snd_pci_quirk alc882
 	SND_PCI_QUIRK(0x1458, 0xa0ce, "Gigabyte X570 Aorus Xtreme", ALC1220_FIXUP_CLEVO_P950),
 	SND_PCI_QUIRK(0x1462, 0x11f7, "MSI-GE63", ALC1220_FIXUP_CLEVO_P950),
 	SND_PCI_QUIRK(0x1462, 0x1228, "MSI-GP63", ALC1220_FIXUP_CLEVO_P950),
+	SND_PCI_QUIRK(0x1462, 0x1229, "MSI-GP73", ALC1220_FIXUP_CLEVO_P950),
 	SND_PCI_QUIRK(0x1462, 0x1275, "MSI-GL63", ALC1220_FIXUP_CLEVO_P950),
 	SND_PCI_QUIRK(0x1462, 0x1276, "MSI-GL73", ALC1220_FIXUP_CLEVO_P950),
 	SND_PCI_QUIRK(0x1462, 0x1293, "MSI-GP65", ALC1220_FIXUP_CLEVO_P950),



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 343/453] ALSA: hda/realtek: Apply jack fixup for Quanta NL3
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (340 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.4 342/453] ALSA: hda/realtek: Add quirk for MSI-GP73 Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.4 344/453] ALSA: usb-audio: Add VID to support native DSD reproduction on FiiO devices Greg Kroah-Hartman
                   ` (113 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Chris Chiu, Takashi Iwai

From: Chris Chiu <chiu@endlessos.org>

commit 6ca653e3f73a1af0f30dbf9c2c79d2897074989f upstream.

The Quanta NL3 laptop has both a headphone output jack and a headset
jack, on the right edge of the chassis.

The pin information suggests that both of these are at the Front.
The PulseAudio is confused to differentiate them so one of the jack
can neither get the jack sense working nor the audio output.

The ALC269_FIXUP_LIFEBOOK chained with ALC269_FIXUP_QUANTA_MUTE can
help to differentiate 2 jacks and get the 'Auto-Mute Mode' working
correctly.

Signed-off-by: Chris Chiu <chiu@endlessos.org>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201222150459.9545-1-chiu@endlessos.org
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/pci/hda/patch_realtek.c |    1 +
 1 file changed, 1 insertion(+)

--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -7947,6 +7947,7 @@ static const struct snd_pci_quirk alc269
 	SND_PCI_QUIRK(0x1458, 0xfa53, "Gigabyte BXBT-2807", ALC283_FIXUP_HEADSET_MIC),
 	SND_PCI_QUIRK(0x1462, 0xb120, "MSI Cubi MS-B120", ALC283_FIXUP_HEADSET_MIC),
 	SND_PCI_QUIRK(0x1462, 0xb171, "Cubi N 8GL (MS-B171)", ALC283_FIXUP_HEADSET_MIC),
+	SND_PCI_QUIRK(0x152d, 0x1082, "Quanta NL3", ALC269_FIXUP_LIFEBOOK),
 	SND_PCI_QUIRK(0x1558, 0x1323, "Clevo N130ZU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1558, 0x1325, "System76 Darter Pro (darp5)", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1558, 0x1401, "Clevo L140[CZ]U", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 344/453] ALSA: usb-audio: Add VID to support native DSD reproduction on FiiO devices
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (341 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.4 343/453] ALSA: hda/realtek: Apply jack fixup for Quanta NL3 Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.4 345/453] ALSA: usb-audio: Disable sample read check if firmware doesnt give back Greg Kroah-Hartman
                   ` (112 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Amadej Kastelic, Emilio Moretti,
	Takashi Iwai

From: Amadej Kastelic <amadejkastelic7@gmail.com>

commit 725124d10d00b2f56bb5bd08b431cc74ab3b3ace upstream.

Add VID to support native DSD reproduction on FiiO devices.

Tested-by: Amadej Kastelic <amadejkastelic7@gmail.com>
Signed-off-by: Emilio Moretti <emilio.moretti@gmail.com>
Signed-off-by: Amadej Kastelic <amadejkastelic7@gmail.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/X9j7wdXSr4XyK7Bd@ryzen.localdomain
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/usb/quirks.c |    1 +
 1 file changed, 1 insertion(+)

--- a/sound/usb/quirks.c
+++ b/sound/usb/quirks.c
@@ -1731,6 +1731,7 @@ u64 snd_usb_interface_dsd_format_quirks(
 	case 0x25ce:  /* Mytek devices */
 	case 0x278b:  /* Rotel? */
 	case 0x292b:  /* Gustard/Ess based devices */
+	case 0x2972:  /* FiiO devices */
 	case 0x2ab6:  /* T+A devices */
 	case 0x3353:  /* Khadas devices */
 	case 0x3842:  /* EVGA */



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 345/453] ALSA: usb-audio: Disable sample read check if firmware doesnt give back
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (342 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.4 344/453] ALSA: usb-audio: Add VID to support native DSD reproduction on FiiO devices Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.4 346/453] ALSA: core: memalloc: add page alignment for iram Greg Kroah-Hartman
                   ` (111 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Takashi Iwai

From: Takashi Iwai <tiwai@suse.de>

commit 9df28edce7c6ab38050235f6f8b43dd7ccd01b6d upstream.

Some buggy firmware don't give the current sample rate but leaves
zero.  Handle this case more gracefully without warning but just skip
the current rate verification from the next time.

Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201218145858.2357-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/usb/clock.c |    6 ++++++
 1 file changed, 6 insertions(+)

--- a/sound/usb/clock.c
+++ b/sound/usb/clock.c
@@ -531,6 +531,12 @@ static int set_sample_rate_v1(struct snd
 	}
 
 	crate = data[0] | (data[1] << 8) | (data[2] << 16);
+	if (!crate) {
+		dev_info(&dev->dev, "failed to read current rate; disabling the check\n");
+		chip->sample_rate_read_error = 3; /* three strikes, see above */
+		return 0;
+	}
+
 	if (crate != rate) {
 		dev_warn(&dev->dev, "current rate %d is different from the runtime rate %d\n", crate, rate);
 		// runtime->rate = crate;



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 346/453] ALSA: core: memalloc: add page alignment for iram
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (343 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.4 345/453] ALSA: usb-audio: Disable sample read check if firmware doesnt give back Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.4 347/453] s390/smp: perform initial CPU reset also for SMT siblings Greg Kroah-Hartman
                   ` (110 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Robin Gong, Takashi Iwai

From: Robin Gong <yibin.gong@nxp.com>

commit 74c64efa1557fef731b59eb813f115436d18078e upstream.

Since mmap for userspace is based on page alignment, add page alignment
for iram alloc from pool, otherwise, some good data located in the same
page of dmab->area maybe touched wrongly by userspace like pulseaudio.

Signed-off-by: Robin Gong <yibin.gong@nxp.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/1608221747-3474-1-git-send-email-yibin.gong@nxp.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/core/memalloc.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/sound/core/memalloc.c
+++ b/sound/core/memalloc.c
@@ -76,7 +76,8 @@ static void snd_malloc_dev_iram(struct s
 	/* Assign the pool into private_data field */
 	dmab->private_data = pool;
 
-	dmab->area = gen_pool_dma_alloc(pool, size, &dmab->addr);
+	dmab->area = gen_pool_dma_alloc_align(pool, size, &dmab->addr,
+					PAGE_SIZE);
 }
 
 /**



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 347/453] s390/smp: perform initial CPU reset also for SMT siblings
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (344 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.4 346/453] ALSA: core: memalloc: add page alignment for iram Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.4 348/453] s390/kexec_file: fix diag308 subcode when loading crash kernel Greg Kroah-Hartman
                   ` (109 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Heiko Carstens, Sven Schnelle, stable

From: Sven Schnelle <svens@linux.ibm.com>

commit b5e438ebd7e808d1d2435159ac4742e01a94b8da upstream.

Not resetting the SMT siblings might leave them in unpredictable
state. One of the observed problems was that the CPU timer wasn't
reset and therefore large system time values where accounted during
CPU bringup.

Cc: <stable@kernel.org> # 4.0
Fixes: 10ad34bc76dfb ("s390: add SMT support")
Reviewed-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Sven Schnelle <svens@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/s390/kernel/smp.c |   18 +++---------------
 1 file changed, 3 insertions(+), 15 deletions(-)

--- a/arch/s390/kernel/smp.c
+++ b/arch/s390/kernel/smp.c
@@ -885,24 +885,12 @@ static void __no_sanitize_address smp_st
 /* Upping and downing of CPUs */
 int __cpu_up(unsigned int cpu, struct task_struct *tidle)
 {
-	struct pcpu *pcpu;
-	int base, i, rc;
+	struct pcpu *pcpu = pcpu_devices + cpu;
+	int rc;
 
-	pcpu = pcpu_devices + cpu;
 	if (pcpu->state != CPU_STATE_CONFIGURED)
 		return -EIO;
-	base = smp_get_base_cpu(cpu);
-	for (i = 0; i <= smp_cpu_mtid; i++) {
-		if (base + i < nr_cpu_ids)
-			if (cpu_online(base + i))
-				break;
-	}
-	/*
-	 * If this is the first CPU of the core to get online
-	 * do an initial CPU reset.
-	 */
-	if (i > smp_cpu_mtid &&
-	    pcpu_sigp_retry(pcpu_devices + base, SIGP_INITIAL_CPU_RESET, 0) !=
+	if (pcpu_sigp_retry(pcpu, SIGP_INITIAL_CPU_RESET, 0) !=
 	    SIGP_CC_ORDER_CODE_ACCEPTED)
 		return -EIO;
 



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 348/453] s390/kexec_file: fix diag308 subcode when loading crash kernel
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (345 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.4 347/453] s390/smp: perform initial CPU reset also for SMT siblings Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.4 349/453] s390/dasd: fix hanging device offline processing Greg Kroah-Hartman
                   ` (108 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Philipp Rudo, Xiaoying Yan,
	Lianbo Jiang, Heiko Carstens

From: Philipp Rudo <prudo@linux.ibm.com>

commit 613775d62ec60202f98d2c5f520e6e9ba6dd4ac4 upstream.

diag308 subcode 0 performes a clear reset which inlcudes the reset of
all registers in the system. While this is the preferred behavior when
loading a normal kernel via kexec it prevents the crash kernel to store
the register values in the dump. To prevent this use subcode 1 when
loading a crash kernel instead.

Fixes: ee337f5469fd ("s390/kexec_file: Add crash support to image loader")
Cc: <stable@vger.kernel.org> # 4.17
Signed-off-by: Philipp Rudo <prudo@linux.ibm.com>
Reported-by: Xiaoying Yan <yiyan@redhat.com>
Tested-by: Lianbo Jiang <lijiang@redhat.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/s390/purgatory/head.S |    9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

--- a/arch/s390/purgatory/head.S
+++ b/arch/s390/purgatory/head.S
@@ -62,14 +62,15 @@
 	jh	10b
 .endm
 
-.macro START_NEXT_KERNEL base
+.macro START_NEXT_KERNEL base subcode
 	lg	%r4,kernel_entry-\base(%r13)
 	lg	%r5,load_psw_mask-\base(%r13)
 	ogr	%r4,%r5
 	stg	%r4,0(%r0)
 
 	xgr	%r0,%r0
-	diag	%r0,%r0,0x308
+	lghi	%r1,\subcode
+	diag	%r0,%r1,0x308
 .endm
 
 .text
@@ -123,7 +124,7 @@ ENTRY(purgatory_start)
 	je	.start_crash_kernel
 
 	/* start normal kernel */
-	START_NEXT_KERNEL .base_crash
+	START_NEXT_KERNEL .base_crash 0
 
 .return_old_kernel:
 	lmg	%r6,%r15,gprregs-.base_crash(%r13)
@@ -227,7 +228,7 @@ ENTRY(purgatory_start)
 	MEMCPY	%r9,%r10,%r11
 
 	/* start crash kernel */
-	START_NEXT_KERNEL .base_dst
+	START_NEXT_KERNEL .base_dst 1
 
 
 load_psw_mask:



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 349/453] s390/dasd: fix hanging device offline processing
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (346 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.4 348/453] s390/kexec_file: fix diag308 subcode when loading crash kernel Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.4 350/453] s390/dasd: prevent inconsistent LCU device data Greg Kroah-Hartman
                   ` (107 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Stefan Haberland, Jan Hoeppner, Jens Axboe

From: Stefan Haberland <sth@linux.ibm.com>

commit 658a337a606f48b7ebe451591f7681d383fa115e upstream.

For an LCU update a read unit address configuration IO is required.
This is started using sleep_on(), which has early exit paths in case the
device is not usable for IO. For example when it is in offline processing.

In those cases the LCU update should fail and not be retried.
Therefore lcu_update_work checks if EOPNOTSUPP is returned or not.

Commit 41995342b40c ("s390/dasd: fix endless loop after read unit address configuration")
accidentally removed the EOPNOTSUPP return code from
read_unit_address_configuration(), which in turn might lead to an endless
loop of the LCU update in offline processing.

Fix by returning EOPNOTSUPP again if the device is not able to perform the
request.

Fixes: 41995342b40c ("s390/dasd: fix endless loop after read unit address configuration")
Cc: stable@vger.kernel.org #5.3
Signed-off-by: Stefan Haberland <sth@linux.ibm.com>
Reviewed-by: Jan Hoeppner <hoeppner@linux.ibm.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/s390/block/dasd_alias.c |   10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

--- a/drivers/s390/block/dasd_alias.c
+++ b/drivers/s390/block/dasd_alias.c
@@ -462,11 +462,19 @@ static int read_unit_address_configurati
 	spin_unlock_irqrestore(&lcu->lock, flags);
 
 	rc = dasd_sleep_on(cqr);
-	if (rc && !suborder_not_supported(cqr)) {
+	if (!rc)
+		goto out;
+
+	if (suborder_not_supported(cqr)) {
+		/* suborder not supported or device unusable for IO */
+		rc = -EOPNOTSUPP;
+	} else {
+		/* IO failed but should be retried */
 		spin_lock_irqsave(&lcu->lock, flags);
 		lcu->flags |= NEED_UAC_UPDATE;
 		spin_unlock_irqrestore(&lcu->lock, flags);
 	}
+out:
 	dasd_sfree_request(cqr, cqr->memdev);
 	return rc;
 }



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 350/453] s390/dasd: prevent inconsistent LCU device data
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (347 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.4 349/453] s390/dasd: fix hanging device offline processing Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.4 351/453] s390/dasd: fix list corruption of pavgroup group list Greg Kroah-Hartman
                   ` (106 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Stefan Haberland, Jan Hoeppner, Jens Axboe

From: Stefan Haberland <sth@linux.ibm.com>

commit a29ea01653493b94ea12bb2b89d1564a265081b6 upstream.

Prevent _lcu_update from adding a device to a pavgroup if the LCU still
requires an update. The data is not reliable any longer and in parallel
devices might have been moved on the lists already.
This might lead to list corruptions or invalid PAV grouping.
Only add devices to a pavgroup if the LCU is up to date. Additional steps
are taken by the scheduled lcu update.

Fixes: 8e09f21574ea ("[S390] dasd: add hyper PAV support to DASD device driver, part 1")
Cc: stable@vger.kernel.org
Signed-off-by: Stefan Haberland <sth@linux.ibm.com>
Reviewed-by: Jan Hoeppner <hoeppner@linux.ibm.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/s390/block/dasd_alias.c |    9 +++++++++
 1 file changed, 9 insertions(+)

--- a/drivers/s390/block/dasd_alias.c
+++ b/drivers/s390/block/dasd_alias.c
@@ -511,6 +511,14 @@ static int _lcu_update(struct dasd_devic
 		return rc;
 
 	spin_lock_irqsave(&lcu->lock, flags);
+	/*
+	 * there is another update needed skip the remaining handling
+	 * the data might already be outdated
+	 * but especially do not add the device to an LCU with pending
+	 * update
+	 */
+	if (lcu->flags & NEED_UAC_UPDATE)
+		goto out;
 	lcu->pav = NO_PAV;
 	for (i = 0; i < MAX_DEVICES_PER_LCU; ++i) {
 		switch (lcu->uac->unit[i].ua_type) {
@@ -529,6 +537,7 @@ static int _lcu_update(struct dasd_devic
 				 alias_list) {
 		_add_device_to_lcu(lcu, device, refdev);
 	}
+out:
 	spin_unlock_irqrestore(&lcu->lock, flags);
 	return 0;
 }



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 351/453] s390/dasd: fix list corruption of pavgroup group list
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (348 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.4 350/453] s390/dasd: prevent inconsistent LCU device data Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.4 352/453] s390/dasd: fix list corruption of lcu list Greg Kroah-Hartman
                   ` (105 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Stefan Haberland, Jan Hoeppner, Jens Axboe

From: Stefan Haberland <sth@linux.ibm.com>

commit 0ede91f83aa335da1c3ec68eb0f9e228f269f6d8 upstream.

dasd_alias_add_device() moves devices to the active_devices list in case
of a scheduled LCU update regardless if they have previously been in a
pavgroup or not.

Example: device A and B are in the same pavgroup.

Device A has already been in a pavgroup and the private->pavgroup pointer
is set and points to a valid pavgroup. While going through dasd_add_device
it is moved from the pavgroup to the active_devices list.

In parallel device B might be removed from the same pavgroup in
remove_device_from_lcu() which in turn checks if the group is empty
and deletes it accordingly because device A has already been removed from
there.

When now device A enters remove_device_from_lcu() it is tried to remove it
from the pavgroup again because the pavgroup pointer is still set and again
the empty group will be cleaned up which leads to a list corruption.

Fix by setting private->pavgroup to NULL in dasd_add_device.

If the device has been the last device on the pavgroup an empty pavgroup
remains but this will be cleaned up by the scheduled lcu_update which
iterates over all existing pavgroups.

Fixes: 8e09f21574ea ("[S390] dasd: add hyper PAV support to DASD device driver, part 1")
Cc: stable@vger.kernel.org
Signed-off-by: Stefan Haberland <sth@linux.ibm.com>
Reviewed-by: Jan Hoeppner <hoeppner@linux.ibm.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/s390/block/dasd_alias.c |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/s390/block/dasd_alias.c
+++ b/drivers/s390/block/dasd_alias.c
@@ -642,6 +642,7 @@ int dasd_alias_add_device(struct dasd_de
 	}
 	if (lcu->flags & UPDATE_PENDING) {
 		list_move(&device->alias_list, &lcu->active_devices);
+		private->pavgroup = NULL;
 		_schedule_lcu_update(lcu, device);
 	}
 	spin_unlock_irqrestore(&lcu->lock, flags);



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 352/453] s390/dasd: fix list corruption of lcu list
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (349 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.4 351/453] s390/dasd: fix list corruption of pavgroup group list Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.4 353/453] binder: add flag to clear buffer on txn complete Greg Kroah-Hartman
                   ` (104 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Stefan Haberland, Jan Hoeppner, Jens Axboe

From: Stefan Haberland <sth@linux.ibm.com>

commit 53a7f655834c7c335bf683f248208d4fbe4b47bc upstream.

In dasd_alias_disconnect_device_from_lcu the device is removed from any
list on the LCU. Afterwards the LCU is removed from the lcu list if it
does not contain devices any longer.

The lcu->lock protects the lcu from parallel updates. But to cancel all
workers and wait for completion the lcu->lock has to be unlocked.

If two devices are removed in parallel and both are removed from the LCU
the first device that takes the lcu->lock again will delete the LCU because
it is already empty but the second device also tries to free the LCU which
leads to a list corruption of the lcu list.

Fix by removing the device right before the lcu is checked without
unlocking the lcu->lock in between.

Fixes: 8e09f21574ea ("[S390] dasd: add hyper PAV support to DASD device driver, part 1")
Cc: stable@vger.kernel.org
Signed-off-by: Stefan Haberland <sth@linux.ibm.com>
Reviewed-by: Jan Hoeppner <hoeppner@linux.ibm.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/s390/block/dasd_alias.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/s390/block/dasd_alias.c
+++ b/drivers/s390/block/dasd_alias.c
@@ -256,7 +256,6 @@ void dasd_alias_disconnect_device_from_l
 		return;
 	device->discipline->get_uid(device, &uid);
 	spin_lock_irqsave(&lcu->lock, flags);
-	list_del_init(&device->alias_list);
 	/* make sure that the workers don't use this device */
 	if (device == lcu->suc_data.device) {
 		spin_unlock_irqrestore(&lcu->lock, flags);
@@ -283,6 +282,7 @@ void dasd_alias_disconnect_device_from_l
 
 	spin_lock_irqsave(&aliastree.lock, flags);
 	spin_lock(&lcu->lock);
+	list_del_init(&device->alias_list);
 	if (list_empty(&lcu->grouplist) &&
 	    list_empty(&lcu->active_devices) &&
 	    list_empty(&lcu->inactive_devices)) {



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 353/453] binder: add flag to clear buffer on txn complete
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (350 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.4 352/453] s390/dasd: fix list corruption of lcu list Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.4 354/453] ASoC: cx2072x: Fix doubly definitions of Playback and Capture streams Greg Kroah-Hartman
                   ` (103 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Todd Kjos

From: Todd Kjos <tkjos@google.com>

commit 0f966cba95c78029f491b433ea95ff38f414a761 upstream.

Add a per-transaction flag to indicate that the buffer
must be cleared when the transaction is complete to
prevent copies of sensitive data from being preserved
in memory.

Signed-off-by: Todd Kjos <tkjos@google.com>
Link: https://lore.kernel.org/r/20201120233743.3617529-1-tkjos@google.com
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/android/binder.c            |    1 
 drivers/android/binder_alloc.c      |   48 ++++++++++++++++++++++++++++++++++++
 drivers/android/binder_alloc.h      |    4 ++-
 include/uapi/linux/android/binder.h |    1 
 4 files changed, 53 insertions(+), 1 deletion(-)

--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -3150,6 +3150,7 @@ static void binder_transaction(struct bi
 	t->buffer->debug_id = t->debug_id;
 	t->buffer->transaction = t;
 	t->buffer->target_node = target_node;
+	t->buffer->clear_on_free = !!(t->flags & TF_CLEAR_BUF);
 	trace_binder_transaction_alloc_buf(t->buffer);
 
 	if (binder_alloc_copy_user_to_buffer(
--- a/drivers/android/binder_alloc.c
+++ b/drivers/android/binder_alloc.c
@@ -647,6 +647,8 @@ static void binder_free_buf_locked(struc
 	binder_insert_free_buffer(alloc, buffer);
 }
 
+static void binder_alloc_clear_buf(struct binder_alloc *alloc,
+				   struct binder_buffer *buffer);
 /**
  * binder_alloc_free_buf() - free a binder buffer
  * @alloc:	binder_alloc for this proc
@@ -657,6 +659,18 @@ static void binder_free_buf_locked(struc
 void binder_alloc_free_buf(struct binder_alloc *alloc,
 			    struct binder_buffer *buffer)
 {
+	/*
+	 * We could eliminate the call to binder_alloc_clear_buf()
+	 * from binder_alloc_deferred_release() by moving this to
+	 * binder_alloc_free_buf_locked(). However, that could
+	 * increase contention for the alloc mutex if clear_on_free
+	 * is used frequently for large buffers. The mutex is not
+	 * needed for correctness here.
+	 */
+	if (buffer->clear_on_free) {
+		binder_alloc_clear_buf(alloc, buffer);
+		buffer->clear_on_free = false;
+	}
 	mutex_lock(&alloc->mutex);
 	binder_free_buf_locked(alloc, buffer);
 	mutex_unlock(&alloc->mutex);
@@ -753,6 +767,10 @@ void binder_alloc_deferred_release(struc
 		/* Transaction should already have been freed */
 		BUG_ON(buffer->transaction);
 
+		if (buffer->clear_on_free) {
+			binder_alloc_clear_buf(alloc, buffer);
+			buffer->clear_on_free = false;
+		}
 		binder_free_buf_locked(alloc, buffer);
 		buffers++;
 	}
@@ -1087,6 +1105,36 @@ static struct page *binder_alloc_get_pag
 }
 
 /**
+ * binder_alloc_clear_buf() - zero out buffer
+ * @alloc: binder_alloc for this proc
+ * @buffer: binder buffer to be cleared
+ *
+ * memset the given buffer to 0
+ */
+static void binder_alloc_clear_buf(struct binder_alloc *alloc,
+				   struct binder_buffer *buffer)
+{
+	size_t bytes = binder_alloc_buffer_size(alloc, buffer);
+	binder_size_t buffer_offset = 0;
+
+	while (bytes) {
+		unsigned long size;
+		struct page *page;
+		pgoff_t pgoff;
+		void *kptr;
+
+		page = binder_alloc_get_page(alloc, buffer,
+					     buffer_offset, &pgoff);
+		size = min_t(size_t, bytes, PAGE_SIZE - pgoff);
+		kptr = kmap(page) + pgoff;
+		memset(kptr, 0, size);
+		kunmap(page);
+		bytes -= size;
+		buffer_offset += size;
+	}
+}
+
+/**
  * binder_alloc_copy_user_to_buffer() - copy src user to tgt user
  * @alloc: binder_alloc for this proc
  * @buffer: binder buffer to be accessed
--- a/drivers/android/binder_alloc.h
+++ b/drivers/android/binder_alloc.h
@@ -23,6 +23,7 @@ struct binder_transaction;
  * @entry:              entry alloc->buffers
  * @rb_node:            node for allocated_buffers/free_buffers rb trees
  * @free:               %true if buffer is free
+ * @clear_on_free:      %true if buffer must be zeroed after use
  * @allow_user_free:    %true if user is allowed to free buffer
  * @async_transaction:  %true if buffer is in use for an async txn
  * @debug_id:           unique ID for debugging
@@ -40,9 +41,10 @@ struct binder_buffer {
 	struct rb_node rb_node; /* free entry by size or allocated entry */
 				/* by address */
 	unsigned free:1;
+	unsigned clear_on_free:1;
 	unsigned allow_user_free:1;
 	unsigned async_transaction:1;
-	unsigned debug_id:29;
+	unsigned debug_id:28;
 
 	struct binder_transaction *transaction;
 
--- a/include/uapi/linux/android/binder.h
+++ b/include/uapi/linux/android/binder.h
@@ -248,6 +248,7 @@ enum transaction_flags {
 	TF_ROOT_OBJECT	= 0x04,	/* contents are the component's root object */
 	TF_STATUS_CODE	= 0x08,	/* contents are a 32-bit status code */
 	TF_ACCEPT_FDS	= 0x10,	/* allow replies with file descriptors */
+	TF_CLEAR_BUF	= 0x20,	/* clear buffer on txn complete */
 };
 
 struct binder_transaction_data {



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 354/453] ASoC: cx2072x: Fix doubly definitions of Playback and Capture streams
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (351 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.4 353/453] binder: add flag to clear buffer on txn complete Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.4 355/453] staging: comedi: mf6x4: Fix AI end-of-conversion detection Greg Kroah-Hartman
                   ` (102 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Takashi Iwai, Mark Brown

From: Takashi Iwai <tiwai@suse.de>

commit 0d024a8bec084205fdd9fa17479ba91f45f85db3 upstream.

The cx2072x codec driver defines multiple DAIs with the same stream
name "Playback" and "Capture".  Although the current code works more
or less as is as the secondary streams are never used, it still leads
the error message like:
 debugfs: File 'Playback' in directory 'dapm' already present!
 debugfs: File 'Capture' in directory 'dapm' already present!

Fix it by renaming the secondary streams to unique names.

Fixes: a497a4363706 ("ASoC: Add support for Conexant CX2072X CODEC")
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://lore.kernel.org/r/20201208135154.9188-1-tiwai@suse.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/soc/codecs/cx2072x.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/sound/soc/codecs/cx2072x.c
+++ b/sound/soc/codecs/cx2072x.c
@@ -1579,7 +1579,7 @@ static struct snd_soc_dai_driver soc_cod
 		.id	= CX2072X_DAI_DSP,
 		.probe = cx2072x_dsp_dai_probe,
 		.playback = {
-			.stream_name = "Playback",
+			.stream_name = "DSP Playback",
 			.channels_min = 2,
 			.channels_max = 2,
 			.rates = CX2072X_RATES_DSP,
@@ -1591,7 +1591,7 @@ static struct snd_soc_dai_driver soc_cod
 		.name = "cx2072x-aec",
 		.id	= 3,
 		.capture = {
-			.stream_name = "Capture",
+			.stream_name = "AEC Capture",
 			.channels_min = 2,
 			.channels_max = 2,
 			.rates = CX2072X_RATES_DSP,



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 355/453] staging: comedi: mf6x4: Fix AI end-of-conversion detection
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (352 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.4 354/453] ASoC: cx2072x: Fix doubly definitions of Playback and Capture streams Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.4 356/453] perf/x86/intel: Add event constraint for CYCLE_ACTIVITY.STALLS_MEM_ANY Greg Kroah-Hartman
                   ` (101 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Rostislav Lisovy, Ian Abbott

From: Ian Abbott <abbotti@mev.co.uk>

commit 56c90457ebfe9422496aac6ef3d3f0f0ea8b2ec2 upstream.

I have had reports from two different people that attempts to read the
analog input channels of the MF624 board fail with an `ETIMEDOUT` error.

After triggering the conversion, the code calls `comedi_timeout()` with
`mf6x4_ai_eoc()` as the callback function to check if the conversion is
complete.  The callback returns 0 if complete or `-EBUSY` if not yet
complete.  `comedi_timeout()` returns `-ETIMEDOUT` if it has not
completed within a timeout period which is propagated as an error to the
user application.

The existing code considers the conversion to be complete when the EOLC
bit is high.  However, according to the user manuals for the MF624 and
MF634 boards, this test is incorrect because EOLC is an active low
signal that goes high when the conversion is triggered, and goes low
when the conversion is complete.  Fix the problem by inverting the test
of the EOLC bit state.

Fixes: 04b565021a83 ("comedi: Humusoft MF634 and MF624 DAQ cards driver")
Cc: <stable@vger.kernel.org> # v4.4+
Cc: Rostislav Lisovy <lisovy@gmail.com>
Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Link: https://lore.kernel.org/r/20201207145806.4046-1-abbotti@mev.co.uk
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/staging/comedi/drivers/mf6x4.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/staging/comedi/drivers/mf6x4.c
+++ b/drivers/staging/comedi/drivers/mf6x4.c
@@ -112,8 +112,9 @@ static int mf6x4_ai_eoc(struct comedi_de
 	struct mf6x4_private *devpriv = dev->private;
 	unsigned int status;
 
+	/* EOLC goes low at end of conversion. */
 	status = ioread32(devpriv->gpioc_reg);
-	if (status & MF6X4_GPIOC_EOLC)
+	if ((status & MF6X4_GPIOC_EOLC) == 0)
 		return 0;
 	return -EBUSY;
 }



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 356/453] perf/x86/intel: Add event constraint for CYCLE_ACTIVITY.STALLS_MEM_ANY
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (353 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.4 355/453] staging: comedi: mf6x4: Fix AI end-of-conversion detection Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.4 357/453] perf/x86/intel: Fix rtm_abort_event encoding on Ice Lake Greg Kroah-Hartman
                   ` (100 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Andi Kleen, Kan Liang,
	Peter Zijlstra (Intel)

From: Kan Liang <kan.liang@linux.intel.com>

commit 306e3e91edf1c6739a55312edd110d298ff498dd upstream.

The event CYCLE_ACTIVITY.STALLS_MEM_ANY (0x14a3) should be available on
all 8 GP counters on ICL, but it's only scheduled on the first four
counters due to the current ICL constraint table.

Add a line for the CYCLE_ACTIVITY.STALLS_MEM_ANY event in the ICL
constraint table.
Correct the comments for the CYCLE_ACTIVITY.CYCLES_MEM_ANY event.

Fixes: 6017608936c1 ("perf/x86/intel: Add Icelake support")
Reported-by: Andi Kleen <ak@linux.intel.com>
Signed-off-by: Kan Liang <kan.liang@linux.intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: stable@vger.kernel.org
Link: https://lkml.kernel.org/r/20201019164529.32154-1-kan.liang@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/x86/events/intel/core.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/arch/x86/events/intel/core.c
+++ b/arch/x86/events/intel/core.c
@@ -253,7 +253,8 @@ static struct event_constraint intel_icl
 	INTEL_EVENT_CONSTRAINT_RANGE(0x48, 0x54, 0xf),
 	INTEL_EVENT_CONSTRAINT_RANGE(0x60, 0x8b, 0xf),
 	INTEL_UEVENT_CONSTRAINT(0x04a3, 0xff),  /* CYCLE_ACTIVITY.STALLS_TOTAL */
-	INTEL_UEVENT_CONSTRAINT(0x10a3, 0xff),  /* CYCLE_ACTIVITY.STALLS_MEM_ANY */
+	INTEL_UEVENT_CONSTRAINT(0x10a3, 0xff),  /* CYCLE_ACTIVITY.CYCLES_MEM_ANY */
+	INTEL_UEVENT_CONSTRAINT(0x14a3, 0xff),  /* CYCLE_ACTIVITY.STALLS_MEM_ANY */
 	INTEL_EVENT_CONSTRAINT(0xa3, 0xf),      /* CYCLE_ACTIVITY.* */
 	INTEL_EVENT_CONSTRAINT_RANGE(0xa8, 0xb0, 0xf),
 	INTEL_EVENT_CONSTRAINT_RANGE(0xb7, 0xbd, 0xf),



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 357/453] perf/x86/intel: Fix rtm_abort_event encoding on Ice Lake
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (354 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.4 356/453] perf/x86/intel: Add event constraint for CYCLE_ACTIVITY.STALLS_MEM_ANY Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.4 358/453] powerpc/perf: Exclude kernel samples while counting events in user space Greg Kroah-Hartman
                   ` (99 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Kan Liang, Peter Zijlstra (Intel)

From: Kan Liang <kan.liang@linux.intel.com>

commit 46b72e1bf4fc571da0c29c6fb3e5b2a2107a4c26 upstream.

According to the event list from icelake_core_v1.09.json, the encoding
of the RTM_RETIRED.ABORTED event on Ice Lake should be,
    "EventCode": "0xc9",
    "UMask": "0x04",
    "EventName": "RTM_RETIRED.ABORTED",

Correct the wrong encoding.

Fixes: 6017608936c1 ("perf/x86/intel: Add Icelake support")
Signed-off-by: Kan Liang <kan.liang@linux.intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: stable@vger.kernel.org
Link: https://lkml.kernel.org/r/20201125213720.15692-1-kan.liang@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/x86/events/intel/core.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/x86/events/intel/core.c
+++ b/arch/x86/events/intel/core.c
@@ -5058,7 +5058,7 @@ __init int intel_pmu_init(void)
 		extra_skl_attr = skl_format_attr;
 		mem_attr = icl_events_attrs;
 		tsx_attr = icl_tsx_events_attrs;
-		x86_pmu.rtm_abort_event = X86_CONFIG(.event=0xca, .umask=0x02);
+		x86_pmu.rtm_abort_event = X86_CONFIG(.event=0xc9, .umask=0x04);
 		x86_pmu.lbr_pt_coexist = true;
 		intel_pmu_pebs_data_source_skl(pmem);
 		pr_cont("Icelake events, ");



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 358/453] powerpc/perf: Exclude kernel samples while counting events in user space.
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (355 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.4 357/453] perf/x86/intel: Fix rtm_abort_event encoding on Ice Lake Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.4 359/453] crypto: ecdh - avoid unaligned accesses in ecdh_set_secret() Greg Kroah-Hartman
                   ` (98 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Athira Rajeev, Michael Ellerman

From: Athira Rajeev <atrajeev@linux.vnet.ibm.com>

commit aa8e21c053d72b6639ea5a7f1d3a1d0209534c94 upstream.

Perf event attritube supports exclude_kernel flag to avoid
sampling/profiling in supervisor state (kernel). Based on this event
attr flag, Monitor Mode Control Register bit is set to freeze on
supervisor state. But sometimes (due to hardware limitation), Sampled
Instruction Address Register (SIAR) locks on to kernel address even
when freeze on supervisor is set. Patch here adds a check to drop
those samples.

Cc: stable@vger.kernel.org
Signed-off-by: Athira Rajeev <atrajeev@linux.vnet.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/1606289215-1433-1-git-send-email-atrajeev@linux.vnet.ibm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/powerpc/perf/core-book3s.c |   10 ++++++++++
 1 file changed, 10 insertions(+)

--- a/arch/powerpc/perf/core-book3s.c
+++ b/arch/powerpc/perf/core-book3s.c
@@ -2090,6 +2090,16 @@ static void record_and_restart(struct pe
 	perf_event_update_userpage(event);
 
 	/*
+	 * Due to hardware limitation, sometimes SIAR could sample a kernel
+	 * address even when freeze on supervisor state (kernel) is set in
+	 * MMCR2. Check attr.exclude_kernel and address to drop the sample in
+	 * these cases.
+	 */
+	if (event->attr.exclude_kernel && record)
+		if (is_kernel_addr(mfspr(SPRN_SIAR)))
+			record = 0;
+
+	/*
 	 * Finally record data if requested.
 	 */
 	if (record) {



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 359/453] crypto: ecdh - avoid unaligned accesses in ecdh_set_secret()
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (356 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.4 358/453] powerpc/perf: Exclude kernel samples while counting events in user space Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.4 360/453] crypto: arm/aes-ce - work around Cortex-A57/A72 silion errata Greg Kroah-Hartman
                   ` (97 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Ard Biesheuvel, Herbert Xu

From: Ard Biesheuvel <ardb@kernel.org>

commit 17858b140bf49961b71d4e73f1c3ea9bc8e7dda0 upstream.

ecdh_set_secret() casts a void* pointer to a const u64* in order to
feed it into ecc_is_key_valid(). This is not generally permitted by
the C standard, and leads to actual misalignment faults on ARMv6
cores. In some cases, these are fixed up in software, but this still
leads to performance hits that are entirely avoidable.

So let's copy the key into the ctx buffer first, which we will do
anyway in the common case, and which guarantees correct alignment.

Cc: <stable@vger.kernel.org>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 crypto/ecdh.c |    9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

--- a/crypto/ecdh.c
+++ b/crypto/ecdh.c
@@ -53,12 +53,13 @@ static int ecdh_set_secret(struct crypto
 		return ecc_gen_privkey(ctx->curve_id, ctx->ndigits,
 				       ctx->private_key);
 
-	if (ecc_is_key_valid(ctx->curve_id, ctx->ndigits,
-			     (const u64 *)params.key, params.key_size) < 0)
-		return -EINVAL;
-
 	memcpy(ctx->private_key, params.key, params.key_size);
 
+	if (ecc_is_key_valid(ctx->curve_id, ctx->ndigits,
+			     ctx->private_key, params.key_size) < 0) {
+		memzero_explicit(ctx->private_key, params.key_size);
+		return -EINVAL;
+	}
 	return 0;
 }
 



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 360/453] crypto: arm/aes-ce - work around Cortex-A57/A72 silion errata
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (357 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.4 359/453] crypto: ecdh - avoid unaligned accesses in ecdh_set_secret() Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.4 361/453] EDAC/i10nm: Use readl() to access MMIO registers Greg Kroah-Hartman
                   ` (96 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Ard Biesheuvel, Herbert Xu

From: Ard Biesheuvel <ardb@kernel.org>

commit f3456b9fd269c6d0c973b136c5449d46b2510f4b upstream.

ARM Cortex-A57 and Cortex-A72 cores running in 32-bit mode are affected
by silicon errata #1742098 and #1655431, respectively, where the second
instruction of a AES instruction pair may execute twice if an interrupt
is taken right after the first instruction consumes an input register of
which a single 32-bit lane has been updated the last time it was modified.

This is not such a rare occurrence as it may seem: in counter mode, only
the least significant 32-bit word is incremented in the absence of a
carry, which makes our counter mode implementation susceptible to these
errata.

So let's shuffle the counter assignments around a bit so that the most
recent updates when the AES instruction pair executes are 128-bit wide.

[0] ARM-EPM-049219 v23 Cortex-A57 MPCore Software Developers Errata Notice
[1] ARM-EPM-012079 v11.0 Cortex-A72 MPCore Software Developers Errata Notice

Cc: <stable@vger.kernel.org> # v5.4+
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/arm/crypto/aes-ce-core.S |   32 ++++++++++++++++++++++----------
 1 file changed, 22 insertions(+), 10 deletions(-)

--- a/arch/arm/crypto/aes-ce-core.S
+++ b/arch/arm/crypto/aes-ce-core.S
@@ -386,20 +386,32 @@ ENTRY(ce_aes_ctr_encrypt)
 .Lctrloop4x:
 	subs		r4, r4, #4
 	bmi		.Lctr1x
-	add		r6, r6, #1
+
+	/*
+	 * NOTE: the sequence below has been carefully tweaked to avoid
+	 * a silicon erratum that exists in Cortex-A57 (#1742098) and
+	 * Cortex-A72 (#1655431) cores, where AESE/AESMC instruction pairs
+	 * may produce an incorrect result if they take their input from a
+	 * register of which a single 32-bit lane has been updated the last
+	 * time it was modified. To work around this, the lanes of registers
+	 * q0-q3 below are not manipulated individually, and the different
+	 * counter values are prepared by successive manipulations of q7.
+	 */
+	add		ip, r6, #1
 	vmov		q0, q7
+	rev		ip, ip
+	add		lr, r6, #2
+	vmov		s31, ip			@ set lane 3 of q1 via q7
+	add		ip, r6, #3
+	rev		lr, lr
 	vmov		q1, q7
-	rev		ip, r6
-	add		r6, r6, #1
+	vmov		s31, lr			@ set lane 3 of q2 via q7
+	rev		ip, ip
 	vmov		q2, q7
-	vmov		s7, ip
-	rev		ip, r6
-	add		r6, r6, #1
+	vmov		s31, ip			@ set lane 3 of q3 via q7
+	add		r6, r6, #4
 	vmov		q3, q7
-	vmov		s11, ip
-	rev		ip, r6
-	add		r6, r6, #1
-	vmov		s15, ip
+
 	vld1.8		{q4-q5}, [r1]!
 	vld1.8		{q6}, [r1]!
 	vld1.8		{q15}, [r1]!



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 361/453] EDAC/i10nm: Use readl() to access MMIO registers
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (358 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.4 360/453] crypto: arm/aes-ce - work around Cortex-A57/A72 silion errata Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.4 362/453] EDAC/amd64: Fix PCI component registration Greg Kroah-Hartman
                   ` (95 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Qiuxu Zhuo, Tony Luck

From: Qiuxu Zhuo <qiuxu.zhuo@intel.com>

commit 83ff51c4e3fecf6b8587ce4d46f6eac59f5d7c5a upstream.

Instead of raw access, use readl() to access MMIO registers of
memory controller to avoid possible compiler re-ordering.

Fixes: d4dc89d069aa ("EDAC, i10nm: Add a driver for Intel 10nm server processors")
Cc: <stable@vger.kernel.org>
Signed-off-by: Qiuxu Zhuo <qiuxu.zhuo@intel.com>
Signed-off-by: Tony Luck <tony.luck@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/edac/i10nm_base.c |   11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

--- a/drivers/edac/i10nm_base.c
+++ b/drivers/edac/i10nm_base.c
@@ -6,6 +6,7 @@
  */
 
 #include <linux/kernel.h>
+#include <linux/io.h>
 #include <asm/cpu_device_id.h>
 #include <asm/intel-family.h>
 #include <asm/mce.h>
@@ -19,14 +20,16 @@
 #define i10nm_printk(level, fmt, arg...)	\
 	edac_printk(level, "i10nm", fmt, ##arg)
 
-#define I10NM_GET_SCK_BAR(d, reg)		\
+#define I10NM_GET_SCK_BAR(d, reg)	\
 	pci_read_config_dword((d)->uracu, 0xd0, &(reg))
 #define I10NM_GET_IMC_BAR(d, i, reg)	\
 	pci_read_config_dword((d)->uracu, 0xd8 + (i) * 4, &(reg))
 #define I10NM_GET_DIMMMTR(m, i, j)	\
-	(*(u32 *)((m)->mbase + 0x2080c + (i) * 0x4000 + (j) * 4))
+	readl((m)->mbase + 0x2080c + (i) * 0x4000 + (j) * 4)
 #define I10NM_GET_MCDDRTCFG(m, i, j)	\
-	(*(u32 *)((m)->mbase + 0x20970 + (i) * 0x4000 + (j) * 4))
+	readl((m)->mbase + 0x20970 + (i) * 0x4000 + (j) * 4)
+#define I10NM_GET_MCMTR(m, i)		\
+	readl((m)->mbase + 0x20ef8 + (i) * 0x4000)
 
 #define I10NM_GET_SCK_MMIO_BASE(reg)	(GET_BITFIELD(reg, 0, 28) << 23)
 #define I10NM_GET_IMC_MMIO_OFFSET(reg)	(GET_BITFIELD(reg, 0, 10) << 12)
@@ -134,7 +137,7 @@ static bool i10nm_check_ecc(struct skx_i
 {
 	u32 mcmtr;
 
-	mcmtr = *(u32 *)(imc->mbase + 0x20ef8 + chan * 0x4000);
+	mcmtr = I10NM_GET_MCMTR(imc, chan);
 	edac_dbg(1, "ch%d mcmtr reg %x\n", chan, mcmtr);
 
 	return !!GET_BITFIELD(mcmtr, 2, 2);



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 362/453] EDAC/amd64: Fix PCI component registration
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (359 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.4 361/453] EDAC/i10nm: Use readl() to access MMIO registers Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:49 ` [PATCH 5.4 363/453] cpuset: fix race between hotplug work and later CPU offline Greg Kroah-Hartman
                   ` (94 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Borislav Petkov

From: Borislav Petkov <bp@suse.de>

commit 706657b1febf446a9ba37dc51b89f46604f57ee9 upstream.

In order to setup its PCI component, the driver needs any node private
instance in order to get a reference to the PCI device and hand that
into edac_pci_create_generic_ctl(). For convenience, it uses the 0th
memory controller descriptor under the assumption that if any, the 0th
will be always present.

However, this assumption goes wrong when the 0th node doesn't have
memory and the driver doesn't initialize an instance for it:

  EDAC amd64: F17h detected (node 0).
  ...
  EDAC amd64: Node 0: No DIMMs detected.

But looking up node instances is not really needed - all one needs is
the pointer to the proper device which gets discovered during instance
init.

So stash that pointer into a variable and use it when setting up the
EDAC PCI component.

Clear that variable when the driver needs to unwind due to some
instances failing init to avoid any registration imbalance.

Cc: <stable@vger.kernel.org>
Signed-off-by: Borislav Petkov <bp@suse.de>
Link: https://lkml.kernel.org/r/20201122150815.13808-1-bp@alien8.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/edac/amd64_edac.c |   26 ++++++++++++++------------
 1 file changed, 14 insertions(+), 12 deletions(-)

--- a/drivers/edac/amd64_edac.c
+++ b/drivers/edac/amd64_edac.c
@@ -22,6 +22,9 @@ static struct ecc_settings **ecc_stngs;
 /* Number of Unified Memory Controllers */
 static u8 num_umcs;
 
+/* Device for the PCI component */
+static struct device *pci_ctl_dev;
+
 /*
  * Valid scrub rates for the K8 hardware memory scrubber. We map the scrubbing
  * bandwidth to a valid bit pattern. The 'set' operation finds the 'matching-
@@ -2672,6 +2675,9 @@ reserve_mc_sibling_devs(struct amd64_pvt
 			return -ENODEV;
 		}
 
+		if (!pci_ctl_dev)
+			pci_ctl_dev = &pvt->F0->dev;
+
 		edac_dbg(1, "F0: %s\n", pci_name(pvt->F0));
 		edac_dbg(1, "F3: %s\n", pci_name(pvt->F3));
 		edac_dbg(1, "F6: %s\n", pci_name(pvt->F6));
@@ -2696,6 +2702,9 @@ reserve_mc_sibling_devs(struct amd64_pvt
 		return -ENODEV;
 	}
 
+	if (!pci_ctl_dev)
+		pci_ctl_dev = &pvt->F2->dev;
+
 	edac_dbg(1, "F1: %s\n", pci_name(pvt->F1));
 	edac_dbg(1, "F2: %s\n", pci_name(pvt->F2));
 	edac_dbg(1, "F3: %s\n", pci_name(pvt->F3));
@@ -3626,21 +3635,10 @@ static void remove_one_instance(unsigned
 
 static void setup_pci_device(void)
 {
-	struct mem_ctl_info *mci;
-	struct amd64_pvt *pvt;
-
 	if (pci_ctl)
 		return;
 
-	mci = edac_mc_find(0);
-	if (!mci)
-		return;
-
-	pvt = mci->pvt_info;
-	if (pvt->umc)
-		pci_ctl = edac_pci_create_generic_ctl(&pvt->F0->dev, EDAC_MOD_STR);
-	else
-		pci_ctl = edac_pci_create_generic_ctl(&pvt->F2->dev, EDAC_MOD_STR);
+	pci_ctl = edac_pci_create_generic_ctl(pci_ctl_dev, EDAC_MOD_STR);
 	if (!pci_ctl) {
 		pr_warn("%s(): Unable to create PCI control\n", __func__);
 		pr_warn("%s(): PCI error report via EDAC not set\n", __func__);
@@ -3723,6 +3721,8 @@ static int __init amd64_edac_init(void)
 	return 0;
 
 err_pci:
+	pci_ctl_dev = NULL;
+
 	msrs_free(msrs);
 	msrs = NULL;
 
@@ -3754,6 +3754,8 @@ static void __exit amd64_edac_exit(void)
 	kfree(ecc_stngs);
 	ecc_stngs = NULL;
 
+	pci_ctl_dev = NULL;
+
 	msrs_free(msrs);
 	msrs = NULL;
 }



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 363/453] cpuset: fix race between hotplug work and later CPU offline
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (360 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.4 362/453] EDAC/amd64: Fix PCI component registration Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.4 364/453] USB: serial: mos7720: fix parallel-port state restore Greg Kroah-Hartman
                   ` (93 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Daniel Jordan, Peter Zijlstra (Intel),
	Tejun Heo

From: Daniel Jordan <daniel.m.jordan@oracle.com>

commit 406100f3da08066c00105165db8520bbc7694a36 upstream.

