All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH 4.19 000/639] 4.19.99-stable review
@ 2020-01-24  9:22 Greg Kroah-Hartman
  2020-01-24  9:22 ` [PATCH 4.19 001/639] Revert "efi: Fix debugobjects warning on efi_rts_work" Greg Kroah-Hartman
                   ` (642 more replies)
  0 siblings, 643 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:22 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, torvalds, akpm, linux, shuah, patches,
	ben.hutchings, lkft-triage, stable

This is the start of the stable review cycle for the 4.19.99 release.
There are 639 patches in this series, all will be posted as a response
to this one.  If anyone has any issues with these being applied, please
let me know.

Responses should be made by Sun, 26 Jan 2020 09:26:29 +0000.
Anything received after that time might be too late.

The whole patch series can be found in one patch at:
	https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.99-rc1.gz
or in the git tree and branch at:
	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Linux 4.19.99-rc1

Finn Thain <fthain@telegraphics.com.au>
    m68k: Call timer_interrupt() with interrupts disabled

Christian Hewitt <christianshewitt@gmail.com>
    arm64: dts: meson-gxm-khadas-vim2: fix uart_A bluetooth node

Fabrice Gasnier <fabrice.gasnier@st.com>
    serial: stm32: fix clearing interrupt error flags

Max Gurtovoy <maxg@mellanox.com>
    IB/iser: Fix dma_nents type definition

Marc Gonzalez <marc.w.gonzalez@free.fr>
    usb: dwc3: Allow building USB_DWC3_QCOM without EXTCON

Jesper Dangaard Brouer <brouer@redhat.com>
    samples/bpf: Fix broken xdp_rxq_info due to map order assumptions

Andre Przywara <andre.przywara@arm.com>
    arm64: dts: juno: Fix UART frequency

Sam Bobroff <sbobroff@linux.ibm.com>
    drm/radeon: fix bad DMA from INTERRUPT_CNTL2

Chuhong Yuan <hslester96@gmail.com>
    dmaengine: ti: edma: fix missed failure handling

zhengbin <zhengbin13@huawei.com>
    afs: Remove set but not used variables 'before', 'after'

Navid Emamdoost <navid.emamdoost@gmail.com>
    affs: fix a memory leak in affs_remount

H. Nikolaus Schaller <hns@goldelico.com>
    mmc: core: fix wl1251 sdio quirks

H. Nikolaus Schaller <hns@goldelico.com>
    mmc: sdio: fix wl1251 vendor id

Alain Volmat <alain.volmat@st.com>
    i2c: stm32f7: report dma error during probe

Eric Dumazet <edumazet@google.com>
    packet: fix data-race in fanout_flow_is_huge()

Eric Dumazet <edumazet@google.com>
    net: neigh: use long type to store jiffies delta

Stephen Hemminger <sthemmin@microsoft.com>
    hv_netvsc: flag software created hash value

Tiezhu Yang <yangtiezhu@loongson.cn>
    MIPS: Loongson: Fix return value of loongson_hwmon_init

Madalin Bucur <madalin.bucur@nxp.com>
    dpaa_eth: avoid timestamp read on error paths

Madalin Bucur <madalin.bucur@nxp.com>
    dpaa_eth: perform DMA unmapping before read

Tony Lindgren <tony@atomide.com>
    hwrng: omap3-rom - Fix missing clock by probing with device tree

Dan Carpenter <dan.carpenter@oracle.com>
    drm: panel-lvds: Potential Oops in probe error handling

Marc Dionne <marc.dionne@auristor.com>
    afs: Fix large file support

Haiyang Zhang <haiyangz@microsoft.com>
    hv_netvsc: Fix send_table offset in case of a host bug

Haiyang Zhang <haiyangz@microsoft.com>
    hv_netvsc: Fix offset usage in netvsc_send_table()

Stefan Wahren <stefan.wahren@in-tech.com>
    net: qca_spi: Move reset_count to struct qcaspi

David Howells <dhowells@redhat.com>
    afs: Fix missing timeout reset

Dan Carpenter <dan.carpenter@oracle.com>
    bpf, offload: Unlock on error in bpf_offload_dev_create()

Magnus Karlsson <magnus.karlsson@intel.com>
    xsk: Fix registration of Rx-only sockets

Jakub Kicinski <jakub.kicinski@netronome.com>
    net: netem: correct the parent's backlog when corrupted packet was dropped

Jakub Kicinski <jakub.kicinski@netronome.com>
    net: netem: fix error path for corrupted GSO frames

Pavel Tatashin <pasha.tatashin@soleen.com>
    arm64: hibernate: check pgd table allocation

Jean Delvare <jdelvare@suse.de>
    firmware: dmi: Fix unlikely out-of-bounds read in save_mem_devices

Robin Gong <yibin.gong@nxp.com>
    dmaengine: imx-sdma: fix size check for sdma script_number

Michael S. Tsirkin <mst@redhat.com>
    vhost/test: stop device before reset

Jeffrey Hugo <jeffrey.l.hugo@gmail.com>
    drm/msm/dsi: Implement reset correctly

Karsten Graul <kgraul@linux.ibm.com>
    net/smc: receive pending data after RCV_SHUTDOWN

Karsten Graul <kgraul@linux.ibm.com>
    net/smc: receive returns without data

Eric Dumazet <edumazet@google.com>
    tcp: annotate lockless access to tcp_memory_pressure

Eric Dumazet <edumazet@google.com>
    net: add {READ|WRITE}_ONCE() annotations on ->rskq_accept_head

Eric Dumazet <edumazet@google.com>
    net: avoid possible false sharing in sk_leave_memory_pressure()

YueHaibing <yuehaibing@huawei.com>
    act_mirred: Fix mirred_init_module error handling

Alexandra Winter <wintera@linux.ibm.com>
    s390/qeth: Fix initialization of vnicc cmd masks during set online

Alexandra Winter <wintera@linux.ibm.com>
    s390/qeth: Fix error handling during VNICC initialization

Xin Long <lucien.xin@gmail.com>
    sctp: add chunks to sk_backlog when the newsk sk_socket is not set

Antonio Borneo <antonio.borneo@st.com>
    net: stmmac: fix disabling flexible PPS output

Antonio Borneo <antonio.borneo@st.com>
    net: stmmac: fix length of PTP clock's name string

Haishuang Yan <yanhaishuang@cmss.chinamobile.com>
    ip6erspan: remove the incorrect mtu limit for ip6erspan

Eric Biggers <ebiggers@google.com>
    llc: fix sk_buff refcounting in llc_conn_state_process()

Eric Biggers <ebiggers@google.com>
    llc: fix another potential sk_buff leak in llc_ui_sendmsg()

Johannes Berg <johannes.berg@intel.com>
    mac80211: accept deauth frames in IBSS mode

David Howells <dhowells@redhat.com>
    rxrpc: Fix trace-after-put looking at the put connection record

Jose Abreu <Jose.Abreu@synopsys.com>
    net: stmmac: gmac4+: Not all Unicast addresses may be available

Ard Biesheuvel <ard.biesheuvel@linaro.org>
    nvme: retain split access workaround for capability reads

Vladimir Oltean <olteanv@gmail.com>
    net: sched: cbs: Avoid division by zero when calculating the port rate

Dan Carpenter <dan.carpenter@oracle.com>
    net: ethernet: stmmac: Fix signedness bug in ipq806x_gmac_of_parse()

Dan Carpenter <dan.carpenter@oracle.com>
    net: nixge: Fix a signedness bug in nixge_probe()

Dan Carpenter <dan.carpenter@oracle.com>
    of: mdio: Fix a signedness bug in of_phy_get_and_connect()

Dan Carpenter <dan.carpenter@oracle.com>
    net: axienet: fix a signedness bug in probe

Dan Carpenter <dan.carpenter@oracle.com>
    net: stmmac: dwmac-meson8b: Fix signedness bug in probe

Dan Carpenter <dan.carpenter@oracle.com>
    net: socionext: Fix a signedness bug in ave_probe()

Dan Carpenter <dan.carpenter@oracle.com>
    net: netsec: Fix signedness bug in netsec_probe()

Dan Carpenter <dan.carpenter@oracle.com>
    net: broadcom/bcmsysport: Fix signedness in bcm_sysport_probe()

Dan Carpenter <dan.carpenter@oracle.com>
    net: hisilicon: Fix signedness bug in hix5hd2_dev_probe()

Dan Carpenter <dan.carpenter@oracle.com>
    cxgb4: Signedness bug in init_one()

Dan Carpenter <dan.carpenter@oracle.com>
    net: aquantia: Fix aq_vec_isr_legacy() return value

Filippo Sironi <sironi@amazon.de>
    iommu/amd: Wait for completion of IOTLB flush in attach_device

Yunfeng Ye <yeyunfeng@huawei.com>
    crypto: hisilicon - Matching the dma address for dma_pool_free()

Alexei Starovoitov <ast@kernel.org>
    bpf: fix BTF limits

Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
    powerpc/mm/mce: Keep irqs disabled during lockless page table walk

Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
    clk: actions: Fix factor clk struct member access

Jorge Ramirez-Ortiz <jorge.ramirez-ortiz@linaro.org>
    mailbox: qcom-apcs: fix max_register value

Chao Yu <yuchao0@huawei.com>
    f2fs: fix to avoid accessing uninitialized field of inode page in is_alive()

Vasundhara Volam <vasundhara-v.volam@broadcom.com>
    bnxt_en: Increase timeout for HWRM_DBG_COREDUMP_XX commands

Anton Ivanov <anton.ivanov@cambridgegreys.com>
    um: Fix off by one error in IRQ enumeration

Gerd Rausch <gerd.rausch@oracle.com>
    net/rds: Fix 'ib_evt_handler_call' element in 'rds_ib_stat_names'

Håkon Bugge <haakon.bugge@oracle.com>
    RDMA/cma: Fix false error message

Nicolas Boichat <drinkcat@chromium.org>
    ath10k: adjust skb length in ath10k_sdio_mbox_rx_packet

Rashmica Gupta <rashmica.g@gmail.com>
    gpio/aspeed: Fix incorrect number of banks

Li Jin <li.jin@broadcom.com>
    pinctrl: iproc-gpio: Fix incorrect pinconf configurations

Mao Wenan <maowenan@huawei.com>
    net: sonic: replace dev_kfree_skb in sonic_send_packet

Dan Robertson <dan@dlrobertson.com>
    hwmon: (shtc1) fix shtc1 and shtw1 id mask

Firo Yang <firo.yang@suse.com>
    ixgbe: sync the first fragment unconditionally

Omar Sandoval <osandov@fb.com>
    btrfs: use correct count in btrfs_file_write_iter()

Filipe Manana <fdmanana@suse.com>
    Btrfs: fix inode cache waiters hanging on path allocation failure

Filipe Manana <fdmanana@suse.com>
    Btrfs: fix inode cache waiters hanging on failure to start caching thread

Filipe Manana <fdmanana@suse.com>
    Btrfs: fix hang when loading existing inode cache off disk

Govindarajulu Varadarajan <gvaradar@cisco.com>
    scsi: fnic: fix msix interrupt allocation

Chao Yu <yuchao0@huawei.com>
    f2fs: fix error path of f2fs_convert_inline_page()

Chao Yu <yuchao0@huawei.com>
    f2fs: fix wrong error injection path in inc_valid_block_count()

Adam Ford <aford173@gmail.com>
    ARM: dts: logicpd-som-lv: Fix i2c2 and i2c3 Pin mux

Wei Yongjun <weiyongjun1@huawei.com>
    rtlwifi: Fix file release memory leak

Jian Shen <shenjian15@huawei.com>
    net: hns3: fix error VF index when setting VLAN offload

Mao Wenan <maowenan@huawei.com>
    net: sonic: return NETDEV_TX_OK if failed to map buffer

Oleh Kravchenko <oleg@kaa.org.ua>
    led: triggers: Fix dereferencing of null pointer

Björn Töpel <bjorn.topel@intel.com>
    xsk: avoid store-tearing when assigning umem

Björn Töpel <bjorn.topel@intel.com>
    xsk: avoid store-tearing when assigning queues

Oscar A Perez <linux@neuralgames.com>
    ARM: dts: aspeed-g5: Fixe gpio-ranges upper limit

Andrey Smirnov <andrew.smirnov@gmail.com>
    tty: serial: fsl_lpuart: Use appropriate lpuart32_* I/O funcs

Arnd Bergmann <arnd@arndb.de>
    wcn36xx: use dynamic allocation for large variables

Lorenzo Bianconi <lorenzo@kernel.org>
    ath9k: dynack: fix possible deadlock in ath_dynack_node_{de}init

Pablo Neira Ayuso <pablo@netfilter.org>
    netfilter: ctnetlink: honor IPS_OFFLOAD flag

Colin Ian King <colin.king@canonical.com>
    iio: dac: ad5380: fix incorrect assignment to val

Dan Carpenter <dan.carpenter@oracle.com>
    bcache: Fix an error code in bch_dump_read()

YueHaibing <yuehaibing@huawei.com>
    usb: typec: tps6598x: Fix build error without CONFIG_REGMAP_I2C

Colin Ian King <colin.king@canonical.com>
    bcma: fix incorrect update of BCMA_CORE_PCI_MDIO_DATA

Dexuan Cui <decui@microsoft.com>
    irqdomain: Add the missing assignment of domain->fwnode for named fwnode

Dan Carpenter <dan.carpenter@oracle.com>
    staging: greybus: light: fix a couple double frees

Masami Hiramatsu <mhiramat@kernel.org>
    x86, perf: Fix the dependency of the x86 insn decoder selftest

Stephen Boyd <swboyd@chromium.org>
    power: supply: Init device wakeup after device_add()

Vladimir Oltean <olteanv@gmail.com>
    net/sched: cbs: Set default link speed to 10 Mbps in cbs_set_port_rate

Guenter Roeck <linux@roeck-us.net>
    hwmon: (lm75) Fix write operations for negative temperatures

Linus Torvalds <torvalds@linux-foundation.org>
    Partially revert "kfifo: fix kfifo_alloc() and kfifo_init()"

David Howells <dhowells@redhat.com>
    rxrpc: Fix lack of conn cleanup when local endpoint is cleaned up [ver #2]

Andy Shevchenko <andriy.shevchenko@linux.intel.com>
    ahci: Do not export local variable ahci_em_messages

Yong Wu <yong.wu@mediatek.com>
    iommu/mediatek: Fix iova_to_phys PA start for 4GB mode

Markus Elfring <elfring@users.sourceforge.net>
    media: em28xx: Fix exception handling in em28xx_alloc_urbs()

Nick Desaulniers <ndesaulniers@google.com>
    mips: avoid explicit UB in assignment of mips_io_port_base

Bruno Thomsen <bruno.thomsen@gmail.com>
    rtc: pcf2127: bugfix: read rtc disables watchdog

Geert Uytterhoeven <geert@linux-m68k.org>
    ARM: 8896/1: VDSO: Don't leak kernel addresses

Alexandre Kroupski <alexandre.kroupski@ingenico.com>
    media: atmel: atmel-isi: fix timeout value for stop streaming

Arnd Bergmann <arnd@arndb.de>
    i40e: reduce stack usage in i40e_set_fc

Felix Fietkau <nbd@nbd.name>
    mac80211: minstrel_ht: fix per-group max throughput rate initialization

Dan Carpenter <dan.carpenter@oracle.com>
    rtc: rv3029: revert error handling patch to rv3029_eeprom_write()

Andy Shevchenko <andriy.shevchenko@linux.intel.com>
    dmaengine: dw: platform: Switch to acpi_dma_controller_register()

Maxime Ripard <maxime.ripard@bootlin.com>
    ASoC: sun4i-i2s: RX and TX counter registers are swapped

Nicholas Piggin <npiggin@gmail.com>
    powerpc/64s/radix: Fix memory hot-unplug page table split

Eric W. Biederman <ebiederm@xmission.com>
    signal: Allow cifs and drbd to receive their terminating signals

Vasundhara Volam <vasundhara-v.volam@broadcom.com>
    bnxt_en: Fix handling FRAG_ERR when NVM_INSTALL_UPDATE cmd fails

Fabrizio Castro <fabrizio.castro@bp.renesas.com>
    drm: rcar-du: lvds: Fix bridge_to_rcar_lvds

Quentin Monnet <quentin.monnet@netronome.com>
    tools: bpftool: fix format strings and arguments for jsonw_printf()

Quentin Monnet <quentin.monnet@netronome.com>
    tools: bpftool: fix arguments for p_err() in do_event_pipe()

Gerd Rausch <gerd.rausch@oracle.com>
    net/rds: Add a few missing rds_stat_names entries

YueHaibing <yuehaibing@huawei.com>
    ASoC: wm8737: Fix copy-paste error in wm8737_snd_controls

YueHaibing <yuehaibing@huawei.com>
    ASoC: cs4349: Use PM ops 'cs4349_runtime_pm'

YueHaibing <yuehaibing@huawei.com>
    ASoC: es8328: Fix copy-paste error in es8328_right_line_controls

Xi Wang <wangxi11@huawei.com>
    RDMA/hns: bugfix for slab-out-of-bounds when loading hip08 driver

Xi Wang <wangxi11@huawei.com>
    RDMA/hns: Bugfix for slab-out-of-bounds when unloading hip08 driver

Colin Ian King <colin.king@canonical.com>
    ext4: set error return correctly when ext4_htree_store_dirent fails

Iuliana Prodan <iuliana.prodan@nxp.com>
    crypto: caam - free resources in case caam_rng registration failed

Chuhong Yuan <hslester96@gmail.com>
    cxgb4: smt: Add lock for atomic_dec_and_test

Rayagonda Kokatanur <rayagonda.kokatanur@broadcom.com>
    spi: bcm-qspi: Fix BSPI QUAD and DUAL mode support when using flex mode

Jesper Dangaard Brouer <brouer@redhat.com>
    net: fix bpf_xdp_adjust_head regression for generic-XDP

Chuhong Yuan <hslester96@gmail.com>
    iio: tsl2772: Use devm_add_action_or_reset for tsl2772_chip_off

Steve French <stfrench@microsoft.com>
    cifs: fix rmmod regression in cifs.ko caused by force_sig changes

Mark Zhang <markz@mellanox.com>
    net/mlx5: Fix mlx5_ifc_query_lag_out_bits

Fabrice Gasnier <fabrice.gasnier@st.com>
    ARM: dts: stm32: add missing vdda-supply to adc on stm32h743i-eval

Jon Maloy <jon.maloy@ericsson.com>
    tipc: reduce risk of wakeup queue starvation

Yoshihiro Kaneko <ykaneko0929@gmail.com>
    arm64: dts: renesas: r8a77995: Fix register range of display node

Johannes Berg <johannes@sipsolutions.net>
    ALSA: aoa: onyx: always initialize register read value

Arnd Bergmann <arnd@arndb.de>
    crypto: ccp - Reduce maximum stack usage

Thomas Gleixner <tglx@linutronix.de>
    x86/kgbd: Use NMI_VECTOR not APIC_DM_NMI

Arnd Bergmann <arnd@arndb.de>
    mic: avoid statically declaring a 'struct device'.

Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
    media: rcar-vin: Clean up correct notifier in error path

Ruslan Bilovol <ruslan.bilovol@gmail.com>
    usb: host: xhci-hub: fix extra endianness conversion

Arnd Bergmann <arnd@arndb.de>
    qed: reduce maximum stack frame size

YueHaibing <yuehaibing@huawei.com>
    libertas_tf: Use correct channel range in lbtf_geo_init

Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    PM: sleep: Fix possible overflow in pm_system_cancel_wakeup()

Icenowy Zheng <icenowy@aosc.io>
    clk: sunxi-ng: v3s: add the missing PLL_DDR1

Jani Nikula <jani.nikula@intel.com>
    drm/panel: make drm_panel.h self-contained

Nicolas Dichtel <nicolas.dichtel@6wind.com>
    xfrm interface: ifname may be wrong in logs

Colin Ian King <colin.king@canonical.com>
    scsi: libfc: fix null pointer dereference on a null lport

Masahiro Yamada <yamada.masahiro@socionext.com>
    ARM: stm32: use "depends on" instead of "if" after prompt

Ilya Maximets <i.maximets@samsung.com>
    xdp: fix possible cq entry leak

Arnd Bergmann <arnd@arndb.de>
    x86/pgtable/32: Fix LOWMEM_PAGES constant

Jakub Kicinski <jakub.kicinski@netronome.com>
    net/tls: fix socket wmem accounting on fallback with netem

Wen Yang <wen.yang99@zte.com.cn>
    net: pasemi: fix an use-after-free in pasemi_mac_phy_init()

David Disseldorp <ddiss@suse.de>
    ceph: fix "ceph.dir.rctime" vxattr value

Hou Zhiqiang <Zhiqiang.Hou@nxp.com>
    PCI: mobiveil: Fix the valid check for inbound and outbound windows

Hou Zhiqiang <Zhiqiang.Hou@nxp.com>
    PCI: mobiveil: Fix devfn check in mobiveil_pcie_valid_device()

Hou Zhiqiang <Zhiqiang.Hou@nxp.com>
    PCI: mobiveil: Remove the flag MSI_FLAG_MULTI_PCI_MSI

Xi Wang <wangxi11@huawei.com>
    RDMA/hns: Fixs hw access invalid dma memory error

Eddie James <eajames@linux.ibm.com>
    fsi: sbefifo: Don't fail operations when in SBE IPL state

Arnd Bergmann <arnd@arndb.de>
    devres: allow const resource arguments

Jeremy Kerr <jk@ozlabs.org>
    fsi/core: Fix error paths on CFAM init

Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    ACPI: PM: Introduce "poweroff" callbacks for ACPI PM domain and LPSS

Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    ACPI: PM: Simplify and fix PM domain hibernation callbacks

Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    PM: ACPI/PCI: Resume all devices during hibernation

Jouni Malinen <j@w1.fi>
    um: Fix IRQ controller regression on console read

Chuck Lever <chuck.lever@oracle.com>
    xprtrdma: Fix use-after-free in rpcrdma_post_recvs

David Howells <dhowells@redhat.com>
    rxrpc: Fix uninitialized error code in rxrpc_send_data_packet()

Andy Shevchenko <andriy.shevchenko@linux.intel.com>
    mfd: intel-lpss: Release IDA resources

Kevin Mitchell <kevmitch@arista.com>
    iommu/amd: Make iommu_disable safer

Michael Chan <michael.chan@broadcom.com>
    bnxt_en: Suppress error messages when querying DSCP DCB capabilities.

Michael Chan <michael.chan@broadcom.com>
    bnxt_en: Fix ethtool selftest crash under error conditions.

Andrea Arcangeli <aarcange@redhat.com>
    fork,memcg: alloc_thread_stack_node needs to set tsk->stack

Matthias Kaehlcke <mka@chromium.org>
    backlight: pwm_bl: Fix heuristic to determine number of brightness levels

Jakub Kicinski <jakub.kicinski@netronome.com>
    tools: bpftool: use correct argument in cgroup errors

Bryan O'Donoghue <pure.logic@nexus-software.ie>
    nvmem: imx-ocotp: Change TIMING calculation to u-boot algorithm

Bryan O'Donoghue <pure.logic@nexus-software.ie>
    nvmem: imx-ocotp: Ensure WAIT bits are preserved when setting timing

Nathan Huckleberry <nhuck@google.com>
    clk: qcom: Fix -Wunused-const-variable

Andy Shevchenko <andriy.shevchenko@linux.intel.com>
    dmaengine: hsu: Revert "set HSU_CH_MTSR to memory width"

Ravi Bangoria <ravi.bangoria@linux.ibm.com>
    perf/ioctl: Add check for the sample_period value

Stefano Brivio <sbrivio@redhat.com>
    ip6_fib: Don't discard nodes with valid routing information in fib6_locate_1()

Rob Clark <robdclark@chromium.org>
    drm/msm/a3xx: remove TPL1 regs from snapshot

Chen-Yu Tsai <wens@csie.org>
    arm64: dts: allwinner: h6: Pine H64: Add interrupt line for RTC

YueHaibing <yuehaibing@huawei.com>
    net/sched: cbs: Fix error path of cbs_module_init

Fabrizio Castro <fabrizio.castro@bp.renesas.com>
    ARM: dts: iwg20d-q7-common: Fix SDHI1 VccQ regularor

Chen-Yu Tsai <wens@csie.org>
    rtc: pcf8563: Clear event flags and disable interrupts before requesting irq

Chen-Yu Tsai <wens@csie.org>
    rtc: pcf8563: Fix interrupt trigger method

Peter Ujfalusi <peter.ujfalusi@ti.com>
    ASoC: ti: davinci-mcasp: Fix slot mask settings when using multiple AXRs

Julian Wiedmann <jwi@linux.ibm.com>
    net/af_iucv: always register net_device notifier

Julian Wiedmann <jwi@linux.ibm.com>
    net/af_iucv: build proper skbs for HiperTransport

Fred Klassen <fklassen@appneta.com>
    net/udp_gso: Allow TX timestamp with UDP GSO

Jakub Kicinski <jakub.kicinski@netronome.com>
    net: netem: fix backlog accounting for corrupted GSO frames

Jeffrey Hugo <jeffrey.l.hugo@gmail.com>
    drm/msm/mdp5: Fix mdp5_cfg_init error return

Mike Marciniszyn <mike.marciniszyn@intel.com>
    IB/hfi1: Handle port down properly in pio

Anton Protopopov <a.s.protopopov@gmail.com>
    bpf: fix the check that forwarding is enabled in bpf_ipv6_fib_lookup

Nathan Lynch <nathanl@linux.ibm.com>
    powerpc/pseries/mobility: rebuild cacheinfo hierarchy post-migration

Nathan Lynch <nathanl@linux.ibm.com>
    powerpc/cacheinfo: add cacheinfo_teardown, cacheinfo_rebuild

Michal Kalderon <michal.kalderon@marvell.com>
    qed: iWARP - fix uninitialized callback

Michal Kalderon <michal.kalderon@marvell.com>
    qed: iWARP - Use READ_ONCE and smp_store_release to access ep->state

Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    PCI: PM: Skip devices in D0 for suspend-to-idle

Jerome Brunet <jbrunet@baylibre.com>
    ASoC: meson: axg-tdmout: right_j is not supported

Jerome Brunet <jbrunet@baylibre.com>
    ASoC: meson: axg-tdmin: right_j is not supported

Dan Carpenter <dan.carpenter@oracle.com>
    ntb_hw_switchtec: potential shift wrapping bug in switchtec_ntb_init_sndev()

Peng Fan <peng.fan@nxp.com>
    firmware: arm_scmi: update rate_discrete in clock_describe_rates_get

Sudeep Holla <sudeep.holla@arm.com>
    firmware: arm_scmi: fix bitfield definitions for SENSOR_DESC attributes

Florian Fainelli <f.fainelli@gmail.com>
    phy: usb: phy-brcm-usb: Remove sysfs attributes upon driver removal

Eric Auger <eric.auger@redhat.com>
    iommu/vt-d: Duplicate iommu_resv_region objects per device list

Christian Hewitt <christianshewitt@gmail.com>
    arm64: dts: meson-gxm-khadas-vim2: fix Bluetooth support

Christian Hewitt <christianshewitt@gmail.com>
    arm64: dts: meson-gxm-khadas-vim2: fix gpio-keys-polled node

Borut Seljak <borut.seljak@t-2.net>
    serial: stm32: fix a recursive locking in stm32_config_rs485

George Wilkie <gwilkie@vyatta.att-mail.com>
    mpls: fix warning with multi-label encap

Takeshi Kihara <takeshi.kihara.df@renesas.com>
    arm64: dts: renesas: ebisu: Remove renesas, no-ether-link property

Antoine Tenart <antoine.tenart@bootlin.com>
    crypto: inside-secure - fix queued len computation

Antoine Tenart <antoine.tenart@bootlin.com>
    crypto: inside-secure - fix zeroing of the request in ahash_exit_inv

Colin Ian King <colin.king@canonical.com>
    media: vivid: fix incorrect assignment operation when setting video mode

Ondrej Jirman <megous@megous.com>
    clk: sunxi-ng: sun50i-h6-r: Fix incorrect W1 clock gate register

Florian Fainelli <f.fainelli@gmail.com>
    cpufreq: brcmstb-avs-cpufreq: Fix types for voltage/frequency

Florian Fainelli <f.fainelli@gmail.com>
    cpufreq: brcmstb-avs-cpufreq: Fix initial command check

Colin Ian King <colin.king@canonical.com>
    phy: qcom-qusb2: fix missing assignment of ret when calling clk_prepare_enable

Jakub Kicinski <jakub.kicinski@netronome.com>
    net: don't clear sock->sk early to avoid trouble in strparser

Dan Carpenter <dan.carpenter@oracle.com>
    RDMA/uverbs: check for allocation failure in uapi_add_elm()

Stephen Hemminger <stephen@networkplumber.org>
    net: core: support XDP generic on stacked devices.

Stephen Hemminger <stephen@networkplumber.org>
    netvsc: unshare skb in VF rx handler

Christophe Leroy <christophe.leroy@c-s.fr>
    crypto: talitos - fix AEAD processing.

Christophe JAILLET <christophe.jaillet@wanadoo.fr>
    media: Staging: media: Release the correct resource in an error handling path

Huazhong Tan <tanhuazhong@huawei.com>
    net: hns3: fix a memory leak issue for hclge_map_unmap_ring_to_vf_vector

Eric Dumazet <edumazet@google.com>
    inet: frags: call inet_frags_fini() after unregister_pernet_subsys()

Eric W. Biederman <ebiederm@xmission.com>
    signal/cifs: Fix cifs_put_tcp_session to call send_sig instead of force_sig

Eric W. Biederman <ebiederm@xmission.com>
    signal/bpfilter: Fix bpfilter_kernl to use send_sig not force_sig

Lu Baolu <baolu.lu@linux.intel.com>
    iommu: Use right function to get group for device

Lu Baolu <baolu.lu@linux.intel.com>
    iommu: Add missing new line for dma type

Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    PCI: PM: Avoid possible suspend-to-idle issue

Nathan Chancellor <natechancellor@gmail.com>
    misc: sgi-xp: Properly initialize buf in xpc_get_rsvd_page_pa

Erwan Le Ray <erwan.leray@st.com>
    serial: stm32: fix wakeup source initialization

Erwan Le Ray <erwan.leray@st.com>
    serial: stm32: Add support of TC bit status check

Erwan Le Ray <erwan.leray@st.com>
    serial: stm32: fix transmit_chars when tx is stopped

Erwan Le Ray <erwan.leray@st.com>
    serial: stm32: fix rx data length when parity enabled

Erwan Le Ray <erwan.leray@st.com>
    serial: stm32: fix rx error handling

Erwan Le Ray <erwan.leray@st.com>
    serial: stm32: fix word length configuration

Hook, Gary <Gary.Hook@amd.com>
    crypto: ccp - Fix 3DES complaint from ccp-crypto module

Hook, Gary <Gary.Hook@amd.com>
    crypto: ccp - fix AES CFB error exposed by new test vectors

Christophe Leroy <christophe.leroy@c-s.fr>
    spi: spi-fsl-spi: call spi_finalize_current_message() at the end

Sagiv Ozeri <sagiv.ozeri@marvell.com>
    RDMA/qedr: Fix incorrect device rate.

Jerome Brunet <jbrunet@baylibre.com>
    arm64: dts: meson: libretech-cc: set eMMC as removable

Jon Hunter <jonathanh@nvidia.com>
    dmaengine: tegra210-adma: Fix crash during probe

Jerome Brunet <jbrunet@baylibre.com>
    clk: meson: axg: spread spectrum is on mpll2

Jerome Brunet <jbrunet@baylibre.com>
    clk: meson: gxbb: no spread spectrum on mpll0

Jernej Skrabec <jernej.skrabec@siol.net>
    ARM: dts: sun8i-h3: Fix wifi in Beelink X2 DT

David Howells <dhowells@redhat.com>
    afs: Fix double inc of vnode->cb_break

David Howells <dhowells@redhat.com>
    afs: Fix lock-wait/callback-break double locking

David Howells <dhowells@redhat.com>
    afs: Don't invalidate callback if AFS_VNODE_DIR_VALID not set

David Howells <dhowells@redhat.com>
    afs: Fix key leak in afs_release() and afs_evict_inode()

Robert Richter <rrichter@marvell.com>
    EDAC/mc: Fix edac_mc_find() in case no device is found

Matthias Kaehlcke <mka@chromium.org>
    thermal: cpu_cooling: Actually trace CPU load in thermal_power_cpu_get_power

Jiada Wang <jiada_wang@mentor.com>
    thermal: rcar_gen3_thermal: fix interrupt type

Brian Masney <masneyb@onstation.org>
    backlight: lm3630a: Return 0 on success in update_status functions

Florian Westphal <fw@strlen.de>
    netfilter: nf_tables: correct NFT_LOGLEVEL_MAX value

Dan Carpenter <dan.carpenter@oracle.com>
    kdb: do a sanity check on the cpu in kdb_per_cpu()

Jiong Wang <jiong.wang@netronome.com>
    nfp: bpf: fix static check error through tightening shift amount adjustment

Russell King <rmk+kernel@armlinux.org.uk>
    ARM: riscpc: fix lack of keyboard interrupts after irq conversion

Bichao Zheng <bichao.zheng@amlogic.com>
    pwm: meson: Don't disable PWM when setting duty repeatedly

Martin Blumenstingl <martin.blumenstingl@googlemail.com>
    pwm: meson: Consider 128 a valid pre-divider

Florian Westphal <fw@strlen.de>
    netfilter: ebtables: CONFIG_COMPAT: reject trailing data after last rule

Iuliana Prodan <iuliana.prodan@nxp.com>
    crypto: caam - fix caam_dump_sg that iterates through scatterlist

Dan Carpenter <dan.carpenter@oracle.com>
    platform/x86: alienware-wmi: printing the wrong error code

Dan Carpenter <dan.carpenter@oracle.com>
    media: davinci/vpbe: array underflow in vpbe_enum_outputs()

Dan Carpenter <dan.carpenter@oracle.com>
    media: omap_vout: potential buffer overflow in vidioc_dqbuf()

Takashi Iwai <tiwai@suse.de>
    ALSA: aica: Fix a long-time build breakage

YueHaibing <yuehaibing@huawei.com>
    l2tp: Fix possible NULL pointer dereference

Parav Pandit <parav@mellanox.com>
    vfio/mdev: Fix aborting mdev child device removal if one fails

Parav Pandit <parav@mellanox.com>
    vfio/mdev: Follow correct remove sequence

Parav Pandit <parav@mellanox.com>
    vfio/mdev: Avoid release parent reference during error path

David Howells <dhowells@redhat.com>
    afs: Fix the afs.cell and afs.volume xattr handlers

Rakesh Pillai <pillair@codeaurora.org>
    ath10k: Fix encoding for protected management frames

Igor Konopko <igor.j.konopko@intel.com>
    lightnvm: pblk: fix lock order in pblk_rb_tear_down_check

Pan Bian <bianpan2016@163.com>
    mmc: core: fix possible use after free of host

Guenter Roeck <linux@roeck-us.net>
    watchdog: rtd119x_wdt: Fix remove function

Sameer Pujar <spujar@nvidia.com>
    dmaengine: tegra210-adma: restore channel status

Sameeh Jubran <sameehj@amazon.com>
    net: ena: fix ena_com_fill_hash_function() implementation

Sameeh Jubran <sameehj@amazon.com>
    net: ena: fix incorrect test of supported hash function

Sameeh Jubran <sameehj@amazon.com>
    net: ena: fix: Free napi resources when ena_up() fails

Sameeh Jubran <sameehj@amazon.com>
    net: ena: fix swapped parameters when calling ena_com_indirect_table_fill_entry

Lu Baolu <baolu.lu@linux.intel.com>
    iommu/vt-d: Make kernel parameter igfx_off work with vIOMMU

Parav Pandit <parav@mellanox.com>
    RDMA/rxe: Consider skb reserve space based on netdev of GID

Jack Morgenstein <jackm@dev.mellanox.co.il>
    IB/mlx5: Add missing XRC options to QP optional params mask

Minas Harutyunyan <minas.harutyunyan@synopsys.com>
    dwc2: gadget: Fix completed transfer size calculation in DDMA

Arnd Bergmann <arnd@arndb.de>
    usb: gadget: fsl: fix link error against usb-gadget module

Jerome Brunet <jbrunet@baylibre.com>
    ASoC: fix valid stream condition

Willem de Bruijn <willemb@google.com>
    packet: in recvmsg msg_name return at least sizeof sockaddr_ll

Adam Ford <aford173@gmail.com>
    ARM: dts: logicpd-som-lv: Fix MMC1 card detect

Srinath Mannam <srinath.mannam@broadcom.com>
    PCI: iproc: Enable iProc config read for PAXBv2

Pablo Neira Ayuso <pablo@netfilter.org>
    netfilter: nft_flow_offload: add entry to flowtable after confirmation

Alexey Kardashevskiy <aik@ozlabs.ru>
    KVM: PPC: Book3S HV: Fix lockdep warning when entering the guest

Bart Van Assche <bvanassche@acm.org>
    scsi: qla2xxx: Avoid that qlt_send_resp_ctio() corrupts memory

Bart Van Assche <bvanassche@acm.org>
    scsi: qla2xxx: Fix error handling in qlt_alloc_qfull_cmd()

Bart Van Assche <bvanassche@acm.org>
    scsi: qla2xxx: Fix a format specifier

Hongbo Yao <yaohongbo@huawei.com>
    irqchip/gic-v3-its: fix some definitions of inner cacheability attributes

Philipp Rudo <prudo@linux.ibm.com>
    s390/kexec_file: Fix potential segment overlap in ELF loader

Arnd Bergmann <arnd@arndb.de>
    coresight: catu: fix clang build warning

Trond Myklebust <trondmy@gmail.com>
    NFS: Don't interrupt file writeout due to fatal errors

David Howells <dhowells@redhat.com>
    afs: Further fix file locking

David Howells <dhowells@redhat.com>
    afs: Fix AFS file locking to allow fine grained locks

Takashi Iwai <tiwai@suse.de>
    ALSA: usb-audio: Handle the error from snd_usb_mixer_apply_create_quirk()

Alexandru Ardelean <alexandru.ardelean@analog.com>
    dmaengine: axi-dmac: Don't check the number of frames for alignment

Dan Carpenter <dan.carpenter@oracle.com>
    6lowpan: Off by one handling ->nexthdr

Akinobu Mita <akinobu.mita@gmail.com>
    media: ov2659: fix unbalanced mutex_lock/unlock

Vladimir Oltean <olteanv@gmail.com>
    ARM: dts: ls1021: Fix SGMII PCS link remaining down after PHY disconnect

Ben Hutchings <ben@decadent.org.uk>
    powerpc: vdso: Make vdso32 installation conditional in vdso_install

Jian Shen <shenjian15@huawei.com>
    net: hns3: fix loop condition of hns3_get_tx_timeo_queue_info()

Kees Cook <keescook@chromium.org>
    selftests/ipc: Fix msgque compiler warnings

Hans de Goede <hdegoede@redhat.com>
    usb: typec: tcpm: Notify the tcpc to start connection-detection for SRPs

Jie Liu <liujie165@huawei.com>
    tipc: set sysctl_tipc_rmem and named_timeout right range

Colin Ian King <colin.king@canonical.com>
    platform/x86: alienware-wmi: fix kfree on potentially uninitialized pointer

Neil Armstrong <narmstrong@baylibre.com>
    soc: amlogic: meson-gx-pwrc-vpu: Fix power on/off register bitmask

Kishon Vijay Abraham I <kishon@ti.com>
    PCI: dwc: Fix dw_pcie_ep_find_capability() to return correct capability offset

Vincent Stehlé <vincent.stehle@laposte.net>
    staging: android: vsoc: fix copy_from_user overrun

Alexander Shishkin <alexander.shishkin@linux.intel.com>
    perf/core: Fix the address filtering fix

Guenter Roeck <linux@roeck-us.net>
    hwmon: (w83627hf) Use request_muxed_region for Super-IO accesses

Yunsheng Lin <linyunsheng@huawei.com>
    net: hns3: fix for vport->bw_limit overflow problem

Colin Ian King <colin.king@canonical.com>
    PCI: rockchip: Fix rockchip_pcie_ep_assert_intx() bitwise operations

YueHaibing <yuehaibing@huawei.com>
    ARM: pxa: ssp: Fix "WARNING: invalid free of devm_ allocated data"

Colin Ian King <colin.king@canonical.com>
    brcmfmac: fix leak of mypkt on error return path

Bart Van Assche <bvanassche@acm.org>
    scsi: target/core: Fix a race condition in the LUN lookup code

Jeffrey Altman <jaltman@auristor.com>
    rxrpc: Fix detection of out of order acks

Steven Price <steven.price@arm.com>
    firmware: arm_scmi: fix of_node leak in scmi_mailbox_check

Zhang Rui <rui.zhang@intel.com>
    ACPI: button: reinitialize button state upon resume

Marc Gonzalez <marc.w.gonzalez@free.fr>
    clk: qcom: Skip halt checks on gcc_pcie_0_pipe_clk for 8998

Leandro Dorileo <leandro.maciel.dorileo@intel.com>
    net/sched: cbs: fix port_rate miscalculation

Chris Packham <chris.packham@alliedtelesis.co.nz>
    of: use correct function prototype for of_overlay_fdt_apply()

Bart Van Assche <bvanassche@acm.org>
    scsi: qla2xxx: Unregister chrdev if module initialization fails

YueHaibing <yuehaibing@huawei.com>
    drm/vmwgfx: Remove set but not used variable 'restart'

Andrey Ignatov <rdna@fb.com>
    bpf: Add missed newline in verifier verbose log

YueHaibing <yuehaibing@huawei.com>
    ehea: Fix a copy-paste err in ehea_init_port_res

Pi-Hsun Shih <pihsun@chromium.org>
    rtc: mt6397: Don't call irq_dispose_mapping.

Geert Uytterhoeven <geert+renesas@glider.be>
    rtc: Fix timestamp value for RTC_TIMESTAMP_BEGIN_1900

Matteo Croce <mcroce@redhat.com>
    arm64/vdso: don't leak kernel addresses

Noralf Trønnes <noralf@tronnes.org>
    drm/fb-helper: generic: Call drm_client_add() after setup is done

Martin Sperl <kernel@martin.sperl.org>
    spi: bcm2835aux: fix driver to not allow 65535 (=-1) cs-gpios

Dan Carpenter <dan.carpenter@oracle.com>
    soc/fsl/qe: Fix an error code in qe_pin_request()

Tony Lindgren <tony@atomide.com>
    bus: ti-sysc: Fix sysc_unprepare() when no clocks have been allocated

Sowjanya Komatineni <skomatineni@nvidia.com>
    spi: tegra114: configure dma burst size to fifo trig level

Sowjanya Komatineni <skomatineni@nvidia.com>
    spi: tegra114: flush fifos

Sowjanya Komatineni <skomatineni@nvidia.com>
    spi: tegra114: terminate dma and reset on transfer timeout

Sowjanya Komatineni <skomatineni@nvidia.com>
    spi: tegra114: fix for unpacked mode transfers

Sowjanya Komatineni <skomatineni@nvidia.com>
    spi: tegra114: clear packed bit for unpacked mode

YueHaibing <yuehaibing@huawei.com>
    media: tw5864: Fix possible NULL pointer dereference in tw5864_handle_frame

Arnd Bergmann <arnd@arndb.de>
    media: davinci-isif: avoid uninitialized variable use

Dan Carpenter <dan.carpenter@oracle.com>
    soc: qcom: cmd-db: Fix an error code in cmd_db_dev_probe()

Vladimir Oltean <olteanv@gmail.com>
    net: dsa: Avoid null pointer when failing to connect to PHY

Tony Lindgren <tony@atomide.com>
    ARM: OMAP2+: Fix potentially uninitialized return value for _setup_reset()

Heiner Kallweit <hkallweit1@gmail.com>
    net: phy: don't clear BMCR in genphy_soft_reset

Maxime Ripard <maxime.ripard@bootlin.com>
    ARM: dts: sun9i: optimus: Fix fixed-regulators

Maxime Ripard <maxime.ripard@bootlin.com>
    arm64: dts: allwinner: a64: Add missing PIO clocks

Maxime Ripard <maxime.ripard@bootlin.com>
    ARM: dts: sun8i: a33: Reintroduce default pinctrl muxing

Finn Thain <fthain@telegraphics.com.au>
    m68k: mac: Fix VIA timer counter accesses

Jon Maloy <jon.maloy@ericsson.com>
    tipc: tipc clang warning

Arnd Bergmann <arnd@arndb.de>
    jfs: fix bogus variable self-initialization

Arnd Bergmann <arnd@arndb.de>
    crypto: ccree - reduce kernel stack usage with clang

Axel Lin <axel.lin@ingics.com>
    regulator: tps65086: Fix tps65086_ldoa1_ranges for selector 0xB

Nicholas Mc Guire <hofrat@osadl.org>
    media: cx23885: check allocation return

Dan Carpenter <dan.carpenter@oracle.com>
    media: wl128x: Fix an error code in fm_download_firmware()

Dan Carpenter <dan.carpenter@oracle.com>
    media: cx18: update *pos correctly in cx18_read_pos()

Dan Carpenter <dan.carpenter@oracle.com>
    media: ivtv: update *pos correctly in ivtv_read_pos()

Neil Armstrong <narmstrong@baylibre.com>
    soc: amlogic: gx-socinfo: Add mask for each SoC packages

Axel Lin <axel.lin@ingics.com>
    regulator: lp87565: Fix missing register for LP87565_BUCK_0

Kangjie Lu <kjlu@umn.edu>
    net: sh_eth: fix a missing check of of_get_phy_mode

Feras Daoud <ferasda@mellanox.com>
    net/mlx5e: IPoIB, Fix RX checksum statistics update

Eli Britstein <elibr@mellanox.com>
    net/mlx5: Fix multiple updates of steering rules in parallel

Dan Carpenter <dan.carpenter@oracle.com>
    xen, cpu_hotplug: Prevent an out of bounds access

Dan Carpenter <dan.carpenter@oracle.com>
    drivers/rapidio/rio_cm.c: fix potential oops in riocm_ch_listen()

Dirk van der Merwe <dirk.vandermerwe@netronome.com>
    nfp: fix simple vNIC mailbox length

Steve Sistare <steven.sistare@oracle.com>
    scsi: megaraid_sas: reduce module load time

Qian Cai <cai@lca.pw>
    x86/mm: Remove unused variable 'cpu'

Guenter Roeck <linux@roeck-us.net>
    nios2: ksyms: Add missing symbol exports

Alex Williamson <alex.williamson@redhat.com>
    PCI: Fix "try" semantics of bus and slot reset

Ilya Dryomov <idryomov@gmail.com>
    rbd: clear ->xferred on error from rbd_obj_issue_copyup()

Akihiro Tsukada <tskd08@gmail.com>
    media: dvb/earth-pt1: fix wrong initialization for demod blocks

Rashmica Gupta <rashmica.g@gmail.com>
    powerpc/mm: Check secondary hash page table

Igor Russkikh <Igor.Russkikh@aquantia.com>
    net: aquantia: fixed instack structure overflow

Trond Myklebust <trond.myklebust@hammerspace.com>
    NFSv4/flexfiles: Fix invalid deref in FF_LAYOUT_DEVID_NODE()

Anna Schumaker <Anna.Schumaker@Netapp.com>
    NFS: Add missing encode / decode sequence_maxsz to v4.2 operations

Lu Baolu <baolu.lu@linux.intel.com>
    iommu/vt-d: Fix NULL pointer reference in intel_svm_bind_mm()

Jonas Gorski <jonas.gorski@gmail.com>
    hwrng: bcm2835 - fix probe as platform device

Eli Britstein <elibr@mellanox.com>
    net: sched: act_csum: Fix csum calc for tagged packets

Pablo Neira Ayuso <pablo@netfilter.org>
    netfilter: nft_set_hash: bogus element self comparison from deactivation path

Pablo Neira Ayuso <pablo@netfilter.org>
    netfilter: nft_set_hash: fix lookups with fixed size hash on big endian

Surabhi Vishnoi <svishnoi@codeaurora.org>
    ath10k: Fix length of wmi tlv command for protected mgmt frames

Axel Lin <axel.lin@ingics.com>
    regulator: wm831x-dcdc: Fix list of wm831x_dcdc_ilim from mA to uA

Vladimir Murzin <vladimir.murzin@arm.com>
    ARM: 8849/1: NOMMU: Fix encodings for PMSAv8's PRBAR4/PRLAR4

Vladimir Murzin <vladimir.murzin@arm.com>
    ARM: 8848/1: virt: Align GIC version check with arm64 counterpart

Marek Szyprowski <m.szyprowski@samsung.com>
    ARM: 8847/1: pm: fix HYP/SVC mode mismatch when MCPM is used

Geert Uytterhoeven <geert+renesas@glider.be>
    iommu: Fix IOMMU debugfs fallout

Stefan Wahren <stefan.wahren@i2se.com>
    mmc: sdhci-brcmstb: handle mmc_of_parse() errors during probe

Trond Myklebust <trond.myklebust@hammerspace.com>
    NFS/pnfs: Bulk destroy of layouts needs to be safe w.r.t. umount

Mattias Jacobsson <2pi@mok.nu>
    platform/x86: wmi: fix potential null pointer dereference

Marek Szyprowski <m.szyprowski@samsung.com>
    clocksource/drivers/exynos_mct: Fix error path in timer resources initialization

Chen-Yu Tsai <wens@csie.org>
    clocksource/drivers/sun5i: Fail gracefully when clock rate is unavailable

Alexander Shishkin <alexander.shishkin@linux.intel.com>
    perf, pt, coresight: Fix address filters for vmas with non-zero offset

Alexander Shishkin <alexander.shishkin@linux.intel.com>
    perf: Copy parent's address filter offsets on clone

Trond Myklebust <trond.myklebust@hammerspace.com>
    NFS: Fix a soft lockup in the delegation recovery code

Michael Ellerman <mpe@ellerman.id.au>
    powerpc/64s: Fix logic when handling unknown CPU features

Nathan Chancellor <natechancellor@gmail.com>
    staging: rtlwifi: Use proper enum for return in halmac_parse_psd_data_88xx

Eric W. Biederman <ebiederm@xmission.com>
    fs/nfs: Fix nfs_parse_devname to not modify it's argument

Russell King <rmk+kernel@armlinux.org.uk>
    net: dsa: fix unintended change of bridge interface STP state

Takashi Iwai <tiwai@suse.de>
    ASoC: qcom: Fix of-node refcount unbalance in apq8016_sbc_parse_of()

Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    driver core: Fix PM-runtime for links added during consumer probe

Colin Ian King <colin.king@canonical.com>
    drm/nouveau: fix missing break in switch statement

Colin Ian King <colin.king@canonical.com>
    drm/nouveau/pmu: don't print reply values if exec is false

Colin Ian King <colin.king@canonical.com>
    drm/nouveau/bios/ramcfg: fix missing parentheses when calculating RON

Leon Romanovsky <leon@kernel.org>
    net/mlx5: Delete unused FPGA QPN variable

Vinod Koul <vkoul@kernel.org>
    net: dsa: qca8k: Enable delay for RGMII_ID mode

Axel Lin <axel.lin@ingics.com>
    regulator: pv88090: Fix array out-of-bounds access

Axel Lin <axel.lin@ingics.com>
    regulator: pv88080: Fix array out-of-bounds access

Axel Lin <axel.lin@ingics.com>
    regulator: pv88060: Fix array out-of-bounds access

Arend van Spriel <arend.vanspriel@broadcom.com>
    brcmfmac: create debugfs files for bus-specific layer

YueHaibing <yuehaibing@huawei.com>
    cdc-wdm: pass return value of recover_from_urb_loss

Robin Murphy <robin.murphy@arm.com>
    dmaengine: mv_xor: Use correct device for DMA API

Nicholas Mc Guire <hofrat@osadl.org>
    staging: r8822be: check kzalloc return or bail

Alexey Kardashevskiy <aik@ozlabs.ru>
    KVM: PPC: Release all hardware TCE tables attached to a group

YueHaibing <yuehaibing@huawei.com>
    mdio_bus: Fix PTR_ERR() usage after initialization to constant

Vadim Pasternak <vadimp@mellanox.com>
    hwmon: (pmbus/tps53679) Fix driver info initialization in probe routine

Eric Auger <eric.auger@redhat.com>
    vfio_pci: Enable memory accesses before calling pci_map_rom

Jacopo Mondi <jacopo+renesas@jmondi.org>
    media: sh: migor: Include missing dma-mapping header

Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
    mt76: usb: fix possible memory leak in mt76u_buf_free

Florian Fainelli <f.fainelli@gmail.com>
    net: dsa: b53: Do not program CPU port's PVID

Florian Fainelli <f.fainelli@gmail.com>
    net: dsa: b53: Properly account for VLAN filtering

Florian Fainelli <f.fainelli@gmail.com>
    net: dsa: b53: Fix default VLAN ID

David Howells <dhowells@redhat.com>
    keys: Timestamp new keys

Ming Lei <ming.lei@redhat.com>
    block: don't use bio->bi_vcnt to figure out segment number

Sven Van Asbroeck <thesven73@gmail.com>
    usb: phy: twl6030-usb: fix possible use-after-free on remove

Wen Yang <wen.yang99@zte.com.cn>
    PCI: endpoint: functions: Use memcpy_fromio()/memcpy_toio()

Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    driver core: Fix possible supplier PM-usage counter imbalance

Mark Bloch <markb@mellanox.com>
    RDMA/mlx5: Fix memory leak in case we fail to add an IB device

Geert Uytterhoeven <geert+renesas@glider.be>
    pinctrl: sh-pfc: sh73a0: Fix fsic_spdif pin groups

Geert Uytterhoeven <geert+renesas@glider.be>
    pinctrl: sh-pfc: r8a7792: Fix vin1_data18_b pin group

Geert Uytterhoeven <geert+renesas@glider.be>
    pinctrl: sh-pfc: r8a7791: Fix scifb2_data_c pin group

Geert Uytterhoeven <geert+renesas@glider.be>
    pinctrl: sh-pfc: emev2: Add missing pinmux functions

Wesley Sheng <wesley.sheng@microchip.com>
    ntb_hw_switchtec: NT req id mapping table register entry number should be 512

Paul Selles <paul.selles@microchip.com>
    ntb_hw_switchtec: debug print 64bit aligned crosslink BAR Numbers

Dan Carpenter <dan.carpenter@oracle.com>
    drm/etnaviv: potential NULL dereference

Magnus Karlsson <magnus.karlsson@intel.com>
    xsk: add missing smp_rmb() in xsk_mmap

Nicholas Mc Guire <hofrat@osadl.org>
    ipmi: kcs_bmc: handle devm_kasprintf() failure case

Steve Wise <swise@opengridcomputing.com>
    iw_cxgb4: use tos when finding ipv6 routes

Steve Wise <swise@opengridcomputing.com>
    iw_cxgb4: use tos when importing the endpoint

YueHaibing <yuehaibing@huawei.com>
    fbdev: chipsfb: remove set but not used variable 'size'

Colin Ian King <colin.king@canonical.com>
    rtc: pm8xxx: fix unintended sign extension

Colin Ian King <colin.king@canonical.com>
    rtc: 88pm80x: fix unintended sign extension

Colin Ian King <colin.king@canonical.com>
    rtc: 88pm860x: fix unintended sign extension

Karsten Graul <kgraul@linux.ibm.com>
    net/smc: original socket family in inet_sock_diag

Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
    rtc: ds1307: rx8130: Fix alarm handling

Moritz Fischer <mdf@kernel.org>
    net: phy: fixed_phy: Fix fixed_phy not checking GPIO

Rakesh Pillai <pillair@codeaurora.org>
    ath10k: fix dma unmap direction for management frames

Niklas Cassel <niklas.cassel@linaro.org>
    arm64: dts: msm8916: remove bogus argument to the cpu clock

Michael Kao <michael.kao@mediatek.com>
    thermal: mediatek: fix register index error

Colin Ian King <colin.king@canonical.com>
    rtc: ds1672: fix unintended sign extension

Paul Cercueil <paul@crapouillou.net>
    clk: ingenic: jz4740: Fix gating of UDC clock

Colin Ian King <colin.king@canonical.com>
    staging: most: cdev: add missing check for cdev_add failure

Sara Sharon <sara.sharon@intel.com>
    iwlwifi: mvm: fix RSS config command

Oleksandr Andrushchenko <oleksandr_andrushchenko@epam.com>
    drm/xen-front: Fix mmap attributes for display buffers

Vladimir Zapolskiy <vz@mleia.com>
    ARM: dts: lpc32xx: phy3250: fix SD card regulator voltage

Vladimir Zapolskiy <vz@mleia.com>
    ARM: dts: lpc32xx: fix ARM PrimeCell LCD controller clocks property

Vladimir Zapolskiy <vz@mleia.com>
    ARM: dts: lpc32xx: fix ARM PrimeCell LCD controller variant

Vladimir Zapolskiy <vz@mleia.com>
    ARM: dts: lpc32xx: reparent keypad controller to SIC1

Vladimir Zapolskiy <vz@mleia.com>
    ARM: dts: lpc32xx: add required clocks property to keypad device node

Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    driver core: Do not call rpm_put_suppliers() in pm_runtime_drop_link()

Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    driver core: Fix handling of runtime PM flags in device_link_add()

Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    driver core: Do not resume suppliers under device_links_write_lock()

Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    driver core: Avoid careless re-use of existing device links

Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    driver core: Fix DL_FLAG_AUTOREMOVE_SUPPLIER device link flag handling

Corentin Labbe <clabbe@baylibre.com>
    crypto: crypto4xx - Fix wrong ppc4xx_trng_probe()/ppc4xx_trng_remove() arguments

Liu Jian <liujian56@huawei.com>
    driver: uio: fix possible use-after-free in __uio_register_device

Liu Jian <liujian56@huawei.com>
    driver: uio: fix possible memory leak in __uio_register_device

YueHaibing <yuehaibing@huawei.com>
    tty: ipwireless: Fix potential NULL pointer dereference

Tony Lindgren <tony@atomide.com>
    bus: ti-sysc: Fix timer handling with drop pm_runtime_irq_safe()

Johannes Berg <johannes.berg@intel.com>
    iwlwifi: mvm: fix A-MPDU reference assignment

Chen-Yu Tsai <wens@csie.org>
    arm64: dts: allwinner: h6: Move GIC device node fix base address ordering

wenxu <wenxu@ucloud.cn>
    ip_tunnel: Fix route fl4 init in ip_md_tunnel_xmit

Moni Shoua <monis@mellanox.com>
    net/mlx5: Take lock with IRQs disabled to avoid deadlock

Mordechay Goodstein <mordechay.goodstein@intel.com>
    iwlwifi: mvm: avoid possible access out of array.

Chen-Yu Tsai <wens@csie.org>
    clk: sunxi-ng: sun8i-a23: Enable PLL-MIPI LDOs when ungating it

Chen-Yu Tsai <wens@csie.org>
    ARM: dts: sun8i-a23-a33: Move NAND controller device node to sort by address

Huazhong Tan <tanhuazhong@huawei.com>
    net: hns3: fix bug of ethtool_ops.get_channels for VF

YueHaibing <yuehaibing@huawei.com>
    spi/topcliff_pch: Fix potential NULL dereference on allocation error

Eric Wong <e@80x24.org>
    rtc: cmos: ignore bogus century byte

Maor Gottlieb <maorg@mellanox.com>
    IB/mlx5: Don't override existing ip_protocol

Jacopo Mondi <jacopo+renesas@jmondi.org>
    media: tw9910: Unregister subdevice with v4l2-async

Huazhong Tan <tanhuazhong@huawei.com>
    net: hns3: fix wrong combined count returned by ethtool -l

Israel Rukshin <israelr@mellanox.com>
    IB/iser: Pass the correct number of entries for dma mapped SGL

Stefan Agner <stefan@agner.ch>
    ASoC: imx-sgtl5000: put of nodes if finding codec fails

Eric Biggers <ebiggers@google.com>
    crypto: tgr192 - fix unaligned memory access

YueHaibing <yuehaibing@huawei.com>
    crypto: brcm - Fix some set-but-not-used warning

Masahiro Yamada <yamada.masahiro@socionext.com>
    kbuild: mark prepare0 as PHONY to fix external module build

Pawe? Chmiel <pawel.mikolaj.chmiel@gmail.com>
    media: s5p-jpeg: Correct step and max values for V4L2_CID_JPEG_RESTART_INTERVAL

Dan Carpenter <dan.carpenter@oracle.com>
    drm/etnaviv: NULL vs IS_ERR() buf in etnaviv_core_dump()

Dmitry Osipenko <digetx@gmail.com>
    memory: tegra: Don't invoke Tegra30+ specific memory timing setup on Tegra20

Heiner Kallweit <hkallweit1@gmail.com>
    net: phy: micrel: set soft_reset callback to genphy_soft_reset for KSZ9031

Raju Rangoju <rajur@chelsio.com>
    RDMA/iw_cxgb4: Fix the unchecked ep dereference

Charles Keepax <ckeepax@opensource.cirrus.com>
    spi: cadence: Correct initialisation of runtime PM

Loic Poulain <loic.poulain@linaro.org>
    arm64: dts: apq8016-sbc: Increase load on l11 for SDCARD

YueHaibing <yuehaibing@huawei.com>
    drm/shmob: Fix return value check in shmob_drm_probe

Gal Pressman <galpress@amazon.com>
    RDMA/qedr: Fix out of bounds index check in query pkey

Gal Pressman <galpress@amazon.com>
    RDMA/ocrdma: Fix out of bounds index check in query pkey

Gal Pressman <galpress@amazon.com>
    IB/usnic: Fix out of bounds index check in query pkey

Shakeel Butt <shakeelb@google.com>
    fork, memcg: fix cached_stacks case

Noralf Trønnes <noralf@tronnes.org>
    drm/fb-helper: generic: Fix setup error path

Dan Carpenter <dan.carpenter@oracle.com>
    drm/etnaviv: fix some off by one bugs

Biju Das <biju.das@bp.renesas.com>
    ARM: dts: r8a7743: Remove generic compatible string from iic3

YueHaibing <yuehaibing@huawei.com>
    drm: Fix error handling in drm_legacy_addctx

Sibi Sankar <sibis@codeaurora.org>
    remoteproc: qcom: q6v5-mss: Add missing regulator for MSM8996

Sibi Sankar <sibis@codeaurora.org>
    remoteproc: qcom: q6v5-mss: Add missing clocks for MSM8996

Stefan Wahren <stefan.wahren@i2se.com>
    arm64: defconfig: Re-enable bcm2835-thermal driver

Jonas Gorski <jonas.gorski@gmail.com>
    MIPS: BCM63XX: drop unused and broken DSP platform device

Yangtao Li <tiny.windzz@gmail.com>
    clk: dove: fix refcount leak in dove_clk_init()

Yangtao Li <tiny.windzz@gmail.com>
    clk: mv98dx3236: fix refcount leak in mv98dx3236_clk_init()

Yangtao Li <tiny.windzz@gmail.com>
    clk: armada-xp: fix refcount leak in axp_clk_init()

Yangtao Li <tiny.windzz@gmail.com>
    clk: kirkwood: fix refcount leak in kirkwood_clk_init()

Yangtao Li <tiny.windzz@gmail.com>
    clk: armada-370: fix refcount leak in a370_clk_init()

Yangtao Li <tiny.windzz@gmail.com>
    clk: vf610: fix refcount leak in vf610_clocks_init()

Yangtao Li <tiny.windzz@gmail.com>
    clk: imx7d: fix refcount leak in imx7d_clocks_init()

Yangtao Li <tiny.windzz@gmail.com>
    clk: imx6sx: fix refcount leak in imx6sx_clocks_init()

Yangtao Li <tiny.windzz@gmail.com>
    clk: imx6q: fix refcount leak in imx6q_clocks_init()

Yangtao Li <tiny.windzz@gmail.com>
    clk: samsung: exynos4: fix refcount leak in exynos4_get_xom()

Yangtao Li <tiny.windzz@gmail.com>
    clk: socfpga: fix refcount leak

Yangtao Li <tiny.windzz@gmail.com>
    clk: ti: fix refcount leak in ti_dt_clocks_register()

Yangtao Li <tiny.windzz@gmail.com>
    clk: qoriq: fix refcount leak in clockgen_init()

Yangtao Li <tiny.windzz@gmail.com>
    clk: highbank: fix refcount leak in hb_clk_init()

Rik van Riel <riel@surriel.com>
    fork,memcg: fix crash in free_thread_stack on memcg charge fail

Dan Carpenter <dan.carpenter@oracle.com>
    Input: nomadik-ske-keypad - fix a loop timeout test

Petr Machata <petrm@mellanox.com>
    vxlan: changelink: Fix handling of default remotes

Huazhong Tan <tanhuazhong@huawei.com>
    net: hns3: fix error handling int the hns3_get_vector_ring_chain

Geert Uytterhoeven <geert+renesas@glider.be>
    pinctrl: sh-pfc: sh7734: Remove bogus IPSR10 value

Geert Uytterhoeven <geert+renesas@glider.be>
    pinctrl: sh-pfc: sh7269: Add missing PCIOR0 field

Geert Uytterhoeven <geert+renesas@glider.be>
    pinctrl: sh-pfc: r8a77995: Remove bogus SEL_PWM[0-3]_3 configurations

Geert Uytterhoeven <geert+renesas@glider.be>
    pinctrl: sh-pfc: sh7734: Add missing IPSR11 field

Geert Uytterhoeven <geert+renesas@glider.be>
    pinctrl: sh-pfc: r8a77980: Add missing MOD_SEL0 field

Geert Uytterhoeven <geert+renesas@glider.be>
    pinctrl: sh-pfc: r8a77970: Add missing MOD_SEL0 field

Geert Uytterhoeven <geert+renesas@glider.be>
    pinctrl: sh-pfc: r8a7794: Remove bogus IPSR9 field

Geert Uytterhoeven <geert+renesas@glider.be>
    pinctrl: sh-pfc: sh73a0: Add missing TO pin to tpu4_to3 group

Geert Uytterhoeven <geert+renesas@glider.be>
    pinctrl: sh-pfc: r8a7791: Remove bogus marks from vin1_b_data18 group

Geert Uytterhoeven <geert+renesas@glider.be>
    pinctrl: sh-pfc: r8a7791: Remove bogus ctrl marks from qspi_data4_b group

Geert Uytterhoeven <geert+renesas@glider.be>
    pinctrl: sh-pfc: r8a7740: Add missing LCD0 marks to lcd0_data24_1 group

Geert Uytterhoeven <geert+renesas@glider.be>
    pinctrl: sh-pfc: r8a7740: Add missing REF125CK pin to gether_gmii group

Willem de Bruijn <willemb@google.com>
    ipv6: add missing tx timestamping on IPPROTO_RAW

Kelvin Cao <kelvin.cao@microchip.com>
    switchtec: Remove immediate status check after submitting MRPC command

Stefan Wahren <stefan.wahren@i2se.com>
    staging: bcm2835-camera: fix module autoloading

Stefan Wahren <stefan.wahren@i2se.com>
    staging: bcm2835-camera: Abort probe if there is no camera

Dan Carpenter <dan.carpenter@oracle.com>
    mailbox: ti-msgmgr: Off by one in ti_msgmgr_of_xlate()

Yuval Shaia <yuval.shaia@oracle.com>
    IB/rxe: Fix incorrect cache cleanup in error flow

Viresh Kumar <viresh.kumar@linaro.org>
    OPP: Fix missing debugfs supply directory for OPPs

Mitko Haralanov <mitko.haralanov@intel.com>
    IB/hfi1: Correctly process FECN and BECN in packets

Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
    net: phy: Fix not to call phy_resume() if PHY is not attached

Geert Uytterhoeven <geert+renesas@glider.be>
    arm64: dts: renesas: r8a7795-es1: Add missing power domains to IPMMU nodes

Neil Armstrong <narmstrong@baylibre.com>
    arm64: dts: meson-gx: Add hdmi_5v regulator as hdmi tx supply

Lyude Paul <lyude@redhat.com>
    drm/dp_mst: Skip validating ports during destruction, just ref

Willem de Bruijn <willemb@google.com>
    net: always initialize pagedlen

Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
    drm: rcar-du: Fix vblank initialization

Christophe JAILLET <christophe.jaillet@wanadoo.fr>
    drm: rcar-du: Fix the return value in case of error in 'rcar_du_crtc_set_crc_source()'

YueHaibing <yuehaibing@huawei.com>
    exportfs: fix 'passing zero to ERR_PTR()' warning

Tony Lindgren <tony@atomide.com>
    bus: ti-sysc: Add mcasp optional clocks flag

Neil Armstrong <narmstrong@baylibre.com>
    pinctrl: meson-gxl: remove invalid GPIOX tsin_a pins

Vasily Khoruzhick <anarsoul@gmail.com>
    ASoC: sun8i-codec: add missing route for ADC

Colin Ian King <colin.king@canonical.com>
    pcrypt: use format specifier in kobject_add

Phil Elwell <phil@raspberrypi.org>
    ARM: dts: bcm283x: Correct mailbox register sizes

Arnd Bergmann <arnd@arndb.de>
    ASoC: wm97xx: fix uninitialized regmap pointer problem

Gustavo A. R. Silva <gustavo@embeddedor.com>
    NTB: ntb_hw_idt: replace IS_ERR_OR_NULL with regular NULL checks

Petr Machata <petrm@mellanox.com>
    mlxsw: spectrum: Set minimum shaper on MC TCs

Petr Machata <petrm@mellanox.com>
    mlxsw: reg: QEEC: Add minimum shaper fields

Huazhong Tan <tanhuazhong@huawei.com>
    net: hns3: add error handler for hns3_nic_init_vector_data()

Maxime Ripard <maxime.ripard@bootlin.com>
    drm/sun4i: hdmi: Fix double flag assignation

Masahisa Kojima <masahisa.kojima@linaro.org>
    net: socionext: Add dummy PHY register read in phy_write()

Jon Maloy <jon.maloy@ericsson.com>
    tipc: eliminate message disordering during binding table update

Christophe Leroy <christophe.leroy@c-s.fr>
    powerpc/kgdb: add kgdb_arch_set/remove_breakpoint()

Taehee Yoo <ap420073@gmail.com>
    netfilter: nf_flow_table: do not remove offload when other netns's interface is down

Selvin Xavier <selvin.xavier@broadcom.com>
    RDMA/bnxt_re: Add missing spin lock initialization

Colin Ian King <colin.king@canonical.com>
    rtlwifi: rtl8821ae: replace _rtl8821ae_mrate_idx_to_arfr_id with generic version

YueHaibing <yuehaibing@huawei.com>
    powerpc/pseries/memory-hotplug: Fix return value type of find_aa_index

Hans de Goede <hdegoede@redhat.com>
    pwm: lpss: Release runtime-pm reference from the driver's remove callback

Fernando Fernandez Mancera <ffmancera@riseup.net>
    netfilter: nft_osf: usage from output path is not valid

Spencer E. Olson <olsonse@umich.edu>
    staging: comedi: ni_mio_common: protect register write overflow

Naftali Goldstein <naftali.goldstein@intel.com>
    iwlwifi: nvm: get num of hw addresses from firmware

Nicolas Huaman <nicolas@herochao.de>
    ALSA: usb-audio: update quirk for B&W PX to remove microphone

Rob Herring <robh@kernel.org>
    of: Fix property name in of_node_get_device_type

Colin Ian King <colin.king@canonical.com>
    drm/msm: fix unsigned comparison with less than zero

Tomas Winkler <tomas.winkler@intel.com>
    mei: replace POLL* with EPOLL* for write queues.