One of our machines keeled over trying to rebuild the scheduler domains.
Mainline produces the same splat:

  BUG: unable to handle page fault for address: 0000607f820054db
  CPU: 2 PID: 149 Comm: kworker/1:1 Not tainted 5.10.0-rc1-master+ #6
  Workqueue: events cpuset_hotplug_workfn
  RIP: build_sched_domains
  Call Trace:
   partition_sched_domains_locked
   rebuild_sched_domains_locked
   cpuset_hotplug_workfn

It happens with cgroup2 and exclusive cpusets only.  This reproducer
triggers it on an 8-cpu vm and works most effectively with no
preexisting child cgroups:

  cd $UNIFIED_ROOT
  mkdir cg1
  echo 4-7 > cg1/cpuset.cpus
  echo root > cg1/cpuset.cpus.partition

  # with smt/control reading 'on',
  echo off > /sys/devices/system/cpu/smt/control

RIP maps to

  sd->shared = *per_cpu_ptr(sdd->sds, sd_id);

from sd_init().  sd_id is calculated earlier in the same function:

  cpumask_and(sched_domain_span(sd), cpu_map, tl->mask(cpu));
  sd_id = cpumask_first(sched_domain_span(sd));

tl->mask(cpu), which reads cpu_sibling_map on x86, returns an empty mask
and so cpumask_first() returns >= nr_cpu_ids, which leads to the bogus
value from per_cpu_ptr() above.

The problem is a race between cpuset_hotplug_workfn() and a later
offline of CPU N.  cpuset_hotplug_workfn() updates the effective masks
when N is still online, the offline clears N from cpu_sibling_map, and
then the worker uses the stale effective masks that still have N to
generate the scheduling domains, leading the worker to read
N's empty cpu_sibling_map in sd_init().

rebuild_sched_domains_locked() prevented the race during the cgroup2
cpuset series up until the Fixes commit changed its check.  Make the
check more robust so that it can detect an offline CPU in any exclusive
cpuset's effective mask, not just the top one.

Fixes: 0ccea8feb980 ("cpuset: Make generate_sched_domains() work with partition")
Signed-off-by: Daniel Jordan <daniel.m.jordan@oracle.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Acked-by: Tejun Heo <tj@kernel.org>
Cc: stable@vger.kernel.org
Link: https://lkml.kernel.org/r/20201112171711.639541-1-daniel.m.jordan@oracle.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 kernel/cgroup/cpuset.c |   33 ++++++++++++++++++++++++++++-----
 1 file changed, 28 insertions(+), 5 deletions(-)

--- a/kernel/cgroup/cpuset.c
+++ b/kernel/cgroup/cpuset.c
@@ -981,25 +981,48 @@ partition_and_rebuild_sched_domains(int
  */
 static void rebuild_sched_domains_locked(void)
 {
+	struct cgroup_subsys_state *pos_css;
 	struct sched_domain_attr *attr;
 	cpumask_var_t *doms;
+	struct cpuset *cs;
 	int ndoms;
 
 	lockdep_assert_cpus_held();
 	percpu_rwsem_assert_held(&cpuset_rwsem);
 
 	/*
-	 * We have raced with CPU hotplug. Don't do anything to avoid
+	 * If we have raced with CPU hotplug, return early to avoid
 	 * passing doms with offlined cpu to partition_sched_domains().
-	 * Anyways, hotplug work item will rebuild sched domains.
+	 * Anyways, cpuset_hotplug_workfn() will rebuild sched domains.
+	 *
+	 * With no CPUs in any subpartitions, top_cpuset's effective CPUs
+	 * should be the same as the active CPUs, so checking only top_cpuset
+	 * is enough to detect racing CPU offlines.
 	 */
 	if (!top_cpuset.nr_subparts_cpus &&
 	    !cpumask_equal(top_cpuset.effective_cpus, cpu_active_mask))
 		return;
 
-	if (top_cpuset.nr_subparts_cpus &&
-	   !cpumask_subset(top_cpuset.effective_cpus, cpu_active_mask))
-		return;
+	/*
+	 * With subpartition CPUs, however, the effective CPUs of a partition
+	 * root should be only a subset of the active CPUs.  Since a CPU in any
+	 * partition root could be offlined, all must be checked.
+	 */
+	if (top_cpuset.nr_subparts_cpus) {
+		rcu_read_lock();
+		cpuset_for_each_descendant_pre(cs, pos_css, &top_cpuset) {
+			if (!is_partition_root(cs)) {
+				pos_css = css_rightmost_descendant(pos_css);
+				continue;
+			}
+			if (!cpumask_subset(cs->effective_cpus,
+					    cpu_active_mask)) {
+				rcu_read_unlock();
+				return;
+			}
+		}
+		rcu_read_unlock();
+	}
 
 	/* Generate domain masks and attrs */
 	ndoms = generate_sched_domains(&doms, &attr);



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 364/453] USB: serial: mos7720: fix parallel-port state restore
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (361 preceding siblings ...)
  2020-12-28 12:49 ` [PATCH 5.4 363/453] cpuset: fix race between hotplug work and later CPU offline Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.4 365/453] USB: serial: digi_acceleport: fix write-wakeup deadlocks Greg Kroah-Hartman
                   ` (92 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Johan Hovold

From: Johan Hovold <johan@kernel.org>

commit 975323ab8f116667676c30ca3502a6757bd89e8d upstream.

The parallel-port restore operations is called when a driver claims the
port and is supposed to restore the provided state (e.g. saved when
releasing the port).

Fixes: b69578df7e98 ("USB: usbserial: mos7720: add support for parallel port on moschip 7715")
Cc: stable <stable@vger.kernel.org>     # 2.6.35
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/serial/mos7720.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/drivers/usb/serial/mos7720.c
+++ b/drivers/usb/serial/mos7720.c
@@ -638,6 +638,8 @@ static void parport_mos7715_restore_stat
 		spin_unlock(&release_lock);
 		return;
 	}
+	mos_parport->shadowDCR = s->u.pc.ctr;
+	mos_parport->shadowECR = s->u.pc.ecr;
 	write_parport_reg_nonblock(mos_parport, MOS7720_DCR,
 				   mos_parport->shadowDCR);
 	write_parport_reg_nonblock(mos_parport, MOS7720_ECR,



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 365/453] USB: serial: digi_acceleport: fix write-wakeup deadlocks
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (362 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.4 364/453] USB: serial: mos7720: fix parallel-port state restore Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.4 366/453] USB: serial: keyspan_pda: fix dropped unthrottle interrupts Greg Kroah-Hartman
                   ` (91 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Johan Hovold

From: Johan Hovold <johan@kernel.org>

commit 5098e77962e7c8947f87bd8c5869c83e000a522a upstream.

The driver must not call tty_wakeup() while holding its private lock as
line disciplines are allowed to call back into write() from
write_wakeup(), leading to a deadlock.

Also remove the unneeded work struct that was used to defer wakeup in
order to work around a possible race in ancient times (see comment about
n_tty write_chan() in commit 14b54e39b412 ("USB: serial: remove
changelogs and old todo entries")).

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/serial/digi_acceleport.c |   45 ++++++++++-------------------------
 1 file changed, 13 insertions(+), 32 deletions(-)

--- a/drivers/usb/serial/digi_acceleport.c
+++ b/drivers/usb/serial/digi_acceleport.c
@@ -19,7 +19,6 @@
 #include <linux/tty_flip.h>
 #include <linux/module.h>
 #include <linux/spinlock.h>
-#include <linux/workqueue.h>
 #include <linux/uaccess.h>
 #include <linux/usb.h>
 #include <linux/wait.h>
@@ -198,14 +197,12 @@ struct digi_port {
 	int dp_throttle_restart;
 	wait_queue_head_t dp_flush_wait;
 	wait_queue_head_t dp_close_wait;	/* wait queue for close */
-	struct work_struct dp_wakeup_work;
 	struct usb_serial_port *dp_port;
 };
 
 
 /* Local Function Declarations */
 
-static void digi_wakeup_write_lock(struct work_struct *work);
 static int digi_write_oob_command(struct usb_serial_port *port,
 	unsigned char *buf, int count, int interruptible);
 static int digi_write_inb_command(struct usb_serial_port *port,
@@ -356,26 +353,6 @@ __releases(lock)
 	return timeout;
 }
 
-
-/*
- *  Digi Wakeup Write
- *
- *  Wake up port, line discipline, and tty processes sleeping
- *  on writes.
- */
-
-static void digi_wakeup_write_lock(struct work_struct *work)
-{
-	struct digi_port *priv =
-			container_of(work, struct digi_port, dp_wakeup_work);
-	struct usb_serial_port *port = priv->dp_port;
-	unsigned long flags;
-
-	spin_lock_irqsave(&priv->dp_port_lock, flags);
-	tty_port_tty_wakeup(&port->port);
-	spin_unlock_irqrestore(&priv->dp_port_lock, flags);
-}
-
 /*
  *  Digi Write OOB Command
  *
@@ -986,6 +963,7 @@ static void digi_write_bulk_callback(str
 	unsigned long flags;
 	int ret = 0;
 	int status = urb->status;
+	bool wakeup;
 
 	/* port and serial sanity check */
 	if (port == NULL || (priv = usb_get_serial_port_data(port)) == NULL) {
@@ -1012,6 +990,7 @@ static void digi_write_bulk_callback(str
 	}
 
 	/* try to send any buffered data on this port */
+	wakeup = true;
 	spin_lock_irqsave(&priv->dp_port_lock, flags);
 	priv->dp_write_urb_in_use = 0;
 	if (priv->dp_out_buf_len > 0) {
@@ -1027,19 +1006,18 @@ static void digi_write_bulk_callback(str
 		if (ret == 0) {
 			priv->dp_write_urb_in_use = 1;
 			priv->dp_out_buf_len = 0;
+			wakeup = false;
 		}
 	}
-	/* wake up processes sleeping on writes immediately */
-	tty_port_tty_wakeup(&port->port);
-	/* also queue up a wakeup at scheduler time, in case we */
-	/* lost the race in write_chan(). */
-	schedule_work(&priv->dp_wakeup_work);
-
 	spin_unlock_irqrestore(&priv->dp_port_lock, flags);
+
 	if (ret && ret != -EPERM)
 		dev_err_console(port,
 			"%s: usb_submit_urb failed, ret=%d, port=%d\n",
 			__func__, ret, priv->dp_port_num);
+
+	if (wakeup)
+		tty_port_tty_wakeup(&port->port);
 }
 
 static int digi_write_room(struct tty_struct *tty)
@@ -1239,7 +1217,6 @@ static int digi_port_init(struct usb_ser
 	init_waitqueue_head(&priv->dp_transmit_idle_wait);
 	init_waitqueue_head(&priv->dp_flush_wait);
 	init_waitqueue_head(&priv->dp_close_wait);
-	INIT_WORK(&priv->dp_wakeup_work, digi_wakeup_write_lock);
 	priv->dp_port = port;
 
 	init_waitqueue_head(&port->write_wait);
@@ -1508,13 +1485,14 @@ static int digi_read_oob_callback(struct
 			rts = C_CRTSCTS(tty);
 
 		if (tty && opcode == DIGI_CMD_READ_INPUT_SIGNALS) {
+			bool wakeup = false;
+
 			spin_lock_irqsave(&priv->dp_port_lock, flags);
 			/* convert from digi flags to termiox flags */
 			if (val & DIGI_READ_INPUT_SIGNALS_CTS) {
 				priv->dp_modem_signals |= TIOCM_CTS;
-				/* port must be open to use tty struct */
 				if (rts)
-					tty_port_tty_wakeup(&port->port);
+					wakeup = true;
 			} else {
 				priv->dp_modem_signals &= ~TIOCM_CTS;
 				/* port must be open to use tty struct */
@@ -1533,6 +1511,9 @@ static int digi_read_oob_callback(struct
 				priv->dp_modem_signals &= ~TIOCM_CD;
 
 			spin_unlock_irqrestore(&priv->dp_port_lock, flags);
+
+			if (wakeup)
+				tty_port_tty_wakeup(&port->port);
 		} else if (opcode == DIGI_CMD_TRANSMIT_IDLE) {
 			spin_lock_irqsave(&priv->dp_port_lock, flags);
 			priv->dp_transmit_idle = 1;



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 366/453] USB: serial: keyspan_pda: fix dropped unthrottle interrupts
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (363 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.4 365/453] USB: serial: digi_acceleport: fix write-wakeup deadlocks Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.4 367/453] USB: serial: keyspan_pda: fix write deadlock Greg Kroah-Hartman
                   ` (90 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sebastian Andrzej Siewior, Johan Hovold

From: Johan Hovold <johan@kernel.org>

commit 696c541c8c6cfa05d65aa24ae2b9e720fc01766e upstream.

Commit c528fcb116e6 ("USB: serial: keyspan_pda: fix receive sanity
checks") broke write-unthrottle handling by dropping well-formed
unthrottle-interrupt packets which are precisely two bytes long. This
could lead to blocked writers not being woken up when buffer space again
becomes available.

Instead, stop unconditionally printing the third byte which is
(presumably) only valid on modem-line changes.

Fixes: c528fcb116e6 ("USB: serial: keyspan_pda: fix receive sanity checks")
Cc: stable <stable@vger.kernel.org>     # 4.11
Acked-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/serial/keyspan_pda.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/usb/serial/keyspan_pda.c
+++ b/drivers/usb/serial/keyspan_pda.c
@@ -172,11 +172,11 @@ static void keyspan_pda_rx_interrupt(str
 		break;
 	case 1:
 		/* status interrupt */
-		if (len < 3) {
+		if (len < 2) {
 			dev_warn(&port->dev, "short interrupt message received\n");
 			break;
 		}
-		dev_dbg(&port->dev, "rx int, d1=%d, d2=%d\n", data[1], data[2]);
+		dev_dbg(&port->dev, "rx int, d1=%d\n", data[1]);
 		switch (data[1]) {
 		case 1: /* modemline change */
 			break;



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 367/453] USB: serial: keyspan_pda: fix write deadlock
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (364 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.4 366/453] USB: serial: keyspan_pda: fix dropped unthrottle interrupts Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.4 368/453] USB: serial: keyspan_pda: fix stalled writes Greg Kroah-Hartman
                   ` (89 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sebastian Andrzej Siewior, Johan Hovold

From: Johan Hovold <johan@kernel.org>

commit 7353cad7ee4deaefc16e94727e69285563e219f6 upstream.

The write() callback can be called in interrupt context (e.g. when used
as a console) so interrupts must be disabled while holding the port lock
to prevent a possible deadlock.

Fixes: e81ee637e4ae ("usb-serial: possible irq lock inversion (PPP vs. usb/serial)")
Fixes: 507ca9bc0476 ("[PATCH] USB: add ability for usb-serial drivers to determine if their write urb is currently being used.")
Cc: stable <stable@vger.kernel.org>     # 2.6.19
Acked-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/serial/keyspan_pda.c |    7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

--- a/drivers/usb/serial/keyspan_pda.c
+++ b/drivers/usb/serial/keyspan_pda.c
@@ -443,6 +443,7 @@ static int keyspan_pda_write(struct tty_
 	int request_unthrottle = 0;
 	int rc = 0;
 	struct keyspan_pda_private *priv;
+	unsigned long flags;
 
 	priv = usb_get_serial_port_data(port);
 	/* guess how much room is left in the device's ring buffer, and if we
@@ -462,13 +463,13 @@ static int keyspan_pda_write(struct tty_
 	   the TX urb is in-flight (wait until it completes)
 	   the device is full (wait until it says there is room)
 	*/
-	spin_lock_bh(&port->lock);
+	spin_lock_irqsave(&port->lock, flags);
 	if (!test_bit(0, &port->write_urbs_free) || priv->tx_throttled) {
-		spin_unlock_bh(&port->lock);
+		spin_unlock_irqrestore(&port->lock, flags);
 		return 0;
 	}
 	clear_bit(0, &port->write_urbs_free);
-	spin_unlock_bh(&port->lock);
+	spin_unlock_irqrestore(&port->lock, flags);
 
 	/* At this point the URB is in our control, nobody else can submit it
 	   again (the only sudden transition was the one from EINPROGRESS to



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 368/453] USB: serial: keyspan_pda: fix stalled writes
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (365 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.4 367/453] USB: serial: keyspan_pda: fix write deadlock Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.4 369/453] USB: serial: keyspan_pda: fix write-wakeup use-after-free Greg Kroah-Hartman
                   ` (88 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sebastian Andrzej Siewior, Johan Hovold

From: Johan Hovold <johan@kernel.org>

commit c01d2c58698f710c9e13ba3e2d296328606f74fd upstream.

Make sure to clear the write-busy flag also in case no new data was
submitted due to lack of device buffer space so that writing is
resumed once space again becomes available.

Fixes: 507ca9bc0476 ("[PATCH] USB: add ability for usb-serial drivers to determine if their write urb is currently being used.")
Cc: stable <stable@vger.kernel.org>     # 2.6.13
Acked-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/serial/keyspan_pda.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/usb/serial/keyspan_pda.c
+++ b/drivers/usb/serial/keyspan_pda.c
@@ -548,7 +548,7 @@ static int keyspan_pda_write(struct tty_
 
 	rc = count;
 exit:
-	if (rc < 0)
+	if (rc <= 0)
 		set_bit(0, &port->write_urbs_free);
 	return rc;
 }



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 369/453] USB: serial: keyspan_pda: fix write-wakeup use-after-free
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (366 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.4 368/453] USB: serial: keyspan_pda: fix stalled writes Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.4 370/453] USB: serial: keyspan_pda: fix tx-unthrottle use-after-free Greg Kroah-Hartman
                   ` (87 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sebastian Andrzej Siewior, Johan Hovold

From: Johan Hovold <johan@kernel.org>

commit 37faf50615412947868c49aee62f68233307f4e4 upstream.

The driver's deferred write wakeup was never flushed on disconnect,
something which could lead to the driver port data being freed while the
wakeup work is still scheduled.

Fix this by using the usb-serial write wakeup which gets cancelled
properly on disconnect.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Acked-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/serial/keyspan_pda.c |   17 +++--------------
 1 file changed, 3 insertions(+), 14 deletions(-)

--- a/drivers/usb/serial/keyspan_pda.c
+++ b/drivers/usb/serial/keyspan_pda.c
@@ -43,8 +43,7 @@
 struct keyspan_pda_private {
 	int			tx_room;
 	int			tx_throttled;
-	struct work_struct			wakeup_work;
-	struct work_struct			unthrottle_work;
+	struct work_struct	unthrottle_work;
 	struct usb_serial	*serial;
 	struct usb_serial_port	*port;
 };
@@ -97,15 +96,6 @@ static const struct usb_device_id id_tab
 };
 #endif
 
-static void keyspan_pda_wakeup_write(struct work_struct *work)
-{
-	struct keyspan_pda_private *priv =
-		container_of(work, struct keyspan_pda_private, wakeup_work);
-	struct usb_serial_port *port = priv->port;
-
-	tty_port_tty_wakeup(&port->port);
-}
-
 static void keyspan_pda_request_unthrottle(struct work_struct *work)
 {
 	struct keyspan_pda_private *priv =
@@ -183,7 +173,7 @@ static void keyspan_pda_rx_interrupt(str
 		case 2: /* tx unthrottle interrupt */
 			priv->tx_throttled = 0;
 			/* queue up a wakeup at scheduler time */
-			schedule_work(&priv->wakeup_work);
+			usb_serial_port_softint(port);
 			break;
 		default:
 			break;
@@ -563,7 +553,7 @@ static void keyspan_pda_write_bulk_callb
 	priv = usb_get_serial_port_data(port);
 
 	/* queue up a wakeup at scheduler time */
-	schedule_work(&priv->wakeup_work);
+	usb_serial_port_softint(port);
 }
 
 
@@ -716,7 +706,6 @@ static int keyspan_pda_port_probe(struct
 	if (!priv)
 		return -ENOMEM;
 
-	INIT_WORK(&priv->wakeup_work, keyspan_pda_wakeup_write);
 	INIT_WORK(&priv->unthrottle_work, keyspan_pda_request_unthrottle);
 	priv->serial = port->serial;
 	priv->port = port;



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 370/453] USB: serial: keyspan_pda: fix tx-unthrottle use-after-free
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (367 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.4 369/453] USB: serial: keyspan_pda: fix write-wakeup use-after-free Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.4 371/453] USB: serial: keyspan_pda: fix write unthrottling Greg Kroah-Hartman
                   ` (86 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sebastian Andrzej Siewior, Johan Hovold

From: Johan Hovold <johan@kernel.org>

commit 49fbb8e37a961396a5b6c82937c70df91de45e9d upstream.

The driver's transmit-unthrottle work was never flushed on disconnect,
something which could lead to the driver port data being freed while the
unthrottle work is still scheduled.

Fix this by cancelling the unthrottle work when shutting down the port.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Acked-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/serial/keyspan_pda.c |    4 ++++
 1 file changed, 4 insertions(+)

--- a/drivers/usb/serial/keyspan_pda.c
+++ b/drivers/usb/serial/keyspan_pda.c
@@ -647,8 +647,12 @@ error:
 }
 static void keyspan_pda_close(struct usb_serial_port *port)
 {
+	struct keyspan_pda_private *priv = usb_get_serial_port_data(port);
+
 	usb_kill_urb(port->write_urb);
 	usb_kill_urb(port->interrupt_in_urb);
+
+	cancel_work_sync(&priv->unthrottle_work);
 }
 
 



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 371/453] USB: serial: keyspan_pda: fix write unthrottling
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (368 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.4 370/453] USB: serial: keyspan_pda: fix tx-unthrottle use-after-free Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.4 372/453] btrfs: do not shorten unpin len for caching block groups Greg Kroah-Hartman
                   ` (85 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sebastian Andrzej Siewior, Johan Hovold

From: Johan Hovold <johan@kernel.org>

commit 320f9028c7873c3c7710e8e93e5c979f4c857490 upstream.

The driver did not update its view of the available device buffer space
until write() was called in task context. This meant that write_room()
would return 0 even after the device had sent a write-unthrottle
notification, something which could lead to blocked writers not being
woken up (e.g. when using OPOST).

Note that we must also request an unthrottle notification is case a
write() request fills the device buffer exactly.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable <stable@vger.kernel.org>
Acked-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/serial/keyspan_pda.c |   29 ++++++++++++++++++++---------
 1 file changed, 20 insertions(+), 9 deletions(-)

--- a/drivers/usb/serial/keyspan_pda.c
+++ b/drivers/usb/serial/keyspan_pda.c
@@ -40,6 +40,8 @@
 #define DRIVER_AUTHOR "Brian Warner <warner@lothar.com>"
 #define DRIVER_DESC "USB Keyspan PDA Converter driver"
 
+#define KEYSPAN_TX_THRESHOLD	16
+
 struct keyspan_pda_private {
 	int			tx_room;
 	int			tx_throttled;
@@ -110,7 +112,7 @@ static void keyspan_pda_request_unthrott
 				 7, /* request_unthrottle */
 				 USB_TYPE_VENDOR | USB_RECIP_INTERFACE
 				 | USB_DIR_OUT,
-				 16, /* value: threshold */
+				 KEYSPAN_TX_THRESHOLD,
 				 0, /* index */
 				 NULL,
 				 0,
@@ -129,6 +131,8 @@ static void keyspan_pda_rx_interrupt(str
 	int retval;
 	int status = urb->status;
 	struct keyspan_pda_private *priv;
+	unsigned long flags;
+
 	priv = usb_get_serial_port_data(port);
 
 	switch (status) {
@@ -171,7 +175,10 @@ static void keyspan_pda_rx_interrupt(str
 		case 1: /* modemline change */
 			break;
 		case 2: /* tx unthrottle interrupt */
+			spin_lock_irqsave(&port->lock, flags);
 			priv->tx_throttled = 0;
+			priv->tx_room = max(priv->tx_room, KEYSPAN_TX_THRESHOLD);
+			spin_unlock_irqrestore(&port->lock, flags);
 			/* queue up a wakeup at scheduler time */
 			usb_serial_port_softint(port);
 			break;
@@ -505,7 +512,8 @@ static int keyspan_pda_write(struct tty_
 			goto exit;
 		}
 	}
-	if (count > priv->tx_room) {
+
+	if (count >= priv->tx_room) {
 		/* we're about to completely fill the Tx buffer, so
 		   we'll be throttled afterwards. */
 		count = priv->tx_room;
@@ -560,14 +568,17 @@ static void keyspan_pda_write_bulk_callb
 static int keyspan_pda_write_room(struct tty_struct *tty)
 {
 	struct usb_serial_port *port = tty->driver_data;
-	struct keyspan_pda_private *priv;
-	priv = usb_get_serial_port_data(port);
-	/* used by n_tty.c for processing of tabs and such. Giving it our
-	   conservative guess is probably good enough, but needs testing by
-	   running a console through the device. */
-	return priv->tx_room;
-}
+	struct keyspan_pda_private *priv = usb_get_serial_port_data(port);
+	unsigned long flags;
+	int room = 0;
+
+	spin_lock_irqsave(&port->lock, flags);
+	if (test_bit(0, &port->write_urbs_free) && !priv->tx_throttled)
+		room = priv->tx_room;
+	spin_unlock_irqrestore(&port->lock, flags);
 
+	return room;
+}
 
 static int keyspan_pda_chars_in_buffer(struct tty_struct *tty)
 {



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 372/453] btrfs: do not shorten unpin len for caching block groups
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (369 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.4 371/453] USB: serial: keyspan_pda: fix write unthrottling Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.4 373/453] btrfs: trim: fix underflow in trim length to prevent access beyond device boundary Greg Kroah-Hartman
                   ` (84 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Filipe Manana, Josef Bacik, David Sterba

From: Josef Bacik <josef@toxicpanda.com>

commit 9076dbd5ee837c3882fc42891c14cecd0354a849 upstream.

While fixing up our ->last_byte_to_unpin locking I noticed that we will
shorten len based on ->last_byte_to_unpin if we're caching when we're
adding back the free space.  This is correct for the free space, as we
cannot unpin more than ->last_byte_to_unpin, however we use len to
adjust the ->bytes_pinned counters and such, which need to track the
actual pinned usage.  This could result in
WARN_ON(space_info->bytes_pinned) triggering at unmount time.

Fix this by using a local variable for the amount to add to free space
cache, and leave len untouched in this case.

CC: stable@vger.kernel.org # 5.4+
Reviewed-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/btrfs/extent-tree.c |    8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -2838,10 +2838,10 @@ static int unpin_extent_range(struct btr
 		len = cache->key.objectid + cache->key.offset - start;
 		len = min(len, end + 1 - start);
 
-		if (start < cache->last_byte_to_unpin) {
-			len = min(len, cache->last_byte_to_unpin - start);
-			if (return_free_space)
-				btrfs_add_free_space(cache, start, len);
+		if (start < cache->last_byte_to_unpin && return_free_space) {
+			u64 add_len = min(len, cache->last_byte_to_unpin - start);
+
+			btrfs_add_free_space(cache, start, add_len);
 		}
 
 		start += len;



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 373/453] btrfs: trim: fix underflow in trim length to prevent access beyond device boundary
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (370 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.4 372/453] btrfs: do not shorten unpin len for caching block groups Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.4 374/453] ext4: fix a memory leak of ext4_free_data Greg Kroah-Hartman
                   ` (83 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Qu Wenruo, Filipe Manana,
	David Sterba, Sudip Mukherjee

From: Qu Wenruo <wqu@suse.com>

commit c57dd1f2f6a7cd1bb61802344f59ccdc5278c983 upstream

[BUG]
The following script can lead to tons of beyond device boundary access:

  mkfs.btrfs -f $dev -b 10G
  mount $dev $mnt
  trimfs $mnt
  btrfs filesystem resize 1:-1G $mnt
  trimfs $mnt

[CAUSE]
Since commit 929be17a9b49 ("btrfs: Switch btrfs_trim_free_extents to
find_first_clear_extent_bit"), we try to avoid trimming ranges that's
already trimmed.

So we check device->alloc_state by finding the first range which doesn't
have CHUNK_TRIMMED and CHUNK_ALLOCATED not set.

But if we shrunk the device, that bits are not cleared, thus we could
easily got a range starts beyond the shrunk device size.

This results the returned @start and @end are all beyond device size,
then we call "end = min(end, device->total_bytes -1);" making @end
smaller than device size.

Then finally we goes "len = end - start + 1", totally underflow the
result, and lead to the beyond-device-boundary access.

[FIX]
This patch will fix the problem in two ways:

- Clear CHUNK_TRIMMED | CHUNK_ALLOCATED bits when shrinking device
  This is the root fix

- Add extra safety check when trimming free device extents
  We check and warn if the returned range is already beyond current
  device.

Link: https://github.com/kdave/btrfs-progs/issues/282
Fixes: 929be17a9b49 ("btrfs: Switch btrfs_trim_free_extents to find_first_clear_extent_bit")
CC: stable@vger.kernel.org # 5.4+
Signed-off-by: Qu Wenruo <wqu@suse.com>
Reviewed-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
[sudip: adjust context and use extent_io.h]
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/btrfs/extent-tree.c |   14 ++++++++++++++
 fs/btrfs/extent_io.h   |    2 ++
 fs/btrfs/volumes.c     |    4 ++++
 3 files changed, 20 insertions(+)

--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -32,6 +32,7 @@
 #include "block-rsv.h"
 #include "delalloc-space.h"
 #include "block-group.h"
+#include "rcu-string.h"
 
 #undef SCRAMBLE_DELAYED_REFS
 
@@ -5618,6 +5619,19 @@ static int btrfs_trim_free_extents(struc
 					    &start, &end,
 					    CHUNK_TRIMMED | CHUNK_ALLOCATED);
 
+		/* Check if there are any CHUNK_* bits left */
+		if (start > device->total_bytes) {
+			WARN_ON(IS_ENABLED(CONFIG_BTRFS_DEBUG));
+			btrfs_warn_in_rcu(fs_info,
+"ignoring attempt to trim beyond device size: offset %llu length %llu device %s device size %llu",
+					  start, end - start + 1,
+					  rcu_str_deref(device->name),
+					  device->total_bytes);
+			mutex_unlock(&fs_info->chunk_mutex);
+			ret = 0;
+			break;
+		}
+
 		/* Ensure we skip the reserved area in the first 1M */
 		start = max_t(u64, start, SZ_1M);
 
--- a/fs/btrfs/extent_io.h
+++ b/fs/btrfs/extent_io.h
@@ -35,6 +35,8 @@
  */
 #define CHUNK_ALLOCATED EXTENT_DIRTY
 #define CHUNK_TRIMMED   EXTENT_DEFRAG
+#define CHUNK_STATE_MASK			(CHUNK_ALLOCATED |		\
+						 CHUNK_TRIMMED)
 
 /*
  * flags for bio submission. The high bits indicate the compression
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -4908,6 +4908,10 @@ again:
 	}
 
 	mutex_lock(&fs_info->chunk_mutex);
+	/* Clear all state bits beyond the shrunk device size */
+	clear_extent_bits(&device->alloc_state, new_size, (u64)-1,
+			  CHUNK_STATE_MASK);
+
 	btrfs_device_set_disk_total_bytes(device, new_size);
 	if (list_empty(&device->post_commit_list))
 		list_add_tail(&device->post_commit_list,



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 374/453] ext4: fix a memory leak of ext4_free_data
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (371 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.4 373/453] btrfs: trim: fix underflow in trim length to prevent access beyond device boundary Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.4 375/453] ext4: fix deadlock with fs freezing and EA inodes Greg Kroah-Hartman
                   ` (82 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chunguang Xu, Theodore Tso, stable

From: Chunguang Xu <brookxu@tencent.com>

commit cca415537244f6102cbb09b5b90db6ae2c953bdd upstream.

When freeing metadata, we will create an ext4_free_data and
insert it into the pending free list.  After the current
transaction is committed, the object will be freed.

ext4_mb_free_metadata() will check whether the area to be freed
overlaps with the pending free list. If true, return directly. At this
time, ext4_free_data is leaked.  Fortunately, the probability of this
problem is small, since it only occurs if the file system is corrupted
such that a block is claimed by more one inode and those inodes are
deleted within a single jbd2 transaction.

Signed-off-by: Chunguang Xu <brookxu@tencent.com>
Link: https://lore.kernel.org/r/1604764698-4269-8-git-send-email-brookxu@tencent.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: stable@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/ext4/mballoc.c |    1 +
 1 file changed, 1 insertion(+)

--- a/fs/ext4/mballoc.c
+++ b/fs/ext4/mballoc.c
@@ -4691,6 +4691,7 @@ ext4_mb_free_metadata(handle_t *handle,
 				ext4_group_first_block_no(sb, group) +
 				EXT4_C2B(sbi, cluster),
 				"Block already on to-be-freed list");
+			kmem_cache_free(ext4_free_data_cachep, new_entry);
 			return 0;
 		}
 	}



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 375/453] ext4: fix deadlock with fs freezing and EA inodes
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (372 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.4 374/453] ext4: fix a memory leak of ext4_free_data Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.4 376/453] KVM: arm64: Introduce handling of AArch32 TTBCR2 traps Greg Kroah-Hartman
                   ` (81 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jan Kara, Andreas Dilger, Theodore Tso

From: Jan Kara <jack@suse.cz>

commit 46e294efc355c48d1dd4d58501aa56dac461792a upstream.

Xattr code using inodes with large xattr data can end up dropping last
inode reference (and thus deleting the inode) from places like
ext4_xattr_set_entry(). That function is called with transaction started
and so ext4_evict_inode() can deadlock against fs freezing like:

CPU1					CPU2

removexattr()				freeze_super()
  vfs_removexattr()
    ext4_xattr_set()
      handle = ext4_journal_start()
      ...
      ext4_xattr_set_entry()
        iput(old_ea_inode)
          ext4_evict_inode(old_ea_inode)
					  sb->s_writers.frozen = SB_FREEZE_FS;
					  sb_wait_write(sb, SB_FREEZE_FS);
					  ext4_freeze()
					    jbd2_journal_lock_updates()
					      -> blocks waiting for all
					         handles to stop
            sb_start_intwrite()
	      -> blocks as sb is already in SB_FREEZE_FS state

Generally it is advisable to delete inodes from a separate transaction
as it can consume quite some credits however in this case it would be
quite clumsy and furthermore the credits for inode deletion are quite
limited and already accounted for. So just tweak ext4_evict_inode() to
avoid freeze protection if we have transaction already started and thus
it is not really needed anyway.

Cc: stable@vger.kernel.org
Fixes: dec214d00e0d ("ext4: xattr inode deduplication")
Signed-off-by: Jan Kara <jack@suse.cz>
Reviewed-by: Andreas Dilger <adilger@dilger.ca>
Link: https://lore.kernel.org/r/20201127110649.24730-1-jack@suse.cz
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/ext4/inode.c |   21 +++++++++++++++------
 1 file changed, 15 insertions(+), 6 deletions(-)

--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -203,6 +203,7 @@ void ext4_evict_inode(struct inode *inod
 	 */
 	int extra_credits = 6;
 	struct ext4_xattr_inode_array *ea_inode_array = NULL;
+	bool freeze_protected = false;
 
 	trace_ext4_evict_inode(inode);
 
@@ -250,9 +251,14 @@ void ext4_evict_inode(struct inode *inod
 
 	/*
 	 * Protect us against freezing - iput() caller didn't have to have any
-	 * protection against it
-	 */
-	sb_start_intwrite(inode->i_sb);
+	 * protection against it. When we are in a running transaction though,
+	 * we are already protected against freezing and we cannot grab further
+	 * protection due to lock ordering constraints.
+	 */
+	if (!ext4_journal_current_handle()) {
+		sb_start_intwrite(inode->i_sb);
+		freeze_protected = true;
+	}
 
 	if (!IS_NOQUOTA(inode))
 		extra_credits += EXT4_MAXQUOTAS_DEL_BLOCKS(inode->i_sb);
@@ -271,7 +277,8 @@ void ext4_evict_inode(struct inode *inod
 		 * cleaned up.
 		 */
 		ext4_orphan_del(NULL, inode);
-		sb_end_intwrite(inode->i_sb);
+		if (freeze_protected)
+			sb_end_intwrite(inode->i_sb);
 		goto no_delete;
 	}
 
@@ -312,7 +319,8 @@ void ext4_evict_inode(struct inode *inod
 stop_handle:
 		ext4_journal_stop(handle);
 		ext4_orphan_del(NULL, inode);
-		sb_end_intwrite(inode->i_sb);
+		if (freeze_protected)
+			sb_end_intwrite(inode->i_sb);
 		ext4_xattr_inode_array_free(ea_inode_array);
 		goto no_delete;
 	}
@@ -341,7 +349,8 @@ stop_handle:
 	else
 		ext4_free_inode(handle, inode);
 	ext4_journal_stop(handle);
-	sb_end_intwrite(inode->i_sb);
+	if (freeze_protected)
+		sb_end_intwrite(inode->i_sb);
 	ext4_xattr_inode_array_free(ea_inode_array);
 	return;
 no_delete:



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 376/453] KVM: arm64: Introduce handling of AArch32 TTBCR2 traps
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (373 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.4 375/453] ext4: fix deadlock with fs freezing and EA inodes Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.4 377/453] ARM: dts: pandaboard: fix pinmux for gpio user button of Pandaboard ES Greg Kroah-Hartman
                   ` (80 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, James Morse, Marc Zyngier

From: Marc Zyngier <maz@kernel.org>

commit ca4e514774930f30b66375a974b5edcbebaf0e7e upstream.

ARMv8.2 introduced TTBCR2, which shares TCR_EL1 with TTBCR.
Gracefully handle traps to this register when HCR_EL2.TVM is set.

Cc: stable@vger.kernel.org
Reported-by: James Morse <james.morse@arm.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/arm64/include/asm/kvm_host.h |    1 +
 arch/arm64/kvm/sys_regs.c         |    1 +
 2 files changed, 2 insertions(+)

--- a/arch/arm64/include/asm/kvm_host.h
+++ b/arch/arm64/include/asm/kvm_host.h
@@ -182,6 +182,7 @@ enum vcpu_sysreg {
 #define c2_TTBR1	(TTBR1_EL1 * 2)	/* Translation Table Base Register 1 */
 #define c2_TTBR1_high	(c2_TTBR1 + 1)	/* TTBR1 top 32 bits */
 #define c2_TTBCR	(TCR_EL1 * 2)	/* Translation Table Base Control R. */
+#define c2_TTBCR2	(c2_TTBCR + 1)	/* Translation Table Base Control R. 2 */
 #define c3_DACR		(DACR32_EL2 * 2)/* Domain Access Control Register */
 #define c5_DFSR		(ESR_EL1 * 2)	/* Data Fault Status Register */
 #define c5_IFSR		(IFSR32_EL2 * 2)/* Instruction Fault Status Register */
--- a/arch/arm64/kvm/sys_regs.c
+++ b/arch/arm64/kvm/sys_regs.c
@@ -1837,6 +1837,7 @@ static const struct sys_reg_desc cp15_re
 	{ Op1( 0), CRn( 2), CRm( 0), Op2( 0), access_vm_reg, NULL, c2_TTBR0 },
 	{ Op1( 0), CRn( 2), CRm( 0), Op2( 1), access_vm_reg, NULL, c2_TTBR1 },
 	{ Op1( 0), CRn( 2), CRm( 0), Op2( 2), access_vm_reg, NULL, c2_TTBCR },
+	{ Op1( 0), CRn( 2), CRm( 0), Op2( 3), access_vm_reg, NULL, c2_TTBCR2 },
 	{ Op1( 0), CRn( 3), CRm( 0), Op2( 0), access_vm_reg, NULL, c3_DACR },
 	{ Op1( 0), CRn( 5), CRm( 0), Op2( 0), access_vm_reg, NULL, c5_DFSR },
 	{ Op1( 0), CRn( 5), CRm( 0), Op2( 1), access_vm_reg, NULL, c5_IFSR },



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 377/453] ARM: dts: pandaboard: fix pinmux for gpio user button of Pandaboard ES
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (374 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.4 376/453] KVM: arm64: Introduce handling of AArch32 TTBCR2 traps Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.4 378/453] ARM: dts: at91: sama5d2: fix CAN message ram offset and size Greg Kroah-Hartman
                   ` (79 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, H. Nikolaus Schaller, Tony Lindgren

From: H. Nikolaus Schaller <hns@goldelico.com>

commit df9dbaf2c415cd94ad520067a1eccfee62f00a33 upstream.

The pinmux control register offset passed to OMAP4_IOPAD is odd.

Fixes: ab9a13665e7c ("ARM: dts: pandaboard: add gpio user button")
Cc: stable@vger.kernel.org
Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/arm/boot/dts/omap4-panda-es.dts |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/arm/boot/dts/omap4-panda-es.dts
+++ b/arch/arm/boot/dts/omap4-panda-es.dts
@@ -46,7 +46,7 @@
 
 	button_pins: pinmux_button_pins {
 		pinctrl-single,pins = <
-			OMAP4_IOPAD(0x11b, PIN_INPUT_PULLUP | MUX_MODE3) /* gpio_113 */
+			OMAP4_IOPAD(0x0fc, PIN_INPUT_PULLUP | MUX_MODE3) /* gpio_113 */
 		>;
 	};
 };



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 378/453] ARM: dts: at91: sama5d2: fix CAN message ram offset and size
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (375 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.4 377/453] ARM: dts: pandaboard: fix pinmux for gpio user button of Pandaboard ES Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.4 379/453] xprtrdma: Fix XDRBUF_SPARSE_PAGES support Greg Kroah-Hartman
                   ` (78 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Sneddon, Nicolas Ferre,
	Alexandre Belloni, Cristian Birsan

From: Nicolas Ferre <nicolas.ferre@microchip.com>

commit 85b8350ae99d1300eb6dc072459246c2649a8e50 upstream.

CAN0 and CAN1 instances share the same message ram configured
at 0x210000 on sama5d2 Linux systems.
According to current configuration of CAN0, we need 0x1c00 bytes
so that the CAN1 don't overlap its message ram:
64 x RX FIFO0 elements => 64 x 72 bytes
32 x TXE (TX Event FIFO) elements => 32 x 8 bytes
32 x TXB (TX Buffer) elements => 32 x 72 bytes
So a total of 7168 bytes (0x1C00).

Fix offset to match this needed size.
Make the CAN0 message ram ioremap match exactly this size so that is
easily understandable.  Adapt CAN1 size accordingly.

Fixes: bc6d5d7666b7 ("ARM: dts: at91: sama5d2: add m_can nodes")
Reported-by: Dan Sneddon <dan.sneddon@microchip.com>
Signed-off-by: Nicolas Ferre <nicolas.ferre@microchip.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Tested-by: Cristian Birsan <cristian.birsan@microchip.com>
Cc: stable@vger.kernel.org # v4.13+
Link: https://lore.kernel.org/r/20201203091949.9015-1-nicolas.ferre@microchip.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/arm/boot/dts/sama5d2.dtsi |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- a/arch/arm/boot/dts/sama5d2.dtsi
+++ b/arch/arm/boot/dts/sama5d2.dtsi
@@ -717,7 +717,7 @@
 
 			can0: can@f8054000 {
 				compatible = "bosch,m_can";
-				reg = <0xf8054000 0x4000>, <0x210000 0x4000>;
+				reg = <0xf8054000 0x4000>, <0x210000 0x1c00>;
 				reg-names = "m_can", "message_ram";
 				interrupts = <56 IRQ_TYPE_LEVEL_HIGH 7>,
 					     <64 IRQ_TYPE_LEVEL_HIGH 7>;
@@ -939,7 +939,7 @@
 
 			can1: can@fc050000 {
 				compatible = "bosch,m_can";
-				reg = <0xfc050000 0x4000>, <0x210000 0x4000>;
+				reg = <0xfc050000 0x4000>, <0x210000 0x3800>;
 				reg-names = "m_can", "message_ram";
 				interrupts = <57 IRQ_TYPE_LEVEL_HIGH 7>,
 					     <65 IRQ_TYPE_LEVEL_HIGH 7>;
@@ -949,7 +949,7 @@
 				assigned-clocks = <&pmc PMC_TYPE_GCK 57>;
 				assigned-clock-parents = <&pmc PMC_TYPE_CORE PMC_UTMI>;
 				assigned-clock-rates = <40000000>;
-				bosch,mram-cfg = <0x1100 0 0 64 0 0 32 32>;
+				bosch,mram-cfg = <0x1c00 0 0 64 0 0 32 32>;
 				status = "disabled";
 			};
 



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 379/453] xprtrdma: Fix XDRBUF_SPARSE_PAGES support
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (376 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.4 378/453] ARM: dts: at91: sama5d2: fix CAN message ram offset and size Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.4 380/453] powerpc: Fix incorrect stw{, ux, u, x} instructions in __set_pte_at Greg Kroah-Hartman
                   ` (77 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Olga Kornievskaia, Chuck Lever,
	Trond Myklebust

From: Chuck Lever <chuck.lever@oracle.com>

commit 15261b9126cd5bb2ad8521da49d8f5c042d904c7 upstream.

Olga K. observed that rpcrdma_marsh_req() allocates sparse pages
only when it has determined that a Reply chunk is necessary. There
are plenty of cases where no Reply chunk is needed, but the
XDRBUF_SPARSE_PAGES flag is set. The result would be a crash in
rpcrdma_inline_fixup() when it tries to copy parts of the received
Reply into a missing page.

To avoid crashing, handle sparse page allocation up front.

Until XATTR support was added, this issue did not appear often
because the only SPARSE_PAGES consumer always expected a reply large
enough to always require a Reply chunk.

Reported-by: Olga Kornievskaia <kolga@netapp.com>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/sunrpc/xprtrdma/rpc_rdma.c |   40 +++++++++++++++++++++++++++++++---------
 1 file changed, 31 insertions(+), 9 deletions(-)

--- a/net/sunrpc/xprtrdma/rpc_rdma.c
+++ b/net/sunrpc/xprtrdma/rpc_rdma.c
@@ -183,6 +183,31 @@ rpcrdma_nonpayload_inline(const struct r
 		r_xprt->rx_ep.rep_max_inline_recv;
 }
 
+/* ACL likes to be lazy in allocating pages. For TCP, these
+ * pages can be allocated during receive processing. Not true
+ * for RDMA, which must always provision receive buffers
+ * up front.
+ */
+static noinline int
+rpcrdma_alloc_sparse_pages(struct xdr_buf *buf)
+{
+	struct page **ppages;
+	int len;
+
+	len = buf->page_len;
+	ppages = buf->pages + (buf->page_base >> PAGE_SHIFT);
+	while (len > 0) {
+		if (!*ppages)
+			*ppages = alloc_page(GFP_NOWAIT | __GFP_NOWARN);
+		if (!*ppages)
+			return -ENOBUFS;
+		ppages++;
+		len -= PAGE_SIZE;
+	}
+
+	return 0;
+}
+
 /* Split @vec on page boundaries into SGEs. FMR registers pages, not
  * a byte range. Other modes coalesce these SGEs into a single MR
  * when they can.
@@ -237,15 +262,6 @@ rpcrdma_convert_iovs(struct rpcrdma_xprt
 	ppages = xdrbuf->pages + (xdrbuf->page_base >> PAGE_SHIFT);
 	page_base = offset_in_page(xdrbuf->page_base);
 	while (len) {
-		/* ACL likes to be lazy in allocating pages - ACLs
-		 * are small by default but can get huge.
-		 */
-		if (unlikely(xdrbuf->flags & XDRBUF_SPARSE_PAGES)) {
-			if (!*ppages)
-				*ppages = alloc_page(GFP_NOWAIT | __GFP_NOWARN);
-			if (!*ppages)
-				return -ENOBUFS;
-		}
 		seg->mr_page = *ppages;
 		seg->mr_offset = (char *)page_base;
 		seg->mr_len = min_t(u32, PAGE_SIZE - page_base, len);
@@ -800,6 +816,12 @@ rpcrdma_marshal_req(struct rpcrdma_xprt
 	__be32 *p;
 	int ret;
 
+	if (unlikely(rqst->rq_rcv_buf.flags & XDRBUF_SPARSE_PAGES)) {
+		ret = rpcrdma_alloc_sparse_pages(&rqst->rq_rcv_buf);
+		if (ret)
+			return ret;
+	}
+
 	rpcrdma_set_xdrlen(&req->rl_hdrbuf, 0);
 	xdr_init_encode(xdr, &req->rl_hdrbuf, rdmab_data(req->rl_rdmabuf),
 			rqst);



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 380/453] powerpc: Fix incorrect stw{, ux, u, x} instructions in __set_pte_at
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (377 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.4 379/453] xprtrdma: Fix XDRBUF_SPARSE_PAGES support Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.4 381/453] powerpc/rtas: Fix typo of ibm,open-errinjct in RTAS filter Greg Kroah-Hartman
                   ` (76 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Mathieu Desnoyers, Christophe Leroy,
	Segher Boessenkool, Michael Ellerman

From: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>

commit d85be8a49e733dcd23674aa6202870d54bf5600d upstream.

The placeholder for instruction selection should use the second
argument's operand, which is %1, not %0. This could generate incorrect
assembly code if the memory addressing of operand %0 is a different
form from that of operand %1.

Also remove the %Un placeholder because having %Un placeholders
for two operands which are based on the same local var (ptep) doesn't
make much sense. By the way, it doesn't change the current behaviour
because "<>" constraint is missing for the associated "=m".

[chleroy: revised commit log iaw segher's comments and removed %U0]

Fixes: 9bf2b5cdc5fe ("powerpc: Fixes for CONFIG_PTE_64BIT for SMP support")
Cc: <stable@vger.kernel.org> # v2.6.28+
Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Acked-by: Segher Boessenkool <segher@kernel.crashing.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/96354bd77977a6a933fe9020da57629007fdb920.1603358942.git.christophe.leroy@csgroup.eu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/powerpc/include/asm/book3s/32/pgtable.h |    4 ++--
 arch/powerpc/include/asm/nohash/pgtable.h    |    4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

--- a/arch/powerpc/include/asm/book3s/32/pgtable.h
+++ b/arch/powerpc/include/asm/book3s/32/pgtable.h
@@ -557,9 +557,9 @@ static inline void __set_pte_at(struct m
 	if (pte_val(*ptep) & _PAGE_HASHPTE)
 		flush_hash_entry(mm, ptep, addr);
 	__asm__ __volatile__("\
-		stw%U0%X0 %2,%0\n\
+		stw%X0 %2,%0\n\
 		eieio\n\
-		stw%U0%X0 %L2,%1"
+		stw%X1 %L2,%1"
 	: "=m" (*ptep), "=m" (*((unsigned char *)ptep+4))
 	: "r" (pte) : "memory");
 
--- a/arch/powerpc/include/asm/nohash/pgtable.h
+++ b/arch/powerpc/include/asm/nohash/pgtable.h
@@ -199,9 +199,9 @@ static inline void __set_pte_at(struct m
 	 */
 	if (IS_ENABLED(CONFIG_PPC32) && IS_ENABLED(CONFIG_PTE_64BIT) && !percpu) {
 		__asm__ __volatile__("\
-			stw%U0%X0 %2,%0\n\
+			stw%X0 %2,%0\n\
 			eieio\n\
-			stw%U0%X0 %L2,%1"
+			stw%X1 %L2,%1"
 		: "=m" (*ptep), "=m" (*((unsigned char *)ptep+4))
 		: "r" (pte) : "memory");
 		return;



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 381/453] powerpc/rtas: Fix typo of ibm,open-errinjct in RTAS filter
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (378 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.4 380/453] powerpc: Fix incorrect stw{, ux, u, x} instructions in __set_pte_at Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.4 382/453] powerpc/feature: Add CPU_FTR_NOEXECUTE to G2_LE Greg Kroah-Hartman
                   ` (75 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Tyrel Datwyler, Michael Ellerman

From: Tyrel Datwyler <tyreld@linux.ibm.com>

commit f10881a46f8914428110d110140a455c66bdf27b upstream.

Commit bd59380c5ba4 ("powerpc/rtas: Restrict RTAS requests from userspace")
introduced the following error when invoking the errinjct userspace
tool:

  [root@ltcalpine2-lp5 librtas]# errinjct open
  [327884.071171] sys_rtas: RTAS call blocked - exploit attempt?
  [327884.071186] sys_rtas: token=0x26, nargs=0 (called by errinjct)
  errinjct: Could not open RTAS error injection facility
  errinjct: librtas: open: Unexpected I/O error

The entry for ibm,open-errinjct in rtas_filter array has a typo where
the "j" is omitted in the rtas call name. After fixing this typo the
errinjct tool functions again as expected.

  [root@ltcalpine2-lp5 linux]# errinjct open
  RTAS error injection facility open, token = 1

Fixes: bd59380c5ba4 ("powerpc/rtas: Restrict RTAS requests from userspace")
Cc: stable@vger.kernel.org
Signed-off-by: Tyrel Datwyler <tyreld@linux.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20201208195434.8289-1-tyreld@linux.ibm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/powerpc/kernel/rtas.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/powerpc/kernel/rtas.c
+++ b/arch/powerpc/kernel/rtas.c
@@ -978,7 +978,7 @@ static struct rtas_filter rtas_filters[]
 	{ "ibm,display-message", -1, 0, -1, -1, -1 },
 	{ "ibm,errinjct", -1, 2, -1, -1, -1, 1024 },
 	{ "ibm,close-errinjct", -1, -1, -1, -1, -1 },
-	{ "ibm,open-errinct", -1, -1, -1, -1, -1 },
+	{ "ibm,open-errinjct", -1, -1, -1, -1, -1 },
 	{ "ibm,get-config-addr-info2", -1, -1, -1, -1, -1 },
 	{ "ibm,get-dynamic-sensor-state", -1, 1, -1, -1, -1 },
 	{ "ibm,get-indices", -1, 2, 3, -1, -1 },



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 382/453] powerpc/feature: Add CPU_FTR_NOEXECUTE to G2_LE
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (379 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.4 381/453] powerpc/rtas: Fix typo of ibm,open-errinjct in RTAS filter Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.4 383/453] powerpc/xmon: Change printk() to pr_cont() Greg Kroah-Hartman
                   ` (74 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christophe Leroy, Michael Ellerman

From: Christophe Leroy <christophe.leroy@csgroup.eu>

commit 197493af414ee22427be3343637ac290a791925a upstream.

G2_LE has a 603 core, add CPU_FTR_NOEXECUTE.

Fixes: 385e89d5b20f ("powerpc/mm: add exec protection on powerpc 603")
Cc: stable@vger.kernel.org
Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/39a530ee41d83f49747ab3af8e39c056450b9b4d.1602489653.git.christophe.leroy@csgroup.eu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/powerpc/include/asm/cputable.h |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/powerpc/include/asm/cputable.h
+++ b/arch/powerpc/include/asm/cputable.h
@@ -367,7 +367,7 @@ static inline void cpu_feature_keys_init
 	    CPU_FTR_PPC_LE | CPU_FTR_NEED_PAIRED_STWCX)
 #define CPU_FTRS_82XX	(CPU_FTR_COMMON | CPU_FTR_MAYBE_CAN_DOZE | CPU_FTR_NOEXECUTE)
 #define CPU_FTRS_G2_LE	(CPU_FTR_COMMON | CPU_FTR_MAYBE_CAN_DOZE | \
-	    CPU_FTR_MAYBE_CAN_NAP)
+	    CPU_FTR_MAYBE_CAN_NAP | CPU_FTR_NOEXECUTE)
 #define CPU_FTRS_E300	(CPU_FTR_MAYBE_CAN_DOZE | \
 	    CPU_FTR_MAYBE_CAN_NAP | \
 	    CPU_FTR_COMMON  | CPU_FTR_NOEXECUTE)



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 383/453] powerpc/xmon: Change printk() to pr_cont()
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (380 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.4 382/453] powerpc/feature: Add CPU_FTR_NOEXECUTE to G2_LE Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.4 384/453] powerpc/8xx: Fix early debug when SMC1 is relocated Greg Kroah-Hartman
                   ` (73 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christophe Leroy, Michael Ellerman

From: Christophe Leroy <christophe.leroy@csgroup.eu>

commit 7c6c86b36a36dd4a13d30bba07718e767aa2e7a1 upstream.

Since some time now, printk() adds carriage return, leading to
unusable xmon output if there is no udbg backend available:

  [   54.288722] sysrq: Entering xmon
  [   54.292209] Vector: 0  at [cace3d2c]
  [   54.292274]     pc:
  [   54.292331] c0023650
  [   54.292468] : xmon+0x28/0x58
  [   54.292519]
  [   54.292574]     lr:
  [   54.292630] c0023724
  [   54.292749] : sysrq_handle_xmon+0xa4/0xfc
  [   54.292801]
  [   54.292867]     sp: cace3de8
  [   54.292931]    msr: 9032
  [   54.292999]   current = 0xc28d0000
  [   54.293072]     pid   = 377, comm = sh
  [   54.293157] Linux version 5.10.0-rc6-s3k-dev-01364-gedf13f0ccd76-dirty (root@po17688vm.idsi0.si.c-s.fr) (powerpc64-linux-gcc (GCC) 10.1.0, GNU ld (GNU Binutils) 2.34) #4211 PREEMPT Fri Dec 4 09:32:11 UTC 2020
  [   54.293287] enter ? for help
  [   54.293470] [cace3de8]
  [   54.293532] c0023724
  [   54.293654]  sysrq_handle_xmon+0xa4/0xfc
  [   54.293711]  (unreliable)
  ...
  [   54.296002]
  [   54.296159] --- Exception: c01 (System Call) at
  [   54.296217] 0fd4e784
  [   54.296303]
  [   54.296375] SP (7fca6ff0) is in userspace
  [   54.296431] mon>
  [   54.296484]  <no input ...>

Use pr_cont() instead.

Fixes: 4bcc595ccd80 ("printk: reinstate KERN_CONT for printing continuation lines")
Cc: stable@vger.kernel.org # v4.9+
Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
[mpe: Mention that it only happens when udbg is not available]
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/c8a6ec704416ecd5ff2bd26213c9bc026bdd19de.1607077340.git.christophe.leroy@csgroup.eu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/powerpc/xmon/nonstdio.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/powerpc/xmon/nonstdio.c
+++ b/arch/powerpc/xmon/nonstdio.c
@@ -178,7 +178,7 @@ void xmon_printf(const char *format, ...
 
 	if (n && rc == 0) {
 		/* No udbg hooks, fallback to printk() - dangerous */
-		printk("%s", xmon_outbuf);
+		pr_cont("%s", xmon_outbuf);
 	}
 }
 



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 384/453] powerpc/8xx: Fix early debug when SMC1 is relocated
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (381 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.4 383/453] powerpc/xmon: Change printk() to pr_cont() Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.4 385/453] powerpc/mm: Fix verification of MMU_FTR_TYPE_44x Greg Kroah-Hartman
                   ` (72 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christophe Leroy, Michael Ellerman

From: Christophe Leroy <christophe.leroy@csgroup.eu>

commit 1e78f723d6a52966bfe3804209dbf404fdc9d3bb upstream.

When SMC1 is relocated and early debug is selected, the
board hangs is ppc_md.setup_arch(). This is because ones
the microcode has been loaded and SMC1 relocated, early
debug writes in the weed.

To allow smooth continuation, the SMC1 parameter RAM set up
by the bootloader have to be copied into the new location.

Fixes: 43db76f41824 ("powerpc/8xx: Add microcode patch to move SMC parameter RAM.")
Cc: stable@vger.kernel.org
Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/b2f71f39eca543f1e4ec06596f09a8b12235c701.1607076683.git.christophe.leroy@csgroup.eu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/powerpc/include/asm/cpm1.h         |    1 +
 arch/powerpc/platforms/8xx/micropatch.c |   11 +++++++++++
 2 files changed, 12 insertions(+)

--- a/arch/powerpc/include/asm/cpm1.h
+++ b/arch/powerpc/include/asm/cpm1.h
@@ -68,6 +68,7 @@ extern void cpm_reset(void);
 #define PROFF_SPI	((uint)0x0180)
 #define PROFF_SCC3	((uint)0x0200)
 #define PROFF_SMC1	((uint)0x0280)
+#define PROFF_DSP1	((uint)0x02c0)
 #define PROFF_SCC4	((uint)0x0300)
 #define PROFF_SMC2	((uint)0x0380)
 
--- a/arch/powerpc/platforms/8xx/micropatch.c
+++ b/arch/powerpc/platforms/8xx/micropatch.c
@@ -361,6 +361,17 @@ void __init cpm_load_patch(cpm8xx_t *cp)
 	if (IS_ENABLED(CONFIG_SMC_UCODE_PATCH)) {
 		smc_uart_t *smp;
 
+		if (IS_ENABLED(CONFIG_PPC_EARLY_DEBUG_CPM)) {
+			int i;
+
+			for (i = 0; i < sizeof(*smp); i += 4) {
+				u32 __iomem *src = (u32 __iomem *)&cp->cp_dparam[PROFF_SMC1 + i];
+				u32 __iomem *dst = (u32 __iomem *)&cp->cp_dparam[PROFF_DSP1 + i];
+
+				out_be32(dst, in_be32(src));
+			}
+		}
+
 		smp = (smc_uart_t *)&cp->cp_dparam[PROFF_SMC1];
 		out_be16(&smp->smc_rpbase, 0x1ec0);
 		smp = (smc_uart_t *)&cp->cp_dparam[PROFF_SMC2];



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 385/453] powerpc/mm: Fix verification of MMU_FTR_TYPE_44x
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (382 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.4 384/453] powerpc/8xx: Fix early debug when SMC1 is relocated Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.4 386/453] powerpc/powernv/npu: Do not attempt NPU2 setup on POWER8NVL NPU Greg Kroah-Hartman
                   ` (71 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christophe Leroy, Michael Ellerman

From: Christophe Leroy <christophe.leroy@csgroup.eu>

commit 17179aeb9d34cc81e1a4ae3f85e5b12b13a1f8d0 upstream.

MMU_FTR_TYPE_44x cannot be checked by cpu_has_feature()

Use mmu_has_feature() instead

Fixes: 23eb7f560a2a ("powerpc: Convert flush_icache_range & friends to C")
Cc: stable@vger.kernel.org
Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/ceede82fadf37f3b8275e61fcf8cf29a3e2ec7fe.1602351011.git.christophe.leroy@csgroup.eu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/powerpc/mm/mem.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/powerpc/mm/mem.c
+++ b/arch/powerpc/mm/mem.c
@@ -530,7 +530,7 @@ void __flush_dcache_icache(void *p)
 	 * space occurs, before returning to user space.
 	 */
 
-	if (cpu_has_feature(MMU_FTR_TYPE_44x))
+	if (mmu_has_feature(MMU_FTR_TYPE_44x))
 		return;
 
 	invalidate_icache_range(addr, addr + PAGE_SIZE);



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 386/453] powerpc/powernv/npu: Do not attempt NPU2 setup on POWER8NVL NPU
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (383 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.4 385/453] powerpc/mm: Fix verification of MMU_FTR_TYPE_44x Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.4 387/453] powerpc/powernv/memtrace: Dont leak kernel memory to user space Greg Kroah-Hartman
                   ` (70 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Alexey Kardashevskiy, Michael Ellerman

From: Alexey Kardashevskiy <aik@ozlabs.ru>

commit b1198a88230f2ce50c271e22b82a8b8610b2eea9 upstream.

We execute certain NPU2 setup code (such as mapping an LPID to a device
in NPU2) unconditionally if an Nvlink bridge is detected. However this
cannot succeed on POWER8NVL machines and errors appear in dmesg. This is
harmless as skiboot returns an error and the only place we check it is
vfio-pci but that code does not get called on P8+ either.

This adds a check if pnv_npu2_xxx helpers are called on a machine with
NPU2 which initializes pnv_phb::npu in pnv_npu2_init();
pnv_phb::npu==NULL on POWER8/NVL (Naples).

While at this, fix NULL derefencing in pnv_npu_peers_take_ownership/
pnv_npu_peers_release_ownership which occurs when GPUs on mentioned P8s
cause EEH which happens if "vfio-pci" disables devices using
the D3 power state; the vfio-pci's disable_idle_d3 module parameter
controls this and must be set on Naples. The EEH handling clears
the entire pnv_ioda_pe struct in pnv_ioda_free_pe() hence
the NULL derefencing. We cannot recover from that but at least we stop
crashing.

Tested on
- POWER9 pvr=004e1201, Ubuntu 19.04 host, Ubuntu 18.04 vm,
  NVIDIA GV100 10de:1db1 driver 418.39
- POWER8 pvr=004c0100, RHEL 7.6 host, Ubuntu 16.10 vm,
  NVIDIA P100 10de:15f9 driver 396.47

Fixes: 1b785611e119 ("powerpc/powernv/npu: Add release_ownership hook")
Cc: stable@vger.kernel.org # 5.0
Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20201122073828.15446-1-aik@ozlabs.ru
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/powerpc/platforms/powernv/npu-dma.c |   16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

--- a/arch/powerpc/platforms/powernv/npu-dma.c
+++ b/arch/powerpc/platforms/powernv/npu-dma.c
@@ -384,7 +384,8 @@ static void pnv_npu_peers_take_ownership
 	for (i = 0; i < npucomp->pe_num; ++i) {
 		struct pnv_ioda_pe *pe = npucomp->pe[i];
 
-		if (!pe->table_group.ops->take_ownership)
+		if (!pe->table_group.ops ||
+		    !pe->table_group.ops->take_ownership)
 			continue;
 		pe->table_group.ops->take_ownership(&pe->table_group);
 	}
@@ -400,7 +401,8 @@ static void pnv_npu_peers_release_owners
 	for (i = 0; i < npucomp->pe_num; ++i) {
 		struct pnv_ioda_pe *pe = npucomp->pe[i];
 
-		if (!pe->table_group.ops->release_ownership)
+		if (!pe->table_group.ops ||
+		    !pe->table_group.ops->release_ownership)
 			continue;
 		pe->table_group.ops->release_ownership(&pe->table_group);
 	}
@@ -560,6 +562,11 @@ int pnv_npu2_map_lpar_dev(struct pci_dev
 		return -ENODEV;
 
 	hose = pci_bus_to_host(npdev->bus);
+	if (hose->npu == NULL) {
+		dev_info_once(&npdev->dev, "Nvlink1 does not support contexts");
+		return 0;
+	}
+
 	nphb = hose->private_data;
 
 	dev_dbg(&gpdev->dev, "Map LPAR opalid=%llu lparid=%u\n",
@@ -607,6 +614,11 @@ int pnv_npu2_unmap_lpar_dev(struct pci_d
 		return -ENODEV;
 
 	hose = pci_bus_to_host(npdev->bus);
+	if (hose->npu == NULL) {
+		dev_info_once(&npdev->dev, "Nvlink1 does not support contexts");
+		return 0;
+	}
+
 	nphb = hose->private_data;
 
 	dev_dbg(&gpdev->dev, "destroy context opalid=%llu\n",



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 387/453] powerpc/powernv/memtrace: Dont leak kernel memory to user space
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (384 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.4 386/453] powerpc/powernv/npu: Do not attempt NPU2 setup on POWER8NVL NPU Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.4 388/453] powerpc/powernv/memtrace: Fix crashing the kernel when enabling concurrently Greg Kroah-Hartman
                   ` (69 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Michael Ellerman, David Hildenbrand,
	Oscar Salvador

From: David Hildenbrand <david@redhat.com>

commit c74cf7a3d59a21b290fe0468f5b470d0b8ee37df upstream.

We currently leak kernel memory to user space, because memory
offlining doesn't do any implicit clearing of memory and we are
missing explicit clearing of memory.

Let's keep it simple and clear pages before removing the linear
mapping.

Reproduced in QEMU/TCG with 10 GiB of main memory:
  [root@localhost ~]# dd obs=9G if=/dev/urandom of=/dev/null
  [... wait until "free -m" used counter no longer changes and cancel]
  19665802+0 records in
  1+0 records out
  9663676416 bytes (9.7 GB, 9.0 GiB) copied, 135.548 s, 71.3 MB/s
  [root@localhost ~]# cat /sys/devices/system/memory/block_size_bytes
  40000000
  [root@localhost ~]# echo 0x40000000 > /sys/kernel/debug/powerpc/memtrace/enable
  [  402.978663][ T1086] page:000000001bc4bc74 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x24900
  [  402.980063][ T1086] flags: 0x7ffff000001000(reserved)
  [  402.980415][ T1086] raw: 007ffff000001000 c00c000000924008 c00c000000924008 0000000000000000
  [  402.980627][ T1086] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
  [  402.980845][ T1086] page dumped because: unmovable page
  [  402.989608][ T1086] Offlined Pages 16384
  [  403.324155][ T1086] memtrace: Allocated trace memory on node 0 at 0x0000000200000000

Before this patch:
  [root@localhost ~]# hexdump -C /sys/kernel/debug/powerpc/memtrace/00000000/trace  | head
  00000000  c8 25 72 51 4d 26 36 c5  5c c2 56 15 d5 1a cd 10  |.%rQM&6.\.V.....|
  00000010  19 b9 50 b2 cb e3 60 b8  ec 0a f3 ec 4b 3c 39 f0  |..P...`.....K<9.|$
  00000020  4e 5a 4c cf bd 26 19 ff  37 79 13 67 24 b7 b8 57  |NZL..&..7y.g$..W|$
  00000030  98 3e f5 be 6f 14 6a bd  a4 52 bc 6e e9 e0 c1 5d  |.>..o.j..R.n...]|$
  00000040  76 b3 ae b5 88 d7 da e3  64 23 85 2c 10 88 07 b6  |v.......d#.,....|$
  00000050  9a d8 91 de f7 50 27 69  2e 64 9c 6f d3 19 45 79  |.....P'i.d.o..Ey|$
  00000060  6a 6f 8a 61 71 19 1f c7  f1 df 28 26 ca 0f 84 55  |jo.aq.....(&...U|$
  00000070  01 3f be e4 e2 e1 da ff  7b 8c 8e 32 37 b4 24 53  |.?......{..27.$S|$
  00000080  1b 70 30 45 56 e6 8c c4  0e b5 4c fb 9f dd 88 06  |.p0EV.....L.....|$
  00000090  ef c4 18 79 f1 60 b1 5c  79 59 4d f4 36 d7 4a 5c  |...y.`.\yYM.6.J\|$

After this patch:
  [root@localhost ~]# hexdump -C /sys/kernel/debug/powerpc/memtrace/00000000/trace  | head
  00000000  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
  *
  40000000

Fixes: 9d5171a8f248 ("powerpc/powernv: Enable removal of memory for in memory tracing")
Cc: stable@vger.kernel.org # v4.14+
Reported-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Oscar Salvador <osalvador@suse.de>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20201111145322.15793-2-david@redhat.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/powerpc/platforms/powernv/memtrace.c |   22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

--- a/arch/powerpc/platforms/powernv/memtrace.c
+++ b/arch/powerpc/platforms/powernv/memtrace.c
@@ -67,6 +67,23 @@ static int change_memblock_state(struct
 	return 0;
 }
 
+static void memtrace_clear_range(unsigned long start_pfn,
+				 unsigned long nr_pages)
+{
+	unsigned long pfn;
+
+	/*
+	 * As pages are offline, we cannot trust the memmap anymore. As HIGHMEM
+	 * does not apply, avoid passing around "struct page" and use
+	 * clear_page() instead directly.
+	 */
+	for (pfn = start_pfn; pfn < start_pfn + nr_pages; pfn++) {
+		if (IS_ALIGNED(pfn, PAGES_PER_SECTION))
+			cond_resched();
+		clear_page(__va(PFN_PHYS(pfn)));
+	}
+}
+
 /* called with device_hotplug_lock held */
 static bool memtrace_offline_pages(u32 nid, u64 start_pfn, u64 nr_pages)
 {
@@ -112,6 +129,11 @@ static u64 memtrace_alloc_node(u32 nid,
 	for (base_pfn = end_pfn; base_pfn > start_pfn; base_pfn -= nr_pages) {
 		if (memtrace_offline_pages(nid, base_pfn, nr_pages) == true) {
 			/*
+			 * Clear the range while we still have a linear
+			 * mapping.
+			 */
+			memtrace_clear_range(base_pfn, nr_pages);
+			/*
 			 * Remove memory in memory block size chunks so that
 			 * iomem resources are always split to the same size and
 			 * we never try to remove memory that spans two iomem



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 388/453] powerpc/powernv/memtrace: Fix crashing the kernel when enabling concurrently
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (385 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.4 387/453] powerpc/powernv/memtrace: Dont leak kernel memory to user space Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.4 389/453] ima: Dont modify file descriptor mode on the fly Greg Kroah-Hartman
                   ` (68 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, David Hildenbrand, Oscar Salvador,
	Michael Ellerman

From: David Hildenbrand <david@redhat.com>

commit d6718941a2767fb383e105d257d2105fe4f15f0e upstream.

It's very easy to crash the kernel right now by simply trying to
enable memtrace concurrently, hammering on the "enable" interface

loop.sh:
  #!/bin/bash

  dmesg --console-off

  while true; do
          echo 0x40000000 > /sys/kernel/debug/powerpc/memtrace/enable
  done

[root@localhost ~]# loop.sh &
[root@localhost ~]# loop.sh &

Resulting quickly in a kernel crash. Let's properly protect using a
mutex.

Fixes: 9d5171a8f248 ("powerpc/powernv: Enable removal of memory for in memory tracing")
Cc: stable@vger.kernel.org# v4.14+
Signed-off-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Oscar Salvador <osalvador@suse.de>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20201111145322.15793-3-david@redhat.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/powerpc/platforms/powernv/memtrace.c |   22 +++++++++++++++-------
 1 file changed, 15 insertions(+), 7 deletions(-)

--- a/arch/powerpc/platforms/powernv/memtrace.c
+++ b/arch/powerpc/platforms/powernv/memtrace.c
@@ -30,6 +30,7 @@ struct memtrace_entry {
 	char name[16];
 };
 
+static DEFINE_MUTEX(memtrace_mutex);
 static u64 memtrace_size;
 
 static struct memtrace_entry *memtrace_array;
@@ -290,6 +291,7 @@ static int memtrace_online(void)
 
 static int memtrace_enable_set(void *data, u64 val)
 {
+	int rc = -EAGAIN;
 	u64 bytes;
 
 	/*
@@ -302,25 +304,31 @@ static int memtrace_enable_set(void *dat
 		return -EINVAL;
 	}
 
+	mutex_lock(&memtrace_mutex);
+
 	/* Re-add/online previously removed/offlined memory */
 	if (memtrace_size) {
 		if (memtrace_online())
-			return -EAGAIN;
+			goto out_unlock;
 	}
 
-	if (!val)
-		return 0;
+	if (!val) {
+		rc = 0;
+		goto out_unlock;
+	}
 
 	/* Offline and remove memory */
 	if (memtrace_init_regions_runtime(val))
-		return -EINVAL;
+		goto out_unlock;
 
 	if (memtrace_init_debugfs())
-		return -EINVAL;
+		goto out_unlock;
 
 	memtrace_size = val;
-
-	return 0;
+	rc = 0;
+out_unlock:
+	mutex_unlock(&memtrace_mutex);
+	return rc;
 }
 
 static int memtrace_enable_get(void *data, u64 *val)



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 389/453] ima: Dont modify file descriptor mode on the fly
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (386 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.4 388/453] powerpc/powernv/memtrace: Fix crashing the kernel when enabling concurrently Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.4 390/453] um: Remove use of asprinf in umid.c Greg Kroah-Hartman
                   ` (67 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Roberto Sassu, Christoph Hellwig, Mimi Zohar

From: Roberto Sassu <roberto.sassu@huawei.com>

commit 207cdd565dfc95a0a5185263a567817b7ebf5467 upstream.

Commit a408e4a86b36b ("ima: open a new file instance if no read
permissions") already introduced a second open to measure a file when the
original file descriptor does not allow it. However, it didn't remove the
existing method of changing the mode of the original file descriptor, which
is still necessary if the current process does not have enough privileges
to open a new one.

Changing the mode isn't really an option, as the filesystem might need to
do preliminary steps to make the read possible. Thus, this patch removes
the code and keeps the second open as the only option to measure a file
when it is unreadable with the original file descriptor.

Cc: <stable@vger.kernel.org> # 4.20.x: 0014cc04e8ec0 ima: Set file->f_mode
Fixes: 2fe5d6def1672 ("ima: integrity appraisal extension")
Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 security/integrity/ima/ima_crypto.c |   20 +++++---------------
 1 file changed, 5 insertions(+), 15 deletions(-)

--- a/security/integrity/ima/ima_crypto.c
+++ b/security/integrity/ima/ima_crypto.c
@@ -411,7 +411,7 @@ int ima_calc_file_hash(struct file *file
 	loff_t i_size;
 	int rc;
 	struct file *f = file;
-	bool new_file_instance = false, modified_mode = false;
+	bool new_file_instance = false;
 
 	/*
 	 * For consistency, fail file's opened with the O_DIRECT flag on
@@ -429,18 +429,10 @@ int ima_calc_file_hash(struct file *file
 				O_TRUNC | O_CREAT | O_NOCTTY | O_EXCL);
 		flags |= O_RDONLY;
 		f = dentry_open(&file->f_path, flags, file->f_cred);
-		if (IS_ERR(f)) {
-			/*
-			 * Cannot open the file again, lets modify f_mode
-			 * of original and continue
-			 */
-			pr_info_ratelimited("Unable to reopen file for reading.\n");
-			f = file;
-			f->f_mode |= FMODE_READ;
-			modified_mode = true;
-		} else {
-			new_file_instance = true;
-		}
+		if (IS_ERR(f))
+			return PTR_ERR(f);
+
+		new_file_instance = true;
 	}
 
 	i_size = i_size_read(file_inode(f));
@@ -455,8 +447,6 @@ int ima_calc_file_hash(struct file *file
 out:
 	if (new_file_instance)
 		fput(f);
-	else if (modified_mode)
-		f->f_mode &= ~FMODE_READ;
 	return rc;
 }
 



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 390/453] um: Remove use of asprinf in umid.c
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (387 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.4 389/453] ima: Dont modify file descriptor mode on the fly Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.4 391/453] ceph: fix race in concurrent __ceph_remove_cap invocations Greg Kroah-Hartman
                   ` (66 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Anton Ivanov, Richard Weinberger

From: Anton Ivanov <anton.ivanov@cambridgegreys.com>

commit 97be7ceaf7fea68104824b6aa874cff235333ac1 upstream.

asprintf is not compatible with the existing uml memory allocation
mechanism. Its use on the "user" side of UML results in a corrupt slab
state.

Fixes: 0d4e5ac7e780 ("um: remove uses of variable length arrays")
Cc: stable@vger.kernel.org
Signed-off-by: Anton Ivanov <anton.ivanov@cambridgegreys.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/um/os-Linux/umid.c |   17 +++++------------
 1 file changed, 5 insertions(+), 12 deletions(-)

--- a/arch/um/os-Linux/umid.c
+++ b/arch/um/os-Linux/umid.c
@@ -137,20 +137,13 @@ static inline int is_umdir_used(char *di
 {
 	char pid[sizeof("nnnnn\0")], *end, *file;
 	int dead, fd, p, n, err;
-	size_t filelen;
+	size_t filelen = strlen(dir) + sizeof("/pid") + 1;
 
-	err = asprintf(&file, "%s/pid", dir);
-	if (err < 0)
-		return 0;
+	file = malloc(filelen);
+	if (!file)
+		return -ENOMEM;
 
-	filelen = strlen(file);
-
-	n = snprintf(file, filelen, "%s/pid", dir);
-	if (n >= filelen) {
-		printk(UM_KERN_ERR "is_umdir_used - pid filename too long\n");
-		err = -E2BIG;
-		goto out;
-	}
+	snprintf(file, filelen, "%s/pid", dir);
 
 	dead = 0;
 	fd = open(file, O_RDONLY);



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 391/453] ceph: fix race in concurrent __ceph_remove_cap invocations
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (388 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.4 390/453] um: Remove use of asprinf in umid.c Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.4 392/453] SMB3: avoid confusing warning message on mount to Azure Greg Kroah-Hartman
                   ` (65 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jeff Layton, Luis Henriques, Ilya Dryomov

From: Luis Henriques <lhenriques@suse.de>

commit e5cafce3ad0f8652d6849314d951459c2bff7233 upstream.

A NULL pointer dereference may occur in __ceph_remove_cap with some of the
callbacks used in ceph_iterate_session_caps, namely trim_caps_cb and
remove_session_caps_cb. Those callers hold the session->s_mutex, so they
are prevented from concurrent execution, but ceph_evict_inode does not.

Since the callers of this function hold the i_ceph_lock, the fix is simply
a matter of returning immediately if caps->ci is NULL.

Cc: stable@vger.kernel.org
URL: https://tracker.ceph.com/issues/43272
Suggested-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Luis Henriques <lhenriques@suse.de>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/ceph/caps.c |   11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

--- a/fs/ceph/caps.c
+++ b/fs/ceph/caps.c
@@ -1052,12 +1052,19 @@ void __ceph_remove_cap(struct ceph_cap *
 {
 	struct ceph_mds_session *session = cap->session;
 	struct ceph_inode_info *ci = cap->ci;
-	struct ceph_mds_client *mdsc =
-		ceph_sb_to_client(ci->vfs_inode.i_sb)->mdsc;
+	struct ceph_mds_client *mdsc;
 	int removed = 0;
 
+	/* 'ci' being NULL means the remove have already occurred */
+	if (!ci) {
+		dout("%s: cap inode is NULL\n", __func__);
+		return;
+	}
+
 	dout("__ceph_remove_cap %p from %p\n", cap, &ci->vfs_inode);
 
+	mdsc = ceph_inode_to_client(&ci->vfs_inode)->mdsc;
+
 	/* remove from inode's cap rbtree, and clear auth cap */
 	rb_erase(&cap->ci_node, &ci->i_caps);
 	if (ci->i_auth_cap == cap)



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 392/453] SMB3: avoid confusing warning message on mount to Azure
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (389 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.4 391/453] ceph: fix race in concurrent __ceph_remove_cap invocations Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.4 393/453] ubifs: wbuf: Dont leak kernel memory to flash Greg Kroah-Hartman
                   ` (64 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Ronnie Sahlberg, Steve French

From: Steve French <stfrench@microsoft.com>

commit ebcd6de98754d9b6a5f89d7835864b1c365d432f upstream.

Mounts to Azure cause an unneeded warning message in dmesg
   "CIFS: VFS: parse_server_interfaces: incomplete interface info"

Azure rounds up the size (by 8 additional bytes, to a
16 byte boundary) of the structure returned on the query
of the server interfaces at mount time.  This is permissible
even though different than other servers so do not log a warning
if query network interfaces response is only rounded up by 8
bytes or fewer.

CC: Stable <stable@vger.kernel.org>
Reviewed-by: Ronnie Sahlberg <lsahlber@redhat.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/cifs/smb2ops.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/fs/cifs/smb2ops.c
+++ b/fs/cifs/smb2ops.c
@@ -478,7 +478,8 @@ parse_server_interfaces(struct network_i
 		goto out;
 	}
 
-	if (bytes_left || p->Next)
+	/* Azure rounds the buffer size up 8, to a 16 byte boundary */
+	if ((bytes_left > 8) || p->Next)
 		cifs_dbg(VFS, "%s: incomplete interface info\n", __func__);
 
 



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 393/453] ubifs: wbuf: Dont leak kernel memory to flash
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (390 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.4 392/453] SMB3: avoid confusing warning message on mount to Azure Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.4 394/453] jffs2: Fix GC exit abnormally Greg Kroah-Hartman
                   ` (63 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Richard Weinberger, Zhihao Cheng

From: Richard Weinberger <richard@nod.at>

commit 20f1431160c6b590cdc269a846fc5a448abf5b98 upstream.

Write buffers use a kmalloc()'ed buffer, they can leak
up to seven bytes of kernel memory to flash if writes are not
aligned.
So use ubifs_pad() to fill these gaps with padding bytes.
This was never a problem while scanning because the scanner logic
manually aligns node lengths and skips over these gaps.

Cc: <stable@vger.kernel.org>
Fixes: 1e51764a3c2ac05a2 ("UBIFS: add new flash file system")
Signed-off-by: Richard Weinberger <richard@nod.at>
Reviewed-by: Zhihao Cheng <chengzhihao1@huawei.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/ubifs/io.c |   13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

--- a/fs/ubifs/io.c
+++ b/fs/ubifs/io.c
@@ -319,7 +319,7 @@ void ubifs_pad(const struct ubifs_info *
 {
 	uint32_t crc;
 
-	ubifs_assert(c, pad >= 0 && !(pad & 7));
+	ubifs_assert(c, pad >= 0);
 
 	if (pad >= UBIFS_PAD_NODE_SZ) {
 		struct ubifs_ch *ch = buf;
@@ -764,6 +764,10 @@ int ubifs_wbuf_write_nolock(struct ubifs
 		 * write-buffer.
 		 */
 		memcpy(wbuf->buf + wbuf->used, buf, len);
+		if (aligned_len > len) {
+			ubifs_assert(c, aligned_len - len < 8);
+			ubifs_pad(c, wbuf->buf + wbuf->used + len, aligned_len - len);
+		}
 
 		if (aligned_len == wbuf->avail) {
 			dbg_io("flush jhead %s wbuf to LEB %d:%d",
@@ -856,13 +860,18 @@ int ubifs_wbuf_write_nolock(struct ubifs
 	}
 
 	spin_lock(&wbuf->lock);
-	if (aligned_len)
+	if (aligned_len) {
 		/*
 		 * And now we have what's left and what does not take whole
 		 * max. write unit, so write it to the write-buffer and we are
 		 * done.
 		 */
 		memcpy(wbuf->buf, buf + written, len);
+		if (aligned_len > len) {
+			ubifs_assert(c, aligned_len - len < 8);
+			ubifs_pad(c, wbuf->buf + len, aligned_len - len);
+		}
+	}
 
 	if (c->leb_size - wbuf->offs >= c->max_write_size)
 		wbuf->size = c->max_write_size;



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 394/453] jffs2: Fix GC exit abnormally
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (391 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.4 393/453] ubifs: wbuf: Dont leak kernel memory to flash Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.4 395/453] jffs2: Fix ignoring mounting options problem during remounting Greg Kroah-Hartman
                   ` (62 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Zhe Li, Richard Weinberger

From: Zhe Li <lizhe67@huawei.com>

commit 9afc9a8a4909fece0e911e72b1060614ba2f7969 upstream.

The log of this problem is:
jffs2: Error garbage collecting node at 0x***!
jffs2: No space for garbage collection. Aborting GC thread

This is because GC believe that it do nothing, so it abort.

After going over the image of jffs2, I find a scene that
can trigger this problem stably.
The scene is: there is a normal dirent node at summary-area,
but abnormal at corresponding not-summary-area with error
name_crc.

The reason that GC exit abnormally is because it find that
abnormal dirent node to GC, but when it goes to function
jffs2_add_fd_to_list, it cannot meet the condition listed
below:

if ((*prev)->nhash == new->nhash && !strcmp((*prev)->name, new->name))

So no node is marked obsolete, statistical information of
erase_block do not change, which cause GC exit abnormally.

The root cause of this problem is: we do not check the
name_crc of the abnormal dirent node with summary is enabled.

Noticed that in function jffs2_scan_dirent_node, we use
function jffs2_scan_dirty_space to deal with the dirent
node with error name_crc. So this patch add a checking
code in function read_direntry to ensure the correctness
of dirent node. If checked failed, the dirent node will
be marked obsolete so GC will pass this node and this
problem will be fixed.

Cc: <stable@vger.kernel.org>
Signed-off-by: Zhe Li <lizhe67@huawei.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/jffs2/readinode.c |   16 ++++++++++++++++
 1 file changed, 16 insertions(+)

--- a/fs/jffs2/readinode.c
+++ b/fs/jffs2/readinode.c
@@ -672,6 +672,22 @@ static inline int read_direntry(struct j
 			jffs2_free_full_dirent(fd);
 			return -EIO;
 		}
+
+#ifdef CONFIG_JFFS2_SUMMARY
+		/*
+		 * we use CONFIG_JFFS2_SUMMARY because without it, we
+		 * have checked it while mounting
+		 */
+		crc = crc32(0, fd->name, rd->nsize);
+		if (unlikely(crc != je32_to_cpu(rd->name_crc))) {
+			JFFS2_NOTICE("name CRC failed on dirent node at"
+			   "%#08x: read %#08x,calculated %#08x\n",
+			   ref_offset(ref), je32_to_cpu(rd->node_crc), crc);
+			jffs2_mark_node_obsolete(c, ref);
+			jffs2_free_full_dirent(fd);
+			return 0;
+		}
+#endif
 	}
 
 	fd->nhash = full_name_hash(NULL, fd->name, rd->nsize);



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 395/453] jffs2: Fix ignoring mounting options problem during remounting
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (392 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.4 394/453] jffs2: Fix GC exit abnormally Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.4 396/453] jfs: Fix array index bounds check in dbAdjTree Greg Kroah-Hartman
                   ` (61 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, lizhe, Richard Weinberger

From: lizhe <lizhe67@huawei.com>

commit 08cd274f9b8283a1da93e2ccab216a336da83525 upstream.

The jffs2 mount options will be ignored when remounting jffs2.
It can be easily reproduced with the steps listed below.
1. mount -t jffs2 -o compr=none /dev/mtdblockx /mnt
2. mount -o remount compr=zlib /mnt

Since ec10a24f10c8, the option parsing happens before fill_super and
then pass fc, which contains the options parsing results, to function
jffs2_reconfigure during remounting. But function jffs2_reconfigure do
not update c->mount_opts.

This patch add a function jffs2_update_mount_opts to fix this problem.

By the way, I notice that tmpfs use the same way to update remounting
options. If it is necessary to unify them?

Cc: <stable@vger.kernel.org>
Fixes: ec10a24f10c8 ("vfs: Convert jffs2 to use the new mount API")
Signed-off-by: lizhe <lizhe67@huawei.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/jffs2/super.c |   17 +++++++++++++++++
 1 file changed, 17 insertions(+)

--- a/fs/jffs2/super.c
+++ b/fs/jffs2/super.c
@@ -221,11 +221,28 @@ static int jffs2_parse_param(struct fs_c
 	return 0;
 }
 
+static inline void jffs2_update_mount_opts(struct fs_context *fc)
+{
+	struct jffs2_sb_info *new_c = fc->s_fs_info;
+	struct jffs2_sb_info *c = JFFS2_SB_INFO(fc->root->d_sb);
+
+	mutex_lock(&c->alloc_sem);
+	if (new_c->mount_opts.override_compr) {
+		c->mount_opts.override_compr = new_c->mount_opts.override_compr;
+		c->mount_opts.compr = new_c->mount_opts.compr;
+	}
+	if (new_c->mount_opts.rp_size)
+		c->mount_opts.rp_size = new_c->mount_opts.rp_size;
+	mutex_unlock(&c->alloc_sem);
+}
+
 static int jffs2_reconfigure(struct fs_context *fc)
 {
 	struct super_block *sb = fc->root->d_sb;
 
 	sync_filesystem(sb);
+	jffs2_update_mount_opts(fc);
+
 	return jffs2_do_remount_fs(sb, fc);
 }
 



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 396/453] jfs: Fix array index bounds check in dbAdjTree
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (393 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.4 395/453] jffs2: Fix ignoring mounting options problem during remounting Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.4 397/453] drm/amd/display: Honor the offset for plane 0 Greg Kroah-Hartman
                   ` (60 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Dave Kleikamp, butt3rflyh4ck

From: Dave Kleikamp <dave.kleikamp@oracle.com>

commit c61b3e4839007668360ed8b87d7da96d2e59fc6c upstream.

Bounds checking tools can flag a bug in dbAdjTree() for an array index
out of bounds in dmt_stree. Since dmt_stree can refer to the stree in
both structures dmaptree and dmapctl, use the larger array to eliminate
the false positive.

Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
Reported-by: butt3rflyh4ck <butterflyhuangxx@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/jfs/jfs_dmap.h |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/fs/jfs/jfs_dmap.h
+++ b/fs/jfs/jfs_dmap.h
@@ -183,7 +183,7 @@ typedef union dmtree {
 #define	dmt_leafidx	t1.leafidx
 #define	dmt_height	t1.height
 #define	dmt_budmin	t1.budmin
-#define	dmt_stree	t1.stree
+#define	dmt_stree	t2.stree
 
 /*
  *	on-disk aggregate disk allocation map descriptor.



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 397/453] drm/amd/display: Honor the offset for plane 0.
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (394 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.4 396/453] jfs: Fix array index bounds check in dbAdjTree Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.4 398/453] drm/amd/display: Fix memory leaks in S3 resume Greg Kroah-Hartman
                   ` (59 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Bas Nieuwenhuizen, Alex Deucher,
	Nicholas Kazlauskas

From: Bas Nieuwenhuizen <bas@basnieuwenhuizen.nl>

commit be7b9b327e79cd2db07b659af599867b629b2f66 upstream.

With modifiers I'd like to support non-dedicated buffers for
images.

Signed-off-by: Bas Nieuwenhuizen <bas@basnieuwenhuizen.nl>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
Cc: stable@vger.kernel.org # 5.1.0
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c |   14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -2720,6 +2720,7 @@ fill_plane_dcc_attributes(struct amdgpu_
 	struct dc *dc = adev->dm.dc;
 	struct dc_dcc_surface_param input;
 	struct dc_surface_dcc_cap output;
+	uint64_t plane_address = afb->address + afb->base.offsets[0];
 	uint32_t offset = AMDGPU_TILING_GET(info, DCC_OFFSET_256B);
 	uint32_t i64b = AMDGPU_TILING_GET(info, DCC_INDEPENDENT_64B) != 0;
 	uint64_t dcc_address;
@@ -2763,7 +2764,7 @@ fill_plane_dcc_attributes(struct amdgpu_
 		AMDGPU_TILING_GET(info, DCC_PITCH_MAX) + 1;
 	dcc->independent_64b_blks = i64b;
 
-	dcc_address = get_dcc_address(afb->address, info);
+	dcc_address = get_dcc_address(plane_address, info);
 	address->grph.meta_addr.low_part = lower_32_bits(dcc_address);
 	address->grph.meta_addr.high_part = upper_32_bits(dcc_address);
 
@@ -2791,6 +2792,8 @@ fill_plane_buffer_attributes(struct amdg
 	memset(address, 0, sizeof(*address));
 
 	if (format < SURFACE_PIXEL_FORMAT_VIDEO_BEGIN) {
+		uint64_t addr = afb->address + fb->offsets[0];
+
 		plane_size->surface_size.x = 0;
 		plane_size->surface_size.y = 0;
 		plane_size->surface_size.width = fb->width;
@@ -2799,9 +2802,10 @@ fill_plane_buffer_attributes(struct amdg
 			fb->pitches[0] / fb->format->cpp[0];
 
 		address->type = PLN_ADDR_TYPE_GRAPHICS;
-		address->grph.addr.low_part = lower_32_bits(afb->address);
-		address->grph.addr.high_part = upper_32_bits(afb->address);
+		address->grph.addr.low_part = lower_32_bits(addr);
+		address->grph.addr.high_part = upper_32_bits(addr);
 	} else if (format < SURFACE_PIXEL_FORMAT_INVALID) {
+		uint64_t luma_addr = afb->address + fb->offsets[0];
 		uint64_t chroma_addr = afb->address + fb->offsets[1];
 
 		plane_size->surface_size.x = 0;
@@ -2822,9 +2826,9 @@ fill_plane_buffer_attributes(struct amdg
 
 		address->type = PLN_ADDR_TYPE_VIDEO_PROGRESSIVE;
 		address->video_progressive.luma_addr.low_part =
-			lower_32_bits(afb->address);
+			lower_32_bits(luma_addr);
 		address->video_progressive.luma_addr.high_part =
-			upper_32_bits(afb->address);
+			upper_32_bits(luma_addr);
 		address->video_progressive.chroma_addr.low_part =
 			lower_32_bits(chroma_addr);
 		address->video_progressive.chroma_addr.high_part =



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 398/453] drm/amd/display: Fix memory leaks in S3 resume
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (395 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.4 397/453] drm/amd/display: Honor the offset for plane 0 Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.4 399/453] drm/dp_aux_dev: check aux_dev before use in drm_dp_aux_dev_get_by_minor() Greg Kroah-Hartman
                   ` (58 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Harry Wentland, Alex Deucher,
	Nicholas Kazlauskas, Stylon Wang

From: Stylon Wang <stylon.wang@amd.com>

commit a135a1b4c4db1f3b8cbed9676a40ede39feb3362 upstream.

EDID parsing in S3 resume pushes new display modes
to probed_modes list but doesn't consolidate to actual
mode list. This creates a race condition when
amdgpu_dm_connector_ddc_get_modes() re-initializes the
list head without walking the list and results in  memory leak.

Bug: https://bugzilla.kernel.org/show_bug.cgi?id=209987
Acked-by: Harry Wentland <harry.wentland@amd.com>
Acked-by: Alex Deucher <alexander.deucher@amd.com>
Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
Signed-off-by: Stylon Wang <stylon.wang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -1434,7 +1434,8 @@ amdgpu_dm_update_connector_after_detect(
 
 			drm_connector_update_edid_property(connector,
 							   aconnector->edid);
-			drm_add_edid_modes(connector, aconnector->edid);
+			aconnector->num_modes = drm_add_edid_modes(connector, aconnector->edid);
+			drm_connector_list_update(connector);
 
 			if (aconnector->dc_link->aux_mode)
 				drm_dp_cec_set_edid(&aconnector->dm_dp_aux.aux,



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 399/453] drm/dp_aux_dev: check aux_dev before use in drm_dp_aux_dev_get_by_minor()
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (396 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.4 398/453] drm/amd/display: Fix memory leaks in S3 resume Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.4 400/453] drm/i915: Fix mismatch between misplaced vma check and vma insert Greg Kroah-Hartman
                   ` (57 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Zwane Mwaikambo, Lyude Paul

From: Zwane Mwaikambo <zwane@yosper.io>

commit 73b62cdb93b68d7e2c1d373c6a411bc00c53e702 upstream.