Linus Walleij <linus.walleij@linaro.org>
    regulator: fixed: Default enable high on DT regulators

Johannes Berg <johannes.berg@intel.com>
    cfg80211: regulatory: make initialization more robust

Nicholas Mc Guire <hofrat@osadl.org>
    usb: gadget: fsl_udc_core: check allocation return value and cleanup on failure

Arnd Bergmann <arnd@arndb.de>
    usb: dwc3: add EXTCON dependency for qcom

Marc Zyngier <marc.zyngier@arm.com>
    genirq/debugfs: Reinstate full OF path for domain name

Alex Estrin <alex.estrin@intel.com>
    IB/hfi1: Add mtu check for operational data VLs

Zhu Yanjun <yanjun.zhu@oracle.com>
    IB/rxe: replace kvfree with vfree

Houlong Wei <houlong.wei@mediatek.com>
    mailbox: mediatek: Add check for possible failure of kzalloc

Arnd Bergmann <arnd@arndb.de>
    ASoC: wm9712: fix unused variable warning

Eric W. Biederman <ebiederm@xmission.com>
    signal/ia64: Use the force_sig(SIGSEGV,...) in ia64_rt_sigreturn

Eric W. Biederman <ebiederm@xmission.com>
    signal/ia64: Use the generic force_sigsegv in setup_frame

John Garry <john.garry@huawei.com>
    drm/hisilicon: hibmc: Don't overwrite fb helper surface depth

Roopa Prabhu <roopa@cumulusnetworks.com>
    bridge: br_arp_nd_proxy: set icmp6_router if neigh has NTF_ROUTER

Jitendra Bhivare <jitendra.bhivare@broadcom.com>
    PCI: iproc: Remove PAXC slot check to allow VF support

Stephen Boyd <swboyd@chromium.org>
    firmware: coreboot: Let OF core populate platform device

Frank Rowand <frank.rowand@sony.com>
    ARM: qcom_defconfig: Enable MAILBOX

Jann Horn <jannh@google.com>
    apparmor: don't try to replace stale label in ptrace access check

Anders Roxell <anders.roxell@linaro.org>
    ALSA: hda: fix unused variable warning

Tony Jones <tonyj@suse.de>
    apparmor: Fix network performance issue in aa_label_sk_perm

Eugen Hristev <eugen.hristev@microchip.com>
    iio: fix position relative kernel version

Dan Carpenter <dan.carpenter@oracle.com>
    drm/virtio: fix bounds check in virtio_gpu_cmd_get_capset()

Shannon Nelson <shannon.nelson@oracle.com>
    ixgbe: don't clear IPsec sa counters on HW clearing

Peter Rosin <peda@axentia.se>
    ARM: dts: at91: nattis: make the SD-card slot work

Peter Rosin <peda@axentia.se>
    ARM: dts: at91: nattis: set the PRLUD and HIPOW signals low

Peter Rosin <peda@axentia.se>
    drm/sti: do not remove the drm_bridge that was never added

Navid Emamdoost <navid.emamdoost@gmail.com>
    ipmi: Fix memory leak in __ipmi_bmc_register

Shuiqing Li <shuiqing.li@unisoc.com>
    watchdog: sprd: Fix the incorrect pointer getting from driver data

Luc Van Oostenryck <luc.vanoostenryck@gmail.com>
    soc: aspeed: Fix snoop_file_poll()'s return type

Jean-Jacques Hiblot <jjhiblot@ti.com>
    leds: tlc591xx: update the maximum brightness

Arnaldo Carvalho de Melo <acme@redhat.com>
    perf map: No need to adjust the long name of modules

Corentin Labbe <clabbe.montjoie@gmail.com>
    crypto: sun4i-ss - fix big endian issues

Lorenzo Bianconi <lorenzo@kernel.org>
    mt7601u: fix bbp version check in mt7601u_wait_bbp_ready

Tung Nguyen <tung.q.nguyen@dektech.com.au>
    tipc: fix wrong timeout input for tipc_wait_for_cond()

Hoang Le <hoang.h.le@dektech.com.au>
    tipc: update mon's self addr when node addr generated

Ard Biesheuvel <ardb@kernel.org>
    powerpc/archrandom: fix arch_get_random_seed_int()

Tyrel Datwyler <tyreld@linux.ibm.com>
    powerpc/pseries: Enable support for ibm,drc-info property

Chuck Lever <chuck.lever@oracle.com>
    SUNRPC: Fix svcauth_gss_proxy_init()

Jarkko Nikula <jarkko.nikula@linux.intel.com>
    mfd: intel-lpss: Add default I2C device properties for Gemini Lake

Alain Volmat <alain.volmat@st.com>
    i2c: i2c-stm32f7: fix 10-bits check in slave free id search loop

Alain Volmat <alain.volmat@st.com>
    i2c: stm32f7: rework slave_id allocation

Jan Kara <jack@suse.cz>
    xfs: Sanity check flags of Q_XQUOTARM call

Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Revert "efi: Fix debugobjects warning on 'efi_rts_work'"


-------------

Diffstat:

 Documentation/ABI/testing/sysfs-bus-iio            |   2 +-
 Documentation/devicetree/bindings/bus/ti-sysc.txt  |   1 +
 .../devicetree/bindings/rng/omap3_rom_rng.txt      |  27 ++
 Makefile                                           |   8 +-
 arch/arm/boot/dts/aspeed-g5.dtsi                   |   2 +-
 arch/arm/boot/dts/at91-nattis-2-natte-2.dts        |   7 +-
 arch/arm/boot/dts/bcm2835-rpi.dtsi                 |   2 +-
 arch/arm/boot/dts/iwg20d-q7-common.dtsi            |   2 +-
 arch/arm/boot/dts/logicpd-som-lv-baseboard.dtsi    |   2 +-
 arch/arm/boot/dts/logicpd-som-lv.dtsi              |  26 +-
 arch/arm/boot/dts/lpc3250-phy3250.dts              |   4 +-
 arch/arm/boot/dts/lpc32xx.dtsi                     |  10 +-
 arch/arm/boot/dts/ls1021a-twr.dts                  |   9 +-
 arch/arm/boot/dts/ls1021a.dtsi                     |  11 +-
 arch/arm/boot/dts/omap3-n900.dts                   |   6 +
 arch/arm/boot/dts/r8a7743.dtsi                     |   4 +-
 arch/arm/boot/dts/stm32h743i-eval.dts              |   1 +
 arch/arm/boot/dts/sun8i-a23-a33.dtsi               |  30 +-
 arch/arm/boot/dts/sun8i-h3-beelink-x2.dts          |   4 +
 arch/arm/boot/dts/sun9i-a80-optimus.dts            |   4 +-
 arch/arm/common/mcpm_entry.c                       |   2 +-
 arch/arm/configs/qcom_defconfig                    |   1 +
 arch/arm/include/asm/suspend.h                     |   1 +
 arch/arm/kernel/head-nommu.S                       |   4 +-
 arch/arm/kernel/hyp-stub.S                         |   4 +-
 arch/arm/kernel/sleep.S                            |  12 +
 arch/arm/kernel/vdso.c                             |   1 -
 arch/arm/mach-omap2/omap_hwmod.c                   |   2 +-
 arch/arm/mach-omap2/pdata-quirks.c                 |  12 +-
 arch/arm/mach-rpc/irq.c                            |   3 +-
 arch/arm/mach-stm32/Kconfig                        |   3 +-
 arch/arm/plat-pxa/ssp.c                            |   6 -
 arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi      |   3 +-
 .../boot/dts/allwinner/sun50i-h6-pine-h64.dts      |   2 +
 arch/arm64/boot/dts/allwinner/sun50i-h6.dtsi       |  22 +-
 .../arm64/boot/dts/amlogic/meson-gx-p23x-q20x.dtsi |   1 +
 .../dts/amlogic/meson-gxl-s905x-khadas-vim.dts     |   1 +
 .../dts/amlogic/meson-gxl-s905x-libretech-cc.dts   |   2 +-
 .../boot/dts/amlogic/meson-gxl-s905x-p212.dts      |   1 +
 .../boot/dts/amlogic/meson-gxm-khadas-vim2.dts     |  17 +-
 arch/arm64/boot/dts/arm/juno-clocks.dtsi           |   4 +-
 arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi          |   2 +
 arch/arm64/boot/dts/qcom/msm8916.dtsi              |   8 +-
 arch/arm64/boot/dts/renesas/r8a7795-es1.dtsi       |   2 +
 arch/arm64/boot/dts/renesas/r8a77990-ebisu.dts     |   1 -
 arch/arm64/boot/dts/renesas/r8a77995.dtsi          |   2 +-
 arch/arm64/configs/defconfig                       |   1 +
 arch/arm64/kernel/hibernate.c                      |   9 +-
 arch/arm64/kernel/vdso.c                           |   2 -
 arch/ia64/kernel/signal.c                          |  60 +--
 arch/m68k/amiga/cia.c                              |   9 +
 arch/m68k/atari/ataints.c                          |   4 +-
 arch/m68k/atari/time.c                             |  15 +-
 arch/m68k/bvme6000/config.c                        |  20 +-
 arch/m68k/hp300/time.c                             |  10 +-
 arch/m68k/mac/via.c                                | 119 +++---
 arch/m68k/mvme147/config.c                         |  18 +-
 arch/m68k/mvme16x/config.c                         |  21 +-
 arch/m68k/q40/q40ints.c                            |  19 +-
 arch/m68k/sun3/sun3ints.c                          |   3 +
 arch/m68k/sun3x/time.c                             |  16 +-
 arch/mips/bcm63xx/Makefile                         |   6 +-
 arch/mips/bcm63xx/boards/board_bcm963xx.c          |  20 -
 arch/mips/bcm63xx/dev-dsp.c                        |  56 ---
 arch/mips/include/asm/io.h                         |  14 +-
 .../include/asm/mach-bcm63xx/bcm63xx_dev_dsp.h     |  14 -
 .../mips/include/asm/mach-bcm63xx/board_bcm963xx.h |   5 -
 arch/mips/kernel/setup.c                           |   2 +-
 arch/nios2/kernel/nios2_ksyms.c                    |  12 +
 arch/powerpc/Makefile                              |   2 +
 arch/powerpc/include/asm/archrandom.h              |   2 +-
 arch/powerpc/include/asm/kgdb.h                    |   5 +-
 arch/powerpc/kernel/cacheinfo.c                    |  21 ++
 arch/powerpc/kernel/cacheinfo.h                    |   4 +
 arch/powerpc/kernel/dt_cpu_ftrs.c                  |  17 +-
 arch/powerpc/kernel/kgdb.c                         |  43 ++-
 arch/powerpc/kernel/mce_power.c                    |  20 +-
 arch/powerpc/kernel/prom_init.c                    |   2 +-
 arch/powerpc/kvm/book3s_64_vio.c                   |   1 -
 arch/powerpc/kvm/book3s_hv.c                       |  15 +-
 arch/powerpc/mm/dump_hashpagetable.c               |   2 +-
 arch/powerpc/mm/pgtable-radix.c                    |   4 +-
 arch/powerpc/platforms/pseries/hotplug-memory.c    |  61 ++-
 arch/powerpc/platforms/pseries/mobility.c          |  10 +
 arch/s390/kernel/kexec_elf.c                       |   2 +-
 arch/sh/boards/mach-migor/setup.c                  |   1 +
 arch/um/drivers/chan_kern.c                        |  52 ++-
 arch/um/include/asm/irq.h                          |   2 +-
 arch/um/kernel/irq.c                               |   4 +
 arch/x86/Kconfig.debug                             |   2 +-
 arch/x86/events/intel/pt.c                         |   9 +-
 arch/x86/include/asm/pgtable_32.h                  |   2 +-
 arch/x86/kernel/kgdb.c                             |   2 +-
 arch/x86/mm/tlb.c                                  |   3 -
 block/blk-merge.c                                  |   8 +-
 crypto/pcrypt.c                                    |   2 +-
 crypto/tgr192.c                                    |   6 +-
 drivers/acpi/acpi_lpss.c                           | 111 +++++-
 drivers/acpi/button.c                              |   5 +-
 drivers/acpi/device_pm.c                           |  94 ++---
 drivers/ata/libahci.c                              |   1 -
 drivers/base/core.c                                |  88 +++--
 drivers/base/power/runtime.c                       |  40 +-
 drivers/base/power/wakeup.c                        |   2 +-
 drivers/bcma/driver_pci.c                          |   4 +-
 drivers/block/drbd/drbd_main.c                     |   2 +
 drivers/block/rbd.c                                |   1 +
 drivers/bus/ti-sysc.c                              |  18 +-
 drivers/char/hw_random/bcm2835-rng.c               |  18 +-
 drivers/char/hw_random/omap3-rom-rng.c             |  17 +-
 drivers/char/ipmi/ipmi_msghandler.c                |   5 +-
 drivers/char/ipmi/kcs_bmc.c                        |   5 +-
 drivers/clk/actions/owl-factor.c                   |   7 +-
 drivers/clk/clk-highbank.c                         |   1 +
 drivers/clk/clk-qoriq.c                            |   1 +
 drivers/clk/imx/clk-imx6q.c                        |   1 +
 drivers/clk/imx/clk-imx6sx.c                       |   1 +
 drivers/clk/imx/clk-imx7d.c                        |   1 +
 drivers/clk/imx/clk-vf610.c                        |   1 +
 drivers/clk/ingenic/jz4740-cgu.c                   |   2 +-
 drivers/clk/meson/axg.c                            |  10 +-
 drivers/clk/meson/gxbb.c                           |   5 -
 drivers/clk/mvebu/armada-370.c                     |   4 +-
 drivers/clk/mvebu/armada-xp.c                      |   4 +-
 drivers/clk/mvebu/dove.c                           |   8 +-
 drivers/clk/mvebu/kirkwood.c                       |   2 +
 drivers/clk/mvebu/mv98dx3236.c                     |   4 +-
 drivers/clk/qcom/gcc-msm8996.c                     |  36 --
 drivers/clk/qcom/gcc-msm8998.c                     |   2 +-
 drivers/clk/samsung/clk-exynos4.c                  |   1 +
 drivers/clk/socfpga/clk-pll-a10.c                  |   1 +
 drivers/clk/socfpga/clk-pll.c                      |   1 +
 drivers/clk/sunxi-ng/ccu-sun50i-h6-r.c             |   2 +-
 drivers/clk/sunxi-ng/ccu-sun8i-a23.c               |   2 +-
 drivers/clk/sunxi-ng/ccu-sun8i-v3s.c               |  19 +-
 drivers/clk/sunxi-ng/ccu-sun8i-v3s.h               |   6 +-
 drivers/clk/ti/clk.c                               |   8 +-
 drivers/clocksource/exynos_mct.c                   |  14 +-
 drivers/clocksource/timer-sun5i.c                  |  10 +
 drivers/clocksource/timer-ti-dm.c                  |   1 -
 drivers/cpufreq/brcmstb-avs-cpufreq.c              |  12 +-
 drivers/crypto/amcc/crypto4xx_trng.h               |   4 +-
 drivers/crypto/bcm/cipher.c                        |   6 +-
 drivers/crypto/caam/caamrng.c                      |   5 +-
 drivers/crypto/caam/error.c                        |   2 +-
 drivers/crypto/ccp/ccp-crypto-aes.c                |   8 +-
 drivers/crypto/ccp/ccp-ops.c                       |  67 ++--
 drivers/crypto/ccree/cc_cipher.c                   |   2 +-
 drivers/crypto/hisilicon/sec/sec_algs.c            |  44 +--
 drivers/crypto/inside-secure/safexcel_hash.c       |  10 +-
 drivers/crypto/sunxi-ss/sun4i-ss-hash.c            |  21 +-
 drivers/crypto/talitos.c                           | 158 +++-----
 drivers/crypto/talitos.h                           |   2 +-
 drivers/dma/dma-axi-dmac.c                         |   2 +-
 drivers/dma/dw/platform.c                          |  14 +-
 drivers/dma/hsu/hsu.c                              |   4 +-
 drivers/dma/imx-sdma.c                             |   8 +
 drivers/dma/mv_xor.c                               |   2 +-
 drivers/dma/tegra210-adma.c                        |  72 +++-
 drivers/dma/ti/edma.c                              |   6 +-
 drivers/edac/edac_mc.c                             |  12 +-
 drivers/firmware/arm_scmi/clock.c                  |   2 +
 drivers/firmware/arm_scmi/driver.c                 |   4 +-
 drivers/firmware/arm_scmi/sensors.c                |   4 +-
 drivers/firmware/dmi_scan.c                        |   2 +-
 drivers/firmware/efi/runtime-wrappers.c            |   2 +-
 drivers/firmware/google/coreboot_table-of.c        |  28 +-
 drivers/fsi/fsi-core.c                             |  32 +-
 drivers/fsi/fsi-sbefifo.c                          |   4 +-
 drivers/gpio/gpio-aspeed.c                         |   2 +-
 drivers/gpu/drm/drm_context.c                      |  15 +-
 drivers/gpu/drm/drm_dp_mst_topology.c              |  15 +-
 drivers/gpu/drm/drm_fb_helper.c                    | 102 ++---
 drivers/gpu/drm/etnaviv/etnaviv_dump.c             |   2 +-
 drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c        |   2 +-
 drivers/gpu/drm/etnaviv/etnaviv_perfmon.c          |   6 +-
 drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c  |   1 -
 drivers/gpu/drm/msm/adreno/a3xx_gpu.c              |  24 +-
 drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c         |   2 +-
 drivers/gpu/drm/msm/disp/mdp5/mdp5_cfg.c           |   2 +-
 drivers/gpu/drm/msm/dsi/dsi_host.c                 |   6 +-
 drivers/gpu/drm/nouveau/nouveau_abi16.c            |   1 +
 drivers/gpu/drm/nouveau/nvkm/subdev/fb/gddr3.c     |   2 +-
 drivers/gpu/drm/nouveau/nvkm/subdev/pmu/memx.c     |   4 +-
 drivers/gpu/drm/panel/panel-lvds.c                 |  21 +-
 drivers/gpu/drm/radeon/cik.c                       |   4 +-
 drivers/gpu/drm/radeon/r600.c                      |   4 +-
 drivers/gpu/drm/radeon/si.c                        |   4 +-
 drivers/gpu/drm/rcar-du/rcar_du_crtc.c             |   2 +-
 drivers/gpu/drm/rcar-du/rcar_du_kms.c              |   2 +-
 drivers/gpu/drm/rcar-du/rcar_lvds.c                |   8 +-
 drivers/gpu/drm/shmobile/shmob_drm_drv.c           |   4 +-
 drivers/gpu/drm/sti/sti_hda.c                      |   1 -
 drivers/gpu/drm/sti/sti_hdmi.c                     |   1 -
 drivers/gpu/drm/sun4i/sun4i_hdmi_tmds_clk.c        |   2 +-
 drivers/gpu/drm/virtio/virtgpu_vq.c                |   5 +-
 drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf.c             |   6 +-
 drivers/gpu/drm/xen/xen_drm_front_gem.c            |  13 +-
 drivers/hwmon/lm75.c                               |   2 +-
 drivers/hwmon/pmbus/tps53679.c                     |   9 +-
 drivers/hwmon/shtc1.c                              |   2 +-
 drivers/hwmon/w83627hf.c                           |  42 ++-
 drivers/hwtracing/coresight/coresight-catu.h       |   5 -
 drivers/hwtracing/coresight/coresight-etm-perf.c   |   7 +-
 drivers/hwtracing/coresight/coresight-tmc-etr.c    |   5 +-
 drivers/i2c/busses/i2c-stm32.c                     |  16 +-
 drivers/i2c/busses/i2c-stm32f7.c                   |  13 +-
 drivers/iio/dac/ad5380.c                           |   2 +-
 drivers/iio/light/tsl2772.c                        |  16 +-
 drivers/infiniband/core/cma.c                      |   2 +-
 drivers/infiniband/core/uverbs_uapi.c              |   2 +
 drivers/infiniband/hw/bnxt_re/ib_verbs.c           |   1 +
 drivers/infiniband/hw/bnxt_re/qplib_fp.c           |   1 +
 drivers/infiniband/hw/cxgb4/cm.c                   |  24 +-
 drivers/infiniband/hw/hfi1/chip.c                  |  26 +-
 drivers/infiniband/hw/hfi1/driver.c                |  70 ++--
 drivers/infiniband/hw/hfi1/hfi.h                   |  35 +-
 drivers/infiniband/hw/hfi1/pio.c                   |   5 +-
 drivers/infiniband/hw/hfi1/rc.c                    |  32 +-
 drivers/infiniband/hw/hfi1/uc.c                    |   2 +-
 drivers/infiniband/hw/hfi1/ud.c                    |  33 +-
 drivers/infiniband/hw/hfi1/verbs.c                 |   4 +-
 drivers/infiniband/hw/hns/hns_roce_hem.c           |  19 +-
 drivers/infiniband/hw/hns/hns_roce_hw_v2.c         |   6 +-
 drivers/infiniband/hw/hns/hns_roce_qp.c            |   1 -
 drivers/infiniband/hw/mlx5/ib_rep.c                |   4 +-
 drivers/infiniband/hw/mlx5/main.c                  |  53 ++-
 drivers/infiniband/hw/mlx5/qp.c                    |  21 ++
 drivers/infiniband/hw/ocrdma/ocrdma_verbs.c        |   2 +-
 drivers/infiniband/hw/qedr/verbs.c                 |  27 +-
 drivers/infiniband/hw/usnic/usnic_ib_verbs.c       |   2 +-
 drivers/infiniband/sw/rxe/rxe_cq.c                 |   4 +-
 drivers/infiniband/sw/rxe/rxe_net.c                |   3 +-
 drivers/infiniband/sw/rxe/rxe_pool.c               |  26 +-
 drivers/infiniband/sw/rxe/rxe_qp.c                 |   5 +-
 drivers/infiniband/ulp/iser/iscsi_iser.h           |   2 +-
 drivers/infiniband/ulp/iser/iser_memory.c          |  10 +-
 drivers/input/keyboard/nomadik-ske-keypad.c        |   2 +-
 drivers/iommu/amd_iommu.c                          |   2 +
 drivers/iommu/amd_iommu_init.c                     |   3 +
 drivers/iommu/intel-iommu.c                        |  39 +-
 drivers/iommu/intel-svm.c                          |   2 +-
 drivers/iommu/iommu-debugfs.c                      |  23 +-
 drivers/iommu/iommu.c                              |   8 +-
 drivers/iommu/mtk_iommu.c                          |  26 +-
 drivers/leds/led-triggers.c                        |   4 +-
 drivers/leds/leds-tlc591xx.c                       |   7 +-
 drivers/lightnvm/pblk-rb.c                         |   2 +-
 drivers/mailbox/mtk-cmdq-mailbox.c                 |   3 +
 drivers/mailbox/qcom-apcs-ipc-mailbox.c            |   2 +-
 drivers/mailbox/ti-msgmgr.c                        |   2 +-
 drivers/md/bcache/debug.c                          |   5 +-
 drivers/media/i2c/ov2659.c                         |   2 +-
 drivers/media/i2c/tw9910.c                         |   2 +-
 drivers/media/pci/cx18/cx18-fileops.c              |   2 +-
 drivers/media/pci/cx23885/cx23885-dvb.c            |   5 +-
 drivers/media/pci/ivtv/ivtv-fileops.c              |   2 +-
 drivers/media/pci/pt1/pt1.c                        |  54 ++-
 drivers/media/pci/tw5864/tw5864-video.c            |   4 +-
 drivers/media/platform/atmel/atmel-isi.c           |   2 +-
 drivers/media/platform/davinci/isif.c              |   9 -
 drivers/media/platform/davinci/vpbe.c              |   2 +-
 drivers/media/platform/omap/omap_vout.c            |  15 +-
 drivers/media/platform/rcar-vin/rcar-core.c        |   2 +-
 drivers/media/platform/s5p-jpeg/jpeg-core.c        |   2 +-
 drivers/media/platform/vivid/vivid-osd.c           |   2 +-
 drivers/media/radio/wl128x/fmdrv_common.c          |   5 +-
 drivers/media/usb/em28xx/em28xx-core.c             |   2 +-
 drivers/memory/tegra/mc.c                          |  11 +-
 drivers/mfd/intel-lpss-pci.c                       |  28 +-
 drivers/mfd/intel-lpss.c                           |   1 +
 drivers/misc/aspeed-lpc-snoop.c                    |   4 +-
 drivers/misc/mei/main.c                            |   4 +-
 drivers/misc/mic/card/mic_x100.c                   |  28 +-
 drivers/misc/sgi-xp/xpc_partition.c                |   2 +-
 drivers/mmc/core/host.c                            |   2 -
 drivers/mmc/core/quirks.h                          |   7 +
 drivers/mmc/host/sdhci-brcmstb.c                   |   4 +-
 drivers/net/dsa/b53/b53_common.c                   |  90 ++++-
 drivers/net/dsa/b53/b53_priv.h                     |   3 +
 drivers/net/dsa/qca8k.c                            |  12 +
 drivers/net/dsa/qca8k.h                            |   1 +
 drivers/net/ethernet/amazon/ena/ena_com.c          |   3 +-
 drivers/net/ethernet/amazon/ena/ena_ethtool.c      |   4 +-
 drivers/net/ethernet/amazon/ena/ena_netdev.c       |   1 +
 drivers/net/ethernet/aquantia/atlantic/aq_vec.c    |  15 +-
 .../ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c  |   4 +-
 .../ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c  |   4 +-
 drivers/net/ethernet/broadcom/bcmsysport.c         |   2 +-
 drivers/net/ethernet/broadcom/bnxt/bnxt.h          |   1 +
 drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c      |   2 +-
 drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c  |  20 +-
 drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c    |   2 +-
 drivers/net/ethernet/chelsio/cxgb4/smt.c           |   4 +-
 drivers/net/ethernet/freescale/dpaa/dpaa_eth.c     |  47 +--
 drivers/net/ethernet/hisilicon/hix5hd2_gmac.c      |   2 +-
 drivers/net/ethernet/hisilicon/hns3/hns3_enet.c    |  17 +-
 .../ethernet/hisilicon/hns3/hns3pf/hclge_main.c    |  21 +-
 .../ethernet/hisilicon/hns3/hns3pf/hclge_main.h    |   2 +-
 .../net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c |   4 +-
 .../ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c  |   5 +-
 drivers/net/ethernet/ibm/ehea/ehea_main.c          |   2 +-
 drivers/net/ethernet/intel/i40e/i40e_common.c      |  91 +++--
 drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c     |   4 -
 drivers/net/ethernet/intel/ixgbe/ixgbe_main.c      |  16 +-
 drivers/net/ethernet/mellanox/mlx5/core/en_rx.c    |  11 +-
 .../net/ethernet/mellanox/mlx5/core/fpga/core.c    |   2 -
 drivers/net/ethernet/mellanox/mlx5/core/fs_core.c  |   6 +
 drivers/net/ethernet/mellanox/mlx5/core/qp.c       |   5 +-
 drivers/net/ethernet/mellanox/mlxsw/reg.h          |  22 +-
 drivers/net/ethernet/mellanox/mlxsw/spectrum.c     |  25 ++
 drivers/net/ethernet/natsemi/sonic.c               |   6 +-
 drivers/net/ethernet/netronome/nfp/bpf/jit.c       |  13 +-
 drivers/net/ethernet/netronome/nfp/nfp_net_ctrl.h  |   2 +-
 drivers/net/ethernet/ni/nixge.c                    |   2 +-
 drivers/net/ethernet/pasemi/pasemi_mac.c           |   2 +-
 drivers/net/ethernet/qlogic/qed/qed_iwarp.c        |  17 +-
 drivers/net/ethernet/qlogic/qed/qed_l2.c           |  34 +-
 drivers/net/ethernet/qualcomm/qca_spi.c            |   9 +-
 drivers/net/ethernet/qualcomm/qca_spi.h            |   1 +
 drivers/net/ethernet/renesas/sh_eth.c              |   6 +-
 drivers/net/ethernet/socionext/netsec.c            |  20 +-
 drivers/net/ethernet/socionext/sni_ave.c           |   2 +-
 .../net/ethernet/stmicro/stmmac/dwmac-ipq806x.c    |   2 +-
 .../net/ethernet/stmicro/stmmac/dwmac-meson8b.c    |   2 +-
 drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c  |   2 +-
 drivers/net/ethernet/stmicro/stmmac/dwmac5.c       |   1 +
 drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c   |   2 +-
 drivers/net/ethernet/xilinx/xilinx_axienet_main.c  |   2 +-
 drivers/net/hyperv/hyperv_net.h                    |   3 +-
 drivers/net/hyperv/netvsc.c                        |  38 +-
 drivers/net/hyperv/netvsc_drv.c                    |  13 +-
 drivers/net/phy/fixed_phy.c                        |   6 +-
 drivers/net/phy/mdio_bus.c                         |  11 +-
 drivers/net/phy/micrel.c                           |   1 +
 drivers/net/phy/phy_device.c                       |  13 +-
 drivers/net/vxlan.c                                |   7 +-
 drivers/net/wireless/ath/ath10k/mac.c              |   4 +-
 drivers/net/wireless/ath/ath10k/sdio.c             |  29 +-
 drivers/net/wireless/ath/ath10k/wmi-tlv.c          |   2 +-
 drivers/net/wireless/ath/ath10k/wmi.c              |   4 +-
 drivers/net/wireless/ath/ath9k/dynack.c            |   8 +-
 drivers/net/wireless/ath/wcn36xx/smd.c             | 186 ++++++----
 .../wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c  |   8 +-
 .../net/wireless/broadcom/brcm80211/brcmfmac/bus.h |  10 +
 .../wireless/broadcom/brcm80211/brcmfmac/core.c    |   1 +
 .../wireless/broadcom/brcm80211/brcmfmac/sdio.c    |  12 +-
 .../net/wireless/intel/iwlwifi/fw/api/nvm-reg.h    |  14 +-
 drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c |  10 +-
 drivers/net/wireless/intel/iwlwifi/mvm/fw.c        |  12 +-
 drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c      |   2 +-
 drivers/net/wireless/intel/iwlwifi/mvm/sta.c       |  19 +-
 drivers/net/wireless/marvell/libertas_tf/cmd.c     |   2 +-
 drivers/net/wireless/mediatek/mt76/usb.c           |  14 +-
 drivers/net/wireless/mediatek/mt7601u/phy.c        |   2 +-
 drivers/net/wireless/realtek/rtlwifi/debug.c       |   2 +-
 .../net/wireless/realtek/rtlwifi/rtl8821ae/hw.c    |  71 +---
 drivers/ntb/hw/idt/ntb_hw_idt.c                    |   8 +-
 drivers/ntb/hw/mscc/ntb_hw_switchtec.c             |   4 +-
 drivers/nvme/host/pci.c                            |   2 +-
 drivers/nvmem/imx-ocotp.c                          |  39 +-
 drivers/of/of_mdio.c                               |   2 +-
 drivers/opp/core.c                                 |  12 +-
 drivers/opp/of.c                                   |  20 +-
 drivers/opp/opp.h                                  |   6 +-
 drivers/pci/controller/dwc/pcie-designware-ep.c    |  10 +-
 drivers/pci/controller/pcie-iproc.c                |  10 +-
 drivers/pci/controller/pcie-mobiveil.c             |   8 +-
 drivers/pci/controller/pcie-rockchip-ep.c          |   2 +-
 drivers/pci/endpoint/functions/pci-epf-test.c      |   4 +-
 drivers/pci/pci-driver.c                           |  60 ++-
 drivers/pci/pci.c                                  |  54 ++-
 drivers/pci/switch/switchtec.c                     |   4 -
 drivers/phy/broadcom/phy-brcm-usb.c                |   8 +
 drivers/phy/qualcomm/phy-qcom-qusb2.c              |   2 +-
 drivers/pinctrl/bcm/pinctrl-iproc-gpio.c           |  96 ++++-
 drivers/pinctrl/meson/pinctrl-meson-gxl.c          |  12 +-
 drivers/pinctrl/sh-pfc/pfc-emev2.c                 |  20 +
 drivers/pinctrl/sh-pfc/pfc-r8a7740.c               |   3 +-
 drivers/pinctrl/sh-pfc/pfc-r8a7791.c               |   8 +-
 drivers/pinctrl/sh-pfc/pfc-r8a7792.c               |   1 +
 drivers/pinctrl/sh-pfc/pfc-r8a7794.c               |   2 +-
 drivers/pinctrl/sh-pfc/pfc-r8a77970.c              |   2 +-
 drivers/pinctrl/sh-pfc/pfc-r8a77980.c              |   2 +-
 drivers/pinctrl/sh-pfc/pfc-r8a77995.c              |   8 +-
 drivers/pinctrl/sh-pfc/pfc-sh7269.c                |   2 +-
 drivers/pinctrl/sh-pfc/pfc-sh73a0.c                |   4 +-
 drivers/pinctrl/sh-pfc/pfc-sh7734.c                |   4 +-
 drivers/platform/mips/cpu_hwmon.c                  |   2 +-
 drivers/platform/x86/alienware-wmi.c               |  19 +-
 drivers/platform/x86/wmi.c                         |   3 +
 drivers/power/supply/power_supply_core.c           |  10 +-
 drivers/pwm/pwm-lpss.c                             |   6 +
 drivers/pwm/pwm-meson.c                            |   9 +-
 drivers/rapidio/rio_cm.c                           |   4 +-
 drivers/regulator/fixed.c                          |  11 +-
 drivers/regulator/lp87565-regulator.c              |   2 +-
 drivers/regulator/pv88060-regulator.c              |   2 +-
 drivers/regulator/pv88080-regulator.c              |   2 +-
 drivers/regulator/pv88090-regulator.c              |   2 +-
 drivers/regulator/tps65086-regulator.c             |   4 +-
 drivers/regulator/wm831x-dcdc.c                    |   4 +-
 drivers/remoteproc/qcom_q6v5_pil.c                 |  12 +-
 drivers/rtc/rtc-88pm80x.c                          |  21 +-
 drivers/rtc/rtc-88pm860x.c                         |  21 +-
 drivers/rtc/rtc-ds1307.c                           |   7 +-
 drivers/rtc/rtc-ds1672.c                           |   3 +-
 drivers/rtc/rtc-mc146818-lib.c                     |   2 +-
 drivers/rtc/rtc-mt6397.c                           |   9 +-
 drivers/rtc/rtc-pcf2127.c                          |  32 +-
 drivers/rtc/rtc-pcf8563.c                          |  13 +-
 drivers/rtc/rtc-pm8xxx.c                           |   6 +-
 drivers/rtc/rtc-rv3029c2.c                         |  16 +-
 drivers/s390/net/qeth_l2_main.c                    |  23 +-
 drivers/scsi/fnic/fnic_isr.c                       |   4 +-
 drivers/scsi/libfc/fc_exch.c                       |   2 +-
 drivers/scsi/megaraid/megaraid_sas_base.c          |   4 +-
 drivers/scsi/qla2xxx/qla_os.c                      |  34 +-
 drivers/scsi/qla2xxx/qla_target.c                  |  21 +-
 drivers/soc/amlogic/meson-gx-pwrc-vpu.c            |   8 +-
 drivers/soc/amlogic/meson-gx-socinfo.c             |  32 +-
 drivers/soc/fsl/qe/gpio.c                          |   4 +-
 drivers/soc/qcom/cmd-db.c                          |   4 +-
 drivers/spi/spi-bcm-qspi.c                         |   4 +-
 drivers/spi/spi-bcm2835aux.c                       |  13 +-
 drivers/spi/spi-cadence.c                          |  11 +-
 drivers/spi/spi-fsl-spi.c                          |   2 +-
 drivers/spi/spi-tegra114.c                         | 145 ++++++--
 drivers/spi/spi-topcliff-pch.c                     |   6 +
 drivers/staging/android/vsoc.c                     |   3 +-
 drivers/staging/comedi/drivers/ni_mio_common.c     |  24 +-
 drivers/staging/greybus/light.c                    |  12 +-
 drivers/staging/media/davinci_vpfe/dm365_ipipe.c   |  10 +-
 drivers/staging/most/cdev/cdev.c                   |   5 +-
 .../rtlwifi/halmac/halmac_88xx/halmac_func_88xx.c  |   5 +-
 .../vc04_services/bcm2835-camera/bcm2835-camera.c  |  10 +
 drivers/target/target_core_device.c                |   4 +-
 drivers/thermal/cpu_cooling.c                      |   2 +-
 drivers/thermal/mtk_thermal.c                      |   6 +-
 drivers/thermal/rcar_gen3_thermal.c                |  38 +-
 drivers/tty/ipwireless/hardware.c                  |   2 +
 drivers/tty/serial/fsl_lpuart.c                    |  28 +-
 drivers/tty/serial/stm32-usart.c                   | 194 ++++++----
 drivers/tty/serial/stm32-usart.h                   |  14 +-
 drivers/uio/uio.c                                  |  10 +-
 drivers/usb/class/cdc-wdm.c                        |   2 +-
 drivers/usb/dwc2/gadget.c                          |   1 +
 drivers/usb/dwc3/Kconfig                           |   4 +-
 drivers/usb/gadget/udc/fsl_udc_core.c              |  30 +-
 drivers/usb/host/xhci-hub.c                        |   2 +-
 drivers/usb/phy/Kconfig                            |   2 +-
 drivers/usb/phy/phy-twl6030-usb.c                  |   2 +-
 drivers/usb/typec/Kconfig                          |   1 +
 drivers/usb/typec/fusb302/fusb302.c                |  10 +-
 drivers/usb/typec/tcpci.c                          |  10 +-
 drivers/usb/typec/tcpm.c                           |  32 +-
 drivers/usb/typec/typec_wcove.c                    |  10 +-
 drivers/vfio/mdev/mdev_core.c                      |  11 +-
 drivers/vfio/mdev/mdev_sysfs.c                     |   2 +-
 drivers/vfio/pci/vfio_pci.c                        |  19 +-
 drivers/vhost/test.c                               |   2 +
 drivers/video/backlight/lm3630a_bl.c               |   4 +-
 drivers/video/backlight/pwm_bl.c                   |  24 +-
 drivers/video/fbdev/chipsfb.c                      |   3 +-
 drivers/watchdog/rtd119x_wdt.c                     |   2 +-
 drivers/watchdog/sprd_wdt.c                        |   6 +-
 drivers/xen/cpu_hotplug.c                          |   2 +-
 drivers/xen/pvcalls-back.c                         |   2 +-
 fs/affs/super.c                                    |   6 -
 fs/afs/callback.c                                  |   8 +-
 fs/afs/dir_edit.c                                  |  12 +-
 fs/afs/file.c                                      |   7 +-
 fs/afs/flock.c                                     | 412 ++++++++++-----------
 fs/afs/inode.c                                     |   8 +-
 fs/afs/rxrpc.c                                     |   1 +
 fs/afs/security.c                                  |   4 +-
 fs/afs/super.c                                     |   1 +
 fs/afs/xattr.c                                     |   4 +-
 fs/btrfs/file.c                                    |   3 +-
 fs/btrfs/inode-map.c                               |  28 +-
 fs/ceph/xattr.c                                    |   2 +-
 fs/cifs/connect.c                                  |   3 +-
 fs/exportfs/expfs.c                                |   1 +
 fs/ext4/inline.c                                   |   2 +-
 fs/f2fs/dir.c                                      |   5 +
 fs/f2fs/f2fs.h                                     |   3 +-
 fs/f2fs/inline.c                                   |   6 +
 fs/jfs/jfs_txnmgr.c                                |   3 +-
 fs/nfs/delegation.c                                |  20 +-
 fs/nfs/delegation.h                                |   1 +
 fs/nfs/flexfilelayout/flexfilelayout.h             |  32 +-
 fs/nfs/nfs42xdr.c                                  |  10 +
 fs/nfs/pnfs.c                                      |  33 +-
 fs/nfs/pnfs.h                                      |   1 +
 fs/nfs/super.c                                     |   2 +-
 fs/nfs/write.c                                     |   2 +-
 fs/xfs/xfs_quotaops.c                              |   3 +
 include/drm/drm_panel.h                            |   1 +
 include/linux/acpi.h                               |  12 +-
 include/linux/device.h                             |   6 +-
 include/linux/irqchip/arm-gic-v3.h                 |  12 +-
 include/linux/mlx5/mlx5_ifc.h                      |   2 -
 include/linux/mmc/sdio_ids.h                       |   2 +
 include/linux/of.h                                 |   5 +-
 include/linux/pci.h                                |   1 +
 include/linux/perf_event.h                         |   7 +-
 include/linux/platform_data/dma-imx-sdma.h         |   3 +
 include/linux/rtc.h                                |   2 +-
 include/linux/signal.h                             |  15 +-
 include/linux/switchtec.h                          |   4 +-
 include/linux/usb/tcpm.h                           |  13 +-
 include/media/davinci/vpbe.h                       |   2 +-
 include/net/request_sock.h                         |   4 +-
 include/net/sctp/sctp.h                            |   5 +
 include/net/tcp.h                                  |   2 +-
 include/net/xfrm.h                                 |   1 -
 include/sound/soc.h                                |   2 +-
 include/trace/events/rxrpc.h                       |   6 +-
 include/uapi/linux/btf.h                           |   4 +-
 include/uapi/linux/netfilter/nf_tables.h           |   2 +-
 kernel/bpf/offload.c                               |   4 +-
 kernel/bpf/verifier.c                              |   2 +-
 kernel/debug/kdb/kdb_main.c                        |   2 +-
 kernel/events/core.c                               | 126 ++++---
 kernel/fork.c                                      |  16 +-
 kernel/irq/irqdomain.c                             |   3 +-
 kernel/signal.c                                    |   5 +
 lib/devres.c                                       |   3 +-
 lib/kfifo.c                                        |   3 +-
 net/6lowpan/nhc.c                                  |   2 +-
 net/bpfilter/bpfilter_kern.c                       |   2 +-
 net/bridge/br_arp_nd_proxy.c                       |   2 +-
 net/bridge/netfilter/ebtables.c                    |   4 +-
 net/core/dev.c                                     |  73 ++--
 net/core/filter.c                                  |   2 +-
 net/core/neighbour.c                               |   4 +-
 net/core/sock.c                                    |   4 +-
 net/dsa/port.c                                     |   7 +-
 net/dsa/slave.c                                    |   8 +-
 net/ieee802154/6lowpan/reassembly.c                |   2 +-
 net/ipv4/af_inet.c                                 |   2 +-
 net/ipv4/inet_connection_sock.c                    |   2 +-
 net/ipv4/ip_output.c                               |   3 +-
 net/ipv4/ip_tunnel.c                               |   5 +-
 net/ipv4/tcp.c                                     |   4 +-
 net/ipv4/udp_offload.c                             |   5 +
 net/ipv6/ip6_fib.c                                 |   3 +-
 net/ipv6/ip6_gre.c                                 |   1 +
 net/ipv6/ip6_output.c                              |   3 +-
 net/ipv6/raw.c                                     |   2 +
 net/ipv6/reassembly.c                              |   2 +-
 net/iucv/af_iucv.c                                 |  40 +-
 net/l2tp/l2tp_core.c                               |   3 +-
 net/llc/af_llc.c                                   |  34 +-
 net/llc/llc_conn.c                                 |  35 +-
 net/llc/llc_if.c                                   |  12 +-
 net/mac80211/rc80211_minstrel_ht.c                 |   2 +-
 net/mac80211/rx.c                                  |  11 +-
 net/mpls/mpls_iptunnel.c                           |   2 +-
 net/netfilter/nf_conntrack_netlink.c               |   7 +-
 net/netfilter/nf_flow_table_core.c                 |   9 +-
 net/netfilter/nft_flow_offload.c                   |   3 +-
 net/netfilter/nft_osf.c                            |  10 +
 net/netfilter/nft_set_hash.c                       |  25 +-
 net/packet/af_packet.c                             |  25 +-
 net/rds/ib_stats.c                                 |   2 +-
 net/rds/stats.c                                    |   2 +
 net/rxrpc/af_rxrpc.c                               |   3 -
 net/rxrpc/ar-internal.h                            |   2 +
 net/rxrpc/call_accept.c                            |   2 +-
 net/rxrpc/conn_client.c                            |  50 ++-
 net/rxrpc/conn_object.c                            |  15 +-
 net/rxrpc/conn_service.c                           |   2 +-
 net/rxrpc/input.c                                  |  18 +-
 net/rxrpc/local_object.c                           |   5 +-
 net/rxrpc/output.c                                 |   3 +
 net/sched/act_csum.c                               |  31 +-
 net/sched/act_mirred.c                             |   6 +-
 net/sched/sch_cbs.c                                | 108 +++++-
 net/sched/sch_netem.c                              |  18 +-
 net/sctp/input.c                                   |  12 +-
 net/smc/smc_diag.c                                 |   3 +-
 net/smc/smc_rx.c                                   |  29 +-
 net/sunrpc/auth_gss/svcauth_gss.c                  |  84 +++--
 net/sunrpc/xprtrdma/verbs.c                        |   3 +-
 net/tipc/link.c                                    |  29 +-
 net/tipc/monitor.c                                 |  15 +
 net/tipc/monitor.h                                 |   1 +
 net/tipc/name_distr.c                              |  18 +-
 net/tipc/name_table.c                              |   1 +
 net/tipc/name_table.h                              |   1 +
 net/tipc/net.c                                     |   2 +
 net/tipc/node.c                                    |   7 +-
 net/tipc/socket.c                                  |   2 +-
 net/tipc/sysctl.c                                  |   8 +-
 net/tls/tls_device_fallback.c                      |   4 +
 net/wireless/reg.c                                 |   9 +
 net/xdp/xdp_umem.c                                 |   6 +
 net/xdp/xsk.c                                      |  21 +-
 net/xfrm/xfrm_interface.c                          |  10 +-
 samples/bpf/xdp_rxq_info_user.c                    |   6 +-
 security/apparmor/include/cred.h                   |   2 +
 security/apparmor/lsm.c                            |   4 +-
 security/apparmor/net.c                            |  15 +-
 security/keys/key.c                                |   1 +
 sound/aoa/codecs/onyx.c                            |   4 +-
 sound/pci/hda/hda_controller.h                     |   9 +-
 sound/sh/aica.c                                    |  14 +-
 sound/soc/codecs/cs4349.c                          |   1 +
 sound/soc/codecs/es8328.c                          |   2 +-
 sound/soc/codecs/wm8737.c                          |   2 +-
 sound/soc/codecs/wm9705.c                          |  10 +-
 sound/soc/codecs/wm9712.c                          |  13 +-
 sound/soc/codecs/wm9713.c                          |  10 +-
 sound/soc/davinci/davinci-mcasp.c                  |  13 +-
 sound/soc/fsl/imx-sgtl5000.c                       |   3 +-
 sound/soc/meson/axg-tdmin.c                        |   1 -
 sound/soc/meson/axg-tdmout.c                       |   1 -
 sound/soc/qcom/apq8016_sbc.c                       |  21 +-
 sound/soc/soc-pcm.c                                |   4 +-
 sound/soc/sunxi/sun4i-i2s.c                        |   4 +-
 sound/soc/sunxi/sun8i-codec.c                      |   6 +-
 sound/usb/mixer.c                                  |   4 +-
 sound/usb/quirks-table.h                           |   9 +-
 tools/bpf/bpftool/btf_dumper.c                     |   8 +-
 tools/bpf/bpftool/cgroup.c                         |   6 +-
 tools/bpf/bpftool/map_perf_ring.c                  |   4 +-
 tools/perf/util/machine.c                          |  27 +-
 tools/testing/selftests/ipc/msgque.c               |  11 +-
 629 files changed, 4721 insertions(+), 3155 deletions(-)



^ permalink raw reply	[flat|nested] 685+ messages in thread

* [PATCH 4.19 001/639] Revert "efi: Fix debugobjects warning on efi_rts_work"
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
@ 2020-01-24  9:22 ` Greg Kroah-Hartman
  2020-01-24  9:22 ` [PATCH 4.19 002/639] xfs: Sanity check flags of Q_XQUOTARM call Greg Kroah-Hartman
                   ` (641 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:22 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chris Wilson, Waiman Long,
	Ard Biesheuvel, Sai Praneeth Prakhya, Linus Torvalds,
	Peter Zijlstra, Thomas Gleixner, linux-efi, Ingo Molnar,
	Sasha Levin

From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

This reverts commit 3e6b472f474accf757e107919f8ee42e7315ac0d which is
commit ef1491e791308317bb9851a0ad380c4a68b58d54 upstream.

Chris reports that this commit has problems and should not have been
backported to 4.19.y

Reported-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Waiman Long <longman@redhat.com>
Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: Sai Praneeth Prakhya <sai.praneeth.prakhya@intel.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: linux-efi@vger.kernel.org
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/firmware/efi/runtime-wrappers.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/firmware/efi/runtime-wrappers.c
+++ b/drivers/firmware/efi/runtime-wrappers.c
@@ -95,7 +95,7 @@ struct efi_runtime_work {
 	efi_rts_work.status = EFI_ABORTED;				\
 									\
 	init_completion(&efi_rts_work.efi_rts_comp);			\
-	INIT_WORK(&efi_rts_work.work, efi_call_rts);			\
+	INIT_WORK_ONSTACK(&efi_rts_work.work, efi_call_rts);		\
 	efi_rts_work.arg1 = _arg1;					\
 	efi_rts_work.arg2 = _arg2;					\
 	efi_rts_work.arg3 = _arg3;					\



^ permalink raw reply	[flat|nested] 685+ messages in thread

* [PATCH 4.19 002/639] xfs: Sanity check flags of Q_XQUOTARM call
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
  2020-01-24  9:22 ` [PATCH 4.19 001/639] Revert "efi: Fix debugobjects warning on efi_rts_work" Greg Kroah-Hartman
@ 2020-01-24  9:22 ` Greg Kroah-Hartman
  2020-01-24  9:22 ` [PATCH 4.19 003/639] i2c: stm32f7: rework slave_id allocation Greg Kroah-Hartman
                   ` (640 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:22 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yang Xu, Jan Kara, Eric Sandeen,
	Darrick J. Wong

From: Jan Kara <jack@suse.cz>

commit 3dd4d40b420846dd35869ccc8f8627feef2cff32 upstream.

Flags passed to Q_XQUOTARM were not sanity checked for invalid values.
Fix that.

Fixes: 9da93f9b7cdf ("xfs: fix Q_XQUOTARM ioctl")
Reported-by: Yang Xu <xuyang2018.jy@cn.fujitsu.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Reviewed-by: Eric Sandeen <sandeen@redhat.com>
Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/xfs/xfs_quotaops.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/fs/xfs/xfs_quotaops.c
+++ b/fs/xfs/xfs_quotaops.c
@@ -202,6 +202,9 @@ xfs_fs_rm_xquota(
 	if (XFS_IS_QUOTA_ON(mp))
 		return -EINVAL;
 
+	if (uflags & ~(FS_USER_QUOTA | FS_GROUP_QUOTA | FS_PROJ_QUOTA))
+		return -EINVAL;
+
 	if (uflags & FS_USER_QUOTA)
 		flags |= XFS_DQ_USER;
 	if (uflags & FS_GROUP_QUOTA)



^ permalink raw reply	[flat|nested] 685+ messages in thread

* [PATCH 4.19 003/639] i2c: stm32f7: rework slave_id allocation
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
  2020-01-24  9:22 ` [PATCH 4.19 001/639] Revert "efi: Fix debugobjects warning on efi_rts_work" Greg Kroah-Hartman
  2020-01-24  9:22 ` [PATCH 4.19 002/639] xfs: Sanity check flags of Q_XQUOTARM call Greg Kroah-Hartman
@ 2020-01-24  9:22 ` Greg Kroah-Hartman
  2020-01-24  9:22 ` [PATCH 4.19 004/639] i2c: i2c-stm32f7: fix 10-bits check in slave free id search loop Greg Kroah-Hartman
                   ` (639 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:22 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Alain Volmat, Pierre-Yves MORDRET,
	Wolfram Sang

From: Alain Volmat <alain.volmat@st.com>

commit 52d3be711e065a97a57c2f2ffba3098748855bd6 upstream.

The IP can handle two slave addresses. One address can either be
7 bits or 10 bits while the other can only be 7 bits.
In order to ensure that a 10 bits address can always be allocated
(assuming there is only one 7 bits address already allocated),
pick up the 7-bits only address slot in priority when performing a 7-bits
address allocation.

Fixes: 60d609f30de2 ("i2c: i2c-stm32f7: Add slave support")
Signed-off-by: Alain Volmat <alain.volmat@st.com>
Reviewed-by: Pierre-Yves MORDRET <pierre-yves.mordret@st.com>
Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/i2c/busses/i2c-stm32f7.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/i2c/busses/i2c-stm32f7.c
+++ b/drivers/i2c/busses/i2c-stm32f7.c
@@ -1252,7 +1252,7 @@ static int stm32f7_i2c_get_free_slave_id
 	 * slave[0] supports 7-bit and 10-bit slave address
 	 * slave[1] supports 7-bit slave address only
 	 */
-	for (i = 0; i < STM32F7_I2C_MAX_SLAVE; i++) {
+	for (i = STM32F7_I2C_MAX_SLAVE - 1; i >= 0; i--) {
 		if (i == 1 && (slave->flags & I2C_CLIENT_PEC))
 			continue;
 		if (!i2c_dev->slave[i]) {



^ permalink raw reply	[flat|nested] 685+ messages in thread

* [PATCH 4.19 004/639] i2c: i2c-stm32f7: fix 10-bits check in slave free id search loop
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (2 preceding siblings ...)
  2020-01-24  9:22 ` [PATCH 4.19 003/639] i2c: stm32f7: rework slave_id allocation Greg Kroah-Hartman
@ 2020-01-24  9:22 ` Greg Kroah-Hartman
  2020-01-24  9:22 ` [PATCH 4.19 005/639] mfd: intel-lpss: Add default I2C device properties for Gemini Lake Greg Kroah-Hartman
                   ` (638 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:22 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Alain Volmat, Pierre-Yves MORDRET,
	Wolfram Sang

From: Alain Volmat <alain.volmat@st.com>

commit 7787657d7ee55a9ecf4aea4907b46b87a44eda67 upstream.

Fix a typo in the free slave id search loop. Instead of I2C_CLIENT_PEC,
it should have been I2C_CLIENT_TEN. The slave id 1 can only handle 7-bit
addresses and thus is not eligible in case of 10-bit addresses.
As a matter of fact none of the slave id support I2C_CLIENT_PEC, overall
check is performed at the beginning of the stm32f7_i2c_reg_slave function.

Fixes: 60d609f30de2 ("i2c: i2c-stm32f7: Add slave support")
Signed-off-by: Alain Volmat <alain.volmat@st.com>
Reviewed-by: Pierre-Yves MORDRET <pierre-yves.mordret@st.com>
Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/i2c/busses/i2c-stm32f7.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/i2c/busses/i2c-stm32f7.c
+++ b/drivers/i2c/busses/i2c-stm32f7.c
@@ -1253,7 +1253,7 @@ static int stm32f7_i2c_get_free_slave_id
 	 * slave[1] supports 7-bit slave address only
 	 */
 	for (i = STM32F7_I2C_MAX_SLAVE - 1; i >= 0; i--) {
-		if (i == 1 && (slave->flags & I2C_CLIENT_PEC))
+		if (i == 1 && (slave->flags & I2C_CLIENT_TEN))
 			continue;
 		if (!i2c_dev->slave[i]) {
 			*id = i;



^ permalink raw reply	[flat|nested] 685+ messages in thread

* [PATCH 4.19 005/639] mfd: intel-lpss: Add default I2C device properties for Gemini Lake
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (3 preceding siblings ...)
  2020-01-24  9:22 ` [PATCH 4.19 004/639] i2c: i2c-stm32f7: fix 10-bits check in slave free id search loop Greg Kroah-Hartman
@ 2020-01-24  9:22 ` Greg Kroah-Hartman
  2020-01-24  9:22 ` [PATCH 4.19 006/639] SUNRPC: Fix svcauth_gss_proxy_init() Greg Kroah-Hartman
                   ` (637 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:22 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chris Chiu, Jarkko Nikula,
	Andy Shevchenko, Lee Jones

From: Jarkko Nikula <jarkko.nikula@linux.intel.com>

commit 3f31bc67e4dc6a555341dffefe328ddd58e8b431 upstream.

It turned out Intel Gemini Lake doesn't use the same I2C timing
parameters as Broxton.

I got confirmation from the Windows team that Gemini Lake systems should
use updated timing parameters that differ from those used in Broxton
based systems.

Fixes: f80e78aa11ad ("mfd: intel-lpss: Add Intel Gemini Lake PCI IDs")
Tested-by: Chris Chiu <chiu@endlessm.com>
Signed-off-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
Acked-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/mfd/intel-lpss-pci.c |   28 ++++++++++++++++++++--------
 1 file changed, 20 insertions(+), 8 deletions(-)

--- a/drivers/mfd/intel-lpss-pci.c
+++ b/drivers/mfd/intel-lpss-pci.c
@@ -126,6 +126,18 @@ static const struct intel_lpss_platform_
 	.properties = apl_i2c_properties,
 };
 
+static struct property_entry glk_i2c_properties[] = {
+	PROPERTY_ENTRY_U32("i2c-sda-hold-time-ns", 313),
+	PROPERTY_ENTRY_U32("i2c-sda-falling-time-ns", 171),
+	PROPERTY_ENTRY_U32("i2c-scl-falling-time-ns", 290),
+	{ },
+};
+
+static const struct intel_lpss_platform_info glk_i2c_info = {
+	.clk_rate = 133000000,
+	.properties = glk_i2c_properties,
+};
+
 static const struct intel_lpss_platform_info cnl_i2c_info = {
 	.clk_rate = 216000000,
 	.properties = spt_i2c_properties,
@@ -165,14 +177,14 @@ static const struct pci_device_id intel_
 	{ PCI_VDEVICE(INTEL, 0x1ac6), (kernel_ulong_t)&bxt_info },
 	{ PCI_VDEVICE(INTEL, 0x1aee), (kernel_ulong_t)&bxt_uart_info },
 	/* GLK */
-	{ PCI_VDEVICE(INTEL, 0x31ac), (kernel_ulong_t)&bxt_i2c_info },
-	{ PCI_VDEVICE(INTEL, 0x31ae), (kernel_ulong_t)&bxt_i2c_info },
-	{ PCI_VDEVICE(INTEL, 0x31b0), (kernel_ulong_t)&bxt_i2c_info },
-	{ PCI_VDEVICE(INTEL, 0x31b2), (kernel_ulong_t)&bxt_i2c_info },
-	{ PCI_VDEVICE(INTEL, 0x31b4), (kernel_ulong_t)&bxt_i2c_info },
-	{ PCI_VDEVICE(INTEL, 0x31b6), (kernel_ulong_t)&bxt_i2c_info },
-	{ PCI_VDEVICE(INTEL, 0x31b8), (kernel_ulong_t)&bxt_i2c_info },
-	{ PCI_VDEVICE(INTEL, 0x31ba), (kernel_ulong_t)&bxt_i2c_info },
+	{ PCI_VDEVICE(INTEL, 0x31ac), (kernel_ulong_t)&glk_i2c_info },
+	{ PCI_VDEVICE(INTEL, 0x31ae), (kernel_ulong_t)&glk_i2c_info },
+	{ PCI_VDEVICE(INTEL, 0x31b0), (kernel_ulong_t)&glk_i2c_info },
+	{ PCI_VDEVICE(INTEL, 0x31b2), (kernel_ulong_t)&glk_i2c_info },
+	{ PCI_VDEVICE(INTEL, 0x31b4), (kernel_ulong_t)&glk_i2c_info },
+	{ PCI_VDEVICE(INTEL, 0x31b6), (kernel_ulong_t)&glk_i2c_info },
+	{ PCI_VDEVICE(INTEL, 0x31b8), (kernel_ulong_t)&glk_i2c_info },
+	{ PCI_VDEVICE(INTEL, 0x31ba), (kernel_ulong_t)&glk_i2c_info },
 	{ PCI_VDEVICE(INTEL, 0x31bc), (kernel_ulong_t)&bxt_uart_info },
 	{ PCI_VDEVICE(INTEL, 0x31be), (kernel_ulong_t)&bxt_uart_info },
 	{ PCI_VDEVICE(INTEL, 0x31c0), (kernel_ulong_t)&bxt_uart_info },



^ permalink raw reply	[flat|nested] 685+ messages in thread

* [PATCH 4.19 006/639] SUNRPC: Fix svcauth_gss_proxy_init()
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (4 preceding siblings ...)
  2020-01-24  9:22 ` [PATCH 4.19 005/639] mfd: intel-lpss: Add default I2C device properties for Gemini Lake Greg Kroah-Hartman
@ 2020-01-24  9:22 ` Greg Kroah-Hartman
  2020-01-24  9:22 ` [PATCH 4.19 007/639] powerpc/pseries: Enable support for ibm,drc-info property Greg Kroah-Hartman
                   ` (636 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:22 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chuck Lever, Bill Baker, Simo Sorce,
	J. Bruce Fields

From: Chuck Lever <chuck.lever@oracle.com>

commit 5866efa8cbfbadf3905072798e96652faf02dbe8 upstream.

gss_read_proxy_verf() assumes things about the XDR buffer containing
the RPC Call that are not true for buffers generated by
svc_rdma_recv().

RDMA's buffers look more like what the upper layer generates for
sending: head is a kmalloc'd buffer; it does not point to a page
whose contents are contiguous with the first page in the buffers'
page array. The result is that ACCEPT_SEC_CONTEXT via RPC/RDMA has
stopped working on Linux NFS servers that use gssproxy.

This does not affect clients that use only TCP to send their
ACCEPT_SEC_CONTEXT operation (that's all Linux clients). Other
clients, like Solaris NFS clients, send ACCEPT_SEC_CONTEXT on the
same transport as they send all other NFS operations. Such clients
can send ACCEPT_SEC_CONTEXT via RPC/RDMA.

I thought I had found every direct reference in the server RPC code
to the rqstp->rq_pages field.

Bug found at the 2019 Westford NFS bake-a-thon.

Fixes: 3316f0631139 ("svcrdma: Persistently allocate and DMA- ... ")
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Tested-by: Bill Baker <bill.baker@oracle.com>
Reviewed-by: Simo Sorce <simo@redhat.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/sunrpc/auth_gss/svcauth_gss.c |   84 ++++++++++++++++++++++++++++----------
 1 file changed, 63 insertions(+), 21 deletions(-)

--- a/net/sunrpc/auth_gss/svcauth_gss.c
+++ b/net/sunrpc/auth_gss/svcauth_gss.c
@@ -1054,24 +1054,32 @@ gss_read_verf(struct rpc_gss_wire_cred *
 	return 0;
 }
 
-/* Ok this is really heavily depending on a set of semantics in
- * how rqstp is set up by svc_recv and pages laid down by the
- * server when reading a request. We are basically guaranteed that
- * the token lays all down linearly across a set of pages, starting
- * at iov_base in rq_arg.head[0] which happens to be the first of a
- * set of pages stored in rq_pages[].
- * rq_arg.head[0].iov_base will provide us the page_base to pass
- * to the upcall.
- */
-static inline int
-gss_read_proxy_verf(struct svc_rqst *rqstp,
-		    struct rpc_gss_wire_cred *gc, __be32 *authp,
-		    struct xdr_netobj *in_handle,
-		    struct gssp_in_token *in_token)
+static void gss_free_in_token_pages(struct gssp_in_token *in_token)
 {
-	struct kvec *argv = &rqstp->rq_arg.head[0];
 	u32 inlen;
-	int res;
+	int i;
+
+	i = 0;
+	inlen = in_token->page_len;
+	while (inlen) {
+		if (in_token->pages[i])
+			put_page(in_token->pages[i]);
+		inlen -= inlen > PAGE_SIZE ? PAGE_SIZE : inlen;
+	}
+
+	kfree(in_token->pages);
+	in_token->pages = NULL;
+}
+
+static int gss_read_proxy_verf(struct svc_rqst *rqstp,
+			       struct rpc_gss_wire_cred *gc, __be32 *authp,
+			       struct xdr_netobj *in_handle,
+			       struct gssp_in_token *in_token)
+{
+	struct kvec *argv = &rqstp->rq_arg.head[0];
+	unsigned int page_base, length;
+	int pages, i, res;
+	size_t inlen;
 
 	res = gss_read_common_verf(gc, argv, authp, in_handle);
 	if (res)
@@ -1081,10 +1089,36 @@ gss_read_proxy_verf(struct svc_rqst *rqs
 	if (inlen > (argv->iov_len + rqstp->rq_arg.page_len))
 		return SVC_DENIED;
 
-	in_token->pages = rqstp->rq_pages;
-	in_token->page_base = (ulong)argv->iov_base & ~PAGE_MASK;
+	pages = DIV_ROUND_UP(inlen, PAGE_SIZE);
+	in_token->pages = kcalloc(pages, sizeof(struct page *), GFP_KERNEL);
+	if (!in_token->pages)
+		return SVC_DENIED;
+	in_token->page_base = 0;
 	in_token->page_len = inlen;
+	for (i = 0; i < pages; i++) {
+		in_token->pages[i] = alloc_page(GFP_KERNEL);
+		if (!in_token->pages[i]) {
+			gss_free_in_token_pages(in_token);
+			return SVC_DENIED;
+		}
+	}
 
+	length = min_t(unsigned int, inlen, argv->iov_len);
+	memcpy(page_address(in_token->pages[0]), argv->iov_base, length);
+	inlen -= length;
+
+	i = 1;
+	page_base = rqstp->rq_arg.page_base;
+	while (inlen) {
+		length = min_t(unsigned int, inlen, PAGE_SIZE);
+		memcpy(page_address(in_token->pages[i]),
+		       page_address(rqstp->rq_arg.pages[i]) + page_base,
+		       length);
+
+		inlen -= length;
+		page_base = 0;
+		i++;
+	}
 	return 0;
 }
 
@@ -1259,8 +1293,11 @@ static int svcauth_gss_proxy_init(struct
 		break;
 	case GSS_S_COMPLETE:
 		status = gss_proxy_save_rsc(sn->rsc_cache, &ud, &handle);
-		if (status)
+		if (status) {
+			pr_info("%s: gss_proxy_save_rsc failed (%d)\n",
+				__func__, status);
 			goto out;
+		}
 		cli_handle.data = (u8 *)&handle;
 		cli_handle.len = sizeof(handle);
 		break;
@@ -1271,15 +1308,20 @@ static int svcauth_gss_proxy_init(struct
 
 	/* Got an answer to the upcall; use it: */
 	if (gss_write_init_verf(sn->rsc_cache, rqstp,
-				&cli_handle, &ud.major_status))
+				&cli_handle, &ud.major_status)) {
+		pr_info("%s: gss_write_init_verf failed\n", __func__);
 		goto out;
+	}
 	if (gss_write_resv(resv, PAGE_SIZE,
 			   &cli_handle, &ud.out_token,
-			   ud.major_status, ud.minor_status))
+			   ud.major_status, ud.minor_status)) {
+		pr_info("%s: gss_write_resv failed\n", __func__);
 		goto out;
+	}
 
 	ret = SVC_COMPLETE;
 out:
+	gss_free_in_token_pages(&ud.in_token);
 	gssp_free_upcall_data(&ud);
 	return ret;
 }



^ permalink raw reply	[flat|nested] 685+ messages in thread

* [PATCH 4.19 007/639] powerpc/pseries: Enable support for ibm,drc-info property
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (5 preceding siblings ...)
  2020-01-24  9:22 ` [PATCH 4.19 006/639] SUNRPC: Fix svcauth_gss_proxy_init() Greg Kroah-Hartman
@ 2020-01-24  9:22 ` Greg Kroah-Hartman
  2020-01-24  9:22 ` [PATCH 4.19 008/639] powerpc/archrandom: fix arch_get_random_seed_int() Greg Kroah-Hartman
                   ` (635 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:22 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Tyrel Datwyler, Michael Ellerman

From: Tyrel Datwyler <tyreld@linux.ibm.com>

commit 0a87ccd3699983645f54cafd2258514a716b20b8 upstream.

Advertise client support for the PAPR architected ibm,drc-info device
tree property during CAS handshake.

Fixes: c7a3275e0f9e ("powerpc/pseries: Revert support for ibm,drc-info devtree property")
Signed-off-by: Tyrel Datwyler <tyreld@linux.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/1573449697-5448-11-git-send-email-tyreld@linux.ibm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/powerpc/kernel/prom_init.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/powerpc/kernel/prom_init.c
+++ b/arch/powerpc/kernel/prom_init.c
@@ -904,7 +904,7 @@ struct ibm_arch_vec __cacheline_aligned
 		.reserved2 = 0,
 		.reserved3 = 0,
 		.subprocessors = 1,
-		.byte22 = OV5_FEAT(OV5_DRMEM_V2),
+		.byte22 = OV5_FEAT(OV5_DRMEM_V2) | OV5_FEAT(OV5_DRC_INFO),
 		.intarch = 0,
 		.mmu = 0,
 		.hash_ext = 0,



^ permalink raw reply	[flat|nested] 685+ messages in thread

* [PATCH 4.19 008/639] powerpc/archrandom: fix arch_get_random_seed_int()
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (6 preceding siblings ...)
  2020-01-24  9:22 ` [PATCH 4.19 007/639] powerpc/pseries: Enable support for ibm,drc-info property Greg Kroah-Hartman
@ 2020-01-24  9:22 ` Greg Kroah-Hartman
  2020-01-24  9:22 ` [PATCH 4.19 009/639] tipc: update mons self addr when node addr generated Greg Kroah-Hartman
                   ` (634 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:22 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Ard Biesheuvel, Michael Ellerman

From: Ard Biesheuvel <ardb@kernel.org>

commit b6afd1234cf93aa0d71b4be4788c47534905f0be upstream.

Commit 01c9348c7620ec65

  powerpc: Use hardware RNG for arch_get_random_seed_* not arch_get_random_*

updated arch_get_random_[int|long]() to be NOPs, and moved the hardware
RNG backing to arch_get_random_seed_[int|long]() instead. However, it
failed to take into account that arch_get_random_int() was implemented
in terms of arch_get_random_long(), and so we ended up with a version
of the former that is essentially a NOP as well.

Fix this by calling arch_get_random_seed_long() from
arch_get_random_seed_int() instead.

Fixes: 01c9348c7620ec65 ("powerpc: Use hardware RNG for arch_get_random_seed_* not arch_get_random_*")
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20191204115015.18015-1-ardb@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/powerpc/include/asm/archrandom.h |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/powerpc/include/asm/archrandom.h
+++ b/arch/powerpc/include/asm/archrandom.h
@@ -28,7 +28,7 @@ static inline int arch_get_random_seed_i
 	unsigned long val;
 	int rc;
 
-	rc = arch_get_random_long(&val);
+	rc = arch_get_random_seed_long(&val);
 	if (rc)
 		*v = val;
 



^ permalink raw reply	[flat|nested] 685+ messages in thread

* [PATCH 4.19 009/639] tipc: update mons self addr when node addr generated
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (7 preceding siblings ...)
  2020-01-24  9:22 ` [PATCH 4.19 008/639] powerpc/archrandom: fix arch_get_random_seed_int() Greg Kroah-Hartman
@ 2020-01-24  9:22 ` Greg Kroah-Hartman
  2020-01-24  9:23 ` [PATCH 4.19 010/639] tipc: fix wrong timeout input for tipc_wait_for_cond() Greg Kroah-Hartman
                   ` (633 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:22 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jon Maloy, Hoang Le, David S. Miller

From: Hoang Le <hoang.h.le@dektech.com.au>

commit 46cb01eeeb86fca6afe24dda1167b0cb95424e29 upstream.

In commit 25b0b9c4e835 ("tipc: handle collisions of 32-bit node address
hash values"), the 32-bit node address only generated after one second
trial period expired. However the self's addr in struct tipc_monitor do
not update according to node address generated. This lead to it is
always zero as initial value. As result, sorting algorithm using this
value does not work as expected, neither neighbor monitoring framework.

In this commit, we add a fix to update self's addr when 32-bit node
address generated.

Fixes: 25b0b9c4e835 ("tipc: handle collisions of 32-bit node address hash values")
Acked-by: Jon Maloy <jon.maloy@ericsson.com>
Signed-off-by: Hoang Le <hoang.h.le@dektech.com.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/tipc/monitor.c |   15 +++++++++++++++
 net/tipc/monitor.h |    1 +
 net/tipc/net.c     |    2 ++
 3 files changed, 18 insertions(+)

--- a/net/tipc/monitor.c
+++ b/net/tipc/monitor.c
@@ -665,6 +665,21 @@ void tipc_mon_delete(struct net *net, in
 	kfree(mon);
 }
 
+void tipc_mon_reinit_self(struct net *net)
+{
+	struct tipc_monitor *mon;
+	int bearer_id;
+
+	for (bearer_id = 0; bearer_id < MAX_BEARERS; bearer_id++) {
+		mon = tipc_monitor(net, bearer_id);
+		if (!mon)
+			continue;
+		write_lock_bh(&mon->lock);
+		mon->self->addr = tipc_own_addr(net);
+		write_unlock_bh(&mon->lock);
+	}
+}
+
 int tipc_nl_monitor_set_threshold(struct net *net, u32 cluster_size)
 {
 	struct tipc_net *tn = tipc_net(net);
--- a/net/tipc/monitor.h
+++ b/net/tipc/monitor.h
@@ -77,6 +77,7 @@ int __tipc_nl_add_monitor(struct net *ne
 			  u32 bearer_id);
 int tipc_nl_add_monitor_peer(struct net *net, struct tipc_nl_msg *msg,
 			     u32 bearer_id, u32 *prev_node);
+void tipc_mon_reinit_self(struct net *net);
 
 extern const int tipc_max_domain_size;
 #endif
--- a/net/tipc/net.c
+++ b/net/tipc/net.c
@@ -42,6 +42,7 @@
 #include "node.h"
 #include "bcast.h"
 #include "netlink.h"
+#include "monitor.h"
 
 /*
  * The TIPC locking policy is designed to ensure a very fine locking
@@ -136,6 +137,7 @@ static void tipc_net_finalize(struct net
 	tipc_set_node_addr(net, addr);
 	tipc_named_reinit(net);
 	tipc_sk_reinit(net);
+	tipc_mon_reinit_self(net);
 	tipc_nametbl_publish(net, TIPC_CFG_SRV, addr, addr,
 			     TIPC_CLUSTER_SCOPE, 0, addr);
 }



^ permalink raw reply	[flat|nested] 685+ messages in thread

* [PATCH 4.19 010/639] tipc: fix wrong timeout input for tipc_wait_for_cond()
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (8 preceding siblings ...)
  2020-01-24  9:22 ` [PATCH 4.19 009/639] tipc: update mons self addr when node addr generated Greg Kroah-Hartman
@ 2020-01-24  9:23 ` Greg Kroah-Hartman
  2020-01-24  9:23 ` [PATCH 4.19 011/639] mt7601u: fix bbp version check in mt7601u_wait_bbp_ready Greg Kroah-Hartman
                   ` (632 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:23 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Tung Nguyen, Jon Maloy, David S. Miller

From: Tung Nguyen <tung.q.nguyen@dektech.com.au>

commit 12db3c8083fcab4270866a88191933f2d9f24f89 upstream.

In function __tipc_shutdown(), the timeout value passed to
tipc_wait_for_cond() is not jiffies.

This commit fixes it by converting that value from milliseconds
to jiffies.

Fixes: 365ad353c256 ("tipc: reduce risk of user starvation during link congestion")
Signed-off-by: Tung Nguyen <tung.q.nguyen@dektech.com.au>
Acked-by: Jon Maloy <jon.maloy@ericsson.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/tipc/socket.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -501,7 +501,7 @@ static void __tipc_shutdown(struct socke
 	struct sock *sk = sock->sk;
 	struct tipc_sock *tsk = tipc_sk(sk);
 	struct net *net = sock_net(sk);
-	long timeout = CONN_TIMEOUT_DEFAULT;
+	long timeout = msecs_to_jiffies(CONN_TIMEOUT_DEFAULT);
 	u32 dnode = tsk_peer_node(tsk);
 	struct sk_buff *skb;
 



^ permalink raw reply	[flat|nested] 685+ messages in thread

* [PATCH 4.19 011/639] mt7601u: fix bbp version check in mt7601u_wait_bbp_ready
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (9 preceding siblings ...)
  2020-01-24  9:23 ` [PATCH 4.19 010/639] tipc: fix wrong timeout input for tipc_wait_for_cond() Greg Kroah-Hartman
@ 2020-01-24  9:23 ` Greg Kroah-Hartman
  2020-01-24  9:23 ` [PATCH 4.19 012/639] crypto: sun4i-ss - fix big endian issues Greg Kroah-Hartman
                   ` (631 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:23 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jakub Kicinski, Lorenzo Bianconi, Kalle Valo

From: Lorenzo Bianconi <lorenzo@kernel.org>

commit 15e14f76f85f4f0eab3b8146e1cd3c58ce272823 upstream.

Fix bbp ready check in mt7601u_wait_bbp_ready. The issue is reported by
coverity with the following error:

Logical vs. bitwise operator
The expression's value does not depend on the operands; inadvertent use
of the wrong operator is a likely logic error.

Addresses-Coverity-ID: 1309441 ("Logical vs. bitwise operator")
Fixes: c869f77d6abb ("add mt7601u driver")
Acked-by: Jakub Kicinski <kubakici@wp.pl>
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/wireless/mediatek/mt7601u/phy.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/net/wireless/mediatek/mt7601u/phy.c
+++ b/drivers/net/wireless/mediatek/mt7601u/phy.c
@@ -221,7 +221,7 @@ int mt7601u_wait_bbp_ready(struct mt7601
 
 	do {
 		val = mt7601u_bbp_rr(dev, MT_BBP_REG_VERSION);
-		if (val && ~val)
+		if (val && val != 0xff)
 			break;
 	} while (--i);
 



^ permalink raw reply	[flat|nested] 685+ messages in thread

* [PATCH 4.19 012/639] crypto: sun4i-ss - fix big endian issues
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (10 preceding siblings ...)
  2020-01-24  9:23 ` [PATCH 4.19 011/639] mt7601u: fix bbp version check in mt7601u_wait_bbp_ready Greg Kroah-Hartman
@ 2020-01-24  9:23 ` Greg Kroah-Hartman
  2020-01-24  9:23 ` [PATCH 4.19 013/639] perf map: No need to adjust the long name of modules Greg Kroah-Hartman
                   ` (630 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:23 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Corentin Labbe, Herbert Xu

From: Corentin Labbe <clabbe.montjoie@gmail.com>

commit d1d787bcebfe122a5bd443ae565696661e2e9656 upstream.

When testing BigEndian kernel, the sun4i-ss was failling all crypto
tests.
This patch fix endian issues with it.

Fixes: 6298e948215f ("crypto: sunxi-ss - Add Allwinner Security System crypto accelerator")
Signed-off-by: Corentin Labbe <clabbe.montjoie@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/crypto/sunxi-ss/sun4i-ss-hash.c |   21 +++++++++++----------
 1 file changed, 11 insertions(+), 10 deletions(-)

--- a/drivers/crypto/sunxi-ss/sun4i-ss-hash.c
+++ b/drivers/crypto/sunxi-ss/sun4i-ss-hash.c
@@ -179,7 +179,7 @@ static int sun4i_hash(struct ahash_reque
 	 */
 	unsigned int i = 0, end, fill, min_fill, nwait, nbw = 0, j = 0, todo;
 	unsigned int in_i = 0;
-	u32 spaces, rx_cnt = SS_RX_DEFAULT, bf[32] = {0}, wb = 0, v, ivmode = 0;
+	u32 spaces, rx_cnt = SS_RX_DEFAULT, bf[32] = {0}, v, ivmode = 0;
 	struct sun4i_req_ctx *op = ahash_request_ctx(areq);
 	struct crypto_ahash *tfm = crypto_ahash_reqtfm(areq);
 	struct sun4i_tfm_ctx *tfmctx = crypto_ahash_ctx(tfm);
@@ -188,6 +188,7 @@ static int sun4i_hash(struct ahash_reque
 	struct sg_mapping_iter mi;
 	int in_r, err = 0;
 	size_t copied = 0;
+	__le32 wb = 0;
 
 	dev_dbg(ss->dev, "%s %s bc=%llu len=%u mode=%x wl=%u h0=%0x",
 		__func__, crypto_tfm_alg_name(areq->base.tfm),
@@ -399,7 +400,7 @@ hash_final:
 
 		nbw = op->len - 4 * nwait;
 		if (nbw) {
-			wb = *(u32 *)(op->buf + nwait * 4);
+			wb = cpu_to_le32(*(u32 *)(op->buf + nwait * 4));
 			wb &= GENMASK((nbw * 8) - 1, 0);
 
 			op->byte_count += nbw;
@@ -408,7 +409,7 @@ hash_final:
 
 	/* write the remaining bytes of the nbw buffer */
 	wb |= ((1 << 7) << (nbw * 8));
-	bf[j++] = wb;
+	bf[j++] = le32_to_cpu(wb);
 
 	/*
 	 * number of space to pad to obtain 64o minus 8(size) minus 4 (final 1)
@@ -427,13 +428,13 @@ hash_final:
 
 	/* write the length of data */
 	if (op->mode == SS_OP_SHA1) {
-		__be64 bits = cpu_to_be64(op->byte_count << 3);
-		bf[j++] = lower_32_bits(bits);
-		bf[j++] = upper_32_bits(bits);
+		__be64 *bits = (__be64 *)&bf[j];
+		*bits = cpu_to_be64(op->byte_count << 3);
+		j += 2;
 	} else {
-		__le64 bits = op->byte_count << 3;
-		bf[j++] = lower_32_bits(bits);
-		bf[j++] = upper_32_bits(bits);
+		__le64 *bits = (__le64 *)&bf[j];
+		*bits = cpu_to_le64(op->byte_count << 3);
+		j += 2;
 	}
 	writesl(ss->base + SS_RXFIFO, bf, j);
 
@@ -475,7 +476,7 @@ hash_final:
 		}
 	} else {
 		for (i = 0; i < 4; i++) {
-			v = readl(ss->base + SS_MD0 + i * 4);
+			v = cpu_to_le32(readl(ss->base + SS_MD0 + i * 4));
 			memcpy(areq->result + i * 4, &v, 4);
 		}
 	}



^ permalink raw reply	[flat|nested] 685+ messages in thread

* [PATCH 4.19 013/639] perf map: No need to adjust the long name of modules
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (11 preceding siblings ...)
  2020-01-24  9:23 ` [PATCH 4.19 012/639] crypto: sun4i-ss - fix big endian issues Greg Kroah-Hartman
@ 2020-01-24  9:23 ` Greg Kroah-Hartman
  2020-01-24  9:23 ` [PATCH 4.19 014/639] leds: tlc591xx: update the maximum brightness Greg Kroah-Hartman
                   ` (629 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:23 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Adrian Hunter, Andi Kleen, Jiri Olsa,
	Namhyung Kim, Wang Nan, Arnaldo Carvalho de Melo

From: Arnaldo Carvalho de Melo <acme@redhat.com>

commit f068435d9bb2d825d59e3c101bc579f09315ee01 upstream.