I observed this when unplugging a DP monitor whilst a computer is asleep
and then waking it up. This left DP chardev nodes still being present on
the filesystem and accessing these device nodes caused an oops because
drm_dp_aux_dev_get_by_minor() assumes a device exists if it is opened.
This can also be reproduced by creating a device node with mknod(1) and
issuing an open(2)

[166164.933198] BUG: kernel NULL pointer dereference, address: 0000000000000018
[166164.933202] #PF: supervisor read access in kernel mode
[166164.933204] #PF: error_code(0x0000) - not-present page
[166164.933205] PGD 0 P4D 0
[166164.933208] Oops: 0000 [#1] PREEMPT SMP NOPTI
[166164.933211] CPU: 4 PID: 99071 Comm: fwupd Tainted: G        W
5.8.0-rc6+ #1
[166164.933213] Hardware name: LENOVO 20RD002VUS/20RD002VUS, BIOS R16ET25W
(1.11 ) 04/21/2020
[166164.933232] RIP: 0010:drm_dp_aux_dev_get_by_minor+0x29/0x70
[drm_kms_helper]
[166164.933234] Code: 00 0f 1f 44 00 00 55 48 89 e5 41 54 41 89 fc 48 c7
c7 60 01 a4 c0 e8 26 ab 30 d7 44 89 e6 48 c7 c7 80 01 a4 c0 e8 47 94 d6 d6
<8b> 50 18 49 89 c4 48 8d 78 18 85 d2 74 33 8d 4a 01 89 d0 f0 0f b1
[166164.933236] RSP: 0018:ffffb7d7c41cbbf0 EFLAGS: 00010246
[166164.933237] RAX: 0000000000000000 RBX: ffff8a90001fe900 RCX: 0000000000000000
[166164.933238] RDX: 0000000000000000 RSI: 0000000000000003 RDI: ffffffffc0a40180
[166164.933239] RBP: ffffb7d7c41cbbf8 R08: 0000000000000000 R09: ffff8a93e157d6d0
[166164.933240] R10: 0000000000000000 R11: ffffffffc0a40188 R12: 0000000000000003
[166164.933241] R13: ffff8a9402200e80 R14: ffff8a90001fe900 R15: 0000000000000000
[166164.933244] FS:  00007f7fb041eb00(0000) GS:ffff8a9411500000(0000)
knlGS:0000000000000000
[166164.933245] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[166164.933246] CR2: 0000000000000018 CR3: 00000000352c2003 CR4: 00000000003606e0
[166164.933247] Call Trace:
[166164.933264]  auxdev_open+0x1b/0x40 [drm_kms_helper]
[166164.933278]  chrdev_open+0xa7/0x1c0
[166164.933282]  ? cdev_put.part.0+0x20/0x20
[166164.933287]  do_dentry_open+0x161/0x3c0
[166164.933291]  vfs_open+0x2d/0x30
[166164.933297]  path_openat+0xb27/0x10e0
[166164.933306]  ? atime_needs_update+0x73/0xd0
[166164.933309]  do_filp_open+0x91/0x100
[166164.933313]  ? __alloc_fd+0xb2/0x150
[166164.933316]  do_sys_openat2+0x210/0x2d0
[166164.933318]  do_sys_open+0x46/0x80
[166164.933320]  __x64_sys_openat+0x20/0x30
[166164.933328]  do_syscall_64+0x52/0xc0
[166164.933336]  entry_SYSCALL_64_after_hwframe+0x44/0xa9

(gdb) disassemble drm_dp_aux_dev_get_by_minor+0x29
Dump of assembler code for function drm_dp_aux_dev_get_by_minor:
   0x0000000000017b10 <+0>:     callq  0x17b15 <drm_dp_aux_dev_get_by_minor+5>
   0x0000000000017b15 <+5>:     push   %rbp
   0x0000000000017b16 <+6>:     mov    %rsp,%rbp
   0x0000000000017b19 <+9>:     push   %r12
   0x0000000000017b1b <+11>:    mov    %edi,%r12d
   0x0000000000017b1e <+14>:    mov    $0x0,%rdi
   0x0000000000017b25 <+21>:    callq  0x17b2a <drm_dp_aux_dev_get_by_minor+26>
   0x0000000000017b2a <+26>:    mov    %r12d,%esi
   0x0000000000017b2d <+29>:    mov    $0x0,%rdi
   0x0000000000017b34 <+36>:    callq  0x17b39 <drm_dp_aux_dev_get_by_minor+41>
   0x0000000000017b39 <+41>:    mov    0x18(%rax),%edx <=========
   0x0000000000017b3c <+44>:    mov    %rax,%r12
   0x0000000000017b3f <+47>:    lea    0x18(%rax),%rdi
   0x0000000000017b43 <+51>:    test   %edx,%edx
   0x0000000000017b45 <+53>:    je     0x17b7a <drm_dp_aux_dev_get_by_minor+106>
   0x0000000000017b47 <+55>:    lea    0x1(%rdx),%ecx
   0x0000000000017b4a <+58>:    mov    %edx,%eax
   0x0000000000017b4c <+60>:    lock cmpxchg %ecx,(%rdi)
   0x0000000000017b50 <+64>:    jne    0x17b76 <drm_dp_aux_dev_get_by_minor+102>
   0x0000000000017b52 <+66>:    test   %edx,%edx
   0x0000000000017b54 <+68>:    js     0x17b6d <drm_dp_aux_dev_get_by_minor+93>
   0x0000000000017b56 <+70>:    test   %ecx,%ecx
   0x0000000000017b58 <+72>:    js     0x17b6d <drm_dp_aux_dev_get_by_minor+93>
   0x0000000000017b5a <+74>:    mov    $0x0,%rdi
   0x0000000000017b61 <+81>:    callq  0x17b66 <drm_dp_aux_dev_get_by_minor+86>
   0x0000000000017b66 <+86>:    mov    %r12,%rax
   0x0000000000017b69 <+89>:    pop    %r12
   0x0000000000017b6b <+91>:    pop    %rbp
   0x0000000000017b6c <+92>:    retq
   0x0000000000017b6d <+93>:    xor    %esi,%esi
   0x0000000000017b6f <+95>:    callq  0x17b74 <drm_dp_aux_dev_get_by_minor+100>
   0x0000000000017b74 <+100>:   jmp    0x17b5a <drm_dp_aux_dev_get_by_minor+74>
   0x0000000000017b76 <+102>:   mov    %eax,%edx
   0x0000000000017b78 <+104>:   jmp    0x17b43 <drm_dp_aux_dev_get_by_minor+51>
   0x0000000000017b7a <+106>:   xor    %r12d,%r12d
   0x0000000000017b7d <+109>:   jmp    0x17b5a <drm_dp_aux_dev_get_by_minor+74>
End of assembler dump.

(gdb) list *drm_dp_aux_dev_get_by_minor+0x29
0x17b39 is in drm_dp_aux_dev_get_by_minor (drivers/gpu/drm/drm_dp_aux_dev.c:65).
60      static struct drm_dp_aux_dev *drm_dp_aux_dev_get_by_minor(unsigned index)
61      {
62              struct drm_dp_aux_dev *aux_dev = NULL;
63
64              mutex_lock(&aux_idr_mutex);
65              aux_dev = idr_find(&aux_idr, index);
66              if (!kref_get_unless_zero(&aux_dev->refcount))
67                      aux_dev = NULL;
68              mutex_unlock(&aux_idr_mutex);
69
(gdb) p/x &((struct drm_dp_aux_dev *)(0x0))->refcount
$8 = 0x18

Looking at the caller, checks on the minor are pushed down to
drm_dp_aux_dev_get_by_minor()

static int auxdev_open(struct inode *inode, struct file *file)
{
    unsigned int minor = iminor(inode);
    struct drm_dp_aux_dev *aux_dev;

    aux_dev = drm_dp_aux_dev_get_by_minor(minor); <====
    if (!aux_dev)
        return -ENODEV;

    file->private_data = aux_dev;
    return 0;
}

Fixes: e94cb37b34eb ("drm/dp: Add a drm_aux-dev module for reading/writing dpcd registers.")
Cc: <stable@vger.kernel.org> # v4.6+
Signed-off-by: Zwane Mwaikambo <zwane@yosper.io>
Reviewed-by: Lyude Paul <lyude@redhat.com>
[added Cc to stable]
Signed-off-by: Lyude Paul <lyude@redhat.com>
Link: https://patchwork.freedesktop.org/patch/msgid/alpine.DEB.2.21.2010122231070.38717@montezuma.home
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/drm_dp_aux_dev.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/gpu/drm/drm_dp_aux_dev.c
+++ b/drivers/gpu/drm/drm_dp_aux_dev.c
@@ -63,7 +63,7 @@ static struct drm_dp_aux_dev *drm_dp_aux
 
 	mutex_lock(&aux_idr_mutex);
 	aux_dev = idr_find(&aux_idr, index);
-	if (!kref_get_unless_zero(&aux_dev->refcount))
+	if (aux_dev && !kref_get_unless_zero(&aux_dev->refcount))
 		aux_dev = NULL;
 	mutex_unlock(&aux_idr_mutex);
 



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 400/453] drm/i915: Fix mismatch between misplaced vma check and vma insert
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (397 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.4 399/453] drm/dp_aux_dev: check aux_dev before use in drm_dp_aux_dev_get_by_minor() Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.4 401/453] spi: pxa2xx: Fix use-after-free on unbind Greg Kroah-Hartman
                   ` (56 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, CQ Tang, Chris Wilson, Matthew Auld,
	Jani Nikula

From: Chris Wilson <chris@chris-wilson.co.uk>

commit 0e53656ad8abc99e0a80c3de611e593ebbf55829 upstream.

When inserting a VMA, we restrict the placement to the low 4G unless the
caller opts into using the full range. This was done to allow usersapce
the opportunity to transition slowly from a 32b address space, and to
avoid breaking inherent 32b assumptions of some commands.

However, for insert we limited ourselves to 4G-4K, but on verification
we allowed the full 4G. This causes some attempts to bind a new buffer
to sporadically fail with -ENOSPC, but at other times be bound
successfully.

commit 48ea1e32c39d ("drm/i915/gen9: Set PIN_ZONE_4G end to 4GB - 1
page") suggests that there is a genuine problem with stateless addressing
that cannot utilize the last page in 4G and so we purposefully excluded
it. This means that the quick pin pass may cause us to utilize a buggy
placement.

Reported-by: CQ Tang <cq.tang@intel.com>
Testcase: igt/gem_exec_params/larger-than-life-batch
Fixes: 48ea1e32c39d ("drm/i915/gen9: Set PIN_ZONE_4G end to 4GB - 1 page")
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: CQ Tang <cq.tang@intel.com>
Reviewed-by: CQ Tang <cq.tang@intel.com>
Reviewed-by: Matthew Auld <matthew.auld@intel.com>
Cc: <stable@vger.kernel.org> # v4.5+
Link: https://patchwork.freedesktop.org/patch/msgid/20201216092951.7124-1-chris@chris-wilson.co.uk
(cherry picked from commit 5f22cc0b134ab702d7f64b714e26018f7288ffee)
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c
+++ b/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c
@@ -367,7 +367,7 @@ eb_vma_misplaced(const struct drm_i915_g
 		return true;
 
 	if (!(flags & EXEC_OBJECT_SUPPORTS_48B_ADDRESS) &&
-	    (vma->node.start + vma->node.size - 1) >> 32)
+	    (vma->node.start + vma->node.size + 4095) >> 32)
 		return true;
 
 	if (flags & __EXEC_OBJECT_NEEDS_MAP &&



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 401/453] spi: pxa2xx: Fix use-after-free on unbind
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (398 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.4 400/453] drm/i915: Fix mismatch between misplaced vma check and vma insert Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.4 402/453] spi: spi-sh: " Greg Kroah-Hartman
                   ` (55 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Lukas Wunner, Mark Brown

From: Lukas Wunner <lukas@wunner.de>

commit 5626308bb94d9f930aa5f7c77327df4c6daa7759 upstream.

pxa2xx_spi_remove() accesses the driver's private data after calling
spi_unregister_controller() even though that function releases the last
reference on the spi_controller and thereby frees the private data.

Fix by switching over to the new devm_spi_alloc_master/slave() helper
which keeps the private data accessible until the driver has unbound.

Fixes: 32e5b57232c0 ("spi: pxa2xx: Fix controller unregister order")
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: <stable@vger.kernel.org> # v2.6.17+: 5e844cc37a5c: spi: Introduce device-managed SPI controller allocation
Cc: <stable@vger.kernel.org> # v2.6.17+: 32e5b57232c0: spi: pxa2xx: Fix controller unregister order
Cc: <stable@vger.kernel.org> # v2.6.17+
Link: https://lore.kernel.org/r/5764b04d4a6e43069ebb7808f64c2f774ac6f193.1607286887.git.lukas@wunner.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/spi/spi-pxa2xx.c |    5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

--- a/drivers/spi/spi-pxa2xx.c
+++ b/drivers/spi/spi-pxa2xx.c
@@ -1675,9 +1675,9 @@ static int pxa2xx_spi_probe(struct platf
 	}
 
 	if (platform_info->is_slave)
-		controller = spi_alloc_slave(dev, sizeof(struct driver_data));
+		controller = devm_spi_alloc_slave(dev, sizeof(*drv_data));
 	else
-		controller = spi_alloc_master(dev, sizeof(struct driver_data));
+		controller = devm_spi_alloc_master(dev, sizeof(*drv_data));
 
 	if (!controller) {
 		dev_err(&pdev->dev, "cannot alloc spi_controller\n");
@@ -1900,7 +1900,6 @@ out_error_dma_irq_alloc:
 	free_irq(ssp->irq, drv_data);
 
 out_error_controller_alloc:
-	spi_controller_put(controller);
 	pxa_ssp_free(ssp);
 	return status;
 }



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 402/453] spi: spi-sh: Fix use-after-free on unbind
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (399 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.4 401/453] spi: pxa2xx: Fix use-after-free on unbind Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.4 403/453] spi: atmel-quadspi: " Greg Kroah-Hartman
                   ` (54 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lukas Wunner, Axel Lin, Mark Brown

From: Lukas Wunner <lukas@wunner.de>

commit e77df3eca12be4b17f13cf9f215cff248c57d98f upstream.

spi_sh_remove() accesses the driver's private data after calling
spi_unregister_master() even though that function releases the last
reference on the spi_master and thereby frees the private data.

Fix by switching over to the new devm_spi_alloc_master() helper which
keeps the private data accessible until the driver has unbound.

Fixes: 680c1305e259 ("spi/spi_sh: use spi_unregister_master instead of spi_master_put in remove path")
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: <stable@vger.kernel.org> # v3.0+: 5e844cc37a5c: spi: Introduce device-managed SPI controller allocation
Cc: <stable@vger.kernel.org> # v3.0+
Cc: Axel Lin <axel.lin@ingics.com>
Link: https://lore.kernel.org/r/6d97628b536baf01d5e3e39db61108f84d44c8b2.1607286887.git.lukas@wunner.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/spi/spi-sh.c |   13 ++++---------
 1 file changed, 4 insertions(+), 9 deletions(-)

--- a/drivers/spi/spi-sh.c
+++ b/drivers/spi/spi-sh.c
@@ -440,7 +440,7 @@ static int spi_sh_probe(struct platform_
 	if (irq < 0)
 		return irq;
 
-	master = spi_alloc_master(&pdev->dev, sizeof(struct spi_sh_data));
+	master = devm_spi_alloc_master(&pdev->dev, sizeof(struct spi_sh_data));
 	if (master == NULL) {
 		dev_err(&pdev->dev, "spi_alloc_master error.\n");
 		return -ENOMEM;
@@ -458,16 +458,14 @@ static int spi_sh_probe(struct platform_
 		break;
 	default:
 		dev_err(&pdev->dev, "No support width\n");
-		ret = -ENODEV;
-		goto error1;
+		return -ENODEV;
 	}
 	ss->irq = irq;
 	ss->master = master;
 	ss->addr = devm_ioremap(&pdev->dev, res->start, resource_size(res));
 	if (ss->addr == NULL) {
 		dev_err(&pdev->dev, "ioremap error.\n");
-		ret = -ENOMEM;
-		goto error1;
+		return -ENOMEM;
 	}
 	INIT_LIST_HEAD(&ss->queue);
 	spin_lock_init(&ss->lock);
@@ -477,7 +475,7 @@ static int spi_sh_probe(struct platform_
 	ret = request_irq(irq, spi_sh_irq, 0, "spi_sh", ss);
 	if (ret < 0) {
 		dev_err(&pdev->dev, "request_irq error\n");
-		goto error1;
+		return ret;
 	}
 
 	master->num_chipselect = 2;
@@ -496,9 +494,6 @@ static int spi_sh_probe(struct platform_
 
  error3:
 	free_irq(irq, ss);
- error1:
-	spi_master_put(master);
-
 	return ret;
 }
 



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 403/453] spi: atmel-quadspi: Fix use-after-free on unbind
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (400 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.4 402/453] spi: spi-sh: " Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.4 404/453] spi: davinci: " Greg Kroah-Hartman
                   ` (53 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lukas Wunner, Piotr Bugalski, Mark Brown

From: Lukas Wunner <lukas@wunner.de>

commit c7b884561cb5b641f3dbba950094110794119a6d upstream.

atmel_qspi_remove() accesses the driver's private data after calling
spi_unregister_controller() even though that function releases the last
reference on the spi_controller and thereby frees the private data.

Fix by switching over to the new devm_spi_alloc_master() helper which
keeps the private data accessible until the driver has unbound.

Fixes: 2d30ac5ed633 ("mtd: spi-nor: atmel-quadspi: Use spi-mem interface for atmel-quadspi driver")
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: <stable@vger.kernel.org> # v5.0+: 5e844cc37a5c: spi: Introduce device-managed SPI controller allocation
Cc: <stable@vger.kernel.org> # v5.0+
Cc: Piotr Bugalski <bugalski.piotr@gmail.com>
Link: https://lore.kernel.org/r/4b05c65cf6f1ea3251484fe9a00b4c65478a1ae3.1607286887.git.lukas@wunner.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/spi/atmel-quadspi.c |   15 +++++----------
 1 file changed, 5 insertions(+), 10 deletions(-)

--- a/drivers/spi/atmel-quadspi.c
+++ b/drivers/spi/atmel-quadspi.c
@@ -454,7 +454,7 @@ static int atmel_qspi_probe(struct platf
 	struct resource *res;
 	int irq, err = 0;
 
-	ctrl = spi_alloc_master(&pdev->dev, sizeof(*aq));
+	ctrl = devm_spi_alloc_master(&pdev->dev, sizeof(*aq));
 	if (!ctrl)
 		return -ENOMEM;
 
@@ -476,8 +476,7 @@ static int atmel_qspi_probe(struct platf
 	aq->regs = devm_ioremap_resource(&pdev->dev, res);
 	if (IS_ERR(aq->regs)) {
 		dev_err(&pdev->dev, "missing registers\n");
-		err = PTR_ERR(aq->regs);
-		goto exit;
+		return PTR_ERR(aq->regs);
 	}
 
 	/* Map the AHB memory */
@@ -485,8 +484,7 @@ static int atmel_qspi_probe(struct platf
 	aq->mem = devm_ioremap_resource(&pdev->dev, res);
 	if (IS_ERR(aq->mem)) {
 		dev_err(&pdev->dev, "missing AHB memory\n");
-		err = PTR_ERR(aq->mem);
-		goto exit;
+		return PTR_ERR(aq->mem);
 	}
 
 	aq->mmap_size = resource_size(res);
@@ -498,15 +496,14 @@ static int atmel_qspi_probe(struct platf
 
 	if (IS_ERR(aq->pclk)) {
 		dev_err(&pdev->dev, "missing peripheral clock\n");
-		err = PTR_ERR(aq->pclk);
-		goto exit;
+		return PTR_ERR(aq->pclk);
 	}
 
 	/* Enable the peripheral clock */
 	err = clk_prepare_enable(aq->pclk);
 	if (err) {
 		dev_err(&pdev->dev, "failed to enable the peripheral clock\n");
-		goto exit;
+		return err;
 	}
 
 	aq->caps = of_device_get_match_data(&pdev->dev);
@@ -557,8 +554,6 @@ disable_qspick:
 	clk_disable_unprepare(aq->qspick);
 disable_pclk:
 	clk_disable_unprepare(aq->pclk);
-exit:
-	spi_controller_put(ctrl);
 
 	return err;
 }



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 404/453] spi: davinci: Fix use-after-free on unbind
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (401 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.4 403/453] spi: atmel-quadspi: " Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.4 405/453] spi: fsl: fix use of spisel_boot signal on MPC8309 Greg Kroah-Hartman
                   ` (52 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lukas Wunner, Peter Ujfalusi, Mark Brown

From: Lukas Wunner <lukas@wunner.de>

commit 373afef350a93519b4b8d636b0895da8650b714b upstream.

davinci_spi_remove() accesses the driver's private data after it's been
freed with spi_master_put().

Fix by moving the spi_master_put() to the end of the function.

Fixes: fe5fd2540947 ("spi: davinci: Use dma_request_chan() for requesting DMA channel")
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Acked-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
Cc: <stable@vger.kernel.org> # v4.7+
Link: https://lore.kernel.org/r/412f7eb1cf8990e0a3a2153f4c577298deab623e.1607286887.git.lukas@wunner.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/spi/spi-davinci.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/spi/spi-davinci.c
+++ b/drivers/spi/spi-davinci.c
@@ -1040,13 +1040,13 @@ static int davinci_spi_remove(struct pla
 	spi_bitbang_stop(&dspi->bitbang);
 
 	clk_disable_unprepare(dspi->clk);
-	spi_master_put(master);
 
 	if (dspi->dma_rx) {
 		dma_release_channel(dspi->dma_rx);
 		dma_release_channel(dspi->dma_tx);
 	}
 
+	spi_master_put(master);
 	return 0;
 }
 



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 405/453] spi: fsl: fix use of spisel_boot signal on MPC8309
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (402 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.4 404/453] spi: davinci: " Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.4 406/453] spi: gpio: Dont leak SPI master in probe error path Greg Kroah-Hartman
                   ` (51 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christophe Leroy, Linus Walleij,
	Rasmus Villemoes, Mark Brown

From: Rasmus Villemoes <rasmus.villemoes@prevas.dk>

commit 122541f2b10897b08f7f7e6db5f1eb693e51f0a1 upstream.

Commit 0f0581b24bd0 ("spi: fsl: Convert to use CS GPIO descriptors")
broke the use of the SPISEL_BOOT signal as a chip select on the
MPC8309.

pdata->max_chipselect, which becomes master->num_chipselect, must be
initialized to take into account the possibility that there's one more
chip select in use than the number of GPIO chip selects.

Cc: stable@vger.kernel.org # v5.4+
Cc: Christophe Leroy <christophe.leroy@c-s.fr>
Cc: Linus Walleij <linus.walleij@linaro.org>
Fixes: 0f0581b24bd0 ("spi: fsl: Convert to use CS GPIO descriptors")
Signed-off-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
Link: https://lore.kernel.org/r/20201127152947.376-1-rasmus.villemoes@prevas.dk
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/spi/spi-fsl-spi.c |   11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

--- a/drivers/spi/spi-fsl-spi.c
+++ b/drivers/spi/spi-fsl-spi.c
@@ -717,10 +717,11 @@ static int of_fsl_spi_probe(struct platf
 	type = fsl_spi_get_type(&ofdev->dev);
 	if (type == TYPE_FSL) {
 		struct fsl_spi_platform_data *pdata = dev_get_platdata(dev);
+		bool spisel_boot = false;
 #if IS_ENABLED(CONFIG_FSL_SOC)
 		struct mpc8xxx_spi_probe_info *pinfo = to_of_pinfo(pdata);
-		bool spisel_boot = of_property_read_bool(np, "fsl,spisel_boot");
 
+		spisel_boot = of_property_read_bool(np, "fsl,spisel_boot");
 		if (spisel_boot) {
 			pinfo->immr_spi_cs = ioremap(get_immrbase() + IMMR_SPI_CS_OFFSET, 4);
 			if (!pinfo->immr_spi_cs) {
@@ -737,10 +738,14 @@ static int of_fsl_spi_probe(struct platf
 		 * supported on the GRLIB variant.
 		 */
 		ret = gpiod_count(dev, "cs");
-		if (ret <= 0)
+		if (ret < 0)
+			ret = 0;
+		if (ret == 0 && !spisel_boot) {
 			pdata->max_chipselect = 1;
-		else
+		} else {
+			pdata->max_chipselect = ret + spisel_boot;
 			pdata->cs_control = fsl_spi_cs_control;
+		}
 	}
 
 	ret = of_address_to_resource(np, 0, &mem);



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 406/453] spi: gpio: Dont leak SPI master in probe error path
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (403 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.4 405/453] spi: fsl: fix use of spisel_boot signal on MPC8309 Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.4 407/453] spi: mxic: " Greg Kroah-Hartman
                   ` (50 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lukas Wunner, Linus Walleij,
	Navid Emamdoost, Andrey Smirnov, Mark Brown

From: Lukas Wunner <lukas@wunner.de>

commit 7174dc655ef0578877b0b4598e69619d2be28b4d upstream.

If the call to devm_spi_register_master() fails on probe of the GPIO SPI
driver, the spi_master struct is erroneously not freed:

After allocating the spi_master, its reference count is 1.  The driver
unconditionally decrements the reference count on unbind using a devm
action.  Before calling devm_spi_register_master(), the driver
unconditionally increments the reference count because on success,
that function will decrement the reference count on unbind.  However on
failure, devm_spi_register_master() does *not* decrement the reference
count, so the spi_master is leaked.

The issue was introduced by commits 8b797490b4db ("spi: gpio: Make sure
spi_master_put() is called in every error path") and 79567c1a321e ("spi:
gpio: Use devm_spi_register_master()"), which sought to plug leaks
introduced by 9b00bc7b901f ("spi: spi-gpio: Rewrite to use GPIO
descriptors") but missed this remaining leak.

The situation was later aggravated by commit d3b0ffa1d75d ("spi: gpio:
prevent memory leak in spi_gpio_probe"), which introduced a
use-after-free because it releases a reference on the spi_master if
devm_add_action_or_reset() fails even though the function already
does that.

Fix by switching over to the new devm_spi_alloc_master() helper.

Fixes: 9b00bc7b901f ("spi: spi-gpio: Rewrite to use GPIO descriptors")
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Cc: <stable@vger.kernel.org> # v4.17+: 5e844cc37a5c: spi: Introduce device-managed SPI controller allocation
Cc: <stable@vger.kernel.org> # v5.1-: 8b797490b4db: spi: gpio: Make sure spi_master_put() is called in every error path
Cc: <stable@vger.kernel.org> # v5.1-: 45beec351998: spi: bitbang: Introduce spi_bitbang_init()
Cc: <stable@vger.kernel.org> # v5.1-: 79567c1a321e: spi: gpio: Use devm_spi_register_master()
Cc: <stable@vger.kernel.org> # v5.4-: d3b0ffa1d75d: spi: gpio: prevent memory leak in spi_gpio_probe
Cc: <stable@vger.kernel.org> # v4.17+
Cc: Navid Emamdoost <navid.emamdoost@gmail.com>
Cc: Andrey Smirnov <andrew.smirnov@gmail.com>
Link: https://lore.kernel.org/r/86eaed27431c3d709e3748eb76ceecbfc790dd37.1607286887.git.lukas@wunner.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/spi/spi-gpio.c |   15 ++-------------
 1 file changed, 2 insertions(+), 13 deletions(-)

--- a/drivers/spi/spi-gpio.c
+++ b/drivers/spi/spi-gpio.c
@@ -350,11 +350,6 @@ static int spi_gpio_probe_pdata(struct p
 	return 0;
 }
 
-static void spi_gpio_put(void *data)
-{
-	spi_master_put(data);
-}
-
 static int spi_gpio_probe(struct platform_device *pdev)
 {
 	int				status;
@@ -366,16 +361,10 @@ static int spi_gpio_probe(struct platfor
 
 	of_id = of_match_device(spi_gpio_dt_ids, &pdev->dev);
 
-	master = spi_alloc_master(dev, sizeof(*spi_gpio));
+	master = devm_spi_alloc_master(dev, sizeof(*spi_gpio));
 	if (!master)
 		return -ENOMEM;
 
-	status = devm_add_action_or_reset(&pdev->dev, spi_gpio_put, master);
-	if (status) {
-		spi_master_put(master);
-		return status;
-	}
-
 	if (of_id)
 		status = spi_gpio_probe_dt(pdev, master);
 	else
@@ -435,7 +424,7 @@ static int spi_gpio_probe(struct platfor
 	if (status)
 		return status;
 
-	return devm_spi_register_master(&pdev->dev, spi_master_get(master));
+	return devm_spi_register_master(&pdev->dev, master);
 }
 
 MODULE_ALIAS("platform:" DRIVER_NAME);



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 407/453] spi: mxic: Dont leak SPI master in probe error path
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (404 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.4 406/453] spi: gpio: Dont leak SPI master in probe error path Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.4 408/453] spi: pic32: Dont leak DMA channels " Greg Kroah-Hartman
                   ` (49 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lukas Wunner, Mason Yang, Mark Brown

From: Lukas Wunner <lukas@wunner.de>

commit cc53711b2191cf3b3210283ae89bf0abb98c70a3 upstream.

If the calls to devm_clk_get() or devm_ioremap_resource() fail on probe
of the Macronix SPI driver, the spi_master struct is erroneously not freed.

Fix by switching over to the new devm_spi_alloc_master() helper.

Fixes: b942d80b0a39 ("spi: Add MXIC controller driver")
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: <stable@vger.kernel.org> # v5.0+: 5e844cc37a5c: spi: Introduce device-managed SPI controller allocation
Cc: <stable@vger.kernel.org> # v5.0+
Cc: Mason Yang <masonccyang@mxic.com.tw>
Link: https://lore.kernel.org/r/4fa6857806e7e75741c05d057ac9df3564460114.1607286887.git.lukas@wunner.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/spi/spi-mxic.c |   10 ++--------
 1 file changed, 2 insertions(+), 8 deletions(-)

--- a/drivers/spi/spi-mxic.c
+++ b/drivers/spi/spi-mxic.c
@@ -528,7 +528,7 @@ static int mxic_spi_probe(struct platfor
 	struct mxic_spi *mxic;
 	int ret;
 
-	master = spi_alloc_master(&pdev->dev, sizeof(struct mxic_spi));
+	master = devm_spi_alloc_master(&pdev->dev, sizeof(struct mxic_spi));
 	if (!master)
 		return -ENOMEM;
 
@@ -573,15 +573,9 @@ static int mxic_spi_probe(struct platfor
 	ret = spi_register_master(master);
 	if (ret) {
 		dev_err(&pdev->dev, "spi_register_master failed\n");
-		goto err_put_master;
+		pm_runtime_disable(&pdev->dev);
 	}
 
-	return 0;
-
-err_put_master:
-	spi_master_put(master);
-	pm_runtime_disable(&pdev->dev);
-
 	return ret;
 }
 



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 408/453] spi: pic32: Dont leak DMA channels in probe error path
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (405 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.4 407/453] spi: mxic: " Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.4 409/453] spi: rb4xx: Dont leak SPI master " Greg Kroah-Hartman
                   ` (48 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lukas Wunner, Purna Chandra Mandal,
	Mark Brown

From: Lukas Wunner <lukas@wunner.de>

commit c575e9113bff5e024d75481613faed5ef9d465b2 upstream.

If the calls to devm_request_irq() or devm_spi_register_master() fail
on probe of the PIC32 SPI driver, the DMA channels requested by
pic32_spi_dma_prep() are erroneously not released.  Plug the leak.

Fixes: 1bcb9f8ceb67 ("spi: spi-pic32: Add PIC32 SPI master driver")
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: <stable@vger.kernel.org> # v4.7+
Cc: Purna Chandra Mandal <purna.mandal@microchip.com>
Link: https://lore.kernel.org/r/9624250e3a7aa61274b38219a62375bac1def637.1604874488.git.lukas@wunner.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/spi/spi-pic32.c |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/spi/spi-pic32.c
+++ b/drivers/spi/spi-pic32.c
@@ -825,6 +825,7 @@ static int pic32_spi_probe(struct platfo
 	return 0;
 
 err_bailout:
+	pic32_spi_dma_unprep(pic32s);
 	clk_disable_unprepare(pic32s->clk);
 err_master:
 	spi_master_put(master);



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 409/453] spi: rb4xx: Dont leak SPI master in probe error path
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (406 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.4 408/453] spi: pic32: Dont leak DMA channels " Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.4 410/453] spi: sc18is602: " Greg Kroah-Hartman
                   ` (47 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lukas Wunner, Bert Vermeulen, Mark Brown

From: Lukas Wunner <lukas@wunner.de>

commit a4729c3506c3eb1a6ca5c0289f4e7cafa4115065 upstream.

If the calls to devm_clk_get(), devm_spi_register_master() or
clk_prepare_enable() fail on probe of the Mikrotik RB4xx SPI driver,
the spi_master struct is erroneously not freed.

Fix by switching over to the new devm_spi_alloc_master() helper.

Fixes: 05aec357871f ("spi: Add SPI driver for Mikrotik RB4xx series boards")
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: <stable@vger.kernel.org> # v4.2+: 5e844cc37a5c: spi: Introduce device-managed SPI controller allocation
Cc: <stable@vger.kernel.org> # v4.2+
Cc: Bert Vermeulen <bert@biot.com>
Link: https://lore.kernel.org/r/369bf26d71927f60943b1d9d8f51810f00b0237d.1607286887.git.lukas@wunner.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/spi/spi-rb4xx.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/spi/spi-rb4xx.c
+++ b/drivers/spi/spi-rb4xx.c
@@ -142,7 +142,7 @@ static int rb4xx_spi_probe(struct platfo
 	if (IS_ERR(spi_base))
 		return PTR_ERR(spi_base);
 
-	master = spi_alloc_master(&pdev->dev, sizeof(*rbspi));
+	master = devm_spi_alloc_master(&pdev->dev, sizeof(*rbspi));
 	if (!master)
 		return -ENOMEM;
 



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 410/453] spi: sc18is602: Dont leak SPI master in probe error path
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (407 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.4 409/453] spi: rb4xx: Dont leak SPI master " Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.4 411/453] spi: st-ssc4: Fix unbalanced pm_runtime_disable() " Greg Kroah-Hartman
                   ` (46 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lukas Wunner, Phil Reid, Mark Brown

From: Lukas Wunner <lukas@wunner.de>

commit 5b8c88462d83331dacb48aeaec8388117fef82e0 upstream.

If the call to devm_gpiod_get_optional() fails on probe of the NXP
SC18IS602/603 SPI driver, the spi_master struct is erroneously not freed.

Fix by switching over to the new devm_spi_alloc_master() helper.

Fixes: f99008013e19 ("spi: sc18is602: Add reset control via gpio pin.")
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: <stable@vger.kernel.org> # v4.9+: 5e844cc37a5c: spi: Introduce device-managed SPI controller allocation
Cc: <stable@vger.kernel.org> # v4.9+
Cc: Phil Reid <preid@electromag.com.au>
Link: https://lore.kernel.org/r/d5f715527b894b91d530fe11a86f51b3184a4e1a.1607286887.git.lukas@wunner.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/spi/spi-sc18is602.c |   13 ++-----------
 1 file changed, 2 insertions(+), 11 deletions(-)

--- a/drivers/spi/spi-sc18is602.c
+++ b/drivers/spi/spi-sc18is602.c
@@ -239,13 +239,12 @@ static int sc18is602_probe(struct i2c_cl
 	struct sc18is602_platform_data *pdata = dev_get_platdata(dev);
 	struct sc18is602 *hw;
 	struct spi_master *master;
-	int error;
 
 	if (!i2c_check_functionality(client->adapter, I2C_FUNC_I2C |
 				     I2C_FUNC_SMBUS_WRITE_BYTE_DATA))
 		return -EINVAL;
 
-	master = spi_alloc_master(dev, sizeof(struct sc18is602));
+	master = devm_spi_alloc_master(dev, sizeof(struct sc18is602));
 	if (!master)
 		return -ENOMEM;
 
@@ -299,15 +298,7 @@ static int sc18is602_probe(struct i2c_cl
 	master->min_speed_hz = hw->freq / 128;
 	master->max_speed_hz = hw->freq / 4;
 
-	error = devm_spi_register_master(dev, master);
-	if (error)
-		goto error_reg;
-
-	return 0;
-
-error_reg:
-	spi_master_put(master);
-	return error;
+	return devm_spi_register_master(dev, master);
 }
 
 static const struct i2c_device_id sc18is602_id[] = {



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 411/453] spi: st-ssc4: Fix unbalanced pm_runtime_disable() in probe error path
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (408 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.4 410/453] spi: sc18is602: " Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.4 412/453] spi: synquacer: Disable clock " Greg Kroah-Hartman
                   ` (45 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lukas Wunner, Chuhong Yuan, Mark Brown

From: Lukas Wunner <lukas@wunner.de>

commit 5ef76dac0f2c26aeae4ee79eb830280f16d5aceb upstream.

If the calls to devm_platform_ioremap_resource(), irq_of_parse_and_map()
or devm_request_irq() fail on probe of the ST SSC4 SPI driver, the
runtime PM disable depth is incremented even though it was not
decremented before.  Fix it.

Fixes: cd050abeba2a ("spi: st-ssc4: add missed pm_runtime_disable")
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: <stable@vger.kernel.org> # v5.5+
Cc: Chuhong Yuan <hslester96@gmail.com>
Link: https://lore.kernel.org/r/fbe8768c30dc829e2d77eabe7be062ca22f84024.1604874488.git.lukas@wunner.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/spi/spi-st-ssc4.c |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

--- a/drivers/spi/spi-st-ssc4.c
+++ b/drivers/spi/spi-st-ssc4.c
@@ -375,13 +375,14 @@ static int spi_st_probe(struct platform_
 	ret = devm_spi_register_master(&pdev->dev, master);
 	if (ret) {
 		dev_err(&pdev->dev, "Failed to register master\n");
-		goto clk_disable;
+		goto rpm_disable;
 	}
 
 	return 0;
 
-clk_disable:
+rpm_disable:
 	pm_runtime_disable(&pdev->dev);
+clk_disable:
 	clk_disable_unprepare(spi_st->clk);
 put_master:
 	spi_master_put(master);



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 412/453] spi: synquacer: Disable clock in probe error path
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (409 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.4 411/453] spi: st-ssc4: Fix unbalanced pm_runtime_disable() " Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.4 413/453] spi: mt7621: " Greg Kroah-Hartman
                   ` (44 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lukas Wunner, Masahisa Kojima, Mark Brown

From: Lukas Wunner <lukas@wunner.de>

commit 8853b2503014aca5c793d2c7f0aabc990b32bdad upstream.

If the calls to platform_get_irq() or devm_request_irq() fail on probe
of the SynQuacer SPI driver, the clock "sspi->clk" is erroneously not
unprepared and disabled.

If the clock rate "master->max_speed_hz" cannot be determined, the same
happens and in addition the spi_master struct is not freed.

Fix it.

Fixes: b0823ee35cf9 ("spi: Add spi driver for Socionext SynQuacer platform")
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: <stable@vger.kernel.org> # v5.3+
Cc: Masahisa Kojima <masahisa.kojima@linaro.org>
Link: https://lore.kernel.org/r/232281df1ab91d8f0f553a62d5f97fc264ace4da.1604874488.git.lukas@wunner.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/spi/spi-synquacer.c |   15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

--- a/drivers/spi/spi-synquacer.c
+++ b/drivers/spi/spi-synquacer.c
@@ -658,7 +658,8 @@ static int synquacer_spi_probe(struct pl
 
 	if (!master->max_speed_hz) {
 		dev_err(&pdev->dev, "missing clock source\n");
-		return -EINVAL;
+		ret = -EINVAL;
+		goto disable_clk;
 	}
 	master->min_speed_hz = master->max_speed_hz / 254;
 
@@ -671,7 +672,7 @@ static int synquacer_spi_probe(struct pl
 	rx_irq = platform_get_irq(pdev, 0);
 	if (rx_irq <= 0) {
 		ret = rx_irq;
-		goto put_spi;
+		goto disable_clk;
 	}
 	snprintf(sspi->rx_irq_name, SYNQUACER_HSSPI_IRQ_NAME_MAX, "%s-rx",
 		 dev_name(&pdev->dev));
@@ -679,13 +680,13 @@ static int synquacer_spi_probe(struct pl
 				0, sspi->rx_irq_name, sspi);
 	if (ret) {
 		dev_err(&pdev->dev, "request rx_irq failed (%d)\n", ret);
-		goto put_spi;
+		goto disable_clk;
 	}
 
 	tx_irq = platform_get_irq(pdev, 1);
 	if (tx_irq <= 0) {
 		ret = tx_irq;
-		goto put_spi;
+		goto disable_clk;
 	}
 	snprintf(sspi->tx_irq_name, SYNQUACER_HSSPI_IRQ_NAME_MAX, "%s-tx",
 		 dev_name(&pdev->dev));
@@ -693,7 +694,7 @@ static int synquacer_spi_probe(struct pl
 				0, sspi->tx_irq_name, sspi);
 	if (ret) {
 		dev_err(&pdev->dev, "request tx_irq failed (%d)\n", ret);
-		goto put_spi;
+		goto disable_clk;
 	}
 
 	master->dev.of_node = np;
@@ -711,7 +712,7 @@ static int synquacer_spi_probe(struct pl
 
 	ret = synquacer_spi_enable(master);
 	if (ret)
-		goto fail_enable;
+		goto disable_clk;
 
 	pm_runtime_set_active(sspi->dev);
 	pm_runtime_enable(sspi->dev);
@@ -724,7 +725,7 @@ static int synquacer_spi_probe(struct pl
 
 disable_pm:
 	pm_runtime_disable(sspi->dev);
-fail_enable:
+disable_clk:
 	clk_disable_unprepare(sspi->clk);
 put_spi:
 	spi_master_put(master);



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 413/453] spi: mt7621: Disable clock in probe error path
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (410 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.4 412/453] spi: synquacer: Disable clock " Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.4 414/453] spi: mt7621: Dont leak SPI master " Greg Kroah-Hartman
                   ` (43 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lukas Wunner, Qinglang Miao, Mark Brown

From: Lukas Wunner <lukas@wunner.de>

commit 24f7033405abe195224ec793dbc3d7a27dec0b98 upstream.

Commit 702b15cb9712 ("spi: mt7621: fix missing clk_disable_unprepare()
on error in mt7621_spi_probe") sought to disable the SYS clock on probe
errors, but only did so for 2 of 3 potentially failing calls:  The clock
needs to be disabled on failure of devm_spi_register_controller() as
well.

Moreover, the commit purports to fix a bug in commit cbd66c626e16 ("spi:
mt7621: Move SPI driver out of staging") but in reality the bug has
existed since the driver was first introduced.

Fixes: 1ab7f2a43558 ("staging: mt7621-spi: add mt7621 support")
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: <stable@vger.kernel.org> # v4.17+: 702b15cb9712: spi: mt7621: fix missing clk_disable_unprepare() on error in mt7621_spi_probe
Cc: <stable@vger.kernel.org> # v4.17+
Cc: Qinglang Miao <miaoqinglang@huawei.com>
Link: https://lore.kernel.org/r/36ad42760087952fb7c10aae7d2628547c26a7ec.1607286887.git.lukas@wunner.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/spi/spi-mt7621.c |    6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

--- a/drivers/spi/spi-mt7621.c
+++ b/drivers/spi/spi-mt7621.c
@@ -382,7 +382,11 @@ static int mt7621_spi_probe(struct platf
 		return ret;
 	}
 
-	return devm_spi_register_controller(&pdev->dev, master);
+	ret = devm_spi_register_controller(&pdev->dev, master);
+	if (ret)
+		clk_disable_unprepare(clk);
+
+	return ret;
 }
 
 static int mt7621_spi_remove(struct platform_device *pdev)



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 414/453] spi: mt7621: Dont leak SPI master in probe error path
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (411 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.4 413/453] spi: mt7621: " Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.4 415/453] spi: atmel-quadspi: Disable clock " Greg Kroah-Hartman
                   ` (42 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lukas Wunner, Stefan Roese, Mark Brown

From: Lukas Wunner <lukas@wunner.de>

commit 46b5c4fb87ce8211e0f9b0383dbde72c3652d2ba upstream.

If the calls to device_reset() or devm_spi_register_controller() fail on
probe of the MediaTek MT7621 SPI driver, the spi_controller struct is
erroneously not freed.  Fix by switching over to the new
devm_spi_alloc_master() helper.

Additionally, there's an ordering issue in mt7621_spi_remove() wherein
the spi_controller is unregistered after disabling the SYS clock.
The correct order is to call spi_unregister_controller() *before* this
teardown step because bus accesses may still be ongoing until that
function returns.

All of these bugs have existed since the driver was first introduced,
so it seems fair to fix them together in a single commit.

Fixes: 1ab7f2a43558 ("staging: mt7621-spi: add mt7621 support")
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Reviewed-by: Stefan Roese <sr@denx.de>
Cc: <stable@vger.kernel.org> # v4.17+: 5e844cc37a5c: spi: Introduce device-managed SPI controller allocation
Cc: <stable@vger.kernel.org> # v4.17+
Link: https://lore.kernel.org/r/72b680796149f5fcda0b3f530ffb7ee73b04f224.1607286887.git.lukas@wunner.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/spi/spi-mt7621.c |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

--- a/drivers/spi/spi-mt7621.c
+++ b/drivers/spi/spi-mt7621.c
@@ -350,7 +350,7 @@ static int mt7621_spi_probe(struct platf
 	if (status)
 		return status;
 
-	master = spi_alloc_master(&pdev->dev, sizeof(*rs));
+	master = devm_spi_alloc_master(&pdev->dev, sizeof(*rs));
 	if (!master) {
 		dev_info(&pdev->dev, "master allocation failed\n");
 		clk_disable_unprepare(clk);
@@ -382,7 +382,7 @@ static int mt7621_spi_probe(struct platf
 		return ret;
 	}
 
-	ret = devm_spi_register_controller(&pdev->dev, master);
+	ret = spi_register_controller(master);
 	if (ret)
 		clk_disable_unprepare(clk);
 
@@ -397,6 +397,7 @@ static int mt7621_spi_remove(struct plat
 	master = dev_get_drvdata(&pdev->dev);
 	rs = spi_controller_get_devdata(master);
 
+	spi_unregister_controller(master);
 	clk_disable_unprepare(rs->clk);
 
 	return 0;



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 415/453] spi: atmel-quadspi: Disable clock in probe error path
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (412 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.4 414/453] spi: mt7621: Dont leak SPI master " Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.4 416/453] spi: atmel-quadspi: Fix AHB memory accesses Greg Kroah-Hartman
                   ` (41 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lukas Wunner, Tudor Ambarus,
	Boris Brezillon, Mark Brown

From: Lukas Wunner <lukas@wunner.de>

commit 0e685017c7ba1a2fe9f6f1e7a9302890747d934c upstream.

If the call to of_device_get_match_data() fails on probe of the Atmel
QuadSPI driver, the clock "aq->pclk" is erroneously not unprepared and
disabled.  Fix it.

Fixes: 2e5c88887358 ("spi: atmel-quadspi: add support for sam9x60 qspi controller")
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: <stable@vger.kernel.org> # v5.1+
Cc: Tudor Ambarus <tudor.ambarus@microchip.com>
Cc: Boris Brezillon <boris.brezillon@collabora.com>
Reviewed-by: Tudor Ambarus <tudor.ambarus@microchip.com>
Link: https://lore.kernel.org/r/8f8dc2815aa97b2378528f08f923bf81e19611f0.1604874488.git.lukas@wunner.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/spi/atmel-quadspi.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/spi/atmel-quadspi.c
+++ b/drivers/spi/atmel-quadspi.c
@@ -510,7 +510,7 @@ static int atmel_qspi_probe(struct platf
 	if (!aq->caps) {
 		dev_err(&pdev->dev, "Could not retrieve QSPI caps\n");
 		err = -EINVAL;
-		goto exit;
+		goto disable_pclk;
 	}
 
 	if (aq->caps->has_qspick) {



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 416/453] spi: atmel-quadspi: Fix AHB memory accesses
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (413 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.4 415/453] spi: atmel-quadspi: Disable clock " Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.4 417/453] soc: qcom: smp2p: Safely acquire spinlock without IRQs Greg Kroah-Hartman
                   ` (40 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Tom Burkart, Tudor Ambarus, Mark Brown

From: Tudor Ambarus <tudor.ambarus@microchip.com>

commit cac8c821059639b015586abf61623c62cc549a13 upstream.

Following error was seen when mounting a 16MByte ubifs:
UBIFS error (ubi0:0 pid 1893): check_lpt_type.constprop.6: invalid type (15) in LPT node type

QSPI_IFR.TFRTYP was not set correctly. When data transfer is enabled
and one wants to access the serial memory through AHB in order to:
 - read in the serial memory, but not a memory data, for example
   a JEDEC-ID, QSPI_IFR.TFRTYP must be written to '0' (both sama5d2
   and sam9x60).
 - read in the serial memory, and particularly a memory data,
   TFRTYP must be written to '1' (both sama5d2 and sam9x60).
 - write in the serial memory, but not a memory data, for example
   writing the configuration or the QSPI_SR, TFRTYP must be written
   to '2' for sama5d2 and to '0' for sam9x60.
 - write in the serial memory in particular to program a memory data,
   TFRTYP must be written to '3' for sama5d2 and to '1' for sam9x60.

Fix the setting of the QSPI_IFR.TFRTYP field.

Fixes: 2d30ac5ed633 ("mtd: spi-nor: atmel-quadspi: Use spi-mem interface for atmel-quadspi driver")
Cc: <stable@vger.kernel.org> # v5.0+
Reported-by: Tom Burkart <tom@aussec.com>
Signed-off-by: Tudor Ambarus <tudor.ambarus@microchip.com>
Link: https://lore.kernel.org/r/20201207135959.154124-2-tudor.ambarus@microchip.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/spi/atmel-quadspi.c |   10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

--- a/drivers/spi/atmel-quadspi.c
+++ b/drivers/spi/atmel-quadspi.c
@@ -284,10 +284,14 @@ static int atmel_qspi_set_cfg(struct atm
 	if (dummy_cycles)
 		ifr |= QSPI_IFR_NBDUM(dummy_cycles);
 
-	/* Set data enable */
-	if (op->data.nbytes)
+	/* Set data enable and data transfer type. */
+	if (op->data.nbytes) {
 		ifr |= QSPI_IFR_DATAEN;
 
+		if (op->addr.nbytes)
+			ifr |= QSPI_IFR_TFRTYP_MEM;
+	}
+
 	/*
 	 * If the QSPI controller is set in regular SPI mode, set it in
 	 * Serial Memory Mode (SMM).
@@ -312,7 +316,7 @@ static int atmel_qspi_set_cfg(struct atm
 			writel_relaxed(icr, aq->regs + QSPI_WICR);
 		writel_relaxed(ifr, aq->regs + QSPI_IFR);
 	} else {
-		if (op->data.dir == SPI_MEM_DATA_OUT)
+		if (op->data.nbytes && op->data.dir == SPI_MEM_DATA_OUT)
 			ifr |= QSPI_IFR_SAMA5D2_WRITE_TRSFR;
 
 		/* Set QSPI Instruction Frame registers */



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 417/453] soc: qcom: smp2p: Safely acquire spinlock without IRQs
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (414 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.4 416/453] spi: atmel-quadspi: Fix AHB memory accesses Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.4 418/453] mtd: spinand: Fix OOB read Greg Kroah-Hartman
                   ` (39 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Bjorn Andersson, Stephen Boyd, Evan Green

From: Evan Green <evgreen@chromium.org>

commit fc3e62e25c3896855b7c3d72df19ca6be3459c9f upstream.

smp2p_update_bits() should disable interrupts when it acquires its
spinlock. This is important because without the _irqsave, a priority
inversion can occur.

This function is called both with interrupts enabled in
qcom_q6v5_request_stop(), and with interrupts disabled in
ipa_smp2p_panic_notifier(). IRQ handling of spinlocks should be
consistent to avoid the panic notifier deadlocking because it's
sitting on the thread that's already got the lock via _request_stop().

Found via lockdep.

Cc: stable@vger.kernel.org
Fixes: 50e99641413e7 ("soc: qcom: smp2p: Qualcomm Shared Memory Point to Point")
Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Reviewed-by: Stephen Boyd <swboyd@chromium.org>
Signed-off-by: Evan Green <evgreen@chromium.org>
Link: https://lore.kernel.org/r/20200929133040.RESEND.1.Ideabf6dcdfc577cf39ce3d95b0e4aa1ac8b38f0c@changeid
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/soc/qcom/smp2p.c |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

--- a/drivers/soc/qcom/smp2p.c
+++ b/drivers/soc/qcom/smp2p.c
@@ -318,15 +318,16 @@ static int qcom_smp2p_inbound_entry(stru
 static int smp2p_update_bits(void *data, u32 mask, u32 value)
 {
 	struct smp2p_entry *entry = data;
+	unsigned long flags;
 	u32 orig;
 	u32 val;
 
-	spin_lock(&entry->lock);
+	spin_lock_irqsave(&entry->lock, flags);
 	val = orig = readl(entry->value);
 	val &= ~mask;
 	val |= value;
 	writel(val, entry->value);
-	spin_unlock(&entry->lock);
+	spin_unlock_irqrestore(&entry->lock, flags);
 
 	if (val != orig)
 		qcom_smp2p_kick(entry->smp2p);



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 418/453] mtd: spinand: Fix OOB read
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (415 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.4 417/453] soc: qcom: smp2p: Safely acquire spinlock without IRQs Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.4 419/453] mtd: parser: cmdline: Fix parsing of part-names with colons Greg Kroah-Hartman
                   ` (38 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Miquel Raynal

From: Miquel Raynal <miquel.raynal@bootlin.com>

commit 868cbe2a6dcee451bd8f87cbbb2a73cf463b57e5 upstream.

So far OOB have never been used in SPI-NAND, add the missing memcpy to
make it work properly.

Fixes: 7529df465248 ("mtd: nand: Add core infrastructure to support SPI NANDs")
Cc: stable@vger.kernel.org
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20201001102014.20100-6-miquel.raynal@bootlin.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/mtd/nand/spi/core.c |    4 ++++
 1 file changed, 4 insertions(+)

--- a/drivers/mtd/nand/spi/core.c
+++ b/drivers/mtd/nand/spi/core.c
@@ -317,6 +317,10 @@ static int spinand_write_to_cache_op(str
 		buf += ret;
 	}
 
+	if (req->ooblen)
+		memcpy(req->oobbuf.in, spinand->oobbuf + req->ooboffs,
+		       req->ooblen);
+
 	return 0;
 }
 



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 419/453] mtd: parser: cmdline: Fix parsing of part-names with colons
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (416 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.4 418/453] mtd: spinand: Fix OOB read Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.4 420/453] mtd: rawnand: qcom: Fix DMA sync on FLASH_STATUS register read Greg Kroah-Hartman
                   ` (37 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ron Minnich, Sven Eckelmann, Miquel Raynal

From: Sven Eckelmann <sven@narfation.org>

commit 639a82434f16a6df0ce0e7c8595976f1293940fd upstream.

Some devices (especially QCA ones) are already using hardcoded partition
names with colons in it. The OpenMesh A62 for example provides following
mtd relevant information via cmdline:

  root=31:11 mtdparts=spi0.0:256k(0:SBL1),128k(0:MIBIB),384k(0:QSEE),64k(0:CDT),64k(0:DDRPARAMS),64k(0:APPSBLENV),512k(0:APPSBL),64k(0:ART),64k(custom),64k(0:KEYS),0x002b0000(kernel),0x00c80000(rootfs),15552k(inactive) rootfsname=rootfs rootwait

The change to split only on the last colon between mtd-id and partitions
will cause newpart to see following string for the first partition:

  KEYS),0x002b0000(kernel),0x00c80000(rootfs),15552k(inactive)

Such a partition list cannot be parsed and thus the device fails to boot.

Avoid this behavior by making sure that the start of the first part-name
("(") will also be the last byte the mtd-id split algorithm is using for
its colon search.

Fixes: eb13fa022741 ("mtd: parser: cmdline: Support MTD names containing one or more colons")
Cc: stable@vger.kernel.org
Cc: Ron Minnich <rminnich@google.com>
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20201124062506.185392-1-sven@narfation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/mtd/parsers/cmdlinepart.c |   14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

--- a/drivers/mtd/parsers/cmdlinepart.c
+++ b/drivers/mtd/parsers/cmdlinepart.c
@@ -218,7 +218,7 @@ static int mtdpart_setup_real(char *s)
 		struct cmdline_mtd_partition *this_mtd;
 		struct mtd_partition *parts;
 		int mtd_id_len, num_parts;
-		char *p, *mtd_id, *semicol;
+		char *p, *mtd_id, *semicol, *open_parenth;
 
 		/*
 		 * Replace the first ';' by a NULL char so strrchr can work
@@ -228,6 +228,14 @@ static int mtdpart_setup_real(char *s)
 		if (semicol)
 			*semicol = '\0';
 
+		/*
+		 * make sure that part-names with ":" will not be handled as
+		 * part of the mtd-id with an ":"
+		 */
+		open_parenth = strchr(s, '(');
+		if (open_parenth)
+			*open_parenth = '\0';
+
 		mtd_id = s;
 
 		/*
@@ -237,6 +245,10 @@ static int mtdpart_setup_real(char *s)
 		 */
 		p = strrchr(s, ':');
 
+		/* Restore the '(' now. */
+		if (open_parenth)
+			*open_parenth = '(';
+
 		/* Restore the ';' now. */
 		if (semicol)
 			*semicol = ';';



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 420/453] mtd: rawnand: qcom: Fix DMA sync on FLASH_STATUS register read
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (417 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.4 419/453] mtd: parser: cmdline: Fix parsing of part-names with colons Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.4 421/453] mtd: rawnand: meson: fix meson_nfc_dma_buffer_release() arguments Greg Kroah-Hartman
                   ` (36 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Praveenkumar I, Miquel Raynal

From: Praveenkumar I <ipkumar@codeaurora.org>

commit bc3686021122de953858a5be4cbf6e3f1d821e79 upstream.

After each codeword NAND_FLASH_STATUS is read for possible operational
failures. But there is no DMA sync for CPU operation before reading it
and this leads to incorrect or older copy of DMA buffer in reg_read_buf.

This patch adds the DMA sync on reg_read_buf for CPU before reading it.

Fixes: 5bc36b2bf6e2 ("mtd: rawnand: qcom: check for operation errors in case of raw read")
Cc: stable@vger.kernel.org
Signed-off-by: Praveenkumar I <ipkumar@codeaurora.org>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/1602230872-25616-1-git-send-email-ipkumar@codeaurora.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/mtd/nand/raw/qcom_nandc.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/drivers/mtd/nand/raw/qcom_nandc.c
+++ b/drivers/mtd/nand/raw/qcom_nandc.c
@@ -1570,6 +1570,8 @@ static int check_flash_errors(struct qco
 	struct qcom_nand_controller *nandc = get_qcom_nand_controller(chip);
 	int i;
 
+	nandc_read_buffer_sync(nandc, true);
+
 	for (i = 0; i < cw_cnt; i++) {
 		u32 flash = le32_to_cpu(nandc->reg_read_buf[i]);
 



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 421/453] mtd: rawnand: meson: fix meson_nfc_dma_buffer_release() arguments
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (418 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.4 420/453] mtd: rawnand: qcom: Fix DMA sync on FLASH_STATUS register read Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.4 422/453] scsi: qla2xxx: Fix crash during driver load on big endian machines Greg Kroah-Hartman
                   ` (35 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sergei Antonov, Liang Yang, Miquel Raynal

From: Sergei Antonov <saproj@gmail.com>

commit c13d845e9a69580424d40b7b101c37d4f71bcd63 upstream.

Arguments 'infolen' and 'datalen' to meson_nfc_dma_buffer_release() were mixed up.

Fixes: 8fae856c53500 ("mtd: rawnand: meson: add support for Amlogic NAND flash controller")
Cc: stable@vger.kernel.org
Signed-off-by: Sergei Antonov <saproj@gmail.com>
Acked-by: Liang Yang <liang.yang@amlogic.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20201028094940.11765-1-saproj@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/mtd/nand/raw/meson_nand.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/mtd/nand/raw/meson_nand.c
+++ b/drivers/mtd/nand/raw/meson_nand.c
@@ -510,7 +510,7 @@ static int meson_nfc_dma_buffer_setup(st
 }
 
 static void meson_nfc_dma_buffer_release(struct nand_chip *nand,
-					 int infolen, int datalen,
+					 int datalen, int infolen,
 					 enum dma_data_direction dir)
 {
 	struct meson_nfc *nfc = nand_get_controller_data(nand);



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 422/453] scsi: qla2xxx: Fix crash during driver load on big endian machines
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (419 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.4 421/453] mtd: rawnand: meson: fix meson_nfc_dma_buffer_release() arguments Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:50 ` [PATCH 5.4 423/453] scsi: lpfc: Fix invalid sleeping context in lpfc_sli4_nvmet_alloc() Greg Kroah-Hartman
                   ` (34 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Himanshu Madhani, Arun Easi,
	Nilesh Javali, Martin K. Petersen

From: Arun Easi <aeasi@marvell.com>

commit 8de309e7299a00b3045fb274f82b326f356404f0 upstream.

Crash stack:
	[576544.715489] Unable to handle kernel paging request for data at address 0xd00000000f970000
	[576544.715497] Faulting instruction address: 0xd00000000f880f64
	[576544.715503] Oops: Kernel access of bad area, sig: 11 [#1]
	[576544.715506] SMP NR_CPUS=2048 NUMA pSeries
	:
	[576544.715703] NIP [d00000000f880f64] .qla27xx_fwdt_template_valid+0x94/0x100 [qla2xxx]
	[576544.715722] LR [d00000000f7952dc] .qla24xx_load_risc_flash+0x2fc/0x590 [qla2xxx]
	[576544.715726] Call Trace:
	[576544.715731] [c0000004d0ffb000] [c0000006fe02c350] 0xc0000006fe02c350 (unreliable)
	[576544.715750] [c0000004d0ffb080] [d00000000f7952dc] .qla24xx_load_risc_flash+0x2fc/0x590 [qla2xxx]
	[576544.715770] [c0000004d0ffb170] [d00000000f7aa034] .qla81xx_load_risc+0x84/0x1a0 [qla2xxx]
	[576544.715789] [c0000004d0ffb210] [d00000000f79f7c8] .qla2x00_setup_chip+0xc8/0x910 [qla2xxx]
	[576544.715808] [c0000004d0ffb300] [d00000000f7a631c] .qla2x00_initialize_adapter+0x4dc/0xb00 [qla2xxx]
	[576544.715826] [c0000004d0ffb3e0] [d00000000f78ce28] .qla2x00_probe_one+0xf08/0x2200 [qla2xxx]

Link: https://lore.kernel.org/r/20201202132312.19966-8-njavali@marvell.com
Fixes: f73cb695d3ec ("[SCSI] qla2xxx: Add support for ISP2071.")
Cc: stable@vger.kernel.org
Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
Signed-off-by: Arun Easi <aeasi@marvell.com>
Signed-off-by: Nilesh Javali <njavali@marvell.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/scsi/qla2xxx/qla_tmpl.c |    9 +++++----
 drivers/scsi/qla2xxx/qla_tmpl.h |    2 +-
 2 files changed, 6 insertions(+), 5 deletions(-)

--- a/drivers/scsi/qla2xxx/qla_tmpl.c
+++ b/drivers/scsi/qla2xxx/qla_tmpl.c
@@ -910,7 +910,8 @@ qla27xx_template_checksum(void *p, ulong
 static inline int
 qla27xx_verify_template_checksum(struct qla27xx_fwdt_template *tmp)
 {
-	return qla27xx_template_checksum(tmp, tmp->template_size) == 0;
+	return qla27xx_template_checksum(tmp,
+		le32_to_cpu(tmp->template_size)) == 0;
 }
 
 static inline int
@@ -926,7 +927,7 @@ qla27xx_execute_fwdt_template(struct scs
 	ulong len = 0;
 
 	if (qla27xx_fwdt_template_valid(tmp)) {
-		len = tmp->template_size;
+		len = le32_to_cpu(tmp->template_size);
 		tmp = memcpy(buf, tmp, len);
 		ql27xx_edit_template(vha, tmp);
 		qla27xx_walk_template(vha, tmp, buf, &len);
@@ -942,7 +943,7 @@ qla27xx_fwdt_calculate_dump_size(struct
 	ulong len = 0;
 
 	if (qla27xx_fwdt_template_valid(tmp)) {
-		len = tmp->template_size;
+		len = le32_to_cpu(tmp->template_size);
 		qla27xx_walk_template(vha, tmp, NULL, &len);
 	}
 
@@ -954,7 +955,7 @@ qla27xx_fwdt_template_size(void *p)
 {
 	struct qla27xx_fwdt_template *tmp = p;
 
-	return tmp->template_size;
+	return le32_to_cpu(tmp->template_size);
 }
 
 int
--- a/drivers/scsi/qla2xxx/qla_tmpl.h
+++ b/drivers/scsi/qla2xxx/qla_tmpl.h
@@ -13,7 +13,7 @@
 struct __packed qla27xx_fwdt_template {
 	__le32 template_type;
 	__le32 entry_offset;
-	uint32_t template_size;
+	__le32 template_size;
 	uint32_t count;		/* borrow field for running/residual count */
 
 	__le32 entry_count;



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 423/453] scsi: lpfc: Fix invalid sleeping context in lpfc_sli4_nvmet_alloc()
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (420 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.4 422/453] scsi: qla2xxx: Fix crash during driver load on big endian machines Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
  2020-12-28 12:51 ` [PATCH 5.4 424/453] scsi: lpfc: Re-fix use after free in lpfc_rq_buf_free() Greg Kroah-Hartman
                   ` (33 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dick Kennedy, James Smart,
	Martin K. Petersen

From: James Smart <james.smart@broadcom.com>

commit 62e3a931db60daf94fdb3159d685a5bc6ad4d0cf upstream.

The following calltrace was seen:

BUG: sleeping function called from invalid context at mm/slab.h:494
...
Call Trace:
 dump_stack+0x9a/0xf0
 ___might_sleep.cold.63+0x13d/0x178
 slab_pre_alloc_hook+0x6a/0x90
 kmem_cache_alloc_trace+0x3a/0x2d0
 lpfc_sli4_nvmet_alloc+0x4c/0x280 [lpfc]
 lpfc_post_rq_buffer+0x2e7/0xa60 [lpfc]
 lpfc_sli4_hba_setup+0x6b4c/0xa4b0 [lpfc]
 lpfc_pci_probe_one_s4.isra.15+0x14f8/0x2280 [lpfc]
 lpfc_pci_probe_one+0x260/0x2880 [lpfc]
 local_pci_probe+0xd4/0x180
 work_for_cpu_fn+0x51/0xa0
 process_one_work+0x8f0/0x17b0
 worker_thread+0x536/0xb50
 kthread+0x30c/0x3d0
 ret_from_fork+0x3a/0x50

A prior patch introduced a spin_lock_irqsave(hbalock) in the
lpfc_post_rq_buffer() routine. Call trace is seen as the hbalock is held
with interrupts disabled during a GFP_KERNEL allocation in
lpfc_sli4_nvmet_alloc().

Fix by reordering locking so that hbalock not held when calling
sli4_nvmet_alloc() (aka rqb_buf_list()).

Link: https://lore.kernel.org/r/20201020202719.54726-2-james.smart@broadcom.com
Fixes: 411de511c694 ("scsi: lpfc: Fix RQ empty firmware trap")
Cc: <stable@vger.kernel.org> # v4.17+
Co-developed-by: Dick Kennedy <dick.kennedy@broadcom.com>
Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com>
Signed-off-by: James Smart <james.smart@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/scsi/lpfc/lpfc_mem.c |    4 +---
 drivers/scsi/lpfc/lpfc_sli.c |   10 ++++++++--
 2 files changed, 9 insertions(+), 5 deletions(-)

--- a/drivers/scsi/lpfc/lpfc_mem.c
+++ b/drivers/scsi/lpfc/lpfc_mem.c
@@ -593,8 +593,6 @@ lpfc_sli4_rb_free(struct lpfc_hba *phba,
  * Description: Allocates a DMA-mapped receive buffer from the lpfc_hrb_pool PCI
  * pool along a non-DMA-mapped container for it.
  *
- * Notes: Not interrupt-safe.  Must be called with no locks held.
- *
  * Returns:
  *   pointer to HBQ on success
  *   NULL on failure
@@ -604,7 +602,7 @@ lpfc_sli4_nvmet_alloc(struct lpfc_hba *p
 {
 	struct rqb_dmabuf *dma_buf;
 
-	dma_buf = kzalloc(sizeof(struct rqb_dmabuf), GFP_KERNEL);
+	dma_buf = kzalloc(sizeof(*dma_buf), GFP_KERNEL);
 	if (!dma_buf)
 		return NULL;
 
--- a/drivers/scsi/lpfc/lpfc_sli.c
+++ b/drivers/scsi/lpfc/lpfc_sli.c
@@ -7102,12 +7102,16 @@ lpfc_post_rq_buffer(struct lpfc_hba *phb
 	struct rqb_dmabuf *rqb_buffer;
 	LIST_HEAD(rqb_buf_list);
 
-	spin_lock_irqsave(&phba->hbalock, flags);
 	rqbp = hrq->rqbp;
 	for (i = 0; i < count; i++) {
+		spin_lock_irqsave(&phba->hbalock, flags);
 		/* IF RQ is already full, don't bother */
-		if (rqbp->buffer_count + i >= rqbp->entry_count - 1)
+		if (rqbp->buffer_count + i >= rqbp->entry_count - 1) {
+			spin_unlock_irqrestore(&phba->hbalock, flags);
 			break;
+		}
+		spin_unlock_irqrestore(&phba->hbalock, flags);
+
 		rqb_buffer = rqbp->rqb_alloc_buffer(phba);
 		if (!rqb_buffer)
 			break;
@@ -7116,6 +7120,8 @@ lpfc_post_rq_buffer(struct lpfc_hba *phb
 		rqb_buffer->idx = idx;
 		list_add_tail(&rqb_buffer->hbuf.list, &rqb_buf_list);
 	}
+
+	spin_lock_irqsave(&phba->hbalock, flags);
 	while (!list_empty(&rqb_buf_list)) {
 		list_remove_head(&rqb_buf_list, rqb_buffer, struct rqb_dmabuf,
 				 hbuf.list);



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 424/453] scsi: lpfc: Re-fix use after free in lpfc_rq_buf_free()
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (421 preceding siblings ...)
  2020-12-28 12:50 ` [PATCH 5.4 423/453] scsi: lpfc: Fix invalid sleeping context in lpfc_sli4_nvmet_alloc() Greg Kroah-Hartman
@ 2020-12-28 12:51 ` Greg Kroah-Hartman
  2020-12-28 12:51 ` [PATCH 5.4 425/453] iio: buffer: Fix demux update Greg Kroah-Hartman
                   ` (32 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:51 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, James Smart, Martin K. Petersen

From: James Smart <james.smart@broadcom.com>

commit e5785d3ec32f5f44dd88cd7b398e496742630469 upstream.

Commit 9816ef6ecbc1 ("scsi: lpfc: Use after free in lpfc_rq_buf_free()")
was made to correct a use after free condition in lpfc_rq_buf_free().
Unfortunately, a subsequent patch cut on a tree without the fix
inadvertently reverted the fix.

Put the fix back: Move the freeing of the rqb_entry to after the print
function that references it.

Link: https://lore.kernel.org/r/20201020202719.54726-4-james.smart@broadcom.com
Fixes: 411de511c694 ("scsi: lpfc: Fix RQ empty firmware trap")
Cc: <stable@vger.kernel.org> # v4.17+
Signed-off-by: James Smart <james.smart@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/scsi/lpfc/lpfc_mem.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/scsi/lpfc/lpfc_mem.c
+++ b/drivers/scsi/lpfc/lpfc_mem.c
@@ -725,7 +725,6 @@ lpfc_rq_buf_free(struct lpfc_hba *phba,
 	drqe.address_hi = putPaddrHigh(rqb_entry->dbuf.phys);
 	rc = lpfc_sli4_rq_put(rqb_entry->hrq, rqb_entry->drq, &hrqe, &drqe);
 	if (rc < 0) {
-		(rqbp->rqb_free_buffer)(phba, rqb_entry);
 		lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
 				"6409 Cannot post to HRQ %d: %x %x %x "
 				"DRQ %x %x\n",
@@ -735,6 +734,7 @@ lpfc_rq_buf_free(struct lpfc_hba *phba,
 				rqb_entry->hrq->entry_count,
 				rqb_entry->drq->host_index,
 				rqb_entry->drq->hba_index);
+		(rqbp->rqb_free_buffer)(phba, rqb_entry);
 	} else {
 		list_add_tail(&rqb_entry->hbuf.list, &rqbp->rqb_buffer_list);
 		rqbp->buffer_count++;



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 425/453] iio: buffer: Fix demux update
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (422 preceding siblings ...)
  2020-12-28 12:51 ` [PATCH 5.4 424/453] scsi: lpfc: Re-fix use after free in lpfc_rq_buf_free() Greg Kroah-Hartman
@ 2020-12-28 12:51 ` Greg Kroah-Hartman
  2020-12-28 12:51 ` [PATCH 5.4 426/453] iio: adc: rockchip_saradc: fix missing clk_disable_unprepare() on error in rockchip_saradc_resume Greg Kroah-Hartman
                   ` (31 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:51 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Nuno Sá, Stable, Jonathan Cameron

From: Nuno Sá <nuno.sa@analog.com>

commit 19ef7b70ca9487773c29b449adf0c70f540a0aab upstream.

When updating the buffer demux, we will skip a scan element from the
device in the case `in_ind != out_ind` and we enter the while loop.
in_ind should only be refreshed with `find_next_bit()` in the end of the
loop.

Note, to cause problems we need a situation where we are skippig over
an element (channel not enabled) that happens to not have the same size
as the next element.   Whilst this is a possible situation we haven't
actually identified any cases in mainline where it happens as most drivers
have consistent channel storage sizes with the exception of the timestamp
which is the last element and hence never skipped over.

Fixes: 5ada4ea9be16 ("staging:iio: add demux optionally to path from device to buffer")
Signed-off-by: Nuno Sá <nuno.sa@analog.com>
Link: https://lore.kernel.org/r/20201112144323.28887-1-nuno.sa@analog.com
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/iio/industrialio-buffer.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- a/drivers/iio/industrialio-buffer.c
+++ b/drivers/iio/industrialio-buffer.c
@@ -845,12 +845,12 @@ static int iio_buffer_update_demux(struc
 				       indio_dev->masklength,
 				       in_ind + 1);
 		while (in_ind != out_ind) {
-			in_ind = find_next_bit(indio_dev->active_scan_mask,
-					       indio_dev->masklength,
-					       in_ind + 1);
 			length = iio_storage_bytes_for_si(indio_dev, in_ind);
 			/* Make sure we are aligned */
 			in_loc = roundup(in_loc, length) + length;
+			in_ind = find_next_bit(indio_dev->active_scan_mask,
+					       indio_dev->masklength,
+					       in_ind + 1);
 		}
 		length = iio_storage_bytes_for_si(indio_dev, in_ind);
 		out_loc = roundup(out_loc, length);



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 426/453] iio: adc: rockchip_saradc: fix missing clk_disable_unprepare() on error in rockchip_saradc_resume
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (423 preceding siblings ...)
  2020-12-28 12:51 ` [PATCH 5.4 425/453] iio: buffer: Fix demux update Greg Kroah-Hartman
@ 2020-12-28 12:51 ` Greg Kroah-Hartman
  2020-12-28 12:51 ` [PATCH 5.4 427/453] iio:light:rpr0521: Fix timestamp alignment and prevent data leak Greg Kroah-Hartman
                   ` (30 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:51 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Robin Murphy, Qinglang Miao, Stable,
	Jonathan Cameron

From: Qinglang Miao <miaoqinglang@huawei.com>

commit 560c6b914c6ec7d9d9a69fddbb5bf3bf71433e8b upstream.

Fix the missing clk_disable_unprepare() of info->pclk
before return from rockchip_saradc_resume in the error
handling case when fails to prepare and enable info->clk.

Suggested-by: Robin Murphy <robin.murphy@arm.com>
Fixes: 44d6f2ef94f9 ("iio: adc: add driver for Rockchip saradc")
Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
Cc: <Stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201103120743.110662-1-miaoqinglang@huawei.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/iio/adc/rockchip_saradc.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/iio/adc/rockchip_saradc.c
+++ b/drivers/iio/adc/rockchip_saradc.c
@@ -372,7 +372,7 @@ static int rockchip_saradc_resume(struct
 
 	ret = clk_prepare_enable(info->clk);
 	if (ret)
-		return ret;
+		clk_disable_unprepare(info->pclk);
 
 	return ret;
 }



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 427/453] iio:light:rpr0521: Fix timestamp alignment and prevent data leak.
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (424 preceding siblings ...)
  2020-12-28 12:51 ` [PATCH 5.4 426/453] iio: adc: rockchip_saradc: fix missing clk_disable_unprepare() on error in rockchip_saradc_resume Greg Kroah-Hartman
@ 2020-12-28 12:51 ` Greg Kroah-Hartman
  2020-12-28 12:51 ` [PATCH 5.4 428/453] iio:light:st_uvis25: " Greg Kroah-Hartman
                   ` (29 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:51 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jonathan Cameron, Alexandru Ardelean,
	Mikko Koivunen, Stable

From: Jonathan Cameron <Jonathan.Cameron@huawei.com>

commit a61817216bcc755eabbcb1cf281d84ccad267ed1 upstream.

One of a class of bugs pointed out by Lars in a recent review.
iio_push_to_buffers_with_timestamp() assumes the buffer used is aligned
to the size of the timestamp (8 bytes).  This is not guaranteed in
this driver which uses an array of smaller elements on the stack.
As Lars also noted this anti pattern can involve a leak of data to
userspace and that indeed can happen here.  We close both issues by
moving to a suitable structure in the iio_priv().
This data is allocated with kzalloc() so no data can leak apart
from previous readings and in this case the status byte from the device.

The forced alignment of ts is not necessary in this case but it
potentially makes the code less fragile.

>From personal communications with Mikko:

We could probably split the reading of the int register, but it
would mean a significant performance cost of 20 i2c clock cycles.

Fixes: e12ffd241c00 ("iio: light: rpr0521 triggered buffer")
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Alexandru Ardelean <alexandru.ardelean@analog.com>
Cc: Mikko Koivunen <mikko.koivunen@fi.rohmeurope.com>
Cc: <Stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200920112742.170751-2-jic23@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/iio/light/rpr0521.c |   17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

--- a/drivers/iio/light/rpr0521.c
+++ b/drivers/iio/light/rpr0521.c
@@ -194,6 +194,17 @@ struct rpr0521_data {
 	bool pxs_need_dis;
 
 	struct regmap *regmap;
+
+	/*
+	 * Ensure correct naturally aligned timestamp.
+	 * Note that the read will put garbage data into
+	 * the padding but this should not be a problem
+	 */
+	struct {
+		__le16 channels[3];
+		u8 garbage;
+		s64 ts __aligned(8);
+	} scan;
 };
 
 static IIO_CONST_ATTR(in_intensity_scale_available, RPR0521_ALS_SCALE_AVAIL);
@@ -449,8 +460,6 @@ static irqreturn_t rpr0521_trigger_consu
 	struct rpr0521_data *data = iio_priv(indio_dev);
 	int err;
 
-	u8 buffer[16]; /* 3 16-bit channels + padding + ts */
-
 	/* Use irq timestamp when reasonable. */
 	if (iio_trigger_using_own(indio_dev) && data->irq_timestamp) {
 		pf->timestamp = data->irq_timestamp;
@@ -461,11 +470,11 @@ static irqreturn_t rpr0521_trigger_consu
 		pf->timestamp = iio_get_time_ns(indio_dev);
 
 	err = regmap_bulk_read(data->regmap, RPR0521_REG_PXS_DATA,
-		&buffer,
+		data->scan.channels,
 		(3 * 2) + 1);	/* 3 * 16-bit + (discarded) int clear reg. */
 	if (!err)
 		iio_push_to_buffers_with_timestamp(indio_dev,
-						   buffer, pf->timestamp);
+						   &data->scan, pf->timestamp);
 	else
 		dev_err(&data->client->dev,
 			"Trigger consumer can't read from sensor.\n");



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 428/453] iio:light:st_uvis25: Fix timestamp alignment and prevent data leak.
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (425 preceding siblings ...)
  2020-12-28 12:51 ` [PATCH 5.4 427/453] iio:light:rpr0521: Fix timestamp alignment and prevent data leak Greg Kroah-Hartman
@ 2020-12-28 12:51 ` Greg Kroah-Hartman
  2020-12-28 12:51 ` [PATCH 5.4 429/453] iio:magnetometer:mag3110: Fix alignment and data leak issues Greg Kroah-Hartman
                   ` (28 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:51 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lars-Peter Clausen, Jonathan Cameron,
	Alexandru Ardelean, Lorenzo Bianconi, Stable

From: Jonathan Cameron <Jonathan.Cameron@huawei.com>

commit d837a996f57c29a985177bc03b0e599082047f27 upstream.

One of a class of bugs pointed out by Lars in a recent review.
iio_push_to_buffers_with_timestamp() assumes the buffer used is aligned
to the size of the timestamp (8 bytes).  This is not guaranteed in
this driver which uses an array of smaller elements on the stack.
As Lars also noted this anti pattern can involve a leak of data to
userspace and that indeed can happen here.  We close both issues by
moving to a suitable structure in the iio_priv()

This data is allocated with kzalloc() so no data can leak apart
from previous readings.

A local unsigned int variable is used for the regmap call so it
is clear there is no potential issue with writing into the padding
of the structure.

Fixes: 3025c8688c1e ("iio: light: add support for UVIS25 sensor")
Reported-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Alexandru Ardelean <alexandru.ardelean@analog.com>
Acked-by: Lorenzo Bianconi <lorenzo@kernel.org>
Cc: <Stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200920112742.170751-3-jic23@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/iio/light/st_uvis25.h      |    5 +++++
 drivers/iio/light/st_uvis25_core.c |    8 +++++---
 2 files changed, 10 insertions(+), 3 deletions(-)

--- a/drivers/iio/light/st_uvis25.h
+++ b/drivers/iio/light/st_uvis25.h
@@ -27,6 +27,11 @@ struct st_uvis25_hw {
 	struct iio_trigger *trig;
 	bool enabled;
 	int irq;
+	/* Ensure timestamp is naturally aligned */
+	struct {
+		u8 chan;
+		s64 ts __aligned(8);
+	} scan;
 };
 
 extern const struct dev_pm_ops st_uvis25_pm_ops;
--- a/drivers/iio/light/st_uvis25_core.c
+++ b/drivers/iio/light/st_uvis25_core.c
@@ -234,17 +234,19 @@ static const struct iio_buffer_setup_ops
 
 static irqreturn_t st_uvis25_buffer_handler_thread(int irq, void *p)
 {
-	u8 buffer[ALIGN(sizeof(u8), sizeof(s64)) + sizeof(s64)];
 	struct iio_poll_func *pf = p;
 	struct iio_dev *iio_dev = pf->indio_dev;
 	struct st_uvis25_hw *hw = iio_priv(iio_dev);
+	unsigned int val;
 	int err;
 
-	err = regmap_read(hw->regmap, ST_UVIS25_REG_OUT_ADDR, (int *)buffer);
+	err = regmap_read(hw->regmap, ST_UVIS25_REG_OUT_ADDR, &val);
 	if (err < 0)
 		goto out;
 
-	iio_push_to_buffers_with_timestamp(iio_dev, buffer,
+	hw->scan.chan = val;
+
+	iio_push_to_buffers_with_timestamp(iio_dev, &hw->scan,
 					   iio_get_time_ns(iio_dev));
 
 out:



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 429/453] iio:magnetometer:mag3110: Fix alignment and data leak issues.
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (426 preceding siblings ...)
  2020-12-28 12:51 ` [PATCH 5.4 428/453] iio:light:st_uvis25: " Greg Kroah-Hartman
@ 2020-12-28 12:51 ` Greg Kroah-Hartman
  2020-12-28 12:51 ` [PATCH 5.4 430/453] iio:pressure:mpl3115: Force alignment of buffer Greg Kroah-Hartman
                   ` (27 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:51 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lars-Peter Clausen, Jonathan Cameron,
	Alexandru Ardelean, Stable

From: Jonathan Cameron <Jonathan.Cameron@huawei.com>

commit 89deb1334252ea4a8491d47654811e28b0790364 upstream.

One of a class of bugs pointed out by Lars in a recent review.
iio_push_to_buffers_with_timestamp() assumes the buffer used is aligned
to the size of the timestamp (8 bytes).  This is not guaranteed in
this driver which uses an array of smaller elements on the stack.
As Lars also noted this anti pattern can involve a leak of data to
userspace and that indeed can happen here.  We close both issues by
moving to a suitable structure in the iio_priv() data.
This data is allocated with kzalloc() so no data can leak apart from
previous readings.

The explicit alignment of ts is not necessary in this case but
does make the code slightly less fragile so I have included it.

Fixes: 39631b5f9584 ("iio: Add Freescale mag3110 magnetometer driver")
Reported-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Alexandru Ardelean <alexandru.ardelean@analog.com>
Cc: <Stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200920112742.170751-4-jic23@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/iio/magnetometer/mag3110.c |   13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

--- a/drivers/iio/magnetometer/mag3110.c
+++ b/drivers/iio/magnetometer/mag3110.c
@@ -56,6 +56,12 @@ struct mag3110_data {
 	int sleep_val;
 	struct regulator *vdd_reg;
 	struct regulator *vddio_reg;
+	/* Ensure natural alignment of timestamp */
+	struct {
+		__be16 channels[3];
+		u8 temperature;
+		s64 ts __aligned(8);
+	} scan;
 };
 
 static int mag3110_request(struct mag3110_data *data)
@@ -387,10 +393,9 @@ static irqreturn_t mag3110_trigger_handl
 	struct iio_poll_func *pf = p;
 	struct iio_dev *indio_dev = pf->indio_dev;
 	struct mag3110_data *data = iio_priv(indio_dev);
-	u8 buffer[16]; /* 3 16-bit channels + 1 byte temp + padding + ts */
 	int ret;
 
-	ret = mag3110_read(data, (__be16 *) buffer);
+	ret = mag3110_read(data, data->scan.channels);
 	if (ret < 0)
 		goto done;
 
@@ -399,10 +404,10 @@ static irqreturn_t mag3110_trigger_handl
 			MAG3110_DIE_TEMP);
 		if (ret < 0)
 			goto done;
-		buffer[6] = ret;
+		data->scan.temperature = ret;
 	}
 
-	iio_push_to_buffers_with_timestamp(indio_dev, buffer,
+	iio_push_to_buffers_with_timestamp(indio_dev, &data->scan,
 		iio_get_time_ns(indio_dev));
 
 done:



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 430/453] iio:pressure:mpl3115: Force alignment of buffer
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (427 preceding siblings ...)
  2020-12-28 12:51 ` [PATCH 5.4 429/453] iio:magnetometer:mag3110: Fix alignment and data leak issues Greg Kroah-Hartman
@ 2020-12-28 12:51 ` Greg Kroah-Hartman
  2020-12-28 12:51 ` [PATCH 5.4 431/453] iio:imu:bmi160: Fix too large a buffer Greg Kroah-Hartman
                   ` (26 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:51 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lars-Peter Clausen, Jonathan Cameron,
	Andy Shevchenko, Alexandru Ardelean, Peter Meerwald, Stable

From: Jonathan Cameron <Jonathan.Cameron@huawei.com>

commit 198cf32f0503d2ad60d320b95ef6fb8243db857f upstream.

Whilst this is another case of the issue Lars reported with
an array of elements of smaller than 8 bytes being passed
to iio_push_to_buffers_with_timestamp(), the solution here is
a bit different from the other cases and relies on __aligned
working on the stack (true since 4.6?)

This one is unusual.  We have to do an explicit memset() each time
as we are reading 3 bytes into a potential 4 byte channel which
may sometimes be a 2 byte channel depending on what is enabled.
As such, moving the buffer to the heap in the iio_priv structure
doesn't save us much.  We can't use a nice explicit structure
on the stack either as the data channels have different storage
sizes and are all separately controlled.

Fixes: cc26ad455f57 ("iio: Add Freescale MPL3115A2 pressure / temperature sensor driver")
Reported-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Reviewed-by: Alexandru Ardelean <alexandru.ardelean@analog.com>
Cc: Peter Meerwald <pmeerw@pmeerw.net>
Cc: <Stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200920112742.170751-7-jic23@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/iio/pressure/mpl3115.c |    9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

--- a/drivers/iio/pressure/mpl3115.c
+++ b/drivers/iio/pressure/mpl3115.c
@@ -144,7 +144,14 @@ static irqreturn_t mpl3115_trigger_handl
 	struct iio_poll_func *pf = p;
 	struct iio_dev *indio_dev = pf->indio_dev;
 	struct mpl3115_data *data = iio_priv(indio_dev);
-	u8 buffer[16]; /* 32-bit channel + 16-bit channel + padding + ts */
+	/*
+	 * 32-bit channel + 16-bit channel + padding + ts
+	 * Note that it is possible for only one of the first 2
+	 * channels to be enabled. If that happens, the first element
+	 * of the buffer may be either 16 or 32-bits.  As such we cannot
+	 * use a simple structure definition to express this data layout.
+	 */
+	u8 buffer[16] __aligned(8);
 	int ret, pos = 0;
 
 	mutex_lock(&data->lock);



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 431/453] iio:imu:bmi160: Fix too large a buffer.
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (428 preceding siblings ...)
  2020-12-28 12:51 ` [PATCH 5.4 430/453] iio:pressure:mpl3115: Force alignment of buffer Greg Kroah-Hartman
@ 2020-12-28 12:51 ` Greg Kroah-Hartman
  2020-12-28 12:51 ` [PATCH 5.4 432/453] iio:adc:ti-ads124s08: Fix buffer being too long Greg Kroah-Hartman
                   ` (25 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:51 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jonathan Cameron, Alexandru Ardelean,
	Daniel Baluta, Stable

From: Jonathan Cameron <Jonathan.Cameron@huawei.com>

commit dc7de42d6b50a07b37feeba4c6b5136290fcee81 upstream.

The comment implies this device has 3 sensor types, but it only
has an accelerometer and a gyroscope (both 3D).  As such the
buffer does not need to be as long as stated.

Note I've separated this from the following patch which fixes
the alignment for passing to iio_push_to_buffers_with_timestamp()
as they are different issues even if they affect the same line
of code.

Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Alexandru Ardelean <alexandru.ardelean@analog.com>
Cc: Daniel Baluta <daniel.baluta@oss.nxp.com>
Cc: <Stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200920112742.170751-5-jic23@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/iio/imu/bmi160/bmi160_core.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/iio/imu/bmi160/bmi160_core.c
+++ b/drivers/iio/imu/bmi160/bmi160_core.c
@@ -411,8 +411,8 @@ static irqreturn_t bmi160_trigger_handle
 	struct iio_poll_func *pf = p;
 	struct iio_dev *indio_dev = pf->indio_dev;
 	struct bmi160_data *data = iio_priv(indio_dev);
-	__le16 buf[16];
-	/* 3 sens x 3 axis x __le16 + 3 x __le16 pad + 4 x __le16 tstamp */
+	__le16 buf[12];
+	/* 2 sens x 3 axis x __le16 + 2 x __le16 pad + 4 x __le16 tstamp */
 	int i, ret, j = 0, base = BMI160_REG_DATA_MAGN_XOUT_L;
 	__le16 sample;
 



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 432/453] iio:adc:ti-ads124s08: Fix buffer being too long.
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (429 preceding siblings ...)
  2020-12-28 12:51 ` [PATCH 5.4 431/453] iio:imu:bmi160: Fix too large a buffer Greg Kroah-Hartman
@ 2020-12-28 12:51 ` Greg Kroah-Hartman
  2020-12-28 12:51 ` [PATCH 5.4 433/453] iio:adc:ti-ads124s08: Fix alignment and data leak issues Greg Kroah-Hartman
                   ` (24 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:51 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jonathan Cameron, Alexandru Ardelean,
	Dan Murphy, Stable

From: Jonathan Cameron <Jonathan.Cameron@huawei.com>

commit b0bd27f02d768e3a861c4e6c27f8e369720e6c25 upstream.

The buffer is expressed as a u32 array, yet the extra space for
the s64 timestamp was expressed as sizeof(s64)/sizeof(u16).
This will result in 2 extra u32 elements.
Fix by dividing by sizeof(u32).

Fixes: e717f8c6dfec ("iio: adc: Add the TI ads124s08 ADC code")
Signed-off-by: Jonathan Cameron<Jonathan.Cameron@huawei.com>
Reviewed-by: Alexandru Ardelean <alexandru.ardelean@analog.com>
Cc: Dan Murphy <dmurphy@ti.com>
Cc: <Stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200920112742.170751-8-jic23@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/iio/adc/ti-ads124s08.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/iio/adc/ti-ads124s08.c
+++ b/drivers/iio/adc/ti-ads124s08.c
@@ -270,7 +270,7 @@ static irqreturn_t ads124s_trigger_handl
 	struct iio_poll_func *pf = p;
 	struct iio_dev *indio_dev = pf->indio_dev;
 	struct ads124s_private *priv = iio_priv(indio_dev);
-	u32 buffer[ADS124S08_MAX_CHANNELS + sizeof(s64)/sizeof(u16)];
+	u32 buffer[ADS124S08_MAX_CHANNELS + sizeof(s64)/sizeof(u32)];
 	int scan_index, j = 0;
 	int ret;
 



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 433/453] iio:adc:ti-ads124s08: Fix alignment and data leak issues.
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (430 preceding siblings ...)
  2020-12-28 12:51 ` [PATCH 5.4 432/453] iio:adc:ti-ads124s08: Fix buffer being too long Greg Kroah-Hartman
@ 2020-12-28 12:51 ` Greg Kroah-Hartman
  2020-12-28 12:51 ` [PATCH 5.4 434/453] md/cluster: block reshape with remote resync job Greg Kroah-Hartman
                   ` (23 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:51 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lars-Peter Clausen, Jonathan Cameron,
	Alexandru Ardelean, Dan Murphy, Stable

From: Jonathan Cameron <Jonathan.Cameron@huawei.com>

commit 1e405bc2512f80a903ddd6ba8740cee885238d7f upstream.

One of a class of bugs pointed out by Lars in a recent review.
iio_push_to_buffers_with_timestamp() assumes the buffer used is aligned
to the size of the timestamp (8 bytes).  This is not guaranteed in
this driver which uses an array of smaller elements on the stack.
As Lars also noted this anti pattern can involve a leak of data to
userspace and that indeed can happen here.  We close both issues by
moving to a suitable structure in the iio_priv() data with alignment
explicitly requested.  This data is allocated with kzalloc() so no
data can leak apart from previous readings.

In this driver the timestamp can end up in various different locations
depending on what other channels are enabled.  As a result, we don't
use a structure to specify it's position as that would be misleading.

Fixes: e717f8c6dfec ("iio: adc: Add the TI ads124s08 ADC code")
Reported-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Alexandru Ardelean <alexandru.ardelean@analog.com>
Cc: Dan Murphy <dmurphy@ti.com>
Cc: <Stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200920112742.170751-9-jic23@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/iio/adc/ti-ads124s08.c |   13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

--- a/drivers/iio/adc/ti-ads124s08.c
+++ b/drivers/iio/adc/ti-ads124s08.c
@@ -97,6 +97,14 @@ struct ads124s_private {
 	struct gpio_desc *reset_gpio;
 	struct spi_device *spi;
 	struct mutex lock;
+	/*
+	 * Used to correctly align data.
+	 * Ensure timestamp is naturally aligned.
+	 * Note that the full buffer length may not be needed if not
+	 * all channels are enabled, as long as the alignment of the
+	 * timestamp is maintained.
+	 */
+	u32 buffer[ADS124S08_MAX_CHANNELS + sizeof(s64)/sizeof(u32)] __aligned(8);
 	u8 data[5] ____cacheline_aligned;
 };
 
@@ -270,7 +278,6 @@ static irqreturn_t ads124s_trigger_handl
 	struct iio_poll_func *pf = p;
 	struct iio_dev *indio_dev = pf->indio_dev;
 	struct ads124s_private *priv = iio_priv(indio_dev);
-	u32 buffer[ADS124S08_MAX_CHANNELS + sizeof(s64)/sizeof(u32)];
 	int scan_index, j = 0;
 	int ret;
 
@@ -285,7 +292,7 @@ static irqreturn_t ads124s_trigger_handl
 		if (ret)
 			dev_err(&priv->spi->dev, "Start ADC conversions failed\n");
 
-		buffer[j] = ads124s_read(indio_dev, scan_index);
+		priv->buffer[j] = ads124s_read(indio_dev, scan_index);
 		ret = ads124s_write_cmd(indio_dev, ADS124S08_STOP_CONV);
 		if (ret)
 			dev_err(&priv->spi->dev, "Stop ADC conversions failed\n");
@@ -293,7 +300,7 @@ static irqreturn_t ads124s_trigger_handl
 		j++;
 	}
 
-	iio_push_to_buffers_with_timestamp(indio_dev, buffer,
+	iio_push_to_buffers_with_timestamp(indio_dev, priv->buffer,
 			pf->timestamp);
 
 	iio_trigger_notify_done(indio_dev->trig);



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 434/453] md/cluster: block reshape with remote resync job
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (431 preceding siblings ...)
  2020-12-28 12:51 ` [PATCH 5.4 433/453] iio:adc:ti-ads124s08: Fix alignment and data leak issues Greg Kroah-Hartman
@ 2020-12-28 12:51 ` Greg Kroah-Hartman
  2020-12-28 12:51 ` [PATCH 5.4 435/453] md/cluster: fix deadlock when node is doing " Greg Kroah-Hartman
                   ` (22 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:51 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Zhao Heming, Song Liu

From: Zhao Heming <heming.zhao@suse.com>

commit a8da01f79c89755fad55ed0ea96e8d2103242a72 upstream.