At some point in the past we needed to make sure we would get the long
name of modules and not just what we get from /proc/modules, but that
need, as described in the cset that introduced the adjustment function:

Fixes: c03d5184f0e9 ("perf machine: Adjust dso->long_name for offline module")

Without using the buildid-cache:

  # lsmod | grep trusted
  # insmod trusted.ko
  # lsmod | grep trusted
  trusted                24576  0
  # strace -e open,openat perf probe -m ./trusted.ko key_seal |& grep trusted
  openat(AT_FDCWD, "/sys/module/trusted/notes/.note.gnu.build-id", O_RDONLY) = 4
  openat(AT_FDCWD, "/sys/module/trusted/notes/.note.gnu.build-id", O_RDONLY) = 7
  openat(AT_FDCWD, "/root/trusted.ko", O_RDONLY) = 3
  openat(AT_FDCWD, "/root/.debug/root/trusted.ko/dd3d355d567394d540f527e093e0f64b95879584/probes", O_RDWR|O_CREAT, 0644) = 3
  openat(AT_FDCWD, "/usr/lib/debug/root/trusted.ko.debug", O_RDONLY) = -1 ENOENT (No such file or directory)
  openat(AT_FDCWD, "/usr/lib/debug/root/trusted.ko", O_RDONLY) = -1 ENOENT (No such file or directory)
  openat(AT_FDCWD, "/root/.debug/trusted.ko", O_RDONLY) = -1 ENOENT (No such file or directory)
  openat(AT_FDCWD, "/root/trusted.ko", O_RDONLY) = 3
  openat(AT_FDCWD, "trusted.ko.debug", O_RDONLY) = -1 ENOENT (No such file or directory)
  openat(AT_FDCWD, ".debug/trusted.ko.debug", O_RDONLY) = -1 ENOENT (No such file or directory)
  openat(AT_FDCWD, "trusted.ko.debug", O_RDONLY) = -1 ENOENT (No such file or directory)
  openat(AT_FDCWD, "/root/trusted.ko", O_RDONLY) = 3
  openat(AT_FDCWD, "/root/trusted.ko", O_RDONLY) = 3
  openat(AT_FDCWD, "/root/trusted.ko", O_RDONLY) = 4
  openat(AT_FDCWD, "/root/trusted.ko", O_RDONLY) = 3
    probe:key_seal       (on key_seal in trusted)
  # perf probe -l
    probe:key_seal       (on key_seal in trusted)
  #

No attempt at opening '[trusted]'.

Now using the build-id cache:

  # rmmod trusted
  # perf buildid-cache --add ./trusted.ko
  # insmod trusted.ko
  # strace -e open,openat perf probe -m ./trusted.ko key_seal |& grep trusted
  openat(AT_FDCWD, "/sys/module/trusted/notes/.note.gnu.build-id", O_RDONLY) = 4
  openat(AT_FDCWD, "/sys/module/trusted/notes/.note.gnu.build-id", O_RDONLY) = 7
  openat(AT_FDCWD, "/root/trusted.ko", O_RDONLY) = 3
  openat(AT_FDCWD, "/root/.debug/root/trusted.ko/dd3d355d567394d540f527e093e0f64b95879584/probes", O_RDWR|O_CREAT, 0644) = 3
  openat(AT_FDCWD, "/usr/lib/debug/root/trusted.ko.debug", O_RDONLY) = -1 ENOENT (No such file or directory)
  openat(AT_FDCWD, "/usr/lib/debug/root/trusted.ko", O_RDONLY) = -1 ENOENT (No such file or directory)
  openat(AT_FDCWD, "/root/.debug/trusted.ko", O_RDONLY) = -1 ENOENT (No such file or directory)
  openat(AT_FDCWD, "/root/trusted.ko", O_RDONLY) = 3
  openat(AT_FDCWD, "trusted.ko.debug", O_RDONLY) = -1 ENOENT (No such file or directory)
  openat(AT_FDCWD, ".debug/trusted.ko.debug", O_RDONLY) = -1 ENOENT (No such file or directory)
  openat(AT_FDCWD, "trusted.ko.debug", O_RDONLY) = -1 ENOENT (No such file or directory)
  openat(AT_FDCWD, "/root/trusted.ko", O_RDONLY) = 3
  openat(AT_FDCWD, "/root/trusted.ko", O_RDONLY) = 3
  openat(AT_FDCWD, "/root/trusted.ko", O_RDONLY) = 4
  openat(AT_FDCWD, "/root/trusted.ko", O_RDONLY) = 3
  #

Again, no attempt at reading '[trusted]'.

Finally, adding a probe to that function and then using:

[root@quaco ~]# perf trace -e probe_perf:*/max-stack=16/ --max-events=2
     0.000 perf/13456 probe_perf:dso__adjust_kmod_long_name(__probe_ip: 5492263)
                                       dso__adjust_kmod_long_name (/home/acme/bin/perf)
                                       machine__process_kernel_mmap_event (/home/acme/bin/perf)
                                       machine__process_mmap_event (/home/acme/bin/perf)
                                       perf_event__process_mmap (/home/acme/bin/perf)
                                       machines__deliver_event (/home/acme/bin/perf)
                                       perf_session__deliver_event (/home/acme/bin/perf)
                                       perf_session__process_event (/home/acme/bin/perf)
                                       process_simple (/home/acme/bin/perf)
                                       reader__process_events (/home/acme/bin/perf)
                                       __perf_session__process_events (/home/acme/bin/perf)
                                       perf_session__process_events (/home/acme/bin/perf)
                                       process_buildids (/home/acme/bin/perf)
                                       record__finish_output (/home/acme/bin/perf)
                                       __cmd_record (/home/acme/bin/perf)
                                       cmd_record (/home/acme/bin/perf)
                                       run_builtin (/home/acme/bin/perf)
     0.055 perf/13456 probe_perf:dso__adjust_kmod_long_name(__probe_ip: 5492263)
                                       dso__adjust_kmod_long_name (/home/acme/bin/perf)
                                       machine__process_kernel_mmap_event (/home/acme/bin/perf)
                                       machine__process_mmap_event (/home/acme/bin/perf)
                                       perf_event__process_mmap (/home/acme/bin/perf)
                                       machines__deliver_event (/home/acme/bin/perf)
                                       perf_session__deliver_event (/home/acme/bin/perf)
                                       perf_session__process_event (/home/acme/bin/perf)
                                       process_simple (/home/acme/bin/perf)
                                       reader__process_events (/home/acme/bin/perf)
                                       __perf_session__process_events (/home/acme/bin/perf)
                                       perf_session__process_events (/home/acme/bin/perf)
                                       process_buildids (/home/acme/bin/perf)
                                       record__finish_output (/home/acme/bin/perf)
                                       __cmd_record (/home/acme/bin/perf)
                                       cmd_record (/home/acme/bin/perf)
                                       run_builtin (/home/acme/bin/perf)
  #

This was the only path I could find using the perf tools that reach at this
function, then as of november/2019, if we put a probe in the line where the
actuall setting of the dso->long_name is done:

  # perf trace -e probe_perf:*
  ^C[root@quaco ~]
  # perf stat -e probe_perf:*  -I 2000
       2.000404265                  0      probe_perf:dso__adjust_kmod_long_name
       4.001142200                  0      probe_perf:dso__adjust_kmod_long_name
       6.001704120                  0      probe_perf:dso__adjust_kmod_long_name
       8.002398316                  0      probe_perf:dso__adjust_kmod_long_name
      10.002984010                  0      probe_perf:dso__adjust_kmod_long_name
      12.003597851                  0      probe_perf:dso__adjust_kmod_long_name
      14.004113303                  0      probe_perf:dso__adjust_kmod_long_name
      16.004582773                  0      probe_perf:dso__adjust_kmod_long_name
      18.005176373                  0      probe_perf:dso__adjust_kmod_long_name
      20.005801605                  0      probe_perf:dso__adjust_kmod_long_name
      22.006467540                  0      probe_perf:dso__adjust_kmod_long_name
  ^C    23.683261941                  0      probe_perf:dso__adjust_kmod_long_name

  #

Its not being used at all.

To further test this I used kvm.ko as the offline module, i.e. removed
if from the buildid-cache by nuking it completely (rm -rf ~/.debug) and
moved it from the normal kernel distro path, removed the modules, stoped
the kvm guest, and then installed it manually, etc.

  # rmmod kvm-intel
  # rmmod kvm
  # lsmod | grep kvm
  # modprobe kvm-intel
  modprobe: ERROR: ctx=0x55d3b1722260 path=/lib/modules/5.3.8-200.fc30.x86_64/kernel/arch/x86/kvm/kvm.ko.xz error=No such file or directory
  modprobe: ERROR: ctx=0x55d3b1722260 path=/lib/modules/5.3.8-200.fc30.x86_64/kernel/arch/x86/kvm/kvm.ko.xz error=No such file or directory
  modprobe: ERROR: could not insert 'kvm_intel': Unknown symbol in module, or unknown parameter (see dmesg)
  # insmod ./kvm.ko
  # modprobe kvm-intel
  modprobe: ERROR: ctx=0x562f34026260 path=/lib/modules/5.3.8-200.fc30.x86_64/kernel/arch/x86/kvm/kvm.ko.xz error=No such file or directory
  modprobe: ERROR: ctx=0x562f34026260 path=/lib/modules/5.3.8-200.fc30.x86_64/kernel/arch/x86/kvm/kvm.ko.xz error=No such file or directory
  # lsmod | grep kvm
  kvm_intel             299008  0
  kvm                   765952  1 kvm_intel
  irqbypass              16384  1 kvm
  #
  # perf probe -x ~/bin/perf machine__findnew_module_map:12 mname=m.name:string filename=filename:string 'dso_long_name=map->dso->long_name:string' 'dso_name=map->dso->name:string'
  # perf probe -l
    probe_perf:machine__findnew_module_map (on machine__findnew_module_map:12@util/machine.c in /home/acme/bin/perf with mname filename dso_long_name dso_name)
  # perf record
  ^C[ perf record: Woken up 2 times to write data ]
  [ perf record: Captured and wrote 3.416 MB perf.data (33956 samples) ]
  # perf trace -e probe_perf:machine*
  <SNIP>
       6.322 perf/23099 probe_perf:machine__findnew_module_map(__probe_ip: 5492493, mname: "[salsa20_generic]", filename: "/lib/modules/5.3.8-200.fc30.x86_64/kernel/crypto/salsa20_generic.ko.xz", dso_long_name: "/lib/modules/5.3.8-200.fc30.x86_64/kernel/crypto/salsa20_generic.ko.xz", dso_name: "[salsa20_generic]")
       6.375 perf/23099 probe_perf:machine__findnew_module_map(__probe_ip: 5492493, mname: "[kvm]", filename: "[kvm]", dso_long_name: "[kvm]", dso_name: "[kvm]")
  <SNIP>

The filename doesn't come with the path, no point in trying to set the dso->long_name.

  [root@quaco ~]# strace -e open,openat perf probe -m ./kvm.ko kvm_apic_local_deliver |& egrep 'open.*kvm'
  openat(AT_FDCWD, "/sys/module/kvm_intel/notes/.note.gnu.build-id", O_RDONLY) = 4
  openat(AT_FDCWD, "/sys/module/kvm/notes/.note.gnu.build-id", O_RDONLY) = 4
  openat(AT_FDCWD, "/lib/modules/5.3.8-200.fc30.x86_64/kernel/arch/x86/kvm", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 7
  openat(AT_FDCWD, "/sys/module/kvm_intel/notes/.note.gnu.build-id", O_RDONLY) = 8
  openat(AT_FDCWD, "/root/kvm.ko", O_RDONLY) = 3
  openat(AT_FDCWD, "/root/.debug/root/kvm.ko/5955f426cb93f03f30f3e876814be2db80ab0b55/probes", O_RDWR|O_CREAT, 0644) = 3
  openat(AT_FDCWD, "/usr/lib/debug/root/kvm.ko.debug", O_RDONLY) = -1 ENOENT (No such file or directory)
  openat(AT_FDCWD, "/usr/lib/debug/root/kvm.ko", O_RDONLY) = -1 ENOENT (No such file or directory)
  openat(AT_FDCWD, "/root/.debug/kvm.ko", O_RDONLY) = -1 ENOENT (No such file or directory)
  openat(AT_FDCWD, "/root/kvm.ko", O_RDONLY) = 3
  openat(AT_FDCWD, "kvm.ko.debug", O_RDONLY) = -1 ENOENT (No such file or directory)
  openat(AT_FDCWD, ".debug/kvm.ko.debug", O_RDONLY) = -1 ENOENT (No such file or directory)
  openat(AT_FDCWD, "kvm.ko.debug", O_RDONLY) = -1 ENOENT (No such file or directory)
  openat(AT_FDCWD, "/root/kvm.ko", O_RDONLY) = 3
  openat(AT_FDCWD, "/root/kvm.ko", O_RDONLY) = 3
  openat(AT_FDCWD, "/root/kvm.ko", O_RDONLY) = 4
  openat(AT_FDCWD, "/root/kvm.ko", O_RDONLY) = 3
  [root@quaco ~]#

Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Andi Kleen <ak@linux.intel.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Wang Nan <wangnan0@huawei.com>
Link: https://lkml.kernel.org/n/tip-jlfew3lyb24d58egrp0o72o2@git.kernel.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 tools/perf/util/machine.c |   27 +--------------------------
 1 file changed, 1 insertion(+), 26 deletions(-)

--- a/tools/perf/util/machine.c
+++ b/tools/perf/util/machine.c
@@ -681,24 +681,6 @@ int machine__process_switch_event(struct
 	return 0;
 }
 
-static void dso__adjust_kmod_long_name(struct dso *dso, const char *filename)
-{
-	const char *dup_filename;
-
-	if (!filename || !dso || !dso->long_name)
-		return;
-	if (dso->long_name[0] != '[')
-		return;
-	if (!strchr(filename, '/'))
-		return;
-
-	dup_filename = strdup(filename);
-	if (!dup_filename)
-		return;
-
-	dso__set_long_name(dso, dup_filename, true);
-}
-
 struct map *machine__findnew_module_map(struct machine *machine, u64 start,
 					const char *filename)
 {
@@ -710,15 +692,8 @@ struct map *machine__findnew_module_map(
 		return NULL;
 
 	map = map_groups__find_by_name(&machine->kmaps, m.name);
-	if (map) {
-		/*
-		 * If the map's dso is an offline module, give dso__load()
-		 * a chance to find the file path of that module by fixing
-		 * long_name.
-		 */
-		dso__adjust_kmod_long_name(map->dso, filename);
+	if (map)
 		goto out;
-	}
 
 	dso = machine__findnew_module_dso(machine, &m, filename);
 	if (dso == NULL)



^ permalink raw reply	[flat|nested] 685+ messages in thread

* [PATCH 4.19 014/639] leds: tlc591xx: update the maximum brightness
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (12 preceding siblings ...)
  2020-01-24  9:23 ` [PATCH 4.19 013/639] perf map: No need to adjust the long name of modules Greg Kroah-Hartman
@ 2020-01-24  9:23 ` Greg Kroah-Hartman
  2020-01-24 23:18   ` Pavel Machek
  2020-01-24  9:23 ` [PATCH 4.19 015/639] soc: aspeed: Fix snoop_file_poll()s return type Greg Kroah-Hartman
                   ` (628 subsequent siblings)
  642 siblings, 1 reply; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:23 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jean-Jacques Hiblot, Pavel Machek

From: Jean-Jacques Hiblot <jjhiblot@ti.com>

commit a2cafdfd8cf5ad8adda6c0ce44a59f46431edf02 upstream.

The TLC chips actually offer 257 levels:
- 0: led OFF
- 1-255: Led dimmed is using a PWM. The duty cycle range from 0.4% to 99.6%
- 256: led fully ON

Fixes: e370d010a5fe ("leds: tlc591xx: Driver for the TI 8/16 Channel i2c LED driver")
Signed-off-by: Jean-Jacques Hiblot <jjhiblot@ti.com>
Signed-off-by: Pavel Machek <pavel@ucw.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/leds/leds-tlc591xx.c |    7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

--- a/drivers/leds/leds-tlc591xx.c
+++ b/drivers/leds/leds-tlc591xx.c
@@ -16,6 +16,7 @@
 #include <linux/slab.h>
 
 #define TLC591XX_MAX_LEDS	16
+#define TLC591XX_MAX_BRIGHTNESS	256
 
 #define TLC591XX_REG_MODE1	0x00
 #define MODE1_RESPON_ADDR_MASK	0xF0
@@ -115,11 +116,11 @@ tlc591xx_brightness_set(struct led_class
 	struct tlc591xx_priv *priv = led->priv;
 	int err;
 
-	switch (brightness) {
+	switch ((int)brightness) {
 	case 0:
 		err = tlc591xx_set_ledout(priv, led, LEDOUT_OFF);
 		break;
-	case LED_FULL:
+	case TLC591XX_MAX_BRIGHTNESS:
 		err = tlc591xx_set_ledout(priv, led, LEDOUT_ON);
 		break;
 	default:
@@ -160,7 +161,7 @@ tlc591xx_configure(struct device *dev,
 		led->priv = priv;
 		led->led_no = i;
 		led->ldev.brightness_set_blocking = tlc591xx_brightness_set;
-		led->ldev.max_brightness = LED_FULL;
+		led->ldev.max_brightness = TLC591XX_MAX_BRIGHTNESS;
 		err = led_classdev_register(dev, &led->ldev);
 		if (err < 0) {
 			dev_err(dev, "couldn't register LED %s\n",



^ permalink raw reply	[flat|nested] 685+ messages in thread

* [PATCH 4.19 015/639] soc: aspeed: Fix snoop_file_poll()s return type
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (13 preceding siblings ...)
  2020-01-24  9:23 ` [PATCH 4.19 014/639] leds: tlc591xx: update the maximum brightness Greg Kroah-Hartman
@ 2020-01-24  9:23 ` Greg Kroah-Hartman
  2020-01-24  9:23 ` [PATCH 4.19 016/639] watchdog: sprd: Fix the incorrect pointer getting from driver data Greg Kroah-Hartman
                   ` (627 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:23 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Luc Van Oostenryck, Joel Stanley,
	Andrew Jeffery, Olof Johansson

From: Luc Van Oostenryck <luc.vanoostenryck@gmail.com>

commit a4e55ccd4392e70f296d12e81b93c6ca96ee21d5 upstream.

snoop_file_poll() is defined as returning 'unsigned int' but the
.poll method is declared as returning '__poll_t', a bitwise type.

Fix this by using the proper return type and using the EPOLL
constants instead of the POLL ones, as required for __poll_t.

Link: https://lore.kernel.org/r/20191121051851.268726-1-joel@jms.id.au
Fixes: 3772e5da4454 ("drivers/misc: Aspeed LPC snoop output using misc chardev")
Signed-off-by: Luc Van Oostenryck <luc.vanoostenryck@gmail.com>
Reviewed-by: Joel Stanley <joel@jms.id.au>
Reviewed-by: Andrew Jeffery <andrew@aj.id.au>
Signed-off-by: Joel Stanley <joel@jms.id.au>
Signed-off-by: Olof Johansson <olof@lixom.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/misc/aspeed-lpc-snoop.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/misc/aspeed-lpc-snoop.c
+++ b/drivers/misc/aspeed-lpc-snoop.c
@@ -101,13 +101,13 @@ static ssize_t snoop_file_read(struct fi
 	return ret ? ret : copied;
 }
 
-static unsigned int snoop_file_poll(struct file *file,
+static __poll_t snoop_file_poll(struct file *file,
 				    struct poll_table_struct *pt)
 {
 	struct aspeed_lpc_snoop_channel *chan = snoop_file_to_chan(file);
 
 	poll_wait(file, &chan->wq, pt);
-	return !kfifo_is_empty(&chan->fifo) ? POLLIN : 0;
+	return !kfifo_is_empty(&chan->fifo) ? EPOLLIN : 0;
 }
 
 static const struct file_operations snoop_fops = {



^ permalink raw reply	[flat|nested] 685+ messages in thread

* [PATCH 4.19 016/639] watchdog: sprd: Fix the incorrect pointer getting from driver data
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (14 preceding siblings ...)
  2020-01-24  9:23 ` [PATCH 4.19 015/639] soc: aspeed: Fix snoop_file_poll()s return type Greg Kroah-Hartman
@ 2020-01-24  9:23 ` Greg Kroah-Hartman
  2020-01-24  9:23 ` [PATCH 4.19 017/639] ipmi: Fix memory leak in __ipmi_bmc_register Greg Kroah-Hartman
                   ` (626 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:23 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dongwei Wang, Shuiqing Li,
	Baolin Wang, Guenter Roeck, Wim Van Sebroeck

From: Shuiqing Li <shuiqing.li@unisoc.com>

commit 39e68d9e7ab276880980ee5386301fb218202192 upstream.

The device driver data saved the 'struct sprd_wdt' object, it is
incorrect to get 'struct watchdog_device' object from the driver
data, thus fix it.

Fixes: 477603467009 ("watchdog: Add Spreadtrum watchdog driver")
Reported-by: Dongwei Wang <dongwei.wang@unisoc.com>
Signed-off-by: Shuiqing Li <shuiqing.li@unisoc.com>
Signed-off-by: Baolin Wang <baolin.wang@linaro.org>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Link: https://lore.kernel.org/r/76d4687189ec940baa90cb8d679a8d4c8f02ee80.1573210405.git.baolin.wang@linaro.org
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/watchdog/sprd_wdt.c |    6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

--- a/drivers/watchdog/sprd_wdt.c
+++ b/drivers/watchdog/sprd_wdt.c
@@ -342,10 +342,9 @@ static int sprd_wdt_probe(struct platfor
 
 static int __maybe_unused sprd_wdt_pm_suspend(struct device *dev)
 {
-	struct watchdog_device *wdd = dev_get_drvdata(dev);
 	struct sprd_wdt *wdt = dev_get_drvdata(dev);
 
-	if (watchdog_active(wdd))
+	if (watchdog_active(&wdt->wdd))
 		sprd_wdt_stop(&wdt->wdd);
 	sprd_wdt_disable(wdt);
 
@@ -354,7 +353,6 @@ static int __maybe_unused sprd_wdt_pm_su
 
 static int __maybe_unused sprd_wdt_pm_resume(struct device *dev)
 {
-	struct watchdog_device *wdd = dev_get_drvdata(dev);
 	struct sprd_wdt *wdt = dev_get_drvdata(dev);
 	int ret;
 
@@ -362,7 +360,7 @@ static int __maybe_unused sprd_wdt_pm_re
 	if (ret)
 		return ret;
 
-	if (watchdog_active(wdd)) {
+	if (watchdog_active(&wdt->wdd)) {
 		ret = sprd_wdt_start(&wdt->wdd);
 		if (ret) {
 			sprd_wdt_disable(wdt);



^ permalink raw reply	[flat|nested] 685+ messages in thread

* [PATCH 4.19 017/639] ipmi: Fix memory leak in __ipmi_bmc_register
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (15 preceding siblings ...)
  2020-01-24  9:23 ` [PATCH 4.19 016/639] watchdog: sprd: Fix the incorrect pointer getting from driver data Greg Kroah-Hartman
@ 2020-01-24  9:23 ` Greg Kroah-Hartman
  2020-01-24  9:23 ` [PATCH 4.19 018/639] drm/sti: do not remove the drm_bridge that was never added Greg Kroah-Hartman
                   ` (625 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:23 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Navid Emamdoost, Corey Minyard

From: Navid Emamdoost <navid.emamdoost@gmail.com>

commit 4aa7afb0ee20a97fbf0c5bab3df028d5fb85fdab upstream.

In the impelementation of __ipmi_bmc_register() the allocated memory for
bmc should be released in case ida_simple_get() fails.

Fixes: 68e7e50f195f ("ipmi: Don't use BMC product/dev ids in the BMC name")
Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Message-Id: <20191021200649.1511-1-navid.emamdoost@gmail.com>
Signed-off-by: Corey Minyard <cminyard@mvista.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/char/ipmi/ipmi_msghandler.c |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

--- a/drivers/char/ipmi/ipmi_msghandler.c
+++ b/drivers/char/ipmi/ipmi_msghandler.c
@@ -2965,8 +2965,11 @@ static int __ipmi_bmc_register(struct ip
 		bmc->pdev.name = "ipmi_bmc";
 
 		rv = ida_simple_get(&ipmi_bmc_ida, 0, 0, GFP_KERNEL);
-		if (rv < 0)
+		if (rv < 0) {
+			kfree(bmc);
 			goto out;
+		}
+
 		bmc->pdev.dev.driver = &ipmidriver.driver;
 		bmc->pdev.id = rv;
 		bmc->pdev.dev.release = release_bmc_device;



^ permalink raw reply	[flat|nested] 685+ messages in thread

* [PATCH 4.19 018/639] drm/sti: do not remove the drm_bridge that was never added
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (16 preceding siblings ...)
  2020-01-24  9:23 ` [PATCH 4.19 017/639] ipmi: Fix memory leak in __ipmi_bmc_register Greg Kroah-Hartman
@ 2020-01-24  9:23 ` Greg Kroah-Hartman
  2020-01-24  9:23 ` [PATCH 4.19 019/639] ARM: dts: at91: nattis: set the PRLUD and HIPOW signals low Greg Kroah-Hartman
                   ` (624 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:23 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Daniel Vetter, Peter Rosin,
	Benjamin Gaignard, Sasha Levin

From: Peter Rosin <peda@axentia.se>

[ Upstream commit 66e31a72dc38543b2d9d1ce267dc78ba9beebcfd ]

Removing the drm_bridge_remove call should avoid a NULL dereference
during list processing in drm_bridge_remove if the error path is ever
taken.

The more natural approach would perhaps be to add a drm_bridge_add,
but there are several other bridges that never call drm_bridge_add.
Just removing the drm_bridge_remove is the easier fix.

Fixes: 84601dbdea36 ("drm: sti: rework init sequence")
Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Peter Rosin <peda@axentia.se>
Signed-off-by: Benjamin Gaignard <benjamin.gaignard@linaro.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20180806061910.29914-2-peda@axentia.se
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/sti/sti_hda.c  | 1 -
 drivers/gpu/drm/sti/sti_hdmi.c | 1 -
 2 files changed, 2 deletions(-)

diff --git a/drivers/gpu/drm/sti/sti_hda.c b/drivers/gpu/drm/sti/sti_hda.c
index 49438337f70dc..19b9b5ed12970 100644
--- a/drivers/gpu/drm/sti/sti_hda.c
+++ b/drivers/gpu/drm/sti/sti_hda.c
@@ -721,7 +721,6 @@ static int sti_hda_bind(struct device *dev, struct device *master, void *data)
 	return 0;
 
 err_sysfs:
-	drm_bridge_remove(bridge);
 	return -EINVAL;
 }
 
diff --git a/drivers/gpu/drm/sti/sti_hdmi.c b/drivers/gpu/drm/sti/sti_hdmi.c
index 34cdc46444350..ccf718404a1c2 100644
--- a/drivers/gpu/drm/sti/sti_hdmi.c
+++ b/drivers/gpu/drm/sti/sti_hdmi.c
@@ -1315,7 +1315,6 @@ static int sti_hdmi_bind(struct device *dev, struct device *master, void *data)
 	return 0;
 
 err_sysfs:
-	drm_bridge_remove(bridge);
 	hdmi->drm_connector = NULL;
 	return -EINVAL;
 }
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 019/639] ARM: dts: at91: nattis: set the PRLUD and HIPOW signals low
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (17 preceding siblings ...)
  2020-01-24  9:23 ` [PATCH 4.19 018/639] drm/sti: do not remove the drm_bridge that was never added Greg Kroah-Hartman
@ 2020-01-24  9:23 ` Greg Kroah-Hartman
  2020-01-24  9:23 ` [PATCH 4.19 020/639] ARM: dts: at91: nattis: make the SD-card slot work Greg Kroah-Hartman
                   ` (623 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:23 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Peter Rosin, Alexandre Belloni, Sasha Levin

From: Peter Rosin <peda@axentia.se>

[ Upstream commit 29feb2c960ab32fc24249443d4434194ce96f083 ]

AT91_PINCTRL_OUTPUT_VAL(0) without AT91_PINCTRL_OUTPUT is a no-op, so
make sure the pins really output a zero.

Fixes: 0e4323899973 ("ARM: dts: at91: add devicetree for the Axentia Nattis with Natte power")
Signed-off-by: Peter Rosin <peda@axentia.se>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/at91-nattis-2-natte-2.dts | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/arch/arm/boot/dts/at91-nattis-2-natte-2.dts b/arch/arm/boot/dts/at91-nattis-2-natte-2.dts
index af9f38456d04e..bfa5815a07214 100644
--- a/arch/arm/boot/dts/at91-nattis-2-natte-2.dts
+++ b/arch/arm/boot/dts/at91-nattis-2-natte-2.dts
@@ -38,14 +38,16 @@
 						atmel,pins =
 							<AT91_PIOA 21
 							 AT91_PERIPH_GPIO
-							 AT91_PINCTRL_OUTPUT_VAL(0)>;
+							 (AT91_PINCTRL_OUTPUT |
+							  AT91_PINCTRL_OUTPUT_VAL(0))>;
 					};
 
 					pinctrl_lcd_hipow0: lcd_hipow0 {
 						atmel,pins =
 							<AT91_PIOA 23
 							 AT91_PERIPH_GPIO
-							 AT91_PINCTRL_OUTPUT_VAL(0)>;
+							 (AT91_PINCTRL_OUTPUT |
+							  AT91_PINCTRL_OUTPUT_VAL(0))>;
 					};
 				};
 			};
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 020/639] ARM: dts: at91: nattis: make the SD-card slot work
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (18 preceding siblings ...)
  2020-01-24  9:23 ` [PATCH 4.19 019/639] ARM: dts: at91: nattis: set the PRLUD and HIPOW signals low Greg Kroah-Hartman
@ 2020-01-24  9:23 ` Greg Kroah-Hartman
  2020-01-24  9:23 ` [PATCH 4.19 021/639] ixgbe: dont clear IPsec sa counters on HW clearing Greg Kroah-Hartman
                   ` (622 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:23 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Peter Rosin, Alexandre Belloni, Sasha Levin

From: Peter Rosin <peda@axentia.se>

[ Upstream commit f52eb2067929d533babe106fbc131c88db3eff3d ]

The cd-gpios signal is assumed active-low by the driver, and the
cd-inverted property is needed if it is, in fact, active-high. Fix
this oversight.

Fixes: 0e4323899973 ("ARM: dts: at91: add devicetree for the Axentia Nattis with Natte power")
Signed-off-by: Peter Rosin <peda@axentia.se>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/at91-nattis-2-natte-2.dts | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/arm/boot/dts/at91-nattis-2-natte-2.dts b/arch/arm/boot/dts/at91-nattis-2-natte-2.dts
index bfa5815a07214..4308a07b792ea 100644
--- a/arch/arm/boot/dts/at91-nattis-2-natte-2.dts
+++ b/arch/arm/boot/dts/at91-nattis-2-natte-2.dts
@@ -221,6 +221,7 @@
 		reg = <0>;
 		bus-width = <4>;
 		cd-gpios = <&pioD 5 GPIO_ACTIVE_HIGH>;
+		cd-inverted;
 	};
 };
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 021/639] ixgbe: dont clear IPsec sa counters on HW clearing
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (19 preceding siblings ...)
  2020-01-24  9:23 ` [PATCH 4.19 020/639] ARM: dts: at91: nattis: make the SD-card slot work Greg Kroah-Hartman
@ 2020-01-24  9:23 ` Greg Kroah-Hartman
  2020-01-24  9:23 ` [PATCH 4.19 022/639] drm/virtio: fix bounds check in virtio_gpu_cmd_get_capset() Greg Kroah-Hartman
                   ` (621 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:23 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Shannon Nelson, Andrew Bowers,
	Jeff Kirsher, Sasha Levin

From: Shannon Nelson <shannon.nelson@oracle.com>

[ Upstream commit 9e3f2f5ecee69b0f70003fb3e07639151e91de73 ]

The software SA record counters should not be cleared when clearing
the hardware tables.  This causes the counters to be out of sync
after a driver reset.

Fixes: 63a67fe229ea ("ixgbe: add ipsec offload add and remove SA")
Signed-off-by: Shannon Nelson <shannon.nelson@oracle.com>
Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c
index b27f7a968820d..49e6d66ccf802 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c
@@ -114,7 +114,6 @@ static void ixgbe_ipsec_set_rx_ip(struct ixgbe_hw *hw, u16 idx, __be32 addr[])
  **/
 static void ixgbe_ipsec_clear_hw_tables(struct ixgbe_adapter *adapter)
 {
-	struct ixgbe_ipsec *ipsec = adapter->ipsec;
 	struct ixgbe_hw *hw = &adapter->hw;
 	u32 buf[4] = {0, 0, 0, 0};
 	u16 idx;
@@ -133,9 +132,6 @@ static void ixgbe_ipsec_clear_hw_tables(struct ixgbe_adapter *adapter)
 		ixgbe_ipsec_set_tx_sa(hw, idx, buf, 0);
 		ixgbe_ipsec_set_rx_sa(hw, idx, 0, buf, 0, 0, 0);
 	}
-
-	ipsec->num_rx_sa = 0;
-	ipsec->num_tx_sa = 0;
 }
 
 /**
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 022/639] drm/virtio: fix bounds check in virtio_gpu_cmd_get_capset()
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (20 preceding siblings ...)
  2020-01-24  9:23 ` [PATCH 4.19 021/639] ixgbe: dont clear IPsec sa counters on HW clearing Greg Kroah-Hartman
@ 2020-01-24  9:23 ` Greg Kroah-Hartman
  2020-01-24  9:23 ` [PATCH 4.19 023/639] iio: fix position relative kernel version Greg Kroah-Hartman
                   ` (620 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:23 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Gerd Hoffmann, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit 09c4b49457434fa74749ad6194ef28464d9f5df9 ]

This doesn't affect runtime because in the current code "idx" is always
valid.

First, we read from "vgdev->capsets[idx].max_size" before checking
whether "idx" is within bounds.  And secondly the bounds check is off by
one so we could end up reading one element beyond the end of the
vgdev->capsets[] array.

Fixes: 62fb7a5e1096 ("virtio-gpu: add 3d/virgl support")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: http://patchwork.freedesktop.org/patch/msgid/20180704094250.m7sgvvzg3dhcvv3h@kili.mountain
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/virtio/virtgpu_vq.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/virtio/virtgpu_vq.c b/drivers/gpu/drm/virtio/virtgpu_vq.c
index c8a581b1f4c40..608906f06cedd 100644
--- a/drivers/gpu/drm/virtio/virtgpu_vq.c
+++ b/drivers/gpu/drm/virtio/virtgpu_vq.c
@@ -650,11 +650,11 @@ int virtio_gpu_cmd_get_capset(struct virtio_gpu_device *vgdev,
 {
 	struct virtio_gpu_get_capset *cmd_p;
 	struct virtio_gpu_vbuffer *vbuf;
-	int max_size = vgdev->capsets[idx].max_size;
+	int max_size;
 	struct virtio_gpu_drv_cap_cache *cache_ent;
 	void *resp_buf;
 
-	if (idx > vgdev->num_capsets)
+	if (idx >= vgdev->num_capsets)
 		return -EINVAL;
 
 	if (version > vgdev->capsets[idx].max_version)
@@ -664,6 +664,7 @@ int virtio_gpu_cmd_get_capset(struct virtio_gpu_device *vgdev,
 	if (!cache_ent)
 		return -ENOMEM;
 
+	max_size = vgdev->capsets[idx].max_size;
 	cache_ent->caps_cache = kmalloc(max_size, GFP_KERNEL);
 	if (!cache_ent->caps_cache) {
 		kfree(cache_ent);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 023/639] iio: fix position relative kernel version
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (21 preceding siblings ...)
  2020-01-24  9:23 ` [PATCH 4.19 022/639] drm/virtio: fix bounds check in virtio_gpu_cmd_get_capset() Greg Kroah-Hartman
@ 2020-01-24  9:23 ` Greg Kroah-Hartman
  2020-01-24  9:23 ` [PATCH 4.19 024/639] apparmor: Fix network performance issue in aa_label_sk_perm Greg Kroah-Hartman
                   ` (619 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:23 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Eugen Hristev, Jonathan Cameron, Sasha Levin

From: Eugen Hristev <eugen.hristev@microchip.com>

[ Upstream commit 21eab7861688aa4c69fcb88440cc0c4a422bdcd6 ]

Position relative channel type was added in 4.19 kernel version

Fixes: "3055a6cfa04ba" ("iio: Add channel for Position Relative")
Signed-off-by: Eugen Hristev <eugen.hristev@microchip.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 Documentation/ABI/testing/sysfs-bus-iio | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Documentation/ABI/testing/sysfs-bus-iio b/Documentation/ABI/testing/sysfs-bus-iio
index a5b4f223641d9..8127a08e366d8 100644
--- a/Documentation/ABI/testing/sysfs-bus-iio
+++ b/Documentation/ABI/testing/sysfs-bus-iio
@@ -199,7 +199,7 @@ Description:
 
 What:		/sys/bus/iio/devices/iio:deviceX/in_positionrelative_x_raw
 What:		/sys/bus/iio/devices/iio:deviceX/in_positionrelative_y_raw
-KernelVersion:	4.18
+KernelVersion:	4.19
 Contact:	linux-iio@vger.kernel.org
 Description:
 		Relative position in direction x or y on a pad (may be
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 024/639] apparmor: Fix network performance issue in aa_label_sk_perm
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (22 preceding siblings ...)
  2020-01-24  9:23 ` [PATCH 4.19 023/639] iio: fix position relative kernel version Greg Kroah-Hartman
@ 2020-01-24  9:23 ` Greg Kroah-Hartman
  2020-01-24  9:23 ` [PATCH 4.19 025/639] ALSA: hda: fix unused variable warning Greg Kroah-Hartman
                   ` (618 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:23 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Tony Jones, John Johansen, Sasha Levin

From: Tony Jones <tonyj@suse.de>

[ Upstream commit 5f997580e8b12b9f585e34cc16304925d26ce49e ]

The netperf benchmark shows a 5.73% reduction in throughput for
small (64 byte) transfers by unconfined tasks.

DEFINE_AUDIT_SK() in aa_label_sk_perm() should not be performed
unconditionally, rather only when the label is confined.

netperf-tcp
                            56974a6fc^              56974a6fc
Min       64         563.48 (   0.00%)      531.17 (  -5.73%)
Min       128       1056.92 (   0.00%)      999.44 (  -5.44%)
Min       256       1945.95 (   0.00%)     1867.97 (  -4.01%)
Min       1024      6761.40 (   0.00%)     6364.23 (  -5.87%)
Min       2048     11110.53 (   0.00%)    10606.20 (  -4.54%)
Min       3312     13692.67 (   0.00%)    13158.41 (  -3.90%)
Min       4096     14926.29 (   0.00%)    14457.46 (  -3.14%)
Min       8192     18399.34 (   0.00%)    18091.65 (  -1.67%)
Min       16384    21384.13 (   0.00%)    21158.05 (  -1.06%)
Hmean     64         564.96 (   0.00%)      534.38 (  -5.41%)
Hmean     128       1064.42 (   0.00%)     1010.12 (  -5.10%)
Hmean     256       1965.85 (   0.00%)     1879.16 (  -4.41%)
Hmean     1024      6839.77 (   0.00%)     6478.70 (  -5.28%)
Hmean     2048     11154.80 (   0.00%)    10671.13 (  -4.34%)
Hmean     3312     13838.12 (   0.00%)    13249.01 (  -4.26%)
Hmean     4096     15009.99 (   0.00%)    14561.36 (  -2.99%)
Hmean     8192     18975.57 (   0.00%)    18326.54 (  -3.42%)
Hmean     16384    21440.44 (   0.00%)    21324.59 (  -0.54%)
Stddev    64           1.24 (   0.00%)        2.85 (-130.64%)
Stddev    128          4.51 (   0.00%)        6.53 ( -44.84%)
Stddev    256         11.67 (   0.00%)        8.50 (  27.16%)
Stddev    1024        48.33 (   0.00%)       75.07 ( -55.34%)
Stddev    2048        54.82 (   0.00%)       65.16 ( -18.86%)
Stddev    3312       153.57 (   0.00%)       56.29 (  63.35%)
Stddev    4096       100.25 (   0.00%)       88.50 (  11.72%)
Stddev    8192       358.13 (   0.00%)      169.99 (  52.54%)
Stddev    16384       43.99 (   0.00%)      141.82 (-222.39%)

Signed-off-by: Tony Jones <tonyj@suse.de>
Fixes: 56974a6fcfef ("apparmor: add base infastructure for socket
mediation")
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 security/apparmor/net.c | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/security/apparmor/net.c b/security/apparmor/net.c
index bb24cfa0a164c..d5d72dd1ca1f9 100644
--- a/security/apparmor/net.c
+++ b/security/apparmor/net.c
@@ -146,17 +146,20 @@ int aa_af_perm(struct aa_label *label, const char *op, u32 request, u16 family,
 static int aa_label_sk_perm(struct aa_label *label, const char *op, u32 request,
 			    struct sock *sk)
 {
-	struct aa_profile *profile;
-	DEFINE_AUDIT_SK(sa, op, sk);
+	int error = 0;
 
 	AA_BUG(!label);
 	AA_BUG(!sk);
 
-	if (unconfined(label))
-		return 0;
+	if (!unconfined(label)) {
+		struct aa_profile *profile;
+		DEFINE_AUDIT_SK(sa, op, sk);
 
-	return fn_for_each_confined(label, profile,
-			aa_profile_af_sk_perm(profile, &sa, request, sk));
+		error = fn_for_each_confined(label, profile,
+			    aa_profile_af_sk_perm(profile, &sa, request, sk));
+	}
+
+	return error;
 }
 
 int aa_sk_perm(const char *op, u32 request, struct sock *sk)
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 025/639] ALSA: hda: fix unused variable warning
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (23 preceding siblings ...)
  2020-01-24  9:23 ` [PATCH 4.19 024/639] apparmor: Fix network performance issue in aa_label_sk_perm Greg Kroah-Hartman
@ 2020-01-24  9:23 ` Greg Kroah-Hartman
  2020-01-24  9:23 ` [PATCH 4.19 026/639] apparmor: dont try to replace stale label in ptrace access check Greg Kroah-Hartman
                   ` (617 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:23 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Anders Roxell, Takashi Iwai, Sasha Levin

From: Anders Roxell <anders.roxell@linaro.org>

[ Upstream commit 5b03006d5c58ddd31caf542eef4d0269bcf265b3 ]

When CONFIG_X86=n function azx_snoop doesn't use the variable chip it
only returns true.

sound/pci/hda/hda_intel.c: In function ‘dma_alloc_pages’:
sound/pci/hda/hda_intel.c:2002:14: warning: unused variable ‘chip’ [-Wunused-variable]
  struct azx *chip = bus_to_azx(bus);
              ^~~~

Create a inline function of azx_snoop.

Fixes: a41d122449be ("ALSA: hda - Embed bus into controller object")
Signed-off-by: Anders Roxell <anders.roxell@linaro.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/pci/hda/hda_controller.h | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/sound/pci/hda/hda_controller.h b/sound/pci/hda/hda_controller.h
index 8a9dd4767b1ec..63cc10604afc7 100644
--- a/sound/pci/hda/hda_controller.h
+++ b/sound/pci/hda/hda_controller.h
@@ -176,11 +176,10 @@ struct azx {
 #define azx_bus(chip)	(&(chip)->bus.core)
 #define bus_to_azx(_bus)	container_of(_bus, struct azx, bus.core)
 
-#ifdef CONFIG_X86
-#define azx_snoop(chip)		((chip)->snoop)
-#else
-#define azx_snoop(chip)		true
-#endif
+static inline bool azx_snoop(struct azx *chip)
+{
+	return !IS_ENABLED(CONFIG_X86) || chip->snoop;
+}
 
 /*
  * macros for easy use
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 026/639] apparmor: dont try to replace stale label in ptrace access check
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (24 preceding siblings ...)
  2020-01-24  9:23 ` [PATCH 4.19 025/639] ALSA: hda: fix unused variable warning Greg Kroah-Hartman
@ 2020-01-24  9:23 ` Greg Kroah-Hartman
  2020-01-24  9:23 ` [PATCH 4.19 027/639] ARM: qcom_defconfig: Enable MAILBOX Greg Kroah-Hartman
                   ` (616 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:23 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jann Horn, John Johansen, Sasha Levin

From: Jann Horn <jannh@google.com>

[ Upstream commit 1f8266ff58840d698a1e96d2274189de1bdf7969 ]

As a comment above begin_current_label_crit_section() explains,
begin_current_label_crit_section() must run in sleepable context because
when label_is_stale() is true, aa_replace_current_label() runs, which uses
prepare_creds(), which can sleep.
Until now, the ptrace access check (which runs with a task lock held)
violated this rule.

Also add a might_sleep() assertion to begin_current_label_crit_section(),
because asserts are less likely to be ignored than comments.

Fixes: b2d09ae449ced ("apparmor: move ptrace checks to using labels")
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 security/apparmor/include/cred.h | 2 ++
 security/apparmor/lsm.c          | 4 ++--
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/security/apparmor/include/cred.h b/security/apparmor/include/cred.h
index e287b7d0d4beb..265ae6641a064 100644
--- a/security/apparmor/include/cred.h
+++ b/security/apparmor/include/cred.h
@@ -151,6 +151,8 @@ static inline struct aa_label *begin_current_label_crit_section(void)
 {
 	struct aa_label *label = aa_current_raw_label();
 
+	might_sleep();
+
 	if (label_is_stale(label)) {
 		label = aa_get_newest_label(label);
 		if (aa_replace_current_label(label) == 0)
diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
index 590ca7d8fae54..730de4638b4e2 100644
--- a/security/apparmor/lsm.c
+++ b/security/apparmor/lsm.c
@@ -114,13 +114,13 @@ static int apparmor_ptrace_access_check(struct task_struct *child,
 	struct aa_label *tracer, *tracee;
 	int error;
 
-	tracer = begin_current_label_crit_section();
+	tracer = __begin_current_label_crit_section();
 	tracee = aa_get_task_label(child);
 	error = aa_may_ptrace(tracer, tracee,
 			(mode & PTRACE_MODE_READ) ? AA_PTRACE_READ
 						  : AA_PTRACE_TRACE);
 	aa_put_label(tracee);
-	end_current_label_crit_section(tracer);
+	__end_current_label_crit_section(tracer);
 
 	return error;
 }
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 027/639] ARM: qcom_defconfig: Enable MAILBOX
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (25 preceding siblings ...)
  2020-01-24  9:23 ` [PATCH 4.19 026/639] apparmor: dont try to replace stale label in ptrace access check Greg Kroah-Hartman
@ 2020-01-24  9:23 ` Greg Kroah-Hartman
  2020-01-24  9:23 ` [PATCH 4.19 028/639] firmware: coreboot: Let OF core populate platform device Greg Kroah-Hartman
                   ` (615 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:23 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Frank Rowand, Bjorn Andersson,
	Andy Gross, Sasha Levin

From: Frank Rowand <frank.rowand@sony.com>

[ Upstream commit 54c2678cd198f61555796bbda5e1727e6e1858f1 ]

Problem:
ab460a2e72da ("rpmsg: qcom_smd: Access APCS through mailbox framework"
added a "depends on MAILBOX") to RPMSG_QCOM_SMD, thus RPMSG_QCOM_SMD
becomes unset since MAILBOX was not enabled in qcom_defconfig and is
not otherwise selected for the dragonboard.  When the resulting
kernel is booted the mmc device which contains the root file system
is not available.

Fix:
add CONFIG_MAILBOX to qcom_defconfig

Fixes: ab460a2e72da ("rpmsg: qcom_smd: Access APCS through mailbox framework"
added a "depends on MAILBOX")

Signed-off-by: Frank Rowand <frank.rowand@sony.com>
Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Andy Gross <andy.gross@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/configs/qcom_defconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/arm/configs/qcom_defconfig b/arch/arm/configs/qcom_defconfig
index 6aa7046fb91ff..bd6440f234939 100644
--- a/arch/arm/configs/qcom_defconfig
+++ b/arch/arm/configs/qcom_defconfig
@@ -207,6 +207,7 @@ CONFIG_MSM_MMCC_8974=y
 CONFIG_MSM_IOMMU=y
 CONFIG_HWSPINLOCK=y
 CONFIG_HWSPINLOCK_QCOM=y
+CONFIG_MAILBOX=y
 CONFIG_REMOTEPROC=y
 CONFIG_QCOM_ADSP_PIL=y
 CONFIG_QCOM_Q6V5_PIL=y
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 028/639] firmware: coreboot: Let OF core populate platform device
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (26 preceding siblings ...)
  2020-01-24  9:23 ` [PATCH 4.19 027/639] ARM: qcom_defconfig: Enable MAILBOX Greg Kroah-Hartman
@ 2020-01-24  9:23 ` Greg Kroah-Hartman
  2020-01-24  9:23 ` [PATCH 4.19 029/639] PCI: iproc: Remove PAXC slot check to allow VF support Greg Kroah-Hartman
                   ` (614 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:23 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Wei-Ning Huang, Julius Werner,
	Brian Norris, Samuel Holland, Sudeep Holla, Stephen Boyd,
	Sasha Levin

From: Stephen Boyd <swboyd@chromium.org>

[ Upstream commit 09ed061a4f56d50758851ca3997510f27115f81b ]

Now that the /firmware/coreboot node in DT is populated by the core DT
platform code with commit 3aa0582fdb82 ("of: platform: populate
/firmware/ node from of_platform_default_populate_init()") we should and
can remove the platform device creation here. Otherwise, the
of_platform_device_create() call will fail, the coreboot of driver won't
be registered, and this driver will never bind. At the same time, we
should move this driver to use MODULE_DEVICE_TABLE so that module
auto-load works properly when the coreboot device is auto-populated and
we should drop the of_node handling that was presumably placed here to
hold a reference to the DT node created during module init that no
longer happens.

Cc: Wei-Ning Huang <wnhuang@chromium.org>
Cc: Julius Werner <jwerner@chromium.org>
Reviewed-by: Brian Norris <briannorris@chromium.org>
Cc: Samuel Holland <samuel@sholland.org>
Reviewed-by: Sudeep Holla <Sudeep.Holla@arm.com>
Fixes: 3aa0582fdb82 ("of: platform: populate /firmware/ node from of_platform_default_populate_init()")
Signed-off-by: Stephen Boyd <swboyd@chromium.org>
Reviewed-by: Julius Werner <jwerner@chromium.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/firmware/google/coreboot_table-of.c | 28 +++------------------
 1 file changed, 3 insertions(+), 25 deletions(-)

diff --git a/drivers/firmware/google/coreboot_table-of.c b/drivers/firmware/google/coreboot_table-of.c
index f15bf404c579b..9b90c0fa4a0b4 100644
--- a/drivers/firmware/google/coreboot_table-of.c
+++ b/drivers/firmware/google/coreboot_table-of.c
@@ -19,7 +19,6 @@
 #include <linux/io.h>
 #include <linux/module.h>
 #include <linux/of_address.h>
-#include <linux/of_platform.h>
 #include <linux/platform_device.h>
 
 #include "coreboot_table.h"
@@ -30,7 +29,6 @@ static int coreboot_table_of_probe(struct platform_device *pdev)
 	void __iomem *ptr;
 
 	ptr = of_iomap(fw_dn, 0);
-	of_node_put(fw_dn);
 	if (!ptr)
 		return -ENOMEM;
 
@@ -44,8 +42,9 @@ static int coreboot_table_of_remove(struct platform_device *pdev)
 
 static const struct of_device_id coreboot_of_match[] = {
 	{ .compatible = "coreboot" },
-	{},
+	{}
 };
+MODULE_DEVICE_TABLE(of, coreboot_of_match);
 
 static struct platform_driver coreboot_table_of_driver = {
 	.probe = coreboot_table_of_probe,
@@ -55,28 +54,7 @@ static struct platform_driver coreboot_table_of_driver = {
 		.of_match_table = coreboot_of_match,
 	},
 };
-
-static int __init platform_coreboot_table_of_init(void)
-{
-	struct platform_device *pdev;
-	struct device_node *of_node;
-
-	/* Limit device creation to the presence of /firmware/coreboot node */
-	of_node = of_find_node_by_path("/firmware/coreboot");
-	if (!of_node)
-		return -ENODEV;
-
-	if (!of_match_node(coreboot_of_match, of_node))
-		return -ENODEV;
-
-	pdev = of_platform_device_create(of_node, "coreboot_table_of", NULL);
-	if (!pdev)
-		return -ENODEV;
-
-	return platform_driver_register(&coreboot_table_of_driver);
-}
-
-module_init(platform_coreboot_table_of_init);
+module_platform_driver(coreboot_table_of_driver);
 
 MODULE_AUTHOR("Google, Inc.");
 MODULE_LICENSE("GPL");
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 029/639] PCI: iproc: Remove PAXC slot check to allow VF support
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (27 preceding siblings ...)
  2020-01-24  9:23 ` [PATCH 4.19 028/639] firmware: coreboot: Let OF core populate platform device Greg Kroah-Hartman
@ 2020-01-24  9:23 ` Greg Kroah-Hartman
  2020-01-24  9:23 ` [PATCH 4.19 030/639] bridge: br_arp_nd_proxy: set icmp6_router if neigh has NTF_ROUTER Greg Kroah-Hartman
                   ` (613 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:23 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jitendra Bhivare, Ray Jui,
	Lorenzo Pieralisi, Andy Gospodarek, Sasha Levin

From: Jitendra Bhivare <jitendra.bhivare@broadcom.com>

[ Upstream commit 4da6b4480766e5bc9c4d7bc14bf1d0939a1a5fa7 ]

Fix previous incorrect logic that limits PAXC slot number to zero only.
In order for SRIOV/VF to work, we need to allow the slot number to be
greater than zero.

Fixes: 46560388c476c ("PCI: iproc: Allow multiple devices except on PAXC")
Signed-off-by: Jitendra Bhivare <jitendra.bhivare@broadcom.com>
Signed-off-by: Ray Jui <ray.jui@broadcom.com>
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Reviewed-by: Andy Gospodarek <gospo@broadcom.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/controller/pcie-iproc.c | 8 --------
 1 file changed, 8 deletions(-)

diff --git a/drivers/pci/controller/pcie-iproc.c b/drivers/pci/controller/pcie-iproc.c
index 3160e9342a2fb..c20fd6bd68fd8 100644
--- a/drivers/pci/controller/pcie-iproc.c
+++ b/drivers/pci/controller/pcie-iproc.c
@@ -630,14 +630,6 @@ static void __iomem *iproc_pcie_map_cfg_bus(struct iproc_pcie *pcie,
 			return (pcie->base + offset);
 	}
 
-	/*
-	 * PAXC is connected to an internally emulated EP within the SoC.  It
-	 * allows only one device.
-	 */
-	if (pcie->ep_is_internal)
-		if (slot > 0)
-			return NULL;
-
 	return iproc_pcie_map_ep_cfg_reg(pcie, busno, slot, fn, where);
 }
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 030/639] bridge: br_arp_nd_proxy: set icmp6_router if neigh has NTF_ROUTER
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (28 preceding siblings ...)
  2020-01-24  9:23 ` [PATCH 4.19 029/639] PCI: iproc: Remove PAXC slot check to allow VF support Greg Kroah-Hartman
@ 2020-01-24  9:23 ` Greg Kroah-Hartman
  2020-01-24  9:23 ` [PATCH 4.19 031/639] drm/hisilicon: hibmc: Dont overwrite fb helper surface depth Greg Kroah-Hartman
                   ` (612 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:23 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Roopa Prabhu, David S. Miller, Sasha Levin

From: Roopa Prabhu <roopa@cumulusnetworks.com>

[ Upstream commit 7aca011f88eb57be1b17b0216247f4e32ac54e29 ]

Fixes: ed842faeb2bd ("bridge: suppress nd pkts on BR_NEIGH_SUPPRESS ports")
Signed-off-by: Roopa Prabhu <roopa@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/bridge/br_arp_nd_proxy.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/bridge/br_arp_nd_proxy.c b/net/bridge/br_arp_nd_proxy.c
index 2cf7716254be6..d42e3904b4987 100644
--- a/net/bridge/br_arp_nd_proxy.c
+++ b/net/bridge/br_arp_nd_proxy.c
@@ -311,7 +311,7 @@ static void br_nd_send(struct net_bridge *br, struct net_bridge_port *p,
 	/* Neighbor Advertisement */
 	memset(na, 0, sizeof(*na) + na_olen);
 	na->icmph.icmp6_type = NDISC_NEIGHBOUR_ADVERTISEMENT;
-	na->icmph.icmp6_router = 0; /* XXX: should be 1 ? */
+	na->icmph.icmp6_router = (n->flags & NTF_ROUTER) ? 1 : 0;
 	na->icmph.icmp6_override = 1;
 	na->icmph.icmp6_solicited = 1;
 	na->target = ns->target;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 031/639] drm/hisilicon: hibmc: Dont overwrite fb helper surface depth
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (29 preceding siblings ...)
  2020-01-24  9:23 ` [PATCH 4.19 030/639] bridge: br_arp_nd_proxy: set icmp6_router if neigh has NTF_ROUTER Greg Kroah-Hartman
@ 2020-01-24  9:23 ` Greg Kroah-Hartman
  2020-01-24  9:23   ` Greg Kroah-Hartman
                   ` (611 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:23 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, John Garry, Xinliang Liu, Sasha Levin

From: John Garry <john.garry@huawei.com>

[ Upstream commit 0ff9f49646353ce31312411e7e7bd2281492a40e ]

Currently the driver overwrites the surface depth provided by the fb
helper to give an invalid bpp/surface depth combination.

This has been exposed by commit 70109354fed2 ("drm: Reject unknown legacy
bpp and depth for drm_mode_addfb ioctl"), which now causes the driver to
fail to probe.

Fix by not overwriting the surface depth.

Fixes: d1667b86795a ("drm/hisilicon/hibmc: Add support for frame buffer")
Signed-off-by: John Garry <john.garry@huawei.com>
Reviewed-by: Xinliang Liu <z.liuxinliang@hisilicon.com>
Signed-off-by: Xinliang Liu <z.liuxinliang@hisilicon.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c
index 8bd29075ae4eb..edcca17615001 100644
--- a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c
+++ b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c
@@ -71,7 +71,6 @@ static int hibmc_drm_fb_create(struct drm_fb_helper *helper,
 	DRM_DEBUG_DRIVER("surface width(%d), height(%d) and bpp(%d)\n",
 			 sizes->surface_width, sizes->surface_height,
 			 sizes->surface_bpp);
-	sizes->surface_depth = 32;
 
 	bytes_per_pixel = DIV_ROUND_UP(sizes->surface_bpp, 8);
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 032/639] signal/ia64: Use the generic force_sigsegv in setup_frame
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
@ 2020-01-24  9:23   ` Greg Kroah-Hartman
  2020-01-24  9:22 ` [PATCH 4.19 002/639] xfs: Sanity check flags of Q_XQUOTARM call Greg Kroah-Hartman
                     ` (641 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:23 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Tony Luck, Fenghua Yu, linux-ia64,
	Eric W. Biederman, Sasha Levin

From: Eric W. Biederman <ebiederm@xmission.com>

[ Upstream commit 8b9c6b28312cc51a87055e292b11c5aa28f0c935 ]

The ia64 handling of failure to setup a signal frame has been trying
to set overlapping fields in struct siginfo since 2.3.43.  The si_pid
and si_uid fields are stomped when the si_addr field is set.  The
si_code of SI_KERNEL indicates that si_pid and si_uid should be valid,
and that si_addr does not exist.

Being at odds with the definition of SI_KERNEL and with nothing to
indicate that this was a signal frame setup failure there is no way
for userspace to know that si_addr was filled out instead.

In practice failure to setup a signal frame is rare, and si_pid and
si_uid are always set to 0 when si_code is SI_KERNEL so I expect no
one has looked closely enough before to see this weirdness.  Further
the only difference between force_sigsegv_info and the generic
force_sigsegv other than the return code is that force_sigsegv_info
stomps the si_uid and si_pid fields.

Remove the bug and simplify the code by using force_sigsegv in this
case just like other architectures.

Fixes: 2.3.43
Cc: Tony Luck <tony.luck@intel.com>
Cc: Fenghua Yu <fenghua.yu@intel.com>
Cc: linux-ia64@vger.kernel.org
Acked-by: Tony Luck <tony.luck@intel.com>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/ia64/kernel/signal.c | 50 ++++++++++-----------------------------
 1 file changed, 12 insertions(+), 38 deletions(-)

diff --git a/arch/ia64/kernel/signal.c b/arch/ia64/kernel/signal.c
index d1234a5ba4c55..01fc133b2e4c8 100644
--- a/arch/ia64/kernel/signal.c
+++ b/arch/ia64/kernel/signal.c
@@ -231,37 +231,6 @@ rbs_on_sig_stack (unsigned long bsp)
 	return (bsp - current->sas_ss_sp < current->sas_ss_size);
 }
 
-static long
-force_sigsegv_info (int sig, void __user *addr)
-{
-	unsigned long flags;
-	struct siginfo si;
-
-	clear_siginfo(&si);
-	if (sig == SIGSEGV) {
-		/*
-		 * Acquiring siglock around the sa_handler-update is almost
-		 * certainly overkill, but this isn't a
-		 * performance-critical path and I'd rather play it safe
-		 * here than having to debug a nasty race if and when
-		 * something changes in kernel/signal.c that would make it
-		 * no longer safe to modify sa_handler without holding the
-		 * lock.
-		 */
-		spin_lock_irqsave(&current->sighand->siglock, flags);
-		current->sighand->action[sig - 1].sa.sa_handler = SIG_DFL;
-		spin_unlock_irqrestore(&current->sighand->siglock, flags);
-	}
-	si.si_signo = SIGSEGV;
-	si.si_errno = 0;
-	si.si_code = SI_KERNEL;
-	si.si_pid = task_pid_vnr(current);
-	si.si_uid = from_kuid_munged(current_user_ns(), current_uid());
-	si.si_addr = addr;
-	force_sig_info(SIGSEGV, &si, current);
-	return 1;
-}
-
 static long
 setup_frame(struct ksignal *ksig, sigset_t *set, struct sigscratch *scr)
 {
@@ -295,15 +264,18 @@ setup_frame(struct ksignal *ksig, sigset_t *set, struct sigscratch *scr)
 			 * instead so we will die with SIGSEGV.
 			 */
 			check_sp = (new_sp - sizeof(*frame)) & -STACK_ALIGN;
-			if (!likely(on_sig_stack(check_sp)))
-				return force_sigsegv_info(ksig->sig, (void __user *)
-							  check_sp);
+			if (!likely(on_sig_stack(check_sp))) {
+				force_sigsegv(ksig->sig, current);
+				return 1;
+			}
 		}
 	}
 	frame = (void __user *) ((new_sp - sizeof(*frame)) & -STACK_ALIGN);
 
-	if (!access_ok(VERIFY_WRITE, frame, sizeof(*frame)))
-		return force_sigsegv_info(ksig->sig, frame);
+	if (!access_ok(VERIFY_WRITE, frame, sizeof(*frame))) {
+		force_sigsegv(ksig->sig, current);
+		return 1;
+	}
 
 	err  = __put_user(ksig->sig, &frame->arg0);
 	err |= __put_user(&frame->info, &frame->arg1);
@@ -317,8 +289,10 @@ setup_frame(struct ksignal *ksig, sigset_t *set, struct sigscratch *scr)
 	err |= __save_altstack(&frame->sc.sc_stack, scr->pt.r12);
 	err |= setup_sigcontext(&frame->sc, set, scr);
 
-	if (unlikely(err))
-		return force_sigsegv_info(ksig->sig, frame);
+	if (unlikely(err)) {
+		force_sigsegv(ksig->sig, current);
+		return 1;
+	}
 
 	scr->pt.r12 = (unsigned long) frame - 16;	/* new stack pointer */
 	scr->pt.ar_fpsr = FPSR_DEFAULT;			/* reset fpsr for signal handler */
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 032/639] signal/ia64: Use the generic force_sigsegv in setup_frame
@ 2020-01-24  9:23   ` Greg Kroah-Hartman
  0 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:23 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Tony Luck, Fenghua Yu, linux-ia64,
	Eric W. Biederman, Sasha Levin

From: Eric W. Biederman <ebiederm@xmission.com>

[ Upstream commit 8b9c6b28312cc51a87055e292b11c5aa28f0c935 ]

The ia64 handling of failure to setup a signal frame has been trying
to set overlapping fields in struct siginfo since 2.3.43.  The si_pid
and si_uid fields are stomped when the si_addr field is set.  The
si_code of SI_KERNEL indicates that si_pid and si_uid should be valid,
and that si_addr does not exist.

Being at odds with the definition of SI_KERNEL and with nothing to
indicate that this was a signal frame setup failure there is no way
for userspace to know that si_addr was filled out instead.

In practice failure to setup a signal frame is rare, and si_pid and
si_uid are always set to 0 when si_code is SI_KERNEL so I expect no
one has looked closely enough before to see this weirdness.  Further
the only difference between force_sigsegv_info and the generic
force_sigsegv other than the return code is that force_sigsegv_info
stomps the si_uid and si_pid fields.

Remove the bug and simplify the code by using force_sigsegv in this
case just like other architectures.

Fixes: 2.3.43
Cc: Tony Luck <tony.luck@intel.com>
Cc: Fenghua Yu <fenghua.yu@intel.com>
Cc: linux-ia64@vger.kernel.org
Acked-by: Tony Luck <tony.luck@intel.com>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/ia64/kernel/signal.c | 50 ++++++++++-----------------------------
 1 file changed, 12 insertions(+), 38 deletions(-)

diff --git a/arch/ia64/kernel/signal.c b/arch/ia64/kernel/signal.c
index d1234a5ba4c55..01fc133b2e4c8 100644
--- a/arch/ia64/kernel/signal.c
+++ b/arch/ia64/kernel/signal.c
@@ -231,37 +231,6 @@ rbs_on_sig_stack (unsigned long bsp)
 	return (bsp - current->sas_ss_sp < current->sas_ss_size);
 }
 
-static long
-force_sigsegv_info (int sig, void __user *addr)
-{
-	unsigned long flags;
-	struct siginfo si;
-
-	clear_siginfo(&si);
-	if (sig = SIGSEGV) {
-		/*
-		 * Acquiring siglock around the sa_handler-update is almost
-		 * certainly overkill, but this isn't a
-		 * performance-critical path and I'd rather play it safe
-		 * here than having to debug a nasty race if and when
-		 * something changes in kernel/signal.c that would make it
-		 * no longer safe to modify sa_handler without holding the
-		 * lock.
-		 */
-		spin_lock_irqsave(&current->sighand->siglock, flags);
-		current->sighand->action[sig - 1].sa.sa_handler = SIG_DFL;
-		spin_unlock_irqrestore(&current->sighand->siglock, flags);
-	}
-	si.si_signo = SIGSEGV;
-	si.si_errno = 0;
-	si.si_code = SI_KERNEL;
-	si.si_pid = task_pid_vnr(current);
-	si.si_uid = from_kuid_munged(current_user_ns(), current_uid());
-	si.si_addr = addr;
-	force_sig_info(SIGSEGV, &si, current);
-	return 1;
-}
-
 static long
 setup_frame(struct ksignal *ksig, sigset_t *set, struct sigscratch *scr)
 {
@@ -295,15 +264,18 @@ setup_frame(struct ksignal *ksig, sigset_t *set, struct sigscratch *scr)
 			 * instead so we will die with SIGSEGV.
 			 */
 			check_sp = (new_sp - sizeof(*frame)) & -STACK_ALIGN;
-			if (!likely(on_sig_stack(check_sp)))
-				return force_sigsegv_info(ksig->sig, (void __user *)
-							  check_sp);
+			if (!likely(on_sig_stack(check_sp))) {
+				force_sigsegv(ksig->sig, current);
+				return 1;
+			}
 		}
 	}
 	frame = (void __user *) ((new_sp - sizeof(*frame)) & -STACK_ALIGN);
 
-	if (!access_ok(VERIFY_WRITE, frame, sizeof(*frame)))
-		return force_sigsegv_info(ksig->sig, frame);
+	if (!access_ok(VERIFY_WRITE, frame, sizeof(*frame))) {
+		force_sigsegv(ksig->sig, current);
+		return 1;
+	}
 
 	err  = __put_user(ksig->sig, &frame->arg0);
 	err |= __put_user(&frame->info, &frame->arg1);
@@ -317,8 +289,10 @@ setup_frame(struct ksignal *ksig, sigset_t *set, struct sigscratch *scr)
 	err |= __save_altstack(&frame->sc.sc_stack, scr->pt.r12);
 	err |= setup_sigcontext(&frame->sc, set, scr);
 
-	if (unlikely(err))
-		return force_sigsegv_info(ksig->sig, frame);
+	if (unlikely(err)) {
+		force_sigsegv(ksig->sig, current);
+		return 1;
+	}
 
 	scr->pt.r12 = (unsigned long) frame - 16;	/* new stack pointer */
 	scr->pt.ar_fpsr = FPSR_DEFAULT;			/* reset fpsr for signal handler */
-- 
2.20.1



^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 033/639] signal/ia64: Use the force_sig(SIGSEGV,...) in ia64_rt_sigreturn
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
@ 2020-01-24  9:23   ` Greg Kroah-Hartman
  2020-01-24  9:22 ` [PATCH 4.19 002/639] xfs: Sanity check flags of Q_XQUOTARM call Greg Kroah-Hartman
                     ` (641 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:23 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Tony Luck, Fenghua Yu, linux-ia64,
	Eric W. Biederman, Sasha Levin

From: Eric W. Biederman <ebiederm@xmission.com>

[ Upstream commit b92adb74adde62d9a9780ff2977d63dcb21aeaa6 ]

The ia64 handling of failure to return from a signal frame has been trying
to set overlapping fields in struct siginfo since 2.3.43.  The si_code
corresponds to the fields that were stomped (not the field that is
actually written), so I can not imagine a piece of userspace code
making sense of the signal frame if it looks closely.

In practice failure to return from a signal frame is a rare event that
almost never happens.  Someone using an alternate signal stack to
recover and looking in detail is even more rare.  So I presume no one
has ever noticed and reported this ia64 nonsense.

Sort this out by causing ia64 to use force_sig(SIGSEGV) like other architectures.

Fixes: 2.3.43
Cc: Tony Luck <tony.luck@intel.com>
Cc: Fenghua Yu <fenghua.yu@intel.com>
Cc: linux-ia64@vger.kernel.org
Acked-by: Tony Luck <tony.luck@intel.com>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/ia64/kernel/signal.c | 10 +---------
 1 file changed, 1 insertion(+), 9 deletions(-)

diff --git a/arch/ia64/kernel/signal.c b/arch/ia64/kernel/signal.c
index 01fc133b2e4c8..9a960829a01d9 100644
--- a/arch/ia64/kernel/signal.c
+++ b/arch/ia64/kernel/signal.c
@@ -110,7 +110,6 @@ ia64_rt_sigreturn (struct sigscratch *scr)
 {
 	extern char ia64_strace_leave_kernel, ia64_leave_kernel;
 	struct sigcontext __user *sc;
-	struct siginfo si;
 	sigset_t set;
 	long retval;
 
@@ -153,14 +152,7 @@ ia64_rt_sigreturn (struct sigscratch *scr)
 	return retval;
 
   give_sigsegv:
-	clear_siginfo(&si);
-	si.si_signo = SIGSEGV;
-	si.si_errno = 0;
-	si.si_code = SI_KERNEL;
-	si.si_pid = task_pid_vnr(current);
-	si.si_uid = from_kuid_munged(current_user_ns(), current_uid());
-	si.si_addr = sc;
-	force_sig_info(SIGSEGV, &si, current);
+	force_sig(SIGSEGV, current);
 	return retval;
 }
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 033/639] signal/ia64: Use the force_sig(SIGSEGV,...) in ia64_rt_sigreturn
@ 2020-01-24  9:23   ` Greg Kroah-Hartman
  0 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:23 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Tony Luck, Fenghua Yu, linux-ia64,
	Eric W. Biederman, Sasha Levin

From: Eric W. Biederman <ebiederm@xmission.com>

[ Upstream commit b92adb74adde62d9a9780ff2977d63dcb21aeaa6 ]

The ia64 handling of failure to return from a signal frame has been trying
to set overlapping fields in struct siginfo since 2.3.43.  The si_code
corresponds to the fields that were stomped (not the field that is
actually written), so I can not imagine a piece of userspace code
making sense of the signal frame if it looks closely.

In practice failure to return from a signal frame is a rare event that
almost never happens.  Someone using an alternate signal stack to
recover and looking in detail is even more rare.  So I presume no one
has ever noticed and reported this ia64 nonsense.

Sort this out by causing ia64 to use force_sig(SIGSEGV) like other architectures.

Fixes: 2.3.43
Cc: Tony Luck <tony.luck@intel.com>
Cc: Fenghua Yu <fenghua.yu@intel.com>
Cc: linux-ia64@vger.kernel.org
Acked-by: Tony Luck <tony.luck@intel.com>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/ia64/kernel/signal.c | 10 +---------
 1 file changed, 1 insertion(+), 9 deletions(-)

diff --git a/arch/ia64/kernel/signal.c b/arch/ia64/kernel/signal.c
index 01fc133b2e4c8..9a960829a01d9 100644
--- a/arch/ia64/kernel/signal.c
+++ b/arch/ia64/kernel/signal.c
@@ -110,7 +110,6 @@ ia64_rt_sigreturn (struct sigscratch *scr)
 {
 	extern char ia64_strace_leave_kernel, ia64_leave_kernel;
 	struct sigcontext __user *sc;
-	struct siginfo si;
 	sigset_t set;
 	long retval;
 
@@ -153,14 +152,7 @@ ia64_rt_sigreturn (struct sigscratch *scr)
 	return retval;
 
   give_sigsegv:
-	clear_siginfo(&si);
-	si.si_signo = SIGSEGV;
-	si.si_errno = 0;
-	si.si_code = SI_KERNEL;
-	si.si_pid = task_pid_vnr(current);
-	si.si_uid = from_kuid_munged(current_user_ns(), current_uid());
-	si.si_addr = sc;
-	force_sig_info(SIGSEGV, &si, current);
+	force_sig(SIGSEGV, current);
 	return retval;
 }
 
-- 
2.20.1



^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 034/639] ASoC: wm9712: fix unused variable warning
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (32 preceding siblings ...)
  2020-01-24  9:23   ` Greg Kroah-Hartman
@ 2020-01-24  9:23 ` Greg Kroah-Hartman
  2020-01-24  9:23 ` [PATCH 4.19 035/639] mailbox: mediatek: Add check for possible failure of kzalloc Greg Kroah-Hartman
                   ` (608 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:23 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Arnd Bergmann, Charles Keepax,
	Mark Brown, Sasha Levin

From: Arnd Bergmann <arnd@arndb.de>

[ Upstream commit 18380dcc52cc8965e5144ce33fdfad7e168679a5 ]

The 'ret' variable is now only used in an #ifdef, and causes a
warning if it is declared outside of that block:

sound/soc/codecs/wm9712.c: In function 'wm9712_soc_probe':
sound/soc/codecs/wm9712.c:641:6: error: unused variable 'ret' [-Werror=unused-variable]

Fixes: 2ed1a8e0ce8d ("ASoC: wm9712: add ac97 new bus support")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/codecs/wm9712.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/sound/soc/codecs/wm9712.c b/sound/soc/codecs/wm9712.c
index ade34c26ad2f3..e873baa9e7780 100644
--- a/sound/soc/codecs/wm9712.c
+++ b/sound/soc/codecs/wm9712.c
@@ -638,13 +638,14 @@ static int wm9712_soc_probe(struct snd_soc_component *component)
 {
 	struct wm9712_priv *wm9712 = snd_soc_component_get_drvdata(component);
 	struct regmap *regmap;
-	int ret;
 
 	if (wm9712->mfd_pdata) {
 		wm9712->ac97 = wm9712->mfd_pdata->ac97;
 		regmap = wm9712->mfd_pdata->regmap;
 	} else {
 #ifdef CONFIG_SND_SOC_AC97_BUS
+		int ret;
+
 		wm9712->ac97 = snd_soc_new_ac97_component(component, WM9712_VENDOR_ID,
 						      WM9712_VENDOR_ID_MASK);
 		if (IS_ERR(wm9712->ac97)) {
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 035/639] mailbox: mediatek: Add check for possible failure of kzalloc
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (33 preceding siblings ...)
  2020-01-24  9:23 ` [PATCH 4.19 034/639] ASoC: wm9712: fix unused variable warning Greg Kroah-Hartman
@ 2020-01-24  9:23 ` Greg Kroah-Hartman
  2020-01-24  9:23 ` [PATCH 4.19 036/639] IB/rxe: replace kvfree with vfree Greg Kroah-Hartman
                   ` (607 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:23 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Houlong Wei,
	Philipp Zabel, Jassi Brar, Sasha Levin

From: Houlong Wei <houlong.wei@mediatek.com>

[ Upstream commit 9f0a0a381c5db56e7922dbeea6831f27db58372f ]

The patch 623a6143a845("mailbox: mediatek: Add Mediatek CMDQ driver")
introduce the following static checker warning:
  drivers/mailbox/mtk-cmdq-mailbox.c:366 cmdq_mbox_send_data()
  error: potential null dereference 'task'.  (kzalloc returns null)

Fixes: 623a6143a845 ("mailbox: mediatek: Add Mediatek CMDQ driver")
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Houlong Wei <houlong.wei@mediatek.com>
Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: Jassi Brar <jaswinder.singh@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mailbox/mtk-cmdq-mailbox.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/mailbox/mtk-cmdq-mailbox.c b/drivers/mailbox/mtk-cmdq-mailbox.c
index aec46d5d35061..f7cc29c00302a 100644
--- a/drivers/mailbox/mtk-cmdq-mailbox.c
+++ b/drivers/mailbox/mtk-cmdq-mailbox.c
@@ -363,6 +363,9 @@ static int cmdq_mbox_send_data(struct mbox_chan *chan, void *data)
 	WARN_ON(cmdq->suspended);
 
 	task = kzalloc(sizeof(*task), GFP_ATOMIC);
+	if (!task)
+		return -ENOMEM;
+
 	task->cmdq = cmdq;
 	INIT_LIST_HEAD(&task->list_entry);
 	task->pa_base = pkt->pa_base;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 036/639] IB/rxe: replace kvfree with vfree
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (34 preceding siblings ...)
  2020-01-24  9:23 ` [PATCH 4.19 035/639] mailbox: mediatek: Add check for possible failure of kzalloc Greg Kroah-Hartman
@ 2020-01-24  9:23 ` Greg Kroah-Hartman
  2020-01-24  9:23 ` [PATCH 4.19 037/639] IB/hfi1: Add mtu check for operational data VLs Greg Kroah-Hartman
                   ` (606 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:23 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Leon Romanovsky, Zhu Yanjun,
	Jason Gunthorpe, Sasha Levin

From: Zhu Yanjun <yanjun.zhu@oracle.com>

[ Upstream commit 721ad7e643f7002efa398838693f90284ea216d1 ]

The buf is allocated by vmalloc_user in the function rxe_queue_init.
So it is better to free it by vfree.