Reshape request should be blocked with ongoing resync job. In cluster
env, a node can start resync job even if the resync cmd isn't executed
on it, e.g., user executes "mdadm --grow" on node A, sometimes node B
will start resync job. However, current update_raid_disks() only check
local recovery status, which is incomplete. As a result, we see user will
execute "mdadm --grow" successfully on local, while the remote node deny
to do reshape job when it doing resync job. The inconsistent handling
cause array enter unexpected status. If user doesn't observe this issue
and continue executing mdadm cmd, the array doesn't work at last.

Fix this issue by blocking reshape request. When node executes "--grow"
and detects ongoing resync, it should stop and report error to user.

The following script reproduces the issue with ~100% probability.
(two nodes share 3 iSCSI luns: sdg/sdh/sdi. Each lun size is 1GB)
```
 # on node1, node2 is the remote node.
ssh root@node2 "mdadm -S --scan"
mdadm -S --scan
for i in {g,h,i};do dd if=/dev/zero of=/dev/sd$i oflag=direct bs=1M \
count=20; done

mdadm -C /dev/md0 -b clustered -e 1.2 -n 2 -l mirror /dev/sdg /dev/sdh
ssh root@node2 "mdadm -A /dev/md0 /dev/sdg /dev/sdh"

sleep 5

mdadm --manage --add /dev/md0 /dev/sdi
mdadm --wait /dev/md0
mdadm --grow --raid-devices=3 /dev/md0

mdadm /dev/md0 --fail /dev/sdg
mdadm /dev/md0 --remove /dev/sdg
mdadm --grow --raid-devices=2 /dev/md0
```

Cc: stable@vger.kernel.org
Signed-off-by: Zhao Heming <heming.zhao@suse.com>
Signed-off-by: Song Liu <songliubraving@fb.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/md/md.c |    8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -7052,6 +7052,7 @@ static int update_raid_disks(struct mdde
 		return -EINVAL;
 	if (mddev->sync_thread ||
 	    test_bit(MD_RECOVERY_RUNNING, &mddev->recovery) ||
+	    test_bit(MD_RESYNCING_REMOTE, &mddev->recovery) ||
 	    mddev->reshape_position != MaxSector)
 		return -EBUSY;
 
@@ -9423,8 +9424,11 @@ static void check_sb_changes(struct mdde
 		}
 	}
 
-	if (mddev->raid_disks != le32_to_cpu(sb->raid_disks))
-		update_raid_disks(mddev, le32_to_cpu(sb->raid_disks));
+	if (mddev->raid_disks != le32_to_cpu(sb->raid_disks)) {
+		ret = update_raid_disks(mddev, le32_to_cpu(sb->raid_disks));
+		if (ret)
+			pr_warn("md: updating array disks failed. %d\n", ret);
+	}
 
 	/*
 	 * Since mddev->delta_disks has already updated in update_raid_disks,



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 435/453] md/cluster: fix deadlock when node is doing resync job
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (432 preceding siblings ...)
  2020-12-28 12:51 ` [PATCH 5.4 434/453] md/cluster: block reshape with remote resync job Greg Kroah-Hartman
@ 2020-12-28 12:51 ` Greg Kroah-Hartman
  2020-12-28 12:51 ` [PATCH 5.4 436/453] pinctrl: sunxi: Always call chained_irq_{enter, exit} in sunxi_pinctrl_irq_handler Greg Kroah-Hartman
                   ` (21 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:51 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Zhao Heming, Xiao Ni, Song Liu

From: Zhao Heming <heming.zhao@suse.com>

commit bca5b0658020be90b6b504ca514fd80110204f71 upstream.

md-cluster uses MD_CLUSTER_SEND_LOCK to make node can exclusively send msg.
During sending msg, node can concurrently receive msg from another node.
When node does resync job, grab token_lockres:EX may trigger a deadlock:
```
nodeA                       nodeB
--------------------     --------------------
a.
send METADATA_UPDATED
held token_lockres:EX
                         b.
                         md_do_sync
                          resync_info_update
                            send RESYNCING
                             + set MD_CLUSTER_SEND_LOCK
                             + wait for holding token_lockres:EX

                         c.
                         mdadm /dev/md0 --remove /dev/sdg
                          + held reconfig_mutex
                          + send REMOVE
                             + wait_event(MD_CLUSTER_SEND_LOCK)

                         d.
                         recv_daemon //METADATA_UPDATED from A
                          process_metadata_update
                           + (mddev_trylock(mddev) ||
                              MD_CLUSTER_HOLDING_MUTEX_FOR_RECVD)
                             //this time, both return false forever
```
Explaination:
a. A send METADATA_UPDATED
   This will block another node to send msg

b. B does sync jobs, which will send RESYNCING at intervals.
   This will be block for holding token_lockres:EX lock.

c. B do "mdadm --remove", which will send REMOVE.
   This will be blocked by step <b>: MD_CLUSTER_SEND_LOCK is 1.

d. B recv METADATA_UPDATED msg, which send from A in step <a>.
   This will be blocked by step <c>: holding mddev lock, it makes
   wait_event can't hold mddev lock. (btw,
   MD_CLUSTER_HOLDING_MUTEX_FOR_RECVD keep ZERO in this scenario.)

There is a similar deadlock in commit 0ba959774e93
("md-cluster: use sync way to handle METADATA_UPDATED msg")
In that commit, step c is "update sb". This patch step c is
"mdadm --remove".

For fixing this issue, we can refer the solution of function:
metadata_update_start. Which does the same grab lock_token action.
lock_comm can use the same steps to avoid deadlock. By moving
MD_CLUSTER_HOLDING_MUTEX_FOR_RECVD from lock_token to lock_comm.
It enlarge a little bit window of MD_CLUSTER_HOLDING_MUTEX_FOR_RECVD,
but it is safe & can break deadlock.

Repro steps (I only triggered 3 times with hundreds tests):

two nodes share 3 iSCSI luns: sdg/sdh/sdi. Each lun size is 1GB.
```
ssh root@node2 "mdadm -S --scan"
mdadm -S --scan
for i in {g,h,i};do dd if=/dev/zero of=/dev/sd$i oflag=direct bs=1M \
count=20; done

mdadm -C /dev/md0 -b clustered -e 1.2 -n 2 -l mirror /dev/sdg /dev/sdh \
 --bitmap-chunk=1M
ssh root@node2 "mdadm -A /dev/md0 /dev/sdg /dev/sdh"

sleep 5

mkfs.xfs /dev/md0
mdadm --manage --add /dev/md0 /dev/sdi
mdadm --wait /dev/md0
mdadm --grow --raid-devices=3 /dev/md0

mdadm /dev/md0 --fail /dev/sdg
mdadm /dev/md0 --remove /dev/sdg
mdadm --grow --raid-devices=2 /dev/md0
```

test script will hung when executing "mdadm --remove".

```
 # dump stacks by "echo t > /proc/sysrq-trigger"
md0_cluster_rec D    0  5329      2 0x80004000
Call Trace:
 __schedule+0x1f6/0x560
 ? _cond_resched+0x2d/0x40
 ? schedule+0x4a/0xb0
 ? process_metadata_update.isra.0+0xdb/0x140 [md_cluster]
 ? wait_woken+0x80/0x80
 ? process_recvd_msg+0x113/0x1d0 [md_cluster]
 ? recv_daemon+0x9e/0x120 [md_cluster]
 ? md_thread+0x94/0x160 [md_mod]
 ? wait_woken+0x80/0x80
 ? md_congested+0x30/0x30 [md_mod]
 ? kthread+0x115/0x140
 ? __kthread_bind_mask+0x60/0x60
 ? ret_from_fork+0x1f/0x40

mdadm           D    0  5423      1 0x00004004
Call Trace:
 __schedule+0x1f6/0x560
 ? __schedule+0x1fe/0x560
 ? schedule+0x4a/0xb0
 ? lock_comm.isra.0+0x7b/0xb0 [md_cluster]
 ? wait_woken+0x80/0x80
 ? remove_disk+0x4f/0x90 [md_cluster]
 ? hot_remove_disk+0xb1/0x1b0 [md_mod]
 ? md_ioctl+0x50c/0xba0 [md_mod]
 ? wait_woken+0x80/0x80
 ? blkdev_ioctl+0xa2/0x2a0
 ? block_ioctl+0x39/0x40
 ? ksys_ioctl+0x82/0xc0
 ? __x64_sys_ioctl+0x16/0x20
 ? do_syscall_64+0x5f/0x150
 ? entry_SYSCALL_64_after_hwframe+0x44/0xa9

md0_resync      D    0  5425      2 0x80004000
Call Trace:
 __schedule+0x1f6/0x560
 ? schedule+0x4a/0xb0
 ? dlm_lock_sync+0xa1/0xd0 [md_cluster]
 ? wait_woken+0x80/0x80
 ? lock_token+0x2d/0x90 [md_cluster]
 ? resync_info_update+0x95/0x100 [md_cluster]
 ? raid1_sync_request+0x7d3/0xa40 [raid1]
 ? md_do_sync.cold+0x737/0xc8f [md_mod]
 ? md_thread+0x94/0x160 [md_mod]
 ? md_congested+0x30/0x30 [md_mod]
 ? kthread+0x115/0x140
 ? __kthread_bind_mask+0x60/0x60
 ? ret_from_fork+0x1f/0x40
```

At last, thanks for Xiao's solution.

Cc: stable@vger.kernel.org
Signed-off-by: Zhao Heming <heming.zhao@suse.com>
Suggested-by: Xiao Ni <xni@redhat.com>
Reviewed-by: Xiao Ni <xni@redhat.com>
Signed-off-by: Song Liu <songliubraving@fb.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/md/md-cluster.c |   67 +++++++++++++++++++++++++++---------------------
 drivers/md/md.c         |    6 ++--
 2 files changed, 42 insertions(+), 31 deletions(-)

--- a/drivers/md/md-cluster.c
+++ b/drivers/md/md-cluster.c
@@ -664,9 +664,27 @@ out:
  * Takes the lock on the TOKEN lock resource so no other
  * node can communicate while the operation is underway.
  */
-static int lock_token(struct md_cluster_info *cinfo, bool mddev_locked)
+static int lock_token(struct md_cluster_info *cinfo)
 {
-	int error, set_bit = 0;
+	int error;
+
+	error = dlm_lock_sync(cinfo->token_lockres, DLM_LOCK_EX);
+	if (error) {
+		pr_err("md-cluster(%s:%d): failed to get EX on TOKEN (%d)\n",
+				__func__, __LINE__, error);
+	} else {
+		/* Lock the receive sequence */
+		mutex_lock(&cinfo->recv_mutex);
+	}
+	return error;
+}
+
+/* lock_comm()
+ * Sets the MD_CLUSTER_SEND_LOCK bit to lock the send channel.
+ */
+static int lock_comm(struct md_cluster_info *cinfo, bool mddev_locked)
+{
+	int rv, set_bit = 0;
 	struct mddev *mddev = cinfo->mddev;
 
 	/*
@@ -677,34 +695,19 @@ static int lock_token(struct md_cluster_
 	 */
 	if (mddev_locked && !test_bit(MD_CLUSTER_HOLDING_MUTEX_FOR_RECVD,
 				      &cinfo->state)) {
-		error = test_and_set_bit_lock(MD_CLUSTER_HOLDING_MUTEX_FOR_RECVD,
+		rv = test_and_set_bit_lock(MD_CLUSTER_HOLDING_MUTEX_FOR_RECVD,
 					      &cinfo->state);
-		WARN_ON_ONCE(error);
+		WARN_ON_ONCE(rv);
 		md_wakeup_thread(mddev->thread);
 		set_bit = 1;
 	}
-	error = dlm_lock_sync(cinfo->token_lockres, DLM_LOCK_EX);
-	if (set_bit)
-		clear_bit_unlock(MD_CLUSTER_HOLDING_MUTEX_FOR_RECVD, &cinfo->state);
 
-	if (error)
-		pr_err("md-cluster(%s:%d): failed to get EX on TOKEN (%d)\n",
-				__func__, __LINE__, error);
-
-	/* Lock the receive sequence */
-	mutex_lock(&cinfo->recv_mutex);
-	return error;
-}
-
-/* lock_comm()
- * Sets the MD_CLUSTER_SEND_LOCK bit to lock the send channel.
- */
-static int lock_comm(struct md_cluster_info *cinfo, bool mddev_locked)
-{
 	wait_event(cinfo->wait,
 		   !test_and_set_bit(MD_CLUSTER_SEND_LOCK, &cinfo->state));
-
-	return lock_token(cinfo, mddev_locked);
+	rv = lock_token(cinfo);
+	if (set_bit)
+		clear_bit_unlock(MD_CLUSTER_HOLDING_MUTEX_FOR_RECVD, &cinfo->state);
+	return rv;
 }
 
 static void unlock_comm(struct md_cluster_info *cinfo)
@@ -784,9 +787,11 @@ static int sendmsg(struct md_cluster_inf
 {
 	int ret;
 
-	lock_comm(cinfo, mddev_locked);
-	ret = __sendmsg(cinfo, cmsg);
-	unlock_comm(cinfo);
+	ret = lock_comm(cinfo, mddev_locked);
+	if (!ret) {
+		ret = __sendmsg(cinfo, cmsg);
+		unlock_comm(cinfo);
+	}
 	return ret;
 }
 
@@ -1061,7 +1066,7 @@ static int metadata_update_start(struct
 		return 0;
 	}
 
-	ret = lock_token(cinfo, 1);
+	ret = lock_token(cinfo);
 	clear_bit_unlock(MD_CLUSTER_HOLDING_MUTEX_FOR_RECVD, &cinfo->state);
 	return ret;
 }
@@ -1255,7 +1260,10 @@ static void update_size(struct mddev *md
 	int raid_slot = -1;
 
 	md_update_sb(mddev, 1);
-	lock_comm(cinfo, 1);
+	if (lock_comm(cinfo, 1)) {
+		pr_err("%s: lock_comm failed\n", __func__);
+		return;
+	}
 
 	memset(&cmsg, 0, sizeof(cmsg));
 	cmsg.type = cpu_to_le32(METADATA_UPDATED);
@@ -1407,7 +1415,8 @@ static int add_new_disk(struct mddev *md
 	cmsg.type = cpu_to_le32(NEWDISK);
 	memcpy(cmsg.uuid, uuid, 16);
 	cmsg.raid_slot = cpu_to_le32(rdev->desc_nr);
-	lock_comm(cinfo, 1);
+	if (lock_comm(cinfo, 1))
+		return -EAGAIN;
 	ret = __sendmsg(cinfo, &cmsg);
 	if (ret) {
 		unlock_comm(cinfo);
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -6721,8 +6721,10 @@ static int hot_remove_disk(struct mddev
 		goto busy;
 
 kick_rdev:
-	if (mddev_is_clustered(mddev))
-		md_cluster_ops->remove_disk(mddev, rdev);
+	if (mddev_is_clustered(mddev)) {
+		if (md_cluster_ops->remove_disk(mddev, rdev))
+			goto busy;
+	}
 
 	md_kick_rdev_from_array(rdev);
 	set_bit(MD_SB_CHANGE_DEVS, &mddev->sb_flags);



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 436/453] pinctrl: sunxi: Always call chained_irq_{enter, exit} in sunxi_pinctrl_irq_handler
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (433 preceding siblings ...)
  2020-12-28 12:51 ` [PATCH 5.4 435/453] md/cluster: fix deadlock when node is doing " Greg Kroah-Hartman
@ 2020-12-28 12:51 ` Greg Kroah-Hartman
  2020-12-28 12:51 ` [PATCH 5.4 437/453] clk: ingenic: Fix divider calculation with div tables Greg Kroah-Hartman
                   ` (20 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:51 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Yangtao Li, Linus Walleij

From: Yangtao Li <frank@allwinnertech.com>

commit a1158e36f876f6269978a4176e3a1d48d27fe7a1 upstream.

It is found on many allwinner soc that there is a low probability that
the interrupt status cannot be read in sunxi_pinctrl_irq_handler. This
will cause the interrupt status of a gpio bank to always be active on
gic, preventing gic from responding to other spi interrupts correctly.

So we should call the chained_irq_* each time enter sunxi_pinctrl_irq_handler().

Signed-off-by: Yangtao Li <frank@allwinnertech.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/85263ce8b058e80cea25c6ad6383eb256ce96cc8.1604988979.git.frank@allwinnertech.com
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/pinctrl/sunxi/pinctrl-sunxi.c |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

--- a/drivers/pinctrl/sunxi/pinctrl-sunxi.c
+++ b/drivers/pinctrl/sunxi/pinctrl-sunxi.c
@@ -1130,20 +1130,22 @@ static void sunxi_pinctrl_irq_handler(st
 	if (bank == pctl->desc->irq_banks)
 		return;
 
+	chained_irq_enter(chip, desc);
+
 	reg = sunxi_irq_status_reg_from_bank(pctl->desc, bank);
 	val = readl(pctl->membase + reg);
 
 	if (val) {
 		int irqoffset;
 
-		chained_irq_enter(chip, desc);
 		for_each_set_bit(irqoffset, &val, IRQ_PER_BANK) {
 			int pin_irq = irq_find_mapping(pctl->domain,
 						       bank * IRQ_PER_BANK + irqoffset);
 			generic_handle_irq(pin_irq);
 		}
-		chained_irq_exit(chip, desc);
 	}
+
+	chained_irq_exit(chip, desc);
 }
 
 static int sunxi_pinctrl_add_function(struct sunxi_pinctrl *pctl,



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 437/453] clk: ingenic: Fix divider calculation with div tables
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (434 preceding siblings ...)
  2020-12-28 12:51 ` [PATCH 5.4 436/453] pinctrl: sunxi: Always call chained_irq_{enter, exit} in sunxi_pinctrl_irq_handler Greg Kroah-Hartman
@ 2020-12-28 12:51 ` Greg Kroah-Hartman
  2020-12-28 12:51 ` [PATCH 5.4 438/453] clk: mvebu: a3700: fix the XTAL MODE pin to MPP1_9 Greg Kroah-Hartman
                   ` (19 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:51 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Paul Cercueil, Stephen Boyd

From: Paul Cercueil <paul@crapouillou.net>

commit 11a163f2c7d6a9f27ce144cd7e367a81c851621a upstream.

The previous code assumed that a higher hardware value always resulted
in a bigger divider, which is correct for the regular clocks, but is
an invalid assumption when a divider table is provided for the clock.

Perfect example of this is the PLL0_HALF clock, which applies a /2
divider with the hardware value 0, and a /1 divider otherwise.

Fixes: a9fa2893fcc6 ("clk: ingenic: Add support for divider tables")
Cc: <stable@vger.kernel.org> # 5.2
Signed-off-by: Paul Cercueil <paul@crapouillou.net>
Link: https://lore.kernel.org/r/20201212135733.38050-1-paul@crapouillou.net
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/clk/ingenic/cgu.c |   14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

--- a/drivers/clk/ingenic/cgu.c
+++ b/drivers/clk/ingenic/cgu.c
@@ -393,15 +393,21 @@ static unsigned int
 ingenic_clk_calc_hw_div(const struct ingenic_cgu_clk_info *clk_info,
 			unsigned int div)
 {
-	unsigned int i;
+	unsigned int i, best_i = 0, best = (unsigned int)-1;
 
 	for (i = 0; i < (1 << clk_info->div.bits)
 				&& clk_info->div.div_table[i]; i++) {
-		if (clk_info->div.div_table[i] >= div)
-			return i;
+		if (clk_info->div.div_table[i] >= div &&
+		    clk_info->div.div_table[i] < best) {
+			best = clk_info->div.div_table[i];
+			best_i = i;
+
+			if (div == best)
+				break;
+		}
 	}
 
-	return i - 1;
+	return best_i;
 }
 
 static unsigned



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 438/453] clk: mvebu: a3700: fix the XTAL MODE pin to MPP1_9
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (435 preceding siblings ...)
  2020-12-28 12:51 ` [PATCH 5.4 437/453] clk: ingenic: Fix divider calculation with div tables Greg Kroah-Hartman
@ 2020-12-28 12:51 ` Greg Kroah-Hartman
  2020-12-28 12:51 ` [PATCH 5.4 439/453] clk: tegra: Do not return 0 on failure Greg Kroah-Hartman
                   ` (18 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:51 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Terry Zhou, Pali Rohár,
	Marek Behún, Stephen Boyd

From: Terry Zhou <bjzhou@marvell.com>

commit 6f37689cf6b38fff96de52e7f0d3e78f22803ba0 upstream.

There is an error in the current code that the XTAL MODE
pin was set to NB MPP1_31 which should be NB MPP1_9.
The latch register of NB MPP1_9 has different offset of 0x8.

Signed-off-by: Terry Zhou <bjzhou@marvell.com>
[pali: Fix pin name in commit message]
Signed-off-by: Pali Rohár <pali@kernel.org>
Fixes: 7ea8250406a6 ("clk: mvebu: Add the xtal clock for Armada 3700 SoC")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20201106100039.11385-1-pali@kernel.org
Reviewed-by: Marek Behún <kabel@kernel.org>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/clk/mvebu/armada-37xx-xtal.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/clk/mvebu/armada-37xx-xtal.c
+++ b/drivers/clk/mvebu/armada-37xx-xtal.c
@@ -13,8 +13,8 @@
 #include <linux/platform_device.h>
 #include <linux/regmap.h>
 
-#define NB_GPIO1_LATCH	0xC
-#define XTAL_MODE	    BIT(31)
+#define NB_GPIO1_LATCH	0x8
+#define XTAL_MODE	    BIT(9)
 
 static int armada_3700_xtal_clock_probe(struct platform_device *pdev)
 {



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 439/453] clk: tegra: Do not return 0 on failure
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (436 preceding siblings ...)
  2020-12-28 12:51 ` [PATCH 5.4 438/453] clk: mvebu: a3700: fix the XTAL MODE pin to MPP1_9 Greg Kroah-Hartman
@ 2020-12-28 12:51 ` Greg Kroah-Hartman
  2020-12-28 12:51 ` [PATCH 5.4 440/453] device-dax/core: Fix memory leak when rmmod dax.ko Greg Kroah-Hartman
                   ` (17 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:51 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Nicolin Chen, Thierry Reding

From: Nicolin Chen <nicoleotsuka@gmail.com>

commit 6160aca443148416994c022a35c77daeba948ea6 upstream.

Return values from read_dt_param() will be either TRUE (1) or
FALSE (0), while dfll_fetch_pwm_params() returns 0 on success
or an ERR code on failure.

So this patch fixes the bug of returning 0 on failure.

Fixes: 36541f0499fe ("clk: tegra: dfll: support PWM regulator control")
Cc: <stable@vger.kernel.org>
Signed-off-by: Nicolin Chen <nicoleotsuka@gmail.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/clk/tegra/clk-dfll.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/clk/tegra/clk-dfll.c
+++ b/drivers/clk/tegra/clk-dfll.c
@@ -1801,13 +1801,13 @@ static int dfll_fetch_pwm_params(struct
 			    &td->reg_init_uV);
 	if (!ret) {
 		dev_err(td->dev, "couldn't get initialized voltage\n");
-		return ret;
+		return -EINVAL;
 	}
 
 	ret = read_dt_param(td, "nvidia,pwm-period-nanoseconds", &pwm_period);
 	if (!ret) {
 		dev_err(td->dev, "couldn't get PWM period\n");
-		return ret;
+		return -EINVAL;
 	}
 	td->pwm_rate = (NSEC_PER_SEC / pwm_period) * (MAX_DFLL_VOLTAGES - 1);
 



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 440/453] device-dax/core: Fix memory leak when rmmod dax.ko
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (437 preceding siblings ...)
  2020-12-28 12:51 ` [PATCH 5.4 439/453] clk: tegra: Do not return 0 on failure Greg Kroah-Hartman
@ 2020-12-28 12:51 ` Greg Kroah-Hartman
  2020-12-28 12:51 ` [PATCH 5.4 441/453] dma-buf/dma-resv: Respect num_fences when initializing the shared fence list Greg Kroah-Hartman
                   ` (16 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:51 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Wang Hai, Dan Williams

From: Wang Hai <wanghai38@huawei.com>

commit 1aa574312518ef1d60d2dc62d58f7021db3b163a upstream.

When I repeatedly modprobe and rmmod dax.ko, kmemleak report a
memory leak as follows:

unreferenced object 0xffff9a5588c05088 (size 8):
  comm "modprobe", pid 261, jiffies 4294693644 (age 42.063s)
...
  backtrace:
    [<00000000e007ced0>] kstrdup+0x35/0x70
    [<000000002ae73897>] kstrdup_const+0x3d/0x50
    [<000000002b00c9c3>] kvasprintf_const+0xbc/0xf0
    [<000000008023282f>] kobject_set_name_vargs+0x3b/0xd0
    [<00000000d2cbaa4e>] kobject_set_name+0x62/0x90
    [<00000000202e7a22>] bus_register+0x7f/0x2b0
    [<000000000b77792c>] 0xffffffffc02840f7
    [<000000002d5be5ac>] 0xffffffffc02840b4
    [<00000000dcafb7cd>] do_one_initcall+0x58/0x240
    [<00000000049fe480>] do_init_module+0x56/0x1e2
    [<0000000022671491>] load_module+0x2517/0x2840
    [<000000001a2201cb>] __do_sys_finit_module+0x9c/0xe0
    [<000000003eb304e7>] do_syscall_64+0x33/0x40
    [<0000000051c5fd06>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

When rmmod dax is executed, dax_bus_exit() is missing. This patch
can fix this bug.

Fixes: 9567da0b408a ("device-dax: Introduce bus + driver model")
Cc: <stable@vger.kernel.org>
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Wang Hai <wanghai38@huawei.com>
Link: https://lore.kernel.org/r/20201201135929.66530-1-wanghai38@huawei.com
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/dax/super.c |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/dax/super.c
+++ b/drivers/dax/super.c
@@ -720,6 +720,7 @@ err_chrdev:
 
 static void __exit dax_core_exit(void)
 {
+	dax_bus_exit();
 	unregister_chrdev_region(dax_devt, MINORMASK+1);
 	ida_destroy(&dax_minor_ida);
 	dax_fs_exit();



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 441/453] dma-buf/dma-resv: Respect num_fences when initializing the shared fence list.
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (438 preceding siblings ...)
  2020-12-28 12:51 ` [PATCH 5.4 440/453] device-dax/core: Fix memory leak when rmmod dax.ko Greg Kroah-Hartman
@ 2020-12-28 12:51 ` Greg Kroah-Hartman
  2020-12-28 12:51 ` [PATCH 5.4 442/453] xen-blkback: set ring->xenblkd to NULL after kthread_stop() Greg Kroah-Hartman
                   ` (15 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:51 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Niranjana Vishwanathapura,
	Maarten Lankhorst, Thomas Hellström

From: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>

commit bf8975837dac156c33a4d15d46602700998cb6dd upstream.

We hardcode the maximum number of shared fences to 4, instead of
respecting num_fences. Use a minimum of 4, but more if num_fences
is higher.

This seems to have been an oversight when first implementing the
api.

Fixes: 04a5faa8cbe5 ("reservation: update api and add some helpers")
Cc: <stable@vger.kernel.org> # v3.17+
Reported-by: Niranjana Vishwanathapura <niranjana.vishwanathapura@intel.com>
Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Reviewed-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20201124115707.406917-1-maarten.lankhorst@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/dma-buf/dma-resv.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/dma-buf/dma-resv.c
+++ b/drivers/dma-buf/dma-resv.c
@@ -161,7 +161,7 @@ int dma_resv_reserve_shared(struct dma_r
 			max = max(old->shared_count + num_fences,
 				  old->shared_max * 2);
 	} else {
-		max = 4;
+		max = max(4ul, roundup_pow_of_two(num_fences));
 	}
 
 	new = dma_resv_list_alloc(max);



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 442/453] xen-blkback: set ring->xenblkd to NULL after kthread_stop()
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (439 preceding siblings ...)
  2020-12-28 12:51 ` [PATCH 5.4 441/453] dma-buf/dma-resv: Respect num_fences when initializing the shared fence list Greg Kroah-Hartman
@ 2020-12-28 12:51 ` Greg Kroah-Hartman
  2020-12-28 12:51 ` [PATCH 5.4 443/453] xen/xenbus: Allow watches discard events before queueing Greg Kroah-Hartman
                   ` (14 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:51 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Olivier Benjamin,
	Pawel Wieczorkiewicz, Julien Grall, Juergen Gross

From: Pawel Wieczorkiewicz <wipawel@amazon.de>

commit 1c728719a4da6e654afb9cc047164755072ed7c9 upstream.

When xen_blkif_disconnect() is called, the kernel thread behind the
block interface is stopped by calling kthread_stop(ring->xenblkd).
The ring->xenblkd thread pointer being non-NULL determines if the
thread has been already stopped.
Normally, the thread's function xen_blkif_schedule() sets the
ring->xenblkd to NULL, when the thread's main loop ends.

However, when the thread has not been started yet (i.e.
wake_up_process() has not been called on it), the xen_blkif_schedule()
function would not be called yet.

In such case the kthread_stop() call returns -EINTR and the
ring->xenblkd remains dangling.
When this happens, any consecutive call to xen_blkif_disconnect (for
example in frontend_changed() callback) leads to a kernel crash in
kthread_stop() (e.g. NULL pointer dereference in exit_creds()).

This is XSA-350.

Cc: <stable@vger.kernel.org> # 4.12
Fixes: a24fa22ce22a ("xen/blkback: don't use xen_blkif_get() in xen-blkback kthread")
Reported-by: Olivier Benjamin <oliben@amazon.com>
Reported-by: Pawel Wieczorkiewicz <wipawel@amazon.de>
Signed-off-by: Pawel Wieczorkiewicz <wipawel@amazon.de>
Reviewed-by: Julien Grall <jgrall@amazon.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/block/xen-blkback/xenbus.c |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/block/xen-blkback/xenbus.c
+++ b/drivers/block/xen-blkback/xenbus.c
@@ -256,6 +256,7 @@ static int xen_blkif_disconnect(struct x
 
 		if (ring->xenblkd) {
 			kthread_stop(ring->xenblkd);
+			ring->xenblkd = NULL;
 			wake_up(&ring->shutdown_wq);
 		}
 



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 443/453] xen/xenbus: Allow watches discard events before queueing
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (440 preceding siblings ...)
  2020-12-28 12:51 ` [PATCH 5.4 442/453] xen-blkback: set ring->xenblkd to NULL after kthread_stop() Greg Kroah-Hartman
@ 2020-12-28 12:51 ` Greg Kroah-Hartman
  2020-12-28 12:51 ` [PATCH 5.4 444/453] xen/xenbus: Add will_handle callback support in xenbus_watch_path() Greg Kroah-Hartman
                   ` (13 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:51 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, SeongJae Park, Michael Kurth,
	Pawel Wieczorkiewicz, Juergen Gross

From: SeongJae Park <sjpark@amazon.de>

commit fed1755b118147721f2c87b37b9d66e62c39b668 upstream.

If handling logics of watch events are slower than the events enqueue
logic and the events can be created from the guests, the guests could
trigger memory pressure by intensively inducing the events, because it
will create a huge number of pending events that exhausting the memory.

Fortunately, some watch events could be ignored, depending on its
handler callback.  For example, if the callback has interest in only one
single path, the watch wouldn't want multiple pending events.  Or, some
watches could ignore events to same path.

To let such watches to volutarily help avoiding the memory pressure
situation, this commit introduces new watch callback, 'will_handle'.  If
it is not NULL, it will be called for each new event just before
enqueuing it.  Then, if the callback returns false, the event will be
discarded.  No watch is using the callback for now, though.

This is part of XSA-349

Cc: stable@vger.kernel.org
Signed-off-by: SeongJae Park <sjpark@amazon.de>
Reported-by: Michael Kurth <mku@amazon.de>
Reported-by: Pawel Wieczorkiewicz <wipawel@amazon.de>
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/xen-netback/xenbus.c   |    4 ++++
 drivers/xen/xenbus/xenbus_client.c |    1 +
 drivers/xen/xenbus/xenbus_xs.c     |    5 ++++-
 include/xen/xenbus.h               |    7 +++++++
 4 files changed, 16 insertions(+), 1 deletion(-)

--- a/drivers/net/xen-netback/xenbus.c
+++ b/drivers/net/xen-netback/xenbus.c
@@ -713,12 +713,14 @@ static int xen_register_credit_watch(str
 		return -ENOMEM;
 	snprintf(node, maxlen, "%s/rate", dev->nodename);
 	vif->credit_watch.node = node;
+	vif->credit_watch.will_handle = NULL;
 	vif->credit_watch.callback = xen_net_rate_changed;
 	err = register_xenbus_watch(&vif->credit_watch);
 	if (err) {
 		pr_err("Failed to set watcher %s\n", vif->credit_watch.node);
 		kfree(node);
 		vif->credit_watch.node = NULL;
+		vif->credit_watch.will_handle = NULL;
 		vif->credit_watch.callback = NULL;
 	}
 	return err;
@@ -765,6 +767,7 @@ static int xen_register_mcast_ctrl_watch
 	snprintf(node, maxlen, "%s/request-multicast-control",
 		 dev->otherend);
 	vif->mcast_ctrl_watch.node = node;
+	vif->mcast_ctrl_watch.will_handle = NULL;
 	vif->mcast_ctrl_watch.callback = xen_mcast_ctrl_changed;
 	err = register_xenbus_watch(&vif->mcast_ctrl_watch);
 	if (err) {
@@ -772,6 +775,7 @@ static int xen_register_mcast_ctrl_watch
 		       vif->mcast_ctrl_watch.node);
 		kfree(node);
 		vif->mcast_ctrl_watch.node = NULL;
+		vif->mcast_ctrl_watch.will_handle = NULL;
 		vif->mcast_ctrl_watch.callback = NULL;
 	}
 	return err;
--- a/drivers/xen/xenbus/xenbus_client.c
+++ b/drivers/xen/xenbus/xenbus_client.c
@@ -120,6 +120,7 @@ int xenbus_watch_path(struct xenbus_devi
 	int err;
 
 	watch->node = path;
+	watch->will_handle = NULL;
 	watch->callback = callback;
 
 	err = register_xenbus_watch(watch);
--- a/drivers/xen/xenbus/xenbus_xs.c
+++ b/drivers/xen/xenbus/xenbus_xs.c
@@ -705,7 +705,10 @@ int xs_watch_msg(struct xs_watch_event *
 
 	spin_lock(&watches_lock);
 	event->handle = find_watch(event->token);
-	if (event->handle != NULL) {
+	if (event->handle != NULL &&
+			(!event->handle->will_handle ||
+			 event->handle->will_handle(event->handle,
+				 event->path, event->token))) {
 		spin_lock(&watch_events_lock);
 		list_add_tail(&event->list, &watch_events);
 		wake_up(&watch_events_waitq);
--- a/include/xen/xenbus.h
+++ b/include/xen/xenbus.h
@@ -59,6 +59,13 @@ struct xenbus_watch
 	/* Path being watched. */
 	const char *node;
 
+	/*
+	 * Called just before enqueing new event while a spinlock is held.
+	 * The event will be discarded if this callback returns false.
+	 */
+	bool (*will_handle)(struct xenbus_watch *,
+			      const char *path, const char *token);
+
 	/* Callback (executed in a process context with no locks held). */
 	void (*callback)(struct xenbus_watch *,
 			 const char *path, const char *token);



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 444/453] xen/xenbus: Add will_handle callback support in xenbus_watch_path()
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (441 preceding siblings ...)
  2020-12-28 12:51 ` [PATCH 5.4 443/453] xen/xenbus: Allow watches discard events before queueing Greg Kroah-Hartman
@ 2020-12-28 12:51 ` Greg Kroah-Hartman
  2020-12-28 12:51 ` [PATCH 5.4 445/453] xen/xenbus/xen_bus_type: Support will_handle watch callback Greg Kroah-Hartman
                   ` (12 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:51 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, SeongJae Park, Michael Kurth,
	Pawel Wieczorkiewicz, Juergen Gross

From: SeongJae Park <sjpark@amazon.de>

commit 2e85d32b1c865bec703ce0c962221a5e955c52c2 upstream.

Some code does not directly make 'xenbus_watch' object and call
'register_xenbus_watch()' but use 'xenbus_watch_path()' instead.  This
commit adds support of 'will_handle' callback in the
'xenbus_watch_path()' and it's wrapper, 'xenbus_watch_pathfmt()'.

This is part of XSA-349

Cc: stable@vger.kernel.org
Signed-off-by: SeongJae Park <sjpark@amazon.de>
Reported-by: Michael Kurth <mku@amazon.de>
Reported-by: Pawel Wieczorkiewicz <wipawel@amazon.de>
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/block/xen-blkback/xenbus.c |    3 ++-
 drivers/net/xen-netback/xenbus.c   |    2 +-
 drivers/xen/xen-pciback/xenbus.c   |    2 +-
 drivers/xen/xenbus/xenbus_client.c |    9 +++++++--
 drivers/xen/xenbus/xenbus_probe.c  |    2 +-
 include/xen/xenbus.h               |    6 +++++-
 6 files changed, 17 insertions(+), 7 deletions(-)

--- a/drivers/block/xen-blkback/xenbus.c
+++ b/drivers/block/xen-blkback/xenbus.c
@@ -644,7 +644,8 @@ static int xen_blkbk_probe(struct xenbus
 	/* setup back pointer */
 	be->blkif->be = be;
 
-	err = xenbus_watch_pathfmt(dev, &be->backend_watch, backend_changed,
+	err = xenbus_watch_pathfmt(dev, &be->backend_watch, NULL,
+				   backend_changed,
 				   "%s/%s", dev->nodename, "physical-device");
 	if (err)
 		goto fail;
--- a/drivers/net/xen-netback/xenbus.c
+++ b/drivers/net/xen-netback/xenbus.c
@@ -979,7 +979,7 @@ static void connect(struct backend_info
 	xenvif_carrier_on(be->vif);
 
 	unregister_hotplug_status_watch(be);
-	err = xenbus_watch_pathfmt(dev, &be->hotplug_status_watch,
+	err = xenbus_watch_pathfmt(dev, &be->hotplug_status_watch, NULL,
 				   hotplug_status_changed,
 				   "%s/%s", dev->nodename, "hotplug-status");
 	if (!err)
--- a/drivers/xen/xen-pciback/xenbus.c
+++ b/drivers/xen/xen-pciback/xenbus.c
@@ -688,7 +688,7 @@ static int xen_pcibk_xenbus_probe(struct
 
 	/* watch the backend node for backend configuration information */
 	err = xenbus_watch_path(dev, dev->nodename, &pdev->be_watch,
-				xen_pcibk_be_watch);
+				NULL, xen_pcibk_be_watch);
 	if (err)
 		goto out;
 
--- a/drivers/xen/xenbus/xenbus_client.c
+++ b/drivers/xen/xenbus/xenbus_client.c
@@ -114,19 +114,22 @@ EXPORT_SYMBOL_GPL(xenbus_strstate);
  */
 int xenbus_watch_path(struct xenbus_device *dev, const char *path,
 		      struct xenbus_watch *watch,
+		      bool (*will_handle)(struct xenbus_watch *,
+					  const char *, const char *),
 		      void (*callback)(struct xenbus_watch *,
 				       const char *, const char *))
 {
 	int err;
 
 	watch->node = path;
-	watch->will_handle = NULL;
+	watch->will_handle = will_handle;
 	watch->callback = callback;
 
 	err = register_xenbus_watch(watch);
 
 	if (err) {
 		watch->node = NULL;
+		watch->will_handle = NULL;
 		watch->callback = NULL;
 		xenbus_dev_fatal(dev, err, "adding watch on %s", path);
 	}
@@ -153,6 +156,8 @@ EXPORT_SYMBOL_GPL(xenbus_watch_path);
  */
 int xenbus_watch_pathfmt(struct xenbus_device *dev,
 			 struct xenbus_watch *watch,
+			 bool (*will_handle)(struct xenbus_watch *,
+					const char *, const char *),
 			 void (*callback)(struct xenbus_watch *,
 					  const char *, const char *),
 			 const char *pathfmt, ...)
@@ -169,7 +174,7 @@ int xenbus_watch_pathfmt(struct xenbus_d
 		xenbus_dev_fatal(dev, -ENOMEM, "allocating path for watch");
 		return -ENOMEM;
 	}
-	err = xenbus_watch_path(dev, path, watch, callback);
+	err = xenbus_watch_path(dev, path, watch, will_handle, callback);
 
 	if (err)
 		kfree(path);
--- a/drivers/xen/xenbus/xenbus_probe.c
+++ b/drivers/xen/xenbus/xenbus_probe.c
@@ -136,7 +136,7 @@ static int watch_otherend(struct xenbus_
 		container_of(dev->dev.bus, struct xen_bus_type, bus);
 
 	return xenbus_watch_pathfmt(dev, &dev->otherend_watch,
-				    bus->otherend_changed,
+				    NULL, bus->otherend_changed,
 				    "%s/%s", dev->otherend, "state");
 }
 
--- a/include/xen/xenbus.h
+++ b/include/xen/xenbus.h
@@ -199,10 +199,14 @@ void xenbus_probe(struct work_struct *);
 
 int xenbus_watch_path(struct xenbus_device *dev, const char *path,
 		      struct xenbus_watch *watch,
+		      bool (*will_handle)(struct xenbus_watch *,
+					  const char *, const char *),
 		      void (*callback)(struct xenbus_watch *,
 				       const char *, const char *));
-__printf(4, 5)
+__printf(5, 6)
 int xenbus_watch_pathfmt(struct xenbus_device *dev, struct xenbus_watch *watch,
+			 bool (*will_handle)(struct xenbus_watch *,
+					     const char *, const char *),
 			 void (*callback)(struct xenbus_watch *,
 					  const char *, const char *),
 			 const char *pathfmt, ...);



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 445/453] xen/xenbus/xen_bus_type: Support will_handle watch callback
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (442 preceding siblings ...)
  2020-12-28 12:51 ` [PATCH 5.4 444/453] xen/xenbus: Add will_handle callback support in xenbus_watch_path() Greg Kroah-Hartman
@ 2020-12-28 12:51 ` Greg Kroah-Hartman
  2020-12-28 12:51 ` [PATCH 5.4 446/453] xen/xenbus: Count pending messages for each watch Greg Kroah-Hartman
                   ` (11 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:51 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, SeongJae Park, Michael Kurth,
	Pawel Wieczorkiewicz, Juergen Gross

From: SeongJae Park <sjpark@amazon.de>

commit be987200fbaceaef340872841d4f7af2c5ee8dc3 upstream.

This commit adds support of the 'will_handle' watch callback for
'xen_bus_type' users.

This is part of XSA-349

Cc: stable@vger.kernel.org
Signed-off-by: SeongJae Park <sjpark@amazon.de>
Reported-by: Michael Kurth <mku@amazon.de>
Reported-by: Pawel Wieczorkiewicz <wipawel@amazon.de>
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/xen/xenbus/xenbus.h       |    2 ++
 drivers/xen/xenbus/xenbus_probe.c |    3 ++-
 2 files changed, 4 insertions(+), 1 deletion(-)

--- a/drivers/xen/xenbus/xenbus.h
+++ b/drivers/xen/xenbus/xenbus.h
@@ -44,6 +44,8 @@ struct xen_bus_type {
 	int (*get_bus_id)(char bus_id[XEN_BUS_ID_SIZE], const char *nodename);
 	int (*probe)(struct xen_bus_type *bus, const char *type,
 		     const char *dir);
+	bool (*otherend_will_handle)(struct xenbus_watch *watch,
+				     const char *path, const char *token);
 	void (*otherend_changed)(struct xenbus_watch *watch, const char *path,
 				 const char *token);
 	struct bus_type bus;
--- a/drivers/xen/xenbus/xenbus_probe.c
+++ b/drivers/xen/xenbus/xenbus_probe.c
@@ -136,7 +136,8 @@ static int watch_otherend(struct xenbus_
 		container_of(dev->dev.bus, struct xen_bus_type, bus);
 
 	return xenbus_watch_pathfmt(dev, &dev->otherend_watch,
-				    NULL, bus->otherend_changed,
+				    bus->otherend_will_handle,
+				    bus->otherend_changed,
 				    "%s/%s", dev->otherend, "state");
 }
 



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 446/453] xen/xenbus: Count pending messages for each watch
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (443 preceding siblings ...)
  2020-12-28 12:51 ` [PATCH 5.4 445/453] xen/xenbus/xen_bus_type: Support will_handle watch callback Greg Kroah-Hartman
@ 2020-12-28 12:51 ` Greg Kroah-Hartman
  2020-12-28 12:51 ` [PATCH 5.4 447/453] xenbus/xenbus_backend: Disallow pending watch messages Greg Kroah-Hartman
                   ` (10 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:51 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, SeongJae Park, Michael Kurth,
	Pawel Wieczorkiewicz, Juergen Gross

From: SeongJae Park <sjpark@amazon.de>

commit 3dc86ca6b4c8cfcba9da7996189d1b5a358a94fc upstream.

This commit adds a counter of pending messages for each watch in the
struct.  It is used to skip unnecessary pending messages lookup in
'unregister_xenbus_watch()'.  It could also be used in 'will_handle'
callback.

This is part of XSA-349

Cc: stable@vger.kernel.org
Signed-off-by: SeongJae Park <sjpark@amazon.de>
Reported-by: Michael Kurth <mku@amazon.de>
Reported-by: Pawel Wieczorkiewicz <wipawel@amazon.de>
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/xen/xenbus/xenbus_xs.c |   29 ++++++++++++++++++-----------
 include/xen/xenbus.h           |    2 ++
 2 files changed, 20 insertions(+), 11 deletions(-)

--- a/drivers/xen/xenbus/xenbus_xs.c
+++ b/drivers/xen/xenbus/xenbus_xs.c
@@ -711,6 +711,7 @@ int xs_watch_msg(struct xs_watch_event *
 				 event->path, event->token))) {
 		spin_lock(&watch_events_lock);
 		list_add_tail(&event->list, &watch_events);
+		event->handle->nr_pending++;
 		wake_up(&watch_events_waitq);
 		spin_unlock(&watch_events_lock);
 	} else
@@ -768,6 +769,8 @@ int register_xenbus_watch(struct xenbus_
 
 	sprintf(token, "%lX", (long)watch);
 
+	watch->nr_pending = 0;
+
 	down_read(&xs_watch_rwsem);
 
 	spin_lock(&watches_lock);
@@ -817,11 +820,14 @@ void unregister_xenbus_watch(struct xenb
 
 	/* Cancel pending watch events. */
 	spin_lock(&watch_events_lock);
-	list_for_each_entry_safe(event, tmp, &watch_events, list) {
-		if (event->handle != watch)
-			continue;
-		list_del(&event->list);
-		kfree(event);
+	if (watch->nr_pending) {
+		list_for_each_entry_safe(event, tmp, &watch_events, list) {
+			if (event->handle != watch)
+				continue;
+			list_del(&event->list);
+			kfree(event);
+		}
+		watch->nr_pending = 0;
 	}
 	spin_unlock(&watch_events_lock);
 
@@ -868,7 +874,6 @@ void xs_suspend_cancel(void)
 
 static int xenwatch_thread(void *unused)
 {
-	struct list_head *ent;
 	struct xs_watch_event *event;
 
 	xenwatch_pid = current->pid;
@@ -883,13 +888,15 @@ static int xenwatch_thread(void *unused)
 		mutex_lock(&xenwatch_mutex);
 
 		spin_lock(&watch_events_lock);
-		ent = watch_events.next;
-		if (ent != &watch_events)
-			list_del(ent);
+		event = list_first_entry_or_null(&watch_events,
+				struct xs_watch_event, list);
+		if (event) {
+			list_del(&event->list);
+			event->handle->nr_pending--;
+		}
 		spin_unlock(&watch_events_lock);
 
-		if (ent != &watch_events) {
-			event = list_entry(ent, struct xs_watch_event, list);
+		if (event) {
 			event->handle->callback(event->handle, event->path,
 						event->token);
 			kfree(event);
--- a/include/xen/xenbus.h
+++ b/include/xen/xenbus.h
@@ -59,6 +59,8 @@ struct xenbus_watch
 	/* Path being watched. */
 	const char *node;
 
+	unsigned int nr_pending;
+
 	/*
 	 * Called just before enqueing new event while a spinlock is held.
 	 * The event will be discarded if this callback returns false.



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 447/453] xenbus/xenbus_backend: Disallow pending watch messages
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (444 preceding siblings ...)
  2020-12-28 12:51 ` [PATCH 5.4 446/453] xen/xenbus: Count pending messages for each watch Greg Kroah-Hartman
@ 2020-12-28 12:51 ` Greg Kroah-Hartman
  2020-12-28 12:51 ` [PATCH 5.4 448/453] libnvdimm/namespace: Fix reaping of invalidated block-window-namespace labels Greg Kroah-Hartman
                   ` (9 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:51 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, SeongJae Park, Michael Kurth,
	Pawel Wieczorkiewicz, Juergen Gross

From: SeongJae Park <sjpark@amazon.de>

commit 9996bd494794a2fe393e97e7a982388c6249aa76 upstream.

'xenbus_backend' watches 'state' of devices, which is writable by
guests.  Hence, if guests intensively updates it, dom0 will have lots of
pending events that exhausting memory of dom0.  In other words, guests
can trigger dom0 memory pressure.  This is known as XSA-349.  However,
the watch callback of it, 'frontend_changed()', reads only 'state', so
doesn't need to have the pending events.

To avoid the problem, this commit disallows pending watch messages for
'xenbus_backend' using the 'will_handle()' watch callback.

This is part of XSA-349

Cc: stable@vger.kernel.org
Signed-off-by: SeongJae Park <sjpark@amazon.de>
Reported-by: Michael Kurth <mku@amazon.de>
Reported-by: Pawel Wieczorkiewicz <wipawel@amazon.de>
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/xen/xenbus/xenbus_probe_backend.c |    7 +++++++
 1 file changed, 7 insertions(+)

--- a/drivers/xen/xenbus/xenbus_probe_backend.c
+++ b/drivers/xen/xenbus/xenbus_probe_backend.c
@@ -180,6 +180,12 @@ static int xenbus_probe_backend(struct x
 	return err;
 }
 
+static bool frontend_will_handle(struct xenbus_watch *watch,
+				 const char *path, const char *token)
+{
+	return watch->nr_pending == 0;
+}
+
 static void frontend_changed(struct xenbus_watch *watch,
 			     const char *path, const char *token)
 {
@@ -191,6 +197,7 @@ static struct xen_bus_type xenbus_backen
 	.levels = 3,		/* backend/type/<frontend>/<id> */
 	.get_bus_id = backend_bus_id,
 	.probe = xenbus_probe_backend,
+	.otherend_will_handle = frontend_will_handle,
 	.otherend_changed = frontend_changed,
 	.bus = {
 		.name		= "xen-backend",



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 448/453] libnvdimm/namespace: Fix reaping of invalidated block-window-namespace labels
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (445 preceding siblings ...)
  2020-12-28 12:51 ` [PATCH 5.4 447/453] xenbus/xenbus_backend: Disallow pending watch messages Greg Kroah-Hartman
@ 2020-12-28 12:51 ` Greg Kroah-Hartman
  2020-12-28 12:51 ` [PATCH 5.4 449/453] platform/x86: intel-vbtn: Allow switch events on Acer Switch Alpha 12 Greg Kroah-Hartman
                   ` (8 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:51 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Vishal Verma, Dave Jiang, Ira Weiny,
	Dan Williams

From: Dan Williams <dan.j.williams@intel.com>

commit 2dd2a1740ee19cd2636d247276cf27bfa434b0e2 upstream.

A recent change to ndctl to attempt to reconfigure namespaces in place
uncovered a label accounting problem in block-window-type namespaces.
The ndctl "create.sh" test is able to trigger this signature:

 WARNING: CPU: 34 PID: 9167 at drivers/nvdimm/label.c:1100 __blk_label_update+0x9a3/0xbc0 [libnvdimm]
 [..]
 RIP: 0010:__blk_label_update+0x9a3/0xbc0 [libnvdimm]
 [..]
 Call Trace:
  uuid_store+0x21b/0x2f0 [libnvdimm]
  kernfs_fop_write+0xcf/0x1c0
  vfs_write+0xcc/0x380
  ksys_write+0x68/0xe0

When allocated capacity for a namespace is renamed (new UUID) the labels
with the old UUID need to be deleted. The ndctl behavior to always
destroy namespaces on reconfiguration hid this problem.

The immediate impact of this bug is limited since block-window-type
namespaces only seem to exist in the specification and not in any
shipping products. However, the label handling code is being reused for
other technologies like CXL region labels, so there is a benefit to
making sure both vertical labels sets (block-window) and horizontal
label sets (pmem) have a functional reference implementation in
libnvdimm.

Fixes: c4703ce11c23 ("libnvdimm/namespace: Fix label tracking error")
Cc: <stable@vger.kernel.org>
Cc: Vishal Verma <vishal.l.verma@intel.com>
Cc: Dave Jiang <dave.jiang@intel.com>
Cc: Ira Weiny <ira.weiny@intel.com>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/nvdimm/label.c |    9 +++++++++
 1 file changed, 9 insertions(+)

--- a/drivers/nvdimm/label.c
+++ b/drivers/nvdimm/label.c
@@ -980,6 +980,15 @@ static int __blk_label_update(struct nd_
 		}
 	}
 
+	/* release slots associated with any invalidated UUIDs */
+	mutex_lock(&nd_mapping->lock);
+	list_for_each_entry_safe(label_ent, e, &nd_mapping->labels, list)
+		if (test_and_clear_bit(ND_LABEL_REAP, &label_ent->flags)) {
+			reap_victim(nd_mapping, label_ent);
+			list_move(&label_ent->list, &list);
+		}
+	mutex_unlock(&nd_mapping->lock);
+
 	/*
 	 * Find the resource associated with the first label in the set
 	 * per the v1.2 namespace specification.



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 449/453] platform/x86: intel-vbtn: Allow switch events on Acer Switch Alpha 12
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (446 preceding siblings ...)
  2020-12-28 12:51 ` [PATCH 5.4 448/453] libnvdimm/namespace: Fix reaping of invalidated block-window-namespace labels Greg Kroah-Hartman
@ 2020-12-28 12:51 ` Greg Kroah-Hartman
  2020-12-28 12:51 ` [PATCH 5.4 450/453] PCI: Fix pci_slot_release() NULL pointer dereference Greg Kroah-Hartman
                   ` (7 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:51 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Carlos Garnacho, Hans de Goede

From: Carlos Garnacho <carlosg@gnome.org>

commit fe6000990394639ed374cb76c313be3640714f47 upstream.

This 2-in-1 model (Product name: Switch SA5-271) features a SW_TABLET_MODE
that works as it would be expected, both when detaching the keyboard and
when folding it behind the tablet body.

It used to work until the introduction of the allow list at
commit 8169bd3e6e193 ("platform/x86: intel-vbtn: Switch to an allow-list
for SW_TABLET_MODE reporting"). Add this model to it, so that the Virtual
Buttons device announces the EV_SW features again.

Fixes: 8169bd3e6e193 ("platform/x86: intel-vbtn: Switch to an allow-list for SW_TABLET_MODE reporting")
Cc: stable@vger.kernel.org
Signed-off-by: Carlos Garnacho <carlosg@gnome.org>
Link: https://lore.kernel.org/r/20201201135727.212917-1-carlosg@gnome.org
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/platform/x86/intel-vbtn.c |    6 ++++++
 1 file changed, 6 insertions(+)

--- a/drivers/platform/x86/intel-vbtn.c
+++ b/drivers/platform/x86/intel-vbtn.c
@@ -203,6 +203,12 @@ static const struct dmi_system_id dmi_sw
 			DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion 13 x360 PC"),
 		},
 	},
+	{
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "Switch SA5-271"),
+		},
+	},
 	{} /* Array terminator */
 };
 



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 450/453] PCI: Fix pci_slot_release() NULL pointer dereference
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (447 preceding siblings ...)
  2020-12-28 12:51 ` [PATCH 5.4 449/453] platform/x86: intel-vbtn: Allow switch events on Acer Switch Alpha 12 Greg Kroah-Hartman
@ 2020-12-28 12:51 ` Greg Kroah-Hartman
  2020-12-28 12:51 ` [PATCH 5.4 451/453] regulator: axp20x: Fix DLDO2 voltage control register mask for AXP22x Greg Kroah-Hartman
                   ` (6 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:51 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jubin Zhong, Bjorn Helgaas

From: Jubin Zhong <zhongjubin@huawei.com>

commit 4684709bf81a2d98152ed6b610e3d5c403f9bced upstream.

If kobject_init_and_add() fails, pci_slot_release() is called to delete
slot->list from parent->slots.  But slot->list hasn't been initialized
yet, so we dereference a NULL pointer:

  Unable to handle kernel NULL pointer dereference at virtual address
00000000
  ...
  CPU: 10 PID: 1 Comm: swapper/0 Not tainted 4.4.240 #197
  task: ffffeb398a45ef10 task.stack: ffffeb398a470000
  PC is at __list_del_entry_valid+0x5c/0xb0
  LR is at pci_slot_release+0x84/0xe4
  ...
  __list_del_entry_valid+0x5c/0xb0
  pci_slot_release+0x84/0xe4
  kobject_put+0x184/0x1c4
  pci_create_slot+0x17c/0x1b4
  __pci_hp_initialize+0x68/0xa4
  pciehp_probe+0x1a4/0x2fc
  pcie_port_probe_service+0x58/0x84
  driver_probe_device+0x320/0x470

Initialize slot->list before calling kobject_init_and_add() to avoid this.

Fixes: 8a94644b440e ("PCI: Fix pci_create_slot() reference count leak")
Link: https://lore.kernel.org/r/1606876422-117457-1-git-send-email-zhongjubin@huawei.com
Signed-off-by: Jubin Zhong <zhongjubin@huawei.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Cc: stable@vger.kernel.org	# v5.9+
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/pci/slot.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- a/drivers/pci/slot.c
+++ b/drivers/pci/slot.c
@@ -308,6 +308,9 @@ placeholder:
 		goto err;
 	}
 
+	INIT_LIST_HEAD(&slot->list);
+	list_add(&slot->list, &parent->slots);
+
 	err = kobject_init_and_add(&slot->kobj, &pci_slot_ktype, NULL,
 				   "%s", slot_name);
 	if (err) {
@@ -315,9 +318,6 @@ placeholder:
 		goto err;
 	}
 
-	INIT_LIST_HEAD(&slot->list);
-	list_add(&slot->list, &parent->slots);
-
 	down_read(&pci_bus_sem);
 	list_for_each_entry(dev, &parent->devices, bus_list)
 		if (PCI_SLOT(dev->devfn) == slot_nr)



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 451/453] regulator: axp20x: Fix DLDO2 voltage control register mask for AXP22x
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (448 preceding siblings ...)
  2020-12-28 12:51 ` [PATCH 5.4 450/453] PCI: Fix pci_slot_release() NULL pointer dereference Greg Kroah-Hartman
@ 2020-12-28 12:51 ` Greg Kroah-Hartman
  2020-12-28 12:51 ` [PATCH 5.4 452/453] rtc: ep93xx: Fix NULL pointer dereference in ep93xx_rtc_read_time Greg Kroah-Hartman
                   ` (5 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:51 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, DingHua Ma, Chen-Yu Tsai, Mark Brown

From: DingHua Ma <dinghua.ma.sz@gmail.com>

commit 291de1d102fafef0798cdad9666cd4f8da7da7cc upstream.

When I use the axp20x chip to power my SDIO device on the 5.4 kernel,
the output voltage of DLDO2 is wrong. After comparing the register
manual and source code of the chip, I found that the mask bit of the
driver register of the port was wrong. I fixed this error by modifying
the mask register of the source code. This error seems to be a copy
error of the macro when writing the code. Now the voltage output of
the DLDO2 port of axp20x is correct. My development environment is
Allwinner A40I of arm architecture, and the kernel version is 5.4.

Signed-off-by: DingHua Ma <dinghua.ma.sz@gmail.com>
Reviewed-by: Chen-Yu Tsai <wens@csie.org>
Cc: <stable@vger.kernel.org>
Fixes: db4a555f7c4c ("regulator: axp20x: use defines for masks")
Link: https://lore.kernel.org/r/20201201001000.22302-1-dinghua.ma.sz@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/regulator/axp20x-regulator.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/regulator/axp20x-regulator.c
+++ b/drivers/regulator/axp20x-regulator.c
@@ -596,7 +596,7 @@ static const struct regulator_desc axp22
 		 AXP22X_DLDO1_V_OUT, AXP22X_DLDO1_V_OUT_MASK,
 		 AXP22X_PWR_OUT_CTRL2, AXP22X_PWR_OUT_DLDO1_MASK),
 	AXP_DESC(AXP22X, DLDO2, "dldo2", "dldoin", 700, 3300, 100,
-		 AXP22X_DLDO2_V_OUT, AXP22X_PWR_OUT_DLDO2_MASK,
+		 AXP22X_DLDO2_V_OUT, AXP22X_DLDO2_V_OUT_MASK,
 		 AXP22X_PWR_OUT_CTRL2, AXP22X_PWR_OUT_DLDO2_MASK),
 	AXP_DESC(AXP22X, DLDO3, "dldo3", "dldoin", 700, 3300, 100,
 		 AXP22X_DLDO3_V_OUT, AXP22X_DLDO3_V_OUT_MASK,



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 452/453] rtc: ep93xx: Fix NULL pointer dereference in ep93xx_rtc_read_time
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (449 preceding siblings ...)
  2020-12-28 12:51 ` [PATCH 5.4 451/453] regulator: axp20x: Fix DLDO2 voltage control register mask for AXP22x Greg Kroah-Hartman
@ 2020-12-28 12:51 ` Greg Kroah-Hartman
  2020-12-28 12:51 ` [PATCH 5.4 453/453] Revert: "ring-buffer: Remove HAVE_64BIT_ALIGNED_ACCESS" Greg Kroah-Hartman
                   ` (4 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:51 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Nikita Shubin, Alexandre Belloni

From: Nikita Shubin <nikita.shubin@maquefel.me>

commit 00c33482bb6110bce8110daa351f9b3baf4df7dc upstream.

Mismatch in probe platform_set_drvdata set's and method's that call
dev_get_platdata will result in "Unable to handle kernel NULL pointer
dereference", let's use according method for getting driver data after
platform_set_drvdata.

8<--- cut here ---
Unable to handle kernel NULL pointer dereference at virtual address 00000000
pgd = (ptrval)
[00000000] *pgd=00000000
Internal error: Oops: 5 [#1] ARM
Modules linked in:
CPU: 0 PID: 1 Comm: swapper Not tainted 5.9.10-00003-g723e101e0037-dirty #4
Hardware name: Technologic Systems TS-72xx SBC
PC is at ep93xx_rtc_read_time+0xc/0x2c
LR is at __rtc_read_time+0x4c/0x8c
[...]
[<c02b01c8>] (ep93xx_rtc_read_time) from [<c02ac38c>] (__rtc_read_time+0x4c/0x8c)
[<c02ac38c>] (__rtc_read_time) from [<c02ac3f8>] (rtc_read_time+0x2c/0x4c)
[<c02ac3f8>] (rtc_read_time) from [<c02acc54>] (__rtc_read_alarm+0x28/0x358)
[<c02acc54>] (__rtc_read_alarm) from [<c02abd80>] (__rtc_register_device+0x124/0x2ec)
[<c02abd80>] (__rtc_register_device) from [<c02b028c>] (ep93xx_rtc_probe+0xa4/0xac)
[<c02b028c>] (ep93xx_rtc_probe) from [<c026424c>] (platform_drv_probe+0x24/0x5c)
[<c026424c>] (platform_drv_probe) from [<c0262918>] (really_probe+0x218/0x374)
[<c0262918>] (really_probe) from [<c0262da0>] (device_driver_attach+0x44/0x60)
[<c0262da0>] (device_driver_attach) from [<c0262e70>] (__driver_attach+0xb4/0xc0)
[<c0262e70>] (__driver_attach) from [<c0260d44>] (bus_for_each_dev+0x68/0xac)
[<c0260d44>] (bus_for_each_dev) from [<c026223c>] (driver_attach+0x18/0x24)
[<c026223c>] (driver_attach) from [<c0261dd8>] (bus_add_driver+0x150/0x1b4)
[<c0261dd8>] (bus_add_driver) from [<c026342c>] (driver_register+0xb0/0xf4)
[<c026342c>] (driver_register) from [<c0264210>] (__platform_driver_register+0x30/0x48)
[<c0264210>] (__platform_driver_register) from [<c04cb9ac>] (ep93xx_rtc_driver_init+0x10/0x1c)
[<c04cb9ac>] (ep93xx_rtc_driver_init) from [<c000973c>] (do_one_initcall+0x7c/0x1c0)
[<c000973c>] (do_one_initcall) from [<c04b9ecc>] (kernel_init_freeable+0x168/0x1ac)
[<c04b9ecc>] (kernel_init_freeable) from [<c03b2228>] (kernel_init+0x8/0xf4)
[<c03b2228>] (kernel_init) from [<c00082c0>] (ret_from_fork+0x14/0x34)
Exception stack(0xc441dfb0 to 0xc441dff8)
dfa0:                                     00000000 00000000 00000000 00000000
dfc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
dfe0: 00000000 00000000 00000000 00000000 00000013 00000000
Code: e12fff1e e92d4010 e590303c e1a02001 (e5933000)
---[ end trace c914d6030eaa95c8 ]---

Fixes: b809d192eb98 ("rtc: ep93xx: stop setting platform_data")
Signed-off-by: Nikita Shubin <nikita.shubin@maquefel.me>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20201201095507.10317-1-nikita.shubin@maquefel.me
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/rtc/rtc-ep93xx.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- a/drivers/rtc/rtc-ep93xx.c
+++ b/drivers/rtc/rtc-ep93xx.c
@@ -33,7 +33,7 @@ struct ep93xx_rtc {
 static int ep93xx_rtc_get_swcomp(struct device *dev, unsigned short *preload,
 				 unsigned short *delete)
 {
-	struct ep93xx_rtc *ep93xx_rtc = dev_get_platdata(dev);
+	struct ep93xx_rtc *ep93xx_rtc = dev_get_drvdata(dev);
 	unsigned long comp;
 
 	comp = readl(ep93xx_rtc->mmio_base + EP93XX_RTC_SWCOMP);
@@ -51,7 +51,7 @@ static int ep93xx_rtc_get_swcomp(struct
 
 static int ep93xx_rtc_read_time(struct device *dev, struct rtc_time *tm)
 {
-	struct ep93xx_rtc *ep93xx_rtc = dev_get_platdata(dev);
+	struct ep93xx_rtc *ep93xx_rtc = dev_get_drvdata(dev);
 	unsigned long time;
 
 	time = readl(ep93xx_rtc->mmio_base + EP93XX_RTC_DATA);
@@ -62,7 +62,7 @@ static int ep93xx_rtc_read_time(struct d
 
 static int ep93xx_rtc_set_time(struct device *dev, struct rtc_time *tm)
 {
-	struct ep93xx_rtc *ep93xx_rtc = dev_get_platdata(dev);
+	struct ep93xx_rtc *ep93xx_rtc = dev_get_drvdata(dev);
 	unsigned long secs = rtc_tm_to_time64(tm);
 
 	writel(secs + 1, ep93xx_rtc->mmio_base + EP93XX_RTC_LOAD);



^ permalink raw reply	[flat|nested] 469+ messages in thread

* [PATCH 5.4 453/453] Revert: "ring-buffer: Remove HAVE_64BIT_ALIGNED_ACCESS"
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (450 preceding siblings ...)
  2020-12-28 12:51 ` [PATCH 5.4 452/453] rtc: ep93xx: Fix NULL pointer dereference in ep93xx_rtc_read_time Greg Kroah-Hartman
@ 2020-12-28 12:51 ` Greg Kroah-Hartman
  2020-12-28 16:57 ` [PATCH 5.4 000/453] 5.4.86-rc1 review Naresh Kamboju
                   ` (3 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:51 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Anatoly Pugachev, Steven Rostedt (VMware)

From: Steven Rostedt (VMware) <rostedt@goodmis.org>

commit adab66b71abfe206a020f11e561f4df41f0b2aba upstream.

It was believed that metag was the only architecture that required the ring
buffer to keep 8 byte words aligned on 8 byte architectures, and with its
removal, it was assumed that the ring buffer code did not need to handle
this case. It appears that sparc64 also requires this.

The following was reported on a sparc64 boot up:

   kernel: futex hash table entries: 65536 (order: 9, 4194304 bytes, linear)
   kernel: Running postponed tracer tests:
   kernel: Testing tracer function:
   kernel: Kernel unaligned access at TPC[552a20] trace_function+0x40/0x140
   kernel: Kernel unaligned access at TPC[552a24] trace_function+0x44/0x140
   kernel: Kernel unaligned access at TPC[552a20] trace_function+0x40/0x140
   kernel: Kernel unaligned access at TPC[552a24] trace_function+0x44/0x140
   kernel: Kernel unaligned access at TPC[552a20] trace_function+0x40/0x140
   kernel: PASSED

Need to put back the 64BIT aligned code for the ring buffer.

Link: https://lore.kernel.org/r/CADxRZqzXQRYgKc=y-KV=S_yHL+Y8Ay2mh5ezeZUnpRvg+syWKw@mail.gmail.com

Cc: stable@vger.kernel.org
Fixes: 86b3de60a0b6 ("ring-buffer: Remove HAVE_64BIT_ALIGNED_ACCESS")
Reported-by: Anatoly Pugachev <matorola@gmail.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/Kconfig               |   16 ++++++++++++++++
 kernel/trace/ring_buffer.c |   17 +++++++++++++----
 2 files changed, 29 insertions(+), 4 deletions(-)

--- a/arch/Kconfig
+++ b/arch/Kconfig
@@ -131,6 +131,22 @@ config UPROBES
 	    managed by the kernel and kept transparent to the probed
 	    application. )
 
+config HAVE_64BIT_ALIGNED_ACCESS
+	def_bool 64BIT && !HAVE_EFFICIENT_UNALIGNED_ACCESS
+	help
+	  Some architectures require 64 bit accesses to be 64 bit
+	  aligned, which also requires structs containing 64 bit values
+	  to be 64 bit aligned too. This includes some 32 bit
+	  architectures which can do 64 bit accesses, as well as 64 bit
+	  architectures without unaligned access.
+
+	  This symbol should be selected by an architecture if 64 bit
+	  accesses are required to be 64 bit aligned in this way even
+	  though it is not a 64 bit architecture.
+
+	  See Documentation/unaligned-memory-access.txt for more
+	  information on the topic of unaligned memory accesses.
+
 config HAVE_EFFICIENT_UNALIGNED_ACCESS
 	bool
 	help
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -129,7 +129,16 @@ int ring_buffer_print_entry_header(struc
 #define RB_ALIGNMENT		4U
 #define RB_MAX_SMALL_DATA	(RB_ALIGNMENT * RINGBUF_TYPE_DATA_TYPE_LEN_MAX)
 #define RB_EVNT_MIN_SIZE	8U	/* two 32bit words */
-#define RB_ALIGN_DATA		__aligned(RB_ALIGNMENT)
+
+#ifndef CONFIG_HAVE_64BIT_ALIGNED_ACCESS
+# define RB_FORCE_8BYTE_ALIGNMENT	0
+# define RB_ARCH_ALIGNMENT		RB_ALIGNMENT
+#else
+# define RB_FORCE_8BYTE_ALIGNMENT	1
+# define RB_ARCH_ALIGNMENT		8U
+#endif
+
+#define RB_ALIGN_DATA		__aligned(RB_ARCH_ALIGNMENT)
 
 /* define RINGBUF_TYPE_DATA for 'case RINGBUF_TYPE_DATA:' */
 #define RINGBUF_TYPE_DATA 0 ... RINGBUF_TYPE_DATA_TYPE_LEN_MAX
@@ -2367,7 +2376,7 @@ rb_update_event(struct ring_buffer_per_c
 
 	event->time_delta = delta;
 	length -= RB_EVNT_HDR_SIZE;
-	if (length > RB_MAX_SMALL_DATA) {
+	if (length > RB_MAX_SMALL_DATA || RB_FORCE_8BYTE_ALIGNMENT) {
 		event->type_len = 0;
 		event->array[0] = length;
 	} else
@@ -2382,11 +2391,11 @@ static unsigned rb_calculate_event_lengt
 	if (!length)
 		length++;
 
-	if (length > RB_MAX_SMALL_DATA)
+	if (length > RB_MAX_SMALL_DATA || RB_FORCE_8BYTE_ALIGNMENT)
 		length += sizeof(event.array[0]);
 
 	length += RB_EVNT_HDR_SIZE;
-	length = ALIGN(length, RB_ALIGNMENT);
+	length = ALIGN(length, RB_ARCH_ALIGNMENT);
 
 	/*
 	 * In case the time delta is larger than the 27 bits for it



^ permalink raw reply	[flat|nested] 469+ messages in thread

* Re: [PATCH 5.4 106/453] libbpf: Fix BTF data layout checks and allow empty BTF
  2020-12-28 12:45 ` [PATCH 5.4 106/453] libbpf: Fix BTF data layout checks and allow empty BTF Greg Kroah-Hartman
@ 2020-12-28 15:49   ` Naresh Kamboju
  2020-12-28 19:47     ` Andrii Nakryiko
  0 siblings, 1 reply; 469+ messages in thread
From: Naresh Kamboju @ 2020-12-28 15:49 UTC (permalink / raw)
  To: Greg Kroah-Hartman
  Cc: open list, linux-stable, Andrii Nakryiko, Alexei Starovoitov,
	Sasha Levin

Perf build failed on stable-rc 5.4 branch due to this patch.

On Mon, 28 Dec 2020 at 19:15, Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
>
> From: Andrii Nakryiko <andrii@kernel.org>
>
> [ Upstream commit d8123624506cd62730c9cd9c7672c698e462703d ]
>
> Make data section layout checks stricter, disallowing overlap of types and
> strings data.
>
> Additionally, allow BTFs with no type data. There is nothing inherently wrong
> with having BTF with no types (put potentially with some strings). This could
> be a situation with kernel module BTFs, if module doesn't introduce any new
> type information.
>
> Also fix invalid offset alignment check for btf->hdr->type_off.
>
> Fixes: 8a138aed4a80 ("bpf: btf: Add BTF support to libbpf")
> Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
> Signed-off-by: Alexei Starovoitov <ast@kernel.org>
> Link: https://lore.kernel.org/bpf/20201105043402.2530976-8-andrii@kernel.org
> Signed-off-by: Sasha Levin <sashal@kernel.org>
> ---
>  tools/lib/bpf/btf.c | 16 ++++++----------
>  1 file changed, 6 insertions(+), 10 deletions(-)
>
> diff --git a/tools/lib/bpf/btf.c b/tools/lib/bpf/btf.c
> index d606a358480da..3380aadb74655 100644
> --- a/tools/lib/bpf/btf.c
> +++ b/tools/lib/bpf/btf.c
> @@ -100,22 +100,18 @@ static int btf_parse_hdr(struct btf *btf)
>                 return -EINVAL;
>         }
>
> -       if (meta_left < hdr->type_off) {
> -               pr_debug("Invalid BTF type section offset:%u\n", hdr->type_off);
> +       if (meta_left < hdr->str_off + hdr->str_len) {
> +               pr_debug("Invalid BTF total size:%u\n", btf->raw_size);

In file included from btf.c:17:0:
btf.c: In function 'btf_parse_hdr':
btf.c:104:48: error: 'struct btf' has no member named 'raw_size'; did
you mean 'data_size'?
   pr_debug("Invalid BTF total size:%u\n", btf->raw_size);
                                                ^
libbpf_internal.h:59:40: note: in definition of macro '__pr'
  libbpf_print(level, "libbpf: " fmt, ##__VA_ARGS__); \
                                        ^~~~~~~~~~~
btf.c:104:3: note: in expansion of macro 'pr_debug'
   pr_debug("Invalid BTF total size:%u\n", btf->raw_size);
   ^~~~~~~~

full build log link,
https://ci.linaro.org/view/lkft/job/openembedded-lkft-linux-stable-rc-5.4/DISTRO=lkft,MACHINE=intel-corei7-64,label=docker-buster-lkft/346/consoleText

-- 
Linaro LKFT
https://lkft.linaro.org

^ permalink raw reply	[flat|nested] 469+ messages in thread

* Re: [PATCH 5.4 150/453] EDAC/mce_amd: Use struct cpuinfo_x86.cpu_die_id for AMD NodeId
  2020-12-28 12:46 ` [PATCH 5.4 150/453] EDAC/mce_amd: Use struct cpuinfo_x86.cpu_die_id for AMD NodeId Greg Kroah-Hartman
@ 2020-12-28 15:54   ` Borislav Petkov
  2020-12-28 23:21     ` Sasha Levin
  0 siblings, 1 reply; 469+ messages in thread
From: Borislav Petkov @ 2020-12-28 15:54 UTC (permalink / raw)
  To: Greg Kroah-Hartman; +Cc: linux-kernel, stable, Yazen Ghannam, Sasha Levin

On Mon, Dec 28, 2020 at 01:46:26PM +0100, Greg Kroah-Hartman wrote:
> From: Yazen Ghannam <yazen.ghannam@amd.com>
> 
> [ Upstream commit 8de0c9917cc1297bc5543b61992d5bdee4ce621a ]
> 
> The edac_mce_amd module calls decode_dram_ecc() on AMD Family17h and
> later systems. This function is used in amd64_edac_mod to do
> system-specific decoding for DRAM ECC errors. The function takes a
> "NodeId" as a parameter.
> 
> In AMD documentation, NodeId is used to identify a physical die in a
> system. This can be used to identify a node in the AMD_NB code and also
> it is used with umc_normaddr_to_sysaddr().
> 
> However, the input used for decode_dram_ecc() is currently the NUMA node
> of a logical CPU. In the default configuration, the NUMA node and
> physical die will be equivalent, so this doesn't have an impact.
> 
> But the NUMA node configuration can be adjusted with optional memory
> interleaving modes. This will cause the NUMA node enumeration to not
> match the physical die enumeration. The mismatch will cause the address
> translation function to fail or report incorrect results.
> 
> Use struct cpuinfo_x86.cpu_die_id for the node_id parameter to ensure the
> physical ID is used.
> 
> Fixes: fbe63acf62f5 ("EDAC, mce_amd: Use cpu_to_node() to find the node ID")
> Signed-off-by: Yazen Ghannam <yazen.ghannam@amd.com>
> Signed-off-by: Borislav Petkov <bp@suse.de>
> Link: https://lkml.kernel.org/r/20201109210659.754018-4-Yazen.Ghannam@amd.com
> Signed-off-by: Sasha Levin <sashal@kernel.org>
> ---
>  drivers/edac/mce_amd.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/edac/mce_amd.c b/drivers/edac/mce_amd.c
> index ea622c6f3a393..c19640a453f22 100644
> --- a/drivers/edac/mce_amd.c
> +++ b/drivers/edac/mce_amd.c
> @@ -975,7 +975,7 @@ static void decode_smca_error(struct mce *m)
>  	}
>  
>  	if (bank_type == SMCA_UMC && xec == 0 && decode_dram_ecc)
> -		decode_dram_ecc(cpu_to_node(m->extcpu), m);
> +		decode_dram_ecc(topology_die_id(m->extcpu), m);
>  }
>  
>  static inline void amd_decode_err_code(u16 ec)

I believe this one needs:

028c221ed190 ("x86/CPU/AMD: Save AMD NodeId as cpu_die_id")

to be backported too otherwise ->cpu_die_id will be uninitialized.

-- 
Regards/Gruss,
    Boris.

SUSE Software Solutions Germany GmbH, GF: Felix Imendörffer, HRB 36809, AG Nürnberg

^ permalink raw reply	[flat|nested] 469+ messages in thread

* Re: [PATCH 5.4 000/453] 5.4.86-rc1 review
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (451 preceding siblings ...)
  2020-12-28 12:51 ` [PATCH 5.4 453/453] Revert: "ring-buffer: Remove HAVE_64BIT_ALIGNED_ACCESS" Greg Kroah-Hartman
@ 2020-12-28 16:57 ` Naresh Kamboju
  2020-12-28 17:33 ` Guenter Roeck
                   ` (2 subsequent siblings)
  455 siblings, 0 replies; 469+ messages in thread
From: Naresh Kamboju @ 2020-12-28 16:57 UTC (permalink / raw)
  To: Greg Kroah-Hartman
  Cc: open list, Linus Torvalds, Andrew Morton, Guenter Roeck,
	Shuah Khan, patches, lkft-triage, pavel, linux-stable

On Mon, 28 Dec 2020 at 19:09, Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
>
> This is the start of the stable review cycle for the 5.4.86 release.
> There are 453 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Wed, 30 Dec 2020 12:48:23 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
>         https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.86-rc1.gz
> or in the git tree and branch at:
>         git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.4.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h

Perf build failed on stable-rc 5.4 branch.

> Andrii Nakryiko <andrii@kernel.org>
>     libbpf: Fix BTF data layout checks and allow empty BTF

In file included from btf.c:17:0:
btf.c: In function 'btf_parse_hdr':
btf.c:104:48: error: 'struct btf' has no member named 'raw_size'; did
you mean 'data_size'?
   pr_debug("Invalid BTF total size:%u\n", btf->raw_size);
                                                ^
libbpf_internal.h:59:40: note: in definition of macro '__pr'
  libbpf_print(level, "libbpf: " fmt, ##__VA_ARGS__); \
                                        ^~~~~~~~~~~
btf.c:104:3: note: in expansion of macro 'pr_debug'
   pr_debug("Invalid BTF total size:%u\n", btf->raw_size);
   ^~~~~~~~

Reported-by: Naresh Kamboju <naresh.kamboju@linaro.org>

Full log link,
https://ci.linaro.org/view/lkft/job/openembedded-lkft-linux-stable-rc-5.4/DISTRO=lkft,MACHINE=intel-corei7-64,label=docker-buster-lkft/346/consoleText


-- 
Linaro LKFT
https://lkft.linaro.org

^ permalink raw reply	[flat|nested] 469+ messages in thread

* Re: [PATCH 5.4 000/453] 5.4.86-rc1 review
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (452 preceding siblings ...)
  2020-12-28 16:57 ` [PATCH 5.4 000/453] 5.4.86-rc1 review Naresh Kamboju
@ 2020-12-28 17:33 ` Guenter Roeck
  2020-12-29  9:46   ` Greg Kroah-Hartman
  2020-12-28 20:18 ` Jon Hunter
  2020-12-28 20:26 ` Guenter Roeck
  455 siblings, 1 reply; 469+ messages in thread
From: Guenter Roeck @ 2020-12-28 17:33 UTC (permalink / raw)
  To: Greg Kroah-Hartman, linux-kernel
  Cc: torvalds, akpm, shuah, patches, lkft-triage, pavel, stable

On 12/28/20 4:43 AM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 5.4.86 release.
> There are 453 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.
> 
> Responses should be made by Wed, 30 Dec 2020 12:48:23 +0000.
> Anything received after that time might be too late.
> 


Building arm:multi_v5_defconfig ... failed
--------------
Error log:
drivers/leds/leds-netxbig.c: In function 'netxbig_leds_get_of_pdata':
drivers/leds/leds-netxbig.c:571:13: error: 'gpio_ext_dev' undeclared

Guenter

^ permalink raw reply	[flat|nested] 469+ messages in thread

* Re: [PATCH 5.4 106/453] libbpf: Fix BTF data layout checks and allow empty BTF
  2020-12-28 15:49   ` Naresh Kamboju
@ 2020-12-28 19:47     ` Andrii Nakryiko
  2020-12-28 23:09       ` Sasha Levin
  0 siblings, 1 reply; 469+ messages in thread
From: Andrii Nakryiko @ 2020-12-28 19:47 UTC (permalink / raw)
  To: Naresh Kamboju
  Cc: Greg Kroah-Hartman, open list, linux-stable, Andrii Nakryiko,
	Alexei Starovoitov, Sasha Levin

On Mon, Dec 28, 2020 at 7:49 AM Naresh Kamboju
<naresh.kamboju@linaro.org> wrote:
>
> Perf build failed on stable-rc 5.4 branch due to this patch.
>
> On Mon, 28 Dec 2020 at 19:15, Greg Kroah-Hartman
> <gregkh@linuxfoundation.org> wrote:
> >
> > From: Andrii Nakryiko <andrii@kernel.org>
> >
> > [ Upstream commit d8123624506cd62730c9cd9c7672c698e462703d ]
> >
> > Make data section layout checks stricter, disallowing overlap of types and
> > strings data.
> >
> > Additionally, allow BTFs with no type data. There is nothing inherently wrong
> > with having BTF with no types (put potentially with some strings). This could
> > be a situation with kernel module BTFs, if module doesn't introduce any new
> > type information.
> >
> > Also fix invalid offset alignment check for btf->hdr->type_off.
> >
> > Fixes: 8a138aed4a80 ("bpf: btf: Add BTF support to libbpf")
> > Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
> > Signed-off-by: Alexei Starovoitov <ast@kernel.org>
> > Link: https://lore.kernel.org/bpf/20201105043402.2530976-8-andrii@kernel.org
> > Signed-off-by: Sasha Levin <sashal@kernel.org>
> > ---
> >  tools/lib/bpf/btf.c | 16 ++++++----------
> >  1 file changed, 6 insertions(+), 10 deletions(-)
> >
> > diff --git a/tools/lib/bpf/btf.c b/tools/lib/bpf/btf.c
> > index d606a358480da..3380aadb74655 100644
> > --- a/tools/lib/bpf/btf.c
> > +++ b/tools/lib/bpf/btf.c
> > @@ -100,22 +100,18 @@ static int btf_parse_hdr(struct btf *btf)
> >                 return -EINVAL;
> >         }
> >
> > -       if (meta_left < hdr->type_off) {
> > -               pr_debug("Invalid BTF type section offset:%u\n", hdr->type_off);
> > +       if (meta_left < hdr->str_off + hdr->str_len) {
> > +               pr_debug("Invalid BTF total size:%u\n", btf->raw_size);
>
> In file included from btf.c:17:0:
> btf.c: In function 'btf_parse_hdr':
> btf.c:104:48: error: 'struct btf' has no member named 'raw_size'; did
> you mean 'data_size'?
>    pr_debug("Invalid BTF total size:%u\n", btf->raw_size);
>                                                 ^
> libbpf_internal.h:59:40: note: in definition of macro '__pr'
>   libbpf_print(level, "libbpf: " fmt, ##__VA_ARGS__); \
>                                         ^~~~~~~~~~~
> btf.c:104:3: note: in expansion of macro 'pr_debug'
>    pr_debug("Invalid BTF total size:%u\n", btf->raw_size);
>    ^~~~~~~~
>

This patch fixes the bug introduced back in 8a138aed4a80 ("bpf: btf:
Add BTF support to libbpf"), but a bunch of other refactorings
happened since then, adding/renaming struct btf internals. The fix
here is not that critical, so it's probably best to just drop this
patch from the stable, if possible. Would it be ok, Greg?

> full build log link,
> https://ci.linaro.org/view/lkft/job/openembedded-lkft-linux-stable-rc-5.4/DISTRO=lkft,MACHINE=intel-corei7-64,label=docker-buster-lkft/346/consoleText
>
> --
> Linaro LKFT
> https://lkft.linaro.org

^ permalink raw reply	[flat|nested] 469+ messages in thread

* Re: [PATCH 5.4 000/453] 5.4.86-rc1 review
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (453 preceding siblings ...)
  2020-12-28 17:33 ` Guenter Roeck
@ 2020-12-28 20:18 ` Jon Hunter
  2020-12-28 20:26 ` Guenter Roeck
  455 siblings, 0 replies; 469+ messages in thread
From: Jon Hunter @ 2020-12-28 20:18 UTC (permalink / raw)
  To: Greg Kroah-Hartman
  Cc: Greg Kroah-Hartman, torvalds, akpm, linux, shuah, patches,
	lkft-triage, pavel, stable, linux-tegra

On Mon, 28 Dec 2020 13:43:56 +0100, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 5.4.86 release.
> There are 453 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.
> 
> Responses should be made by Wed, 30 Dec 2020 12:48:23 +0000.
> Anything received after that time might be too late.
> 
> The whole patch series can be found in one patch at:
> 	https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.86-rc1.gz
> or in the git tree and branch at:
> 	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.4.y
> and the diffstat can be found below.
> 
> thanks,
> 
> greg k-h

All tests passing for Tegra ...

Test results for stable-v5.4:
    12 builds:	12 pass, 0 fail
    26 boots:	26 pass, 0 fail
    56 tests:	56 pass, 0 fail

Linux version:	5.4.86-rc1-g11e71509ffb7
Boards tested:	tegra124-jetson-tk1, tegra186-p2771-0000,
                tegra194-p2972-0000, tegra20-ventana,
                tegra210-p2371-2180, tegra210-p3450-0000,
                tegra30-cardhu-a04

Tested-by: Jon Hunter <jonathanh@nvidia.com>

Jon

^ permalink raw reply	[flat|nested] 469+ messages in thread

* Re: [PATCH 5.4 000/453] 5.4.86-rc1 review
  2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
                   ` (454 preceding siblings ...)
  2020-12-28 20:18 ` Jon Hunter
@ 2020-12-28 20:26 ` Guenter Roeck
  455 siblings, 0 replies; 469+ messages in thread
From: Guenter Roeck @ 2020-12-28 20:26 UTC (permalink / raw)
  To: Greg Kroah-Hartman
  Cc: linux-kernel, torvalds, akpm, shuah, patches, lkft-triage, pavel, stable

On Mon, Dec 28, 2020 at 01:43:56PM +0100, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 5.4.86 release.
> There are 453 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.
> 
> Responses should be made by Wed, 30 Dec 2020 12:48:23 +0000.
> Anything received after that time might be too late.
> 

Build results:
	total: 157 pass: 154 fail: 3
Failed builds:
	arm:multi_v5_defconfig
	i386:tools/perf
	x86_64:tools/perf
Qemu test results:
	total: 427 pass: 427 fail: 0

Failures as reported.

Tested-by: Guenter Roeck <linux@roeck-us.net>

Guenter

^ permalink raw reply	[flat|nested] 469+ messages in thread

* Re: [PATCH 5.4 106/453] libbpf: Fix BTF data layout checks and allow empty BTF
  2020-12-28 19:47     ` Andrii Nakryiko
@ 2020-12-28 23:09       ` Sasha Levin
  2020-12-29  9:44         ` Greg Kroah-Hartman
  0 siblings, 1 reply; 469+ messages in thread
From: Sasha Levin @ 2020-12-28 23:09 UTC (permalink / raw)
  To: Andrii Nakryiko
  Cc: Naresh Kamboju, Greg Kroah-Hartman, open list, linux-stable,
	Andrii Nakryiko, Alexei Starovoitov

On Mon, Dec 28, 2020 at 11:47:44AM -0800, Andrii Nakryiko wrote:
>On Mon, Dec 28, 2020 at 7:49 AM Naresh Kamboju
><naresh.kamboju@linaro.org> wrote:
>>
>> Perf build failed on stable-rc 5.4 branch due to this patch.
>>
>> On Mon, 28 Dec 2020 at 19:15, Greg Kroah-Hartman
>> <gregkh@linuxfoundation.org> wrote:
>> >
>> > From: Andrii Nakryiko <andrii@kernel.org>
>> >
>> > [ Upstream commit d8123624506cd62730c9cd9c7672c698e462703d ]
>> >
>> > Make data section layout checks stricter, disallowing overlap of types and
>> > strings data.
>> >
>> > Additionally, allow BTFs with no type data. There is nothing inherently wrong
>> > with having BTF with no types (put potentially with some strings). This could
>> > be a situation with kernel module BTFs, if module doesn't introduce any new
>> > type information.
>> >
>> > Also fix invalid offset alignment check for btf->hdr->type_off.
>> >
>> > Fixes: 8a138aed4a80 ("bpf: btf: Add BTF support to libbpf")
>> > Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
>> > Signed-off-by: Alexei Starovoitov <ast@kernel.org>
>> > Link: https://lore.kernel.org/bpf/20201105043402.2530976-8-andrii@kernel.org
>> > Signed-off-by: Sasha Levin <sashal@kernel.org>
>> > ---
>> >  tools/lib/bpf/btf.c | 16 ++++++----------
>> >  1 file changed, 6 insertions(+), 10 deletions(-)
>> >
>> > diff --git a/tools/lib/bpf/btf.c b/tools/lib/bpf/btf.c
>> > index d606a358480da..3380aadb74655 100644
>> > --- a/tools/lib/bpf/btf.c
>> > +++ b/tools/lib/bpf/btf.c
>> > @@ -100,22 +100,18 @@ static int btf_parse_hdr(struct btf *btf)
>> >                 return -EINVAL;
>> >         }
>> >
>> > -       if (meta_left < hdr->type_off) {
>> > -               pr_debug("Invalid BTF type section offset:%u\n", hdr->type_off);
>> > +       if (meta_left < hdr->str_off + hdr->str_len) {
>> > +               pr_debug("Invalid BTF total size:%u\n", btf->raw_size);
>>
>> In file included from btf.c:17:0:
>> btf.c: In function 'btf_parse_hdr':
>> btf.c:104:48: error: 'struct btf' has no member named 'raw_size'; did
>> you mean 'data_size'?
>>    pr_debug("Invalid BTF total size:%u\n", btf->raw_size);
>>                                                 ^
>> libbpf_internal.h:59:40: note: in definition of macro '__pr'
>>   libbpf_print(level, "libbpf: " fmt, ##__VA_ARGS__); \
>>                                         ^~~~~~~~~~~
>> btf.c:104:3: note: in expansion of macro 'pr_debug'
>>    pr_debug("Invalid BTF total size:%u\n", btf->raw_size);
>>    ^~~~~~~~
>>
>
>This patch fixes the bug introduced back in 8a138aed4a80 ("bpf: btf:
>Add BTF support to libbpf"), but a bunch of other refactorings
>happened since then, adding/renaming struct btf internals. The fix
>here is not that critical, so it's probably best to just drop this
>patch from the stable, if possible. Would it be ok, Greg?

I'll drop it, thanks.

-- 
Thanks,
Sasha

^ permalink raw reply	[flat|nested] 469+ messages in thread

* Re: [PATCH 5.4 150/453] EDAC/mce_amd: Use struct cpuinfo_x86.cpu_die_id for AMD NodeId
  2020-12-28 15:54   ` Borislav Petkov
@ 2020-12-28 23:21     ` Sasha Levin
  0 siblings, 0 replies; 469+ messages in thread
From: Sasha Levin @ 2020-12-28 23:21 UTC (permalink / raw)
  To: Borislav Petkov; +Cc: Greg Kroah-Hartman, linux-kernel, stable, Yazen Ghannam

On Mon, Dec 28, 2020 at 04:54:09PM +0100, Borislav Petkov wrote:
>On Mon, Dec 28, 2020 at 01:46:26PM +0100, Greg Kroah-Hartman wrote:
>> From: Yazen Ghannam <yazen.ghannam@amd.com>
>>
>> [ Upstream commit 8de0c9917cc1297bc5543b61992d5bdee4ce621a ]
>>
>> The edac_mce_amd module calls decode_dram_ecc() on AMD Family17h and
>> later systems. This function is used in amd64_edac_mod to do
>> system-specific decoding for DRAM ECC errors. The function takes a
>> "NodeId" as a parameter.
>>
>> In AMD documentation, NodeId is used to identify a physical die in a
>> system. This can be used to identify a node in the AMD_NB code and also
>> it is used with umc_normaddr_to_sysaddr().
>>
>> However, the input used for decode_dram_ecc() is currently the NUMA node
>> of a logical CPU. In the default configuration, the NUMA node and
>> physical die will be equivalent, so this doesn't have an impact.
>>
>> But the NUMA node configuration can be adjusted with optional memory
>> interleaving modes. This will cause the NUMA node enumeration to not
>> match the physical die enumeration. The mismatch will cause the address
>> translation function to fail or report incorrect results.
>>
>> Use struct cpuinfo_x86.cpu_die_id for the node_id parameter to ensure the
>> physical ID is used.
>>
>> Fixes: fbe63acf62f5 ("EDAC, mce_amd: Use cpu_to_node() to find the node ID")
>> Signed-off-by: Yazen Ghannam <yazen.ghannam@amd.com>
>> Signed-off-by: Borislav Petkov <bp@suse.de>
>> Link: https://lkml.kernel.org/r/20201109210659.754018-4-Yazen.Ghannam@amd.com
>> Signed-off-by: Sasha Levin <sashal@kernel.org>
>> ---
>>  drivers/edac/mce_amd.c | 2 +-
>>  1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/drivers/edac/mce_amd.c b/drivers/edac/mce_amd.c
>> index ea622c6f3a393..c19640a453f22 100644
>> --- a/drivers/edac/mce_amd.c
>> +++ b/drivers/edac/mce_amd.c
>> @@ -975,7 +975,7 @@ static void decode_smca_error(struct mce *m)
>>  	}
>>
>>  	if (bank_type == SMCA_UMC && xec == 0 && decode_dram_ecc)
>> -		decode_dram_ecc(cpu_to_node(m->extcpu), m);
>> +		decode_dram_ecc(topology_die_id(m->extcpu), m);
>>  }
>>
>>  static inline void amd_decode_err_code(u16 ec)
>
>I believe this one needs:
>
>028c221ed190 ("x86/CPU/AMD: Save AMD NodeId as cpu_die_id")
>
>to be backported too otherwise ->cpu_die_id will be uninitialized.

I'll take it, thanks.