Fixes: 8700e3e7c485 ("Soft RoCE driver")
Reviewed-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Zhu Yanjun <yanjun.zhu@oracle.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/sw/rxe/rxe_cq.c | 4 ++--
 drivers/infiniband/sw/rxe/rxe_qp.c | 5 +++--
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/drivers/infiniband/sw/rxe/rxe_cq.c b/drivers/infiniband/sw/rxe/rxe_cq.c
index 2ee4b08b00ea4..a57276f2cb849 100644
--- a/drivers/infiniband/sw/rxe/rxe_cq.c
+++ b/drivers/infiniband/sw/rxe/rxe_cq.c
@@ -30,7 +30,7 @@
  * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  * SOFTWARE.
  */
-
+#include <linux/vmalloc.h>
 #include "rxe.h"
 #include "rxe_loc.h"
 #include "rxe_queue.h"
@@ -97,7 +97,7 @@ int rxe_cq_from_init(struct rxe_dev *rxe, struct rxe_cq *cq, int cqe,
 	err = do_mmap_info(rxe, uresp ? &uresp->mi : NULL, context,
 			   cq->queue->buf, cq->queue->buf_size, &cq->queue->ip);
 	if (err) {
-		kvfree(cq->queue->buf);
+		vfree(cq->queue->buf);
 		kfree(cq->queue);
 		return err;
 	}
diff --git a/drivers/infiniband/sw/rxe/rxe_qp.c b/drivers/infiniband/sw/rxe/rxe_qp.c
index c58452daffc74..230697fa31fe3 100644
--- a/drivers/infiniband/sw/rxe/rxe_qp.c
+++ b/drivers/infiniband/sw/rxe/rxe_qp.c
@@ -34,6 +34,7 @@
 #include <linux/skbuff.h>
 #include <linux/delay.h>
 #include <linux/sched.h>
+#include <linux/vmalloc.h>
 
 #include "rxe.h"
 #include "rxe_loc.h"
@@ -247,7 +248,7 @@ static int rxe_qp_init_req(struct rxe_dev *rxe, struct rxe_qp *qp,
 			   &qp->sq.queue->ip);
 
 	if (err) {
-		kvfree(qp->sq.queue->buf);
+		vfree(qp->sq.queue->buf);
 		kfree(qp->sq.queue);
 		return err;
 	}
@@ -300,7 +301,7 @@ static int rxe_qp_init_resp(struct rxe_dev *rxe, struct rxe_qp *qp,
 				   qp->rq.queue->buf, qp->rq.queue->buf_size,
 				   &qp->rq.queue->ip);
 		if (err) {
-			kvfree(qp->rq.queue->buf);
+			vfree(qp->rq.queue->buf);
 			kfree(qp->rq.queue);
 			return err;
 		}
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 037/639] IB/hfi1: Add mtu check for operational data VLs
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (35 preceding siblings ...)
  2020-01-24  9:23 ` [PATCH 4.19 036/639] IB/rxe: replace kvfree with vfree Greg Kroah-Hartman
@ 2020-01-24  9:23 ` Greg Kroah-Hartman
  2020-01-24  9:23 ` [PATCH 4.19 038/639] genirq/debugfs: Reinstate full OF path for domain name Greg Kroah-Hartman
                   ` (605 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:23 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Mike Marciniszyn, Michael J. Ruhl,
	Alex Estrin, Dennis Dalessandro, Jason Gunthorpe, Sasha Levin

From: Alex Estrin <alex.estrin@intel.com>

[ Upstream commit eb50130964e8c1379f37c3d3bab33a411ec62e98 ]

Since Virtual Lanes BCT credits and MTU are set through separate MADs, we
have to ensure both are valid, and data VLs are ready for transmission
before we allow port transition to Armed state.

Fixes: 5e2d6764a729 ("IB/hfi1: Verify port data VLs credits on transition to Armed")
Reviewed-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
Reviewed-by: Michael J. Ruhl <michael.j.ruhl@intel.com>
Signed-off-by: Alex Estrin <alex.estrin@intel.com>
Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/hw/hfi1/chip.c | 26 ++++++++++++++++++++++----
 1 file changed, 22 insertions(+), 4 deletions(-)

diff --git a/drivers/infiniband/hw/hfi1/chip.c b/drivers/infiniband/hw/hfi1/chip.c
index 6b89353611333..b09a4b1cf397b 100644
--- a/drivers/infiniband/hw/hfi1/chip.c
+++ b/drivers/infiniband/hw/hfi1/chip.c
@@ -10580,12 +10580,29 @@ void set_link_down_reason(struct hfi1_pportdata *ppd, u8 lcl_reason,
 	}
 }
 
-/*
- * Verify if BCT for data VLs is non-zero.
+/**
+ * data_vls_operational() - Verify if data VL BCT credits and MTU
+ *			    are both set.
+ * @ppd: pointer to hfi1_pportdata structure
+ *
+ * Return: true - Ok, false -otherwise.
  */
 static inline bool data_vls_operational(struct hfi1_pportdata *ppd)
 {
-	return !!ppd->actual_vls_operational;
+	int i;
+	u64 reg;
+
+	if (!ppd->actual_vls_operational)
+		return false;
+
+	for (i = 0; i < ppd->vls_supported; i++) {
+		reg = read_csr(ppd->dd, SEND_CM_CREDIT_VL + (8 * i));
+		if ((reg && !ppd->dd->vld[i].mtu) ||
+		    (!reg && ppd->dd->vld[i].mtu))
+			return false;
+	}
+
+	return true;
 }
 
 /*
@@ -10698,7 +10715,8 @@ int set_link_state(struct hfi1_pportdata *ppd, u32 state)
 
 		if (!data_vls_operational(ppd)) {
 			dd_dev_err(dd,
-				   "%s: data VLs not operational\n", __func__);
+				   "%s: Invalid data VL credits or mtu\n",
+				   __func__);
 			ret = -EINVAL;
 			break;
 		}
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 038/639] genirq/debugfs: Reinstate full OF path for domain name
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (36 preceding siblings ...)
  2020-01-24  9:23 ` [PATCH 4.19 037/639] IB/hfi1: Add mtu check for operational data VLs Greg Kroah-Hartman
@ 2020-01-24  9:23 ` Greg Kroah-Hartman
  2020-01-24  9:23 ` [PATCH 4.19 039/639] usb: dwc3: add EXTCON dependency for qcom Greg Kroah-Hartman
                   ` (604 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:23 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Marc Zyngier, Thomas Gleixner, Sasha Levin

From: Marc Zyngier <marc.zyngier@arm.com>

[ Upstream commit 94967b55ebf3b603f2fe750ecedd896042585a1c ]

On a DT based system, we use the of_node full name to name the
corresponding irq domain. We expect that name to be unique, so so that
domains with the same base name won't clash (this happens on multi-node
topologies, for example).

Since a7e4cfb0a7ca ("of/fdt: only store the device node basename in
full_name"), of_node_full_name() lies and only returns the basename. This
breaks the above requirement, and we end-up with only a subset of the
domains in /sys/kernel/debug/irq/domains.

Let's reinstate the feature by using the fancy new %pOF format specifier,
which happens to do the right thing.

Fixes: a7e4cfb0a7ca ("of/fdt: only store the device node basename in full_name")
Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Link: https://lkml.kernel.org/r/20181001100522.180054-3-marc.zyngier@arm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/irq/irqdomain.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/irq/irqdomain.c b/kernel/irq/irqdomain.c
index 5d9fc01b60a61..0b90be3607249 100644
--- a/kernel/irq/irqdomain.c
+++ b/kernel/irq/irqdomain.c
@@ -183,7 +183,7 @@ struct irq_domain *__irq_domain_add(struct fwnode_handle *fwnode, int size,
 		 * unhappy about. Replace them with ':', which does
 		 * the trick and is not as offensive as '\'...
 		 */
-		name = kstrdup(of_node_full_name(of_node), GFP_KERNEL);
+		name = kasprintf(GFP_KERNEL, "%pOF", of_node);
 		if (!name) {
 			kfree(domain);
 			return NULL;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 039/639] usb: dwc3: add EXTCON dependency for qcom
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (37 preceding siblings ...)
  2020-01-24  9:23 ` [PATCH 4.19 038/639] genirq/debugfs: Reinstate full OF path for domain name Greg Kroah-Hartman
@ 2020-01-24  9:23 ` Greg Kroah-Hartman
  2020-01-24  9:23 ` [PATCH 4.19 040/639] usb: gadget: fsl_udc_core: check allocation return value and cleanup on failure Greg Kroah-Hartman
                   ` (603 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:23 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Arnd Bergmann, Felipe Balbi, Sasha Levin

From: Arnd Bergmann <arnd@arndb.de>

[ Upstream commit 3def4031b3e3fbb524cbd01555b057a6cef0d5e6 ]

Like the omap back-end, we get a link error with CONFIG_EXTCON=m
when building the qcom back-end into the kernel:

drivers/usb/dwc3/dwc3-qcom.o: In function `dwc3_qcom_probe':
dwc3-qcom.c:(.text+0x13dc): undefined reference to `extcon_get_edev_by_phandle'
dwc3-qcom.c:(.text+0x1b18): undefined reference to `devm_extcon_register_notifier'
dwc3-qcom.c:(.text+0x1b9c): undefined reference to `extcon_get_state'

Do the same thing as OMAP and add an explicit dependency on
EXTCON.

Fixes: a4333c3a6ba9 ("usb: dwc3: Add Qualcomm DWC3 glue driver")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/dwc3/Kconfig | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/dwc3/Kconfig b/drivers/usb/dwc3/Kconfig
index 518ead12458d0..1a0404fda596b 100644
--- a/drivers/usb/dwc3/Kconfig
+++ b/drivers/usb/dwc3/Kconfig
@@ -113,7 +113,7 @@ config USB_DWC3_ST
 
 config USB_DWC3_QCOM
 	tristate "Qualcomm Platform"
-	depends on ARCH_QCOM || COMPILE_TEST
+	depends on EXTCON && (ARCH_QCOM || COMPILE_TEST)
 	depends on OF
 	default USB_DWC3
 	help
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 040/639] usb: gadget: fsl_udc_core: check allocation return value and cleanup on failure
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (38 preceding siblings ...)
  2020-01-24  9:23 ` [PATCH 4.19 039/639] usb: dwc3: add EXTCON dependency for qcom Greg Kroah-Hartman
@ 2020-01-24  9:23 ` Greg Kroah-Hartman
  2020-01-24  9:23 ` [PATCH 4.19 041/639] cfg80211: regulatory: make initialization more robust Greg Kroah-Hartman
                   ` (602 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:23 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Nicholas Mc Guire, Felipe Balbi, Sasha Levin

From: Nicholas Mc Guire <hofrat@osadl.org>

[ Upstream commit 4ab2b48c98f2ec9712452d520a381917f91ac3d2 ]

The allocation with fsl_alloc_request() and kmalloc() were unchecked
fixed this up with a NULL check and appropriate cleanup.

Additionally udc->ep_qh_size was reset to 0 on failure of allocation.
Similar udc->phy_mode is initially 0 (as udc_controller was
allocated with kzalloc in fsl_udc_probe()) so reset it to 0 as well
so that this function is side-effect free on failure. Not clear if
this is necessary or sensible as fsl_udc_release() probably can not
be called if fsl_udc_probe() failed - but it should not hurt.

Signed-off-by: Nicholas Mc Guire <hofrat@osadl.org>
Fixes: b504882da5 ("USB: add Freescale high-speed USB SOC device controller driver")
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/gadget/udc/fsl_udc_core.c | 30 +++++++++++++++++++++++----
 1 file changed, 26 insertions(+), 4 deletions(-)

diff --git a/drivers/usb/gadget/udc/fsl_udc_core.c b/drivers/usb/gadget/udc/fsl_udc_core.c
index d44b26d5b2a2c..367697144cda2 100644
--- a/drivers/usb/gadget/udc/fsl_udc_core.c
+++ b/drivers/usb/gadget/udc/fsl_udc_core.c
@@ -2247,8 +2247,10 @@ static int struct_udc_setup(struct fsl_udc *udc,
 	udc->phy_mode = pdata->phy_mode;
 
 	udc->eps = kcalloc(udc->max_ep, sizeof(struct fsl_ep), GFP_KERNEL);
-	if (!udc->eps)
-		return -1;
+	if (!udc->eps) {
+		ERR("kmalloc udc endpoint status failed\n");
+		goto eps_alloc_failed;
+	}
 
 	/* initialized QHs, take care of alignment */
 	size = udc->max_ep * sizeof(struct ep_queue_head);
@@ -2262,8 +2264,7 @@ static int struct_udc_setup(struct fsl_udc *udc,
 					&udc->ep_qh_dma, GFP_KERNEL);
 	if (!udc->ep_qh) {
 		ERR("malloc QHs for udc failed\n");
-		kfree(udc->eps);
-		return -1;
+		goto ep_queue_alloc_failed;
 	}
 
 	udc->ep_qh_size = size;
@@ -2272,8 +2273,17 @@ static int struct_udc_setup(struct fsl_udc *udc,
 	/* FIXME: fsl_alloc_request() ignores ep argument */
 	udc->status_req = container_of(fsl_alloc_request(NULL, GFP_KERNEL),
 			struct fsl_req, req);
+	if (!udc->status_req) {
+		ERR("kzalloc for udc status request failed\n");
+		goto udc_status_alloc_failed;
+	}
+
 	/* allocate a small amount of memory to get valid address */
 	udc->status_req->req.buf = kmalloc(8, GFP_KERNEL);
+	if (!udc->status_req->req.buf) {
+		ERR("kzalloc for udc request buffer failed\n");
+		goto udc_req_buf_alloc_failed;
+	}
 
 	udc->resume_state = USB_STATE_NOTATTACHED;
 	udc->usb_state = USB_STATE_POWERED;
@@ -2281,6 +2291,18 @@ static int struct_udc_setup(struct fsl_udc *udc,
 	udc->remote_wakeup = 0;	/* default to 0 on reset */
 
 	return 0;
+
+udc_req_buf_alloc_failed:
+	kfree(udc->status_req);
+udc_status_alloc_failed:
+	kfree(udc->ep_qh);
+	udc->ep_qh_size = 0;
+ep_queue_alloc_failed:
+	kfree(udc->eps);
+eps_alloc_failed:
+	udc->phy_mode = 0;
+	return -1;
+
 }
 
 /*----------------------------------------------------------------
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 041/639] cfg80211: regulatory: make initialization more robust
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (39 preceding siblings ...)
  2020-01-24  9:23 ` [PATCH 4.19 040/639] usb: gadget: fsl_udc_core: check allocation return value and cleanup on failure Greg Kroah-Hartman
@ 2020-01-24  9:23 ` Greg Kroah-Hartman
  2020-01-24  9:23 ` [PATCH 4.19 042/639] regulator: fixed: Default enable high on DT regulators Greg Kroah-Hartman
                   ` (601 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:23 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Johannes Berg, Sasha Levin

From: Johannes Berg <johannes.berg@intel.com>

[ Upstream commit 71e5e886806ee3f8e0c44ed945eb2e4d6659c6e3 ]

Since my change to split out the regulatory init to occur later,
any issues during earlier cfg80211_init() or errors during the
platform device allocation would lead to crashes later. Make this
more robust by checking that the earlier initialization succeeded.

Fixes: d7be102f2945 ("cfg80211: initialize regulatory keys/database later")
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/wireless/reg.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 64841238df855..5643bdee7198f 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -3870,6 +3870,15 @@ static int __init regulatory_init_db(void)
 {
 	int err;
 
+	/*
+	 * It's possible that - due to other bugs/issues - cfg80211
+	 * never called regulatory_init() below, or that it failed;
+	 * in that case, don't try to do any further work here as
+	 * it's doomed to lead to crashes.
+	 */
+	if (IS_ERR_OR_NULL(reg_pdev))
+		return -EINVAL;
+
 	err = load_builtin_regdb_keys();
 	if (err)
 		return err;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 042/639] regulator: fixed: Default enable high on DT regulators
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (40 preceding siblings ...)
  2020-01-24  9:23 ` [PATCH 4.19 041/639] cfg80211: regulatory: make initialization more robust Greg Kroah-Hartman
@ 2020-01-24  9:23 ` Greg Kroah-Hartman
  2020-01-24  9:23 ` [PATCH 4.19 043/639] mei: replace POLL* with EPOLL* for write queues Greg Kroah-Hartman
                   ` (600 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:23 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Leonard Crestez, Fabio Estevam,
	John Stultz, Anders Roxell, Linus Walleij, Mark Brown,
	Sasha Levin

From: Linus Walleij <linus.walleij@linaro.org>

[ Upstream commit 28be5f15df2ee6882b0a122693159c96a28203c7 ]

commit efdfeb079cc3
("regulator: fixed: Convert to use GPIO descriptor only")
switched to use gpiod_get() to look up the regulator from the
gpiolib core whether that is device tree or boardfile.

This meant that we activate the code in
a603a2b8d86e ("gpio: of: Add special quirk to parse regulator flags")
which means the descriptors coming from the device tree already
have the right inversion and open drain semantics set up from
the gpiolib core.

As the fixed regulator was inspected again we got the
inverted inversion and things broke.

Fix it by ignoring the config in the device tree for now: the
later patches in the series will push all inversion handling
over to the gpiolib core and set it up properly in the
boardfiles for legacy devices, but I did not finish that
for this kernel cycle.

Fixes: commit efdfeb079cc3 ("regulator: fixed: Convert to use GPIO descriptor only")
Reported-by: Leonard Crestez <leonard.crestez@nxp.com>
Reported-by: Fabio Estevam <festevam@gmail.com>
Reported-by: John Stultz <john.stultz@linaro.org>
Reported-by: Anders Roxell <anders.roxell@linaro.org>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Tested-by: John Stultz <john.stultz@linaro.org>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/regulator/fixed.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/drivers/regulator/fixed.c b/drivers/regulator/fixed.c
index 988a7472c2ab5..d68ff65a5adc9 100644
--- a/drivers/regulator/fixed.c
+++ b/drivers/regulator/fixed.c
@@ -84,9 +84,14 @@ of_get_fixed_voltage_config(struct device *dev,
 
 	of_property_read_u32(np, "startup-delay-us", &config->startup_delay);
 
-	config->enable_high = of_property_read_bool(np, "enable-active-high");
-	config->gpio_is_open_drain = of_property_read_bool(np,
-							   "gpio-open-drain");
+	/*
+	 * FIXME: we pulled active low/high and open drain handling into
+	 * gpiolib so it will be handled there. Delete this in the second
+	 * step when we also remove the custom inversion handling for all
+	 * legacy boardfiles.
+	 */
+	config->enable_high = 1;
+	config->gpio_is_open_drain = 0;
 
 	if (of_find_property(np, "vin-supply", NULL))
 		config->input_supply = "vin";
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 043/639] mei: replace POLL* with EPOLL* for write queues.
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (41 preceding siblings ...)
  2020-01-24  9:23 ` [PATCH 4.19 042/639] regulator: fixed: Default enable high on DT regulators Greg Kroah-Hartman
@ 2020-01-24  9:23 ` Greg Kroah-Hartman
  2020-01-24  9:23 ` [PATCH 4.19 044/639] drm/msm: fix unsigned comparison with less than zero Greg Kroah-Hartman
                   ` (599 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:23 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Tomas Winkler, Sasha Levin

From: Tomas Winkler <tomas.winkler@intel.com>

[ Upstream commit 03b2cbb6ea3c73e08fcf72d9ef8e286c4dcbd1fe ]

Looks like during merging the bulk POLL* -> EPOLL* replacement
missed the patch
'commit af336cabe083 ("mei: limit the number of queued writes")'

Fix sparse warning:
drivers/misc/mei/main.c:602:13: warning: restricted __poll_t degrades to integer
drivers/misc/mei/main.c:605:30: warning: invalid assignment: |=
drivers/misc/mei/main.c:605:30:    left side has type restricted __poll_t
drivers/misc/mei/main.c:605:30:    right side has type int

Fixes: af336cabe083 ("mei: limit the number of queued writes")
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/misc/mei/main.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/misc/mei/main.c b/drivers/misc/mei/main.c
index 4d77a6ae183a9..87281b3695e60 100644
--- a/drivers/misc/mei/main.c
+++ b/drivers/misc/mei/main.c
@@ -599,10 +599,10 @@ static __poll_t mei_poll(struct file *file, poll_table *wait)
 			mei_cl_read_start(cl, mei_cl_mtu(cl), file);
 	}
 
-	if (req_events & (POLLOUT | POLLWRNORM)) {
+	if (req_events & (EPOLLOUT | EPOLLWRNORM)) {
 		poll_wait(file, &cl->tx_wait, wait);
 		if (cl->tx_cb_queued < dev->tx_queue_limit)
-			mask |= POLLOUT | POLLWRNORM;
+			mask |= EPOLLOUT | EPOLLWRNORM;
 	}
 
 out:
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 044/639] drm/msm: fix unsigned comparison with less than zero
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (42 preceding siblings ...)
  2020-01-24  9:23 ` [PATCH 4.19 043/639] mei: replace POLL* with EPOLL* for write queues Greg Kroah-Hartman
@ 2020-01-24  9:23 ` Greg Kroah-Hartman
  2020-01-24  9:23 ` [PATCH 4.19 045/639] of: Fix property name in of_node_get_device_type Greg Kroah-Hartman
                   ` (598 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:23 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Colin Ian King, Rob Clark, Sasha Levin

From: Colin Ian King <colin.king@canonical.com>

[ Upstream commit dfdb3be43ef1195c491e6c3760b922acb52e3575 ]

The return from the call to _mixer_stages can be a negative error
code however this is being assigned to an unsigned variable 'stages'
hence the check is always false. Fix this by making 'stages' an
int.

Detected by Coccinelle ("Unsigned expression compared with zero:
stages < 0")

Fixes: 25fdd5933e4c ("drm/msm: Add SDM845 DPU support")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Rob Clark <robdclark@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c
index 06be7cf7ce505..79bafea663542 100644
--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c
+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c
@@ -310,7 +310,7 @@ static void dpu_hw_ctl_setup_blendstage(struct dpu_hw_ctl *ctx,
 	u32 mixercfg = 0, mixercfg_ext = 0, mix, ext;
 	u32 mixercfg_ext2 = 0, mixercfg_ext3 = 0;
 	int i, j;
-	u8 stages;
+	int stages;
 	int pipes_per_stage;
 
 	stages = _mixer_stages(ctx->mixer_hw_caps, ctx->mixer_count, lm);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 045/639] of: Fix property name in of_node_get_device_type
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (43 preceding siblings ...)
  2020-01-24  9:23 ` [PATCH 4.19 044/639] drm/msm: fix unsigned comparison with less than zero Greg Kroah-Hartman
@ 2020-01-24  9:23 ` Greg Kroah-Hartman
  2020-01-24  9:23 ` [PATCH 4.19 046/639] ALSA: usb-audio: update quirk for B&W PX to remove microphone Greg Kroah-Hartman
                   ` (597 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:23 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Frank Rowand, Rob Herring, Sasha Levin

From: Rob Herring <robh@kernel.org>

[ Upstream commit 5d5a0ab1a7918fce5ca5c0fb1871a3e2000f85de ]

Commit 0413bedabc88 ("of: Add device_type access helper functions")
added a new helper not yet used in preparation for some treewide clean
up of accesses to 'device_type' properties. Unfortunately, there's an
error and 'type' was used for the property name. Fix this.

Fixes: 0413bedabc88 ("of: Add device_type access helper functions")
Cc: Frank Rowand <frowand.list@gmail.com>
Signed-off-by: Rob Herring <robh@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/of.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/linux/of.h b/include/linux/of.h
index d5a863c1ee390..dac0201eacef7 100644
--- a/include/linux/of.h
+++ b/include/linux/of.h
@@ -1001,7 +1001,7 @@ static inline struct device_node *of_find_matching_node(
 
 static inline const char *of_node_get_device_type(const struct device_node *np)
 {
-	return of_get_property(np, "type", NULL);
+	return of_get_property(np, "device_type", NULL);
 }
 
 static inline bool of_node_is_type(const struct device_node *np, const char *type)
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 046/639] ALSA: usb-audio: update quirk for B&W PX to remove microphone
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (44 preceding siblings ...)
  2020-01-24  9:23 ` [PATCH 4.19 045/639] of: Fix property name in of_node_get_device_type Greg Kroah-Hartman
@ 2020-01-24  9:23 ` Greg Kroah-Hartman
  2020-01-24  9:23 ` [PATCH 4.19 047/639] iwlwifi: nvm: get num of hw addresses from firmware Greg Kroah-Hartman
                   ` (596 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:23 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Nicolas Huaman, Takashi Iwai, Sasha Levin

From: Nicolas Huaman <nicolas@herochao.de>

[ Upstream commit c369c8db15d51fa175d2ba85928f79d16af6b562 ]

A quirk in snd-usb-audio was added to automate setting sample rate to
4800k and remove the previously exposed nonfunctional microphone for
the Bowers & Wilkins PX:
commit 240a8af929c7c57dcde28682725b29cf8474e8e5
https://lore.kernel.org/patchwork/patch/919689/

However the headphones where updated shortly after that to remove the
unintentional microphone functionality. I guess because of this the
headphones now crash when connecting them via USB while the quirk is
active. Dmesg:

snd-usb-audio: probe of 2-3:1.0 failed with error -22
usb 2-3: 2:1: cannot get min/max values for control 2 (id 2)

This patch removes the microfone and allows the headphones to connect
and work out of the box. It is based on the current mainline kernel
 and successfully applied an tested on my machine (4.18.10.arch1-1).

Fixes: 240a8af929c7 ("ALSA: usb-audio: Add a quirck for B&W PX headphones")
Signed-off-by: Nicolas Huaman <nicolas@herochao.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/usb/quirks-table.h | 9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h
index 65f9c4ba62ee1..90d4f61cc2308 100644
--- a/sound/usb/quirks-table.h
+++ b/sound/usb/quirks-table.h
@@ -3349,19 +3349,14 @@ AU0828_DEVICE(0x2040, 0x7270, "Hauppauge", "HVR-950Q"),
 				.ifnum = 0,
 				.type = QUIRK_AUDIO_STANDARD_MIXER,
 			},
-			/* Capture */
-			{
-				.ifnum = 1,
-				.type = QUIRK_IGNORE_INTERFACE,
-			},
 			/* Playback */
 			{
-				.ifnum = 2,
+				.ifnum = 1,
 				.type = QUIRK_AUDIO_FIXED_ENDPOINT,
 				.data = &(const struct audioformat) {
 					.formats = SNDRV_PCM_FMTBIT_S16_LE,
 					.channels = 2,
-					.iface = 2,
+					.iface = 1,
 					.altsetting = 1,
 					.altset_idx = 1,
 					.attributes = UAC_EP_CS_ATTR_FILL_MAX |
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 047/639] iwlwifi: nvm: get num of hw addresses from firmware
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (45 preceding siblings ...)
  2020-01-24  9:23 ` [PATCH 4.19 046/639] ALSA: usb-audio: update quirk for B&W PX to remove microphone Greg Kroah-Hartman
@ 2020-01-24  9:23 ` Greg Kroah-Hartman
  2020-01-24  9:23 ` [PATCH 4.19 048/639] staging: comedi: ni_mio_common: protect register write overflow Greg Kroah-Hartman
                   ` (595 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:23 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Naftali Goldstein, Luca Coelho, Sasha Levin

From: Naftali Goldstein <naftali.goldstein@intel.com>

[ Upstream commit e7eeee08434873c2f781dc1afaa42b03a014b95d ]

With NICs that don't read the NVM directly and instead rely on getting
the relevant data from the firmware, the number of reserved MAC
addresses was not added to the API. This caused the driver to assume
there is only one address which results in all interfaces getting the
same address. Update the API to fix this.

While at it, fix-up the comments with firmware api names to actually
match what we have in the firmware.

Fixes: e9e1ba3dbf00 ("iwlwifi: mvm: support getting nvm data from firmware")
Signed-off-by: Naftali Goldstein <naftali.goldstein@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../net/wireless/intel/iwlwifi/fw/api/nvm-reg.h    | 14 +++++++-------
 drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c | 10 +++++++++-
 2 files changed, 16 insertions(+), 8 deletions(-)

diff --git a/drivers/net/wireless/intel/iwlwifi/fw/api/nvm-reg.h b/drivers/net/wireless/intel/iwlwifi/fw/api/nvm-reg.h
index 6c53383647942..d22c1eefba6a2 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/api/nvm-reg.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/api/nvm-reg.h
@@ -165,7 +165,7 @@ struct iwl_nvm_access_resp {
  */
 struct iwl_nvm_get_info {
 	__le32 reserved;
-} __packed; /* GRP_REGULATORY_NVM_GET_INFO_CMD_S_VER_1 */
+} __packed; /* REGULATORY_NVM_GET_INFO_CMD_API_S_VER_1 */
 
 /**
  * enum iwl_nvm_info_general_flags - flags in NVM_GET_INFO resp
@@ -180,14 +180,14 @@ enum iwl_nvm_info_general_flags {
  * @flags: bit 0: 1 - empty, 0 - non-empty
  * @nvm_version: nvm version
  * @board_type: board type
- * @reserved: reserved
+ * @n_hw_addrs: number of reserved MAC addresses
  */
 struct iwl_nvm_get_info_general {
 	__le32 flags;
 	__le16 nvm_version;
 	u8 board_type;
-	u8 reserved;
-} __packed; /* GRP_REGULATORY_NVM_GET_INFO_GENERAL_S_VER_1 */
+	u8 n_hw_addrs;
+} __packed; /* REGULATORY_NVM_GET_INFO_GENERAL_S_VER_2 */
 
 /**
  * enum iwl_nvm_mac_sku_flags - flags in &iwl_nvm_get_info_sku
@@ -231,7 +231,7 @@ struct iwl_nvm_get_info_sku {
 struct iwl_nvm_get_info_phy {
 	__le32 tx_chains;
 	__le32 rx_chains;
-} __packed; /* GRP_REGULATORY_NVM_GET_INFO_PHY_SKU_SECTION_S_VER_1 */
+} __packed; /* REGULATORY_NVM_GET_INFO_PHY_SKU_SECTION_S_VER_1 */
 
 #define IWL_NUM_CHANNELS (51)
 
@@ -245,7 +245,7 @@ struct iwl_nvm_get_info_regulatory {
 	__le32 lar_enabled;
 	__le16 channel_profile[IWL_NUM_CHANNELS];
 	__le16 reserved;
-} __packed; /* GRP_REGULATORY_NVM_GET_INFO_REGULATORY_S_VER_1 */
+} __packed; /* REGULATORY_NVM_GET_INFO_REGULATORY_S_VER_1 */
 
 /**
  * struct iwl_nvm_get_info_rsp - response to get NVM data
@@ -259,7 +259,7 @@ struct iwl_nvm_get_info_rsp {
 	struct iwl_nvm_get_info_sku mac_sku;
 	struct iwl_nvm_get_info_phy phy_sku;
 	struct iwl_nvm_get_info_regulatory regulatory;
-} __packed; /* GRP_REGULATORY_NVM_GET_INFO_CMD_RSP_S_VER_2 */
+} __packed; /* REGULATORY_NVM_GET_INFO_RSP_API_S_VER_3 */
 
 /**
  * struct iwl_nvm_access_complete_cmd - NVM_ACCESS commands are completed
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
index 73969dbeb5c5f..b850cca9853c8 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
@@ -1315,6 +1315,7 @@ struct iwl_nvm_data *iwl_get_nvm(struct iwl_trans *trans,
 	bool lar_fw_supported = !iwlwifi_mod_params.lar_disable &&
 				fw_has_capa(&fw->ucode_capa,
 					    IWL_UCODE_TLV_CAPA_LAR_SUPPORT);
+	bool empty_otp;
 	u32 mac_flags;
 	u32 sbands_flags = 0;
 
@@ -1330,7 +1331,9 @@ struct iwl_nvm_data *iwl_get_nvm(struct iwl_trans *trans,
 	}
 
 	rsp = (void *)hcmd.resp_pkt->data;
-	if (le32_to_cpu(rsp->general.flags) & NVM_GENERAL_FLAGS_EMPTY_OTP)
+	empty_otp = !!(le32_to_cpu(rsp->general.flags) &
+		       NVM_GENERAL_FLAGS_EMPTY_OTP);
+	if (empty_otp)
 		IWL_INFO(trans, "OTP is empty\n");
 
 	nvm = kzalloc(sizeof(*nvm) +
@@ -1354,6 +1357,11 @@ struct iwl_nvm_data *iwl_get_nvm(struct iwl_trans *trans,
 
 	/* Initialize general data */
 	nvm->nvm_version = le16_to_cpu(rsp->general.nvm_version);
+	nvm->n_hw_addrs = rsp->general.n_hw_addrs;
+	if (nvm->n_hw_addrs == 0)
+		IWL_WARN(trans,
+			 "Firmware declares no reserved mac addresses. OTP is empty: %d\n",
+			 empty_otp);
 
 	/* Initialize MAC sku data */
 	mac_flags = le32_to_cpu(rsp->mac_sku.mac_sku_flags);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 048/639] staging: comedi: ni_mio_common: protect register write overflow
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (46 preceding siblings ...)
  2020-01-24  9:23 ` [PATCH 4.19 047/639] iwlwifi: nvm: get num of hw addresses from firmware Greg Kroah-Hartman
@ 2020-01-24  9:23 ` Greg Kroah-Hartman
  2020-01-24  9:23 ` [PATCH 4.19 049/639] netfilter: nft_osf: usage from output path is not valid Greg Kroah-Hartman
                   ` (594 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:23 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Spencer E. Olson, Ian Abbott, Sasha Levin

From: Spencer E. Olson <olsonse@umich.edu>

[ Upstream commit 1cbca5852d6c16e85a21487a15d211195aacd4a1 ]

Fixes two problems introduced as early as
commit 03aef4b6dc12  ("Staging: comedi: add ni_mio_common code"):
(1) Ensures that the last four bits of NISTC_RTSI_TRIGB_OUT_REG register is
    not unduly overwritten on e-series devices.  On e-series devices, the
    first three of the last four bits are reserved.  The last bit defines
    the output selection of the RGOUT0 pin, otherwise known as
    RTSI_Sub_Selection.  For m-series devices, these last four bits are
    indeed used as the output selection of the RTSI7 pin (and the
    RTSI_Sub_Selection bit for the RGOUT0 pin is moved to the
    RTSI_Trig_Direction register.
(2) Allows all 4 RTSI_BRD lines to be treated as valid sources for RTSI
    lines.

This patch also cleans up the ni_get_rtsi_routing command for readability.

Fixes: 03aef4b6dc12  ("Staging: comedi: add ni_mio_common code")
Signed-off-by: Spencer E. Olson <olsonse@umich.edu>
Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../staging/comedi/drivers/ni_mio_common.c    | 24 +++++++++++++------
 1 file changed, 17 insertions(+), 7 deletions(-)

diff --git a/drivers/staging/comedi/drivers/ni_mio_common.c b/drivers/staging/comedi/drivers/ni_mio_common.c
index d799b1b55de39..747518c295427 100644
--- a/drivers/staging/comedi/drivers/ni_mio_common.c
+++ b/drivers/staging/comedi/drivers/ni_mio_common.c
@@ -4984,7 +4984,10 @@ static int ni_valid_rtsi_output_source(struct comedi_device *dev,
 	case NI_RTSI_OUTPUT_G_SRC0:
 	case NI_RTSI_OUTPUT_G_GATE0:
 	case NI_RTSI_OUTPUT_RGOUT0:
-	case NI_RTSI_OUTPUT_RTSI_BRD_0:
+	case NI_RTSI_OUTPUT_RTSI_BRD(0):
+	case NI_RTSI_OUTPUT_RTSI_BRD(1):
+	case NI_RTSI_OUTPUT_RTSI_BRD(2):
+	case NI_RTSI_OUTPUT_RTSI_BRD(3):
 		return 1;
 	case NI_RTSI_OUTPUT_RTSI_OSC:
 		return (devpriv->is_m_series) ? 1 : 0;
@@ -5005,11 +5008,18 @@ static int ni_set_rtsi_routing(struct comedi_device *dev,
 		devpriv->rtsi_trig_a_output_reg |= NISTC_RTSI_TRIG(chan, src);
 		ni_stc_writew(dev, devpriv->rtsi_trig_a_output_reg,
 			      NISTC_RTSI_TRIGA_OUT_REG);
-	} else if (chan < 8) {
+	} else if (chan < NISTC_RTSI_TRIG_NUM_CHAN(devpriv->is_m_series)) {
 		devpriv->rtsi_trig_b_output_reg &= ~NISTC_RTSI_TRIG_MASK(chan);
 		devpriv->rtsi_trig_b_output_reg |= NISTC_RTSI_TRIG(chan, src);
 		ni_stc_writew(dev, devpriv->rtsi_trig_b_output_reg,
 			      NISTC_RTSI_TRIGB_OUT_REG);
+	} else if (chan != NISTC_RTSI_TRIG_OLD_CLK_CHAN) {
+		/* probably should never reach this, since the
+		 * ni_valid_rtsi_output_source above errors out if chan is too
+		 * high
+		 */
+		dev_err(dev->class_dev, "%s: unknown rtsi channel\n", __func__);
+		return -EINVAL;
 	}
 	return 2;
 }
@@ -5025,12 +5035,12 @@ static unsigned int ni_get_rtsi_routing(struct comedi_device *dev,
 	} else if (chan < NISTC_RTSI_TRIG_NUM_CHAN(devpriv->is_m_series)) {
 		return NISTC_RTSI_TRIG_TO_SRC(chan,
 					      devpriv->rtsi_trig_b_output_reg);
-	} else {
-		if (chan == NISTC_RTSI_TRIG_OLD_CLK_CHAN)
-			return NI_RTSI_OUTPUT_RTSI_OSC;
-		dev_err(dev->class_dev, "bug! should never get here?\n");
-		return 0;
+	} else if (chan == NISTC_RTSI_TRIG_OLD_CLK_CHAN) {
+		return NI_RTSI_OUTPUT_RTSI_OSC;
 	}
+
+	dev_err(dev->class_dev, "%s: unknown rtsi channel\n", __func__);
+	return -EINVAL;
 }
 
 static int ni_rtsi_insn_config(struct comedi_device *dev,
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 049/639] netfilter: nft_osf: usage from output path is not valid
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (47 preceding siblings ...)
  2020-01-24  9:23 ` [PATCH 4.19 048/639] staging: comedi: ni_mio_common: protect register write overflow Greg Kroah-Hartman
@ 2020-01-24  9:23 ` Greg Kroah-Hartman
  2020-01-24  9:23 ` [PATCH 4.19 050/639] pwm: lpss: Release runtime-pm reference from the drivers remove callback Greg Kroah-Hartman
                   ` (593 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:23 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Fernando Fernandez Mancera,
	Pablo Neira Ayuso, Sasha Levin

From: Fernando Fernandez Mancera <ffmancera@riseup.net>

[ Upstream commit 4a3e71b7b7dbaf3562be9d508260935aa13cb48b ]

The nft_osf extension, like xt_osf, is not supported from the output
path.

Fixes: b96af92d6eaf ("netfilter: nf_tables: implement Passive OS fingerprint module in nft_osf")
Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/netfilter/nft_osf.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/net/netfilter/nft_osf.c b/net/netfilter/nft_osf.c
index a35fb59ace732..df4e3e0412ed3 100644
--- a/net/netfilter/nft_osf.c
+++ b/net/netfilter/nft_osf.c
@@ -69,6 +69,15 @@ nla_put_failure:
 	return -1;
 }
 
+static int nft_osf_validate(const struct nft_ctx *ctx,
+			    const struct nft_expr *expr,
+			    const struct nft_data **data)
+{
+	return nft_chain_validate_hooks(ctx->chain, (1 << NF_INET_LOCAL_IN) |
+						    (1 << NF_INET_PRE_ROUTING) |
+						    (1 << NF_INET_FORWARD));
+}
+
 static struct nft_expr_type nft_osf_type;
 static const struct nft_expr_ops nft_osf_op = {
 	.eval		= nft_osf_eval,
@@ -76,6 +85,7 @@ static const struct nft_expr_ops nft_osf_op = {
 	.init		= nft_osf_init,
 	.dump		= nft_osf_dump,
 	.type		= &nft_osf_type,
+	.validate	= nft_osf_validate,
 };
 
 static struct nft_expr_type nft_osf_type __read_mostly = {
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 050/639] pwm: lpss: Release runtime-pm reference from the drivers remove callback
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (48 preceding siblings ...)
  2020-01-24  9:23 ` [PATCH 4.19 049/639] netfilter: nft_osf: usage from output path is not valid Greg Kroah-Hartman
@ 2020-01-24  9:23 ` Greg Kroah-Hartman
  2020-01-24  9:23 ` [PATCH 4.19 051/639] powerpc/pseries/memory-hotplug: Fix return value type of find_aa_index Greg Kroah-Hartman
                   ` (592 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:23 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Andy Shevchenko, Hans de Goede,
	Thierry Reding, Sasha Levin

From: Hans de Goede <hdegoede@redhat.com>

[ Upstream commit 42885551cedb45961879d2fc3dc3c4dc545cc23e ]

For each pwm output which gets enabled through pwm_lpss_apply(), we do a
pm_runtime_get_sync().

This commit adds pm_runtime_put() calls to pwm_lpss_remove() to balance
these when the driver gets removed with some of the outputs still enabled.

Fixes: f080be27d7d9 ("pwm: lpss: Add support for runtime PM")
Acked-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pwm/pwm-lpss.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/pwm/pwm-lpss.c b/drivers/pwm/pwm-lpss.c
index 1e69c1c9ec096..7a4a6406cf69a 100644
--- a/drivers/pwm/pwm-lpss.c
+++ b/drivers/pwm/pwm-lpss.c
@@ -216,6 +216,12 @@ EXPORT_SYMBOL_GPL(pwm_lpss_probe);
 
 int pwm_lpss_remove(struct pwm_lpss_chip *lpwm)
 {
+	int i;
+
+	for (i = 0; i < lpwm->info->npwm; i++) {
+		if (pwm_is_enabled(&lpwm->chip.pwms[i]))
+			pm_runtime_put(lpwm->chip.dev);
+	}
 	return pwmchip_remove(&lpwm->chip);
 }
 EXPORT_SYMBOL_GPL(pwm_lpss_remove);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 051/639] powerpc/pseries/memory-hotplug: Fix return value type of find_aa_index
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (49 preceding siblings ...)
  2020-01-24  9:23 ` [PATCH 4.19 050/639] pwm: lpss: Release runtime-pm reference from the drivers remove callback Greg Kroah-Hartman
@ 2020-01-24  9:23 ` Greg Kroah-Hartman
  2020-01-24  9:23 ` [PATCH 4.19 052/639] rtlwifi: rtl8821ae: replace _rtl8821ae_mrate_idx_to_arfr_id with generic version Greg Kroah-Hartman
                   ` (591 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:23 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, YueHaibing, Michael Ellerman, Sasha Levin

From: YueHaibing <yuehaibing@huawei.com>

[ Upstream commit b45e9d761ba2d60044b610297e3ef9f947ac157f ]

The variable 'aa_index' is defined as an unsigned value in
update_lmb_associativity_index(), but find_aa_index() may return -1
when dlpar_clone_property() fails. So change find_aa_index() to return
a bool, which indicates whether 'aa_index' was found or not.

Fixes: c05a5a40969e ("powerpc/pseries: Dynamic add entires to associativity lookup array")
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Reviewed-by: Nathan Fontenot nfont@linux.vnet.ibm.com>
[mpe: Tweak changelog, rename is_found to just found]
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../platforms/pseries/hotplug-memory.c        | 61 +++++++++----------
 1 file changed, 28 insertions(+), 33 deletions(-)

diff --git a/arch/powerpc/platforms/pseries/hotplug-memory.c b/arch/powerpc/platforms/pseries/hotplug-memory.c
index 7f86bc3eaadec..62d3c72cd9316 100644
--- a/arch/powerpc/platforms/pseries/hotplug-memory.c
+++ b/arch/powerpc/platforms/pseries/hotplug-memory.c
@@ -101,11 +101,12 @@ static struct property *dlpar_clone_property(struct property *prop,
 	return new_prop;
 }
 
-static u32 find_aa_index(struct device_node *dr_node,
-			 struct property *ala_prop, const u32 *lmb_assoc)
+static bool find_aa_index(struct device_node *dr_node,
+			 struct property *ala_prop,
+			 const u32 *lmb_assoc, u32 *aa_index)
 {
-	u32 *assoc_arrays;
-	u32 aa_index;
+	u32 *assoc_arrays, new_prop_size;
+	struct property *new_prop;
 	int aa_arrays, aa_array_entries, aa_array_sz;
 	int i, index;
 
@@ -121,46 +122,39 @@ static u32 find_aa_index(struct device_node *dr_node,
 	aa_array_entries = be32_to_cpu(assoc_arrays[1]);
 	aa_array_sz = aa_array_entries * sizeof(u32);
 
-	aa_index = -1;
 	for (i = 0; i < aa_arrays; i++) {
 		index = (i * aa_array_entries) + 2;
 
 		if (memcmp(&assoc_arrays[index], &lmb_assoc[1], aa_array_sz))
 			continue;
 
-		aa_index = i;
-		break;
+		*aa_index = i;
+		return true;
 	}
 
-	if (aa_index == -1) {
-		struct property *new_prop;
-		u32 new_prop_size;
-
-		new_prop_size = ala_prop->length + aa_array_sz;
-		new_prop = dlpar_clone_property(ala_prop, new_prop_size);
-		if (!new_prop)
-			return -1;
-
-		assoc_arrays = new_prop->value;
+	new_prop_size = ala_prop->length + aa_array_sz;
+	new_prop = dlpar_clone_property(ala_prop, new_prop_size);
+	if (!new_prop)
+		return false;
 
-		/* increment the number of entries in the lookup array */
-		assoc_arrays[0] = cpu_to_be32(aa_arrays + 1);
+	assoc_arrays = new_prop->value;
 
-		/* copy the new associativity into the lookup array */
-		index = aa_arrays * aa_array_entries + 2;
-		memcpy(&assoc_arrays[index], &lmb_assoc[1], aa_array_sz);
+	/* increment the number of entries in the lookup array */
+	assoc_arrays[0] = cpu_to_be32(aa_arrays + 1);
 
-		of_update_property(dr_node, new_prop);
+	/* copy the new associativity into the lookup array */
+	index = aa_arrays * aa_array_entries + 2;
+	memcpy(&assoc_arrays[index], &lmb_assoc[1], aa_array_sz);
 
-		/*
-		 * The associativity lookup array index for this lmb is
-		 * number of entries - 1 since we added its associativity
-		 * to the end of the lookup array.
-		 */
-		aa_index = be32_to_cpu(assoc_arrays[0]) - 1;
-	}
+	of_update_property(dr_node, new_prop);
 
-	return aa_index;
+	/*
+	 * The associativity lookup array index for this lmb is
+	 * number of entries - 1 since we added its associativity
+	 * to the end of the lookup array.
+	 */
+	*aa_index = be32_to_cpu(assoc_arrays[0]) - 1;
+	return true;
 }
 
 static int update_lmb_associativity_index(struct drmem_lmb *lmb)
@@ -169,6 +163,7 @@ static int update_lmb_associativity_index(struct drmem_lmb *lmb)
 	struct property *ala_prop;
 	const u32 *lmb_assoc;
 	u32 aa_index;
+	bool found;
 
 	parent = of_find_node_by_path("/");
 	if (!parent)
@@ -200,12 +195,12 @@ static int update_lmb_associativity_index(struct drmem_lmb *lmb)
 		return -ENODEV;
 	}
 
-	aa_index = find_aa_index(dr_node, ala_prop, lmb_assoc);
+	found = find_aa_index(dr_node, ala_prop, lmb_assoc, &aa_index);
 
 	of_node_put(dr_node);
 	dlpar_free_cc_nodes(lmb_node);
 
-	if (aa_index < 0) {
+	if (!found) {
 		pr_err("Could not find LMB associativity\n");
 		return -1;
 	}
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 052/639] rtlwifi: rtl8821ae: replace _rtl8821ae_mrate_idx_to_arfr_id with generic version
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (50 preceding siblings ...)
  2020-01-24  9:23 ` [PATCH 4.19 051/639] powerpc/pseries/memory-hotplug: Fix return value type of find_aa_index Greg Kroah-Hartman
@ 2020-01-24  9:23 ` Greg Kroah-Hartman
  2020-01-24  9:23 ` [PATCH 4.19 053/639] RDMA/bnxt_re: Add missing spin lock initialization Greg Kroah-Hartman
                   ` (590 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:23 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Colin Ian King, Larry Finger,
	Kalle Valo, Sasha Levin

From: Colin Ian King <colin.king@canonical.com>

[ Upstream commit c894696188d5c2af1e636e458190e80c53fb893d ]

Function _rtl8821ae_mrate_idx_to_arfr_id is functionally identical to
the generic version rtl_mrate_idx_to_arfr_id, so remove
_rtl8821ae_mrate_idx_to_arfr_id and use the generic one instead.

This also fixes a missing break statement found by CoverityScan in
_rtl8821ae_mrate_idx_to_arfr_id, namely: CID#1167237 ("Missing break
in switch")

Thanks to Joe Perches for spotting this when I submitted an earlier patch.

Fixes: 3c05bedb5fef ("Staging: rtl8812ae: Add Realtek 8821 PCI WIFI driver")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
ACKed-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../wireless/realtek/rtlwifi/rtl8821ae/hw.c   | 71 +------------------
 1 file changed, 1 insertion(+), 70 deletions(-)

diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c
index 317c1b3101dad..ba258318ee9f3 100644
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c
@@ -3404,75 +3404,6 @@ static void rtl8821ae_update_hal_rate_table(struct ieee80211_hw *hw,
 		 "%x\n", rtl_read_dword(rtlpriv, REG_ARFR0));
 }
 
-static u8 _rtl8821ae_mrate_idx_to_arfr_id(
-	struct ieee80211_hw *hw, u8 rate_index,
-	enum wireless_mode wirelessmode)
-{
-	struct rtl_priv *rtlpriv = rtl_priv(hw);
-	struct rtl_phy *rtlphy = &rtlpriv->phy;
-	u8 ret = 0;
-	switch (rate_index) {
-	case RATR_INX_WIRELESS_NGB:
-		if (rtlphy->rf_type == RF_1T1R)
-			ret = 1;
-		else
-			ret = 0;
-		; break;
-	case RATR_INX_WIRELESS_N:
-	case RATR_INX_WIRELESS_NG:
-		if (rtlphy->rf_type == RF_1T1R)
-			ret = 5;
-		else
-			ret = 4;
-		; break;
-	case RATR_INX_WIRELESS_NB:
-		if (rtlphy->rf_type == RF_1T1R)
-			ret = 3;
-		else
-			ret = 2;
-		; break;
-	case RATR_INX_WIRELESS_GB:
-		ret = 6;
-		break;
-	case RATR_INX_WIRELESS_G:
-		ret = 7;
-		break;
-	case RATR_INX_WIRELESS_B:
-		ret = 8;
-		break;
-	case RATR_INX_WIRELESS_MC:
-		if ((wirelessmode == WIRELESS_MODE_B)
-			|| (wirelessmode == WIRELESS_MODE_G)
-			|| (wirelessmode == WIRELESS_MODE_N_24G)
-			|| (wirelessmode == WIRELESS_MODE_AC_24G))
-			ret = 6;
-		else
-			ret = 7;
-	case RATR_INX_WIRELESS_AC_5N:
-		if (rtlphy->rf_type == RF_1T1R)
-			ret = 10;
-		else
-			ret = 9;
-		break;
-	case RATR_INX_WIRELESS_AC_24N:
-		if (rtlphy->current_chan_bw == HT_CHANNEL_WIDTH_80) {
-			if (rtlphy->rf_type == RF_1T1R)
-				ret = 10;
-			else
-				ret = 9;
-		} else {
-			if (rtlphy->rf_type == RF_1T1R)
-				ret = 11;
-			else
-				ret = 12;
-		}
-		break;
-	default:
-		ret = 0; break;
-	}
-	return ret;
-}
-
 static u32 _rtl8821ae_rate_to_bitmap_2ssvht(__le16 vht_rate)
 {
 	u8 i, j, tmp_rate;
@@ -3761,7 +3692,7 @@ static void rtl8821ae_update_hal_rate_mask(struct ieee80211_hw *hw,
 		break;
 	}
 
-	ratr_index = _rtl8821ae_mrate_idx_to_arfr_id(hw, ratr_index, wirelessmode);
+	ratr_index = rtl_mrate_idx_to_arfr_id(hw, ratr_index, wirelessmode);
 	sta_entry->ratr_index = ratr_index;
 	ratr_bitmap = _rtl8821ae_set_ra_vht_ratr_bitmap(hw, wirelessmode,
 							ratr_bitmap);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 053/639] RDMA/bnxt_re: Add missing spin lock initialization
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (51 preceding siblings ...)
  2020-01-24  9:23 ` [PATCH 4.19 052/639] rtlwifi: rtl8821ae: replace _rtl8821ae_mrate_idx_to_arfr_id with generic version Greg Kroah-Hartman
@ 2020-01-24  9:23 ` Greg Kroah-Hartman
  2020-01-24  9:23 ` [PATCH 4.19 054/639] netfilter: nf_flow_table: do not remove offload when other netnss interface is down Greg Kroah-Hartman
                   ` (589 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:23 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Selvin Xavier, Jason Gunthorpe, Sasha Levin

From: Selvin Xavier <selvin.xavier@broadcom.com>

[ Upstream commit 5a23e0b1dd51fe0efae666b03fdb15e1301f437a ]

Add the missing initalization of the cq_lock and qplib.flush_lock.

Fixes: 942c9b6ca8de ("RDMA/bnxt_re: Avoid Hard lockup during error CQE processing")
Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/hw/bnxt_re/ib_verbs.c | 1 +
 drivers/infiniband/hw/bnxt_re/qplib_fp.c | 1 +
 2 files changed, 2 insertions(+)

diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
index a69632f1fab0b..c9af2d139f5cb 100644
--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c
+++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
@@ -2664,6 +2664,7 @@ struct ib_cq *bnxt_re_create_cq(struct ib_device *ibdev,
 	nq->budget++;
 
 	atomic_inc(&rdev->cq_count);
+	spin_lock_init(&cq->cq_lock);
 
 	if (context) {
 		struct bnxt_re_cq_resp resp;
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.c b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
index c15335dc8f614..60f2fb7e7dbfe 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.c
+++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
@@ -1970,6 +1970,7 @@ int bnxt_qplib_create_cq(struct bnxt_qplib_res *res, struct bnxt_qplib_cq *cq)
 	INIT_LIST_HEAD(&cq->sqf_head);
 	INIT_LIST_HEAD(&cq->rqf_head);
 	spin_lock_init(&cq->compl_lock);
+	spin_lock_init(&cq->flush_lock);
 
 	bnxt_qplib_arm_cq_enable(cq);
 	return 0;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 054/639] netfilter: nf_flow_table: do not remove offload when other netnss interface is down
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (52 preceding siblings ...)
  2020-01-24  9:23 ` [PATCH 4.19 053/639] RDMA/bnxt_re: Add missing spin lock initialization Greg Kroah-Hartman
@ 2020-01-24  9:23 ` Greg Kroah-Hartman
  2020-01-24  9:23 ` [PATCH 4.19 055/639] powerpc/kgdb: add kgdb_arch_set/remove_breakpoint() Greg Kroah-Hartman
                   ` (588 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:23 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Taehee Yoo, Pablo Neira Ayuso, Sasha Levin

From: Taehee Yoo <ap420073@gmail.com>

[ Upstream commit a3fb3698cadf27dc142b24394c401625e14d80d0 ]

When interface is down, offload cleanup function(nf_flow_table_do_cleanup)
is called and that checks whether interface index of offload and
index of link down interface is same. but only interface index checking
is not enough because flowtable is not pernet list.
So that, if other netns's interface that has index is same with offload
is down, that offload will be removed.
This patch adds netns checking code to the offload cleanup routine.

Fixes: 59c466dd68e7 ("netfilter: nf_flow_table: add a new flow state for tearing down offloading")
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/netfilter/nf_flow_table_core.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/net/netfilter/nf_flow_table_core.c b/net/netfilter/nf_flow_table_core.c
index 70bd730ca0597..890799c16aa41 100644
--- a/net/netfilter/nf_flow_table_core.c
+++ b/net/netfilter/nf_flow_table_core.c
@@ -491,14 +491,17 @@ EXPORT_SYMBOL_GPL(nf_flow_table_init);
 static void nf_flow_table_do_cleanup(struct flow_offload *flow, void *data)
 {
 	struct net_device *dev = data;
+	struct flow_offload_entry *e;
+
+	e = container_of(flow, struct flow_offload_entry, flow);
 
 	if (!dev) {
 		flow_offload_teardown(flow);
 		return;
 	}
-
-	if (flow->tuplehash[0].tuple.iifidx == dev->ifindex ||
-	    flow->tuplehash[1].tuple.iifidx == dev->ifindex)
+	if (net_eq(nf_ct_net(e->ct), dev_net(dev)) &&
+	    (flow->tuplehash[0].tuple.iifidx == dev->ifindex ||
+	     flow->tuplehash[1].tuple.iifidx == dev->ifindex))
 		flow_offload_dead(flow);
 }
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 055/639] powerpc/kgdb: add kgdb_arch_set/remove_breakpoint()
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (53 preceding siblings ...)
  2020-01-24  9:23 ` [PATCH 4.19 054/639] netfilter: nf_flow_table: do not remove offload when other netnss interface is down Greg Kroah-Hartman
@ 2020-01-24  9:23 ` Greg Kroah-Hartman
  2020-01-24  9:23 ` [PATCH 4.19 056/639] tipc: eliminate message disordering during binding table update Greg Kroah-Hartman
                   ` (587 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:23 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christophe Leroy, Michael Ellerman,
	Sasha Levin

From: Christophe Leroy <christophe.leroy@c-s.fr>

[ Upstream commit fb978ca207743badfe7efd9eebe68bcbb4969f79 ]

Generic implementation fails to remove breakpoints after init
when CONFIG_STRICT_KERNEL_RWX is selected:

[   13.251285] KGDB: BP remove failed: c001c338
[   13.259587] kgdbts: ERROR PUT: end of test buffer on 'do_fork_test' line 8 expected OK got $E14#aa
[   13.268969] KGDB: re-enter exception: ALL breakpoints killed
[   13.275099] CPU: 0 PID: 1 Comm: init Not tainted 4.18.0-g82bbb913ffd8 #860
[   13.282836] Call Trace:
[   13.285313] [c60e1ba0] [c0080ef0] kgdb_handle_exception+0x6f4/0x720 (unreliable)
[   13.292618] [c60e1c30] [c000e97c] kgdb_handle_breakpoint+0x3c/0x98
[   13.298709] [c60e1c40] [c000af54] program_check_exception+0x104/0x700
[   13.305083] [c60e1c60] [c000e45c] ret_from_except_full+0x0/0x4
[   13.310845] [c60e1d20] [c02a22ac] run_simple_test+0x2b4/0x2d4
[   13.316532] [c60e1d30] [c0081698] put_packet+0xb8/0x158
[   13.321694] [c60e1d60] [c00820b4] gdb_serial_stub+0x230/0xc4c
[   13.327374] [c60e1dc0] [c0080af8] kgdb_handle_exception+0x2fc/0x720
[   13.333573] [c60e1e50] [c000e928] kgdb_singlestep+0xb4/0xcc
[   13.339068] [c60e1e70] [c000ae1c] single_step_exception+0x90/0xac
[   13.345100] [c60e1e80] [c000e45c] ret_from_except_full+0x0/0x4
[   13.350865] [c60e1f40] [c000e11c] ret_from_syscall+0x0/0x38
[   13.356346] Kernel panic - not syncing: Recursive entry to debugger

This patch creates powerpc specific version of
kgdb_arch_set_breakpoint() and kgdb_arch_remove_breakpoint()
using patch_instruction()

Fixes: 1e0fc9d1eb2b ("powerpc/Kconfig: Enable STRICT_KERNEL_RWX for some configs")
Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/include/asm/kgdb.h |  5 +++-
 arch/powerpc/kernel/kgdb.c      | 43 +++++++++++++++++++++++++++------
 2 files changed, 39 insertions(+), 9 deletions(-)

diff --git a/arch/powerpc/include/asm/kgdb.h b/arch/powerpc/include/asm/kgdb.h
index 9db24e77b9f4b..a9e098a3b881f 100644
--- a/arch/powerpc/include/asm/kgdb.h
+++ b/arch/powerpc/include/asm/kgdb.h
@@ -26,9 +26,12 @@
 #define BREAK_INSTR_SIZE	4
 #define BUFMAX			((NUMREGBYTES * 2) + 512)
 #define OUTBUFMAX		((NUMREGBYTES * 2) + 512)
+
+#define BREAK_INSTR		0x7d821008	/* twge r2, r2 */
+
 static inline void arch_kgdb_breakpoint(void)
 {
-	asm(".long 0x7d821008"); /* twge r2, r2 */
+	asm(stringify_in_c(.long BREAK_INSTR));
 }
 #define CACHE_FLUSH_IS_SAFE	1
 #define DBG_MAX_REG_NUM     70
diff --git a/arch/powerpc/kernel/kgdb.c b/arch/powerpc/kernel/kgdb.c
index 35e240a0a4087..59c578f865aa6 100644
--- a/arch/powerpc/kernel/kgdb.c
+++ b/arch/powerpc/kernel/kgdb.c
@@ -24,6 +24,7 @@
 #include <asm/processor.h>
 #include <asm/machdep.h>
 #include <asm/debug.h>
+#include <asm/code-patching.h>
 #include <linux/slab.h>
 
 /*
@@ -144,7 +145,7 @@ static int kgdb_handle_breakpoint(struct pt_regs *regs)
 	if (kgdb_handle_exception(1, SIGTRAP, 0, regs) != 0)
 		return 0;
 
-	if (*(u32 *) (regs->nip) == *(u32 *) (&arch_kgdb_ops.gdb_bpt_instr))
+	if (*(u32 *)regs->nip == BREAK_INSTR)
 		regs->nip += BREAK_INSTR_SIZE;
 
 	return 1;
@@ -441,16 +442,42 @@ int kgdb_arch_handle_exception(int vector, int signo, int err_code,
 	return -1;
 }
 
+int kgdb_arch_set_breakpoint(struct kgdb_bkpt *bpt)
+{
+	int err;
+	unsigned int instr;
+	unsigned int *addr = (unsigned int *)bpt->bpt_addr;
+
+	err = probe_kernel_address(addr, instr);
+	if (err)
+		return err;
+
+	err = patch_instruction(addr, BREAK_INSTR);
+	if (err)
+		return -EFAULT;
+
+	*(unsigned int *)bpt->saved_instr = instr;
+
+	return 0;
+}
+
+int kgdb_arch_remove_breakpoint(struct kgdb_bkpt *bpt)
+{
+	int err;
+	unsigned int instr = *(unsigned int *)bpt->saved_instr;
+	unsigned int *addr = (unsigned int *)bpt->bpt_addr;
+
+	err = patch_instruction(addr, instr);
+	if (err)
+		return -EFAULT;
+
+	return 0;
+}
+
 /*
  * Global data
  */
-struct kgdb_arch arch_kgdb_ops = {
-#ifdef __LITTLE_ENDIAN__
-	.gdb_bpt_instr = {0x08, 0x10, 0x82, 0x7d},
-#else
-	.gdb_bpt_instr = {0x7d, 0x82, 0x10, 0x08},
-#endif
-};
+struct kgdb_arch arch_kgdb_ops;
 
 static int kgdb_not_implemented(struct pt_regs *regs)
 {
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 056/639] tipc: eliminate message disordering during binding table update
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (54 preceding siblings ...)
  2020-01-24  9:23 ` [PATCH 4.19 055/639] powerpc/kgdb: add kgdb_arch_set/remove_breakpoint() Greg Kroah-Hartman
@ 2020-01-24  9:23 ` Greg Kroah-Hartman
  2020-01-24  9:23 ` [PATCH 4.19 057/639] net: socionext: Add dummy PHY register read in phy_write() Greg Kroah-Hartman
                   ` (586 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:23 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Tuong Lien Tong, Ying Xue, Jon Maloy,
	David S. Miller, Sasha Levin

From: Jon Maloy <jon.maloy@ericsson.com>

[ Upstream commit 988f3f1603d4650409db5334355cbf7b13ef50c3 ]

We have seen the following race scenario:
1) named_distribute() builds a "bulk" message, containing a PUBLISH
   item for a certain publication. This is based on the contents of
   the binding tables's 'cluster_scope' list.
2) tipc_named_withdraw() removes the same publication from the list,
   bulds a WITHDRAW message and distributes it to all cluster nodes.
3) tipc_named_node_up(), which was calling named_distribute(), sends
   out the bulk message built under 1)
4) The WITHDRAW message arrives at the just detected node, finds
   no corresponding publication, and is dropped.
5) The PUBLISH item arrives at the same node, is added to its binding
   table, and remains there forever.

This arrival disordering was earlier taken care of by the backlog queue,
originally added for a different purpose, which was removed in the
commit referred to below, but we now need a different solution.
In this commit, we replace the rcu lock protecting the 'cluster_scope'
list with a regular RW lock which comprises even the sending of the
bulk message. This both guarantees both the list integrity and the
message sending order. We will later add a commit which cleans up
this code further.

Note that this commit needs recently added commit d3092b2efca1 ("tipc:
fix unsafe rcu locking when accessing publication list") to apply
cleanly.

Fixes: 37922ea4a310 ("tipc: permit overlapping service ranges in name table")
Reported-by: Tuong Lien Tong <tuong.t.lien@dektech.com.au>
Acked-by: Ying Xue <ying.xue@windriver.com>
Signed-off-by: Jon Maloy <jon.maloy@ericsson.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/tipc/name_distr.c | 18 ++++++++++--------
 net/tipc/name_table.c |  1 +
 net/tipc/name_table.h |  1 +
 3 files changed, 12 insertions(+), 8 deletions(-)

diff --git a/net/tipc/name_distr.c b/net/tipc/name_distr.c
index e0a3dd424d8c2..836e629e8f4ab 100644
--- a/net/tipc/name_distr.c
+++ b/net/tipc/name_distr.c
@@ -94,8 +94,9 @@ struct sk_buff *tipc_named_publish(struct net *net, struct publication *publ)
 		list_add_tail_rcu(&publ->binding_node, &nt->node_scope);
 		return NULL;
 	}
-	list_add_tail_rcu(&publ->binding_node, &nt->cluster_scope);
-
+	write_lock_bh(&nt->cluster_scope_lock);
+	list_add_tail(&publ->binding_node, &nt->cluster_scope);
+	write_unlock_bh(&nt->cluster_scope_lock);
 	skb = named_prepare_buf(net, PUBLICATION, ITEM_SIZE, 0);
 	if (!skb) {
 		pr_warn("Publication distribution failure\n");
@@ -112,11 +113,13 @@ struct sk_buff *tipc_named_publish(struct net *net, struct publication *publ)
  */
 struct sk_buff *tipc_named_withdraw(struct net *net, struct publication *publ)
 {
+	struct name_table *nt = tipc_name_table(net);
 	struct sk_buff *buf;
 	struct distr_item *item;
 
-	list_del_rcu(&publ->binding_node);
-
+	write_lock_bh(&nt->cluster_scope_lock);
+	list_del(&publ->binding_node);
+	write_unlock_bh(&nt->cluster_scope_lock);
 	if (publ->scope == TIPC_NODE_SCOPE)
 		return NULL;
 
@@ -147,7 +150,7 @@ static void named_distribute(struct net *net, struct sk_buff_head *list,
 			ITEM_SIZE) * ITEM_SIZE;
 	u32 msg_rem = msg_dsz;
 
-	list_for_each_entry_rcu(publ, pls, binding_node) {
+	list_for_each_entry(publ, pls, binding_node) {
 		/* Prepare next buffer: */
 		if (!skb) {
 			skb = named_prepare_buf(net, PUBLICATION, msg_rem,
@@ -189,11 +192,10 @@ void tipc_named_node_up(struct net *net, u32 dnode)
 
 	__skb_queue_head_init(&head);
 
-	rcu_read_lock();
+	read_lock_bh(&nt->cluster_scope_lock);
 	named_distribute(net, &head, dnode, &nt->cluster_scope);
-	rcu_read_unlock();
-
 	tipc_node_xmit(net, &head, dnode, 0);
+	read_unlock_bh(&nt->cluster_scope_lock);
 }
 
 /**
diff --git a/net/tipc/name_table.c b/net/tipc/name_table.c
index d72985ca1d555..89993afe0fbd3 100644
--- a/net/tipc/name_table.c
+++ b/net/tipc/name_table.c
@@ -744,6 +744,7 @@ int tipc_nametbl_init(struct net *net)
 
 	INIT_LIST_HEAD(&nt->node_scope);
 	INIT_LIST_HEAD(&nt->cluster_scope);
+	rwlock_init(&nt->cluster_scope_lock);
 	tn->nametbl = nt;
 	spin_lock_init(&tn->nametbl_lock);
 	return 0;
diff --git a/net/tipc/name_table.h b/net/tipc/name_table.h
index 892bd750b85fa..f79066334cc8f 100644
--- a/net/tipc/name_table.h
+++ b/net/tipc/name_table.h
@@ -100,6 +100,7 @@ struct name_table {
 	struct hlist_head services[TIPC_NAMETBL_SIZE];
 	struct list_head node_scope;
 	struct list_head cluster_scope;
+	rwlock_t cluster_scope_lock;
 	u32 local_publ_count;
 };
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 057/639] net: socionext: Add dummy PHY register read in phy_write()
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (55 preceding siblings ...)
  2020-01-24  9:23 ` [PATCH 4.19 056/639] tipc: eliminate message disordering during binding table update Greg Kroah-Hartman
@ 2020-01-24  9:23 ` Greg Kroah-Hartman
  2020-01-24  9:23 ` [PATCH 4.19 058/639] drm/sun4i: hdmi: Fix double flag assignation Greg Kroah-Hartman
                   ` (585 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:23 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Masahisa Kojima, Yoshitoyo Osaki,
	David S. Miller, Sasha Levin

From: Masahisa Kojima <masahisa.kojima@linaro.org>

[ Upstream commit a3241a91de6429051a211b5ce04d6946157caec7 ]

There is a compatibility issue between RTL8211E implemented
in Developerbox and netsec ethernet controller IP.

Our MDIO controller stops MDC clock right after the write
access, but RTL8211E expects MDC clock must be kept toggling
for several clock cycle with MDIO high before entering
the IDLE state. Without keeping clock after write access,
write access is not correctly handled and register is not
updated.

To meet this requirement, netsec driver needs to issue dummy
read(e.g. read PHYID1(offset 0x2) register) right after write
access, to keep MDC clock.

We think this compatibility issue is a problem specific to
our MDIO controller and RTL8211E.

Fixes: 533dd11a12f6 ("net: socionext: Add Synquacer NetSec driver")
Signed-off-by: Masahisa Kojima <masahisa.kojima@linaro.org>
Signed-off-by: Yoshitoyo Osaki <osaki.yoshitoyo@socionext.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/socionext/netsec.c | 18 ++++++++++++++++--
 1 file changed, 16 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/socionext/netsec.c b/drivers/net/ethernet/socionext/netsec.c
index 28d582c18afb9..d9d0d03e4ce79 100644
--- a/drivers/net/ethernet/socionext/netsec.c
+++ b/drivers/net/ethernet/socionext/netsec.c
@@ -432,9 +432,12 @@ static int netsec_mac_update_to_phy_state(struct netsec_priv *priv)
 	return 0;
 }
 
+static int netsec_phy_read(struct mii_bus *bus, int phy_addr, int reg_addr);
+
 static int netsec_phy_write(struct mii_bus *bus,
 			    int phy_addr, int reg, u16 val)
 {
+	int status;
 	struct netsec_priv *priv = bus->priv;
 
 	if (netsec_mac_write(priv, GMAC_REG_GDR, val))
@@ -447,8 +450,19 @@ static int netsec_phy_write(struct mii_bus *bus,
 			      GMAC_REG_SHIFT_CR_GAR)))
 		return -ETIMEDOUT;
 
-	return netsec_mac_wait_while_busy(priv, GMAC_REG_GAR,
-					  NETSEC_GMAC_GAR_REG_GB);
+	status = netsec_mac_wait_while_busy(priv, GMAC_REG_GAR,
+					    NETSEC_GMAC_GAR_REG_GB);
+
+	/* Developerbox implements RTL8211E PHY and there is
+	 * a compatibility problem with F_GMAC4.
+	 * RTL8211E expects MDC clock must be kept toggling for several
+	 * clock cycle with MDIO high before entering the IDLE state.
+	 * To meet this requirement, netsec driver needs to issue dummy
+	 * read(e.g. read PHYID1(offset 0x2) register) right after write.
+	 */
+	netsec_phy_read(bus, phy_addr, MII_PHYSID1);
+
+	return status;
 }
 
 static int netsec_phy_read(struct mii_bus *bus, int phy_addr, int reg_addr)
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 058/639] drm/sun4i: hdmi: Fix double flag assignation
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (56 preceding siblings ...)
  2020-01-24  9:23 ` [PATCH 4.19 057/639] net: socionext: Add dummy PHY register read in phy_write() Greg Kroah-Hartman
@ 2020-01-24  9:23 ` Greg Kroah-Hartman
  2020-01-24  9:23 ` [PATCH 4.19 059/639] net: hns3: add error handler for hns3_nic_init_vector_data() Greg Kroah-Hartman
                   ` (584 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:23 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Maxime Ripard,
	Giulio Benetti, Sasha Levin

From: Maxime Ripard <maxime.ripard@bootlin.com>

[ Upstream commit 1e0ff648940e603cab6c52cf3723017d30d78f30 ]

The is_double flag is a boolean currently assigned to the value of the d
variable, that is either 1 or 2. It means that this is_double variable is
always set to true, even though the initial intent was to have it set to
true when d is 2.

Fix this.

Fixes: 9c5681011a0c ("drm/sun4i: Add HDMI support")
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
Reviewed-by: Giulio Benetti <giulio.benetti@micronovasrl.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20181021163446.29135-2-maxime.ripard@bootlin.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/sun4i/sun4i_hdmi_tmds_clk.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/sun4i/sun4i_hdmi_tmds_clk.c b/drivers/gpu/drm/sun4i/sun4i_hdmi_tmds_clk.c
index 3ecffa52c8146..a74adec6c5dcd 100644
--- a/drivers/gpu/drm/sun4i/sun4i_hdmi_tmds_clk.c
+++ b/drivers/gpu/drm/sun4i/sun4i_hdmi_tmds_clk.c
@@ -52,7 +52,7 @@ static unsigned long sun4i_tmds_calc_divider(unsigned long rate,
 			    (rate - tmp_rate) < (rate - best_rate)) {
 				best_rate = tmp_rate;
 				best_m = m;
-				is_double = d;
+				is_double = (d == 2) ? true : false;
 			}
 		}
 	}
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 059/639] net: hns3: add error handler for hns3_nic_init_vector_data()
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (57 preceding siblings ...)
  2020-01-24  9:23 ` [PATCH 4.19 058/639] drm/sun4i: hdmi: Fix double flag assignation Greg Kroah-Hartman
@ 2020-01-24  9:23 ` Greg Kroah-Hartman
  2020-01-24  9:23 ` [PATCH 4.19 060/639] mlxsw: reg: QEEC: Add minimum shaper fields Greg Kroah-Hartman
                   ` (583 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:23 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Huazhong Tan, David S. Miller, Sasha Levin

From: Huazhong Tan <tanhuazhong@huawei.com>

[ Upstream commit ece4bf46e98c9f3775a488f3932a531508d3b1a2 ]

When hns3_nic_init_vector_data() fails to map ring to vector,
it should cancel the netif_napi_add() that has been successfully
done and then exits.

Fixes: 76ad4f0ee747 ("net: hns3: Add support of HNS3 Ethernet Driver for hip08 SoC")
Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
index 1aaf6e2a3b39d..9df807ec8c840 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
@@ -2642,7 +2642,7 @@ static int hns3_nic_init_vector_data(struct hns3_nic_priv *priv)
 	struct hnae3_handle *h = priv->ae_handle;
 	struct hns3_enet_tqp_vector *tqp_vector;
 	int ret = 0;
-	u16 i;
+	int i;
 
 	for (i = 0; i < priv->vector_num; i++) {
 		tqp_vector = &priv->tqp_vector[i];
@@ -2687,13 +2687,19 @@ static int hns3_nic_init_vector_data(struct hns3_nic_priv *priv)
 		hns3_free_vector_ring_chain(tqp_vector, &vector_ring_chain);
 
 		if (ret)
-			return ret;
+			goto map_ring_fail;
 
 		netif_napi_add(priv->netdev, &tqp_vector->napi,
 			       hns3_nic_common_poll, NAPI_POLL_WEIGHT);
 	}
 
 	return 0;
+
+map_ring_fail:
+	while (i--)
+		netif_napi_del(&priv->tqp_vector[i].napi);
+
+	return ret;
 }
 
 static int hns3_nic_alloc_vector_data(struct hns3_nic_priv *priv)
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 060/639] mlxsw: reg: QEEC: Add minimum shaper fields
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (58 preceding siblings ...)
  2020-01-24  9:23 ` [PATCH 4.19 059/639] net: hns3: add error handler for hns3_nic_init_vector_data() Greg Kroah-Hartman
@ 2020-01-24  9:23 ` Greg Kroah-Hartman
  2020-01-24  9:23 ` [PATCH 4.19 061/639] mlxsw: spectrum: Set minimum shaper on MC TCs Greg Kroah-Hartman
                   ` (582 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:23 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Petr Machata, Ido Schimmel,
	David S. Miller, Sasha Levin

From: Petr Machata <petrm@mellanox.com>

[ Upstream commit 8b931821aa04823e2e5df0ae93937baabbd23286 ]

Add QEEC.mise (minimum shaper enable) and QEEC.min_shaper_rate to enable
configuration of minimum shaper.

Increase the QEEC length to 0x20 as well: that's the length that the
register has had for a long time now, but with the configurations that
mlxsw typically exercises, the firmware tolerated 0x1C-sized packets.
With mise=true however, FW rejects packets unless they have the full
required length.

Fixes: b9b7cee40579 ("mlxsw: reg: Add QoS ETS Element Configuration register")
Signed-off-by: Petr Machata <petrm@mellanox.com>
Signed-off-by: Ido Schimmel <idosch@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/mellanox/mlxsw/reg.h | 22 +++++++++++++++++++++-
 1 file changed, 21 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/mellanox/mlxsw/reg.h b/drivers/net/ethernet/mellanox/mlxsw/reg.h
index aee58b3892f20..c9895876a2317 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/reg.h
+++ b/drivers/net/ethernet/mellanox/mlxsw/reg.h
@@ -3215,7 +3215,7 @@ static inline void mlxsw_reg_qtct_pack(char *payload, u8 local_port,
  * Configures the ETS elements.
  */
 #define MLXSW_REG_QEEC_ID 0x400D
-#define MLXSW_REG_QEEC_LEN 0x1C
+#define MLXSW_REG_QEEC_LEN 0x20
 
 MLXSW_REG_DEFINE(qeec, MLXSW_REG_QEEC_ID, MLXSW_REG_QEEC_LEN);
 
@@ -3257,6 +3257,15 @@ MLXSW_ITEM32(reg, qeec, element_index, 0x04, 0, 8);
  */
 MLXSW_ITEM32(reg, qeec, next_element_index, 0x08, 0, 8);
 
+/* reg_qeec_mise
+ * Min shaper configuration enable. Enables configuration of the min
+ * shaper on this ETS element
+ * 0 - Disable
+ * 1 - Enable
+ * Access: RW
+ */
+MLXSW_ITEM32(reg, qeec, mise, 0x0C, 31, 1);
+
 enum {
 	MLXSW_REG_QEEC_BYTES_MODE,
 	MLXSW_REG_QEEC_PACKETS_MODE,
@@ -3273,6 +3282,17 @@ enum {
  */
 MLXSW_ITEM32(reg, qeec, pb, 0x0C, 28, 1);
 
+/* The smallest permitted min shaper rate. */
+#define MLXSW_REG_QEEC_MIS_MIN	200000		/* Kbps */
+
+/* reg_qeec_min_shaper_rate
+ * Min shaper information rate.
+ * For CPU port, can only be configured for port hierarchy.
+ * When in bytes mode, value is specified in units of 1000bps.
+ * Access: RW
+ */
+MLXSW_ITEM32(reg, qeec, min_shaper_rate, 0x0C, 0, 28);
+
 /* reg_qeec_mase
  * Max shaper configuration enable. Enables configuration of the max
  * shaper on this ETS element.
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 061/639] mlxsw: spectrum: Set minimum shaper on MC TCs
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (59 preceding siblings ...)
  2020-01-24  9:23 ` [PATCH 4.19 060/639] mlxsw: reg: QEEC: Add minimum shaper fields Greg Kroah-Hartman
@ 2020-01-24  9:23 ` Greg Kroah-Hartman
  2020-01-24  9:23 ` [PATCH 4.19 062/639] NTB: ntb_hw_idt: replace IS_ERR_OR_NULL with regular NULL checks Greg Kroah-Hartman
                   ` (581 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:23 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Petr Machata, Ido Schimmel,
	David S. Miller, Sasha Levin

From: Petr Machata <petrm@mellanox.com>

[ Upstream commit 0fe64023162aef123de2f1993ba13a35a786e1de ]

An MC-aware mode was introduced in commit 7b8195306694 ("mlxsw:
spectrum: Configure MC-aware mode on mlxsw ports"). In MC-aware mode,
BUM traffic gets a special treatment by being assigned to a separate set
of traffic classes 8..15. Pairs of TCs 0 and 8, 1 and 9, etc., are then
configured to strictly prioritize the lower-numbered ones. The intention
is to prevent BUM traffic from flooding the switch and push out all UC
traffic, which would otherwise happen, and instead give UC traffic
precedence.

However strictly prioritizing UC traffic has the effect that UC overload
pushes out all BUM traffic, such as legitimate ARP queries. These
packets are kept in queues for a while, but under sustained UC overload,
their lifetime eventually expires and these packets are dropped. That is
detrimental to network performance as well.

Therefore configure the MC TCs (8..15) with minimum shaper of 200Mbps (a
minimum permitted value) to allow a trickle of necessary control traffic
to get through.

Fixes: 7b8195306694 ("mlxsw: spectrum: Configure MC-aware mode on mlxsw ports")
Signed-off-by: Petr Machata <petrm@mellanox.com>
Signed-off-by: Ido Schimmel <idosch@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../net/ethernet/mellanox/mlxsw/spectrum.c    | 25 +++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
index 30ef318b3d68d..5df9b25cab27d 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
@@ -2753,6 +2753,21 @@ int mlxsw_sp_port_ets_maxrate_set(struct mlxsw_sp_port *mlxsw_sp_port,
 	return mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(qeec), qeec_pl);
 }
 
+static int mlxsw_sp_port_min_bw_set(struct mlxsw_sp_port *mlxsw_sp_port,
+				    enum mlxsw_reg_qeec_hr hr, u8 index,
+				    u8 next_index, u32 minrate)
+{
+	struct mlxsw_sp *mlxsw_sp = mlxsw_sp_port->mlxsw_sp;
+	char qeec_pl[MLXSW_REG_QEEC_LEN];
+
+	mlxsw_reg_qeec_pack(qeec_pl, mlxsw_sp_port->local_port, hr, index,
+			    next_index);
+	mlxsw_reg_qeec_mise_set(qeec_pl, true);
+	mlxsw_reg_qeec_min_shaper_rate_set(qeec_pl, minrate);
+
+	return mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(qeec), qeec_pl);
+}
+
 int mlxsw_sp_port_prio_tc_set(struct mlxsw_sp_port *mlxsw_sp_port,
 			      u8 switch_prio, u8 tclass)
 {
@@ -2830,6 +2845,16 @@ static int mlxsw_sp_port_ets_init(struct mlxsw_sp_port *mlxsw_sp_port)
 			return err;
 	}
 
+	/* Configure the min shaper for multicast TCs. */
+	for (i = 0; i < IEEE_8021QAZ_MAX_TCS; i++) {
+		err = mlxsw_sp_port_min_bw_set(mlxsw_sp_port,
+					       MLXSW_REG_QEEC_HIERARCY_TC,
+					       i + 8, i,
+					       MLXSW_REG_QEEC_MIS_MIN);
+		if (err)
+			return err;
+	}
+
 	/* Map all priorities to traffic class 0. */
 	for (i = 0; i < IEEE_8021QAZ_MAX_TCS; i++) {
 		err = mlxsw_sp_port_prio_tc_set(mlxsw_sp_port, i, 0);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 062/639] NTB: ntb_hw_idt: replace IS_ERR_OR_NULL with regular NULL checks
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (60 preceding siblings ...)
  2020-01-24  9:23 ` [PATCH 4.19 061/639] mlxsw: spectrum: Set minimum shaper on MC TCs Greg Kroah-Hartman
@ 2020-01-24  9:23 ` Greg Kroah-Hartman
  2020-01-24  9:23 ` [PATCH 4.19 063/639] ASoC: wm97xx: fix uninitialized regmap pointer problem Greg Kroah-Hartman
                   ` (580 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:23 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Gustavo A. R. Silva, Jon Mason, Sasha Levin

From: Gustavo A. R. Silva <gustavo@embeddedor.com>

[ Upstream commit 1b7619828d0c341612f58683e73f279c37e70bbc ]

Both devm_kcalloc() and devm_kzalloc() return NULL on error. They
never return error pointers.

The use of IS_ERR_OR_NULL is currently applied to the wrong
context.

Fix this by replacing IS_ERR_OR_NULL with regular NULL checks.

Fixes: bf2a952d31d2 ("NTB: Add IDT 89HPESxNTx PCIe-switches support")
Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
Signed-off-by: Jon Mason <jdmason@kudzu.us>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/ntb/hw/idt/ntb_hw_idt.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/ntb/hw/idt/ntb_hw_idt.c b/drivers/ntb/hw/idt/ntb_hw_idt.c
index dbe72f116017a..a67ef23e81bca 100644
--- a/drivers/ntb/hw/idt/ntb_hw_idt.c
+++ b/drivers/ntb/hw/idt/ntb_hw_idt.c
@@ -1105,9 +1105,9 @@ static struct idt_mw_cfg *idt_scan_mws(struct idt_ntb_dev *ndev, int port,
 	}
 
 	/* Allocate memory for memory window descriptors */
-	ret_mws = devm_kcalloc(&ndev->ntb.pdev->dev, *mw_cnt,
-				sizeof(*ret_mws), GFP_KERNEL);
-	if (IS_ERR_OR_NULL(ret_mws))
+	ret_mws = devm_kcalloc(&ndev->ntb.pdev->dev, *mw_cnt, sizeof(*ret_mws),
+			       GFP_KERNEL);
+	if (!ret_mws)
 		return ERR_PTR(-ENOMEM);
 
 	/* Copy the info of detected memory windows */
@@ -2390,7 +2390,7 @@ static struct idt_ntb_dev *idt_create_dev(struct pci_dev *pdev,
 
 	/* Allocate memory for the IDT PCIe-device descriptor */
 	ndev = devm_kzalloc(&pdev->dev, sizeof(*ndev), GFP_KERNEL);
-	if (IS_ERR_OR_NULL(ndev)) {
+	if (!ndev) {
 		dev_err(&pdev->dev, "Memory allocation failed for descriptor");
 		return ERR_PTR(-ENOMEM);
 	}
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 063/639] ASoC: wm97xx: fix uninitialized regmap pointer problem
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (61 preceding siblings ...)
  2020-01-24  9:23 ` [PATCH 4.19 062/639] NTB: ntb_hw_idt: replace IS_ERR_OR_NULL with regular NULL checks Greg Kroah-Hartman
@ 2020-01-24  9:23 ` Greg Kroah-Hartman
  2020-01-24  9:23 ` [PATCH 4.19 064/639] ARM: dts: bcm283x: Correct mailbox register sizes Greg Kroah-Hartman
                   ` (579 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:23 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Arnd Bergmann, Mark Brown, Sasha Levin

From: Arnd Bergmann <arnd@arndb.de>

[ Upstream commit 576ce4075bfa0f03e0e91a89eecc539b3b828b08 ]

gcc notices that without either the ac97 bus or the pdata, we never
initialize the regmap pointer, which leads to an uninitialized variable
access:

sound/soc/codecs/wm9712.c: In function 'wm9712_soc_probe':
sound/soc/codecs/wm9712.c:666:2: error: 'regmap' may be used uninitialized in this function [-Werror=maybe-uninitialized]

Since that configuration is invalid, it's better to return an error
here. I tried to avoid adding complexity to the conditions, and turned
the #ifdef into a regular if(IS_ENABLED()) check for readability.
This in turn requires moving some header file declarations out of
an #ifdef.

The same code is used in three drivers, all of which I'm changing
the same way.

Fixes: 2ed1a8e0ce8d ("ASoC: wm9712: add ac97 new bus support")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/sound/soc.h       |  2 +-
 sound/soc/codecs/wm9705.c | 10 ++++------
 sound/soc/codecs/wm9712.c | 10 ++++------
 sound/soc/codecs/wm9713.c | 10 ++++------
 4 files changed, 13 insertions(+), 19 deletions(-)

diff --git a/include/sound/soc.h b/include/sound/soc.h
index 41cec42fb456a..88aa48e5485f9 100644
--- a/include/sound/soc.h
+++ b/include/sound/soc.h
@@ -548,12 +548,12 @@ static inline void snd_soc_jack_free_gpios(struct snd_soc_jack *jack, int count,
 }
 #endif
 
-#ifdef CONFIG_SND_SOC_AC97_BUS
 struct snd_ac97 *snd_soc_alloc_ac97_component(struct snd_soc_component *component);
 struct snd_ac97 *snd_soc_new_ac97_component(struct snd_soc_component *component,
 	unsigned int id, unsigned int id_mask);
 void snd_soc_free_ac97_component(struct snd_ac97 *ac97);
 
+#ifdef CONFIG_SND_SOC_AC97_BUS
 int snd_soc_set_ac97_ops(struct snd_ac97_bus_ops *ops);
 int snd_soc_set_ac97_ops_of_reset(struct snd_ac97_bus_ops *ops,
 		struct platform_device *pdev);
diff --git a/sound/soc/codecs/wm9705.c b/sound/soc/codecs/wm9705.c
index ccdf088461b7f..54c306707c02c 100644
--- a/sound/soc/codecs/wm9705.c
+++ b/sound/soc/codecs/wm9705.c
@@ -325,8 +325,7 @@ static int wm9705_soc_probe(struct snd_soc_component *component)
 	if (wm9705->mfd_pdata) {
 		wm9705->ac97 = wm9705->mfd_pdata->ac97;
 		regmap = wm9705->mfd_pdata->regmap;
-	} else {
-#ifdef CONFIG_SND_SOC_AC97_BUS
+	} else if (IS_ENABLED(CONFIG_SND_SOC_AC97_BUS)) {
 		wm9705->ac97 = snd_soc_new_ac97_component(component, WM9705_VENDOR_ID,
 						      WM9705_VENDOR_ID_MASK);
 		if (IS_ERR(wm9705->ac97)) {
@@ -339,7 +338,8 @@ static int wm9705_soc_probe(struct snd_soc_component *component)
 			snd_soc_free_ac97_component(wm9705->ac97);
 			return PTR_ERR(regmap);
 		}
-#endif
+	} else {
+		return -ENXIO;
 	}
 
 	snd_soc_component_set_drvdata(component, wm9705->ac97);
@@ -350,14 +350,12 @@ static int wm9705_soc_probe(struct snd_soc_component *component)
 
 static void wm9705_soc_remove(struct snd_soc_component *component)
 {
-#ifdef CONFIG_SND_SOC_AC97_BUS
 	struct wm9705_priv *wm9705 = snd_soc_component_get_drvdata(component);
 
-	if (!wm9705->mfd_pdata) {
+	if (IS_ENABLED(CONFIG_SND_SOC_AC97_BUS) && !wm9705->mfd_pdata) {
 		snd_soc_component_exit_regmap(component);
 		snd_soc_free_ac97_component(wm9705->ac97);
 	}
-#endif
 }
 
 static const struct snd_soc_component_driver soc_component_dev_wm9705 = {
diff --git a/sound/soc/codecs/wm9712.c b/sound/soc/codecs/wm9712.c
index e873baa9e7780..01949eaba4fd4 100644
--- a/sound/soc/codecs/wm9712.c
+++ b/sound/soc/codecs/wm9712.c
@@ -642,8 +642,7 @@ static int wm9712_soc_probe(struct snd_soc_component *component)
 	if (wm9712->mfd_pdata) {
 		wm9712->ac97 = wm9712->mfd_pdata->ac97;
 		regmap = wm9712->mfd_pdata->regmap;
-	} else {
-#ifdef CONFIG_SND_SOC_AC97_BUS
+	} else if (IS_ENABLED(CONFIG_SND_SOC_AC97_BUS)) {
 		int ret;
 
 		wm9712->ac97 = snd_soc_new_ac97_component(component, WM9712_VENDOR_ID,
@@ -660,7 +659,8 @@ static int wm9712_soc_probe(struct snd_soc_component *component)
 			snd_soc_free_ac97_component(wm9712->ac97);
 			return PTR_ERR(regmap);
 		}
-#endif
+	} else {
+		return -ENXIO;
 	}
 
 	snd_soc_component_init_regmap(component, regmap);
@@ -673,14 +673,12 @@ static int wm9712_soc_probe(struct snd_soc_component *component)
 
 static void wm9712_soc_remove(struct snd_soc_component *component)
 {
-#ifdef CONFIG_SND_SOC_AC97_BUS
 	struct wm9712_priv *wm9712 = snd_soc_component_get_drvdata(component);
 
-	if (!wm9712->mfd_pdata) {
+	if (IS_ENABLED(CONFIG_SND_SOC_AC97_BUS) && !wm9712->mfd_pdata) {
 		snd_soc_component_exit_regmap(component);
 		snd_soc_free_ac97_component(wm9712->ac97);
 	}
-#endif
 }
 
 static const struct snd_soc_component_driver soc_component_dev_wm9712 = {
diff --git a/sound/soc/codecs/wm9713.c b/sound/soc/codecs/wm9713.c
index 643863bb32e0d..5a2fdf4f69bf3 100644
--- a/sound/soc/codecs/wm9713.c
+++ b/sound/soc/codecs/wm9713.c
@@ -1214,8 +1214,7 @@ static int wm9713_soc_probe(struct snd_soc_component *component)
 	if (wm9713->mfd_pdata) {
 		wm9713->ac97 = wm9713->mfd_pdata->ac97;
 		regmap = wm9713->mfd_pdata->regmap;
-	} else {
-#ifdef CONFIG_SND_SOC_AC97_BUS
+	} else if (IS_ENABLED(CONFIG_SND_SOC_AC97_BUS)) {
 		wm9713->ac97 = snd_soc_new_ac97_component(component, WM9713_VENDOR_ID,
 						      WM9713_VENDOR_ID_MASK);
 		if (IS_ERR(wm9713->ac97))
@@ -1225,7 +1224,8 @@ static int wm9713_soc_probe(struct snd_soc_component *component)
 			snd_soc_free_ac97_component(wm9713->ac97);
 			return PTR_ERR(regmap);
 		}
-#endif
+	} else {
+		return -ENXIO;
 	}
 
 	snd_soc_component_init_regmap(component, regmap);
@@ -1238,14 +1238,12 @@ static int wm9713_soc_probe(struct snd_soc_component *component)
 
 static void wm9713_soc_remove(struct snd_soc_component *component)
 {
-#ifdef CONFIG_SND_SOC_AC97_BUS
 	struct wm9713_priv *wm9713 = snd_soc_component_get_drvdata(component);
 
-	if (!wm9713->mfd_pdata) {
+	if (IS_ENABLED(CONFIG_SND_SOC_AC97_BUS) && !wm9713->mfd_pdata) {
 		snd_soc_component_exit_regmap(component);
 		snd_soc_free_ac97_component(wm9713->ac97);
 	}
-#endif
 }
 
 static const struct snd_soc_component_driver soc_component_dev_wm9713 = {
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 064/639] ARM: dts: bcm283x: Correct mailbox register sizes
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (62 preceding siblings ...)
  2020-01-24  9:23 ` [PATCH 4.19 063/639] ASoC: wm97xx: fix uninitialized regmap pointer problem Greg Kroah-Hartman
@ 2020-01-24  9:23 ` Greg Kroah-Hartman
  2020-01-24  9:23 ` [PATCH 4.19 065/639] pcrypt: use format specifier in kobject_add Greg Kroah-Hartman
                   ` (578 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:23 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Phil Elwell, Stefan Wahren, Sasha Levin

From: Phil Elwell <phil@raspberrypi.org>

[ Upstream commit 227fa865061470a568858baa404a508f6c030fe4 ]

The size field in a Device Tree "reg" property is encoded in bytes, not
words.

Fixes: 614fa22119d6 ("ARM: dts: bcm2835: Add VCHIQ node to the Raspberry Pi boards. (v3)")
Signed-off-by: Phil Elwell <phil@raspberrypi.org>
Acked-by: Stefan Wahren <stefan.wahren@i2se.com>
Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/bcm2835-rpi.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/bcm2835-rpi.dtsi b/arch/arm/boot/dts/bcm2835-rpi.dtsi
index cb2d6d78a7fbf..c481eab1bd7c0 100644
--- a/arch/arm/boot/dts/bcm2835-rpi.dtsi
+++ b/arch/arm/boot/dts/bcm2835-rpi.dtsi
@@ -32,7 +32,7 @@
 
 		mailbox@7e00b840 {
 			compatible = "brcm,bcm2835-vchiq";
-			reg = <0x7e00b840 0xf>;
+			reg = <0x7e00b840 0x3c>;
 			interrupts = <0 2>;
 		};
 	};
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 065/639] pcrypt: use format specifier in kobject_add
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (63 preceding siblings ...)
  2020-01-24  9:23 ` [PATCH 4.19 064/639] ARM: dts: bcm283x: Correct mailbox register sizes Greg Kroah-Hartman
@ 2020-01-24  9:23 ` Greg Kroah-Hartman
  2020-01-24  9:23 ` [PATCH 4.19 066/639] ASoC: sun8i-codec: add missing route for ADC Greg Kroah-Hartman
                   ` (577 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:23 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Colin Ian King, Herbert Xu, Sasha Levin

From: Colin Ian King <colin.king@canonical.com>

[ Upstream commit b1e3874c75ab15288f573b3532e507c37e8e7656 ]

Passing string 'name' as the format specifier is potentially hazardous
because name could (although very unlikely to) have a format specifier
embedded in it causing issues when parsing the non-existent arguments
to these.  Follow best practice by using the "%s" format string for
the string 'name'.

Cleans up clang warning:
crypto/pcrypt.c:397:40: warning: format string is not a string literal
(potentially insecure) [-Wformat-security]

Fixes: a3fb1e330dd2 ("pcrypt: Added sysfs interface to pcrypt")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 crypto/pcrypt.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/crypto/pcrypt.c b/crypto/pcrypt.c
index f8ec3d4ba4a80..a5718c0a3dc4e 100644
--- a/crypto/pcrypt.c
+++ b/crypto/pcrypt.c
@@ -394,7 +394,7 @@ static int pcrypt_sysfs_add(struct padata_instance *pinst, const char *name)
 	int ret;
 
 	pinst->kobj.kset = pcrypt_kset;
-	ret = kobject_add(&pinst->kobj, NULL, name);
+	ret = kobject_add(&pinst->kobj, NULL, "%s", name);
 	if (!ret)
 		kobject_uevent(&pinst->kobj, KOBJ_ADD);
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 066/639] ASoC: sun8i-codec: add missing route for ADC
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (64 preceding siblings ...)
  2020-01-24  9:23 ` [PATCH 4.19 065/639] pcrypt: use format specifier in kobject_add Greg Kroah-Hartman
@ 2020-01-24  9:23 ` Greg Kroah-Hartman
  2020-01-24  9:23 ` [PATCH 4.19 067/639] pinctrl: meson-gxl: remove invalid GPIOX tsin_a pins Greg Kroah-Hartman
                   ` (576 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:23 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Vasily Khoruzhick, Mark Brown, Sasha Levin

From: Vasily Khoruzhick <anarsoul@gmail.com>

[ Upstream commit 9ee325d029c4abb75716851ce38863845911d605 ]

sun8i-codec misses a route from ADC to AIF1 Slot 0 ADC. Add it
to the driver to avoid adding it to every dts.

Fixes: eda85d1fee05d ("ASoC: sun8i-codec: Add ADC support for a33")
Signed-off-by: Vasily Khoruzhick <anarsoul@gmail.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/sunxi/sun8i-codec.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/sound/soc/sunxi/sun8i-codec.c b/sound/soc/sunxi/sun8i-codec.c
index bf615fa16dc8a..a3db6a68dfe6d 100644
--- a/sound/soc/sunxi/sun8i-codec.c
+++ b/sound/soc/sunxi/sun8i-codec.c
@@ -465,7 +465,11 @@ static const struct snd_soc_dapm_route sun8i_codec_dapm_routes[] = {
 	{ "Right Digital DAC Mixer", "AIF1 Slot 0 Digital DAC Playback Switch",
 	  "AIF1 Slot 0 Right"},
 
-	/* ADC routes */
+	/* ADC Routes */
+	{ "AIF1 Slot 0 Right ADC", NULL, "ADC" },
+	{ "AIF1 Slot 0 Left ADC", NULL, "ADC" },
+
+	/* ADC Mixer Routes */
 	{ "Left Digital ADC Mixer", "AIF1 Data Digital ADC Capture Switch",
 	  "AIF1 Slot 0 Left ADC" },
 	{ "Right Digital ADC Mixer", "AIF1 Data Digital ADC Capture Switch",
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 067/639] pinctrl: meson-gxl: remove invalid GPIOX tsin_a pins
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (65 preceding siblings ...)
  2020-01-24  9:23 ` [PATCH 4.19 066/639] ASoC: sun8i-codec: add missing route for ADC Greg Kroah-Hartman
@ 2020-01-24  9:23 ` Greg Kroah-Hartman
  2020-01-24  9:23 ` [PATCH 4.19 068/639] bus: ti-sysc: Add mcasp optional clocks flag Greg Kroah-Hartman
                   ` (575 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:23 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Neil Armstrong, Linus Walleij, Sasha Levin

From: Neil Armstrong <narmstrong@baylibre.com>

[ Upstream commit d801064cb871806e6843738ecad38993646f53f7 ]

The GPIOX tsin_a pins wrongly uses the SDCard pinctrl bits, this
patch completely removes these pins entries until we find out what
are the correct bits and registers to be used instead.

Fixes: 5a6ae9b80139 ("pinctrl: meson-gxl: add tsin_a pins")
Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pinctrl/meson/pinctrl-meson-gxl.c | 12 ++----------
 1 file changed, 2 insertions(+), 10 deletions(-)

diff --git a/drivers/pinctrl/meson/pinctrl-meson-gxl.c b/drivers/pinctrl/meson/pinctrl-meson-gxl.c
index 158f618f16957..0c0a5018102b0 100644
--- a/drivers/pinctrl/meson/pinctrl-meson-gxl.c
+++ b/drivers/pinctrl/meson/pinctrl-meson-gxl.c
@@ -239,13 +239,9 @@ static const unsigned int eth_link_led_pins[]	= { GPIOZ_14 };
 static const unsigned int eth_act_led_pins[]	= { GPIOZ_15 };
 
 static const unsigned int tsin_a_d0_pins[]	= { GPIODV_0 };
-static const unsigned int tsin_a_d0_x_pins[]	= { GPIOX_10 };
 static const unsigned int tsin_a_clk_pins[]	= { GPIODV_8 };
-static const unsigned int tsin_a_clk_x_pins[]	= { GPIOX_11 };
 static const unsigned int tsin_a_sop_pins[]	= { GPIODV_9 };
-static const unsigned int tsin_a_sop_x_pins[]	= { GPIOX_8 };
 static const unsigned int tsin_a_d_valid_pins[] = { GPIODV_10 };
-static const unsigned int tsin_a_d_valid_x_pins[] = { GPIOX_9 };
 static const unsigned int tsin_a_fail_pins[]	= { GPIODV_11 };
 static const unsigned int tsin_a_dp_pins[] = {
 	GPIODV_1, GPIODV_2, GPIODV_3, GPIODV_4, GPIODV_5, GPIODV_6, GPIODV_7,
@@ -432,10 +428,6 @@ static struct meson_pmx_group meson_gxl_periphs_groups[] = {
 	GROUP(spi_miso,		5,	2),
 	GROUP(spi_ss0,		5,	1),
 	GROUP(spi_sclk,		5,	0),
-	GROUP(tsin_a_sop_x,	6,	3),
-	GROUP(tsin_a_d_valid_x,	6,	2),
-	GROUP(tsin_a_d0_x,	6,	1),
-	GROUP(tsin_a_clk_x,	6,	0),
 
 	/* Bank Z */
 	GROUP(eth_mdio,		4,	23),
@@ -698,8 +690,8 @@ static const char * const eth_led_groups[] = {
 };
 
 static const char * const tsin_a_groups[] = {
-	"tsin_a_clk", "tsin_a_clk_x", "tsin_a_sop", "tsin_a_sop_x",
-	"tsin_a_d_valid", "tsin_a_d_valid_x", "tsin_a_d0", "tsin_a_d0_x",
+	"tsin_a_clk", "tsin_a_sop",
+	"tsin_a_d_valid", "tsin_a_d0",
 	"tsin_a_dp", "tsin_a_fail",
 };
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 068/639] bus: ti-sysc: Add mcasp optional clocks flag
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (66 preceding siblings ...)
  2020-01-24  9:23 ` [PATCH 4.19 067/639] pinctrl: meson-gxl: remove invalid GPIOX tsin_a pins Greg Kroah-Hartman
@ 2020-01-24  9:23 ` Greg Kroah-Hartman
  2020-01-24  9:23 ` [PATCH 4.19 069/639] exportfs: fix passing zero to ERR_PTR() warning Greg Kroah-Hartman
                   ` (574 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:23 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Mark Rutland, Rob Herring,
	Tony Lindgren, Sasha Levin

From: Tony Lindgren <tony@atomide.com>

[ Upstream commit 2c63a833e4500b341a62bf97e67488909ae12086 ]

We have OPT_CLKS_NEEDED in legacy platform data, but it's missing
from the ti-sysc driver for device tree based configuration.

In order to pass OPT_CLKS_NEEDED quirk flag we need to update omap4 module
data and add a new compatible for dra7 as the module layout is different
from sysc_regbits_omap4_mcasp.

Fixes: 70a65240efb1 ("bus: ti-sysc: Add register bits for interconnect
target modules")
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Rob Herring <robh+dt@kernel.org>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 Documentation/devicetree/bindings/bus/ti-sysc.txt |  1 +
 drivers/bus/ti-sysc.c                             | 11 +++++++++++
 2 files changed, 12 insertions(+)

diff --git a/Documentation/devicetree/bindings/bus/ti-sysc.txt b/Documentation/devicetree/bindings/bus/ti-sysc.txt
index 91dc2333af012..85a23f551f024 100644
--- a/Documentation/devicetree/bindings/bus/ti-sysc.txt
+++ b/Documentation/devicetree/bindings/bus/ti-sysc.txt
@@ -35,6 +35,7 @@ Required standard properties:
 		"ti,sysc-omap3-sham"
 		"ti,sysc-omap-aes"
 		"ti,sysc-mcasp"
+		"ti,sysc-dra7-mcasp"
 		"ti,sysc-usb-host-fs"
 		"ti,sysc-dra7-mcan"
 
diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c
index b6f63e7620214..926c83398b27b 100644
--- a/drivers/bus/ti-sysc.c
+++ b/drivers/bus/ti-sysc.c
@@ -1593,6 +1593,16 @@ static const struct sysc_regbits sysc_regbits_omap4_mcasp = {
 static const struct sysc_capabilities sysc_omap4_mcasp = {
 	.type = TI_SYSC_OMAP4_MCASP,
 	.regbits = &sysc_regbits_omap4_mcasp,
+	.mod_quirks = SYSC_QUIRK_OPT_CLKS_NEEDED,
+};
+
+/*
+ * McASP found on dra7 and later
+ */
+static const struct sysc_capabilities sysc_dra7_mcasp = {
+	.type = TI_SYSC_OMAP4_SIMPLE,
+	.regbits = &sysc_regbits_omap4_simple,
+	.mod_quirks = SYSC_QUIRK_OPT_CLKS_NEEDED,
 };
 
 /*
@@ -1821,6 +1831,7 @@ static const struct of_device_id sysc_match[] = {
 	{ .compatible = "ti,sysc-omap3-sham", .data = &sysc_omap3_sham, },
 	{ .compatible = "ti,sysc-omap-aes", .data = &sysc_omap3_aes, },
 	{ .compatible = "ti,sysc-mcasp", .data = &sysc_omap4_mcasp, },
+	{ .compatible = "ti,sysc-dra7-mcasp", .data = &sysc_dra7_mcasp, },
 	{ .compatible = "ti,sysc-usb-host-fs",
 	  .data = &sysc_omap4_usb_host_fs, },
 	{ .compatible = "ti,sysc-dra7-mcan", .data = &sysc_dra7_mcan, },
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 069/639] exportfs: fix passing zero to ERR_PTR() warning
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (67 preceding siblings ...)
  2020-01-24  9:23 ` [PATCH 4.19 068/639] bus: ti-sysc: Add mcasp optional clocks flag Greg Kroah-Hartman
@ 2020-01-24  9:23 ` Greg Kroah-Hartman
  2020-01-24  9:24 ` [PATCH 4.19 070/639] drm: rcar-du: Fix the return value in case of error in rcar_du_crtc_set_crc_source() Greg Kroah-Hartman
                   ` (573 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:23 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, YueHaibing, Al Viro, Sasha Levin

From: YueHaibing <yuehaibing@huawei.com>

[ Upstream commit 909e22e05353a783c526829427e9a8de122fba9c ]

Fix a static code checker warning:
  fs/exportfs/expfs.c:171 reconnect_one() warn: passing zero to 'ERR_PTR'

The error path for lookup_one_len_unlocked failure
should set err to PTR_ERR.

Fixes: bbf7a8a3562f ("exportfs: move most of reconnect_path to helper function")
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/exportfs/expfs.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/exportfs/expfs.c b/fs/exportfs/expfs.c
index 808cae6d5f50f..ae3248326c449 100644
--- a/fs/exportfs/expfs.c
+++ b/fs/exportfs/expfs.c
@@ -147,6 +147,7 @@ static struct dentry *reconnect_one(struct vfsmount *mnt,
 	tmp = lookup_one_len_unlocked(nbuf, parent, strlen(nbuf));
 	if (IS_ERR(tmp)) {
 		dprintk("%s: lookup failed: %d\n", __func__, PTR_ERR(tmp));
+		err = PTR_ERR(tmp);
 		goto out_err;
 	}
 	if (tmp != dentry) {
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 070/639] drm: rcar-du: Fix the return value in case of error in rcar_du_crtc_set_crc_source()
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (68 preceding siblings ...)
  2020-01-24  9:23 ` [PATCH 4.19 069/639] exportfs: fix passing zero to ERR_PTR() warning Greg Kroah-Hartman
@ 2020-01-24  9:24 ` Greg Kroah-Hartman
  2020-01-24  9:24 ` [PATCH 4.19 071/639] drm: rcar-du: Fix vblank initialization Greg Kroah-Hartman
                   ` (572 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:24 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christophe JAILLET, Laurent Pinchart,
	Sasha Levin

From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>

[ Upstream commit 4d486f18d91b1876040bf87e9ad78981a08b15a6 ]

We return 0 unconditionally in 'rcar_du_crtc_set_crc_source()'.
However, 'ret' is set to some error codes if some function calls fail.

Return 'ret' instead to propagate the error code.

Fixes: 47a52d024e89 ("media: drm: rcar-du: Add support for CRC computation")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/rcar-du/rcar_du_crtc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/rcar-du/rcar_du_crtc.c b/drivers/gpu/drm/rcar-du/rcar_du_crtc.c
index 15dc9caa128ba..212e5e11e4b73 100644
--- a/drivers/gpu/drm/rcar-du/rcar_du_crtc.c
+++ b/drivers/gpu/drm/rcar-du/rcar_du_crtc.c
@@ -837,7 +837,7 @@ unlock:
 	drm_modeset_drop_locks(&ctx);
 	drm_modeset_acquire_fini(&ctx);
 
-	return 0;
+	return ret;
 }
 
 static const struct drm_crtc_funcs crtc_funcs_gen2 = {
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 071/639] drm: rcar-du: Fix vblank initialization
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (69 preceding siblings ...)
  2020-01-24  9:24 ` [PATCH 4.19 070/639] drm: rcar-du: Fix the return value in case of error in rcar_du_crtc_set_crc_source() Greg Kroah-Hartman
@ 2020-01-24  9:24 ` Greg Kroah-Hartman
  2020-01-24  9:24 ` [PATCH 4.19 072/639] net: always initialize pagedlen Greg Kroah-Hartman
                   ` (571 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:24 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Tomi Valkeinen, Laurent Pinchart,
	Kieran Bingham, Sasha Levin

From: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>

[ Upstream commit 3d61fe5f59dd3e6f96fc0772156d257cb04dc656 ]

The drm_vblank_init() takes the total number of CRTCs as an argument,
but the rcar-du driver passes a bitmask of the CRTC indices. Fix it.

Fixes: 4bf8e1962f91 ("drm: Renesas R-Car Display Unit DRM driver")
Reported-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Reviewed-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/rcar-du/rcar_du_kms.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/rcar-du/rcar_du_kms.c b/drivers/gpu/drm/rcar-du/rcar_du_kms.c
index 0386b454e2218..6a9578159c2b5 100644
--- a/drivers/gpu/drm/rcar-du/rcar_du_kms.c
+++ b/drivers/gpu/drm/rcar-du/rcar_du_kms.c
@@ -544,7 +544,7 @@ int rcar_du_modeset_init(struct rcar_du_device *rcdu)
 	 * Initialize vertical blanking interrupts handling. Start with vblank
 	 * disabled for all CRTCs.
 	 */
-	ret = drm_vblank_init(dev, (1 << rcdu->num_crtcs) - 1);
+	ret = drm_vblank_init(dev, rcdu->num_crtcs);
 	if (ret < 0)
 		return ret;
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 072/639] net: always initialize pagedlen
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (70 preceding siblings ...)
  2020-01-24  9:24 ` [PATCH 4.19 071/639] drm: rcar-du: Fix vblank initialization Greg Kroah-Hartman
@ 2020-01-24  9:24 ` Greg Kroah-Hartman
  2020-01-24  9:24 ` [PATCH 4.19 073/639] drm/dp_mst: Skip validating ports during destruction, just ref Greg Kroah-Hartman
                   ` (570 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:24 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Willem de Bruijn, David S. Miller,
	Sasha Levin

From: Willem de Bruijn <willemb@google.com>

[ Upstream commit aba36930a35e7f1fe1319b203f25c05d6c119936 ]

In ip packet generation, pagedlen is initialized for each skb at the
start of the loop in __ip(6)_append_data, before label alloc_new_skb.

Depending on compiler options, code can be generated that jumps to
this label, triggering use of an an uninitialized variable.

In practice, at -O2, the generated code moves the initialization below
the label. But the code should not rely on that for correctness.

Fixes: 15e36f5b8e98 ("udp: paged allocation with gso")
Signed-off-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ipv4/ip_output.c  | 3 ++-
 net/ipv6/ip6_output.c | 3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index d63091812342f..fbf30122e8bf2 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -940,7 +940,7 @@ static int __ip_append_data(struct sock *sk,
 			unsigned int fraglen;
 			unsigned int fraggap;
 			unsigned int alloclen;
-			unsigned int pagedlen = 0;
+			unsigned int pagedlen;
 			struct sk_buff *skb_prev;
 alloc_new_skb:
 			skb_prev = skb;
@@ -957,6 +957,7 @@ alloc_new_skb:
 			if (datalen > mtu - fragheaderlen)
 				datalen = maxfraglen - fragheaderlen;
 			fraglen = datalen + fragheaderlen;
+			pagedlen = 0;
 
 			if ((flags & MSG_MORE) &&
 			    !(rt->dst.dev->features&NETIF_F_SG))
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index eed9231c90ad5..9886a84c25117 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -1357,7 +1357,7 @@ emsgsize:
 			unsigned int fraglen;
 			unsigned int fraggap;
 			unsigned int alloclen;
-			unsigned int pagedlen = 0;
+			unsigned int pagedlen;
 alloc_new_skb:
 			/* There's no room in the current skb */
 			if (skb)
@@ -1381,6 +1381,7 @@ alloc_new_skb:
 			if (datalen > (cork->length <= mtu && !(cork->flags & IPCORK_ALLFRAG) ? mtu : maxfraglen) - fragheaderlen)
 				datalen = maxfraglen - fragheaderlen - rt->dst.trailer_len;
 			fraglen = datalen + fragheaderlen;
+			pagedlen = 0;
 
 			if ((flags & MSG_MORE) &&
 			    !(rt->dst.dev->features&NETIF_F_SG))
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 073/639] drm/dp_mst: Skip validating ports during destruction, just ref
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (71 preceding siblings ...)
  2020-01-24  9:24 ` [PATCH 4.19 072/639] net: always initialize pagedlen Greg Kroah-Hartman
@ 2020-01-24  9:24 ` Greg Kroah-Hartman
  2020-01-24  9:24 ` [PATCH 4.19 074/639] arm64: dts: meson-gx: Add hdmi_5v regulator as hdmi tx supply Greg Kroah-Hartman
                   ` (569 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:24 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lyude Paul, Jerry Zuo,
	Harry Wentland, Dave Airlie, Sean Paul, Sasha Levin

From: Lyude Paul <lyude@redhat.com>

[ Upstream commit c54c7374ff44de5e609506aca7c0deae4703b6d1 ]

Jerry Zuo pointed out a rather obscure hotplugging issue that it seems I
accidentally introduced into DRM two years ago.

Pretend we have a topology like this:

|- DP-1: mst_primary
   |- DP-4: active display
   |- DP-5: disconnected
   |- DP-6: active hub
      |- DP-7: active display
      |- DP-8: disconnected
      |- DP-9: disconnected

If we unplug DP-6, the topology starting at DP-7 will be destroyed but
it's payloads will live on in DP-1's VCPI allocations and thus require
removal. However, this removal currently fails because
drm_dp_update_payload_part1() will (rightly so) try to validate the port
before accessing it, fail then abort. If we keep going, eventually we
run the MST hub out of bandwidth and all new allocations will start to
fail (or in my case; all new displays just start flickering a ton).

We could just teach drm_dp_update_payload_part1() not to drop the port
ref in this case, but then we also need to teach
drm_dp_destroy_payload_step1() to do the same thing, then hope no one
ever adds anything to the that requires a validated port reference in
drm_dp_destroy_connector_work(). Kind of sketchy.

So let's go with a more clever solution: any port that
drm_dp_destroy_connector_work() interacts with is guaranteed to still
exist in memory until we say so. While said port might not be valid we
don't really care: that's the whole reason we're destroying it in the
first place! So, teach drm_dp_get_validated_port_ref() to use the all
mighty current_work() function to avoid attempting to validate ports
from the context of mgr->destroy_connector_work. I can't see any
situation where this wouldn't be safe, and this avoids having to play
whack-a-mole in the future of trying to work around port validation.

Signed-off-by: Lyude Paul <lyude@redhat.com>
Fixes: 263efde31f97 ("drm/dp/mst: Get validated port ref in drm_dp_update_payload_part1()")
Reported-by: Jerry Zuo <Jerry.Zuo@amd.com>
Cc: Jerry Zuo <Jerry.Zuo@amd.com>
Cc: Harry Wentland <Harry.Wentland@amd.com>
Cc: <stable@vger.kernel.org> # v4.6+
Reviewed-by: Dave Airlie <airlied@redhat.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20181113224613.28809-1-lyude@redhat.com
Signed-off-by: Sean Paul <seanpaul@chromium.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/drm_dp_mst_topology.c | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
index 4d77158453060..58fe3945494cf 100644
--- a/drivers/gpu/drm/drm_dp_mst_topology.c
+++ b/drivers/gpu/drm/drm_dp_mst_topology.c
@@ -1022,9 +1022,20 @@ static struct drm_dp_mst_port *drm_dp_mst_get_port_ref_locked(struct drm_dp_mst_
 static struct drm_dp_mst_port *drm_dp_get_validated_port_ref(struct drm_dp_mst_topology_mgr *mgr, struct drm_dp_mst_port *port)
 {
 	struct drm_dp_mst_port *rport = NULL;
+
 	mutex_lock(&mgr->lock);
-	if (mgr->mst_primary)
-		rport = drm_dp_mst_get_port_ref_locked(mgr->mst_primary, port);
+	/*
+	 * Port may or may not be 'valid' but we don't care about that when
+	 * destroying the port and we are guaranteed that the port pointer
+	 * will be valid until we've finished
+	 */
+	if (current_work() == &mgr->destroy_connector_work) {
+		kref_get(&port->kref);
+		rport = port;
+	} else if (mgr->mst_primary) {
+		rport = drm_dp_mst_get_port_ref_locked(mgr->mst_primary,
+						       port);
+	}
 	mutex_unlock(&mgr->lock);
 	return rport;
 }
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 074/639] arm64: dts: meson-gx: Add hdmi_5v regulator as hdmi tx supply
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (72 preceding siblings ...)
  2020-01-24  9:24 ` [PATCH 4.19 073/639] drm/dp_mst: Skip validating ports during destruction, just ref Greg Kroah-Hartman
@ 2020-01-24  9:24 ` Greg Kroah-Hartman
  2020-01-24  9:24 ` [PATCH 4.19 075/639] arm64: dts: renesas: r8a7795-es1: Add missing power domains to IPMMU nodes Greg Kroah-Hartman
                   ` (568 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:24 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Neil Armstrong, Kevin Hilman, Sasha Levin

From: Neil Armstrong <narmstrong@baylibre.com>

[ Upstream commit e1f2163deac059ad39f07aba9e314ebe605d5a7a ]

The hdmi_5v regulator must be enabled to provide power to the physical HDMI
PHY and enables the HDMI 5V presence loopback for the monitor.

Fixes: b409f625a6d5 ("ARM64: dts: meson-gx: Add HDMI_5V regulator on selected boards")
Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
Signed-off-by: Kevin Hilman <khilman@baylibre.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/amlogic/meson-gx-p23x-q20x.dtsi          | 1 +
 arch/arm64/boot/dts/amlogic/meson-gxl-s905x-khadas-vim.dts   | 1 +
 arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts | 1 +
 arch/arm64/boot/dts/amlogic/meson-gxl-s905x-p212.dts         | 1 +
 arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts        | 1 +
 5 files changed, 5 insertions(+)

diff --git a/arch/arm64/boot/dts/amlogic/meson-gx-p23x-q20x.dtsi b/arch/arm64/boot/dts/amlogic/meson-gx-p23x-q20x.dtsi
index 765247bc4f247..e14e0ce7e89fe 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gx-p23x-q20x.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-gx-p23x-q20x.dtsi
@@ -125,6 +125,7 @@
 	status = "okay";
 	pinctrl-0 = <&hdmi_hpd_pins>, <&hdmi_i2c_pins>;
 	pinctrl-names = "default";
+	hdmi-supply = <&hdmi_5v>;
 };
 
 &hdmi_tx_tmds_port {
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-khadas-vim.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-khadas-vim.dts
index 9d858eb193ca6..062e12aa46770 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-khadas-vim.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-khadas-vim.dts
@@ -76,6 +76,7 @@
 	status = "okay";
 	pinctrl-0 = <&hdmi_hpd_pins>, <&hdmi_i2c_pins>;
 	pinctrl-names = "default";
+	hdmi-supply = <&hdmi_5v>;
 };
 
 &hdmi_tx_tmds_port {
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts
index b4dfb9afdef86..db293440e4cae 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts
@@ -155,6 +155,7 @@
 	status = "okay";
 	pinctrl-0 = <&hdmi_hpd_pins>, <&hdmi_i2c_pins>;
 	pinctrl-names = "default";
+	hdmi-supply = <&hdmi_5v>;
 };
 
 &hdmi_tx_tmds_port {
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-p212.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-p212.dts
index 5896e8a5d86bc..2602940c2077b 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-p212.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-p212.dts
@@ -51,6 +51,7 @@
 	status = "okay";
 	pinctrl-0 = <&hdmi_hpd_pins>, <&hdmi_i2c_pins>;
 	pinctrl-names = "default";
+	hdmi-supply = <&hdmi_5v>;
 };
 
 &hdmi_tx_tmds_port {
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts b/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts
index 313f88f8759e1..782e9edac8051 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts
@@ -271,6 +271,7 @@
 	status = "okay";
 	pinctrl-0 = <&hdmi_hpd_pins>, <&hdmi_i2c_pins>;
 	pinctrl-names = "default";
+	hdmi-supply = <&hdmi_5v>;
 };
 
 &hdmi_tx_tmds_port {
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 075/639] arm64: dts: renesas: r8a7795-es1: Add missing power domains to IPMMU nodes
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (73 preceding siblings ...)
  2020-01-24  9:24 ` [PATCH 4.19 074/639] arm64: dts: meson-gx: Add hdmi_5v regulator as hdmi tx supply Greg Kroah-Hartman
@ 2020-01-24  9:24 ` Greg Kroah-Hartman
  2020-01-24  9:24 ` [PATCH 4.19 076/639] net: phy: Fix not to call phy_resume() if PHY is not attached Greg Kroah-Hartman
                   ` (567 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:24 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Geert Uytterhoeven, Simon Horman,
	Sasha Levin

From: Geert Uytterhoeven <geert+renesas@glider.be>

[ Upstream commit 41e30b515a003a90e336b7a456c7c82d8c3aa6a7 ]

While commit 3b7e7848f0e88b36 ("arm64: dts: renesas: r8a7795: Add IPMMU
device nodes") for R-Car H3 ES2.0 did include power-domains properties,
they were forgotten in the counterpart for older R-Car H3 ES1.x SoCs.

Fixes: e4b9a493df45075b ("arm64: dts: renesas: r8a7795-es1: Add IPMMU device nodes")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/renesas/r8a7795-es1.dtsi | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/arm64/boot/dts/renesas/r8a7795-es1.dtsi b/arch/arm64/boot/dts/renesas/r8a7795-es1.dtsi
index 7b2fbaec9aef8..3dc61b7e1d08a 100644
--- a/arch/arm64/boot/dts/renesas/r8a7795-es1.dtsi
+++ b/arch/arm64/boot/dts/renesas/r8a7795-es1.dtsi
@@ -28,6 +28,7 @@
 		compatible = "renesas,ipmmu-r8a7795";
 		reg = <0 0xec680000 0 0x1000>;
 		renesas,ipmmu-main = <&ipmmu_mm 5>;
+		power-domains = <&sysc R8A7795_PD_ALWAYS_ON>;
 		#iommu-cells = <1>;
 	};
 
@@ -35,6 +36,7 @@
 		compatible = "renesas,ipmmu-r8a7795";
 		reg = <0 0xe7730000 0 0x1000>;
 		renesas,ipmmu-main = <&ipmmu_mm 8>;
+		power-domains = <&sysc R8A7795_PD_ALWAYS_ON>;
 		#iommu-cells = <1>;
 	};
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 076/639] net: phy: Fix not to call phy_resume() if PHY is not attached
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (74 preceding siblings ...)
  2020-01-24  9:24 ` [PATCH 4.19 075/639] arm64: dts: renesas: r8a7795-es1: Add missing power domains to IPMMU nodes Greg Kroah-Hartman
@ 2020-01-24  9:24 ` Greg Kroah-Hartman
  2020-01-24  9:24 ` [PATCH 4.19 077/639] IB/hfi1: Correctly process FECN and BECN in packets Greg Kroah-Hartman
                   ` (566 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:24 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yoshihiro Shimoda, David S. Miller,
	Sasha Levin

From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>

[ Upstream commit ef1b5bf506b1f0ee3edc98533e1f3ecb105eb46a ]

This patch fixes an issue that mdio_bus_phy_resume() doesn't call
phy_resume() if the PHY is not attached.

Fixes: 803dd9c77ac3 ("net: phy: avoid suspending twice a PHY")
Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/phy/phy_device.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index 43c4f358eeb8a..9c7e51443f6b6 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -76,7 +76,7 @@ static LIST_HEAD(phy_fixup_list);
 static DEFINE_MUTEX(phy_fixup_lock);
 
 #ifdef CONFIG_PM
-static bool mdio_bus_phy_may_suspend(struct phy_device *phydev)
+static bool mdio_bus_phy_may_suspend(struct phy_device *phydev, bool suspend)
 {
 	struct device_driver *drv = phydev->mdio.dev.driver;
 	struct phy_driver *phydrv = to_phy_driver(drv);
@@ -88,10 +88,11 @@ static bool mdio_bus_phy_may_suspend(struct phy_device *phydev)
 	/* PHY not attached? May suspend if the PHY has not already been
 	 * suspended as part of a prior call to phy_disconnect() ->
 	 * phy_detach() -> phy_suspend() because the parent netdev might be the
-	 * MDIO bus driver and clock gated at this point.
+	 * MDIO bus driver and clock gated at this point. Also may resume if
+	 * PHY is not attached.
 	 */
 	if (!netdev)
-		return !phydev->suspended;
+		return suspend ? !phydev->suspended : phydev->suspended;
 
 	if (netdev->wol_enabled)
 		return false;
@@ -126,7 +127,7 @@ static int mdio_bus_phy_suspend(struct device *dev)
 	if (phydev->attached_dev && phydev->adjust_link)
 		phy_stop_machine(phydev);
 
-	if (!mdio_bus_phy_may_suspend(phydev))
+	if (!mdio_bus_phy_may_suspend(phydev, true))
 		return 0;
 
 	return phy_suspend(phydev);
@@ -137,7 +138,7 @@ static int mdio_bus_phy_resume(struct device *dev)
 	struct phy_device *phydev = to_phy_device(dev);
 	int ret;
 
-	if (!mdio_bus_phy_may_suspend(phydev))
+	if (!mdio_bus_phy_may_suspend(phydev, false))
 		goto no_resume;
 
 	ret = phy_resume(phydev);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 077/639] IB/hfi1: Correctly process FECN and BECN in packets
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (75 preceding siblings ...)
  2020-01-24  9:24 ` [PATCH 4.19 076/639] net: phy: Fix not to call phy_resume() if PHY is not attached Greg Kroah-Hartman
@ 2020-01-24  9:24 ` Greg Kroah-Hartman
  2020-01-24  9:24 ` [PATCH 4.19 078/639] OPP: Fix missing debugfs supply directory for OPPs Greg Kroah-Hartman
                   ` (565 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:24 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Kaike Wan, Mike Marciniszyn,
	Dennis Dalessandro, Mitko Haralanov, Jason Gunthorpe,
	Sasha Levin

From: Mitko Haralanov <mitko.haralanov@intel.com>

[ Upstream commit fe4dd4239277486ca3a468e7bbeafd7ef3a5634e ]

A CA is supposed to ignore FECN bits in multicast, ACK, and CNP
packets. This patch corrects the behavior of the HFI1 driver in this
regard by ignoring FECNs in those packet types.

While fixing the above behavior, fix the extraction of the FECN and BECN
bits from the packet headers for both 9B and 16B packets.

Furthermore, this patch corrects the driver's response to a FECN in RDMA
READ RESPONSE packets. Instead of sending an "empty" ACK, the driver now
sends a CNP packet. While editing that code path, add the missing trace
for CNP packets.

Fixes: 88733e3b8450 ("IB/hfi1: Add 16B UD support")
Fixes: f59fb9e05109 ("IB/hfi1: Fix handling of FECN marked multicast packet")
Reviewed-by: Kaike Wan <kaike.wan@intel.com>
Reviewed-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
Reviewed-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
Signed-off-by: Mitko Haralanov <mitko.haralanov@intel.com>
Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/hw/hfi1/driver.c | 70 ++++++++++++++++++++---------
 drivers/infiniband/hw/hfi1/hfi.h    | 35 ++++++++++-----
 drivers/infiniband/hw/hfi1/rc.c     | 30 +++++--------
 drivers/infiniband/hw/hfi1/uc.c     |  2 +-
 drivers/infiniband/hw/hfi1/ud.c     | 33 ++++++++------
 5 files changed, 104 insertions(+), 66 deletions(-)

diff --git a/drivers/infiniband/hw/hfi1/driver.c b/drivers/infiniband/hw/hfi1/driver.c
index a41f85558312e..d5277c23cba60 100644
--- a/drivers/infiniband/hw/hfi1/driver.c
+++ b/drivers/infiniband/hw/hfi1/driver.c
@@ -430,40 +430,60 @@ static const hfi1_handle_cnp hfi1_handle_cnp_tbl[2] = {
 	[HFI1_PKT_TYPE_16B] = &return_cnp_16B
 };
 
-void hfi1_process_ecn_slowpath(struct rvt_qp *qp, struct hfi1_packet *pkt,
-			       bool do_cnp)
+/**
+ * hfi1_process_ecn_slowpath - Process FECN or BECN bits
+ * @qp: The packet's destination QP
+ * @pkt: The packet itself.
+ * @prescan: Is the caller the RXQ prescan
+ *
+ * Process the packet's FECN or BECN bits. By now, the packet
+ * has already been evaluated whether processing of those bit should
+ * be done.
+ * The significance of the @prescan argument is that if the caller
+ * is the RXQ prescan, a CNP will be send out instead of waiting for the
+ * normal packet processing to send an ACK with BECN set (or a CNP).
+ */
+bool hfi1_process_ecn_slowpath(struct rvt_qp *qp, struct hfi1_packet *pkt,
+			       bool prescan)
 {
 	struct hfi1_ibport *ibp = to_iport(qp->ibqp.device, qp->port_num);
 	struct hfi1_pportdata *ppd = ppd_from_ibp(ibp);
 	struct ib_other_headers *ohdr = pkt->ohdr;
 	struct ib_grh *grh = pkt->grh;
-	u32 rqpn = 0, bth1;
+	u32 rqpn = 0;
 	u16 pkey;
 	u32 rlid, slid, dlid = 0;
-	u8 hdr_type, sc, svc_type;
-	bool is_mcast = false;
+	u8 hdr_type, sc, svc_type, opcode;
+	bool is_mcast = false, ignore_fecn = false, do_cnp = false,
+		fecn, becn;
 
 	/* can be called from prescan */
 	if (pkt->etype == RHF_RCV_TYPE_BYPASS) {
-		is_mcast = hfi1_is_16B_mcast(dlid);
 		pkey = hfi1_16B_get_pkey(pkt->hdr);
 		sc = hfi1_16B_get_sc(pkt->hdr);
 		dlid = hfi1_16B_get_dlid(pkt->hdr);
 		slid = hfi1_16B_get_slid(pkt->hdr);
+		is_mcast = hfi1_is_16B_mcast(dlid);
+		opcode = ib_bth_get_opcode(ohdr);
 		hdr_type = HFI1_PKT_TYPE_16B;
+		fecn = hfi1_16B_get_fecn(pkt->hdr);
+		becn = hfi1_16B_get_becn(pkt->hdr);
 	} else {
-		is_mcast = (dlid > be16_to_cpu(IB_MULTICAST_LID_BASE)) &&
-			   (dlid != be16_to_cpu(IB_LID_PERMISSIVE));
 		pkey = ib_bth_get_pkey(ohdr);
 		sc = hfi1_9B_get_sc5(pkt->hdr, pkt->rhf);
-		dlid = ib_get_dlid(pkt->hdr);
+		dlid = qp->ibqp.qp_type != IB_QPT_UD ? ib_get_dlid(pkt->hdr) :
+			ppd->lid;
 		slid = ib_get_slid(pkt->hdr);
+		is_mcast = (dlid > be16_to_cpu(IB_MULTICAST_LID_BASE)) &&
+			   (dlid != be16_to_cpu(IB_LID_PERMISSIVE));
+		opcode = ib_bth_get_opcode(ohdr);
 		hdr_type = HFI1_PKT_TYPE_9B;
+		fecn = ib_bth_get_fecn(ohdr);
+		becn = ib_bth_get_becn(ohdr);
 	}
 
 	switch (qp->ibqp.qp_type) {
 	case IB_QPT_UD:
-		dlid = ppd->lid;
 		rlid = slid;
 		rqpn = ib_get_sqpn(pkt->ohdr);
 		svc_type = IB_CC_SVCTYPE_UD;
@@ -485,22 +505,31 @@ void hfi1_process_ecn_slowpath(struct rvt_qp *qp, struct hfi1_packet *pkt,
 		svc_type = IB_CC_SVCTYPE_RC;
 		break;
 	default:
-		return;
+		return false;
 	}
 
-	bth1 = be32_to_cpu(ohdr->bth[1]);
+	ignore_fecn = is_mcast || (opcode == IB_OPCODE_CNP) ||
+		(opcode == IB_OPCODE_RC_ACKNOWLEDGE);
+	/*
+	 * ACKNOWLEDGE packets do not get a CNP but this will be
+	 * guarded by ignore_fecn above.
+	 */
+	do_cnp = prescan ||
+		(opcode >= IB_OPCODE_RC_RDMA_READ_RESPONSE_FIRST &&
+		 opcode <= IB_OPCODE_RC_ATOMIC_ACKNOWLEDGE);
+
 	/* Call appropriate CNP handler */
-	if (do_cnp && (bth1 & IB_FECN_SMASK))
+	if (!ignore_fecn && do_cnp && fecn)
 		hfi1_handle_cnp_tbl[hdr_type](ibp, qp, rqpn, pkey,
 					      dlid, rlid, sc, grh);
 
-	if (!is_mcast && (bth1 & IB_BECN_SMASK)) {
-		u32 lqpn = bth1 & RVT_QPN_MASK;
+	if (becn) {
+		u32 lqpn = be32_to_cpu(ohdr->bth[1]) & RVT_QPN_MASK;
 		u8 sl = ibp->sc_to_sl[sc];
 
 		process_becn(ppd, sl, rlid, lqpn, rqpn, svc_type);
 	}
-
+	return !ignore_fecn && fecn;
 }
 
 struct ps_mdata {
@@ -599,7 +628,6 @@ static void __prescan_rxq(struct hfi1_packet *packet)
 		struct rvt_dev_info *rdi = &rcd->dd->verbs_dev.rdi;
 		u64 rhf = rhf_to_cpu(rhf_addr);
 		u32 etype = rhf_rcv_type(rhf), qpn, bth1;
-		int is_ecn = 0;
 		u8 lnh;
 
 		if (ps_done(&mdata, rhf, rcd))
@@ -625,12 +653,10 @@ static void __prescan_rxq(struct hfi1_packet *packet)
 			goto next; /* just in case */
 		}
 
-		bth1 = be32_to_cpu(packet->ohdr->bth[1]);
-		is_ecn = !!(bth1 & (IB_FECN_SMASK | IB_BECN_SMASK));
-
-		if (!is_ecn)
+		if (!hfi1_may_ecn(packet))
 			goto next;
 
+		bth1 = be32_to_cpu(packet->ohdr->bth[1]);
 		qpn = bth1 & RVT_QPN_MASK;
 		rcu_read_lock();
 		qp = rvt_lookup_qpn(rdi, &ibp->rvp, qpn);
@@ -640,7 +666,7 @@ static void __prescan_rxq(struct hfi1_packet *packet)
 			goto next;
 		}
 
-		process_ecn(qp, packet, true);
+		hfi1_process_ecn_slowpath(qp, packet, true);
 		rcu_read_unlock();
 
 		/* turn off BECN, FECN */
diff --git a/drivers/infiniband/hw/hfi1/hfi.h b/drivers/infiniband/hw/hfi1/hfi.h
index 2ea42c04cfd25..232fc4b59a98c 100644
--- a/drivers/infiniband/hw/hfi1/hfi.h
+++ b/drivers/infiniband/hw/hfi1/hfi.h
@@ -1797,13 +1797,20 @@ static inline struct hfi1_ibport *rcd_to_iport(struct hfi1_ctxtdata *rcd)
 	return &rcd->ppd->ibport_data;
 }
 
-void hfi1_process_ecn_slowpath(struct rvt_qp *qp, struct hfi1_packet *pkt,
-			       bool do_cnp);
-static inline bool process_ecn(struct rvt_qp *qp, struct hfi1_packet *pkt,
-			       bool do_cnp)
+/**
+ * hfi1_may_ecn - Check whether FECN or BECN processing should be done
+ * @pkt: the packet to be evaluated
+ *
+ * Check whether the FECN or BECN bits in the packet's header are
+ * enabled, depending on packet type.
+ *
+ * This function only checks for FECN and BECN bits. Additional checks
+ * are done in the slowpath (hfi1_process_ecn_slowpath()) in order to
+ * ensure correct handling.
+ */
+static inline bool hfi1_may_ecn(struct hfi1_packet *pkt)
 {
-	bool becn;
-	bool fecn;
+	bool fecn, becn;
 
 	if (pkt->etype == RHF_RCV_TYPE_BYPASS) {
 		fecn = hfi1_16B_get_fecn(pkt->hdr);
@@ -1812,10 +1819,18 @@ static inline bool process_ecn(struct rvt_qp *qp, struct hfi1_packet *pkt,
 		fecn = ib_bth_get_fecn(pkt->ohdr);
 		becn = ib_bth_get_becn(pkt->ohdr);
 	}
-	if (unlikely(fecn || becn)) {
-		hfi1_process_ecn_slowpath(qp, pkt, do_cnp);
-		return fecn;
-	}
+	return fecn || becn;
+}
+
+bool hfi1_process_ecn_slowpath(struct rvt_qp *qp, struct hfi1_packet *pkt,
+			       bool prescan);
+static inline bool process_ecn(struct rvt_qp *qp, struct hfi1_packet *pkt)
+{
+	bool do_work;
+
+	do_work = hfi1_may_ecn(pkt);
+	if (unlikely(do_work))
+		return hfi1_process_ecn_slowpath(qp, pkt, false);
 	return false;
 }
 
diff --git a/drivers/infiniband/hw/hfi1/rc.c b/drivers/infiniband/hw/hfi1/rc.c
index 770c78c657306..980168a567071 100644
--- a/drivers/infiniband/hw/hfi1/rc.c
+++ b/drivers/infiniband/hw/hfi1/rc.c
@@ -2049,8 +2049,7 @@ void hfi1_rc_rcv(struct hfi1_packet *packet)
 	struct ib_reth *reth;
 	unsigned long flags;
 	int ret;
-	bool is_fecn = false;
-	bool copy_last = false;
+	bool copy_last = false, fecn;
 	u32 rkey;
 	u8 extra_bytes = pad + packet->extra_byte + (SIZE_OF_CRC << 2);
 
@@ -2059,7 +2058,7 @@ void hfi1_rc_rcv(struct hfi1_packet *packet)
 	if (hfi1_ruc_check_hdr(ibp, packet))
 		return;
 
-	is_fecn = process_ecn(qp, packet, false);
+	fecn = process_ecn(qp, packet);
 
 	/*
 	 * Process responses (ACKs) before anything else.  Note that the
@@ -2070,8 +2069,6 @@ void hfi1_rc_rcv(struct hfi1_packet *packet)
 	if (opcode >= OP(RDMA_READ_RESPONSE_FIRST) &&
 	    opcode <= OP(ATOMIC_ACKNOWLEDGE)) {
 		rc_rcv_resp(packet);
-		if (is_fecn)
-			goto send_ack;
 		return;
 	}
 
@@ -2347,11 +2344,11 @@ send_last:
 
 		/* Schedule the send engine. */
 		qp->s_flags |= RVT_S_RESP_PENDING;
+		if (fecn)
+			qp->s_flags |= RVT_S_ECN;
 		hfi1_schedule_send(qp);
 
 		spin_unlock_irqrestore(&qp->s_lock, flags);
-		if (is_fecn)
-			goto send_ack;
 		return;
 	}
 
@@ -2413,11 +2410,11 @@ send_last:
 
 		/* Schedule the send engine. */
 		qp->s_flags |= RVT_S_RESP_PENDING;
+		if (fecn)
+			qp->s_flags |= RVT_S_ECN;
 		hfi1_schedule_send(qp);
 
 		spin_unlock_irqrestore(&qp->s_lock, flags);
-		if (is_fecn)
-			goto send_ack;
 		return;
 	}
 
@@ -2430,16 +2427,9 @@ send_last:
 	qp->r_ack_psn = psn;
 	qp->r_nak_state = 0;
 	/* Send an ACK if requested or required. */
-	if (psn & IB_BTH_REQ_ACK) {
-		if (packet->numpkt == 0) {
-			rc_cancel_ack(qp);
-			goto send_ack;
-		}
-		if (qp->r_adefered >= HFI1_PSN_CREDIT) {
-			rc_cancel_ack(qp);
-			goto send_ack;
-		}
-		if (unlikely(is_fecn)) {
+	if (psn & IB_BTH_REQ_ACK || fecn) {
+		if (packet->numpkt == 0 || fecn ||
+		    qp->r_adefered >= HFI1_PSN_CREDIT) {
 			rc_cancel_ack(qp);
 			goto send_ack;
 		}
@@ -2480,7 +2470,7 @@ nack_acc:
 	qp->r_nak_state = IB_NAK_REMOTE_ACCESS_ERROR;
 	qp->r_ack_psn = qp->r_psn;
 send_ack:
-	hfi1_send_rc_ack(packet, is_fecn);
+	hfi1_send_rc_ack(packet, fecn);
 }
 
 void hfi1_rc_hdrerr(
diff --git a/drivers/infiniband/hw/hfi1/uc.c b/drivers/infiniband/hw/hfi1/uc.c
index e254dcec6f647..4121d1a93b1bb 100644
--- a/drivers/infiniband/hw/hfi1/uc.c
+++ b/drivers/infiniband/hw/hfi1/uc.c
@@ -321,7 +321,7 @@ void hfi1_uc_rcv(struct hfi1_packet *packet)
 	if (hfi1_ruc_check_hdr(ibp, packet))
 		return;
 
-	process_ecn(qp, packet, true);
+	process_ecn(qp, packet);
 
 	psn = ib_bth_get_psn(ohdr);
 	/* Compare the PSN verses the expected PSN. */
diff --git a/drivers/infiniband/hw/hfi1/ud.c b/drivers/infiniband/hw/hfi1/ud.c
index 54eb695642649..ef5b3ffd3888b 100644
--- a/drivers/infiniband/hw/hfi1/ud.c
+++ b/drivers/infiniband/hw/hfi1/ud.c
@@ -51,6 +51,7 @@
 #include "hfi.h"
 #include "mad.h"
 #include "verbs_txreq.h"
+#include "trace_ibhdrs.h"
 #include "qp.h"
 
 /* We support only two types - 9B and 16B for now */
@@ -656,18 +657,19 @@ void return_cnp_16B(struct hfi1_ibport *ibp, struct rvt_qp *qp,
 	u32 bth0, plen, vl, hwords = 7;
 	u16 len;
 	u8 l4;
-	struct hfi1_16b_header hdr;
+	struct hfi1_opa_header hdr;
 	struct ib_other_headers *ohdr;
 	struct pio_buf *pbuf;
 	struct send_context *ctxt = qp_to_send_context(qp, sc5);
 	struct hfi1_pportdata *ppd = ppd_from_ibp(ibp);
 	u32 nwords;
 
+	hdr.hdr_type = HFI1_PKT_TYPE_16B;
 	/* Populate length */
 	nwords = ((hfi1_get_16b_padding(hwords << 2, 0) +
 		   SIZE_OF_LT) >> 2) + SIZE_OF_CRC;
 	if (old_grh) {
-		struct ib_grh *grh = &hdr.u.l.grh;
+		struct ib_grh *grh = &hdr.opah.u.l.grh;
 
 		grh->version_tclass_flow = old_grh->version_tclass_flow;
 		grh->paylen = cpu_to_be16(
@@ -675,11 +677,11 @@ void return_cnp_16B(struct hfi1_ibport *ibp, struct rvt_qp *qp,
 		grh->hop_limit = 0xff;
 		grh->sgid = old_grh->dgid;
 		grh->dgid = old_grh->sgid;
-		ohdr = &hdr.u.l.oth;
+		ohdr = &hdr.opah.u.l.oth;
 		l4 = OPA_16B_L4_IB_GLOBAL;
 		hwords += sizeof(struct ib_grh) / sizeof(u32);
 	} else {
-		ohdr = &hdr.u.oth;
+		ohdr = &hdr.opah.u.oth;
 		l4 = OPA_16B_L4_IB_LOCAL;
 	}
 
@@ -693,7 +695,7 @@ void return_cnp_16B(struct hfi1_ibport *ibp, struct rvt_qp *qp,
 
 	/* Convert dwords to flits */
 	len = (hwords + nwords) >> 1;
-	hfi1_make_16b_hdr(&hdr, slid, dlid, len, pkey, 1, 0, l4, sc5);
+	hfi1_make_16b_hdr(&hdr.opah, slid, dlid, len, pkey, 1, 0, l4, sc5);
 
 	plen = 2 /* PBC */ + hwords + nwords;
 	pbc_flags |= PBC_PACKET_BYPASS | PBC_INSERT_BYPASS_ICRC;
@@ -701,9 +703,11 @@ void return_cnp_16B(struct hfi1_ibport *ibp, struct rvt_qp *qp,
 	pbc = create_pbc(ppd, pbc_flags, qp->srate_mbps, vl, plen);
 	if (ctxt) {
 		pbuf = sc_buffer_alloc(ctxt, plen, NULL, NULL);
-		if (pbuf)
+		if (pbuf) {
+			trace_pio_output_ibhdr(ppd->dd, &hdr, sc5);
 			ppd->dd->pio_inline_send(ppd->dd, pbuf, pbc,
 						 &hdr, hwords);
+		}
 	}
 }
 
@@ -715,14 +719,15 @@ void return_cnp(struct hfi1_ibport *ibp, struct rvt_qp *qp, u32 remote_qpn,
 	u32 bth0, plen, vl, hwords = 5;
 	u16 lrh0;
 	u8 sl = ibp->sc_to_sl[sc5];
-	struct ib_header hdr;
+	struct hfi1_opa_header hdr;
 	struct ib_other_headers *ohdr;
 	struct pio_buf *pbuf;
 	struct send_context *ctxt = qp_to_send_context(qp, sc5);
 	struct hfi1_pportdata *ppd = ppd_from_ibp(ibp);
 
+	hdr.hdr_type = HFI1_PKT_TYPE_9B;
 	if (old_grh) {
-		struct ib_grh *grh = &hdr.u.l.grh;
+		struct ib_grh *grh = &hdr.ibh.u.l.grh;
 
 		grh->version_tclass_flow = old_grh->version_tclass_flow;
 		grh->paylen = cpu_to_be16(
@@ -730,11 +735,11 @@ void return_cnp(struct hfi1_ibport *ibp, struct rvt_qp *qp, u32 remote_qpn,
 		grh->hop_limit = 0xff;
 		grh->sgid = old_grh->dgid;
 		grh->dgid = old_grh->sgid;
-		ohdr = &hdr.u.l.oth;
+		ohdr = &hdr.ibh.u.l.oth;
 		lrh0 = HFI1_LRH_GRH;
 		hwords += sizeof(struct ib_grh) / sizeof(u32);
 	} else {
-		ohdr = &hdr.u.oth;
+		ohdr = &hdr.ibh.u.oth;
 		lrh0 = HFI1_LRH_BTH;
 	}
 
@@ -746,16 +751,18 @@ void return_cnp(struct hfi1_ibport *ibp, struct rvt_qp *qp, u32 remote_qpn,
 	ohdr->bth[1] = cpu_to_be32(remote_qpn | (1 << IB_BECN_SHIFT));
 	ohdr->bth[2] = 0; /* PSN 0 */
 
-	hfi1_make_ib_hdr(&hdr, lrh0, hwords + SIZE_OF_CRC, dlid, slid);
+	hfi1_make_ib_hdr(&hdr.ibh, lrh0, hwords + SIZE_OF_CRC, dlid, slid);
 	plen = 2 /* PBC */ + hwords;
 	pbc_flags |= (ib_is_sc5(sc5) << PBC_DC_INFO_SHIFT);
 	vl = sc_to_vlt(ppd->dd, sc5);
 	pbc = create_pbc(ppd, pbc_flags, qp->srate_mbps, vl, plen);
 	if (ctxt) {
 		pbuf = sc_buffer_alloc(ctxt, plen, NULL, NULL);
-		if (pbuf)
+		if (pbuf) {
+			trace_pio_output_ibhdr(ppd->dd, &hdr, sc5);
 			ppd->dd->pio_inline_send(ppd->dd, pbuf, pbc,
 						 &hdr, hwords);
+		}
 	}
 }
 
@@ -912,7 +919,7 @@ void hfi1_ud_rcv(struct hfi1_packet *packet)
 		src_qp = hfi1_16B_get_src_qpn(packet->mgmt);
 	}
 
-	process_ecn(qp, packet, (opcode != IB_OPCODE_CNP));
+	process_ecn(qp, packet);
 	/*
 	 * Get the number of bytes the message was padded by
 	 * and drop incomplete packets.
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 078/639] OPP: Fix missing debugfs supply directory for OPPs
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (76 preceding siblings ...)
  2020-01-24  9:24 ` [PATCH 4.19 077/639] IB/hfi1: Correctly process FECN and BECN in packets Greg Kroah-Hartman
@ 2020-01-24  9:24 ` Greg Kroah-Hartman
  2020-01-24  9:24 ` [PATCH 4.19 079/639] IB/rxe: Fix incorrect cache cleanup in error flow Greg Kroah-Hartman
                   ` (564 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:24 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Quentin Perret, Viresh Kumar, Sasha Levin

From: Viresh Kumar <viresh.kumar@linaro.org>

[ Upstream commit 46f48aca2e5aef3f430e95d1a5fb68227ec8ec85 ]

There is one case where we may end up with no "supply" directory for the
OPPs in debugfs. That happens when the OPP core isn't managing the
regulators for the device and the device's OPP do have microvolt
property. It happens because the opp_table->regulator_count remains set
to 0 and the debugfs routines don't add any supply directory in such a
case.