-- 
Thanks,
Sasha

^ permalink raw reply	[flat|nested] 469+ messages in thread

* Re: [PATCH 5.4 106/453] libbpf: Fix BTF data layout checks and allow empty BTF
  2020-12-28 23:09       ` Sasha Levin
@ 2020-12-29  9:44         ` Greg Kroah-Hartman
  0 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-29  9:44 UTC (permalink / raw)
  To: Sasha Levin
  Cc: Andrii Nakryiko, Naresh Kamboju, open list, linux-stable,
	Andrii Nakryiko, Alexei Starovoitov

On Mon, Dec 28, 2020 at 06:09:25PM -0500, Sasha Levin wrote:
> On Mon, Dec 28, 2020 at 11:47:44AM -0800, Andrii Nakryiko wrote:
> > On Mon, Dec 28, 2020 at 7:49 AM Naresh Kamboju
> > <naresh.kamboju@linaro.org> wrote:
> > > 
> > > Perf build failed on stable-rc 5.4 branch due to this patch.
> > > 
> > > On Mon, 28 Dec 2020 at 19:15, Greg Kroah-Hartman
> > > <gregkh@linuxfoundation.org> wrote:
> > > >
> > > > From: Andrii Nakryiko <andrii@kernel.org>
> > > >
> > > > [ Upstream commit d8123624506cd62730c9cd9c7672c698e462703d ]
> > > >
> > > > Make data section layout checks stricter, disallowing overlap of types and
> > > > strings data.
> > > >
> > > > Additionally, allow BTFs with no type data. There is nothing inherently wrong
> > > > with having BTF with no types (put potentially with some strings). This could
> > > > be a situation with kernel module BTFs, if module doesn't introduce any new
> > > > type information.
> > > >
> > > > Also fix invalid offset alignment check for btf->hdr->type_off.
> > > >
> > > > Fixes: 8a138aed4a80 ("bpf: btf: Add BTF support to libbpf")
> > > > Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
> > > > Signed-off-by: Alexei Starovoitov <ast@kernel.org>
> > > > Link: https://lore.kernel.org/bpf/20201105043402.2530976-8-andrii@kernel.org
> > > > Signed-off-by: Sasha Levin <sashal@kernel.org>
> > > > ---
> > > >  tools/lib/bpf/btf.c | 16 ++++++----------
> > > >  1 file changed, 6 insertions(+), 10 deletions(-)
> > > >
> > > > diff --git a/tools/lib/bpf/btf.c b/tools/lib/bpf/btf.c
> > > > index d606a358480da..3380aadb74655 100644
> > > > --- a/tools/lib/bpf/btf.c
> > > > +++ b/tools/lib/bpf/btf.c
> > > > @@ -100,22 +100,18 @@ static int btf_parse_hdr(struct btf *btf)
> > > >                 return -EINVAL;
> > > >         }
> > > >
> > > > -       if (meta_left < hdr->type_off) {
> > > > -               pr_debug("Invalid BTF type section offset:%u\n", hdr->type_off);
> > > > +       if (meta_left < hdr->str_off + hdr->str_len) {
> > > > +               pr_debug("Invalid BTF total size:%u\n", btf->raw_size);
> > > 
> > > In file included from btf.c:17:0:
> > > btf.c: In function 'btf_parse_hdr':
> > > btf.c:104:48: error: 'struct btf' has no member named 'raw_size'; did
> > > you mean 'data_size'?
> > >    pr_debug("Invalid BTF total size:%u\n", btf->raw_size);
> > >                                                 ^
> > > libbpf_internal.h:59:40: note: in definition of macro '__pr'
> > >   libbpf_print(level, "libbpf: " fmt, ##__VA_ARGS__); \
> > >                                         ^~~~~~~~~~~
> > > btf.c:104:3: note: in expansion of macro 'pr_debug'
> > >    pr_debug("Invalid BTF total size:%u\n", btf->raw_size);
> > >    ^~~~~~~~
> > > 
> > 
> > This patch fixes the bug introduced back in 8a138aed4a80 ("bpf: btf:
> > Add BTF support to libbpf"), but a bunch of other refactorings
> > happened since then, adding/renaming struct btf internals. The fix
> > here is not that critical, so it's probably best to just drop this
> > patch from the stable, if possible. Would it be ok, Greg?
> 
> I'll drop it, thanks.

Thanks for dropping this and doing the other fixups.  I'll go push out
some -rc2 releases soon...

greg k-h

^ permalink raw reply	[flat|nested] 469+ messages in thread

* Re: [PATCH 5.4 000/453] 5.4.86-rc1 review
  2020-12-28 17:33 ` Guenter Roeck
@ 2020-12-29  9:46   ` Greg Kroah-Hartman
  0 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-29  9:46 UTC (permalink / raw)
  To: Guenter Roeck
  Cc: linux-kernel, torvalds, akpm, shuah, patches, lkft-triage, pavel, stable

On Mon, Dec 28, 2020 at 09:33:22AM -0800, Guenter Roeck wrote:
> On 12/28/20 4:43 AM, Greg Kroah-Hartman wrote:
> > This is the start of the stable review cycle for the 5.4.86 release.
> > There are 453 patches in this series, all will be posted as a response
> > to this one.  If anyone has any issues with these being applied, please
> > let me know.
> > 
> > Responses should be made by Wed, 30 Dec 2020 12:48:23 +0000.
> > Anything received after that time might be too late.
> > 
> 
> 
> Building arm:multi_v5_defconfig ... failed
> --------------
> Error log:
> drivers/leds/leds-netxbig.c: In function 'netxbig_leds_get_of_pdata':
> drivers/leds/leds-netxbig.c:571:13: error: 'gpio_ext_dev' undeclared

THanks for reporting this, I'll go delete the offending patch...

greg k-h

^ permalink raw reply	[flat|nested] 469+ messages in thread

* Re: [PATCH 5.4 099/453] drm/amdgpu: fix build_coefficients() argument
  2020-12-28 12:45 ` [PATCH 5.4 099/453] drm/amdgpu: fix build_coefficients() argument Greg Kroah-Hartman
@ 2020-12-29 17:58   ` Pavel Machek
  2020-12-30  9:22     ` Greg Kroah-Hartman
  0 siblings, 1 reply; 469+ messages in thread
From: Pavel Machek @ 2020-12-29 17:58 UTC (permalink / raw)
  To: Greg Kroah-Hartman
  Cc: linux-kernel, stable, Harry Wentland, Arnd Bergmann,
	Alex Deucher, Sasha Levin

[-- Attachment #1: Type: text/plain, Size: 1382 bytes --]

Hi!

> From: Arnd Bergmann <arnd@arndb.de>
> 
> [ Upstream commit dbb60031dd0c2b85f10ce4c12ae604c28d3aaca4 ]
> 
> gcc -Wextra warns about a function taking an enum argument
> being called with a bool:
> 
> drivers/gpu/drm/amd/amdgpu/../display/modules/color/color_gamma.c: In function 'apply_degamma_for_user_regamma':
> drivers/gpu/drm/amd/amdgpu/../display/modules/color/color_gamma.c:1617:29: warning: implicit conversion from 'enum <anonymous>' to 'enum dc_transfer_func_predefined' [-Wenum-conversion]
>  1617 |  build_coefficients(&coeff, true);
> 
> It appears that a patch was added using the old calling conventions
> after the type was changed, and the value should actually be 0
> (TRANSFER_FUNCTION_SRGB) here instead of 1 (true).

Yeah, but 4.19 still uses bool there, so this actually introduces a
bug.

Please drop.
								Pavel
								
> +++ b/drivers/gpu/drm/amd/display/modules/color/color_gamma.c
> @@ -1576,7 +1576,7 @@ static void apply_degamma_for_user_regamma(struct pwl_float_data_ex *rgb_regamma
>  	struct pwl_float_data_ex *rgb = rgb_regamma;
>  	const struct hw_x_point *coord_x = coordinates_x;
>  
> -	build_coefficients(&coeff, true);
> +	build_coefficients(&coeff, TRANSFER_FUNCTION_SRGB);
>  
>  	i = 0;
>  	while (i != hw_points_num + 1) {
> -- 
> 2.27.0
> 
> 

-- 
http://www.livejournal.com/~pavelmachek

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

^ permalink raw reply	[flat|nested] 469+ messages in thread

* Re: [PATCH 5.4 099/453] drm/amdgpu: fix build_coefficients() argument
  2020-12-29 17:58   ` Pavel Machek
@ 2020-12-30  9:22     ` Greg Kroah-Hartman
  0 siblings, 0 replies; 469+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-30  9:22 UTC (permalink / raw)
  To: Pavel Machek
  Cc: linux-kernel, stable, Harry Wentland, Arnd Bergmann,
	Alex Deucher, Sasha Levin

On Tue, Dec 29, 2020 at 06:58:19PM +0100, Pavel Machek wrote:
> Hi!
> 
> > From: Arnd Bergmann <arnd@arndb.de>
> > 
> > [ Upstream commit dbb60031dd0c2b85f10ce4c12ae604c28d3aaca4 ]
> > 
> > gcc -Wextra warns about a function taking an enum argument
> > being called with a bool:
> > 
> > drivers/gpu/drm/amd/amdgpu/../display/modules/color/color_gamma.c: In function 'apply_degamma_for_user_regamma':
> > drivers/gpu/drm/amd/amdgpu/../display/modules/color/color_gamma.c:1617:29: warning: implicit conversion from 'enum <anonymous>' to 'enum dc_transfer_func_predefined' [-Wenum-conversion]
> >  1617 |  build_coefficients(&coeff, true);
> > 
> > It appears that a patch was added using the old calling conventions
> > after the type was changed, and the value should actually be 0
> > (TRANSFER_FUNCTION_SRGB) here instead of 1 (true).
> 
> Yeah, but 4.19 still uses bool there, so this actually introduces a
> bug.
> 
> Please drop.

Now dropped, thanks.

greg k-h

^ permalink raw reply	[flat|nested] 469+ messages in thread

end of thread, other threads:[~2020-12-30  9:22 UTC | newest]

Thread overview: 469+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-12-28 12:43 [PATCH 5.4 000/453] 5.4.86-rc1 review Greg Kroah-Hartman
2020-12-28 12:43 ` [PATCH 5.4 001/453] ARM: dts: sun7i: bananapi: Enable RGMII RX/TX delay on Ethernet PHY Greg Kroah-Hartman
2020-12-28 12:43 ` [PATCH 5.4 002/453] ARM: dts: sun8i: r40: bananapi-m2-berry: Fix dcdc1 regulator Greg Kroah-Hartman
2020-12-28 12:43 ` [PATCH 5.4 003/453] ARM: dts: sun8i: v40: bananapi-m2-berry: Fix ethernet node Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.4 004/453] pinctrl: merrifield: Set default bias in case no particular value given Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.4 005/453] pinctrl: baytrail: Avoid clearing debounce value when turning it off Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.4 006/453] ARM: dts: sun8i: v3s: fix GIC node memory range Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.4 007/453] ARM: dts: sun7i: pcduino3-nano: enable RGMII RX/TX delay on PHY Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.4 008/453] ARM: dts: imx6qdl-wandboard-revd1: Remove PAD_GPIO_6 from enetgrp Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.4 009/453] ARM: dts: imx6qdl-kontron-samx6i: fix I2C_PM scl pin Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.4 010/453] PM: runtime: Add pm_runtime_resume_and_get to deal with usage counter Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.4 011/453] gpio: zynq: fix reference leak in zynq_gpio functions Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.4 012/453] gpio: mvebu: fix potential user-after-free on probe Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.4 013/453] scsi: bnx2i: Requires MMU Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.4 014/453] xsk: Fix xsk_poll()s return type Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.4 015/453] xsk: Replace datagram_poll by sock_poll_wait Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.4 016/453] can: softing: softing_netdev_open(): fix error handling Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.4 017/453] clk: renesas: r9a06g032: Drop __packed for portability Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.4 018/453] block: Simplify REQ_OP_ZONE_RESET_ALL handling Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.4 019/453] block: factor out requeue handling from dispatch code Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.4 020/453] blk-mq: In blk_mq_dispatch_rq_list() "no budget" is a reason to kick Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.4 021/453] pinctrl: aspeed: Fix GPIO requests on pass-through banks Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.4 022/453] netfilter: x_tables: Switch synchronization to RCU Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.4 023/453] netfilter: nft_compat: make sure xtables destructors have run Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.4 024/453] netfilter: nft_dynset: fix timeouts later than 23 days Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.4 025/453] afs: Fix memory leak when mounting with multiple source parameters Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.4 026/453] Revert "gpio: eic-sprd: Use devm_platform_ioremap_resource()" Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.4 027/453] gpio: eic-sprd: break loop when getting NULL device resource Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.4 028/453] netfilter: nft_ct: Remove confirmation check for NFT_CT_ID Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.4 029/453] selftests/bpf/test_offload.py: Reset ethtool features after failed setting Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.4 030/453] RDMA/cm: Fix an attempt to use non-valid pointer when cleaning timewait Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.4 031/453] i40e: Refactor rx_bi accesses Greg Kroah-Hartman
2020-12-28 12:44   ` [Intel-wired-lan] " Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.4 032/453] i40e: optimise prefetch page refcount Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.4 033/453] i40e: avoid premature Rx buffer reuse Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.4 034/453] ixgbe: " Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.4 035/453] selftests: fix poll error in udpgro.sh Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.4 036/453] net: mvpp2: add mvpp2_phylink_to_port() helper Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.4 037/453] drm/tegra: replace idr_init() by idr_init_base() Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.4 038/453] kernel/cpu: add arch override for clear_tasks_mm_cpumask() mm handling Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.4 039/453] drm/tegra: sor: Disable clocks on error in tegra_sor_init() Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.4 040/453] habanalabs: put devices before driver removal Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.4 041/453] arm64: syscall: exit userspace before unmasking exceptions Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.4 042/453] vxlan: Add needed_headroom for lower device Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.4 043/453] vxlan: Copy needed_tailroom from lowerdev Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.4 044/453] scsi: mpt3sas: Increase IOCInit request timeout to 30s Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.4 045/453] dm table: Remove BUG_ON(in_interrupt()) Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.4 046/453] iwlwifi: pcie: add one missing entry for AX210 Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.4 047/453] drm/amd/display: Init clock value by current vbios CLKs Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.4 048/453] perf/x86/intel: Check PEBS status correctly Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.4 049/453] kbuild: avoid split lines in .mod files Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.4 050/453] soc/tegra: fuse: Fix index bug in get_process_id Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.4 051/453] usb: mtu3: fix memory corruption in mtu3_debugfs_regset() Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.4 052/453] USB: serial: option: add interface-number sanity check to flag handling Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.4 053/453] USB: gadget: f_acm: add support for SuperSpeed Plus Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.4 054/453] USB: gadget: f_midi: setup SuperSpeed Plus descriptors Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.4 055/453] usb: gadget: f_fs: Re-use SS descriptors for SuperSpeedPlus Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.4 056/453] USB: gadget: f_rndis: fix bitrate for SuperSpeed and above Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.4 057/453] usb: chipidea: ci_hdrc_imx: Pass DISABLE_DEVICE_STREAMING flag to imx6ul Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.4 058/453] ARM: dts: exynos: fix roles of USB 3.0 ports on Odroid XU Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.4 059/453] ARM: dts: exynos: fix USB 3.0 VBUS control and over-current pins on Exynos5410 Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.4 060/453] ARM: dts: exynos: fix USB 3.0 pins supply being turned off on Odroid XU Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.4 061/453] coresight: tmc-etf: Fix NULL ptr dereference in tmc_enable_etf_sink_perf() Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.4 062/453] coresight: tmc-etr: Check if page is valid before dma_map_page() Greg Kroah-Hartman
2020-12-28 12:44 ` [PATCH 5.4 063/453] coresight: tmc-etr: Fix barrier packet insertion for perf buffer Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.4 064/453] coresight: etb10: Fix possible NULL ptr dereference in etb_enable_perf() Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.4 065/453] scsi: megaraid_sas: Check user-provided offsets Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.4 066/453] HID: i2c-hid: add Vero K147 to descriptor override Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.4 067/453] serial_core: Check for port state when tty is in error state Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.4 068/453] Bluetooth: Fix slab-out-of-bounds read in hci_le_direct_adv_report_evt() Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.4 069/453] quota: Sanity-check quota file headers on load Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.4 070/453] media: msi2500: assign SPI bus number dynamically Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.4 071/453] crypto: af_alg - avoid undefined behavior accessing salg_name Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.4 072/453] md: fix a warning caused by a race between concurrent md_ioctl()s Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.4 073/453] drm/gma500: fix double free of gma_connector Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.4 074/453] drm/aspeed: Fix Kconfig warning & subsequent build errors Greg Kroah-Hartman
2020-12-28 12:45   ` Greg Kroah-Hartman
2020-12-28 12:45   ` Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.4 075/453] drm/mcde: Fix handling of platform_get_irq() error Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.4 076/453] drm/tve200: " Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.4 077/453] arm64: dts: renesas: hihope-rzg2-ex: Drop rxc-skew-ps from ethernet-phy node Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.4 078/453] arm64: dts: renesas: cat875: Remove " Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.4 079/453] soc: renesas: rmobile-sysc: Fix some leaks in rmobile_init_pm_domains() Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.4 080/453] soc: mediatek: Check if power domains can be powered on at boot time Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.4 081/453] soc: qcom: geni: More properly switch to DMA mode Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.4 082/453] Revert "i2c: i2c-qcom-geni: Fix DMA transfer race" Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.4 083/453] RDMA/bnxt_re: Set queue pair state when being queried Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.4 084/453] rtc: pcf2127: fix pcf2127_nvmem_read/write() returns Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.4 085/453] selinux: fix error initialization in inode_doinit_with_dentry() Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.4 086/453] ARM: dts: aspeed: s2600wf: Fix VGA memory region location Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.4 087/453] RDMA/rxe: Compute PSN windows correctly Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.4 088/453] x86/mm/ident_map: Check for errors from ident_pud_init() Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.4 089/453] ARM: p2v: fix handling of LPAE translation in BE mode Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.4 090/453] x86/apic: Fix x2apic enablement without interrupt remapping Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.4 091/453] sched/deadline: Fix sched_dl_global_validate() Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.4 092/453] sched: Reenable interrupts in do_sched_yield() Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.4 093/453] drm/amdgpu: fix incorrect enum type Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.4 094/453] crypto: talitos - Endianess in current_desc_hdr() Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.4 095/453] crypto: talitos - Fix return type of current_desc_hdr() Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.4 096/453] crypto: inside-secure - Fix sizeof() mismatch Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.4 097/453] ASoC: sun4i-i2s: Fix lrck_period computation for I2S justified mode Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.4 098/453] ARM: dts: aspeed: tiogapass: Remove vuart Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.4 099/453] drm/amdgpu: fix build_coefficients() argument Greg Kroah-Hartman
2020-12-29 17:58   ` Pavel Machek
2020-12-30  9:22     ` Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.4 100/453] powerpc/64: Set up a kernel stack for secondaries before cpu_restore() Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.4 101/453] spi: img-spfi: fix reference leak in img_spfi_resume Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.4 102/453] f2fs: call f2fs_get_meta_page_retry for nat page Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.4 103/453] drm/msm/dsi_pll_10nm: restore VCO rate during restore_state Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.4 104/453] spi: spi-mem: fix reference leak in spi_mem_access_start Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.4 105/453] ASoC: pcm: DRAIN support reactivation Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.4 106/453] libbpf: Fix BTF data layout checks and allow empty BTF Greg Kroah-Hartman
2020-12-28 15:49   ` Naresh Kamboju
2020-12-28 19:47     ` Andrii Nakryiko
2020-12-28 23:09       ` Sasha Levin
2020-12-29  9:44         ` Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.4 107/453] selinux: fix inode_doinit_with_dentry() LABEL_INVALID error handling Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.4 108/453] spi: stm32: fix reference leak in stm32_spi_resume Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.4 109/453] brcmfmac: Fix memory leak for unpaired brcmf_{alloc/free} Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.4 110/453] arm64: dts: exynos: Include common syscon restart/poweroff for Exynos7 Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.4 111/453] arm64: dts: exynos: Correct psci compatible used on Exynos7 Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.4 112/453] Bluetooth: Fix null pointer dereference in hci_event_packet() Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.4 113/453] Bluetooth: hci_h5: fix memory leak in h5_close Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.4 114/453] spi: spi-ti-qspi: fix reference leak in ti_qspi_setup Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.4 115/453] spi: mt7621: fix missing clk_disable_unprepare() on error in mt7621_spi_probe Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.4 116/453] spi: tegra20-slink: fix reference leak in slink ops of tegra20 Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.4 117/453] spi: tegra20-sflash: fix reference leak in tegra_sflash_resume Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.4 118/453] spi: tegra114: fix reference leak in tegra spi ops Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.4 119/453] spi: bcm63xx-hsspi: fix missing clk_disable_unprepare() on error in bcm63xx_hsspi_resume Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.4 120/453] mwifiex: fix mwifiex_shutdown_sw() causing sw reset failure Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.4 121/453] selftest/bpf: Add missed ip6ip6 test back Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.4 122/453] ASoC: wm8998: Fix PM disable depth imbalance on error Greg Kroah-Hartman
2020-12-28 12:45 ` [PATCH 5.4 123/453] spi: sprd: fix reference leak in sprd_spi_remove Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.4 124/453] net: evaluate net.ipvX.conf.all.ignore_routes_with_linkdown Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.4 125/453] net: evaluate net.ipv4.conf.all.proxy_arp_pvlan Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.4 126/453] ASoC: arizona: Fix a wrong free in wm8997_probe Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.4 127/453] RDMa/mthca: Work around -Wenum-conversion warning Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.4 128/453] MIPS: BCM47XX: fix kconfig dependency bug for BCM47XX_BCMA Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.4 129/453] crypto: qat - fix status check in qat_hal_put_rel_rd_xfer() Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.4 130/453] staging: greybus: codecs: Fix reference counter leak in error handling Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.4 131/453] staging: gasket: interrupt: fix the missed eventfd_ctx_put() in gasket_interrupt.c Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.4 132/453] media: tm6000: Fix sizeof() mismatches Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.4 133/453] media: mtk-vcodec: add missing put_device() call in mtk_vcodec_init_dec_pm() Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.4 134/453] media: mtk-vcodec: add missing put_device() call in mtk_vcodec_release_dec_pm() Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.4 135/453] media: mtk-vcodec: add missing put_device() call in mtk_vcodec_init_enc_pm() Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.4 136/453] media: v4l2-fwnode: Return -EINVAL for invalid bus-type Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.4 137/453] ASoC: meson: fix COMPILE_TEST error Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.4 138/453] scsi: core: Fix VPD LUN ID designator priorities Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.4 139/453] media: solo6x10: fix missing snd_card_free in error handling case Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.4 140/453] video: fbdev: atmel_lcdfb: fix return error code in atmel_lcdfb_of_init() Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.4 141/453] drm/omap: dmm_tiler: fix return error code in omap_dmm_probe() Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.4 142/453] Input: ads7846 - fix race that causes missing releases Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.4 143/453] Input: ads7846 - fix integer overflow on Rt calculation Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.4 144/453] Input: ads7846 - fix unaligned access on 7845 Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.4 145/453] usb/max3421: fix return error code in max3421_probe() Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.4 146/453] spi: mxs: fix reference leak in mxs_spi_probe Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.4 147/453] selftests/bpf: Fix broken riscv build Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.4 148/453] powerpc: Avoid broken GCC __attribute__((optimize)) Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.4 149/453] powerpc/feature: Fix CPU_FTRS_ALWAYS by removing CPU_FTRS_GENERIC_32 Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.4 150/453] EDAC/mce_amd: Use struct cpuinfo_x86.cpu_die_id for AMD NodeId Greg Kroah-Hartman
2020-12-28 15:54   ` Borislav Petkov
2020-12-28 23:21     ` Sasha Levin
2020-12-28 12:46 ` [PATCH 5.4 151/453] crypto: crypto4xx - Replace bitwise OR with logical OR in crypto4xx_build_pd Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.4 152/453] crypto: omap-aes - Fix PM disable depth imbalance in omap_aes_probe Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.4 153/453] spi: fix resource leak for drivers without .remove callback Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.4 154/453] soc: ti: knav_qmss: fix reference leak in knav_queue_probe Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.4 155/453] soc: ti: Fix reference imbalance in knav_dma_probe Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.4 156/453] drivers: soc: ti: knav_qmss_queue: Fix error return code in knav_queue_probe Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.4 157/453] Input: omap4-keypad - fix runtime PM error handling Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.4 158/453] clk: meson: Kconfig: fix dependency for G12A Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.4 159/453] RDMA/cxgb4: Validate the number of CQEs Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.4 160/453] memstick: fix a double-free bug in memstick_check Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.4 161/453] ARM: dts: at91: sama5d4_xplained: add pincontrol for USB Host Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.4 162/453] ARM: dts: at91: sama5d3_xplained: " Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.4 163/453] mmc: pxamci: Fix error return code in pxamci_probe Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.4 164/453] orinoco: Move context allocation after processing the skb Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.4 165/453] qtnfmac: fix error return code in qtnf_pcie_probe() Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.4 166/453] rsi: fix error return code in rsi_reset_card() Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.4 167/453] cw1200: fix missing destroy_workqueue() on error in cw1200_init_common Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.4 168/453] dmaengine: mv_xor_v2: Fix error return code in mv_xor_v2_probe() Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.4 169/453] leds: netxbig: add missing put_device() call in netxbig_leds_get_of_pdata() Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.4 170/453] arm64: tegra: Fix DT binding for IO High Voltage entry Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.4 171/453] media: siano: fix memory leak of debugfs members in smsdvb_hotplug Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.4 172/453] platform/x86: mlx-platform: Remove PSU EEPROM from default platform configuration Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.4 173/453] platform/x86: mlx-platform: Remove PSU EEPROM from MSN274x " Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.4 174/453] samples: bpf: Fix lwt_len_hist reusing previous BPF map Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.4 175/453] media: imx214: Fix stop streaming Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.4 176/453] mips: cdmm: fix use-after-free in mips_cdmm_bus_discover Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.4 177/453] media: max2175: fix max2175_set_csm_mode() error code Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.4 178/453] slimbus: qcom-ngd-ctrl: Avoid sending power requests without QMI Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.4 179/453] HSI: omap_ssi: Dont jump to free ID in ssi_add_controller() Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.4 180/453] ARM: dts: Remove non-existent i2c1 from 98dx3236 Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.4 181/453] arm64: dts: armada-3720-turris-mox: update ethernet-phy handle name Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.4 182/453] arm64: dts: rockchip: Set dr_mode to "host" for OTG on rk3328-roc-cc Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 5.4 183/453] power: supply: axp288_charger: Fix HP Pavilion x2 10 DMI matching Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.4 184/453] power: supply: bq24190_charger: fix reference leak Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.4 185/453] genirq/irqdomain: Dont try to free an interrupt that has no mapping Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.4 186/453] arm64: dts: ls1028a: fix ENETC PTP clock input Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.4 187/453] arm64: dts: qcom: c630: Polish i2c-hid devices Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.4 188/453] PCI: Bounds-check command-line resource alignment requests Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.4 189/453] PCI: Fix overflow in " Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.4 190/453] PCI: iproc: Fix out-of-bound array accesses Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.4 191/453] arm64: dts: meson: fix spi-max-frequency on Khadas VIM2 Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.4 192/453] arm64: dts: meson-sm1: fix typo in opp table Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.4 193/453] soc: amlogic: canvas: add missing put_device() call in meson_canvas_get() Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.4 194/453] ARM: dts: at91: at91sam9rl: fix ADC triggers Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.4 195/453] platform/x86: dell-smbios-base: Fix error return code in dell_smbios_init Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.4 196/453] ath10k: Fix the parsing error in service available event Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.4 197/453] ath10k: Fix an error handling path Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.4 198/453] ath10k: Release some resources in " Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.4 199/453] SUNRPC: rpc_wake_up() should wake up tasks in the correct order Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.4 200/453] NFSv4.2: condition READDIRs mask for security label based on LSM state Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.4 201/453] SUNRPC: xprt_load_transport() needs to support the netid "rdma6" Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.4 202/453] NFSv4: Fix the alignment of page data in the getdeviceinfo reply Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.4 203/453] net: sunrpc: Fix snprintf return value check in do_xprt_debugfs Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.4 204/453] lockd: dont use interval-based rebinding over TCP Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.4 205/453] NFS: switch nfsiod to be an UNBOUND workqueue Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.4 206/453] selftests/seccomp: Update kernel config Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.4 207/453] vfio-pci: Use io_remap_pfn_range() for PCI IO memory Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.4 208/453] hwmon: (ina3221) Fix PM usage counter unbalance in ina3221_write_enable Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.4 209/453] media: saa7146: fix array overflow in vidioc_s_audio() Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.4 210/453] powerpc/perf: Fix crash with is_sier_available when pmu is not set Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.4 211/453] powerpc/64: Fix an EMIT_BUG_ENTRY in head_64.S Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.4 212/453] clocksource/drivers/orion: Add missing clk_disable_unprepare() on error path Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.4 213/453] clocksource/drivers/cadence_ttc: Fix memory leak in ttc_setup_clockevent() Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.4 214/453] iio: hrtimer-trigger: Mark hrtimer to expire in hard interrupt context Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.4 215/453] ARM: dts: at91: sama5d2: map securam as device Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.4 216/453] bpf: Fix bpf_put_raw_tracepoint()s use of __module_address() Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.4 217/453] pinctrl: falcon: add missing put_device() call in pinctrl_falcon_probe() Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.4 218/453] arm64: dts: rockchip: Fix UART pull-ups on rk3328 Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.4 219/453] memstick: r592: Fix error return in r592_probe() Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.4 220/453] MIPS: Dont round up kernel sections size for memblock_add() Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.4 221/453] net/mlx5: Properly convey driver version to firmware Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.4 222/453] ASoC: jz4740-i2s: add missed checks for clk_get() Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.4 223/453] dm ioctl: fix error return code in target_message Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.4 224/453] phy: renesas: rcar-gen3-usb2: disable runtime pm in case of failure Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.4 225/453] clocksource/drivers/arm_arch_timer: Use stable count reader in erratum sne Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.4 226/453] clocksource/drivers/arm_arch_timer: Correct fault programming of CNTKCTL_EL1.EVNTI Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.4 227/453] cpufreq: ap806: Add missing MODULE_DEVICE_TABLE Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.4 228/453] cpufreq: highbank: " Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.4 229/453] cpufreq: mediatek: " Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.4 230/453] cpufreq: qcom: " Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.4 231/453] cpufreq: st: " Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.4 232/453] cpufreq: sun50i: " Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.4 233/453] cpufreq: loongson1: Add missing MODULE_ALIAS Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.4 234/453] cpufreq: scpi: " Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.4 235/453] Bluetooth: btusb: Add the missed release_firmware() in btusb_mtk_setup_firmware() Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.4 236/453] Bluetooth: btmtksdio: Add the missed release_firmware() in mtk_setup_firmware() Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.4 237/453] arm64: dts: meson: fix PHY deassert timing requirements Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.4 238/453] ARM: " Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.4 239/453] arm64: dts: meson: g12a: x96-max: " Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.4 240/453] scsi: qedi: Fix missing destroy_workqueue() on error in __qedi_probe Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.4 241/453] scsi: pm80xx: Fix error return in pm8001_pci_probe() Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.4 242/453] seq_buf: Avoid type mismatch for seq_buf_init Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 5.4 243/453] scsi: fnic: Fix error return code in fnic_probe() Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.4 244/453] platform/x86: mlx-platform: Fix item counter assignment for MSN2700, MSN24xx systems Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.4 245/453] powerpc/pseries/hibernation: drop pseries_suspend_begin() from suspend ops Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.4 246/453] powerpc/pseries/hibernation: remove redundant cacheinfo update Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.4 247/453] drm/mediatek: avoid dereferencing a null hdmi_phy on an error message Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.4 248/453] ASoC: amd: change clk_get() to devm_clk_get() and add missed checks Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.4 249/453] powerpc/mm: sanity_check_fault() should work for all, not only BOOK3S Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.4 250/453] usb: ehci-omap: Fix PM disable depth umbalance in ehci_hcd_omap_probe Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.4 251/453] usb: oxu210hp-hcd: Fix memory leak in oxu_create Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.4 252/453] speakup: fix uninitialized flush_lock Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.4 253/453] nfsd: Fix message level for normal termination Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.4 254/453] nfs_common: need lock during iterate through the list Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.4 255/453] x86/kprobes: Restore BTF if the single-stepping is cancelled Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.4 256/453] platform/chrome: cros_ec_spi: Dont overwrite spi::mode Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.4 257/453] bus: fsl-mc: fix error return code in fsl_mc_object_allocate() Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.4 258/453] s390/cio: fix use-after-free in ccw_device_destroy_console Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.4 259/453] iwlwifi: mvm: hook up missing RX handlers Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.4 260/453] erofs: avoid using generic_block_bmap Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.4 261/453] can: m_can: m_can_config_endisable(): remove double clearing of clock stop request bit Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.4 262/453] RDMA/core: Do not indicate device ready when device enablement fails Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.4 263/453] remoteproc: q6v5-mss: fix error handling in q6v5_pds_enable Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.4 264/453] remoteproc: qcom: fix reference leak in adsp_start Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.4 265/453] remoteproc: qcom: Fix potential NULL dereference in adsp_init_mmio() Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.4 266/453] clk: tegra: Fix duplicated SE clock entry Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.4 267/453] mtd: rawnand: gpmi: fix reference count leak in gpmi ops Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.4 268/453] mtd: rawnand: meson: Fix a resource leak in init Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.4 269/453] mtd: rawnand: gpmi: Fix the random DMA timeout issue Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.4 270/453] extcon: max77693: Fix modalias string Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.4 271/453] crypto: atmel-i2c - select CONFIG_BITREVERSE Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.4 272/453] mac80211: dont set set TDLS STA bandwidth wider than possible Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.4 273/453] ASoC: wm_adsp: remove "ctl" from list on error in wm_adsp_create_control() Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.4 274/453] irqchip/alpine-msi: Fix freeing of interrupts on allocation error path Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.4 275/453] watchdog: armada_37xx: Add missing dependency on HAS_IOMEM Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.4 276/453] watchdog: sirfsoc: " Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.4 277/453] watchdog: sprd: remove watchdog disable from resume fail path Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.4 278/453] watchdog: sprd: check busy bit before new loading rather than after that Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.4 279/453] watchdog: Fix potential dereferencing of null pointer Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.4 280/453] ubifs: Fix error return code in ubifs_init_authentication() Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.4 281/453] um: Monitor error events in IRQ controller Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.4 282/453] um: tty: Fix handling of close in tty lines Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.4 283/453] um: chan_xterm: Fix fd leak Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.4 284/453] sunrpc: fix xs_read_xdr_buf for partial pages receive Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.4 285/453] RDMA/cma: Dont overwrite sgid_attr after device is released Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.4 286/453] nfc: s3fwrn5: Release the nfc firmware Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.4 287/453] powerpc/ps3: use dma_mapping_error() Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.4 288/453] sparc: fix handling of page table constructor failure Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.4 289/453] mm: dont wake kswapd prematurely when watermark boosting is disabled Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.4 290/453] checkpatch: fix unescaped left brace Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.4 291/453] lan743x: fix rx_napi_poll/interrupt ping-pong Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.4 292/453] net: bcmgenet: Fix a resource leak in an error handling path in the probe functin Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.4 293/453] net: allwinner: Fix some resources leak in the error handling path of the probe and in the remove function Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.4 294/453] net: korina: fix return value Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.4 295/453] libnvdimm/label: Return -ENXIO for no slot in __blk_label_update Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.4 296/453] watchdog: qcom: Avoid context switch in restart handler Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.4 297/453] watchdog: coh901327: add COMMON_CLK dependency Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.4 298/453] clk: ti: Fix memleak in ti_fapll_synth_setup Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.4 299/453] pwm: zx: Add missing cleanup in error path Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.4 301/453] perf record: Fix memory leak when using --user-regs=? to list registers Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.4 302/453] qlcnic: Fix error code in probe Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 5.4 303/453] virtio_ring: Cut and paste bugs in vring_create_virtqueue_packed() Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.4 304/453] virtio_net: Fix error code in probe() Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.4 305/453] virtio_ring: Fix two use after free bugs Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.4 306/453] clk: at91: sam9x60: remove atmel,osc-bypass support Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.4 307/453] clk: s2mps11: Fix a resource leak in error handling paths in the probe function Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.4 308/453] clk: sunxi-ng: Make sure divider tables have sentinel Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.4 309/453] kconfig: fix return value of do_error_if() Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.4 310/453] perf probe: Fix memory leak when synthesizing SDT probes Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.4 311/453] ARM: sunxi: Add machine match for the Allwinner V3 SoC Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.4 312/453] cfg80211: initialize rekey_data Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.4 313/453] [SECURITY] fix namespaced fscaps when !CONFIG_SECURITY Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.4 314/453] lwt: Disable BH too in run_lwt_bpf() Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.4 315/453] drm/amd/display: Prevent bandwidth overflow Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.4 316/453] drm/amdkfd: Fix leak in dmabuf import Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.4 317/453] Input: cros_ec_keyb - send scancodes in addition to key events Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.4 318/453] initramfs: fix clang build failure Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.4 319/453] Input: goodix - add upside-down quirk for Teclast X98 Pro tablet Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.4 320/453] vfio/pci/nvlink2: Do not attempt NPU2 setup on POWER8NVL NPU Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.4 321/453] media: gspca: Fix memory leak in probe Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.4 322/453] media: sunxi-cir: ensure IR is handled when it is continuous Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.4 323/453] media: netup_unidvb: Dont leak SPI master in probe error path Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.4 324/453] media: ipu3-cio2: Remove traces of returned buffers Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.4 325/453] media: ipu3-cio2: Return actual subdev format Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.4 326/453] media: ipu3-cio2: Serialise access to pad format Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.4 327/453] media: ipu3-cio2: Validate mbus format in setting subdev format Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.4 328/453] media: ipu3-cio2: Make the field on subdev format V4L2_FIELD_NONE Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.4 329/453] Input: cyapa_gen6 - fix out-of-bounds stack access Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.4 330/453] ALSA: hda/ca0132 - Change Input Source enum strings Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.4 331/453] PM: ACPI: PCI: Drop acpi_pm_set_bridge_wakeup() Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.4 332/453] Revert "ACPI / resources: Use AE_CTRL_TERMINATE to terminate resources walks" Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.4 333/453] ACPI: PNP: compare the string length in the matching_id() Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.4 334/453] ALSA: hda: Fix regressions on clear and reconfig sysfs Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.4 335/453] ALSA: hda/ca0132 - Fix AE-5 rear headphone pincfg Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.4 336/453] ALSA: hda/realtek: make bass spk volume adjustable on a yoga laptop Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.4 337/453] ALSA: hda/realtek - Enable headset mic of ASUS X430UN with ALC256 Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.4 338/453] ALSA: hda/realtek - Enable headset mic of ASUS Q524UQK with ALC255 Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.4 339/453] ALSA: hda/realtek - Add supported for more Lenovo ALC285 Headset Button Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.4 340/453] ALSA: pcm: oss: Fix a few more UBSAN fixes Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.4 341/453] ALSA/hda: apply jack fixup for the Acer Veriton N4640G/N6640G/N2510G Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.4 342/453] ALSA: hda/realtek: Add quirk for MSI-GP73 Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.4 343/453] ALSA: hda/realtek: Apply jack fixup for Quanta NL3 Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.4 344/453] ALSA: usb-audio: Add VID to support native DSD reproduction on FiiO devices Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.4 345/453] ALSA: usb-audio: Disable sample read check if firmware doesnt give back Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.4 346/453] ALSA: core: memalloc: add page alignment for iram Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.4 347/453] s390/smp: perform initial CPU reset also for SMT siblings Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.4 348/453] s390/kexec_file: fix diag308 subcode when loading crash kernel Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.4 349/453] s390/dasd: fix hanging device offline processing Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.4 350/453] s390/dasd: prevent inconsistent LCU device data Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.4 351/453] s390/dasd: fix list corruption of pavgroup group list Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.4 352/453] s390/dasd: fix list corruption of lcu list Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.4 353/453] binder: add flag to clear buffer on txn complete Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.4 354/453] ASoC: cx2072x: Fix doubly definitions of Playback and Capture streams Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.4 355/453] staging: comedi: mf6x4: Fix AI end-of-conversion detection Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.4 356/453] perf/x86/intel: Add event constraint for CYCLE_ACTIVITY.STALLS_MEM_ANY Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.4 357/453] perf/x86/intel: Fix rtm_abort_event encoding on Ice Lake Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.4 358/453] powerpc/perf: Exclude kernel samples while counting events in user space Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.4 359/453] crypto: ecdh - avoid unaligned accesses in ecdh_set_secret() Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.4 360/453] crypto: arm/aes-ce - work around Cortex-A57/A72 silion errata Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.4 361/453] EDAC/i10nm: Use readl() to access MMIO registers Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.4 362/453] EDAC/amd64: Fix PCI component registration Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 5.4 363/453] cpuset: fix race between hotplug work and later CPU offline Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.4 364/453] USB: serial: mos7720: fix parallel-port state restore Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.4 365/453] USB: serial: digi_acceleport: fix write-wakeup deadlocks Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.4 366/453] USB: serial: keyspan_pda: fix dropped unthrottle interrupts Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.4 367/453] USB: serial: keyspan_pda: fix write deadlock Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.4 368/453] USB: serial: keyspan_pda: fix stalled writes Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.4 369/453] USB: serial: keyspan_pda: fix write-wakeup use-after-free Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.4 370/453] USB: serial: keyspan_pda: fix tx-unthrottle use-after-free Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.4 371/453] USB: serial: keyspan_pda: fix write unthrottling Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.4 372/453] btrfs: do not shorten unpin len for caching block groups Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.4 373/453] btrfs: trim: fix underflow in trim length to prevent access beyond device boundary Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.4 374/453] ext4: fix a memory leak of ext4_free_data Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.4 375/453] ext4: fix deadlock with fs freezing and EA inodes Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.4 376/453] KVM: arm64: Introduce handling of AArch32 TTBCR2 traps Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.4 377/453] ARM: dts: pandaboard: fix pinmux for gpio user button of Pandaboard ES Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.4 378/453] ARM: dts: at91: sama5d2: fix CAN message ram offset and size Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.4 379/453] xprtrdma: Fix XDRBUF_SPARSE_PAGES support Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.4 380/453] powerpc: Fix incorrect stw{, ux, u, x} instructions in __set_pte_at Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.4 381/453] powerpc/rtas: Fix typo of ibm,open-errinjct in RTAS filter Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.4 382/453] powerpc/feature: Add CPU_FTR_NOEXECUTE to G2_LE Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.4 383/453] powerpc/xmon: Change printk() to pr_cont() Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.4 384/453] powerpc/8xx: Fix early debug when SMC1 is relocated Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.4 385/453] powerpc/mm: Fix verification of MMU_FTR_TYPE_44x Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.4 386/453] powerpc/powernv/npu: Do not attempt NPU2 setup on POWER8NVL NPU Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.4 387/453] powerpc/powernv/memtrace: Dont leak kernel memory to user space Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.4 388/453] powerpc/powernv/memtrace: Fix crashing the kernel when enabling concurrently Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.4 389/453] ima: Dont modify file descriptor mode on the fly Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.4 390/453] um: Remove use of asprinf in umid.c Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.4 391/453] ceph: fix race in concurrent __ceph_remove_cap invocations Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.4 392/453] SMB3: avoid confusing warning message on mount to Azure Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.4 393/453] ubifs: wbuf: Dont leak kernel memory to flash Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.4 394/453] jffs2: Fix GC exit abnormally Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.4 395/453] jffs2: Fix ignoring mounting options problem during remounting Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.4 396/453] jfs: Fix array index bounds check in dbAdjTree Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.4 397/453] drm/amd/display: Honor the offset for plane 0 Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.4 398/453] drm/amd/display: Fix memory leaks in S3 resume Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.4 399/453] drm/dp_aux_dev: check aux_dev before use in drm_dp_aux_dev_get_by_minor() Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.4 400/453] drm/i915: Fix mismatch between misplaced vma check and vma insert Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.4 401/453] spi: pxa2xx: Fix use-after-free on unbind Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.4 402/453] spi: spi-sh: " Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.4 403/453] spi: atmel-quadspi: " Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.4 404/453] spi: davinci: " Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.4 405/453] spi: fsl: fix use of spisel_boot signal on MPC8309 Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.4 406/453] spi: gpio: Dont leak SPI master in probe error path Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.4 407/453] spi: mxic: " Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.4 408/453] spi: pic32: Dont leak DMA channels " Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.4 409/453] spi: rb4xx: Dont leak SPI master " Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.4 410/453] spi: sc18is602: " Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.4 411/453] spi: st-ssc4: Fix unbalanced pm_runtime_disable() " Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.4 412/453] spi: synquacer: Disable clock " Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.4 413/453] spi: mt7621: " Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.4 414/453] spi: mt7621: Dont leak SPI master " Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.4 415/453] spi: atmel-quadspi: Disable clock " Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.4 416/453] spi: atmel-quadspi: Fix AHB memory accesses Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.4 417/453] soc: qcom: smp2p: Safely acquire spinlock without IRQs Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.4 418/453] mtd: spinand: Fix OOB read Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.4 419/453] mtd: parser: cmdline: Fix parsing of part-names with colons Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.4 420/453] mtd: rawnand: qcom: Fix DMA sync on FLASH_STATUS register read Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.4 421/453] mtd: rawnand: meson: fix meson_nfc_dma_buffer_release() arguments Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.4 422/453] scsi: qla2xxx: Fix crash during driver load on big endian machines Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 5.4 423/453] scsi: lpfc: Fix invalid sleeping context in lpfc_sli4_nvmet_alloc() Greg Kroah-Hartman
2020-12-28 12:51 ` [PATCH 5.4 424/453] scsi: lpfc: Re-fix use after free in lpfc_rq_buf_free() Greg Kroah-Hartman
2020-12-28 12:51 ` [PATCH 5.4 425/453] iio: buffer: Fix demux update Greg Kroah-Hartman
2020-12-28 12:51 ` [PATCH 5.4 426/453] iio: adc: rockchip_saradc: fix missing clk_disable_unprepare() on error in rockchip_saradc_resume Greg Kroah-Hartman
2020-12-28 12:51 ` [PATCH 5.4 427/453] iio:light:rpr0521: Fix timestamp alignment and prevent data leak Greg Kroah-Hartman
2020-12-28 12:51 ` [PATCH 5.4 428/453] iio:light:st_uvis25: " Greg Kroah-Hartman
2020-12-28 12:51 ` [PATCH 5.4 429/453] iio:magnetometer:mag3110: Fix alignment and data leak issues Greg Kroah-Hartman
2020-12-28 12:51 ` [PATCH 5.4 430/453] iio:pressure:mpl3115: Force alignment of buffer Greg Kroah-Hartman
2020-12-28 12:51 ` [PATCH 5.4 431/453] iio:imu:bmi160: Fix too large a buffer Greg Kroah-Hartman
2020-12-28 12:51 ` [PATCH 5.4 432/453] iio:adc:ti-ads124s08: Fix buffer being too long Greg Kroah-Hartman
2020-12-28 12:51 ` [PATCH 5.4 433/453] iio:adc:ti-ads124s08: Fix alignment and data leak issues Greg Kroah-Hartman
2020-12-28 12:51 ` [PATCH 5.4 434/453] md/cluster: block reshape with remote resync job Greg Kroah-Hartman
2020-12-28 12:51 ` [PATCH 5.4 435/453] md/cluster: fix deadlock when node is doing " Greg Kroah-Hartman
2020-12-28 12:51 ` [PATCH 5.4 436/453] pinctrl: sunxi: Always call chained_irq_{enter, exit} in sunxi_pinctrl_irq_handler Greg Kroah-Hartman
2020-12-28 12:51 ` [PATCH 5.4 437/453] clk: ingenic: Fix divider calculation with div tables Greg Kroah-Hartman
2020-12-28 12:51 ` [PATCH 5.4 438/453] clk: mvebu: a3700: fix the XTAL MODE pin to MPP1_9 Greg Kroah-Hartman
2020-12-28 12:51 ` [PATCH 5.4 439/453] clk: tegra: Do not return 0 on failure Greg Kroah-Hartman
2020-12-28 12:51 ` [PATCH 5.4 440/453] device-dax/core: Fix memory leak when rmmod dax.ko Greg Kroah-Hartman
2020-12-28 12:51 ` [PATCH 5.4 441/453] dma-buf/dma-resv: Respect num_fences when initializing the shared fence list Greg Kroah-Hartman
2020-12-28 12:51 ` [PATCH 5.4 442/453] xen-blkback: set ring->xenblkd to NULL after kthread_stop() Greg Kroah-Hartman
2020-12-28 12:51 ` [PATCH 5.4 443/453] xen/xenbus: Allow watches discard events before queueing Greg Kroah-Hartman
2020-12-28 12:51 ` [PATCH 5.4 444/453] xen/xenbus: Add will_handle callback support in xenbus_watch_path() Greg Kroah-Hartman
2020-12-28 12:51 ` [PATCH 5.4 445/453] xen/xenbus/xen_bus_type: Support will_handle watch callback Greg Kroah-Hartman
2020-12-28 12:51 ` [PATCH 5.4 446/453] xen/xenbus: Count pending messages for each watch Greg Kroah-Hartman
2020-12-28 12:51 ` [PATCH 5.4 447/453] xenbus/xenbus_backend: Disallow pending watch messages Greg Kroah-Hartman
2020-12-28 12:51 ` [PATCH 5.4 448/453] libnvdimm/namespace: Fix reaping of invalidated block-window-namespace labels Greg Kroah-Hartman
2020-12-28 12:51 ` [PATCH 5.4 449/453] platform/x86: intel-vbtn: Allow switch events on Acer Switch Alpha 12 Greg Kroah-Hartman
2020-12-28 12:51 ` [PATCH 5.4 450/453] PCI: Fix pci_slot_release() NULL pointer dereference Greg Kroah-Hartman
2020-12-28 12:51 ` [PATCH 5.4 451/453] regulator: axp20x: Fix DLDO2 voltage control register mask for AXP22x Greg Kroah-Hartman
2020-12-28 12:51 ` [PATCH 5.4 452/453] rtc: ep93xx: Fix NULL pointer dereference in ep93xx_rtc_read_time Greg Kroah-Hartman
2020-12-28 12:51 ` [PATCH 5.4 453/453] Revert: "ring-buffer: Remove HAVE_64BIT_ALIGNED_ACCESS" Greg Kroah-Hartman
2020-12-28 16:57 ` [PATCH 5.4 000/453] 5.4.86-rc1 review Naresh Kamboju
2020-12-28 17:33 ` Guenter Roeck
2020-12-29  9:46   ` Greg Kroah-Hartman
2020-12-28 20:18 ` Jon Hunter
2020-12-28 20:26 ` Guenter Roeck

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.