This commit fixes that by setting opp_table->regulator_count to 1 in
that particular case. But to make everything work nicely and not break
other parts of the core, regulator_count is defined as "int" now instead
of "unsigned int" and it can have different special values now. It is
set to -1 initially to mark it "uninitialized" and later only we set it
to 0 or positive values after checking how many supplies are there.

This also helps in finding the bugs where only few of the OPPs have the
"opp-microvolt" property set and not all.

Fixes: 1fae788ed640 ("PM / OPP: Don't create debugfs "supply-0" directory unnecessarily")
Reported-by: Quentin Perret <quentin.perret@arm.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/opp/core.c | 12 +++++++++---
 drivers/opp/of.c   | 20 ++++++++++++++++----
 drivers/opp/opp.h  |  6 ++++--
 3 files changed, 29 insertions(+), 9 deletions(-)

diff --git a/drivers/opp/core.c b/drivers/opp/core.c
index 1e80f9ec1aa6a..34515f4323755 100644
--- a/drivers/opp/core.c
+++ b/drivers/opp/core.c
@@ -793,6 +793,9 @@ static struct opp_table *_allocate_opp_table(struct device *dev)
 
 	INIT_LIST_HEAD(&opp_table->dev_list);
 
+	/* Mark regulator count uninitialized */
+	opp_table->regulator_count = -1;
+
 	opp_dev = _add_opp_dev(dev, opp_table);
 	if (!opp_dev) {
 		kfree(opp_table);
@@ -955,7 +958,7 @@ struct dev_pm_opp *_opp_allocate(struct opp_table *table)
 	int count, supply_size;
 
 	/* Allocate space for at least one supply */
-	count = table->regulator_count ? table->regulator_count : 1;
+	count = table->regulator_count > 0 ? table->regulator_count : 1;
 	supply_size = sizeof(*opp->supplies) * count;
 
 	/* allocate new OPP node and supplies structures */
@@ -1363,7 +1366,7 @@ free_regulators:
 
 	kfree(opp_table->regulators);
 	opp_table->regulators = NULL;
-	opp_table->regulator_count = 0;
+	opp_table->regulator_count = -1;
 err:
 	dev_pm_opp_put_opp_table(opp_table);
 
@@ -1392,7 +1395,7 @@ void dev_pm_opp_put_regulators(struct opp_table *opp_table)
 
 	kfree(opp_table->regulators);
 	opp_table->regulators = NULL;
-	opp_table->regulator_count = 0;
+	opp_table->regulator_count = -1;
 
 put_opp_table:
 	dev_pm_opp_put_opp_table(opp_table);
@@ -1545,6 +1548,9 @@ int dev_pm_opp_add(struct device *dev, unsigned long freq, unsigned long u_volt)
 	if (!opp_table)
 		return -ENOMEM;
 
+	/* Fix regulator count for dynamic OPPs */
+	opp_table->regulator_count = 1;
+
 	ret = _opp_add_v1(opp_table, dev, freq, u_volt, true);
 
 	dev_pm_opp_put_opp_table(opp_table);
diff --git a/drivers/opp/of.c b/drivers/opp/of.c
index 20988c4266501..d64a13d7881b9 100644
--- a/drivers/opp/of.c
+++ b/drivers/opp/of.c
@@ -113,12 +113,10 @@ static int opp_parse_supplies(struct dev_pm_opp *opp, struct device *dev,
 			      struct opp_table *opp_table)
 {
 	u32 *microvolt, *microamp = NULL;
-	int supplies, vcount, icount, ret, i, j;
+	int supplies = opp_table->regulator_count, vcount, icount, ret, i, j;
 	struct property *prop = NULL;
 	char name[NAME_MAX];
 
-	supplies = opp_table->regulator_count ? opp_table->regulator_count : 1;
-
 	/* Search for "opp-microvolt-<name>" */
 	if (opp_table->prop_name) {
 		snprintf(name, sizeof(name), "opp-microvolt-%s",
@@ -133,7 +131,13 @@ static int opp_parse_supplies(struct dev_pm_opp *opp, struct device *dev,
 
 		/* Missing property isn't a problem, but an invalid entry is */
 		if (!prop) {
-			if (!opp_table->regulator_count)
+			if (unlikely(supplies == -1)) {
+				/* Initialize regulator_count */
+				opp_table->regulator_count = 0;
+				return 0;
+			}
+
+			if (!supplies)
 				return 0;
 
 			dev_err(dev, "%s: opp-microvolt missing although OPP managing regulators\n",
@@ -142,6 +146,14 @@ static int opp_parse_supplies(struct dev_pm_opp *opp, struct device *dev,
 		}
 	}
 
+	if (unlikely(supplies == -1)) {
+		/* Initialize regulator_count */
+		supplies = opp_table->regulator_count = 1;
+	} else if (unlikely(!supplies)) {
+		dev_err(dev, "%s: opp-microvolt wasn't expected\n", __func__);
+		return -EINVAL;
+	}
+
 	vcount = of_property_count_u32_elems(opp->np, name);
 	if (vcount < 0) {
 		dev_err(dev, "%s: Invalid %s property (%d)\n",
diff --git a/drivers/opp/opp.h b/drivers/opp/opp.h
index 7c540fd063b2d..c9e65964ed848 100644
--- a/drivers/opp/opp.h
+++ b/drivers/opp/opp.h
@@ -136,7 +136,9 @@ enum opp_table_access {
  * @prop_name: A name to postfix to many DT properties, while parsing them.
  * @clk: Device's clock handle
  * @regulators: Supply regulators
- * @regulator_count: Number of power supply regulators
+ * @regulator_count: Number of power supply regulators. Its value can be -1
+ * (uninitialized), 0 (no opp-microvolt property) or > 0 (has opp-microvolt
+ * property).
  * @genpd_performance_state: Device's power domain support performance state.
  * @set_opp: Platform specific set_opp callback
  * @set_opp_data: Data to be passed to set_opp callback
@@ -172,7 +174,7 @@ struct opp_table {
 	const char *prop_name;
 	struct clk *clk;
 	struct regulator **regulators;
-	unsigned int regulator_count;
+	int regulator_count;
 	bool genpd_performance_state;
 
 	int (*set_opp)(struct dev_pm_set_opp_data *data);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 079/639] IB/rxe: Fix incorrect cache cleanup in error flow
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (77 preceding siblings ...)
  2020-01-24  9:24 ` [PATCH 4.19 078/639] OPP: Fix missing debugfs supply directory for OPPs Greg Kroah-Hartman
@ 2020-01-24  9:24 ` Greg Kroah-Hartman
  2020-01-24  9:24 ` [PATCH 4.19 080/639] mailbox: ti-msgmgr: Off by one in ti_msgmgr_of_xlate() Greg Kroah-Hartman
                   ` (563 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:24 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yuval Shaia, Bart Van Assche,
	Zhu Yanjun, Leon Romanovsky, Jason Gunthorpe, Sasha Levin

From: Yuval Shaia <yuval.shaia@oracle.com>

[ Upstream commit 6db21d8986e14e2e86573a3b055b05296188bd2c ]

Array iterator stays at the same slot, fix it.

Fixes: 8700e3e7c485 ("Soft RoCE driver")
Signed-off-by: Yuval Shaia <yuval.shaia@oracle.com>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Reviewed-by: Zhu Yanjun <yanjun.zhu@oracle.com>
Reviewed-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/sw/rxe/rxe_pool.c | 26 ++++++++++++++------------
 1 file changed, 14 insertions(+), 12 deletions(-)

diff --git a/drivers/infiniband/sw/rxe/rxe_pool.c b/drivers/infiniband/sw/rxe/rxe_pool.c
index b4a8acc7bb7d6..0e2425f282335 100644
--- a/drivers/infiniband/sw/rxe/rxe_pool.c
+++ b/drivers/infiniband/sw/rxe/rxe_pool.c
@@ -112,6 +112,18 @@ static inline struct kmem_cache *pool_cache(struct rxe_pool *pool)
 	return rxe_type_info[pool->type].cache;
 }
 
+static void rxe_cache_clean(size_t cnt)
+{
+	int i;
+	struct rxe_type_info *type;
+
+	for (i = 0; i < cnt; i++) {
+		type = &rxe_type_info[i];
+		kmem_cache_destroy(type->cache);
+		type->cache = NULL;
+	}
+}
+
 int rxe_cache_init(void)
 {
 	int err;
@@ -136,24 +148,14 @@ int rxe_cache_init(void)
 	return 0;
 
 err1:
-	while (--i >= 0) {
-		kmem_cache_destroy(type->cache);
-		type->cache = NULL;
-	}
+	rxe_cache_clean(i);
 
 	return err;
 }
 
 void rxe_cache_exit(void)
 {
-	int i;
-	struct rxe_type_info *type;
-
-	for (i = 0; i < RXE_NUM_TYPES; i++) {
-		type = &rxe_type_info[i];
-		kmem_cache_destroy(type->cache);
-		type->cache = NULL;
-	}
+	rxe_cache_clean(RXE_NUM_TYPES);
 }
 
 static int rxe_pool_init_index(struct rxe_pool *pool, u32 max, u32 min)
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 080/639] mailbox: ti-msgmgr: Off by one in ti_msgmgr_of_xlate()
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (78 preceding siblings ...)
  2020-01-24  9:24 ` [PATCH 4.19 079/639] IB/rxe: Fix incorrect cache cleanup in error flow Greg Kroah-Hartman
@ 2020-01-24  9:24 ` Greg Kroah-Hartman
  2020-01-24  9:24 ` [PATCH 4.19 081/639] staging: bcm2835-camera: Abort probe if there is no camera Greg Kroah-Hartman
                   ` (562 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:24 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Nishanth Menon,
	Jassi Brar, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit 78f3ff524fca63e7d2a57149a34ade23d2c12798 ]

The > comparison should be >= or we access one element beyond the end
of the array.

(The inst->qinsts[] array is allocated in the ti_msgmgr_probe() function
and it has ->num_valid_queues elements.)

Fixes: a2b79838b891 ("mailbox: ti-msgmgr: Add support for Secure Proxy")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Nishanth Menon <nm@ti.com>
Signed-off-by: Jassi Brar <jaswinder.singh@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mailbox/ti-msgmgr.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/mailbox/ti-msgmgr.c b/drivers/mailbox/ti-msgmgr.c
index 5bceafbf66993..01e9e462512b7 100644
--- a/drivers/mailbox/ti-msgmgr.c
+++ b/drivers/mailbox/ti-msgmgr.c
@@ -547,7 +547,7 @@ static struct mbox_chan *ti_msgmgr_of_xlate(struct mbox_controller *mbox,
 	}
 
 	if (d->is_sproxy) {
-		if (req_pid > d->num_valid_queues)
+		if (req_pid >= d->num_valid_queues)
 			goto err;
 		qinst = &inst->qinsts[req_pid];
 		return qinst->chan;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 081/639] staging: bcm2835-camera: Abort probe if there is no camera
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (79 preceding siblings ...)
  2020-01-24  9:24 ` [PATCH 4.19 080/639] mailbox: ti-msgmgr: Off by one in ti_msgmgr_of_xlate() Greg Kroah-Hartman
@ 2020-01-24  9:24 ` Greg Kroah-Hartman
  2020-01-24  9:24 ` [PATCH 4.19 082/639] staging: bcm2835-camera: fix module autoloading Greg Kroah-Hartman
                   ` (561 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:24 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Stefan Wahren,
	Nicolas Saenz Julienne, Dan Carpenter, Sasha Levin

From: Stefan Wahren <stefan.wahren@i2se.com>

[ Upstream commit 7566f39dfdc11f8a97d5810c6e6295a88f97ef91 ]

Abort the probing of the camera driver in case there isn't a camera
actually connected to the Raspberry Pi. This solution also avoids a
NULL ptr dereference of mmal instance on driver unload.

Fixes: 7b3ad5abf027 ("staging: Import the BCM2835 MMAL-based V4L2 camera driver.")
Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
Reviewed-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../vc04_services/bcm2835-camera/bcm2835-camera.c        | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
index 455082867246d..068e5b9ab2323 100644
--- a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
+++ b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
@@ -1854,6 +1854,12 @@ static int bcm2835_mmal_probe(struct platform_device *pdev)
 	num_cameras = get_num_cameras(instance,
 				      resolutions,
 				      MAX_BCM2835_CAMERAS);
+
+	if (num_cameras < 1) {
+		ret = -ENODEV;
+		goto cleanup_mmal;
+	}
+
 	if (num_cameras > MAX_BCM2835_CAMERAS)
 		num_cameras = MAX_BCM2835_CAMERAS;
 
@@ -1953,6 +1959,9 @@ cleanup_gdev:
 	pr_info("%s: error %d while loading driver\n",
 		BM2835_MMAL_MODULE_NAME, ret);
 
+cleanup_mmal:
+	vchiq_mmal_finalise(instance);
+
 	return ret;
 }
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 082/639] staging: bcm2835-camera: fix module autoloading
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (80 preceding siblings ...)
  2020-01-24  9:24 ` [PATCH 4.19 081/639] staging: bcm2835-camera: Abort probe if there is no camera Greg Kroah-Hartman
@ 2020-01-24  9:24 ` Greg Kroah-Hartman
  2020-01-24  9:24 ` [PATCH 4.19 083/639] switchtec: Remove immediate status check after submitting MRPC command Greg Kroah-Hartman
                   ` (560 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:24 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Stefan Wahren,
	Nicolas Saenz Julienne, Dan Carpenter, Sasha Levin

From: Stefan Wahren <stefan.wahren@i2se.com>

[ Upstream commit 3a2c20024a2b47adbf514e7f3ab79342739c3926 ]

In order to make the module bcm2835-camera load automatically, we need to
add a module alias.

Fixes: 4bebb0312ea9 ("staging/bcm2835-camera: Set ourselves up as a platform driver.")
Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
Reviewed-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
index 068e5b9ab2323..edf25922b12d6 100644
--- a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
+++ b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
@@ -47,6 +47,7 @@ MODULE_DESCRIPTION("Broadcom 2835 MMAL video capture");
 MODULE_AUTHOR("Vincent Sanders");
 MODULE_LICENSE("GPL");
 MODULE_VERSION(BM2835_MMAL_VERSION);
+MODULE_ALIAS("platform:bcm2835-camera");
 
 int bcm2835_v4l2_debug;
 module_param_named(debug, bcm2835_v4l2_debug, int, 0644);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 083/639] switchtec: Remove immediate status check after submitting MRPC command
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (81 preceding siblings ...)
  2020-01-24  9:24 ` [PATCH 4.19 082/639] staging: bcm2835-camera: fix module autoloading Greg Kroah-Hartman
@ 2020-01-24  9:24 ` Greg Kroah-Hartman
  2020-01-24  9:24 ` [PATCH 4.19 084/639] ipv6: add missing tx timestamping on IPPROTO_RAW Greg Kroah-Hartman
                   ` (559 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:24 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Kelvin Cao, Wesley Sheng,
	Bjorn Helgaas, Logan Gunthorpe, Sasha Levin

From: Kelvin Cao <kelvin.cao@microchip.com>

[ Upstream commit 526180408b815aa7b96fd48bd23cdd33ef04e38e ]

After submitting a Firmware Download MRPC command, Switchtec firmware will
delay Management EP BAR MemRd TLP responses by more than 10ms.  This is a
firmware limitation.  Delayed MemRd completions are a problem for systems
with a low Completion Timeout (CTO).

The current driver checks the MRPC status immediately after submitting an
MRPC command, which results in a delayed MemRd completion that may cause a
Completion Timeout.

Remove the immediate status check and rely on the check after receiving an
interrupt or timing out.

This is only a software workaround to the READ issue and a proper fix of
this should be done in firmware.

Fixes: 080b47def5e5 ("MicroSemi Switchtec management interface driver")
Signed-off-by: Kelvin Cao <kelvin.cao@microchip.com>
Signed-off-by: Wesley Sheng <wesley.sheng@microchip.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Logan Gunthorpe <logang@deltatee.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/switch/switchtec.c | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/drivers/pci/switch/switchtec.c b/drivers/pci/switch/switchtec.c
index 5aaa4ce04ec3d..ceb7ab3ba3d09 100644
--- a/drivers/pci/switch/switchtec.c
+++ b/drivers/pci/switch/switchtec.c
@@ -134,10 +134,6 @@ static void mrpc_cmd_submit(struct switchtec_dev *stdev)
 		    stuser->data, stuser->data_len);
 	iowrite32(stuser->cmd, &stdev->mmio_mrpc->cmd);
 
-	stuser->status = ioread32(&stdev->mmio_mrpc->status);
-	if (stuser->status != SWITCHTEC_MRPC_STATUS_INPROGRESS)
-		mrpc_complete_cmd(stdev);
-
 	schedule_delayed_work(&stdev->mrpc_timeout,
 			      msecs_to_jiffies(500));
 }
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 084/639] ipv6: add missing tx timestamping on IPPROTO_RAW
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (82 preceding siblings ...)
  2020-01-24  9:24 ` [PATCH 4.19 083/639] switchtec: Remove immediate status check after submitting MRPC command Greg Kroah-Hartman
@ 2020-01-24  9:24 ` Greg Kroah-Hartman
  2020-01-24  9:24 ` [PATCH 4.19 085/639] pinctrl: sh-pfc: r8a7740: Add missing REF125CK pin to gether_gmii group Greg Kroah-Hartman
                   ` (558 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:24 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Willem de Bruijn,
	Soheil Hassas Yeganeh, David S. Miller, Sasha Levin

From: Willem de Bruijn <willemb@google.com>

[ Upstream commit fbfb2321e950918b430e7225546296b2dcadf725 ]

Raw sockets support tx timestamping, but one case is missing.

IPPROTO_RAW takes a separate packet construction path. raw_send_hdrinc
has an explicit call to sock_tx_timestamp, but rawv6_send_hdrinc does
not. Add it.

Fixes: 11878b40ed5c ("net-timestamp: SOCK_RAW and PING timestamping")
Signed-off-by: Willem de Bruijn <willemb@google.com>
Acked-by: Soheil Hassas Yeganeh <soheil@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ipv6/raw.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index 4856d9320b28e..a41156a00dd44 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -660,6 +660,8 @@ static int rawv6_send_hdrinc(struct sock *sk, struct msghdr *msg, int length,
 
 	skb->ip_summed = CHECKSUM_NONE;
 
+	sock_tx_timestamp(sk, sockc->tsflags, &skb_shinfo(skb)->tx_flags);
+
 	if (flags & MSG_CONFIRM)
 		skb_set_dst_pending_confirm(skb, 1);
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 085/639] pinctrl: sh-pfc: r8a7740: Add missing REF125CK pin to gether_gmii group
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (83 preceding siblings ...)
  2020-01-24  9:24 ` [PATCH 4.19 084/639] ipv6: add missing tx timestamping on IPPROTO_RAW Greg Kroah-Hartman
@ 2020-01-24  9:24 ` Greg Kroah-Hartman
  2020-01-24  9:24 ` [PATCH 4.19 086/639] pinctrl: sh-pfc: r8a7740: Add missing LCD0 marks to lcd0_data24_1 group Greg Kroah-Hartman
                   ` (557 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:24 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Geert Uytterhoeven, Simon Horman,
	Sasha Levin

From: Geert Uytterhoeven <geert+renesas@glider.be>

[ Upstream commit 1ebc589a7786f17f97b9e87b44e0fb4d0290d8f8 ]

The gether_gmii_mux[] array contains the REF125CK pin mark, but the
gether_gmii_pins[] array lacks the corresponding pin number.

Fixes: bae11d30d0cafdc5 ("sh-pfc: r8a7740: Add GETHER pin groups and functions")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pinctrl/sh-pfc/pfc-r8a7740.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7740.c b/drivers/pinctrl/sh-pfc/pfc-r8a7740.c
index 35f436bcb8491..d8077065636e3 100644
--- a/drivers/pinctrl/sh-pfc/pfc-r8a7740.c
+++ b/drivers/pinctrl/sh-pfc/pfc-r8a7740.c
@@ -1982,7 +1982,7 @@ static const unsigned int gether_gmii_pins[] = {
 	 */
 	185, 186, 187, 188, 189, 190, 191, 192, 174, 161, 204,
 	171, 170, 169, 168, 167, 166, 173, 172, 176, 184, 183, 203,
-	205, 163, 206, 207,
+	205, 163, 206, 207, 158,
 };
 static const unsigned int gether_gmii_mux[] = {
 	ET_ERXD0_MARK, ET_ERXD1_MARK, ET_ERXD2_MARK, ET_ERXD3_MARK,
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 086/639] pinctrl: sh-pfc: r8a7740: Add missing LCD0 marks to lcd0_data24_1 group
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (84 preceding siblings ...)
  2020-01-24  9:24 ` [PATCH 4.19 085/639] pinctrl: sh-pfc: r8a7740: Add missing REF125CK pin to gether_gmii group Greg Kroah-Hartman
@ 2020-01-24  9:24 ` Greg Kroah-Hartman
  2020-01-24  9:24 ` [PATCH 4.19 087/639] pinctrl: sh-pfc: r8a7791: Remove bogus ctrl marks from qspi_data4_b group Greg Kroah-Hartman
                   ` (556 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:24 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Geert Uytterhoeven, Simon Horman,
	Sasha Levin

From: Geert Uytterhoeven <geert+renesas@glider.be>

[ Upstream commit 96bb2a6ab4eca10e5b6490b3f0738e9f7ec22c2b ]

The lcd0_data24_1_pins[] array contains the LCD0 D1[2-5] pin numbers,
but the lcd0_data24_1_mux[] array lacks the corresponding pin marks.

Fixes: 06c7dd866da70f6c ("sh-pfc: r8a7740: Add LCDC0 and LCDC1 pin groups and functions")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pinctrl/sh-pfc/pfc-r8a7740.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7740.c b/drivers/pinctrl/sh-pfc/pfc-r8a7740.c
index d8077065636e3..e9739dbcb356e 100644
--- a/drivers/pinctrl/sh-pfc/pfc-r8a7740.c
+++ b/drivers/pinctrl/sh-pfc/pfc-r8a7740.c
@@ -2154,6 +2154,7 @@ static const unsigned int lcd0_data24_1_mux[] = {
 	LCD0_D0_MARK, LCD0_D1_MARK, LCD0_D2_MARK, LCD0_D3_MARK,
 	LCD0_D4_MARK, LCD0_D5_MARK, LCD0_D6_MARK, LCD0_D7_MARK,
 	LCD0_D8_MARK, LCD0_D9_MARK, LCD0_D10_MARK, LCD0_D11_MARK,
+	LCD0_D12_MARK, LCD0_D13_MARK, LCD0_D14_MARK, LCD0_D15_MARK,
 	LCD0_D16_MARK, LCD0_D17_MARK, LCD0_D18_PORT163_MARK,
 	LCD0_D19_PORT162_MARK, LCD0_D20_PORT161_MARK, LCD0_D21_PORT158_MARK,
 	LCD0_D22_PORT160_MARK, LCD0_D23_PORT159_MARK,
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 087/639] pinctrl: sh-pfc: r8a7791: Remove bogus ctrl marks from qspi_data4_b group
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (85 preceding siblings ...)
  2020-01-24  9:24 ` [PATCH 4.19 086/639] pinctrl: sh-pfc: r8a7740: Add missing LCD0 marks to lcd0_data24_1 group Greg Kroah-Hartman
@ 2020-01-24  9:24 ` Greg Kroah-Hartman
  2020-01-24  9:24 ` [PATCH 4.19 088/639] pinctrl: sh-pfc: r8a7791: Remove bogus marks from vin1_b_data18 group Greg Kroah-Hartman
                   ` (555 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:24 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Geert Uytterhoeven, Simon Horman,
	Sasha Levin

From: Geert Uytterhoeven <geert+renesas@glider.be>

[ Upstream commit 884fa25fb6e5e63ab970d612a628313bb68f37cc ]

The qspi_data4_b_mux[] array contains pin marks for the clock and chip
select pins.  The qspi_data4_b_pins[] array rightfully does not contain
the corresponding pin numbers, as the control pins are provided by a
separate group (qspi_ctrl_b).

Fixes: 2d0c386f135e4186 ("pinctrl: sh-pfc: r8a7791: Add QSPI pin groups")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pinctrl/sh-pfc/pfc-r8a7791.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7791.c b/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
index 5811784d88cb9..f5b4255570b28 100644
--- a/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
+++ b/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
@@ -3220,8 +3220,7 @@ static const unsigned int qspi_data4_b_pins[] = {
 	RCAR_GP_PIN(6, 4),
 };
 static const unsigned int qspi_data4_b_mux[] = {
-	SPCLK_B_MARK, MOSI_IO0_B_MARK, MISO_IO1_B_MARK,
-	IO2_B_MARK, IO3_B_MARK, SSL_B_MARK,
+	MOSI_IO0_B_MARK, MISO_IO1_B_MARK, IO2_B_MARK, IO3_B_MARK,
 };
 /* - SCIF0 ------------------------------------------------------------------ */
 static const unsigned int scif0_data_pins[] = {
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 088/639] pinctrl: sh-pfc: r8a7791: Remove bogus marks from vin1_b_data18 group
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (86 preceding siblings ...)
  2020-01-24  9:24 ` [PATCH 4.19 087/639] pinctrl: sh-pfc: r8a7791: Remove bogus ctrl marks from qspi_data4_b group Greg Kroah-Hartman
@ 2020-01-24  9:24 ` Greg Kroah-Hartman
  2020-01-24  9:24 ` [PATCH 4.19 089/639] pinctrl: sh-pfc: sh73a0: Add missing TO pin to tpu4_to3 group Greg Kroah-Hartman
                   ` (554 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:24 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Geert Uytterhoeven, Simon Horman,
	Sasha Levin

From: Geert Uytterhoeven <geert+renesas@glider.be>

[ Upstream commit 0d6256cb880166a4111bebce35790019e56b6e1b ]

The vin1_b_data18_mux[] arrays contains pin marks for the 2 LSB bits of
the color components.  The vin1_b_data18_pins[] array rightfully does
not include the corresponding pin numbers, as RGB18 is subset of RGB24,
containing only the 6 MSB bits of each component.

Fixes: 8e32c9671f84acd8 ("pinctrl: sh-pfc: r8a7791: Add VIN pins")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pinctrl/sh-pfc/pfc-r8a7791.c | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7791.c b/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
index f5b4255570b28..6236ac55c65d3 100644
--- a/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
+++ b/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
@@ -4374,17 +4374,14 @@ static const unsigned int vin1_b_data18_pins[] = {
 };
 static const unsigned int vin1_b_data18_mux[] = {
 	/* B */
-	VI1_DATA0_B_MARK, VI1_DATA1_B_MARK,
 	VI1_DATA2_B_MARK, VI1_DATA3_B_MARK,
 	VI1_DATA4_B_MARK, VI1_DATA5_B_MARK,
 	VI1_DATA6_B_MARK, VI1_DATA7_B_MARK,
 	/* G */
-	VI1_G0_B_MARK, VI1_G1_B_MARK,
 	VI1_G2_B_MARK, VI1_G3_B_MARK,
 	VI1_G4_B_MARK, VI1_G5_B_MARK,
 	VI1_G6_B_MARK, VI1_G7_B_MARK,
 	/* R */
-	VI1_R0_B_MARK, VI1_R1_B_MARK,
 	VI1_R2_B_MARK, VI1_R3_B_MARK,
 	VI1_R4_B_MARK, VI1_R5_B_MARK,
 	VI1_R6_B_MARK, VI1_R7_B_MARK,
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 089/639] pinctrl: sh-pfc: sh73a0: Add missing TO pin to tpu4_to3 group
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (87 preceding siblings ...)
  2020-01-24  9:24 ` [PATCH 4.19 088/639] pinctrl: sh-pfc: r8a7791: Remove bogus marks from vin1_b_data18 group Greg Kroah-Hartman
@ 2020-01-24  9:24 ` Greg Kroah-Hartman
  2020-01-24  9:24 ` [PATCH 4.19 090/639] pinctrl: sh-pfc: r8a7794: Remove bogus IPSR9 field Greg Kroah-Hartman
                   ` (553 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:24 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Geert Uytterhoeven, Simon Horman,
	Sasha Levin

From: Geert Uytterhoeven <geert+renesas@glider.be>

[ Upstream commit 124cde98f856b6206b804acbdec3b7c80f8c3427 ]

The tpu4_to3_mux[] array contains the TPU4TO3 pin mark, but the
tpu4_to3_pins[] array lacks the corresponding pin number.

Add the missing pin number, for non-GPIO pin F26.

Fixes: 5da4eb049de803c7 ("sh-pfc: sh73a0: Add TPU pin groups and functions")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pinctrl/sh-pfc/pfc-sh73a0.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/pinctrl/sh-pfc/pfc-sh73a0.c b/drivers/pinctrl/sh-pfc/pfc-sh73a0.c
index d25e6f674d0ab..f8fbedb46585d 100644
--- a/drivers/pinctrl/sh-pfc/pfc-sh73a0.c
+++ b/drivers/pinctrl/sh-pfc/pfc-sh73a0.c
@@ -3086,6 +3086,7 @@ static const unsigned int tpu4_to2_mux[] = {
 };
 static const unsigned int tpu4_to3_pins[] = {
 	/* TO */
+	PIN_NUMBER(6, 26),
 };
 static const unsigned int tpu4_to3_mux[] = {
 	TPU4TO3_MARK,
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 090/639] pinctrl: sh-pfc: r8a7794: Remove bogus IPSR9 field
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (88 preceding siblings ...)
  2020-01-24  9:24 ` [PATCH 4.19 089/639] pinctrl: sh-pfc: sh73a0: Add missing TO pin to tpu4_to3 group Greg Kroah-Hartman
@ 2020-01-24  9:24 ` Greg Kroah-Hartman
  2020-01-24  9:24 ` [PATCH 4.19 091/639] pinctrl: sh-pfc: r8a77970: Add missing MOD_SEL0 field Greg Kroah-Hartman
                   ` (552 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:24 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Geert Uytterhoeven, Simon Horman,
	Sasha Levin

From: Geert Uytterhoeven <geert+renesas@glider.be>

[ Upstream commit 6a6c195d98a1a5e70faa87f594d7564af1dd1bed ]

The Peripheral Function Select Register 9 contains 12 fields, but the
variable field descriptor contains a 13th bogus field of 3 bits.

Fixes: 43c4436e2f1890a7 ("pinctrl: sh-pfc: add R8A7794 PFC support")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pinctrl/sh-pfc/pfc-r8a7794.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7794.c b/drivers/pinctrl/sh-pfc/pfc-r8a7794.c
index 1640024375946..24b9bb1ee1fe5 100644
--- a/drivers/pinctrl/sh-pfc/pfc-r8a7794.c
+++ b/drivers/pinctrl/sh-pfc/pfc-r8a7794.c
@@ -5215,7 +5215,7 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = {
 		FN_AVB_MDC, FN_SSI_SDATA6_B, 0, 0, }
 	},
 	{ PINMUX_CFG_REG_VAR("IPSR9", 0xE6060044, 32,
-			     1, 3, 3, 3, 3, 2, 2, 3, 3, 3, 3, 3, 3) {
+			     1, 3, 3, 3, 3, 2, 2, 3, 3, 3, 3, 3) {
 		/* IP9_31 [1] */
 		0, 0,
 		/* IP9_30_28 [3] */
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 091/639] pinctrl: sh-pfc: r8a77970: Add missing MOD_SEL0 field
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (89 preceding siblings ...)
  2020-01-24  9:24 ` [PATCH 4.19 090/639] pinctrl: sh-pfc: r8a7794: Remove bogus IPSR9 field Greg Kroah-Hartman
@ 2020-01-24  9:24 ` Greg Kroah-Hartman
  2020-01-24  9:24 ` [PATCH 4.19 092/639] pinctrl: sh-pfc: r8a77980: " Greg Kroah-Hartman
                   ` (551 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:24 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Geert Uytterhoeven, Simon Horman,
	Sasha Levin

From: Geert Uytterhoeven <geert+renesas@glider.be>

[ Upstream commit 67d7745bc78e16ec6b3af02bc1da6c8c868cbd89 ]

The Module Select Register 0 contains 20 (= 5 x 4) reserved bits, and 12
single-bit fields, but the variable field descriptor lacks a field of 4
reserved bits.

Fixes: b92ac66a1819602b ("pinctrl: sh-pfc: Add R8A77970 PFC support")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pinctrl/sh-pfc/pfc-r8a77970.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a77970.c b/drivers/pinctrl/sh-pfc/pfc-r8a77970.c
index eeb58b3bbc9a0..53fae9fd682b8 100644
--- a/drivers/pinctrl/sh-pfc/pfc-r8a77970.c
+++ b/drivers/pinctrl/sh-pfc/pfc-r8a77970.c
@@ -2354,7 +2354,7 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = {
 #define F_(x, y)	x,
 #define FM(x)		FN_##x,
 	{ PINMUX_CFG_REG_VAR("MOD_SEL0", 0xe6060500, 32,
-			     4, 4, 4, 4,
+			     4, 4, 4, 4, 4,
 			     1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1) {
 		/* RESERVED 31, 30, 29, 28 */
 		0, 0, 0, 0, 0, 0, 0, 0,	0, 0, 0, 0, 0, 0, 0, 0,
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 092/639] pinctrl: sh-pfc: r8a77980: Add missing MOD_SEL0 field
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (90 preceding siblings ...)
  2020-01-24  9:24 ` [PATCH 4.19 091/639] pinctrl: sh-pfc: r8a77970: Add missing MOD_SEL0 field Greg Kroah-Hartman
@ 2020-01-24  9:24 ` Greg Kroah-Hartman
  2020-01-24  9:24 ` [PATCH 4.19 093/639] pinctrl: sh-pfc: sh7734: Add missing IPSR11 field Greg Kroah-Hartman
                   ` (550 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:24 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Geert Uytterhoeven, Simon Horman,
	Sasha Levin

From: Geert Uytterhoeven <geert+renesas@glider.be>

[ Upstream commit b0f77269f6bba385f1f4dce44e7756cf8fbc0176 ]

The Module Select Register 0 contains 20 (= 5 x 4) reserved bits, and 12
single-bit fields, but the variable field descriptor lacks a field of 4
reserved bits.

Fixes: f59125248a691dfe ("pinctrl: sh-pfc: Add R8A77980 PFC support")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pinctrl/sh-pfc/pfc-r8a77980.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a77980.c b/drivers/pinctrl/sh-pfc/pfc-r8a77980.c
index 3f6967331f646..81a710bb8555e 100644
--- a/drivers/pinctrl/sh-pfc/pfc-r8a77980.c
+++ b/drivers/pinctrl/sh-pfc/pfc-r8a77980.c
@@ -2751,7 +2751,7 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = {
 #define F_(x, y)	x,
 #define FM(x)		FN_##x,
 	{ PINMUX_CFG_REG_VAR("MOD_SEL0", 0xe6060500, 32,
-			     4, 4, 4, 4,
+			     4, 4, 4, 4, 4,
 			     1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1) {
 		/* RESERVED 31, 30, 29, 28 */
 		0, 0, 0, 0, 0, 0, 0, 0,	0, 0, 0, 0, 0, 0, 0, 0,
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 093/639] pinctrl: sh-pfc: sh7734: Add missing IPSR11 field
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (91 preceding siblings ...)
  2020-01-24  9:24 ` [PATCH 4.19 092/639] pinctrl: sh-pfc: r8a77980: " Greg Kroah-Hartman
@ 2020-01-24  9:24 ` Greg Kroah-Hartman
  2020-01-24  9:24 ` [PATCH 4.19 094/639] pinctrl: sh-pfc: r8a77995: Remove bogus SEL_PWM[0-3]_3 configurations Greg Kroah-Hartman
                   ` (549 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:24 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Geert Uytterhoeven, Simon Horman,
	Sasha Levin

From: Geert Uytterhoeven <geert+renesas@glider.be>

[ Upstream commit 94482af7055e1ffa211c1135256b85590ebcac99 ]

The Peripheral Function Select Register 11 contains 3 reserved bits and
15 variable-width fields, but the variable field descriptor does not
contain the 3-bit field IP11[25:23].

Fixes: 856cb4bb337ee504 ("sh: Add support pinmux for SH7734")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pinctrl/sh-pfc/pfc-sh7734.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/pinctrl/sh-pfc/pfc-sh7734.c b/drivers/pinctrl/sh-pfc/pfc-sh7734.c
index 3eccc9b3ca84a..05ccb27f77818 100644
--- a/drivers/pinctrl/sh-pfc/pfc-sh7734.c
+++ b/drivers/pinctrl/sh-pfc/pfc-sh7734.c
@@ -2237,7 +2237,7 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = {
 		FN_LCD_DATA15_B, 0, 0, 0 }
 	},
 	{ PINMUX_CFG_REG_VAR("IPSR11", 0xFFFC0048, 32,
-			3, 1, 2, 2, 2, 3, 3, 1, 2, 3, 3, 1, 1, 1, 1) {
+			3, 1, 2, 3, 2, 2, 3, 3, 1, 2, 3, 3, 1, 1, 1, 1) {
 	    /* IP11_31_29 [3] */
 	    0, 0, 0, 0, 0, 0, 0, 0,
 	    /* IP11_28 [1] */
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 094/639] pinctrl: sh-pfc: r8a77995: Remove bogus SEL_PWM[0-3]_3 configurations
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (92 preceding siblings ...)
  2020-01-24  9:24 ` [PATCH 4.19 093/639] pinctrl: sh-pfc: sh7734: Add missing IPSR11 field Greg Kroah-Hartman
@ 2020-01-24  9:24 ` Greg Kroah-Hartman
  2020-01-24  9:24 ` [PATCH 4.19 095/639] pinctrl: sh-pfc: sh7269: Add missing PCIOR0 field Greg Kroah-Hartman
                   ` (548 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:24 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Geert Uytterhoeven, Simon Horman,
	Sasha Levin

From: Geert Uytterhoeven <geert+renesas@glider.be>

[ Upstream commit e28dc3f09c9d2555a9bd982f0847988591052226 ]

While the SEL_PWM[0-3] fields in the Module Select Register 0 support 4
possible configurations per PWM pin, only the first 3 are valid.

Replace the invalid and unused configurations for SEL_PWM[0-3]_3 by
dummies.

Fixes: 794a6711764658a1 ("pinctrl: sh-pfc: Initial R8A77995 PFC support")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pinctrl/sh-pfc/pfc-r8a77995.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a77995.c b/drivers/pinctrl/sh-pfc/pfc-r8a77995.c
index adade5b7ffbc2..337c80bde8f93 100644
--- a/drivers/pinctrl/sh-pfc/pfc-r8a77995.c
+++ b/drivers/pinctrl/sh-pfc/pfc-r8a77995.c
@@ -391,10 +391,10 @@ FM(IP12_31_28)	IP12_31_28 \
 #define MOD_SEL0_27		FM(SEL_MSIOF3_0)	FM(SEL_MSIOF3_1)
 #define MOD_SEL0_26		FM(SEL_HSCIF3_0)	FM(SEL_HSCIF3_1)
 #define MOD_SEL0_25		FM(SEL_SCIF4_0)		FM(SEL_SCIF4_1)
-#define MOD_SEL0_24_23		FM(SEL_PWM0_0)		FM(SEL_PWM0_1)		FM(SEL_PWM0_2)		FM(SEL_PWM0_3)
-#define MOD_SEL0_22_21		FM(SEL_PWM1_0)		FM(SEL_PWM1_1)		FM(SEL_PWM1_2)		FM(SEL_PWM1_3)
-#define MOD_SEL0_20_19		FM(SEL_PWM2_0)		FM(SEL_PWM2_1)		FM(SEL_PWM2_2)		FM(SEL_PWM2_3)
-#define MOD_SEL0_18_17		FM(SEL_PWM3_0)		FM(SEL_PWM3_1)		FM(SEL_PWM3_2)		FM(SEL_PWM3_3)
+#define MOD_SEL0_24_23		FM(SEL_PWM0_0)		FM(SEL_PWM0_1)		FM(SEL_PWM0_2)		F_(0, 0)
+#define MOD_SEL0_22_21		FM(SEL_PWM1_0)		FM(SEL_PWM1_1)		FM(SEL_PWM1_2)		F_(0, 0)
+#define MOD_SEL0_20_19		FM(SEL_PWM2_0)		FM(SEL_PWM2_1)		FM(SEL_PWM2_2)		F_(0, 0)
+#define MOD_SEL0_18_17		FM(SEL_PWM3_0)		FM(SEL_PWM3_1)		FM(SEL_PWM3_2)		F_(0, 0)
 #define MOD_SEL0_15		FM(SEL_IRQ_0_0)		FM(SEL_IRQ_0_1)
 #define MOD_SEL0_14		FM(SEL_IRQ_1_0)		FM(SEL_IRQ_1_1)
 #define MOD_SEL0_13		FM(SEL_IRQ_2_0)		FM(SEL_IRQ_2_1)
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 095/639] pinctrl: sh-pfc: sh7269: Add missing PCIOR0 field
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (93 preceding siblings ...)
  2020-01-24  9:24 ` [PATCH 4.19 094/639] pinctrl: sh-pfc: r8a77995: Remove bogus SEL_PWM[0-3]_3 configurations Greg Kroah-Hartman
@ 2020-01-24  9:24 ` Greg Kroah-Hartman
  2020-01-24  9:24 ` [PATCH 4.19 096/639] pinctrl: sh-pfc: sh7734: Remove bogus IPSR10 value Greg Kroah-Hartman
                   ` (547 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:24 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Geert Uytterhoeven, Simon Horman,
	Sasha Levin

From: Geert Uytterhoeven <geert+renesas@glider.be>

[ Upstream commit 9540cbdfcd861caf67a6f0e4bb7f46d41c4aad86 ]

The Port C I/O Register 0 contains 7 reserved bits, but the descriptor
contains only dummy configuration values for 6 reserved bits, thus
breaking the configuration of all subsequent fields in the register.

Fix this by adding the two missing configuration values.

Fixes: f5e811f2a43117b2 ("sh-pfc: Add sh7269 pinmux support")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pinctrl/sh-pfc/pfc-sh7269.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/pinctrl/sh-pfc/pfc-sh7269.c b/drivers/pinctrl/sh-pfc/pfc-sh7269.c
index a50d22bef1f44..cfdb4fc177c3e 100644
--- a/drivers/pinctrl/sh-pfc/pfc-sh7269.c
+++ b/drivers/pinctrl/sh-pfc/pfc-sh7269.c
@@ -2119,7 +2119,7 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = {
 	},
 
 	{ PINMUX_CFG_REG("PCIOR0", 0xfffe3852, 16, 1) {
-		0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+		0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
 		PC8_IN, PC8_OUT,
 		PC7_IN, PC7_OUT,
 		PC6_IN, PC6_OUT,
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 096/639] pinctrl: sh-pfc: sh7734: Remove bogus IPSR10 value
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (94 preceding siblings ...)
  2020-01-24  9:24 ` [PATCH 4.19 095/639] pinctrl: sh-pfc: sh7269: Add missing PCIOR0 field Greg Kroah-Hartman
@ 2020-01-24  9:24 ` Greg Kroah-Hartman
  2020-01-24  9:24 ` [PATCH 4.19 097/639] net: hns3: fix error handling int the hns3_get_vector_ring_chain Greg Kroah-Hartman
                   ` (546 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:24 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Geert Uytterhoeven, Simon Horman,
	Sasha Levin

From: Geert Uytterhoeven <geert+renesas@glider.be>

[ Upstream commit 4d374bacd7c9665179f9752a52d5d602c45d8190 ]

The IP10[5:3] field in Peripheral Function Select Register 10 has a
width of 3 bits, i.e. it allows programming one out of 8 different
configurations.
However, 9 values are provided instead of 8, overflowing into the
subsequent field in the register, and thus breaking the configuration of
the latter.

Fix this by dropping a bogus zero value.

Fixes: ac1ebc2190f575fc ("sh-pfc: Add sh7734 pinmux support")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pinctrl/sh-pfc/pfc-sh7734.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/pinctrl/sh-pfc/pfc-sh7734.c b/drivers/pinctrl/sh-pfc/pfc-sh7734.c
index 05ccb27f77818..c691e5e9d9dea 100644
--- a/drivers/pinctrl/sh-pfc/pfc-sh7734.c
+++ b/drivers/pinctrl/sh-pfc/pfc-sh7734.c
@@ -2231,7 +2231,7 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = {
 		FN_LCD_CL1_B, 0, 0,
 	    /* IP10_5_3 [3] */
 		FN_SSI_WS23, FN_VI1_5_B, FN_TX1_D, FN_HSCK0_C, FN_FALE_B,
-		FN_LCD_DON_B, 0, 0, 0,
+		FN_LCD_DON_B, 0, 0,
 	    /* IP10_2_0 [3] */
 		FN_SSI_SCK23, FN_VI1_4_B, FN_RX1_D, FN_FCLE_B,
 		FN_LCD_DATA15_B, 0, 0, 0 }
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 097/639] net: hns3: fix error handling int the hns3_get_vector_ring_chain
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (95 preceding siblings ...)
  2020-01-24  9:24 ` [PATCH 4.19 096/639] pinctrl: sh-pfc: sh7734: Remove bogus IPSR10 value Greg Kroah-Hartman
@ 2020-01-24  9:24 ` Greg Kroah-Hartman
  2020-01-24  9:24 ` [PATCH 4.19 098/639] vxlan: changelink: Fix handling of default remotes Greg Kroah-Hartman
                   ` (545 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:24 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Huazhong Tan, Peng Li,
	David S. Miller, Sasha Levin

From: Huazhong Tan <tanhuazhong@huawei.com>

[ Upstream commit cda69d244585bc4497d3bb878c22fe2b6ad647c1 ]

When hns3_get_vector_ring_chain() failed in the
hns3_nic_init_vector_data(), it should do the error handling instead
of return directly.

Also, cur_chain should be freed instead of chain and head->next should
be set to NULL in error handling of hns3_get_vector_ring_chain.

This patch fixes them.

Fixes: 73b907a083b8 ("net: hns3: bugfix for buffer not free problem during resetting")
Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com>
Signed-off-by: Peng Li <lipeng321@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
index 9df807ec8c840..10fa7f5df57e7 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
@@ -2605,9 +2605,10 @@ err_free_chain:
 	cur_chain = head->next;
 	while (cur_chain) {
 		chain = cur_chain->next;
-		devm_kfree(&pdev->dev, chain);
+		devm_kfree(&pdev->dev, cur_chain);
 		cur_chain = chain;
 	}
+	head->next = NULL;
 
 	return -ENOMEM;
 }
@@ -2679,7 +2680,7 @@ static int hns3_nic_init_vector_data(struct hns3_nic_priv *priv)
 		ret = hns3_get_vector_ring_chain(tqp_vector,
 						 &vector_ring_chain);
 		if (ret)
-			return ret;
+			goto map_ring_fail;
 
 		ret = h->ae_algo->ops->map_ring_to_vector(h,
 			tqp_vector->vector_irq, &vector_ring_chain);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 098/639] vxlan: changelink: Fix handling of default remotes
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (96 preceding siblings ...)
  2020-01-24  9:24 ` [PATCH 4.19 097/639] net: hns3: fix error handling int the hns3_get_vector_ring_chain Greg Kroah-Hartman
@ 2020-01-24  9:24 ` Greg Kroah-Hartman
  2020-01-24  9:24 ` [PATCH 4.19 099/639] Input: nomadik-ske-keypad - fix a loop timeout test Greg Kroah-Hartman
                   ` (544 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:24 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Petr Machata, Roopa Prabhu,
	David S. Miller, Sasha Levin

From: Petr Machata <petrm@mellanox.com>

[ Upstream commit ce5e098f7a10b4bf8e948c12fa350320c5c3afad ]

Default remotes are stored as FDB entries with an Ethernet address of
00:00:00:00:00:00. When a request is made to change a remote address of
a VXLAN device, vxlan_changelink() first deletes the existing default
remote, and then creates a new FDB entry.

This works well as long as the list of default remotes matches exactly
the configuration of a VXLAN remote address. Thus when the VXLAN device
has a remote of X, there should be exactly one default remote FDB entry
X. If the VXLAN device has no remote address, there should be no such
entry.

Besides using "ip link set", it is possible to manipulate the list of
default remotes by using the "bridge fdb". It is therefore easy to break
the above condition. Under such circumstances, the __vxlan_fdb_delete()
call doesn't delete the FDB entry itself, but just one remote. The
following vxlan_fdb_create() then creates a new FDB entry, leading to a
situation where two entries exist for the address 00:00:00:00:00:00,
each with a different subset of default remotes.

An even more obvious breakage rooted in the same cause can be observed
when a remote address is configured for a VXLAN device that did not have
one before. In that case vxlan_changelink() doesn't remove any remote,
and just creates a new FDB entry for the new address:

$ ip link add name vx up type vxlan id 2000 dstport 4789
$ bridge fdb ap dev vx 00:00:00:00:00:00 dst 192.0.2.20 self permanent
$ bridge fdb ap dev vx 00:00:00:00:00:00 dst 192.0.2.30 self permanent
$ ip link set dev vx type vxlan remote 192.0.2.30
$ bridge fdb sh dev vx | grep 00:00:00:00:00:00
00:00:00:00:00:00 dst 192.0.2.30 self permanent <- new entry, 1 rdst
00:00:00:00:00:00 dst 192.0.2.20 self permanent <- orig. entry, 2 rdsts
00:00:00:00:00:00 dst 192.0.2.30 self permanent

To fix this, instead of calling vxlan_fdb_create() directly, defer to
vxlan_fdb_update(). That has logic to handle the duplicates properly.
Additionally, it also handles notifications, so drop that call from
changelink as well.

Fixes: 0241b836732f ("vxlan: fix default fdb entry netlink notify ordering during netdev create")
Signed-off-by: Petr Machata <petrm@mellanox.com>
Acked-by: Roopa Prabhu <roopa@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/vxlan.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index 613f366818536..df88981e796a4 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -3496,7 +3496,6 @@ static int vxlan_changelink(struct net_device *dev, struct nlattr *tb[],
 	struct vxlan_rdst *dst = &vxlan->default_dst;
 	struct vxlan_rdst old_dst;
 	struct vxlan_config conf;
-	struct vxlan_fdb *f = NULL;
 	int err;
 
 	err = vxlan_nl2conf(tb, data,
@@ -3522,19 +3521,19 @@ static int vxlan_changelink(struct net_device *dev, struct nlattr *tb[],
 					   old_dst.remote_ifindex, 0);
 
 		if (!vxlan_addr_any(&dst->remote_ip)) {
-			err = vxlan_fdb_create(vxlan, all_zeros_mac,
+			err = vxlan_fdb_update(vxlan, all_zeros_mac,
 					       &dst->remote_ip,
 					       NUD_REACHABLE | NUD_PERMANENT,
+					       NLM_F_APPEND | NLM_F_CREATE,
 					       vxlan->cfg.dst_port,
 					       dst->remote_vni,
 					       dst->remote_vni,
 					       dst->remote_ifindex,
-					       NTF_SELF, &f);
+					       NTF_SELF);
 			if (err) {
 				spin_unlock_bh(&vxlan->hash_lock);
 				return err;
 			}
-			vxlan_fdb_notify(vxlan, f, first_remote_rtnl(f), RTM_NEWNEIGH);
 		}
 		spin_unlock_bh(&vxlan->hash_lock);
 	}
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 099/639] Input: nomadik-ske-keypad - fix a loop timeout test
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (97 preceding siblings ...)
  2020-01-24  9:24 ` [PATCH 4.19 098/639] vxlan: changelink: Fix handling of default remotes Greg Kroah-Hartman
@ 2020-01-24  9:24 ` Greg Kroah-Hartman
  2020-01-24  9:24 ` [PATCH 4.19 100/639] fork,memcg: fix crash in free_thread_stack on memcg charge fail Greg Kroah-Hartman
                   ` (543 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:24 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Dmitry Torokhov, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit 4d8f727b83bcd6702c2d210330872c9122d2d360 ]

The loop exits with "timeout" set to -1 not to 0.

Fixes: 1158f0f16224 ("Input: add support for Nomadik SKE keypad controller")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/input/keyboard/nomadik-ske-keypad.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/input/keyboard/nomadik-ske-keypad.c b/drivers/input/keyboard/nomadik-ske-keypad.c
index 8567ee47761e1..ae3b045570740 100644
--- a/drivers/input/keyboard/nomadik-ske-keypad.c
+++ b/drivers/input/keyboard/nomadik-ske-keypad.c
@@ -100,7 +100,7 @@ static int __init ske_keypad_chip_init(struct ske_keypad *keypad)
 	while ((readl(keypad->reg_base + SKE_RIS) != 0x00000000) && timeout--)
 		cpu_relax();
 
-	if (!timeout)
+	if (timeout == -1)
 		return -EINVAL;
 
 	/*
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 100/639] fork,memcg: fix crash in free_thread_stack on memcg charge fail
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (98 preceding siblings ...)
  2020-01-24  9:24 ` [PATCH 4.19 099/639] Input: nomadik-ske-keypad - fix a loop timeout test Greg Kroah-Hartman
@ 2020-01-24  9:24 ` Greg Kroah-Hartman
  2020-01-24  9:24 ` [PATCH 4.19 101/639] clk: highbank: fix refcount leak in hb_clk_init() Greg Kroah-Hartman
                   ` (542 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:24 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Rik van Riel, Roman Gushchin,
	Michal Hocko, Shakeel Butt, Johannes Weiner, Tejun Heo,
	Andrew Morton, Linus Torvalds, Sasha Levin

From: Rik van Riel <riel@surriel.com>

[ Upstream commit 5eed6f1dff87bfb5e545935def3843edf42800f2 ]

Commit 9b6f7e163cd0 ("mm: rework memcg kernel stack accounting") will
result in fork failing if allocating a kernel stack for a task in
dup_task_struct exceeds the kernel memory allowance for that cgroup.

Unfortunately, it also results in a crash.

This is due to the code jumping to free_stack and calling
free_thread_stack when the memcg kernel stack charge fails, but without
tsk->stack pointing at the freshly allocated stack.

This in turn results in the vfree_atomic in free_thread_stack oopsing
with a backtrace like this:

#5 [ffffc900244efc88] die at ffffffff8101f0ab
 #6 [ffffc900244efcb8] do_general_protection at ffffffff8101cb86
 #7 [ffffc900244efce0] general_protection at ffffffff818ff082
    [exception RIP: llist_add_batch+7]
    RIP: ffffffff8150d487  RSP: ffffc900244efd98  RFLAGS: 00010282
    RAX: 0000000000000000  RBX: ffff88085ef55980  RCX: 0000000000000000
    RDX: ffff88085ef55980  RSI: 343834343531203a  RDI: 343834343531203a
    RBP: ffffc900244efd98   R8: 0000000000000001   R9: ffff8808578c3600
    R10: 0000000000000000  R11: 0000000000000001  R12: ffff88029f6c21c0
    R13: 0000000000000286  R14: ffff880147759b00  R15: 0000000000000000
    ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018
 #8 [ffffc900244efda0] vfree_atomic at ffffffff811df2c7
 #9 [ffffc900244efdb8] copy_process at ffffffff81086e37
#10 [ffffc900244efe98] _do_fork at ffffffff810884e0
#11 [ffffc900244eff10] sys_vfork at ffffffff810887ff
#12 [ffffc900244eff20] do_syscall_64 at ffffffff81002a43
    RIP: 000000000049b948  RSP: 00007ffcdb307830  RFLAGS: 00000246
    RAX: ffffffffffffffda  RBX: 0000000000896030  RCX: 000000000049b948
    RDX: 0000000000000000  RSI: 00007ffcdb307790  RDI: 00000000005d7421
    RBP: 000000000067370f   R8: 00007ffcdb3077b0   R9: 000000000001ed00
    R10: 0000000000000008  R11: 0000000000000246  R12: 0000000000000040
    R13: 000000000000000f  R14: 0000000000000000  R15: 000000000088d018
    ORIG_RAX: 000000000000003a  CS: 0033  SS: 002b

The simplest fix is to assign tsk->stack right where it is allocated.

Link: http://lkml.kernel.org/r/20181214231726.7ee4843c@imladris.surriel.com
Fixes: 9b6f7e163cd0 ("mm: rework memcg kernel stack accounting")
Signed-off-by: Rik van Riel <riel@surriel.com>
Acked-by: Roman Gushchin <guro@fb.com>
Acked-by: Michal Hocko <mhocko@suse.com>
Cc: Shakeel Butt <shakeelb@google.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Tejun Heo <tj@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/fork.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/kernel/fork.c b/kernel/fork.c
index 8cb5cd7c97e19..5718c5decc55b 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -230,8 +230,10 @@ static unsigned long *alloc_thread_stack_node(struct task_struct *tsk, int node)
 	 * free_thread_stack() can be called in interrupt context,
 	 * so cache the vm_struct.
 	 */
-	if (stack)
+	if (stack) {
 		tsk->stack_vm_area = find_vm_area(stack);
+		tsk->stack = stack;
+	}
 	return stack;
 #else
 	struct page *page = alloc_pages_node(node, THREADINFO_GFP,
@@ -268,7 +270,10 @@ static struct kmem_cache *thread_stack_cache;
 static unsigned long *alloc_thread_stack_node(struct task_struct *tsk,
 						  int node)
 {
-	return kmem_cache_alloc_node(thread_stack_cache, THREADINFO_GFP, node);
+	unsigned long *stack;
+	stack = kmem_cache_alloc_node(thread_stack_cache, THREADINFO_GFP, node);
+	tsk->stack = stack;
+	return stack;
 }
 
 static void free_thread_stack(struct task_struct *tsk)
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 101/639] clk: highbank: fix refcount leak in hb_clk_init()
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (99 preceding siblings ...)
  2020-01-24  9:24 ` [PATCH 4.19 100/639] fork,memcg: fix crash in free_thread_stack on memcg charge fail Greg Kroah-Hartman
@ 2020-01-24  9:24 ` Greg Kroah-Hartman
  2020-01-24  9:24 ` [PATCH 4.19 102/639] clk: qoriq: fix refcount leak in clockgen_init() Greg Kroah-Hartman
                   ` (541 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:24 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yangtao Li, Stephen Boyd, Sasha Levin

From: Yangtao Li <tiny.windzz@gmail.com>

[ Upstream commit 5eb8ba90958de1285120dae5d3a5d2b1a360b3b4 ]

The of_find_compatible_node() returns a node pointer with refcount
incremented, but there is the lack of use of the of_node_put() when
done. Add the missing of_node_put() to release the refcount.

Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
Fixes: 26cae166cff9 ("ARM: highbank: remove custom .init_time hook")
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/clk-highbank.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/clk/clk-highbank.c b/drivers/clk/clk-highbank.c
index 727ed8e1bb726..8e4581004695c 100644
--- a/drivers/clk/clk-highbank.c
+++ b/drivers/clk/clk-highbank.c
@@ -293,6 +293,7 @@ static __init struct clk *hb_clk_init(struct device_node *node, const struct clk
 	/* Map system registers */
 	srnp = of_find_compatible_node(NULL, NULL, "calxeda,hb-sregs");
 	hb_clk->reg = of_iomap(srnp, 0);
+	of_node_put(srnp);
 	BUG_ON(!hb_clk->reg);
 	hb_clk->reg += reg;
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 102/639] clk: qoriq: fix refcount leak in clockgen_init()
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (100 preceding siblings ...)
  2020-01-24  9:24 ` [PATCH 4.19 101/639] clk: highbank: fix refcount leak in hb_clk_init() Greg Kroah-Hartman
@ 2020-01-24  9:24 ` Greg Kroah-Hartman
  2020-01-24  9:24 ` [PATCH 4.19 103/639] clk: ti: fix refcount leak in ti_dt_clocks_register() Greg Kroah-Hartman
                   ` (540 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:24 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yangtao Li, Stephen Boyd, Sasha Levin

From: Yangtao Li <tiny.windzz@gmail.com>

[ Upstream commit 70af6c5b5270e8101f318c4b69cc98a726edfab9 ]

The of_find_compatible_node() returns a node pointer with refcount
incremented, but there is the lack of use of the of_node_put() when
done. Add the missing of_node_put() to release the refcount.

Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
Fixes: 0dfc86b3173f ("clk: qoriq: Move chip-specific knowledge into driver")
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/clk-qoriq.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/clk/clk-qoriq.c b/drivers/clk/clk-qoriq.c
index 8abc5c8cb8b8c..a0713b2a12f37 100644
--- a/drivers/clk/clk-qoriq.c
+++ b/drivers/clk/clk-qoriq.c
@@ -1389,6 +1389,7 @@ static void __init clockgen_init(struct device_node *np)
 				pr_err("%s: Couldn't map %pOF regs\n", __func__,
 				       guts);
 			}
+			of_node_put(guts);
 		}
 
 	}
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 103/639] clk: ti: fix refcount leak in ti_dt_clocks_register()
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (101 preceding siblings ...)
  2020-01-24  9:24 ` [PATCH 4.19 102/639] clk: qoriq: fix refcount leak in clockgen_init() Greg Kroah-Hartman
@ 2020-01-24  9:24 ` Greg Kroah-Hartman
  2020-01-24  9:24 ` [PATCH 4.19 104/639] clk: socfpga: fix refcount leak Greg Kroah-Hartman
                   ` (539 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:24 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yangtao Li, Stephen Boyd, Sasha Levin

From: Yangtao Li <tiny.windzz@gmail.com>

[ Upstream commit 2274d8001fbb5e1942fbcab5ad2eb15553b09ed2 ]

The of_find_compatible_node() returns a node pointer with refcount
incremented, but there is the lack of use of the of_node_put() when
done. Add the missing of_node_put() to release the refcount.

Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
Fixes: 5b385a45e001 ("clk: ti: add support for clkctrl aliases")
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/ti/clk.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/clk/ti/clk.c b/drivers/clk/ti/clk.c
index 27e0979b31586..0cc87c6ae91c9 100644
--- a/drivers/clk/ti/clk.c
+++ b/drivers/clk/ti/clk.c
@@ -188,9 +188,13 @@ void __init ti_dt_clocks_register(struct ti_dt_clk oclks[])
 			clkdev_add(&c->lk);
 		} else {
 			if (num_args && !has_clkctrl_data) {
-				if (of_find_compatible_node(NULL, NULL,
-							    "ti,clkctrl")) {
+				struct device_node *np;
+
+				np = of_find_compatible_node(NULL, NULL,
+							     "ti,clkctrl");
+				if (np) {
 					has_clkctrl_data = true;
+					of_node_put(np);
 				} else {
 					clkctrl_nodes_missing = true;
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 104/639] clk: socfpga: fix refcount leak
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (102 preceding siblings ...)
  2020-01-24  9:24 ` [PATCH 4.19 103/639] clk: ti: fix refcount leak in ti_dt_clocks_register() Greg Kroah-Hartman
@ 2020-01-24  9:24 ` Greg Kroah-Hartman
  2020-01-24  9:24 ` [PATCH 4.19 105/639] clk: samsung: exynos4: fix refcount leak in exynos4_get_xom() Greg Kroah-Hartman
                   ` (538 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:24 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yangtao Li, Stephen Boyd, Sasha Levin

From: Yangtao Li <tiny.windzz@gmail.com>

[ Upstream commit 7f9705beeb3759e69165e7aff588f6488ff6c1ac ]

The of_find_compatible_node() returns a node pointer with refcount
incremented, but there is the lack of use of the of_node_put() when
done. Add the missing of_node_put() to release the refcount.

Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
Fixes: 5343325ff3dd ("clk: socfpga: add a clock driver for the Arria 10 platform")
Fixes: a30d27ed739b ("clk: socfpga: fix clock driver for 3.15")
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/socfpga/clk-pll-a10.c | 1 +
 drivers/clk/socfpga/clk-pll.c     | 1 +
 2 files changed, 2 insertions(+)

diff --git a/drivers/clk/socfpga/clk-pll-a10.c b/drivers/clk/socfpga/clk-pll-a10.c
index 35fabe1a32c30..269467e8e07e1 100644
--- a/drivers/clk/socfpga/clk-pll-a10.c
+++ b/drivers/clk/socfpga/clk-pll-a10.c
@@ -95,6 +95,7 @@ static struct clk * __init __socfpga_pll_init(struct device_node *node,
 
 	clkmgr_np = of_find_compatible_node(NULL, NULL, "altr,clk-mgr");
 	clk_mgr_a10_base_addr = of_iomap(clkmgr_np, 0);
+	of_node_put(clkmgr_np);
 	BUG_ON(!clk_mgr_a10_base_addr);
 	pll_clk->hw.reg = clk_mgr_a10_base_addr + reg;
 
diff --git a/drivers/clk/socfpga/clk-pll.c b/drivers/clk/socfpga/clk-pll.c
index c7f463172e4b9..b4b44e9b59011 100644
--- a/drivers/clk/socfpga/clk-pll.c
+++ b/drivers/clk/socfpga/clk-pll.c
@@ -100,6 +100,7 @@ static __init struct clk *__socfpga_pll_init(struct device_node *node,
 
 	clkmgr_np = of_find_compatible_node(NULL, NULL, "altr,clk-mgr");
 	clk_mgr_base_addr = of_iomap(clkmgr_np, 0);
+	of_node_put(clkmgr_np);
 	BUG_ON(!clk_mgr_base_addr);
 	pll_clk->hw.reg = clk_mgr_base_addr + reg;
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 105/639] clk: samsung: exynos4: fix refcount leak in exynos4_get_xom()
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (103 preceding siblings ...)
  2020-01-24  9:24 ` [PATCH 4.19 104/639] clk: socfpga: fix refcount leak Greg Kroah-Hartman
@ 2020-01-24  9:24 ` Greg Kroah-Hartman
  2020-01-24  9:24 ` [PATCH 4.19 106/639] clk: imx6q: fix refcount leak in imx6q_clocks_init() Greg Kroah-Hartman
                   ` (537 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:24 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yangtao Li, Stephen Boyd, Sasha Levin

From: Yangtao Li <tiny.windzz@gmail.com>

[ Upstream commit cee82eb9532090cd1dc953e845d71f9b1445c84e ]

The of_find_compatible_node() returns a node pointer with refcount
incremented, but there is the lack of use of the of_node_put() when
done. Add the missing of_node_put() to release the refcount.

Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
Fixes: e062b571777f ("clk: exynos4: register clocks using common clock framework")
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/samsung/clk-exynos4.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/clk/samsung/clk-exynos4.c b/drivers/clk/samsung/clk-exynos4.c
index 0421960eb9633..442309b569203 100644
--- a/drivers/clk/samsung/clk-exynos4.c
+++ b/drivers/clk/samsung/clk-exynos4.c
@@ -1226,6 +1226,7 @@ static unsigned long __init exynos4_get_xom(void)
 			xom = readl(chipid_base + 8);
 
 		iounmap(chipid_base);
+		of_node_put(np);
 	}
 
 	return xom;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 106/639] clk: imx6q: fix refcount leak in imx6q_clocks_init()
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (104 preceding siblings ...)
  2020-01-24  9:24 ` [PATCH 4.19 105/639] clk: samsung: exynos4: fix refcount leak in exynos4_get_xom() Greg Kroah-Hartman
@ 2020-01-24  9:24 ` Greg Kroah-Hartman
  2020-01-24  9:24 ` [PATCH 4.19 107/639] clk: imx6sx: fix refcount leak in imx6sx_clocks_init() Greg Kroah-Hartman
                   ` (536 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:24 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yangtao Li, Stephen Boyd, Sasha Levin

From: Yangtao Li <tiny.windzz@gmail.com>

[ Upstream commit c9ec1d8fef31b5fc9e90e99f9bd685db5caa7c5e ]

The of_find_compatible_node() returns a node pointer with refcount
incremented, but there is the lack of use of the of_node_put() when
done. Add the missing of_node_put() to release the refcount.

Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
Fixes: 2acd1b6f889c ("ARM: i.MX6: implement clocks using common clock framework")
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/imx/clk-imx6q.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/clk/imx/clk-imx6q.c b/drivers/clk/imx/clk-imx6q.c
index c509324f63385..8ddf9b1f1677c 100644
--- a/drivers/clk/imx/clk-imx6q.c
+++ b/drivers/clk/imx/clk-imx6q.c
@@ -424,6 +424,7 @@ static void __init imx6q_clocks_init(struct device_node *ccm_node)
 	np = of_find_compatible_node(NULL, NULL, "fsl,imx6q-anatop");
 	anatop_base = base = of_iomap(np, 0);
 	WARN_ON(!base);
+	of_node_put(np);
 
 	/* Audio/video PLL post dividers do not work on i.MX6q revision 1.0 */
 	if (clk_on_imx6q() && imx_get_soc_revision() == IMX_CHIP_REVISION_1_0) {
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 107/639] clk: imx6sx: fix refcount leak in imx6sx_clocks_init()
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (105 preceding siblings ...)
  2020-01-24  9:24 ` [PATCH 4.19 106/639] clk: imx6q: fix refcount leak in imx6q_clocks_init() Greg Kroah-Hartman
@ 2020-01-24  9:24 ` Greg Kroah-Hartman
  2020-01-24  9:24 ` [PATCH 4.19 108/639] clk: imx7d: fix refcount leak in imx7d_clocks_init() Greg Kroah-Hartman
                   ` (535 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:24 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yangtao Li, Stephen Boyd, Sasha Levin

From: Yangtao Li <tiny.windzz@gmail.com>

[ Upstream commit 1731e14fb30212dd8c1e9f8fc1af061e56498c55 ]

The of_find_compatible_node() returns a node pointer with refcount
incremented, but there is the lack of use of the of_node_put() when
done. Add the missing of_node_put() to release the refcount.

Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
Fixes: d55135689019 ("ARM: imx: add clock driver for imx6sx")
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/imx/clk-imx6sx.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/clk/imx/clk-imx6sx.c b/drivers/clk/imx/clk-imx6sx.c
index d9f2890ffe62b..57ab96a477756 100644
--- a/drivers/clk/imx/clk-imx6sx.c
+++ b/drivers/clk/imx/clk-imx6sx.c
@@ -151,6 +151,7 @@ static void __init imx6sx_clocks_init(struct device_node *ccm_node)
 	np = of_find_compatible_node(NULL, NULL, "fsl,imx6sx-anatop");
 	base = of_iomap(np, 0);
 	WARN_ON(!base);
+	of_node_put(np);
 
 	clks[IMX6SX_PLL1_BYPASS_SRC] = imx_clk_mux("pll1_bypass_src", base + 0x00, 14, 1, pll_bypass_src_sels, ARRAY_SIZE(pll_bypass_src_sels));
 	clks[IMX6SX_PLL2_BYPASS_SRC] = imx_clk_mux("pll2_bypass_src", base + 0x30, 14, 1, pll_bypass_src_sels, ARRAY_SIZE(pll_bypass_src_sels));
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 108/639] clk: imx7d: fix refcount leak in imx7d_clocks_init()
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (106 preceding siblings ...)
  2020-01-24  9:24 ` [PATCH 4.19 107/639] clk: imx6sx: fix refcount leak in imx6sx_clocks_init() Greg Kroah-Hartman
@ 2020-01-24  9:24 ` Greg Kroah-Hartman
  2020-01-24  9:24 ` [PATCH 4.19 109/639] clk: vf610: fix refcount leak in vf610_clocks_init() Greg Kroah-Hartman
                   ` (534 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:24 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yangtao Li, Stephen Boyd, Sasha Levin

From: Yangtao Li <tiny.windzz@gmail.com>

[ Upstream commit 5f8c183a996b76bb09748073c856e4246fd4ce95 ]

The of_find_compatible_node() returns a node pointer with refcount
incremented, but there is the lack of use of the of_node_put() when
done. Add the missing of_node_put() to release the refcount.

Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
Fixes: 8f6d8094b215 ("ARM: imx: add imx7d clk tree support")
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/imx/clk-imx7d.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/clk/imx/clk-imx7d.c b/drivers/clk/imx/clk-imx7d.c
index 881b772c4ac97..83412bc36ebfb 100644
--- a/drivers/clk/imx/clk-imx7d.c
+++ b/drivers/clk/imx/clk-imx7d.c
@@ -413,6 +413,7 @@ static void __init imx7d_clocks_init(struct device_node *ccm_node)
 	np = of_find_compatible_node(NULL, NULL, "fsl,imx7d-anatop");
 	base = of_iomap(np, 0);
 	WARN_ON(!base);
+	of_node_put(np);
 
 	clks[IMX7D_PLL_ARM_MAIN_SRC]  = imx_clk_mux("pll_arm_main_src", base + 0x60, 14, 2, pll_bypass_src_sel, ARRAY_SIZE(pll_bypass_src_sel));
 	clks[IMX7D_PLL_DRAM_MAIN_SRC] = imx_clk_mux("pll_dram_main_src", base + 0x70, 14, 2, pll_bypass_src_sel, ARRAY_SIZE(pll_bypass_src_sel));
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 109/639] clk: vf610: fix refcount leak in vf610_clocks_init()
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (107 preceding siblings ...)
  2020-01-24  9:24 ` [PATCH 4.19 108/639] clk: imx7d: fix refcount leak in imx7d_clocks_init() Greg Kroah-Hartman
@ 2020-01-24  9:24 ` Greg Kroah-Hartman
  2020-01-24  9:24 ` [PATCH 4.19 110/639] clk: armada-370: fix refcount leak in a370_clk_init() Greg Kroah-Hartman
                   ` (533 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:24 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yangtao Li, Stephen Boyd, Sasha Levin

From: Yangtao Li <tiny.windzz@gmail.com>

[ Upstream commit 567177024e0313e4f0dcba7ba10c0732e50e655d ]

The of_find_compatible_node() returns a node pointer with refcount
incremented, but there is the lack of use of the of_node_put() when
done. Add the missing of_node_put() to release the refcount.

Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
Fixes: 1f2c5fd5f048 ("ARM: imx: add VF610 clock support")
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/imx/clk-vf610.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/clk/imx/clk-vf610.c b/drivers/clk/imx/clk-vf610.c
index 6dae54325a91d..a334667c450a1 100644
--- a/drivers/clk/imx/clk-vf610.c
+++ b/drivers/clk/imx/clk-vf610.c
@@ -203,6 +203,7 @@ static void __init vf610_clocks_init(struct device_node *ccm_node)
 	np = of_find_compatible_node(NULL, NULL, "fsl,vf610-anatop");
 	anatop_base = of_iomap(np, 0);
 	BUG_ON(!anatop_base);
+	of_node_put(np);
 
 	np = ccm_node;
 	ccm_base = of_iomap(np, 0);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 110/639] clk: armada-370: fix refcount leak in a370_clk_init()
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (108 preceding siblings ...)
  2020-01-24  9:24 ` [PATCH 4.19 109/639] clk: vf610: fix refcount leak in vf610_clocks_init() Greg Kroah-Hartman
@ 2020-01-24  9:24 ` Greg Kroah-Hartman
  2020-01-24  9:24 ` [PATCH 4.19 111/639] clk: kirkwood: fix refcount leak in kirkwood_clk_init() Greg Kroah-Hartman
                   ` (532 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:24 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yangtao Li, Gregory CLEMENT,
	Stephen Boyd, Sasha Levin

From: Yangtao Li <tiny.windzz@gmail.com>

[ Upstream commit a3c24050bdf70c958a8d98c2823b66ea761e6a31 ]

The of_find_compatible_node() returns a node pointer with refcount
incremented, but there is the lack of use of the of_node_put() when
done. Add the missing of_node_put() to release the refcount.

Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
Reviewed-by: Gregory CLEMENT <gregory.clement@bootlin.com>
Fixes: 07ad6836fa21 ("clk: mvebu: armada-370: maintain clock init order")
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/mvebu/armada-370.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/clk/mvebu/armada-370.c b/drivers/clk/mvebu/armada-370.c
index 2c7c1085f8830..8fdfa97900cd8 100644
--- a/drivers/clk/mvebu/armada-370.c
+++ b/drivers/clk/mvebu/armada-370.c
@@ -177,8 +177,10 @@ static void __init a370_clk_init(struct device_node *np)
 
 	mvebu_coreclk_setup(np, &a370_coreclks);
 
-	if (cgnp)
+	if (cgnp) {
 		mvebu_clk_gating_setup(cgnp, a370_gating_desc);
+		of_node_put(cgnp);
+	}
 }
 CLK_OF_DECLARE(a370_clk, "marvell,armada-370-core-clock", a370_clk_init);
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 111/639] clk: kirkwood: fix refcount leak in kirkwood_clk_init()
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (109 preceding siblings ...)
  2020-01-24  9:24 ` [PATCH 4.19 110/639] clk: armada-370: fix refcount leak in a370_clk_init() Greg Kroah-Hartman
@ 2020-01-24  9:24 ` Greg Kroah-Hartman
  2020-01-24  9:24 ` [PATCH 4.19 112/639] clk: armada-xp: fix refcount leak in axp_clk_init() Greg Kroah-Hartman
                   ` (531 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:24 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yangtao Li, Gregory CLEMENT,
	Stephen Boyd, Sasha Levin

From: Yangtao Li <tiny.windzz@gmail.com>

[ Upstream commit e7beeab9c61591cd0e690d8733d534c3f4278ff8 ]

The of_find_compatible_node() returns a node pointer with refcount
incremented, but there is the lack of use of the of_node_put() when
done. Add the missing of_node_put() to release the refcount.

Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
Reviewed-by: Gregory CLEMENT <gregory.clement@bootlin.com>
Fixes: 58d516ae95cb ("clk: mvebu: kirkwood: maintain clock init order")
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/mvebu/kirkwood.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/clk/mvebu/kirkwood.c b/drivers/clk/mvebu/kirkwood.c
index a2a8d614039da..890ebf623261b 100644
--- a/drivers/clk/mvebu/kirkwood.c
+++ b/drivers/clk/mvebu/kirkwood.c
@@ -333,6 +333,8 @@ static void __init kirkwood_clk_init(struct device_node *np)
 	if (cgnp) {
 		mvebu_clk_gating_setup(cgnp, kirkwood_gating_desc);
 		kirkwood_clk_muxing_setup(cgnp, kirkwood_mux_desc);
+
+		of_node_put(cgnp);
 	}
 }
 CLK_OF_DECLARE(kirkwood_clk, "marvell,kirkwood-core-clock",
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 112/639] clk: armada-xp: fix refcount leak in axp_clk_init()
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (110 preceding siblings ...)
  2020-01-24  9:24 ` [PATCH 4.19 111/639] clk: kirkwood: fix refcount leak in kirkwood_clk_init() Greg Kroah-Hartman
@ 2020-01-24  9:24 ` Greg Kroah-Hartman
  2020-01-24  9:24 ` [PATCH 4.19 113/639] clk: mv98dx3236: fix refcount leak in mv98dx3236_clk_init() Greg Kroah-Hartman
                   ` (530 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:24 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yangtao Li, Gregory CLEMENT,
	Stephen Boyd, Sasha Levin

From: Yangtao Li <tiny.windzz@gmail.com>

[ Upstream commit db20a90a4b6745dad62753f8bd2f66afdd5abc84 ]

The of_find_compatible_node() returns a node pointer with refcount
incremented, but there is the lack of use of the of_node_put() when
done. Add the missing of_node_put() to release the refcount.

Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
Reviewed-by: Gregory CLEMENT <gregory.clement@bootlin.com>
Fixes: 0a11a6ae9437 ("clk: mvebu: armada-xp: maintain clock init order")
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/mvebu/armada-xp.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/clk/mvebu/armada-xp.c b/drivers/clk/mvebu/armada-xp.c
index 0ec44ae9a2a26..df529982adc97 100644
--- a/drivers/clk/mvebu/armada-xp.c
+++ b/drivers/clk/mvebu/armada-xp.c
@@ -228,7 +228,9 @@ static void __init axp_clk_init(struct device_node *np)
 
 	mvebu_coreclk_setup(np, &axp_coreclks);
 
-	if (cgnp)
+	if (cgnp) {
 		mvebu_clk_gating_setup(cgnp, axp_gating_desc);
+		of_node_put(cgnp);
+	}
 }
 CLK_OF_DECLARE(axp_clk, "marvell,armada-xp-core-clock", axp_clk_init);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 113/639] clk: mv98dx3236: fix refcount leak in mv98dx3236_clk_init()
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (111 preceding siblings ...)
  2020-01-24  9:24 ` [PATCH 4.19 112/639] clk: armada-xp: fix refcount leak in axp_clk_init() Greg Kroah-Hartman
@ 2020-01-24  9:24 ` Greg Kroah-Hartman
  2020-01-24  9:24 ` [PATCH 4.19 114/639] clk: dove: fix refcount leak in dove_clk_init() Greg Kroah-Hartman
                   ` (529 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:24 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yangtao Li, Gregory CLEMENT,
	Stephen Boyd, Sasha Levin

From: Yangtao Li <tiny.windzz@gmail.com>

[ Upstream commit 9b4eedf627045ae5ddcff60a484200cdd554c413 ]

The of_find_compatible_node() returns a node pointer with refcount
incremented, but there is the lack of use of the of_node_put() when
done. Add the missing of_node_put() to release the refcount.

Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
Reviewed-by: Gregory CLEMENT <gregory.clement@bootlin.com>
Fixes: 337072604224 ("clk: mvebu: Expand mv98dx3236-core-clock support")
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/mvebu/mv98dx3236.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/clk/mvebu/mv98dx3236.c b/drivers/clk/mvebu/mv98dx3236.c
index 6e203af73cac1..c8a0d03d2cd60 100644
--- a/drivers/clk/mvebu/mv98dx3236.c
+++ b/drivers/clk/mvebu/mv98dx3236.c
@@ -174,7 +174,9 @@ static void __init mv98dx3236_clk_init(struct device_node *np)
 
 	mvebu_coreclk_setup(np, &mv98dx3236_core_clocks);
 
-	if (cgnp)
+	if (cgnp) {
 		mvebu_clk_gating_setup(cgnp, mv98dx3236_gating_desc);
+		of_node_put(cgnp);
+	}
 }
 CLK_OF_DECLARE(mv98dx3236_clk, "marvell,mv98dx3236-core-clock", mv98dx3236_clk_init);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 114/639] clk: dove: fix refcount leak in dove_clk_init()
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (112 preceding siblings ...)
  2020-01-24  9:24 ` [PATCH 4.19 113/639] clk: mv98dx3236: fix refcount leak in mv98dx3236_clk_init() Greg Kroah-Hartman
@ 2020-01-24  9:24 ` Greg Kroah-Hartman
  2020-01-24  9:24 ` [PATCH 4.19 115/639] MIPS: BCM63XX: drop unused and broken DSP platform device Greg Kroah-Hartman
                   ` (528 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:24 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yangtao Li, Gregory CLEMENT,
	Stephen Boyd, Sasha Levin

From: Yangtao Li <tiny.windzz@gmail.com>

[ Upstream commit 8d726c5128298386b907963033be93407b0c4275 ]

The of_find_compatible_node() returns a node pointer with refcount
incremented, but there is the lack of use of the of_node_put() when
done. Add the missing of_node_put() to release the refcount.

Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
Reviewed-by: Gregory CLEMENT <gregory.clement@bootlin.com>
Fixes: 8f7fc5450b64 ("clk: mvebu: dove: maintain clock init order")
Fixes: 63b8d92c793f ("clk: add Dove PLL divider support for GPU, VMeta and AXI clocks")
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/mvebu/dove.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/clk/mvebu/dove.c b/drivers/clk/mvebu/dove.c
index 59fad9546c847..5f258c9bb68bf 100644
--- a/drivers/clk/mvebu/dove.c
+++ b/drivers/clk/mvebu/dove.c
@@ -190,10 +190,14 @@ static void __init dove_clk_init(struct device_node *np)
 
 	mvebu_coreclk_setup(np, &dove_coreclks);
 
-	if (ddnp)
+	if (ddnp) {
 		dove_divider_clk_init(ddnp);
+		of_node_put(ddnp);
+	}
 
-	if (cgnp)
+	if (cgnp) {
 		mvebu_clk_gating_setup(cgnp, dove_gating_desc);
+		of_node_put(cgnp);
+	}
 }
 CLK_OF_DECLARE(dove_clk, "marvell,dove-core-clock", dove_clk_init);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 115/639] MIPS: BCM63XX: drop unused and broken DSP platform device
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (113 preceding siblings ...)
  2020-01-24  9:24 ` [PATCH 4.19 114/639] clk: dove: fix refcount leak in dove_clk_init() Greg Kroah-Hartman
@ 2020-01-24  9:24 ` Greg Kroah-Hartman
  2020-01-24  9:24 ` [PATCH 4.19 116/639] arm64: defconfig: Re-enable bcm2835-thermal driver Greg Kroah-Hartman
                   ` (527 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:24 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jonas Gorski, Paul Burton,
	Florian Fainelli, linux-mips, Ralf Baechle, James Hogan,
	Sasha Levin

From: Jonas Gorski <jonas.gorski@gmail.com>

[ Upstream commit 682fee802843b332f9c51ffc8e062de5ff773f2e ]

Trying to register the DSP platform device results in a null pointer
access:

[    0.124184] CPU 0 Unable to handle kernel paging request at virtual address 00000000, epc == 804e305c, ra == 804e6f20
[    0.135208] Oops[#1]:
[    0.137514] CPU: 0 PID: 1 Comm: swapper Not tainted 4.14.87
...
[    0.197117] epc   : 804e305c bcm63xx_dsp_register+0x80/0xa4
[    0.202838] ra    : 804e6f20 board_register_devices+0x258/0x390
...

This happens because it tries to copy the passed platform data over the
platform_device's unpopulated platform_data.

Since this code has been broken since its submission, no driver was ever
submitted for it, and apparently nobody was using it, just remove it
instead of trying to fix it.

Fixes: e7300d04bd08 ("MIPS: BCM63xx: Add support for the Broadcom BCM63xx family of SOCs.")
Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
Signed-off-by: Paul Burton <paul.burton@mips.com>
Acked-by: Florian Fainelli <f.fainelli@gmail.com>
Cc: linux-mips@linux-mips.org
Cc: Ralf Baechle <ralf@linux-mips.org>
Cc: James Hogan <jhogan@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/mips/bcm63xx/Makefile                    |  6 +-
 arch/mips/bcm63xx/boards/board_bcm963xx.c     | 20 -------
 arch/mips/bcm63xx/dev-dsp.c                   | 56 -------------------
 .../asm/mach-bcm63xx/bcm63xx_dev_dsp.h        | 14 -----
 .../include/asm/mach-bcm63xx/board_bcm963xx.h |  5 --
 5 files changed, 3 insertions(+), 98 deletions(-)
 delete mode 100644 arch/mips/bcm63xx/dev-dsp.c
 delete mode 100644 arch/mips/include/asm/mach-bcm63xx/bcm63xx_dev_dsp.h

diff --git a/arch/mips/bcm63xx/Makefile b/arch/mips/bcm63xx/Makefile
index c69f297fc1df3..d89651e538f64 100644
--- a/arch/mips/bcm63xx/Makefile
+++ b/arch/mips/bcm63xx/Makefile
@@ -1,8 +1,8 @@
 # SPDX-License-Identifier: GPL-2.0
 obj-y		+= clk.o cpu.o cs.o gpio.o irq.o nvram.o prom.o reset.o \
-		   setup.o timer.o dev-dsp.o dev-enet.o dev-flash.o \
-		   dev-pcmcia.o dev-rng.o dev-spi.o dev-hsspi.o dev-uart.o \
-		   dev-wdt.o dev-usb-usbd.o
+		   setup.o timer.o dev-enet.o dev-flash.o dev-pcmcia.o \
+		   dev-rng.o dev-spi.o dev-hsspi.o dev-uart.o dev-wdt.o \
+		   dev-usb-usbd.o
 obj-$(CONFIG_EARLY_PRINTK)	+= early_printk.o
 
 obj-y		+= boards/
diff --git a/arch/mips/bcm63xx/boards/board_bcm963xx.c b/arch/mips/bcm63xx/boards/board_bcm963xx.c
index b2097c0d2ed78..36ec3dc2c999a 100644
--- a/arch/mips/bcm63xx/boards/board_bcm963xx.c
+++ b/arch/mips/bcm63xx/boards/board_bcm963xx.c
@@ -23,7 +23,6 @@
 #include <bcm63xx_nvram.h>
 #include <bcm63xx_dev_pci.h>
 #include <bcm63xx_dev_enet.h>
-#include <bcm63xx_dev_dsp.h>
 #include <bcm63xx_dev_flash.h>
 #include <bcm63xx_dev_hsspi.h>
 #include <bcm63xx_dev_pcmcia.h>
@@ -289,14 +288,6 @@ static struct board_info __initdata board_96348gw_10 = {
 	.has_pccard			= 1,
 	.has_ehci0			= 1,
 
-	.has_dsp			= 1,
-	.dsp = {
-		.gpio_rst		= 6,
-		.gpio_int		= 34,
-		.cs			= 2,
-		.ext_irq		= 2,
-	},
-
 	.leds = {
 		{
 			.name		= "adsl-fail",
@@ -401,14 +392,6 @@ static struct board_info __initdata board_96348gw = {
 
 	.has_ohci0 = 1,
 
-	.has_dsp			= 1,
-	.dsp = {
-		.gpio_rst		= 6,
-		.gpio_int		= 34,
-		.ext_irq		= 2,
-		.cs			= 2,
-	},
-
 	.leds = {
 		{
 			.name		= "adsl-fail",
@@ -898,9 +881,6 @@ int __init board_register_devices(void)
 	if (board.has_usbd)
 		bcm63xx_usbd_register(&board.usbd);
 
-	if (board.has_dsp)
-		bcm63xx_dsp_register(&board.dsp);
-
 	/* Generate MAC address for WLAN and register our SPROM,
 	 * do this after registering enet devices
 	 */
diff --git a/arch/mips/bcm63xx/dev-dsp.c b/arch/mips/bcm63xx/dev-dsp.c
deleted file mode 100644
index 5bb5b154c9bd3..0000000000000
--- a/arch/mips/bcm63xx/dev-dsp.c
+++ /dev/null
@@ -1,56 +0,0 @@
-/*
- * Broadcom BCM63xx VoIP DSP registration
- *
- * This file is subject to the terms and conditions of the GNU General Public
- * License.  See the file "COPYING" in the main directory of this archive
- * for more details.
- *
- * Copyright (C) 2009 Florian Fainelli <florian@openwrt.org>
- */
-
-#include <linux/init.h>
-#include <linux/kernel.h>
-#include <linux/platform_device.h>
-
-#include <bcm63xx_cpu.h>
-#include <bcm63xx_dev_dsp.h>
-#include <bcm63xx_regs.h>
-#include <bcm63xx_io.h>
-
-static struct resource voip_dsp_resources[] = {
-	{
-		.start		= -1, /* filled at runtime */
-		.end		= -1, /* filled at runtime */
-		.flags		= IORESOURCE_MEM,
-	},
-	{
-		.start		= -1, /* filled at runtime */
-		.flags		= IORESOURCE_IRQ,
-	},
-};
-
-static struct platform_device bcm63xx_voip_dsp_device = {
-	.name		= "bcm63xx-voip-dsp",
-	.id		= -1,
-	.num_resources	= ARRAY_SIZE(voip_dsp_resources),
-	.resource	= voip_dsp_resources,
-};
-
-int __init bcm63xx_dsp_register(const struct bcm63xx_dsp_platform_data *pd)
-{
-	struct bcm63xx_dsp_platform_data *dpd;
-	u32 val;
-
-	/* Get the memory window */
-	val = bcm_mpi_readl(MPI_CSBASE_REG(pd->cs - 1));
-	val &= MPI_CSBASE_BASE_MASK;
-	voip_dsp_resources[0].start = val;
-	voip_dsp_resources[0].end = val + 0xFFFFFFF;
-	voip_dsp_resources[1].start = pd->ext_irq;
-
-	/* copy given platform data */
-	dpd = bcm63xx_voip_dsp_device.dev.platform_data;
-	memcpy(dpd, pd, sizeof (*pd));
-
-	return platform_device_register(&bcm63xx_voip_dsp_device);
-}
diff --git a/arch/mips/include/asm/mach-bcm63xx/bcm63xx_dev_dsp.h b/arch/mips/include/asm/mach-bcm63xx/bcm63xx_dev_dsp.h
deleted file mode 100644
index 4e4970787371a..0000000000000
--- a/arch/mips/include/asm/mach-bcm63xx/bcm63xx_dev_dsp.h
+++ /dev/null
@@ -1,14 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-#ifndef __BCM63XX_DSP_H
-#define __BCM63XX_DSP_H
-
-struct bcm63xx_dsp_platform_data {
-	unsigned gpio_rst;
-	unsigned gpio_int;
-	unsigned cs;
-	unsigned ext_irq;
-};
-
-int __init bcm63xx_dsp_register(const struct bcm63xx_dsp_platform_data *pd);
-
-#endif /* __BCM63XX_DSP_H */
diff --git a/arch/mips/include/asm/mach-bcm63xx/board_bcm963xx.h b/arch/mips/include/asm/mach-bcm63xx/board_bcm963xx.h
index 5e5b1bc4a3247..830f53f28e3f7 100644
--- a/arch/mips/include/asm/mach-bcm63xx/board_bcm963xx.h
+++ b/arch/mips/include/asm/mach-bcm63xx/board_bcm963xx.h
@@ -7,7 +7,6 @@
 #include <linux/leds.h>
 #include <bcm63xx_dev_enet.h>
 #include <bcm63xx_dev_usb_usbd.h>
-#include <bcm63xx_dev_dsp.h>
 
 /*
  * flash mapping
@@ -31,7 +30,6 @@ struct board_info {
 	unsigned int	has_ohci0:1;
 	unsigned int	has_ehci0:1;
 	unsigned int	has_usbd:1;
-	unsigned int	has_dsp:1;
 	unsigned int	has_uart0:1;
 	unsigned int	has_uart1:1;
 
@@ -43,9 +41,6 @@ struct board_info {
 	/* USB config */
 	struct bcm63xx_usbd_platform_data usbd;
 
-	/* DSP config */
-	struct bcm63xx_dsp_platform_data dsp;
-
 	/* GPIO LEDs */
 	struct gpio_led leds[5];
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 116/639] arm64: defconfig: Re-enable bcm2835-thermal driver
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (114 preceding siblings ...)
  2020-01-24  9:24 ` [PATCH 4.19 115/639] MIPS: BCM63XX: drop unused and broken DSP platform device Greg Kroah-Hartman
@ 2020-01-24  9:24 ` Greg Kroah-Hartman
  2020-01-24  9:24 ` [PATCH 4.19 117/639] remoteproc: qcom: q6v5-mss: Add missing clocks for MSM8996 Greg Kroah-Hartman
                   ` (526 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:24 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Stefan Wahren, Olof Johansson, Sasha Levin

From: Stefan Wahren <stefan.wahren@i2se.com>

[ Upstream commit 4d9226fd9a0d747030575d7cb184b30c6e64f155 ]

The bcm2835-thermal driver was added with commit ac178e4280e6
("ARM64: bcm2835: add thermal driver to default config"). Unfortunately
this was accidentally dropped by commit eb1e6716cc9c
("arm64: defconfig: sync with savedefconfig"). So enable the driver again.

Fixes: eb1e6716cc9c ("arm64: defconfig: sync with savedefconfig")
Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
Signed-off-by: Olof Johansson <olof@lixom.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/configs/defconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/arm64/configs/defconfig b/arch/arm64/configs/defconfig
index db8d364f84768..1a4f8b67bbe80 100644
--- a/arch/arm64/configs/defconfig
+++ b/arch/arm64/configs/defconfig
@@ -365,6 +365,7 @@ CONFIG_THERMAL_EMULATION=y
 CONFIG_ROCKCHIP_THERMAL=m
 CONFIG_RCAR_GEN3_THERMAL=y
 CONFIG_ARMADA_THERMAL=y
+CONFIG_BCM2835_THERMAL=m
 CONFIG_BRCMSTB_THERMAL=m
 CONFIG_EXYNOS_THERMAL=y
 CONFIG_TEGRA_BPMP_THERMAL=m
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 117/639] remoteproc: qcom: q6v5-mss: Add missing clocks for MSM8996
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (115 preceding siblings ...)
  2020-01-24  9:24 ` [PATCH 4.19 116/639] arm64: defconfig: Re-enable bcm2835-thermal driver Greg Kroah-Hartman
@ 2020-01-24  9:24 ` Greg Kroah-Hartman
  2020-01-24  9:24 ` [PATCH 4.19 118/639] remoteproc: qcom: q6v5-mss: Add missing regulator " Greg Kroah-Hartman
                   ` (525 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:24 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sibi Sankar, Bjorn Andersson, Sasha Levin

From: Sibi Sankar <sibis@codeaurora.org>

[ Upstream commit 80ec419c3404106c563aaf56aa6b516a59c4cdfb ]

Proxy vote for QDSS clock and remove vote on handover interrupt
to provide MSS PBL with access to STM hardware registers during
boot. Add "snoc_axi" and "mnoc_axi" to the active clock list.
Rename "gpll0_mss_clk" to "gpll0_mss" for consistency across SoCs.

Fixes: 9f058fa2efb1 ("remoteproc: qcom: Add support for mss remoteproc on msm8996")
Signed-off-by: Sibi Sankar <sibis@codeaurora.org>
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/remoteproc/qcom_q6v5_pil.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/remoteproc/qcom_q6v5_pil.c b/drivers/remoteproc/qcom_q6v5_pil.c
index 6a84b6372897d..073747ba80002 100644
--- a/drivers/remoteproc/qcom_q6v5_pil.c
+++ b/drivers/remoteproc/qcom_q6v5_pil.c
@@ -1271,13 +1271,16 @@ static const struct rproc_hexagon_res msm8996_mss = {
 	.proxy_clk_names = (char*[]){
 			"xo",
 			"pnoc",
+			"qdss",
 			NULL
 	},
 	.active_clk_names = (char*[]){
 			"iface",
 			"bus",
 			"mem",
-			"gpll0_mss_clk",
+			"gpll0_mss",
+			"snoc_axi",
+			"mnoc_axi",
 			NULL
 	},
 	.need_mem_protection = true,
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 118/639] remoteproc: qcom: q6v5-mss: Add missing regulator for MSM8996
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (116 preceding siblings ...)
  2020-01-24  9:24 ` [PATCH 4.19 117/639] remoteproc: qcom: q6v5-mss: Add missing clocks for MSM8996 Greg Kroah-Hartman
@ 2020-01-24  9:24 ` Greg Kroah-Hartman
  2020-01-24  9:24 ` [PATCH 4.19 119/639] drm: Fix error handling in drm_legacy_addctx Greg Kroah-Hartman
                   ` (524 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:24 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sibi Sankar, Bjorn Andersson, Sasha Levin

From: Sibi Sankar <sibis@codeaurora.org>

[ Upstream commit 47b874748d500020026ee43b386b5598e20f3a68 ]

Add proxy vote for pll supply on MSM8996 SoC.

Fixes: 9f058fa2efb1 ("remoteproc: qcom: Add support for mss remoteproc on msm8996")
Signed-off-by: Sibi Sankar <sibis@codeaurora.org>
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/remoteproc/qcom_q6v5_pil.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/remoteproc/qcom_q6v5_pil.c b/drivers/remoteproc/qcom_q6v5_pil.c
index 073747ba80002..cc475dcbf27f3 100644
--- a/drivers/remoteproc/qcom_q6v5_pil.c
+++ b/drivers/remoteproc/qcom_q6v5_pil.c
@@ -1268,6 +1268,13 @@ static const struct rproc_hexagon_res sdm845_mss = {
 
 static const struct rproc_hexagon_res msm8996_mss = {
 	.hexagon_mba_image = "mba.mbn",
+	.proxy_supply = (struct qcom_mss_reg_res[]) {
+		{
+			.supply = "pll",
+			.uA = 100000,
+		},
+		{}
+	},
 	.proxy_clk_names = (char*[]){
 			"xo",
 			"pnoc",
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 119/639] drm: Fix error handling in drm_legacy_addctx
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (117 preceding siblings ...)
  2020-01-24  9:24 ` [PATCH 4.19 118/639] remoteproc: qcom: q6v5-mss: Add missing regulator " Greg Kroah-Hartman
@ 2020-01-24  9:24 ` Greg Kroah-Hartman
  2020-01-24  9:24 ` [PATCH 4.19 120/639] ARM: dts: r8a7743: Remove generic compatible string from iic3 Greg Kroah-Hartman
                   ` (523 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:24 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, YueHaibing, Daniel Vetter, Sasha Levin

From: YueHaibing <yuehaibing@huawei.com>

[ Upstream commit c39191feed4540fed98badeb484833dcf659bb96 ]

'ctx->handle' is unsigned, it never less than zero.
This patch use int 'tmp_handle' to handle the err condition.

Fixes: 62968144e673 ("drm: convert drm context code to use Linux idr")
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20181229024907.12852-1-yuehaibing@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/drm_context.c | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/drivers/gpu/drm/drm_context.c b/drivers/gpu/drm/drm_context.c
index f973d287696a6..da5abf24f59ff 100644
--- a/drivers/gpu/drm/drm_context.c
+++ b/drivers/gpu/drm/drm_context.c
@@ -361,23 +361,26 @@ int drm_legacy_addctx(struct drm_device *dev, void *data,
 {
 	struct drm_ctx_list *ctx_entry;
 	struct drm_ctx *ctx = data;
+	int tmp_handle;
 
 	if (!drm_core_check_feature(dev, DRIVER_KMS_LEGACY_CONTEXT) &&
 	    !drm_core_check_feature(dev, DRIVER_LEGACY))
 		return -EINVAL;
 
-	ctx->handle = drm_legacy_ctxbitmap_next(dev);
-	if (ctx->handle == DRM_KERNEL_CONTEXT) {
+	tmp_handle = drm_legacy_ctxbitmap_next(dev);
+	if (tmp_handle == DRM_KERNEL_CONTEXT) {
 		/* Skip kernel's context and get a new one. */
-		ctx->handle = drm_legacy_ctxbitmap_next(dev);
+		tmp_handle = drm_legacy_ctxbitmap_next(dev);
 	}
-	DRM_DEBUG("%d\n", ctx->handle);
-	if (ctx->handle < 0) {
+	DRM_DEBUG("%d\n", tmp_handle);
+	if (tmp_handle < 0) {
 		DRM_DEBUG("Not enough free contexts.\n");
 		/* Should this return -EBUSY instead? */
-		return -ENOMEM;
+		return tmp_handle;
 	}
 
+	ctx->handle = tmp_handle;
+
 	ctx_entry = kmalloc(sizeof(*ctx_entry), GFP_KERNEL);
 	if (!ctx_entry) {
 		DRM_DEBUG("out of memory\n");
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 120/639] ARM: dts: r8a7743: Remove generic compatible string from iic3
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (118 preceding siblings ...)
  2020-01-24  9:24 ` [PATCH 4.19 119/639] drm: Fix error handling in drm_legacy_addctx Greg Kroah-Hartman
@ 2020-01-24  9:24 ` Greg Kroah-Hartman
  2020-01-24  9:24 ` [PATCH 4.19 121/639] drm/etnaviv: fix some off by one bugs Greg Kroah-Hartman
                   ` (522 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:24 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Biju Das, Geert Uytterhoeven,
	Simon Horman, Sasha Levin

From: Biju Das <biju.das@bp.renesas.com>

[ Upstream commit 072b817589b17660ef19c31d89f7b981dbed3fd2 ]

The iic3 block on RZ/G1M does not support automatic transmission, unlike
other R-Car SoC's. So dropping the compatibility with the generic version.

Fixes: f523405f2a22cc0c307 ("ARM: dts: r8a7743: Add IIC cores to dtsi")
Signed-off-by: Biju Das <biju.das@bp.renesas.com>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/r8a7743.dtsi | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/arch/arm/boot/dts/r8a7743.dtsi b/arch/arm/boot/dts/r8a7743.dtsi
index 24715f74ae08c..5015e2273d82f 100644
--- a/arch/arm/boot/dts/r8a7743.dtsi
+++ b/arch/arm/boot/dts/r8a7743.dtsi
@@ -565,9 +565,7 @@
 			/* doesn't need pinmux */
 			#address-cells = <1>;
 			#size-cells = <0>;
-			compatible = "renesas,iic-r8a7743",
-				     "renesas,rcar-gen2-iic",
-				     "renesas,rmobile-iic";
+			compatible = "renesas,iic-r8a7743";
 			reg = <0 0xe60b0000 0 0x425>;
 			interrupts = <GIC_SPI 173 IRQ_TYPE_LEVEL_HIGH>;
 			clocks = <&cpg CPG_MOD 926>;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 121/639] drm/etnaviv: fix some off by one bugs
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (119 preceding siblings ...)
  2020-01-24  9:24 ` [PATCH 4.19 120/639] ARM: dts: r8a7743: Remove generic compatible string from iic3 Greg Kroah-Hartman
@ 2020-01-24  9:24 ` Greg Kroah-Hartman
  2020-01-24  9:24 ` [PATCH 4.19 122/639] drm/fb-helper: generic: Fix setup error path Greg Kroah-Hartman
                   ` (521 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:24 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Christian Gmeiner,
	Lucas Stach, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit f5fd9fd4000984f19db689282054953981a50534 ]

The ->nr_signal is the supposed to be the number of elements in the
->signal array.  There was one place where it was 5 but it was supposed
to be 4.  That looks like a copy and paste bug.  There were also two
checks that were off by one.

Fixes: 9e2c2e273012 ("drm/etnaviv: add infrastructure to query perf counter")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Christian Gmeiner <christian.gmeiner@gmail.com>
Tested-by: Christian Gmeiner <christian.gmeiner@gmail.com>
Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/etnaviv/etnaviv_perfmon.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/etnaviv/etnaviv_perfmon.c b/drivers/gpu/drm/etnaviv/etnaviv_perfmon.c
index 9980d81a26e3c..4227a4006c349 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_perfmon.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_perfmon.c
@@ -113,7 +113,7 @@ static const struct etnaviv_pm_domain doms_3d[] = {
 		.name = "PE",
 		.profile_read = VIVS_MC_PROFILE_PE_READ,
 		.profile_config = VIVS_MC_PROFILE_CONFIG0,
-		.nr_signals = 5,
+		.nr_signals = 4,
 		.signal = (const struct etnaviv_pm_signal[]) {
 			{
 				"PIXEL_COUNT_KILLED_BY_COLOR_PIPE",
@@ -435,7 +435,7 @@ int etnaviv_pm_query_sig(struct etnaviv_gpu *gpu,
 
 	dom = meta->domains + signal->domain;
 
-	if (signal->iter > dom->nr_signals)
+	if (signal->iter >= dom->nr_signals)
 		return -EINVAL;
 
 	sig = &dom->signal[signal->iter];
@@ -461,7 +461,7 @@ int etnaviv_pm_req_validate(const struct drm_etnaviv_gem_submit_pmr *r,
 
 	dom = meta->domains + r->domain;
 
-	if (r->signal > dom->nr_signals)
+	if (r->signal >= dom->nr_signals)
 		return -EINVAL;
 
 	return 0;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 122/639] drm/fb-helper: generic: Fix setup error path
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (120 preceding siblings ...)
  2020-01-24  9:24 ` [PATCH 4.19 121/639] drm/etnaviv: fix some off by one bugs Greg Kroah-Hartman
@ 2020-01-24  9:24 ` Greg Kroah-Hartman
  2020-01-24  9:24 ` [PATCH 4.19 123/639] fork, memcg: fix cached_stacks case Greg Kroah-Hartman
                   ` (520 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:24 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Peter Wu, Noralf Trønnes,
	Gerd Hoffmann, Sasha Levin

From: Noralf Trønnes <noralf@tronnes.org>

[ Upstream commit 6e1490cf439aa86b104e5124c36275b964238e1f ]

If register_framebuffer() fails during fbdev setup we will leak the
framebuffer, the GEM buffer and the shadow buffer for defio. This is
because drm_fb_helper_fbdev_setup() just calls drm_fb_helper_fini() on
error not taking into account that register_framebuffer() can fail.

Since the generic emulation uses DRM client for its framebuffer and
backing buffer in addition to a shadow buffer, it's necessary to open code
drm_fb_helper_fbdev_setup() to properly handle the error path.

Error cleanup is removed from .fb_probe and is handled by one function for
all paths.

Fixes: 9060d7f49376 ("drm/fb-helper: Finish the generic fbdev emulation")
Reported-by: Peter Wu <peter@lekensteyn.nl>
Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
Acked-by: Gerd Hoffmann <kraxel@redhat.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20190105181846.26495-1-noralf@tronnes.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/drm_fb_helper.c | 98 +++++++++++++++++++--------------
 1 file changed, 58 insertions(+), 40 deletions(-)

diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
index f57fc1450b613..1c87ad6667e73 100644
--- a/drivers/gpu/drm/drm_fb_helper.c
+++ b/drivers/gpu/drm/drm_fb_helper.c
@@ -2979,18 +2979,16 @@ static int drm_fbdev_fb_release(struct fb_info *info, int user)
 	return 0;
 }
 
-/*
- * fb_ops.fb_destroy is called by the last put_fb_info() call at the end of
- * unregister_framebuffer() or fb_release().
- */
-static void drm_fbdev_fb_destroy(struct fb_info *info)
+static void drm_fbdev_cleanup(struct drm_fb_helper *fb_helper)
 {
-	struct drm_fb_helper *fb_helper = info->par;
 	struct fb_info *fbi = fb_helper->fbdev;
 	struct fb_ops *fbops = NULL;
 	void *shadow = NULL;
 
-	if (fbi->fbdefio) {
+	if (!fb_helper->dev)
+		return;
+
+	if (fbi && fbi->fbdefio) {
 		fb_deferred_io_cleanup(fbi);
 		shadow = fbi->screen_buffer;
 		fbops = fbi->fbops;
@@ -3004,6 +3002,12 @@ static void drm_fbdev_fb_destroy(struct fb_info *info)
 	}
 
 	drm_client_framebuffer_delete(fb_helper->buffer);
+}
+
+static void drm_fbdev_release(struct drm_fb_helper *fb_helper)
+{
+	drm_fbdev_cleanup(fb_helper);
+
 	/*
 	 * FIXME:
 	 * Remove conditional when all CMA drivers have been moved over to using
@@ -3015,6 +3019,15 @@ static void drm_fbdev_fb_destroy(struct fb_info *info)
 	}
 }
 
+/*
+ * fb_ops.fb_destroy is called by the last put_fb_info() call at the end of
+ * unregister_framebuffer() or fb_release().
+ */
+static void drm_fbdev_fb_destroy(struct fb_info *info)
+{
+	drm_fbdev_release(info->par);
+}
+
 static int drm_fbdev_fb_mmap(struct fb_info *info, struct vm_area_struct *vma)
 {
 	struct drm_fb_helper *fb_helper = info->par;
@@ -3065,7 +3078,6 @@ int drm_fb_helper_generic_probe(struct drm_fb_helper *fb_helper,
 	struct drm_framebuffer *fb;
 	struct fb_info *fbi;
 	u32 format;
-	int ret;
 
 	DRM_DEBUG_KMS("surface width(%d), height(%d) and bpp(%d)\n",
 		      sizes->surface_width, sizes->surface_height,
@@ -3082,10 +3094,8 @@ int drm_fb_helper_generic_probe(struct drm_fb_helper *fb_helper,
 	fb = buffer->fb;
 
 	fbi = drm_fb_helper_alloc_fbi(fb_helper);
-	if (IS_ERR(fbi)) {
-		ret = PTR_ERR(fbi);
-		goto err_free_buffer;
-	}
+	if (IS_ERR(fbi))
+		return PTR_ERR(fbi);
 
 	fbi->par = fb_helper;
 	fbi->fbops = &drm_fbdev_fb_ops;
@@ -3116,8 +3126,7 @@ int drm_fb_helper_generic_probe(struct drm_fb_helper *fb_helper,
 		if (!fbops || !shadow) {
 			kfree(fbops);
 			vfree(shadow);
-			ret = -ENOMEM;
-			goto err_fb_info_destroy;
+			return -ENOMEM;
 		}
 
 		*fbops = *fbi->fbops;
@@ -3129,13 +3138,6 @@ int drm_fb_helper_generic_probe(struct drm_fb_helper *fb_helper,
 	}
 
 	return 0;
-
-err_fb_info_destroy:
-	drm_fb_helper_fini(fb_helper);
-err_free_buffer:
-	drm_client_framebuffer_delete(buffer);
-
-	return ret;
 }
 EXPORT_SYMBOL(drm_fb_helper_generic_probe);
 
@@ -3147,18 +3149,11 @@ static void drm_fbdev_client_unregister(struct drm_client_dev *client)
 {
 	struct drm_fb_helper *fb_helper = drm_fb_helper_from_client(client);
 
-	if (fb_helper->fbdev) {
-		drm_fb_helper_unregister_fbi(fb_helper);
+	if (fb_helper->fbdev)
 		/* drm_fbdev_fb_destroy() takes care of cleanup */
-		return;
-	}
-
-	/* Did drm_fb_helper_fbdev_setup() run? */
-	if (fb_helper->dev)
-		drm_fb_helper_fini(fb_helper);
-
-	drm_client_release(client);
-	kfree(fb_helper);
+		drm_fb_helper_unregister_fbi(fb_helper);
+	else
+		drm_fbdev_release(fb_helper);
 }
 
 static int drm_fbdev_client_restore(struct drm_client_dev *client)
@@ -3174,7 +3169,7 @@ static int drm_fbdev_client_hotplug(struct drm_client_dev *client)
 	struct drm_device *dev = client->dev;
 	int ret;
 
-	/* If drm_fb_helper_fbdev_setup() failed, we only try once */
+	/* Setup is not retried if it has failed */
 	if (!fb_helper->dev && fb_helper->funcs)
 		return 0;
 
@@ -3184,15 +3179,34 @@ static int drm_fbdev_client_hotplug(struct drm_client_dev *client)
 	if (!dev->mode_config.num_connector)
 		return 0;
 
-	ret = drm_fb_helper_fbdev_setup(dev, fb_helper, &drm_fb_helper_generic_funcs,
-					fb_helper->preferred_bpp, 0);
-	if (ret) {
-		fb_helper->dev = NULL;
-		fb_helper->fbdev = NULL;
-		return ret;
-	}
+	drm_fb_helper_prepare(dev, fb_helper, &drm_fb_helper_generic_funcs);
+
+	ret = drm_fb_helper_init(dev, fb_helper, dev->mode_config.num_connector);
+	if (ret)
+		goto err;
+
+	ret = drm_fb_helper_single_add_all_connectors(fb_helper);
+	if (ret)
+		goto err_cleanup;
+
+	if (!drm_drv_uses_atomic_modeset(dev))
+		drm_helper_disable_unused_functions(dev);
+
+	ret = drm_fb_helper_initial_config(fb_helper, fb_helper->preferred_bpp);
+	if (ret)
+		goto err_cleanup;
 
 	return 0;
+
+err_cleanup:
+	drm_fbdev_cleanup(fb_helper);
+err:
+	fb_helper->dev = NULL;
+	fb_helper->fbdev = NULL;
+
+	DRM_DEV_ERROR(dev->dev, "fbdev: Failed to setup generic emulation (ret=%d)\n", ret);
+
+	return ret;
 }
 
 static const struct drm_client_funcs drm_fbdev_client_funcs = {
@@ -3245,6 +3259,10 @@ int drm_fbdev_generic_setup(struct drm_device *dev, unsigned int preferred_bpp)
 
 	drm_client_add(&fb_helper->client);
 
+	if (!preferred_bpp)
+		preferred_bpp = dev->mode_config.preferred_depth;
+	if (!preferred_bpp)
+		preferred_bpp = 32;
 	fb_helper->preferred_bpp = preferred_bpp;
 
 	drm_fbdev_client_hotplug(&fb_helper->client);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 123/639] fork, memcg: fix cached_stacks case
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (121 preceding siblings ...)
  2020-01-24  9:24 ` [PATCH 4.19 122/639] drm/fb-helper: generic: Fix setup error path Greg Kroah-Hartman
@ 2020-01-24  9:24 ` Greg Kroah-Hartman
  2020-01-24  9:24 ` [PATCH 4.19 124/639] IB/usnic: Fix out of bounds index check in query pkey Greg Kroah-Hartman
                   ` (519 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:24 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Shakeel Butt, Michal Hocko,
	Rik van Riel, Roman Gushchin, Johannes Weiner, Tejun Heo,
	Andrew Morton, Linus Torvalds, Sasha Levin

From: Shakeel Butt <shakeelb@google.com>

[ Upstream commit ba4a45746c362b665e245c50b870615f02f34781 ]

Commit 5eed6f1dff87 ("fork,memcg: fix crash in free_thread_stack on
memcg charge fail") fixes a crash caused due to failed memcg charge of
the kernel stack.  However the fix misses the cached_stacks case which
this patch fixes.  So, the same crash can happen if the memcg charge of
a cached stack is failed.

Link: http://lkml.kernel.org/r/20190102180145.57406-1-shakeelb@google.com
Fixes: 5eed6f1dff87 ("fork,memcg: fix crash in free_thread_stack on memcg charge fail")
Signed-off-by: Shakeel Butt <shakeelb@google.com>
Acked-by: Michal Hocko <mhocko@suse.com>
Acked-by: Rik van Riel <riel@surriel.com>
Cc: Rik van Riel <riel@surriel.com>
Cc: Roman Gushchin <guro@fb.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Tejun Heo <tj@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/fork.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/kernel/fork.c b/kernel/fork.c
index 5718c5decc55b..1bd119530a492 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -216,6 +216,7 @@ static unsigned long *alloc_thread_stack_node(struct task_struct *tsk, int node)
 		memset(s->addr, 0, THREAD_SIZE);
 
 		tsk->stack_vm_area = s;
+		tsk->stack = s->addr;
 		return s->addr;
 	}
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 124/639] IB/usnic: Fix out of bounds index check in query pkey
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (122 preceding siblings ...)
  2020-01-24  9:24 ` [PATCH 4.19 123/639] fork, memcg: fix cached_stacks case Greg Kroah-Hartman
@ 2020-01-24  9:24 ` Greg Kroah-Hartman
  2020-01-24  9:24 ` [PATCH 4.19 125/639] RDMA/ocrdma: " Greg Kroah-Hartman
                   ` (518 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:24 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Gal Pressman, Parvi Kaustubhi,
	Jason Gunthorpe, Sasha Levin

From: Gal Pressman <galpress@amazon.com>

[ Upstream commit 4959d5da5737dd804255c75b8cea0a2929ce279a ]

The pkey table size is one element, index should be tested for > 0 instead
of > 1.

Fixes: e3cf00d0a87f ("IB/usnic: Add Cisco VIC low-level hardware driver")
Signed-off-by: Gal Pressman <galpress@amazon.com>
Acked-by: Parvi Kaustubhi <pkaustub@cisco.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/hw/usnic/usnic_ib_verbs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/infiniband/hw/usnic/usnic_ib_verbs.c b/drivers/infiniband/hw/usnic/usnic_ib_verbs.c
index 3db232429630e..e611f133aa97b 100644
--- a/drivers/infiniband/hw/usnic/usnic_ib_verbs.c
+++ b/drivers/infiniband/hw/usnic/usnic_ib_verbs.c
@@ -447,7 +447,7 @@ struct net_device *usnic_get_netdev(struct ib_device *device, u8 port_num)
 int usnic_ib_query_pkey(struct ib_device *ibdev, u8 port, u16 index,
 				u16 *pkey)
 {
-	if (index > 1)
+	if (index > 0)
 		return -EINVAL;
 
 	*pkey = 0xffff;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 125/639] RDMA/ocrdma: Fix out of bounds index check in query pkey
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (123 preceding siblings ...)
  2020-01-24  9:24 ` [PATCH 4.19 124/639] IB/usnic: Fix out of bounds index check in query pkey Greg Kroah-Hartman
@ 2020-01-24  9:24 ` Greg Kroah-Hartman
  2020-01-24  9:24 ` [PATCH 4.19 126/639] RDMA/qedr: " Greg Kroah-Hartman
                   ` (517 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:24 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Gal Pressman, Jason Gunthorpe, Sasha Levin

From: Gal Pressman <galpress@amazon.com>

[ Upstream commit b188940796c7be31c1b8c25a9a0e0842c2e7a49e ]

The pkey table size is one element, index should be tested for > 0 instead
of > 1.

Fixes: fe2caefcdf58 ("RDMA/ocrdma: Add driver for Emulex OneConnect IBoE RDMA adapter")
Signed-off-by: Gal Pressman <galpress@amazon.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
index c158ca9fde6dc..08271fce0b9e4 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
@@ -55,7 +55,7 @@
 
 int ocrdma_query_pkey(struct ib_device *ibdev, u8 port, u16 index, u16 *pkey)
 {
-	if (index > 1)
+	if (index > 0)
 		return -EINVAL;
 
 	*pkey = 0xffff;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 126/639] RDMA/qedr: Fix out of bounds index check in query pkey
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (124 preceding siblings ...)
  2020-01-24  9:24 ` [PATCH 4.19 125/639] RDMA/ocrdma: " Greg Kroah-Hartman
@ 2020-01-24  9:24 ` Greg Kroah-Hartman
  2020-01-24  9:24 ` [PATCH 4.19 127/639] drm/shmob: Fix return value check in shmob_drm_probe Greg Kroah-Hartman
                   ` (516 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:24 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Gal Pressman, Michal Kalderon,
	Jason Gunthorpe, Sasha Levin

From: Gal Pressman <galpress@amazon.com>

[ Upstream commit dbe30dae487e1a232158c24b432d45281c2805b7 ]

The pkey table size is QEDR_ROCE_PKEY_TABLE_LEN, index should be tested
for >= QEDR_ROCE_PKEY_TABLE_LEN instead of > QEDR_ROCE_PKEY_TABLE_LEN.

Fixes: a7efd7773e31 ("qedr: Add support for PD,PKEY and CQ verbs")
Signed-off-by: Gal Pressman <galpress@amazon.com>
Acked-by: Michal Kalderon <michal.kalderon@marvell.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/hw/qedr/verbs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/infiniband/hw/qedr/verbs.c b/drivers/infiniband/hw/qedr/verbs.c
index 9167a1c40bcf5..8fd8b97348bfe 100644
--- a/drivers/infiniband/hw/qedr/verbs.c
+++ b/drivers/infiniband/hw/qedr/verbs.c
@@ -67,7 +67,7 @@ static inline int qedr_ib_copy_to_udata(struct ib_udata *udata, void *src,
 
 int qedr_query_pkey(struct ib_device *ibdev, u8 port, u16 index, u16 *pkey)
 {
-	if (index > QEDR_ROCE_PKEY_TABLE_LEN)
+	if (index >= QEDR_ROCE_PKEY_TABLE_LEN)
 		return -EINVAL;
 
 	*pkey = QEDR_ROCE_PKEY_DEFAULT;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 127/639] drm/shmob: Fix return value check in shmob_drm_probe
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (125 preceding siblings ...)
  2020-01-24  9:24 ` [PATCH 4.19 126/639] RDMA/qedr: " Greg Kroah-Hartman
@ 2020-01-24  9:24 ` Greg Kroah-Hartman
  2020-01-24  9:24 ` [PATCH 4.19 128/639] arm64: dts: apq8016-sbc: Increase load on l11 for SDCARD Greg Kroah-Hartman
                   ` (515 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:24 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, YueHaibing, Simon Horman,
	Kieran Bingham, Laurent Pinchart, Sasha Levin

From: YueHaibing <yuehaibing@huawei.com>

[ Upstream commit 06c3bbd3c12737a50c2e981821b5585e1786e73d ]

In case of error, the function devm_ioremap_resource() returns ERR_PTR()
and never returns NULL. The NULL test in the return value check should
be replaced with IS_ERR().

Fixes: 8f1597c8f1a5 ("drm: shmobile: Perform initialization/cleanup at probe/remove time")
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
Reviewed-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/shmobile/shmob_drm_drv.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/shmobile/shmob_drm_drv.c b/drivers/gpu/drm/shmobile/shmob_drm_drv.c
index 592572554eb0e..58d8a98c749b4 100644
--- a/drivers/gpu/drm/shmobile/shmob_drm_drv.c
+++ b/drivers/gpu/drm/shmobile/shmob_drm_drv.c
@@ -233,8 +233,8 @@ static int shmob_drm_probe(struct platform_device *pdev)
 
 	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
 	sdev->mmio = devm_ioremap_resource(&pdev->dev, res);
-	if (sdev->mmio == NULL)
-		return -ENOMEM;
+	if (IS_ERR(sdev->mmio))
+		return PTR_ERR(sdev->mmio);
 
 	ret = shmob_drm_setup_clocks(sdev, pdata->clk_source);
 	if (ret < 0)
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 128/639] arm64: dts: apq8016-sbc: Increase load on l11 for SDCARD
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (126 preceding siblings ...)
  2020-01-24  9:24 ` [PATCH 4.19 127/639] drm/shmob: Fix return value check in shmob_drm_probe Greg Kroah-Hartman
@ 2020-01-24  9:24 ` Greg Kroah-Hartman
  2020-01-24  9:24 ` [PATCH 4.19 129/639] spi: cadence: Correct initialisation of runtime PM Greg Kroah-Hartman
                   ` (514 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:24 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Manabu Igusa, Loic Poulain,
	Bjorn Andersson, Andy Gross, Sasha Levin

From: Loic Poulain <loic.poulain@linaro.org>

[ Upstream commit af61bef513ba179559e56908b8c465e587bc3890 ]

In the same way as for msm8974-hammerhead, l11 load, used for SDCARD
VMMC, needs to be increased in order to prevent any voltage drop issues
(due to limited current) happening with some SDCARDS or during specific
operations (e.g. write).

Tested on Dragonboard-410c and DART-SD410 boards.

Fixes: 4c7d53d16d77 (arm64: dts: apq8016-sbc: add regulators support)
Reported-by: Manabu Igusa <migusa@arrowjapan.com>
Signed-off-by: Loic Poulain <loic.poulain@linaro.org>
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Andy Gross <andy.gross@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi b/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi
index 78ce3979ef096..f38b815e696d8 100644
--- a/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi
+++ b/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi
@@ -630,6 +630,8 @@
 	l11 {
 		regulator-min-microvolt = <1750000>;
 		regulator-max-microvolt = <3337000>;
+		regulator-allow-set-load;
+		regulator-system-load = <200000>;
 	};
 
 	l12 {
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 129/639] spi: cadence: Correct initialisation of runtime PM
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (127 preceding siblings ...)
  2020-01-24  9:24 ` [PATCH 4.19 128/639] arm64: dts: apq8016-sbc: Increase load on l11 for SDCARD Greg Kroah-Hartman
@ 2020-01-24  9:24 ` Greg Kroah-Hartman
  2020-01-24  9:25 ` [PATCH 4.19 130/639] RDMA/iw_cxgb4: Fix the unchecked ep dereference Greg Kroah-Hartman
                   ` (513 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:24 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Charles Keepax, Mark Brown, Sasha Levin

From: Charles Keepax <ckeepax@opensource.cirrus.com>

[ Upstream commit 734882a8bf984c2ac8a57d8ac3ee53230bd0bed8 ]

Currently the driver calls pm_runtime_put_autosuspend but without ever
having done a pm_runtime_get, this causes the reference count in the pm
runtime core to become -1. The bad reference count causes the core to
sometimes suspend whilst an active SPI transfer is in progress.

arizona spi0.1: SPI transfer timed out
spi_master spi0: failed to transfer one message from queue

The correct proceedure is to do all the initialisation that requires the
hardware to be powered up before enabling the PM runtime, then enable
the PM runtime having called pm_runtime_set_active to inform it that the
hardware is currently powered up. The core will then power it down at
it's leisure and no explicit pm_runtime_put is required.

Fixes: d36ccd9f7ea4 ("spi: cadence: Runtime pm adaptation")
Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-cadence.c | 11 ++++-------
 1 file changed, 4 insertions(+), 7 deletions(-)

diff --git a/drivers/spi/spi-cadence.c b/drivers/spi/spi-cadence.c
index 7c88f74f7f470..94cc0a152449f 100644
--- a/drivers/spi/spi-cadence.c
+++ b/drivers/spi/spi-cadence.c
@@ -584,11 +584,6 @@ static int cdns_spi_probe(struct platform_device *pdev)
 		goto clk_dis_apb;
 	}
 
-	pm_runtime_use_autosuspend(&pdev->dev);
-	pm_runtime_set_autosuspend_delay(&pdev->dev, SPI_AUTOSUSPEND_TIMEOUT);
-	pm_runtime_set_active(&pdev->dev);
-	pm_runtime_enable(&pdev->dev);
-
 	ret = of_property_read_u32(pdev->dev.of_node, "num-cs", &num_cs);
 	if (ret < 0)
 		master->num_chipselect = CDNS_SPI_DEFAULT_NUM_CS;
@@ -603,8 +598,10 @@ static int cdns_spi_probe(struct platform_device *pdev)
 	/* SPI controller initializations */
 	cdns_spi_init_hw(xspi);
 
-	pm_runtime_mark_last_busy(&pdev->dev);
-	pm_runtime_put_autosuspend(&pdev->dev);
+	pm_runtime_set_active(&pdev->dev);
+	pm_runtime_enable(&pdev->dev);
+	pm_runtime_use_autosuspend(&pdev->dev);
+	pm_runtime_set_autosuspend_delay(&pdev->dev, SPI_AUTOSUSPEND_TIMEOUT);
 
 	irq = platform_get_irq(pdev, 0);
 	if (irq <= 0) {
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 130/639] RDMA/iw_cxgb4: Fix the unchecked ep dereference
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (128 preceding siblings ...)
  2020-01-24  9:24 ` [PATCH 4.19 129/639] spi: cadence: Correct initialisation of runtime PM Greg Kroah-Hartman
@ 2020-01-24  9:25 ` Greg Kroah-Hartman
  2020-01-24  9:25 ` [PATCH 4.19 131/639] net: phy: micrel: set soft_reset callback to genphy_soft_reset for KSZ9031 Greg Kroah-Hartman
                   ` (512 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:25 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Raju Rangoju,
	Jason Gunthorpe, Sasha Levin

From: Raju Rangoju <rajur@chelsio.com>

[ Upstream commit 3352976c892301fd576a2e9ff0ac7337b2e2ca48 ]

The patch 944661dd97f4: "RDMA/iw_cxgb4: atomically lookup ep and get a
reference" from May 6, 2016, leads to the following Smatch complaint:

    drivers/infiniband/hw/cxgb4/cm.c:2953 terminate()
    error: we previously assumed 'ep' could be null (see line 2945)

Fixes: 944661dd97f4 ("RDMA/iw_cxgb4: atomically lookup ep and get a reference")
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Raju Rangoju <rajur@chelsio.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/hw/cxgb4/cm.c | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
index 4dcc92d116097..1b3d014fa1d6e 100644
--- a/drivers/infiniband/hw/cxgb4/cm.c
+++ b/drivers/infiniband/hw/cxgb4/cm.c
@@ -2947,15 +2947,18 @@ static int terminate(struct c4iw_dev *dev, struct sk_buff *skb)
 
 	ep = get_ep_from_tid(dev, tid);
 
-	if (ep && ep->com.qp) {
-		pr_warn("TERM received tid %u qpid %u\n",
-			tid, ep->com.qp->wq.sq.qid);
-		attrs.next_state = C4IW_QP_STATE_TERMINATE;
-		c4iw_modify_qp(ep->com.qp->rhp, ep->com.qp,
-			       C4IW_QP_ATTR_NEXT_STATE, &attrs, 1);
+	if (ep) {
+		if (ep->com.qp) {
+			pr_warn("TERM received tid %u qpid %u\n", tid,
+				ep->com.qp->wq.sq.qid);
+			attrs.next_state = C4IW_QP_STATE_TERMINATE;
+			c4iw_modify_qp(ep->com.qp->rhp, ep->com.qp,
+				       C4IW_QP_ATTR_NEXT_STATE, &attrs, 1);
+		}
+
+		c4iw_put_ep(&ep->com);
 	} else
 		pr_warn("TERM received tid %u no ep/qp\n", tid);
-	c4iw_put_ep(&ep->com);
 
 	return 0;
 }
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 131/639] net: phy: micrel: set soft_reset callback to genphy_soft_reset for KSZ9031
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (129 preceding siblings ...)
  2020-01-24  9:25 ` [PATCH 4.19 130/639] RDMA/iw_cxgb4: Fix the unchecked ep dereference Greg Kroah-Hartman
@ 2020-01-24  9:25 ` Greg Kroah-Hartman
  2020-01-24  9:25 ` [PATCH 4.19 132/639] memory: tegra: Dont invoke Tegra30+ specific memory timing setup on Tegra20 Greg Kroah-Hartman
                   ` (511 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:25 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Tony Lindgren, Heiner Kallweit,
	Sekhar Nori, Florian Fainelli, David S. Miller, Sasha Levin

From: Heiner Kallweit <hkallweit1@gmail.com>

[ Upstream commit 1d16073a326891c2a964e4cb95bc18fbcafb5f74 ]

So far genphy_soft_reset was used automatically if the PHY driver
didn't implement the soft_reset callback. This changed with the
mentioned commit and broke KSZ9031. To fix this configure the
KSZ9031 PHY driver to use genphy_soft_reset.

Fixes: 6e2d85ec0559 ("net: phy: Stop with excessive soft reset")
Reported-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
Tested-by: Tony Lindgren <tony@atomide.com>
Tested-by: Sekhar Nori <nsekhar@ti.com>
Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/phy/micrel.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c
index 05a6ae32ff652..b4c67c3a928b5 100644
--- a/drivers/net/phy/micrel.c
+++ b/drivers/net/phy/micrel.c
@@ -977,6 +977,7 @@ static struct phy_driver ksphy_driver[] = {
 	.driver_data	= &ksz9021_type,
 	.probe		= kszphy_probe,
 	.config_init	= ksz9031_config_init,
+	.soft_reset	= genphy_soft_reset,
 	.read_status	= ksz9031_read_status,
 	.ack_interrupt	= kszphy_ack_interrupt,
 	.config_intr	= kszphy_config_intr,
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 132/639] memory: tegra: Dont invoke Tegra30+ specific memory timing setup on Tegra20
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (130 preceding siblings ...)
  2020-01-24  9:25 ` [PATCH 4.19 131/639] net: phy: micrel: set soft_reset callback to genphy_soft_reset for KSZ9031 Greg Kroah-Hartman
@ 2020-01-24  9:25 ` Greg Kroah-Hartman
  2020-01-24  9:25 ` [PATCH 4.19 133/639] drm/etnaviv: NULL vs IS_ERR() buf in etnaviv_core_dump() Greg Kroah-Hartman
                   ` (510 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:25 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dmitry Osipenko, Jon Hunter,
	Thierry Reding, Joerg Roedel, Sasha Levin

From: Dmitry Osipenko <digetx@gmail.com>

[ Upstream commit be4dbdec2bab8635c7a41573668624ee13d83022 ]

This fixes irrelevant "tegra-mc 7000f000.memory-controller: no memory
timings for RAM code 0 registered" warning message during of kernels
boot-up on Tegra20.

Fixes: a8d502fd3348 ("memory: tegra: Squash tegra20-mc into common tegra-mc driver")
Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
Acked-by: Jon Hunter <jonathanh@nvidia.com>
Acked-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/memory/tegra/mc.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/drivers/memory/tegra/mc.c b/drivers/memory/tegra/mc.c
index c8f16666256cc..346d8eadb44b1 100644
--- a/drivers/memory/tegra/mc.c
+++ b/drivers/memory/tegra/mc.c
@@ -664,12 +664,13 @@ static int tegra_mc_probe(struct platform_device *pdev)
 		}
 
 		isr = tegra_mc_irq;
-	}
 
-	err = tegra_mc_setup_timings(mc);
-	if (err < 0) {
-		dev_err(&pdev->dev, "failed to setup timings: %d\n", err);
-		return err;
+		err = tegra_mc_setup_timings(mc);
+		if (err < 0) {
+			dev_err(&pdev->dev, "failed to setup timings: %d\n",
+				err);
+			return err;
+		}
 	}
 
 	mc->irq = platform_get_irq(pdev, 0);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 133/639] drm/etnaviv: NULL vs IS_ERR() buf in etnaviv_core_dump()
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (131 preceding siblings ...)
  2020-01-24  9:25 ` [PATCH 4.19 132/639] memory: tegra: Dont invoke Tegra30+ specific memory timing setup on Tegra20 Greg Kroah-Hartman
@ 2020-01-24  9:25 ` Greg Kroah-Hartman
  2020-01-24  9:25 ` [PATCH 4.19 134/639] media: s5p-jpeg: Correct step and max values for V4L2_CID_JPEG_RESTART_INTERVAL Greg Kroah-Hartman
                   ` (509 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:25 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Lucas Stach, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit f8261c376e7f8cb9024af5a6c54be540c7f9108e ]

The etnaviv_gem_get_pages() never returns NULL.  It returns error
pointers on error.

Fixes: a8c21a5451d8 ("drm/etnaviv: add initial etnaviv DRM driver")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/etnaviv/etnaviv_dump.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/etnaviv/etnaviv_dump.c b/drivers/gpu/drm/etnaviv/etnaviv_dump.c
index 468dff2f79040..9d839b4fd8f78 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_dump.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_dump.c
@@ -217,7 +217,7 @@ void etnaviv_core_dump(struct etnaviv_gpu *gpu)
 		mutex_lock(&obj->lock);
 		pages = etnaviv_gem_get_pages(obj);
 		mutex_unlock(&obj->lock);
-		if (pages) {
+		if (!IS_ERR(pages)) {
 			int j;
 
 			iter.hdr->data[0] = bomap - bomap_start;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 134/639] media: s5p-jpeg: Correct step and max values for V4L2_CID_JPEG_RESTART_INTERVAL
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (132 preceding siblings ...)
  2020-01-24  9:25 ` [PATCH 4.19 133/639] drm/etnaviv: NULL vs IS_ERR() buf in etnaviv_core_dump() Greg Kroah-Hartman
@ 2020-01-24  9:25 ` Greg Kroah-Hartman
  2020-01-24  9:25 ` [PATCH 4.19 135/639] kbuild: mark prepare0 as PHONY to fix external module build Greg Kroah-Hartman
                   ` (508 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:25 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Pawe? Chmiel, Jacek Anaszewski,
	Sylwester Nawrocki, Hans Verkuil, Mauro Carvalho Chehab,
	Sasha Levin

From: Pawe? Chmiel <pawel.mikolaj.chmiel@gmail.com>

[ Upstream commit 19c624c6b29e244c418f8b44a711cbf5e82e3cd4 ]

This commit corrects max and step values for v4l2 control for
V4L2_CID_JPEG_RESTART_INTERVAL. Max should be 0xffff and step should be 1.
It was found by using v4l2-compliance tool and checking result of
VIDIOC_QUERY_EXT_CTRL/QUERYMENU test.
Previously it was complaining that step was bigger than difference
between max and min.

Fixes: 15f4bc3b1f42 ("[media] s5p-jpeg: Add JPEG controls support")

Signed-off-by: Pawe? Chmiel <pawel.mikolaj.chmiel@gmail.com>
Reviewed-by: Jacek Anaszewski <jacek.anaszewski@gmail.com>
Reviewed-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/s5p-jpeg/jpeg-core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/platform/s5p-jpeg/jpeg-core.c b/drivers/media/platform/s5p-jpeg/jpeg-core.c
index 350afaa29a620..fa7c42cf4b4ef 100644
--- a/drivers/media/platform/s5p-jpeg/jpeg-core.c
+++ b/drivers/media/platform/s5p-jpeg/jpeg-core.c
@@ -2005,7 +2005,7 @@ static int s5p_jpeg_controls_create(struct s5p_jpeg_ctx *ctx)
 
 		v4l2_ctrl_new_std(&ctx->ctrl_handler, &s5p_jpeg_ctrl_ops,
 				  V4L2_CID_JPEG_RESTART_INTERVAL,
-				  0, 3, 0xffff, 0);
+				  0, 0xffff, 1, 0);
 		if (ctx->jpeg->variant->version == SJPEG_S5P)
 			mask = ~0x06; /* 422, 420 */
 	}
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 135/639] kbuild: mark prepare0 as PHONY to fix external module build
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (133 preceding siblings ...)
  2020-01-24  9:25 ` [PATCH 4.19 134/639] media: s5p-jpeg: Correct step and max values for V4L2_CID_JPEG_RESTART_INTERVAL Greg Kroah-Hartman
@ 2020-01-24  9:25 ` Greg Kroah-Hartman
  2020-01-24  9:25 ` [PATCH 4.19 136/639] crypto: brcm - Fix some set-but-not-used warning Greg Kroah-Hartman
                   ` (507 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:25 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Samuel Holland, Alexey Kardashevskiy,
	Masahiro Yamada, Ard Biesheuvel, Sasha Levin

From: Masahiro Yamada <yamada.masahiro@socionext.com>

[ Upstream commit e00d8880481497474792d28c14479a9fb6752046 ]

Commit c3ff2a5193fa ("powerpc/32: add stack protector support")
caused kernel panic on PowerPC when an external module is used with
CONFIG_STACKPROTECTOR because the 'prepare' target was not executed
for the external module build.

Commit e07db28eea38 ("kbuild: fix single target build for external
module") turned it into a build error because the 'prepare' target is
now executed but the 'prepare0' target is missing for the external
module build.

External module on arm/arm64 with CONFIG_STACKPROTECTOR_PER_TASK is
also broken in the same way.

Move 'PHONY += prepare0' to the common place. GNU Make is fine with
missing rule for phony targets. I also removed the comment which is
wrong irrespective of this commit.

I minimize the change so it can be easily backported to 4.20.x

To fix v4.20, please backport e07db28eea38 ("kbuild: fix single target
build for external module"), and then this commit.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=201891
Fixes: e07db28eea38 ("kbuild: fix single target build for external module")
Fixes: c3ff2a5193fa ("powerpc/32: add stack protector support")
Fixes: 189af4657186 ("ARM: smp: add support for per-task stack canaries")
Fixes: 0a1213fa7432 ("arm64: enable per-task stack canaries")
Cc: linux-stable <stable@vger.kernel.org> # v4.20
Reported-by: Samuel Holland <samuel@sholland.org>
Reported-by: Alexey Kardashevskiy <aik@ozlabs.ru>
Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Tested-by: Alexey Kardashevskiy <aik@ozlabs.ru>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 Makefile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Makefile b/Makefile
index 48dbafb790ff1..9ceecb038356d 100644
--- a/Makefile
+++ b/Makefile
@@ -964,6 +964,7 @@ ifdef CONFIG_STACK_VALIDATION
   endif
 endif
 
+PHONY += prepare0
 
 ifeq ($(KBUILD_EXTMOD),)
 core-y		+= kernel/ certs/ mm/ fs/ ipc/ security/ crypto/ block/
@@ -1072,8 +1073,7 @@ scripts: scripts_basic asm-generic gcc-plugins $(autoksyms_h)
 # archprepare is used in arch Makefiles and when processed asm symlink,
 # version.h and scripts_basic is processed / created.
 
-# Listed in dependency order
-PHONY += prepare archprepare prepare0 prepare1 prepare2 prepare3
+PHONY += prepare archprepare prepare1 prepare2 prepare3
 
 # prepare3 is used to check if we are building in a separate output directory,
 # and if so do:
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 136/639] crypto: brcm - Fix some set-but-not-used warning
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (134 preceding siblings ...)
  2020-01-24  9:25 ` [PATCH 4.19 135/639] kbuild: mark prepare0 as PHONY to fix external module build Greg Kroah-Hartman
@ 2020-01-24  9:25 ` Greg Kroah-Hartman
  2020-01-24  9:25 ` [PATCH 4.19 137/639] crypto: tgr192 - fix unaligned memory access Greg Kroah-Hartman
                   ` (506 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:25 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, YueHaibing, Raveendra Padasalagi,
	Herbert Xu, Sasha Levin

From: YueHaibing <yuehaibing@huawei.com>

[ Upstream commit 707d0cf8f7cff6dfee9197002859912310532c4f ]

Fixes gcc '-Wunused-but-set-variable' warning:

drivers/crypto/bcm/cipher.c: In function 'handle_ahash_req':
drivers/crypto/bcm/cipher.c:720:15: warning:
 variable 'chunk_start' set but not used [-Wunused-but-set-variable]

drivers/crypto/bcm/cipher.c: In function 'spu_rx_callback':
drivers/crypto/bcm/cipher.c:1679:31: warning:
 variable 'areq' set but not used [-Wunused-but-set-variable]

drivers/crypto/bcm/cipher.c:1678:22: warning:
 variable 'ctx' set but not used [-Wunused-but-set-variable]

Fixes: 9d12ba86f818 ("crypto: brcm - Add Broadcom SPU driver")
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Reviewed-by: Raveendra Padasalagi <raveendra.padasalagi@broadcom.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/bcm/cipher.c | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/drivers/crypto/bcm/cipher.c b/drivers/crypto/bcm/cipher.c
index 49c0097fa4749..0b1fc5664b1d8 100644
--- a/drivers/crypto/bcm/cipher.c
+++ b/drivers/crypto/bcm/cipher.c
@@ -717,7 +717,7 @@ static int handle_ahash_req(struct iproc_reqctx_s *rctx)
 	 */
 	unsigned int new_data_len;
 
-	unsigned int chunk_start = 0;
+	unsigned int __maybe_unused chunk_start = 0;
 	u32 db_size;	 /* Length of data field, incl gcm and hash padding */
 	int pad_len = 0; /* total pad len, including gcm, hash, stat padding */
 	u32 data_pad_len = 0;	/* length of GCM/CCM padding */
@@ -1675,8 +1675,6 @@ static void spu_rx_callback(struct mbox_client *cl, void *msg)
 	struct spu_hw *spu = &iproc_priv.spu;
 	struct brcm_message *mssg = msg;
 	struct iproc_reqctx_s *rctx;
-	struct iproc_ctx_s *ctx;
-	struct crypto_async_request *areq;
 	int err = 0;
 
 	rctx = mssg->ctx;
@@ -1686,8 +1684,6 @@ static void spu_rx_callback(struct mbox_client *cl, void *msg)
 		err = -EFAULT;
 		goto cb_finish;
 	}
-	areq = rctx->parent;
-	ctx = rctx->ctx;
 
 	/* process the SPU status */
 	err = spu->spu_status_process(rctx->msg_buf.rx_stat);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 137/639] crypto: tgr192 - fix unaligned memory access
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (135 preceding siblings ...)
  2020-01-24  9:25 ` [PATCH 4.19 136/639] crypto: brcm - Fix some set-but-not-used warning Greg Kroah-Hartman
@ 2020-01-24  9:25 ` Greg Kroah-Hartman
  2020-01-24  9:25 ` [PATCH 4.19 138/639] ASoC: imx-sgtl5000: put of nodes if finding codec fails Greg Kroah-Hartman
                   ` (505 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:25 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Eric Biggers, Herbert Xu, Sasha Levin

From: Eric Biggers <ebiggers@google.com>

[ Upstream commit f990f7fb58ac8ac9a43316f09a48cff1a49dda42 ]

Fix an unaligned memory access in tgr192_transform() by using the
unaligned access helpers.

Fixes: 06ace7a9bafe ("[CRYPTO] Use standard byte order macros wherever possible")
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 crypto/tgr192.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/crypto/tgr192.c b/crypto/tgr192.c
index 022d3dd76c3b2..f8e1d9f9938f5 100644
--- a/crypto/tgr192.c
+++ b/crypto/tgr192.c
@@ -25,8 +25,9 @@
 #include <linux/init.h>
 #include <linux/module.h>
 #include <linux/mm.h>
-#include <asm/byteorder.h>
 #include <linux/types.h>
+#include <asm/byteorder.h>
+#include <asm/unaligned.h>
 
 #define TGR192_DIGEST_SIZE 24
 #define TGR160_DIGEST_SIZE 20
@@ -468,10 +469,9 @@ static void tgr192_transform(struct tgr192_ctx *tctx, const u8 * data)
 	u64 a, b, c, aa, bb, cc;
 	u64 x[8];
 	int i;
-	const __le64 *ptr = (const __le64 *)data;
 
 	for (i = 0; i < 8; i++)
-		x[i] = le64_to_cpu(ptr[i]);
+		x[i] = get_unaligned_le64(data + i * sizeof(__le64));
 
 	/* save */
 	a = aa = tctx->a;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 138/639] ASoC: imx-sgtl5000: put of nodes if finding codec fails
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (136 preceding siblings ...)
  2020-01-24  9:25 ` [PATCH 4.19 137/639] crypto: tgr192 - fix unaligned memory access Greg Kroah-Hartman
@ 2020-01-24  9:25 ` Greg Kroah-Hartman
  2020-01-24  9:25 ` [PATCH 4.19 139/639] IB/iser: Pass the correct number of entries for dma mapped SGL Greg Kroah-Hartman
                   ` (504 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:25 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Stefan Agner, Daniel Baluta,
	Nicolin Chen, Fabio Estevam, Mark Brown, Sasha Levin

From: Stefan Agner <stefan@agner.ch>

[ Upstream commit d9866572486802bc598a3e8576a5231378d190de ]

Make sure to properly put the of node in case finding the codec
fails.

Fixes: 81e8e4926167 ("ASoC: fsl: add sgtl5000 clock support for imx-sgtl5000")
Signed-off-by: Stefan Agner <stefan@agner.ch>
Reviewed-by: Daniel Baluta <daniel.baluta@nxp.com>
Acked-by: Nicolin Chen <nicoleotsuka@gmail.com>
Reviewed-by: Fabio Estevam <festevam@gmail.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/fsl/imx-sgtl5000.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/sound/soc/fsl/imx-sgtl5000.c b/sound/soc/fsl/imx-sgtl5000.c
index 9b9a7ec529055..4bd8da3a5f5b8 100644
--- a/sound/soc/fsl/imx-sgtl5000.c
+++ b/sound/soc/fsl/imx-sgtl5000.c
@@ -112,7 +112,8 @@ static int imx_sgtl5000_probe(struct platform_device *pdev)
 	codec_dev = of_find_i2c_device_by_node(codec_np);
 	if (!codec_dev) {
 		dev_err(&pdev->dev, "failed to find codec platform device\n");
-		return -EPROBE_DEFER;
+		ret = -EPROBE_DEFER;
+		goto fail;
 	}
 
 	data = devm_kzalloc(&pdev->dev, sizeof(*data), GFP_KERNEL);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 139/639] IB/iser: Pass the correct number of entries for dma mapped SGL
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (137 preceding siblings ...)
  2020-01-24  9:25 ` [PATCH 4.19 138/639] ASoC: imx-sgtl5000: put of nodes if finding codec fails Greg Kroah-Hartman
@ 2020-01-24  9:25 ` Greg Kroah-Hartman
  2020-01-24  9:25 ` [PATCH 4.19 140/639] net: hns3: fix wrong combined count returned by ethtool -l Greg Kroah-Hartman
                   ` (503 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:25 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Israel Rukshin, Max Gurtovoy,
	Sagi Grimberg, Jason Gunthorpe, Sasha Levin

From: Israel Rukshin <israelr@mellanox.com>

[ Upstream commit 57b26497fabe1b9379b59fbc7e35e608e114df16 ]

ib_dma_map_sg() augments the SGL into a 'dma mapped SGL'. This process may
change the number of entries and the lengths of each entry.

Code that touches dma_address is iterating over the 'dma mapped SGL' and
must use dma_nents which returned from ib_dma_map_sg().

ib_sg_to_pages() and ib_map_mr_sg() are using dma_address so they must use
dma_nents.

Fixes: 39405885005a ("IB/iser: Port to new fast registration API")
Fixes: bfe066e256d5 ("IB/iser: Reuse ib_sg_to_pages")
Signed-off-by: Israel Rukshin <israelr@mellanox.com>
Reviewed-by: Max Gurtovoy <maxg@mellanox.com>
Acked-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/ulp/iser/iser_memory.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/infiniband/ulp/iser/iser_memory.c b/drivers/infiniband/ulp/iser/iser_memory.c
index 009be8889d71d..379bc0dfc3885 100644
--- a/drivers/infiniband/ulp/iser/iser_memory.c
+++ b/drivers/infiniband/ulp/iser/iser_memory.c
@@ -240,8 +240,8 @@ int iser_fast_reg_fmr(struct iscsi_iser_task *iser_task,
 	page_vec->npages = 0;
 	page_vec->fake_mr.page_size = SIZE_4K;
 	plen = ib_sg_to_pages(&page_vec->fake_mr, mem->sg,
-			      mem->size, NULL, iser_set_page);
-	if (unlikely(plen < mem->size)) {
+			      mem->dma_nents, NULL, iser_set_page);
+	if (unlikely(plen < mem->dma_nents)) {
 		iser_err("page vec too short to hold this SG\n");
 		iser_data_buf_dump(mem, device->ib_device);
 		iser_dump_page_vec(page_vec);
@@ -451,10 +451,10 @@ static int iser_fast_reg_mr(struct iscsi_iser_task *iser_task,
 
 	ib_update_fast_reg_key(mr, ib_inc_rkey(mr->rkey));
 
-	n = ib_map_mr_sg(mr, mem->sg, mem->size, NULL, SIZE_4K);
-	if (unlikely(n != mem->size)) {
+	n = ib_map_mr_sg(mr, mem->sg, mem->dma_nents, NULL, SIZE_4K);
+	if (unlikely(n != mem->dma_nents)) {
 		iser_err("failed to map sg (%d/%d)\n",
-			 n, mem->size);
+			 n, mem->dma_nents);
 		return n < 0 ? n : -EINVAL;
 	}
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 140/639] net: hns3: fix wrong combined count returned by ethtool -l
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (138 preceding siblings ...)
  2020-01-24  9:25 ` [PATCH 4.19 139/639] IB/iser: Pass the correct number of entries for dma mapped SGL Greg Kroah-Hartman
@ 2020-01-24  9:25 ` Greg Kroah-Hartman
  2020-01-24  9:25 ` [PATCH 4.19 141/639] media: tw9910: Unregister subdevice with v4l2-async Greg Kroah-Hartman
                   ` (502 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:25 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Huazhong Tan, Yunsheng Lin, Peng Li,
	David S. Miller, Sasha Levin

From: Huazhong Tan <tanhuazhong@huawei.com>

[ Upstream commit c3b9c50d1567aa12be4448fe85b09626eba2499c ]

The current code returns the number of all queues that can be used and
the number of queues that have been allocated, which is incorrect.
What should be returned is the number of queues allocated for each enabled
TC and the number of queues that can be allocated.

This patch fixes it.

Fixes: 482d2e9c1cc7 ("net: hns3: add support to query tqps number")
Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com>
Signed-off-by: Yunsheng Lin <linyunsheng@huawei.com>
Signed-off-by: Peng Li <lipeng321@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
index f8cc8d1f0b209..4b9f898a1620c 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
@@ -5922,18 +5922,17 @@ static u32 hclge_get_max_channels(struct hnae3_handle *handle)
 	struct hclge_vport *vport = hclge_get_vport(handle);
 	struct hclge_dev *hdev = vport->back;
 
-	return min_t(u32, hdev->rss_size_max * kinfo->num_tc, hdev->num_tqps);
+	return min_t(u32, hdev->rss_size_max,
+		     vport->alloc_tqps / kinfo->num_tc);
 }
 
 static void hclge_get_channels(struct hnae3_handle *handle,
 			       struct ethtool_channels *ch)
 {
-	struct hclge_vport *vport = hclge_get_vport(handle);
-
 	ch->max_combined = hclge_get_max_channels(handle);
 	ch->other_count = 1;
 	ch->max_other = 1;
-	ch->combined_count = vport->alloc_tqps;
+	ch->combined_count = handle->kinfo.rss_size;
 }
 
 static void hclge_get_tqps_and_rss_info(struct hnae3_handle *handle,
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 141/639] media: tw9910: Unregister subdevice with v4l2-async
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (139 preceding siblings ...)
  2020-01-24  9:25 ` [PATCH 4.19 140/639] net: hns3: fix wrong combined count returned by ethtool -l Greg Kroah-Hartman
@ 2020-01-24  9:25 ` Greg Kroah-Hartman
  2020-01-24  9:25 ` [PATCH 4.19 142/639] IB/mlx5: Dont override existing ip_protocol Greg Kroah-Hartman
                   ` (501 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:25 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jacopo Mondi, Sakari Ailus,
	Hans Verkuil, Mauro Carvalho Chehab, Sasha Levin

From: Jacopo Mondi <jacopo+renesas@jmondi.org>

[ Upstream commit 341fe1d301f587c930509f6b9153436b957f649c ]

As the tw9910 subdevice is registered through the v4l2-async framework,
use the v4l2-async provided function to register it.

Fixes: 7b20f325a566 ("media: i2c: tw9910: Remove soc_camera dependencies")

Signed-off-by: Jacopo Mondi <jacopo+renesas@jmondi.org>
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/i2c/tw9910.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/i2c/tw9910.c b/drivers/media/i2c/tw9910.c
index a54548cc42857..c7321a70e3ed0 100644
--- a/drivers/media/i2c/tw9910.c
+++ b/drivers/media/i2c/tw9910.c
@@ -1000,7 +1000,7 @@ static int tw9910_remove(struct i2c_client *client)
 	if (priv->pdn_gpio)
 		gpiod_put(priv->pdn_gpio);
 	clk_put(priv->clk);
-	v4l2_device_unregister_subdev(&priv->subdev);
+	v4l2_async_unregister_subdev(&priv->subdev);
 
 	return 0;
 }
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 142/639] IB/mlx5: Dont override existing ip_protocol
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (140 preceding siblings ...)
  2020-01-24  9:25 ` [PATCH 4.19 141/639] media: tw9910: Unregister subdevice with v4l2-async Greg Kroah-Hartman
@ 2020-01-24  9:25 ` Greg Kroah-Hartman
  2020-01-24  9:25 ` [PATCH 4.19 143/639] rtc: cmos: ignore bogus century byte Greg Kroah-Hartman
                   ` (500 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:25 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Maor Gottlieb, Leon Romanovsky,
	Jason Gunthorpe, Sasha Levin

From: Maor Gottlieb <maorg@mellanox.com>

[ Upstream commit 6113cc44015b41ca51c0a76fed82522b68108dac ]

Two flow specifications can set the ip protocol field in
the flow table entry:

1) IB_FLOW_SPEC_TCP/UDP/GRE - set the ip protocol accordingly.
2) IB_FLOW_SPEC_IPV4/6 - has ip_protocol field for users
who want to receive specific L4 packets.

We need to avoid overriding of the ip_protocol with zeros,
in case that the user first put the L4 specification and
only then the L3.

Fixes: ca0d47538528b ('IB/mlx5: Add support in TOS and protocol to flow steering')
Signed-off-by: Maor Gottlieb <maorg@mellanox.com>
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/hw/mlx5/main.c | 53 +++++++++++++++++++++----------
 1 file changed, 37 insertions(+), 16 deletions(-)

diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
index df5be462dd281..2db34f7b5ced1 100644
--- a/drivers/infiniband/hw/mlx5/main.c
+++ b/drivers/infiniband/hw/mlx5/main.c
@@ -2390,10 +2390,29 @@ static u8 get_match_criteria_enable(u32 *match_criteria)
 	return match_criteria_enable;
 }
 
-static void set_proto(void *outer_c, void *outer_v, u8 mask, u8 val)
+static int set_proto(void *outer_c, void *outer_v, u8 mask, u8 val)
 {
-	MLX5_SET(fte_match_set_lyr_2_4, outer_c, ip_protocol, mask);
-	MLX5_SET(fte_match_set_lyr_2_4, outer_v, ip_protocol, val);
+	u8 entry_mask;
+	u8 entry_val;
+	int err = 0;
+
+	if (!mask)
+		goto out;
+
+	entry_mask = MLX5_GET(fte_match_set_lyr_2_4, outer_c,
+			      ip_protocol);
+	entry_val = MLX5_GET(fte_match_set_lyr_2_4, outer_v,
+			     ip_protocol);
+	if (!entry_mask) {
+		MLX5_SET(fte_match_set_lyr_2_4, outer_c, ip_protocol, mask);
+		MLX5_SET(fte_match_set_lyr_2_4, outer_v, ip_protocol, val);
+		goto out;
+	}
+	/* Don't override existing ip protocol */
+	if (mask != entry_mask || val != entry_val)
+		err = -EINVAL;
+out:
+	return err;
 }
 
 static void set_flow_label(void *misc_c, void *misc_v, u32 mask, u32 val,
@@ -2597,8 +2616,10 @@ static int parse_flow_attr(struct mlx5_core_dev *mdev, u32 *match_c,
 		set_tos(headers_c, headers_v,
 			ib_spec->ipv4.mask.tos, ib_spec->ipv4.val.tos);
 
-		set_proto(headers_c, headers_v,
-			  ib_spec->ipv4.mask.proto, ib_spec->ipv4.val.proto);
+		if (set_proto(headers_c, headers_v,
+			      ib_spec->ipv4.mask.proto,
+			      ib_spec->ipv4.val.proto))
+			return -EINVAL;
 		break;
 	case IB_FLOW_SPEC_IPV6:
 		if (FIELDS_NOT_SUPPORTED(ib_spec->ipv6.mask, LAST_IPV6_FIELD))
@@ -2637,9 +2658,10 @@ static int parse_flow_attr(struct mlx5_core_dev *mdev, u32 *match_c,
 			ib_spec->ipv6.mask.traffic_class,
 			ib_spec->ipv6.val.traffic_class);
 
-		set_proto(headers_c, headers_v,
-			  ib_spec->ipv6.mask.next_hdr,
-			  ib_spec->ipv6.val.next_hdr);
+		if (set_proto(headers_c, headers_v,
+			      ib_spec->ipv6.mask.next_hdr,
+			      ib_spec->ipv6.val.next_hdr))
+			return -EINVAL;
 
 		set_flow_label(misc_params_c, misc_params_v,
 			       ntohl(ib_spec->ipv6.mask.flow_label),
@@ -2660,10 +2682,8 @@ static int parse_flow_attr(struct mlx5_core_dev *mdev, u32 *match_c,
 					 LAST_TCP_UDP_FIELD))
 			return -EOPNOTSUPP;
 
-		MLX5_SET(fte_match_set_lyr_2_4, headers_c, ip_protocol,
-			 0xff);
-		MLX5_SET(fte_match_set_lyr_2_4, headers_v, ip_protocol,
-			 IPPROTO_TCP);
+		if (set_proto(headers_c, headers_v, 0xff, IPPROTO_TCP))
+			return -EINVAL;
 
 		MLX5_SET(fte_match_set_lyr_2_4, headers_c, tcp_sport,
 			 ntohs(ib_spec->tcp_udp.mask.src_port));
@@ -2680,10 +2700,8 @@ static int parse_flow_attr(struct mlx5_core_dev *mdev, u32 *match_c,
 					 LAST_TCP_UDP_FIELD))
 			return -EOPNOTSUPP;
 
-		MLX5_SET(fte_match_set_lyr_2_4, headers_c, ip_protocol,
-			 0xff);
-		MLX5_SET(fte_match_set_lyr_2_4, headers_v, ip_protocol,
-			 IPPROTO_UDP);
+		if (set_proto(headers_c, headers_v, 0xff, IPPROTO_UDP))
+			return -EINVAL;
 
 		MLX5_SET(fte_match_set_lyr_2_4, headers_c, udp_sport,
 			 ntohs(ib_spec->tcp_udp.mask.src_port));
@@ -2699,6 +2717,9 @@ static int parse_flow_attr(struct mlx5_core_dev *mdev, u32 *match_c,
 		if (ib_spec->gre.mask.c_ks_res0_ver)
 			return -EOPNOTSUPP;
 
+		if (set_proto(headers_c, headers_v, 0xff, IPPROTO_GRE))
+			return -EINVAL;
+
 		MLX5_SET(fte_match_set_lyr_2_4, headers_c, ip_protocol,
 			 0xff);
 		MLX5_SET(fte_match_set_lyr_2_4, headers_v, ip_protocol,
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 143/639] rtc: cmos: ignore bogus century byte
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (141 preceding siblings ...)
  2020-01-24  9:25 ` [PATCH 4.19 142/639] IB/mlx5: Dont override existing ip_protocol Greg Kroah-Hartman
@ 2020-01-24  9:25 ` Greg Kroah-Hartman
  2020-01-25 12:04   ` Pavel Machek
  2020-01-24  9:25 ` [PATCH 4.19 144/639] spi/topcliff_pch: Fix potential NULL dereference on allocation error Greg Kroah-Hartman
                   ` (499 subsequent siblings)
  642 siblings, 1 reply; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:25 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Alexandre Belloni, Alessandro Zummo,
	Sylvain Chouleur, Patrick McDermott, linux-rtc, Eric Wong,
	Sasha Levin

From: Eric Wong <e@80x24.org>

[ Upstream commit 2a4daadd4d3e507138f8937926e6a4df49c6bfdc ]

Older versions of Libreboot and Coreboot had an invalid value
(`3' in my case) in the century byte affecting the GM45 in
the Thinkpad X200.  Not everybody's updated their firmwares,
and Linux <= 4.2 was able to read the RTC without problems,
so workaround this by ignoring invalid values.

Fixes: 3c217e51d8a272b9 ("rtc: cmos: century support")

Cc: Alexandre Belloni <alexandre.belloni@bootlin.com>
Cc: Alessandro Zummo <a.zummo@towertech.it>
Cc: Sylvain Chouleur <sylvain.chouleur@intel.com>
Cc: Patrick McDermott <patrick.mcdermott@libiquity.com>
Cc: linux-rtc@vger.kernel.org
Signed-off-by: Eric Wong <e@80x24.org>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/rtc/rtc-mc146818-lib.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/rtc/rtc-mc146818-lib.c b/drivers/rtc/rtc-mc146818-lib.c
index 2f1772a358ca5..18a6f15e313d8 100644
--- a/drivers/rtc/rtc-mc146818-lib.c
+++ b/drivers/rtc/rtc-mc146818-lib.c
@@ -82,7 +82,7 @@ unsigned int mc146818_get_time(struct rtc_time *time)
 	time->tm_year += real_year - 72;
 #endif
 
-	if (century)
+	if (century > 20)
 		time->tm_year += (century - 19) * 100;
 
 	/*
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 144/639] spi/topcliff_pch: Fix potential NULL dereference on allocation error
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (142 preceding siblings ...)
  2020-01-24  9:25 ` [PATCH 4.19 143/639] rtc: cmos: ignore bogus century byte Greg Kroah-Hartman
@ 2020-01-24  9:25 ` Greg Kroah-Hartman
  2020-01-24  9:25 ` [PATCH 4.19 145/639] net: hns3: fix bug of ethtool_ops.get_channels for VF Greg Kroah-Hartman
                   ` (498 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:25 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, YueHaibing, Mark Brown, Sasha Levin

From: YueHaibing <yuehaibing@huawei.com>

[ Upstream commit e902cdcb5112b89ee445588147964723fd69ffb4 ]

In pch_spi_handle_dma, it doesn't check for NULL returns of kcalloc
so it would result in an Oops.

Fixes: c37f3c2749b5 ("spi/topcliff_pch: DMA support")
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-topcliff-pch.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/spi/spi-topcliff-pch.c b/drivers/spi/spi-topcliff-pch.c
index 4389ab80c23e6..fa730a871d252 100644
--- a/drivers/spi/spi-topcliff-pch.c
+++ b/drivers/spi/spi-topcliff-pch.c
@@ -1008,6 +1008,9 @@ static void pch_spi_handle_dma(struct pch_spi_data *data, int *bpw)
 
 	/* RX */
 	dma->sg_rx_p = kcalloc(num, sizeof(*dma->sg_rx_p), GFP_ATOMIC);
+	if (!dma->sg_rx_p)
+		return;
+
 	sg_init_table(dma->sg_rx_p, num); /* Initialize SG table */
 	/* offset, length setting */
 	sg = dma->sg_rx_p;
@@ -1068,6 +1071,9 @@ static void pch_spi_handle_dma(struct pch_spi_data *data, int *bpw)
 	}
 
 	dma->sg_tx_p = kcalloc(num, sizeof(*dma->sg_tx_p), GFP_ATOMIC);
+	if (!dma->sg_tx_p)
+		return;
+
 	sg_init_table(dma->sg_tx_p, num); /* Initialize SG table */
 	/* offset, length setting */
 	sg = dma->sg_tx_p;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 145/639] net: hns3: fix bug of ethtool_ops.get_channels for VF
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (143 preceding siblings ...)
  2020-01-24  9:25 ` [PATCH 4.19 144/639] spi/topcliff_pch: Fix potential NULL dereference on allocation error Greg Kroah-Hartman
@ 2020-01-24  9:25 ` Greg Kroah-Hartman
  2020-01-24  9:25 ` [PATCH 4.19 146/639] ARM: dts: sun8i-a23-a33: Move NAND controller device node to sort by address Greg Kroah-Hartman
                   ` (497 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:25 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Huazhong Tan, Peng Li,
	David S. Miller, Sasha Levin

From: Huazhong Tan <tanhuazhong@huawei.com>

[ Upstream commit 8be7362186bd5ccb5f6f72be49751ad2778e2636 ]

The current code returns the number of all queues that can be used and
the number of queues that have been allocated, which is incorrect.
What should be returned is the number of queues allocated for each enabled
TC and the number of queues that can be allocated.

This patch fixes it.

Fixes: 849e46077689 ("net: hns3: add ethtool_ops.get_channels support for VF")
Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com>
Signed-off-by: Peng Li <lipeng321@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
index 67db19709deaa..fd5375b5991bb 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
@@ -1957,7 +1957,8 @@ static u32 hclgevf_get_max_channels(struct hclgevf_dev *hdev)
 	struct hnae3_handle *nic = &hdev->nic;
 	struct hnae3_knic_private_info *kinfo = &nic->kinfo;
 
-	return min_t(u32, hdev->rss_size_max * kinfo->num_tc, hdev->num_tqps);
+	return min_t(u32, hdev->rss_size_max,
+		     hdev->num_tqps / kinfo->num_tc);
 }
 
 /**
@@ -1978,7 +1979,7 @@ static void hclgevf_get_channels(struct hnae3_handle *handle,
 	ch->max_combined = hclgevf_get_max_channels(hdev);
 	ch->other_count = 0;
 	ch->max_other = 0;
-	ch->combined_count = hdev->num_tqps;
+	ch->combined_count = handle->kinfo.rss_size;
 }
 
 static void hclgevf_get_tqps_and_rss_info(struct hnae3_handle *handle,
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 146/639] ARM: dts: sun8i-a23-a33: Move NAND controller device node to sort by address
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (144 preceding siblings ...)
  2020-01-24  9:25 ` [PATCH 4.19 145/639] net: hns3: fix bug of ethtool_ops.get_channels for VF Greg Kroah-Hartman
@ 2020-01-24  9:25 ` Greg Kroah-Hartman
  2020-01-24  9:25 ` [PATCH 4.19 147/639] clk: sunxi-ng: sun8i-a23: Enable PLL-MIPI LDOs when ungating it Greg Kroah-Hartman
                   ` (496 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:25 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chen-Yu Tsai, Maxime Ripard, Sasha Levin

From: Chen-Yu Tsai <wens@csie.org>

[ Upstream commit d027521497592773cd23d016d36975574d3452db ]

The NAND controller device node was inserted into the wrong position,
probably due to a rebase or merge, as the file's structure does not
provide enough context for git to accurately match the previous device
node block.

Fixes: d7b843df13ea ("ARM: dts: sun8i: add NAND controller node for A23/A33")
Signed-off-by: Chen-Yu Tsai <wens@csie.org>
Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/sun8i-a23-a33.dtsi | 28 +++++++++++++---------------
 1 file changed, 13 insertions(+), 15 deletions(-)

diff --git a/arch/arm/boot/dts/sun8i-a23-a33.dtsi b/arch/arm/boot/dts/sun8i-a23-a33.dtsi
index c16ffcc4db7da..a272a69519a26 100644
--- a/arch/arm/boot/dts/sun8i-a23-a33.dtsi
+++ b/arch/arm/boot/dts/sun8i-a23-a33.dtsi
@@ -155,6 +155,19 @@
 			#dma-cells = <1>;
 		};
 
+		nfc: nand@1c03000 {
+			compatible = "allwinner,sun4i-a10-nand";
+			reg = <0x01c03000 0x1000>;
+			interrupts = <GIC_SPI 70 IRQ_TYPE_LEVEL_HIGH>;
+			clocks = <&ccu CLK_BUS_NAND>, <&ccu CLK_NAND>;
+			clock-names = "ahb", "mod";
+			resets = <&ccu RST_BUS_NAND>;
+			reset-names = "ahb";
+			status = "disabled";
+			#address-cells = <1>;
+			#size-cells = <0>;
+		};
+
 		mmc0: mmc@1c0f000 {
 			compatible = "allwinner,sun7i-a20-mmc";
 			reg = <0x01c0f000 0x1000>;
@@ -212,21 +225,6 @@
 			#size-cells = <0>;
 		};
 
-		nfc: nand@1c03000 {
-			compatible = "allwinner,sun4i-a10-nand";
-			reg = <0x01c03000 0x1000>;
-			interrupts = <GIC_SPI 70 IRQ_TYPE_LEVEL_HIGH>;
-			clocks = <&ccu CLK_BUS_NAND>, <&ccu CLK_NAND>;
-			clock-names = "ahb", "mod";
-			resets = <&ccu RST_BUS_NAND>;
-			reset-names = "ahb";
-			pinctrl-names = "default";
-			pinctrl-0 = <&nand_pins &nand_pins_cs0 &nand_pins_rb0>;
-			status = "disabled";
-			#address-cells = <1>;
-			#size-cells = <0>;
-		};
-
 		usb_otg: usb@1c19000 {
 			/* compatible gets set in SoC specific dtsi file */
 			reg = <0x01c19000 0x0400>;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 147/639] clk: sunxi-ng: sun8i-a23: Enable PLL-MIPI LDOs when ungating it
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (145 preceding siblings ...)
  2020-01-24  9:25 ` [PATCH 4.19 146/639] ARM: dts: sun8i-a23-a33: Move NAND controller device node to sort by address Greg Kroah-Hartman
@ 2020-01-24  9:25 ` Greg Kroah-Hartman
  2020-01-24  9:25 ` [PATCH 4.19 148/639] iwlwifi: mvm: avoid possible access out of array Greg Kroah-Hartman
                   ` (495 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:25 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chen-Yu Tsai, Maxime Ripard, Sasha Levin

From: Chen-Yu Tsai <wens@csie.org>

[ Upstream commit 108a459ef4cd17a28711d81092044e597b5c7618 ]

The PLL-MIPI clock is somewhat special as it has its own LDOs which
need to be turned on for this PLL to actually work and output a clock
signal.

Add the 2 LDO enable bits to the gate bits.

Fixes: 5690879d93e8 ("clk: sunxi-ng: Add A23 CCU")
Signed-off-by: Chen-Yu Tsai <wens@csie.org>
Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/sunxi-ng/ccu-sun8i-a23.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/clk/sunxi-ng/ccu-sun8i-a23.c b/drivers/clk/sunxi-ng/ccu-sun8i-a23.c
index a4fa2945f2302..4b5f8f4e4ab8c 100644
--- a/drivers/clk/sunxi-ng/ccu-sun8i-a23.c
+++ b/drivers/clk/sunxi-ng/ccu-sun8i-a23.c
@@ -144,7 +144,7 @@ static SUNXI_CCU_NKM_WITH_GATE_LOCK(pll_mipi_clk, "pll-mipi",
 				    8, 4,		/* N */
 				    4, 2,		/* K */
 				    0, 4,		/* M */
-				    BIT(31),		/* gate */
+				    BIT(31) | BIT(23) | BIT(22), /* gate */
 				    BIT(28),		/* lock */
 				    CLK_SET_RATE_UNGATE);
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 148/639] iwlwifi: mvm: avoid possible access out of array.
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (146 preceding siblings ...)
  2020-01-24  9:25 ` [PATCH 4.19 147/639] clk: sunxi-ng: sun8i-a23: Enable PLL-MIPI LDOs when ungating it Greg Kroah-Hartman
@ 2020-01-24  9:25 ` Greg Kroah-Hartman
  2020-01-24  9:25 ` [PATCH 4.19 149/639] net/mlx5: Take lock with IRQs disabled to avoid deadlock Greg Kroah-Hartman
                   ` (494 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:25 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Mordechay Goodstein, Luca Coelho,
	Sasha Levin

From: Mordechay Goodstein <mordechay.goodstein@intel.com>

[ Upstream commit b0d795a9ae558209656b18930c2b4def5f8fdfb8 ]

The value in txq_id can be out of array scope,
validate it before accessing the array.

Signed-off-by: Mordechay Goodstein <mordechay.goodstein@intel.com>
Fixes: cf961e16620f ("iwlwifi: mvm: support dqa-mode agg on non-shared queue")
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/intel/iwlwifi/mvm/sta.c | 19 +++++++++++++------
 1 file changed, 13 insertions(+), 6 deletions(-)

diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
index e850aa504b608..69057701641e0 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
@@ -2462,7 +2462,7 @@ int iwl_mvm_sta_tx_agg_start(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
 	struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
 	struct iwl_mvm_tid_data *tid_data;
 	u16 normalized_ssn;
-	int txq_id;
+	u16 txq_id;
 	int ret;
 
 	if (WARN_ON_ONCE(tid >= IWL_MAX_TID_COUNT))
@@ -2506,17 +2506,24 @@ int iwl_mvm_sta_tx_agg_start(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
 	 */
 	txq_id = mvmsta->tid_data[tid].txq_id;
 	if (txq_id == IWL_MVM_INVALID_QUEUE) {
-		txq_id = iwl_mvm_find_free_queue(mvm, mvmsta->sta_id,
-						 IWL_MVM_DQA_MIN_DATA_QUEUE,
-						 IWL_MVM_DQA_MAX_DATA_QUEUE);
-		if (txq_id < 0) {
-			ret = txq_id;
+		ret = iwl_mvm_find_free_queue(mvm, mvmsta->sta_id,
+					      IWL_MVM_DQA_MIN_DATA_QUEUE,
+					      IWL_MVM_DQA_MAX_DATA_QUEUE);
+		if (ret < 0) {
 			IWL_ERR(mvm, "Failed to allocate agg queue\n");
 			goto release_locks;
 		}
 
+		txq_id = ret;
+
 		/* TXQ hasn't yet been enabled, so mark it only as reserved */
 		mvm->queue_info[txq_id].status = IWL_MVM_QUEUE_RESERVED;
+	} else if (WARN_ON(txq_id >= IWL_MAX_HW_QUEUES)) {
+		ret = -ENXIO;
+		IWL_ERR(mvm, "tid_id %d out of range (0, %d)!\n",
+			tid, IWL_MAX_HW_QUEUES - 1);
+		goto out;
+
 	} else if (unlikely(mvm->queue_info[txq_id].status ==
 			    IWL_MVM_QUEUE_SHARED)) {
 		ret = -ENXIO;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 149/639] net/mlx5: Take lock with IRQs disabled to avoid deadlock
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (147 preceding siblings ...)
  2020-01-24  9:25 ` [PATCH 4.19 148/639] iwlwifi: mvm: avoid possible access out of array Greg Kroah-Hartman
@ 2020-01-24  9:25 ` Greg Kroah-Hartman
  2020-01-24  9:25 ` [PATCH 4.19 150/639] ip_tunnel: Fix route fl4 init in ip_md_tunnel_xmit Greg Kroah-Hartman
                   ` (493 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:25 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Moni Shoua, Leon Romanovsky,
	Saeed Mahameed, Sasha Levin

From: Moni Shoua <monis@mellanox.com>

[ Upstream commit 33814e5d127e21f53b52e17b0722c1b57d4f4d29 ]

The lock in qp_table might be taken from process context or from
interrupt context. This may lead to a deadlock unless it is taken with
IRQs disabled.

Discovered by lockdep

================================
WARNING: inconsistent lock state
4.20.0-rc6
--------------------------------
inconsistent {HARDIRQ-ON-W} -> {IN-HARDIRQ-W}

python/12572 [HC1[1]:SC0[0]:HE0:SE1] takes:
00000000052a4df4 (&(&table->lock)->rlock#2){?.+.}, /0x50 [mlx5_core]
{HARDIRQ-ON-W} state was registered at:
  _raw_spin_lock+0x33/0x70
  mlx5_get_rsc+0x1a/0x50 [mlx5_core]
  mlx5_ib_eqe_pf_action+0x493/0x1be0 [mlx5_ib]
  process_one_work+0x90c/0x1820
  worker_thread+0x87/0xbb0
  kthread+0x320/0x3e0
  ret_from_fork+0x24/0x30
irq event stamp: 103928
hardirqs last  enabled at (103927): [] nk+0x1a/0x1c
hardirqs last disabled at (103928): [] unk+0x1a/0x1c
softirqs last  enabled at (103924): [] tcp_sendmsg+0x31/0x40
softirqs last disabled at (103922): [] 80

other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock(&(&table->lock)->rlock#2);

    lock(&(&table->lock)->rlock#2);

 *** DEADLOCK ***

Fixes: 032080ab43ac ("IB/mlx5: Lock QP during page fault handling")
Signed-off-by: Moni Shoua <monis@mellanox.com>
Reviewed-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/mellanox/mlx5/core/qp.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/qp.c b/drivers/net/ethernet/mellanox/mlx5/core/qp.c
index f33707ce8b6b0..479ac21cdbc69 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/qp.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/qp.c
@@ -44,14 +44,15 @@ static struct mlx5_core_rsc_common *mlx5_get_rsc(struct mlx5_core_dev *dev,
 {
 	struct mlx5_qp_table *table = &dev->priv.qp_table;
 	struct mlx5_core_rsc_common *common;
+	unsigned long flags;
 
-	spin_lock(&table->lock);
+	spin_lock_irqsave(&table->lock, flags);
 
 	common = radix_tree_lookup(&table->tree, rsn);
 	if (common)
 		atomic_inc(&common->refcount);
 
-	spin_unlock(&table->lock);
+	spin_unlock_irqrestore(&table->lock, flags);
 
 	if (!common) {
 		mlx5_core_warn(dev, "Async event for bogus resource 0x%x\n",
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 150/639] ip_tunnel: Fix route fl4 init in ip_md_tunnel_xmit
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (148 preceding siblings ...)
  2020-01-24  9:25 ` [PATCH 4.19 149/639] net/mlx5: Take lock with IRQs disabled to avoid deadlock Greg Kroah-Hartman
@ 2020-01-24  9:25 ` Greg Kroah-Hartman
  2020-01-24  9:25 ` [PATCH 4.19 151/639] arm64: dts: allwinner: h6: Move GIC device node fix base address ordering Greg Kroah-Hartman
                   ` (492 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:25 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, wenxu, David S. Miller, Sasha Levin

From: wenxu <wenxu@ucloud.cn>

[ Upstream commit 6e6b904ad4f9aed43ec320afbd5a52ed8461ab41 ]

Init the gre_key from tuninfo->key.tun_id and init the mark
from the skb->mark, set the oif to zero in the collect metadata
mode.

Fixes: cfc7381b3002 ("ip_tunnel: add collect_md mode to IPIP tunnel")
Signed-off-by: wenxu <wenxu@ucloud.cn>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ipv4/ip_tunnel.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
index 420e891ac59da..f03a1b68e70f0 100644
--- a/net/ipv4/ip_tunnel.c
+++ b/net/ipv4/ip_tunnel.c
@@ -574,8 +574,9 @@ void ip_md_tunnel_xmit(struct sk_buff *skb, struct net_device *dev, u8 proto)
 		else if (skb->protocol == htons(ETH_P_IPV6))
 			tos = ipv6_get_dsfield((const struct ipv6hdr *)inner_iph);
 	}
-	ip_tunnel_init_flow(&fl4, proto, key->u.ipv4.dst, key->u.ipv4.src, 0,
-			    RT_TOS(tos), tunnel->parms.link, tunnel->fwmark);
+	ip_tunnel_init_flow(&fl4, proto, key->u.ipv4.dst, key->u.ipv4.src,
+			    tunnel_id_to_key32(key->tun_id), RT_TOS(tos),
+			    0, skb->mark);
 	if (tunnel->encap.type != TUNNEL_ENCAP_NONE)
 		goto tx_error;
 	rt = ip_route_output_key(tunnel->net, &fl4);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 151/639] arm64: dts: allwinner: h6: Move GIC device node fix base address ordering
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (149 preceding siblings ...)
  2020-01-24  9:25 ` [PATCH 4.19 150/639] ip_tunnel: Fix route fl4 init in ip_md_tunnel_xmit Greg Kroah-Hartman
@ 2020-01-24  9:25 ` Greg Kroah-Hartman
  2020-01-25 12:50   ` Pavel Machek
  2020-01-24  9:25 ` [PATCH 4.19 152/639] iwlwifi: mvm: fix A-MPDU reference assignment Greg Kroah-Hartman
                   ` (491 subsequent siblings)
  642 siblings, 1 reply; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:25 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chen-Yu Tsai, Maxime Ripard, Sasha Levin

From: Chen-Yu Tsai <wens@csie.org>

[ Upstream commit 52d9bcb3d0de3fa1e07aff3800f857836d30410d ]

The GIC device node was placed out of order in the initial device tree
submission. Move it so the nodes are correctly sorted by base address
again.

Fixes: e54be32d0273 ("arm64: allwinner: h6: add the basical Allwinner H6 DTSI file")
Signed-off-by: Chen-Yu Tsai <wens@csie.org>
Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/allwinner/sun50i-h6.dtsi | 22 ++++++++++----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h6.dtsi b/arch/arm64/boot/dts/allwinner/sun50i-h6.dtsi
index cfa5fffcf62b4..72813e7aefb8a 100644
--- a/arch/arm64/boot/dts/allwinner/sun50i-h6.dtsi
+++ b/arch/arm64/boot/dts/allwinner/sun50i-h6.dtsi
@@ -101,17 +101,6 @@
 			#reset-cells = <1>;
 		};
 
-		gic: interrupt-controller@3021000 {
-			compatible = "arm,gic-400";
-			reg = <0x03021000 0x1000>,
-			      <0x03022000 0x2000>,
-			      <0x03024000 0x2000>,
-			      <0x03026000 0x2000>;
-			interrupts = <GIC_PPI 9 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_HIGH)>;
-			interrupt-controller;
-			#interrupt-cells = <3>;
-		};
-
 		pio: pinctrl@300b000 {
 			compatible = "allwinner,sun50i-h6-pinctrl";
 			reg = <0x0300b000 0x400>;
@@ -149,6 +138,17 @@
 			};
 		};
 
+		gic: interrupt-controller@3021000 {
+			compatible = "arm,gic-400";
+			reg = <0x03021000 0x1000>,
+			      <0x03022000 0x2000>,
+			      <0x03024000 0x2000>,
+			      <0x03026000 0x2000>;
+			interrupts = <GIC_PPI 9 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_HIGH)>;
+			interrupt-controller;
+			#interrupt-cells = <3>;
+		};
+
 		mmc0: mmc@4020000 {
 			compatible = "allwinner,sun50i-h6-mmc",
 				     "allwinner,sun50i-a64-mmc";
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 152/639] iwlwifi: mvm: fix A-MPDU reference assignment
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (150 preceding siblings ...)
  2020-01-24  9:25 ` [PATCH 4.19 151/639] arm64: dts: allwinner: h6: Move GIC device node fix base address ordering Greg Kroah-Hartman
@ 2020-01-24  9:25 ` Greg Kroah-Hartman
  2020-01-24  9:25 ` [PATCH 4.19 153/639] bus: ti-sysc: Fix timer handling with drop pm_runtime_irq_safe() Greg Kroah-Hartman
                   ` (490 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:25 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Danny Alexander, Johannes Berg,
	Luca Coelho, Sasha Levin

From: Johannes Berg <johannes.berg@intel.com>

[ Upstream commit 1f7698abedeeb3fef3cbcf78e16f925df675a179 ]

The current code assigns the reference, and then goes to increment
it if the toggle bit has changed. That way, we get

Toggle  0  0  0  0  1  1  1  1
ID      1  1  1  1  1  2  2  2

Fix that by assigning the post-toggle ID to get

Toggle  0  0  0  0  1  1  1  1
ID      1  1  1  1  2  2  2  2

Reported-by: Danny Alexander <danny.alexander@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Fixes: fbe4112791b8 ("iwlwifi: mvm: update mpdu metadata API")
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
index 036d1d82d93e7..77e3694536421 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
@@ -1077,7 +1077,6 @@ void iwl_mvm_rx_mpdu_mq(struct iwl_mvm *mvm, struct napi_struct *napi,
 			he_phy_data = le64_to_cpu(desc->v1.he_phy_data);
 
 		rx_status->flag |= RX_FLAG_AMPDU_DETAILS;
-		rx_status->ampdu_reference = mvm->ampdu_ref;
 		/* toggle is switched whenever new aggregation starts */
 		if (toggle_bit != mvm->ampdu_toggle) {
 			mvm->ampdu_ref++;
@@ -1092,6 +1091,7 @@ void iwl_mvm_rx_mpdu_mq(struct iwl_mvm *mvm, struct napi_struct *napi,
 						RX_FLAG_AMPDU_EOF_BIT;
 			}
 		}
+		rx_status->ampdu_reference = mvm->ampdu_ref;
 	}
 
 	rcu_read_lock();
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 153/639] bus: ti-sysc: Fix timer handling with drop pm_runtime_irq_safe()
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (151 preceding siblings ...)
  2020-01-24  9:25 ` [PATCH 4.19 152/639] iwlwifi: mvm: fix A-MPDU reference assignment Greg Kroah-Hartman
@ 2020-01-24  9:25 ` Greg Kroah-Hartman
  2020-01-24  9:25 ` [PATCH 4.19 154/639] tty: ipwireless: Fix potential NULL pointer dereference Greg Kroah-Hartman
                   ` (489 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:25 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Andy Shevchenko, Bartosz Golaszewski,
	Daniel Lezcano, H. Nikolaus Schaller, Keerthy, Ladislav Michl,
	Pavel Machek, Sebastian Reichel, Tero Kristo, Thierry Reding,
	Thomas Gleixner, Andreas Kemnade, Tony Lindgren, Sasha Levin

From: Tony Lindgren <tony@atomide.com>

[ Upstream commit 9bd34c63f5536c490c152833c77fa47f59aeade3 ]

Commit 84badc5ec5fc ("ARM: dts: omap4: Move l4 child devices to probe
them with ti-sysc") started producing a warning for pwm-omap-dmtimer:

WARNING: CPU: 0 PID: 77 at drivers/bus/omap_l3_noc.c:147
l3_interrupt_handler+0x2f8/0x388
44000000.ocp:L3 Custom Error: MASTER MPU TARGET L4PER2 (Idle):
Data Access in Supervisor mode during Functional access
...
__pm_runtime_idle
omap_dm_timer_disable
pwm_omap_dmtimer_start
pwm_omap_dmtimer_enable
pwm_apply_state
pwm_vibrator_start
pwm_vibrator_play_work

This is because the timer that pwm-omap-dmtimer is using is now being
probed with ti-sysc interconnect target module instead of omap_device
and the ti-sysc quirk for SYSC_QUIRK_LEGACY_IDLE is not fully
compatible with what omap_device has been doing.

We could fix this by reverting the timer changes and have the timer
probe again with omap_device. Or we could add more quirk handling to
ti-sysc driver. But as these options don't work nicely as longer term
solutions, let's just make timers probe with ti-sysc without any
quirks.

To do this, all we need to do is remove quirks for timers for ti-sysc,
and drop the bogus pm_runtime_irq_safe() flag for timer-ti-dm.

We should not use pm_runtime_irq_safe() anyways for drivers as it will
take a permanent use count on the parent device blocking the parent
devices from idling and has been forcing ti-sysc driver to use a
quirk flag.

Note that we will move the timer data to DEBUG section later on in
clean-up patches.

Fixes: 84badc5ec5fc ("ARM: dts: omap4: Move l4 child devices to probe them with ti-sysc")
Cc: Andy Shevchenko <andy.shevchenko@gmail.com>
Cc: Bartosz Golaszewski <bgolaszewski@baylibre.com>
Cc: Daniel Lezcano <daniel.lezcano@linaro.org>
Cc: H. Nikolaus Schaller <hns@goldelico.com>
Cc: Keerthy <j-keerthy@ti.com>
Cc: Ladislav Michl <ladis@linux-mips.org>
Cc: Pavel Machek <pavel@ucw.cz>
Cc: Sebastian Reichel <sre@kernel.org>
Cc: Tero Kristo <t-kristo@ti.com>
Cc: Thierry Reding <thierry.reding@gmail.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Reported-by: H. Nikolaus Schaller <hns@goldelico.com>
Tested-By: Andreas Kemnade <andreas@kemnade.info>
Tested-By: H. Nikolaus Schaller <hns@goldelico.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/bus/ti-sysc.c             | 4 ++--
 drivers/clocksource/timer-ti-dm.c | 1 -
 2 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c
index 926c83398b27b..2813f9ed57c0d 100644
--- a/drivers/bus/ti-sysc.c
+++ b/drivers/bus/ti-sysc.c
@@ -888,10 +888,10 @@ static const struct sysc_revision_quirk sysc_revision_quirks[] = {
 	SYSC_QUIRK("smartreflex", 0, -1, 0x38, -1, 0x00000000, 0xffffffff,
 		   SYSC_QUIRK_LEGACY_IDLE),
 	SYSC_QUIRK("timer", 0, 0, 0x10, 0x14, 0x00000015, 0xffffffff,
-		   SYSC_QUIRK_LEGACY_IDLE),
+		   0),
 	/* Some timers on omap4 and later */
 	SYSC_QUIRK("timer", 0, 0, 0x10, -1, 0x4fff1301, 0xffffffff,
-		   SYSC_QUIRK_LEGACY_IDLE),
+		   0),
 	SYSC_QUIRK("uart", 0, 0x50, 0x54, 0x58, 0x00000052, 0xffffffff,
 		   SYSC_QUIRK_LEGACY_IDLE),
 	/* Uarts on omap4 and later */
diff --git a/drivers/clocksource/timer-ti-dm.c b/drivers/clocksource/timer-ti-dm.c
index 3ecf84706640b..23414dddc3bae 100644
--- a/drivers/clocksource/timer-ti-dm.c
+++ b/drivers/clocksource/timer-ti-dm.c
@@ -868,7 +868,6 @@ static int omap_dm_timer_probe(struct platform_device *pdev)
 	timer->pdev = pdev;
 
 	pm_runtime_enable(dev);
-	pm_runtime_irq_safe(dev);
 
 	if (!timer->reserved) {
 		ret = pm_runtime_get_sync(dev);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 154/639] tty: ipwireless: Fix potential NULL pointer dereference
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (152 preceding siblings ...)
  2020-01-24  9:25 ` [PATCH 4.19 153/639] bus: ti-sysc: Fix timer handling with drop pm_runtime_irq_safe() Greg Kroah-Hartman
@ 2020-01-24  9:25 ` Greg Kroah-Hartman
  2020-01-24  9:25 ` [PATCH 4.19 155/639] driver: uio: fix possible memory leak in __uio_register_device Greg Kroah-Hartman
                   ` (488 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:25 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, YueHaibing, Sasha Levin

From: YueHaibing <yuehaibing@huawei.com>

[ Upstream commit 7dd50e205b3348dc7784efbdf85723551de64a25 ]

There is a potential NULL pointer dereference in case
alloc_ctrl_packet() fails and returns NULL.

Fixes: 099dc4fb6265 ("ipwireless: driver for PC Card 3G/UMTS modem")
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/ipwireless/hardware.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/tty/ipwireless/hardware.c b/drivers/tty/ipwireless/hardware.c
index b0baa4ce10f98..6bbf35682d531 100644
--- a/drivers/tty/ipwireless/hardware.c
+++ b/drivers/tty/ipwireless/hardware.c
@@ -1516,6 +1516,8 @@ static void ipw_send_setup_packet(struct ipw_hardware *hw)
 			sizeof(struct ipw_setup_get_version_query_packet),
 			ADDR_SETUP_PROT, TL_PROTOCOLID_SETUP,
 			TL_SETUP_SIGNO_GET_VERSION_QRY);
+	if (!ver_packet)
+		return;
 	ver_packet->header.length = sizeof(struct tl_setup_get_version_qry);
 
 	/*
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 155/639] driver: uio: fix possible memory leak in __uio_register_device
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (153 preceding siblings ...)
  2020-01-24  9:25 ` [PATCH 4.19 154/639] tty: ipwireless: Fix potential NULL pointer dereference Greg Kroah-Hartman
@ 2020-01-24  9:25 ` Greg Kroah-Hartman
  2020-01-24  9:25 ` [PATCH 4.19 156/639] driver: uio: fix possible use-after-free " Greg Kroah-Hartman
                   ` (487 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:25 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Liu Jian, Hamish Martin, Sasha Levin

From: Liu Jian <liujian56@huawei.com>

[ Upstream commit 1a392b3de7c5747506b38fc14b2e79977d3c7770 ]

'idev' is malloced in __uio_register_device() and leak free it before
leaving from the uio_get_minor() error handing case, it will cause
memory leak.

Fixes: a93e7b331568 ("uio: Prevent device destruction while fds are open")
Signed-off-by: Liu Jian <liujian56@huawei.com>
Reviewed-by: Hamish Martin <hamish.martin@alliedtelesis.co.nz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/uio/uio.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c
index 2762148c169df..e4b418757017f 100644
--- a/drivers/uio/uio.c
+++ b/drivers/uio/uio.c
@@ -938,8 +938,10 @@ int __uio_register_device(struct module *owner,
 	atomic_set(&idev->event, 0);
 
 	ret = uio_get_minor(idev);
-	if (ret)
+	if (ret) {
+		kfree(idev);
 		return ret;
+	}
 
 	idev->dev.devt = MKDEV(uio_major, idev->minor);
 	idev->dev.class = &uio_class;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 156/639] driver: uio: fix possible use-after-free in __uio_register_device
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (154 preceding siblings ...)
  2020-01-24  9:25 ` [PATCH 4.19 155/639] driver: uio: fix possible memory leak in __uio_register_device Greg Kroah-Hartman
@ 2020-01-24  9:25 ` Greg Kroah-Hartman
  2020-01-24  9:25 ` [PATCH 4.19 157/639] crypto: crypto4xx - Fix wrong ppc4xx_trng_probe()/ppc4xx_trng_remove() arguments Greg Kroah-Hartman
                   ` (486 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:25 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Liu Jian, Hamish Martin, Sasha Levin

From: Liu Jian <liujian56@huawei.com>

[ Upstream commit 221a1f4ac12d2ab46246c160b2e00d1b1160d5d9 ]

In uio_dev_add_attributes() error handing case, idev is used after
device_unregister(), in which 'idev' has been released, touch idev cause
use-after-free.

Fixes: a93e7b331568 ("uio: Prevent device destruction while fds are open")
Signed-off-by: Liu Jian <liujian56@huawei.com>
Reviewed-by: Hamish Martin <hamish.martin@alliedtelesis.co.nz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/uio/uio.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c
index e4b418757017f..9c788748bdc65 100644
--- a/drivers/uio/uio.c
+++ b/drivers/uio/uio.c
@@ -943,6 +943,7 @@ int __uio_register_device(struct module *owner,
 		return ret;
 	}
 
+	device_initialize(&idev->dev);
 	idev->dev.devt = MKDEV(uio_major, idev->minor);
 	idev->dev.class = &uio_class;
 	idev->dev.parent = parent;
@@ -953,7 +954,7 @@ int __uio_register_device(struct module *owner,
 	if (ret)
 		goto err_device_create;
 
-	ret = device_register(&idev->dev);
+	ret = device_add(&idev->dev);
 	if (ret)
 		goto err_device_create;
 
@@ -985,9 +986,10 @@ int __uio_register_device(struct module *owner,
 err_request_irq:
 	uio_dev_del_attributes(idev);
 err_uio_dev_add_attributes:
-	device_unregister(&idev->dev);
+	device_del(&idev->dev);
 err_device_create:
 	uio_free_minor(idev);
+	put_device(&idev->dev);
 	return ret;
 }
 EXPORT_SYMBOL_GPL(__uio_register_device);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 157/639] crypto: crypto4xx - Fix wrong ppc4xx_trng_probe()/ppc4xx_trng_remove() arguments
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (155 preceding siblings ...)
  2020-01-24  9:25 ` [PATCH 4.19 156/639] driver: uio: fix possible use-after-free " Greg Kroah-Hartman
@ 2020-01-24  9:25 ` Greg Kroah-Hartman
  2020-01-24  9:25 ` [PATCH 4.19 158/639] driver core: Fix DL_FLAG_AUTOREMOVE_SUPPLIER device link flag handling Greg Kroah-Hartman
                   ` (485 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:25 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Corentin Labbe, Herbert Xu, Sasha Levin

From: Corentin Labbe <clabbe@baylibre.com>

[ Upstream commit 6e88098ca43a3d80ae86908f7badba683c8a0d84 ]

When building without CONFIG_HW_RANDOM_PPC4XX, I hit the following build failure:
drivers/crypto/amcc/crypto4xx_core.c: In function 'crypto4xx_probe':
drivers/crypto/amcc/crypto4xx_core.c:1407:20: error: passing argument 1 of 'ppc4xx_trng_probe' from incompatible pointer type [-Werror=incompatible-pointer-types]
In file included from drivers/crypto/amcc/crypto4xx_core.c:50:0:
drivers/crypto/amcc/crypto4xx_trng.h:28:20: note: expected 'struct crypto4xx_device *' but argument is of type 'struct crypto4xx_core_device *'
drivers/crypto/amcc/crypto4xx_core.c: In function 'crypto4xx_remove':
drivers/crypto/amcc/crypto4xx_core.c:1434:21: error: passing argument 1 of 'ppc4xx_trng_remove' from incompatible pointer type [-Werror=incompatible-pointer-types]
In file included from drivers/crypto/amcc/crypto4xx_core.c:50:0:
drivers/crypto/amcc/crypto4xx_trng.h:30:20: note: expected 'struct crypto4xx_device *' but argument is of type 'struct crypto4xx_core_device *'

This patch fix the needed argument of ppc4xx_trng_probe()/ppc4xx_trng_remove() in that case.

Fixes: 5343e674f32f ("crypto4xx: integrate ppc4xx-rng into crypto4xx")
Signed-off-by: Corentin Labbe <clabbe@baylibre.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/amcc/crypto4xx_trng.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/crypto/amcc/crypto4xx_trng.h b/drivers/crypto/amcc/crypto4xx_trng.h
index 931d22531f515..7bbda51b7337c 100644
--- a/drivers/crypto/amcc/crypto4xx_trng.h
+++ b/drivers/crypto/amcc/crypto4xx_trng.h
@@ -26,9 +26,9 @@ void ppc4xx_trng_probe(struct crypto4xx_core_device *core_dev);
 void ppc4xx_trng_remove(struct crypto4xx_core_device *core_dev);
 #else
 static inline void ppc4xx_trng_probe(
-	struct crypto4xx_device *dev __maybe_unused) { }
+	struct crypto4xx_core_device *dev __maybe_unused) { }
 static inline void ppc4xx_trng_remove(
-	struct crypto4xx_device *dev __maybe_unused) { }
+	struct crypto4xx_core_device *dev __maybe_unused) { }
 #endif
 
 #endif
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 158/639] driver core: Fix DL_FLAG_AUTOREMOVE_SUPPLIER device link flag handling
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (156 preceding siblings ...)
  2020-01-24  9:25 ` [PATCH 4.19 157/639] crypto: crypto4xx - Fix wrong ppc4xx_trng_probe()/ppc4xx_trng_remove() arguments Greg Kroah-Hartman
@ 2020-01-24  9:25 ` Greg Kroah-Hartman
  2020-01-24  9:25 ` [PATCH 4.19 159/639] driver core: Avoid careless re-use of existing device links Greg Kroah-Hartman
                   ` (484 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:25 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Rafael J. Wysocki, Sasha Levin

From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>

[ Upstream commit c8d50986da5d74ddfc233b13b91d0a13369fa164 ]

Change the list walk in device_links_driver_cleanup() to a safe one
to avoid use-after-free when dropping a link from the list during the
walk.

Also, while at it, fix device_link_add() to refuse to create
stateless device links with DL_FLAG_AUTOREMOVE_SUPPLIER set, which is
an invalid combination (setting that flag means that the driver core
should manage the link, so it cannot be stateless), and extend the
kerneldoc comment of device_link_add() to cover the
DL_FLAG_AUTOREMOVE_SUPPLIER flag properly too.

Fixes: 1689cac5b32a ("driver core: Add flag to autoremove device link on supplier unbind")
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/base/core.c | 20 ++++++++++++--------
 1 file changed, 12 insertions(+), 8 deletions(-)

diff --git a/drivers/base/core.c b/drivers/base/core.c
index 985ccced33a21..055132f2292aa 100644
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -179,10 +179,14 @@ void device_pm_move_to_tail(struct device *dev)
  * of the link.  If DL_FLAG_PM_RUNTIME is not set, DL_FLAG_RPM_ACTIVE will be
  * ignored.
  *
- * If the DL_FLAG_AUTOREMOVE_CONSUMER is set, the link will be removed
- * automatically when the consumer device driver unbinds from it.
- * The combination of both DL_FLAG_AUTOREMOVE_CONSUMER and DL_FLAG_STATELESS
- * set is invalid and will cause NULL to be returned.
+ * If the DL_FLAG_AUTOREMOVE_CONSUMER flag is set, the link will be removed
+ * automatically when the consumer device driver unbinds from it.  Analogously,
+ * if DL_FLAG_AUTOREMOVE_SUPPLIER is set in @flags, the link will be removed
+ * automatically when the supplier device driver unbinds from it.
+ *
+ * The combination of DL_FLAG_STATELESS and either DL_FLAG_AUTOREMOVE_CONSUMER
+ * or DL_FLAG_AUTOREMOVE_SUPPLIER set in @flags at the same time is invalid and
+ * will cause NULL to be returned upfront.
  *
  * A side effect of the link creation is re-ordering of dpm_list and the
  * devices_kset list by moving the consumer device and all devices depending
@@ -199,8 +203,8 @@ struct device_link *device_link_add(struct device *consumer,
 	struct device_link *link;
 
 	if (!consumer || !supplier ||
-	    ((flags & DL_FLAG_STATELESS) &&
-	     (flags & DL_FLAG_AUTOREMOVE_CONSUMER)))
+	    (flags & DL_FLAG_STATELESS &&
+	     flags & (DL_FLAG_AUTOREMOVE_CONSUMER | DL_FLAG_AUTOREMOVE_SUPPLIER)))
 		return NULL;
 
 	device_links_write_lock();
@@ -539,11 +543,11 @@ void device_links_no_driver(struct device *dev)
  */
 void device_links_driver_cleanup(struct device *dev)
 {
-	struct device_link *link;
+	struct device_link *link, *ln;
 
 	device_links_write_lock();
 
-	list_for_each_entry(link, &dev->links.consumers, s_node) {
+	list_for_each_entry_safe(link, ln, &dev->links.consumers, s_node) {
 		if (link->flags & DL_FLAG_STATELESS)
 			continue;
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 159/639] driver core: Avoid careless re-use of existing device links
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (157 preceding siblings ...)
  2020-01-24  9:25 ` [PATCH 4.19 158/639] driver core: Fix DL_FLAG_AUTOREMOVE_SUPPLIER device link flag handling Greg Kroah-Hartman
@ 2020-01-24  9:25 ` Greg Kroah-Hartman
  2020-01-24  9:25 ` [PATCH 4.19 160/639] driver core: Do not resume suppliers under device_links_write_lock() Greg Kroah-Hartman
                   ` (483 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:25 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Rafael J. Wysocki, Sasha Levin

From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>

[ Upstream commit f265df550a4350dce0a4d721a77c52e4b847ea40 ]

After commit ead18c23c263 ("driver core: Introduce device links
reference counting"), if there is a link between the given supplier
and the given consumer already, device_link_add() will refcount it
and return it unconditionally.  However, if the flags passed to
it on the second (or any subsequent) attempt to create a device
link between the same consumer-supplier pair are not compatible with
the existing link's flags, that is incorrect.

First off, if the existing link is stateless and the next caller of
device_link_add() for the same consumer-supplier pair wants a
stateful one, or the other way around, the existing link cannot be
returned, because it will not match the expected behavior, so make
device_link_add() dump the stack and return NULL in that case.

Moreover, if the DL_FLAG_AUTOREMOVE_CONSUMER flag is passed to
device_link_add(), its caller will expect its reference to the link
to be dropped automatically on consumer driver removal, which will
not happen if that flag is not set in the link's flags (and
analogously for DL_FLAG_AUTOREMOVE_SUPPLIER).  For this reason, make
device_link_add() update the existing link's flags accordingly
before returning it to the caller.

Fixes: ead18c23c263 ("driver core: Introduce device links reference counting")
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/base/core.c | 23 ++++++++++++++++++++---
 1 file changed, 20 insertions(+), 3 deletions(-)

diff --git a/drivers/base/core.c b/drivers/base/core.c
index 055132f2292aa..562385c47fa44 100644
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -221,12 +221,29 @@ struct device_link *device_link_add(struct device *consumer,
 		goto out;
 	}
 
-	list_for_each_entry(link, &supplier->links.consumers, s_node)
-		if (link->consumer == consumer) {
-			kref_get(&link->kref);
+	list_for_each_entry(link, &supplier->links.consumers, s_node) {
+		if (link->consumer != consumer)
+			continue;
+
+		/*
+		 * Don't return a stateless link if the caller wants a stateful
+		 * one and vice versa.
+		 */
+		if (WARN_ON((flags & DL_FLAG_STATELESS) != (link->flags & DL_FLAG_STATELESS))) {
+			link = NULL;
 			goto out;
 		}
 
+		if (flags & DL_FLAG_AUTOREMOVE_CONSUMER)
+			link->flags |= DL_FLAG_AUTOREMOVE_CONSUMER;
+
+		if (flags & DL_FLAG_AUTOREMOVE_SUPPLIER)
+			link->flags |= DL_FLAG_AUTOREMOVE_SUPPLIER;
+
+		kref_get(&link->kref);
+		goto out;
+	}
+
 	link = kzalloc(sizeof(*link), GFP_KERNEL);
 	if (!link)
 		goto out;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 160/639] driver core: Do not resume suppliers under device_links_write_lock()
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (158 preceding siblings ...)
  2020-01-24  9:25 ` [PATCH 4.19 159/639] driver core: Avoid careless re-use of existing device links Greg Kroah-Hartman
@ 2020-01-24  9:25 ` Greg Kroah-Hartman
  2020-01-24  9:25 ` [PATCH 4.19 161/639] driver core: Fix handling of runtime PM flags in device_link_add() Greg Kroah-Hartman
                   ` (482 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:25 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Rafael J. Wysocki, Sasha Levin

From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>

[ Upstream commit 5db25c9eb893df8f6b93c1d97b8006d768e1b6f5 ]

It is incorrect to call pm_runtime_get_sync() under
device_links_write_lock(), because it may end up trying to take
device_links_read_lock() while resuming the target device and that
will deadlock in the non-SRCU case, so avoid that by resuming the
supplier device in device_link_add() before calling
device_links_write_lock().

Fixes: 21d5c57b3726 ("PM / runtime: Use device links")
Fixes: baa8809f6097 ("PM / runtime: Optimize the use of device links")
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/base/core.c | 20 ++++++++++++++------
 1 file changed, 14 insertions(+), 6 deletions(-)

diff --git a/drivers/base/core.c b/drivers/base/core.c
index 562385c47fa44..c228b4ebf554b 100644
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -201,12 +201,21 @@ struct device_link *device_link_add(struct device *consumer,
 				    struct device *supplier, u32 flags)
 {
 	struct device_link *link;
+	bool rpm_put_supplier = false;
 
 	if (!consumer || !supplier ||
 	    (flags & DL_FLAG_STATELESS &&
 	     flags & (DL_FLAG_AUTOREMOVE_CONSUMER | DL_FLAG_AUTOREMOVE_SUPPLIER)))
 		return NULL;
 
+	if (flags & DL_FLAG_PM_RUNTIME && flags & DL_FLAG_RPM_ACTIVE) {
+		if (pm_runtime_get_sync(supplier) < 0) {
+			pm_runtime_put_noidle(supplier);
+			return NULL;
+		}
+		rpm_put_supplier = true;
+	}
+
 	device_links_write_lock();
 	device_pm_lock();
 
@@ -250,13 +259,8 @@ struct device_link *device_link_add(struct device *consumer,
 
 	if (flags & DL_FLAG_PM_RUNTIME) {
 		if (flags & DL_FLAG_RPM_ACTIVE) {
-			if (pm_runtime_get_sync(supplier) < 0) {
-				pm_runtime_put_noidle(supplier);
-				kfree(link);
-				link = NULL;
-				goto out;
-			}
 			link->rpm_active = true;
+			rpm_put_supplier = false;
 		}
 		pm_runtime_new_link(consumer);
 		/*
@@ -328,6 +332,10 @@ struct device_link *device_link_add(struct device *consumer,
  out:
 	device_pm_unlock();
 	device_links_write_unlock();
+
+	if (rpm_put_supplier)
+		pm_runtime_put(supplier);
+
 	return link;
 }
 EXPORT_SYMBOL_GPL(device_link_add);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 161/639] driver core: Fix handling of runtime PM flags in device_link_add()
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (159 preceding siblings ...)
  2020-01-24  9:25 ` [PATCH 4.19 160/639] driver core: Do not resume suppliers under device_links_write_lock() Greg Kroah-Hartman
@ 2020-01-24  9:25 ` Greg Kroah-Hartman
  2020-01-24  9:25 ` [PATCH 4.19 162/639] driver core: Do not call rpm_put_suppliers() in pm_runtime_drop_link() Greg Kroah-Hartman
                   ` (481 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:25 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Rafael J. Wysocki, Sasha Levin

From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>

[ Upstream commit e2f3cd831a280fc226118d9369bf3f77aab58c56 ]

After commit ead18c23c263 ("driver core: Introduce device links
reference counting"), if there is a link between the given supplier
and the given consumer already, device_link_add() will refcount it
and return it unconditionally without updating its flags.  It is
possible, however, that the second (or any subsequent) caller of
device_link_add() for the same consumer-supplier pair will pass
DL_FLAG_PM_RUNTIME, possibly along with DL_FLAG_RPM_ACTIVE, in flags
to it and the existing link may not behave as expected then.

First, if DL_FLAG_PM_RUNTIME is not set in the existing link's flags
at all, it needs to be set like during the original initialization of
the link.

Second, if DL_FLAG_RPM_ACTIVE is passed to device_link_add() in flags
(in addition to DL_FLAG_PM_RUNTIME), the existing link should to be
updated to reflect the "active" runtime PM configuration of the
consumer-supplier pair and extra care must be taken here to avoid
possible destructive races with runtime PM of the consumer.

To that end, redefine the rpm_active field in struct device_link
as a refcount, initialize it to 1 and make rpm_resume() (for the
consumer) and device_link_add() increment it whenever they acquire
a runtime PM reference on the supplier device.  Accordingly, make
rpm_suspend() (for the consumer) and pm_runtime_clean_up_links()
decrement it and drop runtime PM references to the supplier
device in a loop until rpm_active becones 1 again.

Fixes: ead18c23c263 ("driver core: Introduce device links reference counting")
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/base/core.c          | 45 ++++++++++++++++++++++++------------
 drivers/base/power/runtime.c | 26 +++++++++------------
 include/linux/device.h       |  2 +-
 3 files changed, 42 insertions(+), 31 deletions(-)

diff --git a/drivers/base/core.c b/drivers/base/core.c
index c228b4ebf554b..20ae18f44dcdf 100644
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -165,6 +165,19 @@ void device_pm_move_to_tail(struct device *dev)
 	device_links_read_unlock(idx);
 }
 
+static void device_link_rpm_prepare(struct device *consumer,
+				    struct device *supplier)
+{
+	pm_runtime_new_link(consumer);
+	/*
+	 * If the link is being added by the consumer driver at probe time,
+	 * balance the decrementation of the supplier's runtime PM usage counter
+	 * after consumer probe in driver_probe_device().
+	 */
+	if (consumer->links.status == DL_DEV_PROBING)
+		pm_runtime_get_noresume(supplier);
+}
+
 /**
  * device_link_add - Create a link between two devices.
  * @consumer: Consumer end of the link.
@@ -201,7 +214,6 @@ struct device_link *device_link_add(struct device *consumer,
 				    struct device *supplier, u32 flags)
 {
 	struct device_link *link;
-	bool rpm_put_supplier = false;
 
 	if (!consumer || !supplier ||
 	    (flags & DL_FLAG_STATELESS &&
@@ -213,7 +225,6 @@ struct device_link *device_link_add(struct device *consumer,
 			pm_runtime_put_noidle(supplier);
 			return NULL;
 		}
-		rpm_put_supplier = true;
 	}
 
 	device_links_write_lock();
@@ -249,6 +260,15 @@ struct device_link *device_link_add(struct device *consumer,
 		if (flags & DL_FLAG_AUTOREMOVE_SUPPLIER)
 			link->flags |= DL_FLAG_AUTOREMOVE_SUPPLIER;
 
+		if (flags & DL_FLAG_PM_RUNTIME) {
+			if (!(link->flags & DL_FLAG_PM_RUNTIME)) {
+				device_link_rpm_prepare(consumer, supplier);
+				link->flags |= DL_FLAG_PM_RUNTIME;
+			}
+			if (flags & DL_FLAG_RPM_ACTIVE)
+				refcount_inc(&link->rpm_active);
+		}
+
 		kref_get(&link->kref);
 		goto out;
 	}
@@ -257,20 +277,15 @@ struct device_link *device_link_add(struct device *consumer,
 	if (!link)
 		goto out;
 
+	refcount_set(&link->rpm_active, 1);
+
 	if (flags & DL_FLAG_PM_RUNTIME) {
-		if (flags & DL_FLAG_RPM_ACTIVE) {
-			link->rpm_active = true;
-			rpm_put_supplier = false;
-		}
-		pm_runtime_new_link(consumer);
-		/*
-		 * If the link is being added by the consumer driver at probe
-		 * time, balance the decrementation of the supplier's runtime PM
-		 * usage counter after consumer probe in driver_probe_device().
-		 */
-		if (consumer->links.status == DL_DEV_PROBING)
-			pm_runtime_get_noresume(supplier);
+		if (flags & DL_FLAG_RPM_ACTIVE)
+			refcount_inc(&link->rpm_active);
+
+		device_link_rpm_prepare(consumer, supplier);
 	}
+
 	get_device(supplier);
 	link->supplier = supplier;
 	INIT_LIST_HEAD(&link->s_node);
@@ -333,7 +348,7 @@ struct device_link *device_link_add(struct device *consumer,
 	device_pm_unlock();
 	device_links_write_unlock();
 
-	if (rpm_put_supplier)
+	if ((flags & DL_FLAG_PM_RUNTIME && flags & DL_FLAG_RPM_ACTIVE) && !link)
 		pm_runtime_put(supplier);
 
 	return link;
diff --git a/drivers/base/power/runtime.c b/drivers/base/power/runtime.c
index beb85c31f3fa3..b914932d3ca1a 100644
--- a/drivers/base/power/runtime.c
+++ b/drivers/base/power/runtime.c
@@ -268,11 +268,8 @@ static int rpm_get_suppliers(struct device *dev)
 	list_for_each_entry_rcu(link, &dev->links.suppliers, c_node) {
 		int retval;
 
-		if (!(link->flags & DL_FLAG_PM_RUNTIME))
-			continue;
-
-		if (READ_ONCE(link->status) == DL_STATE_SUPPLIER_UNBIND ||
-		    link->rpm_active)
+		if (!(link->flags & DL_FLAG_PM_RUNTIME) ||
+		    READ_ONCE(link->status) == DL_STATE_SUPPLIER_UNBIND)
 			continue;
 
 		retval = pm_runtime_get_sync(link->supplier);
@@ -281,7 +278,7 @@ static int rpm_get_suppliers(struct device *dev)
 			pm_runtime_put_noidle(link->supplier);
 			return retval;
 		}
-		link->rpm_active = true;
+		refcount_inc(&link->rpm_active);
 	}
 	return 0;
 }
@@ -290,12 +287,13 @@ static void rpm_put_suppliers(struct device *dev)
 {
 	struct device_link *link;
 
-	list_for_each_entry_rcu(link, &dev->links.suppliers, c_node)
-		if (link->rpm_active &&
-		    READ_ONCE(link->status) != DL_STATE_SUPPLIER_UNBIND) {
+	list_for_each_entry_rcu(link, &dev->links.suppliers, c_node) {
+		if (READ_ONCE(link->status) == DL_STATE_SUPPLIER_UNBIND)
+			continue;
+
+		while (refcount_dec_not_one(&link->rpm_active))
 			pm_runtime_put(link->supplier);
-			link->rpm_active = false;
-		}
+	}
 }
 
 /**
@@ -1531,7 +1529,7 @@ void pm_runtime_remove(struct device *dev)
  *
  * Check links from this device to any consumers and if any of them have active
  * runtime PM references to the device, drop the usage counter of the device
- * (once per link).
+ * (as many times as needed).
  *
  * Links with the DL_FLAG_STATELESS flag set are ignored.
  *
@@ -1553,10 +1551,8 @@ void pm_runtime_clean_up_links(struct device *dev)
 		if (link->flags & DL_FLAG_STATELESS)
 			continue;
 
-		if (link->rpm_active) {
+		while (refcount_dec_not_one(&link->rpm_active))
 			pm_runtime_put_noidle(dev);
-			link->rpm_active = false;
-		}
 	}
 
 	device_links_read_unlock(idx);
diff --git a/include/linux/device.h b/include/linux/device.h
index 19dd8852602c4..b8fd2a1f859db 100644
--- a/include/linux/device.h
+++ b/include/linux/device.h
@@ -849,7 +849,7 @@ struct device_link {
 	struct list_head c_node;
 	enum device_link_state status;
 	u32 flags;
-	bool rpm_active;
+	refcount_t rpm_active;
 	struct kref kref;
 #ifdef CONFIG_SRCU
 	struct rcu_head rcu_head;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 162/639] driver core: Do not call rpm_put_suppliers() in pm_runtime_drop_link()
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (160 preceding siblings ...)
  2020-01-24  9:25 ` [PATCH 4.19 161/639] driver core: Fix handling of runtime PM flags in device_link_add() Greg Kroah-Hartman
@ 2020-01-24  9:25 ` Greg Kroah-Hartman
  2020-01-24  9:25 ` [PATCH 4.19 163/639] ARM: dts: lpc32xx: add required clocks property to keypad device node Greg Kroah-Hartman
                   ` (480 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:25 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Rafael J. Wysocki, Sasha Levin

From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>

[ Upstream commit a1fdbfbb1da2063ba98a12eb6f1bdd07451c7145 ]

Calling rpm_put_suppliers() from pm_runtime_drop_link() is excessive
as it affects all suppliers of the consumer device and not just the
one pointed to by the device link being dropped.  Worst case it may
cause the consumer device to stop working unexpectedly.  Moreover, in
principle it is racy with respect to runtime PM of the consumer
device.

To avoid these problems drop runtime PM references on the particular
supplier pointed to by the link in question only and do that after
the link has been dropped from the consumer device's list of links to
suppliers, which is in device_link_free().

Fixes: a0504aecba76 ("PM / runtime: Drop usage count for suppliers at device link removal")
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/base/core.c          | 3 +++
 drivers/base/power/runtime.c | 2 --
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/base/core.c b/drivers/base/core.c
index 20ae18f44dcdf..7599147d5f83c 100644
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -357,6 +357,9 @@ EXPORT_SYMBOL_GPL(device_link_add);
 
 static void device_link_free(struct device_link *link)
 {
+	while (refcount_dec_not_one(&link->rpm_active))
+		pm_runtime_put(link->supplier);
+
 	put_device(link->consumer);
 	put_device(link->supplier);
 	kfree(link);
diff --git a/drivers/base/power/runtime.c b/drivers/base/power/runtime.c
index b914932d3ca1a..ab454c4533ba1 100644
--- a/drivers/base/power/runtime.c
+++ b/drivers/base/power/runtime.c
@@ -1603,8 +1603,6 @@ void pm_runtime_new_link(struct device *dev)
 
 void pm_runtime_drop_link(struct device *dev)
 {
-	rpm_put_suppliers(dev);
-
 	spin_lock_irq(&dev->power.lock);
 	WARN_ON(dev->power.links_count == 0);
 	dev->power.links_count--;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 163/639] ARM: dts: lpc32xx: add required clocks property to keypad device node
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (161 preceding siblings ...)
  2020-01-24  9:25 ` [PATCH 4.19 162/639] driver core: Do not call rpm_put_suppliers() in pm_runtime_drop_link() Greg Kroah-Hartman
@ 2020-01-24  9:25 ` Greg Kroah-Hartman
  2020-01-24  9:25 ` [PATCH 4.19 164/639] ARM: dts: lpc32xx: reparent keypad controller to SIC1 Greg Kroah-Hartman
                   ` (479 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:25 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Vladimir Zapolskiy, Sasha Levin

From: Vladimir Zapolskiy <vz@mleia.com>

[ Upstream commit 3e88bc38b9f6fe4b69cecf81badd3c19fde97f97 ]

NXP LPC32xx keypad controller requires a clock property to be defined.

The change fixes the driver initialization problem:

  lpc32xx_keys 40050000.key: failed to get clock
  lpc32xx_keys: probe of 40050000.key failed with error -2

Fixes: 93898eb775e5 ("arm: dts: lpc32xx: add clock properties to device nodes")
Signed-off-by: Vladimir Zapolskiy <vz@mleia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/lpc32xx.dtsi | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/arm/boot/dts/lpc32xx.dtsi b/arch/arm/boot/dts/lpc32xx.dtsi
index ed0d6fb20122a..d4368eeff1b9a 100644
--- a/arch/arm/boot/dts/lpc32xx.dtsi
+++ b/arch/arm/boot/dts/lpc32xx.dtsi
@@ -462,6 +462,7 @@
 			key: key@40050000 {
 				compatible = "nxp,lpc3220-key";
 				reg = <0x40050000 0x1000>;
+				clocks = <&clk LPC32XX_CLK_KEY>;
 				interrupts = <54 IRQ_TYPE_LEVEL_HIGH>;
 				status = "disabled";
 			};
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 164/639] ARM: dts: lpc32xx: reparent keypad controller to SIC1
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (162 preceding siblings ...)
  2020-01-24  9:25 ` [PATCH 4.19 163/639] ARM: dts: lpc32xx: add required clocks property to keypad device node Greg Kroah-Hartman
@ 2020-01-24  9:25 ` Greg Kroah-Hartman
  2020-01-24  9:25 ` [PATCH 4.19 165/639] ARM: dts: lpc32xx: fix ARM PrimeCell LCD controller variant Greg Kroah-Hartman
                   ` (478 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:25 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Vladimir Zapolskiy, Sasha Levin

From: Vladimir Zapolskiy <vz@mleia.com>

[ Upstream commit 489261c45f0ebbc1c2813f337bbdf858267f5033 ]

After switching to a new interrupt controller scheme by separating SIC1
and SIC2 from MIC interrupt controller just one SoC keypad controller
was not taken into account, fix it now:

  WARNING: CPU: 0 PID: 1 at kernel/irq/irqdomain.c:524 irq_domain_associate+0x50/0x1b0
  error: hwirq 0x36 is too large for interrupt-controller@40008000
  ...
  lpc32xx_keys 40050000.key: failed to get platform irq
  lpc32xx_keys: probe of 40050000.key failed with error -22

Fixes: 9b8ad3fb81ae ("ARM: dts: lpc32xx: reparent SIC1 and SIC2 interrupts from MIC")
Signed-off-by: Vladimir Zapolskiy <vz@mleia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/lpc32xx.dtsi | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/lpc32xx.dtsi b/arch/arm/boot/dts/lpc32xx.dtsi
index d4368eeff1b9a..4f8f671c3343c 100644
--- a/arch/arm/boot/dts/lpc32xx.dtsi
+++ b/arch/arm/boot/dts/lpc32xx.dtsi
@@ -463,7 +463,8 @@
 				compatible = "nxp,lpc3220-key";
 				reg = <0x40050000 0x1000>;
 				clocks = <&clk LPC32XX_CLK_KEY>;
-				interrupts = <54 IRQ_TYPE_LEVEL_HIGH>;
+				interrupt-parent = <&sic1>;
+				interrupts = <22 IRQ_TYPE_LEVEL_HIGH>;
 				status = "disabled";
 			};
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 165/639] ARM: dts: lpc32xx: fix ARM PrimeCell LCD controller variant
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (163 preceding siblings ...)
  2020-01-24  9:25 ` [PATCH 4.19 164/639] ARM: dts: lpc32xx: reparent keypad controller to SIC1 Greg Kroah-Hartman
@ 2020-01-24  9:25 ` Greg Kroah-Hartman
  2020-01-24  9:25 ` [PATCH 4.19 166/639] ARM: dts: lpc32xx: fix ARM PrimeCell LCD controller clocks property Greg Kroah-Hartman
                   ` (477 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:25 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Vladimir Zapolskiy, Sasha Levin

From: Vladimir Zapolskiy <vz@mleia.com>

[ Upstream commit 7a0790a4121cbcd111cc537cdc801c46ccb789ee ]

ARM PrimeCell PL111 LCD controller is found on On NXP LPC3230
and LPC3250 SoCs variants, the original reference in compatible
property to an older one ARM PrimeCell PL110 is invalid.

Fixes: e04920d9efcb3 ("ARM: LPC32xx: DTS files for device tree conversion")
Signed-off-by: Vladimir Zapolskiy <vz@mleia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/lpc32xx.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/lpc32xx.dtsi b/arch/arm/boot/dts/lpc32xx.dtsi
index 4f8f671c3343c..cfd422e7f774d 100644
--- a/arch/arm/boot/dts/lpc32xx.dtsi
+++ b/arch/arm/boot/dts/lpc32xx.dtsi
@@ -139,7 +139,7 @@
 		};
 
 		clcd: clcd@31040000 {
-			compatible = "arm,pl110", "arm,primecell";
+			compatible = "arm,pl111", "arm,primecell";
 			reg = <0x31040000 0x1000>;
 			interrupts = <14 IRQ_TYPE_LEVEL_HIGH>;
 			clocks = <&clk LPC32XX_CLK_LCD>;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 166/639] ARM: dts: lpc32xx: fix ARM PrimeCell LCD controller clocks property
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (164 preceding siblings ...)
  2020-01-24  9:25 ` [PATCH 4.19 165/639] ARM: dts: lpc32xx: fix ARM PrimeCell LCD controller variant Greg Kroah-Hartman
@ 2020-01-24  9:25 ` Greg Kroah-Hartman
  2020-01-24  9:25 ` [PATCH 4.19 167/639] ARM: dts: lpc32xx: phy3250: fix SD card regulator voltage Greg Kroah-Hartman
                   ` (476 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:25 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Vladimir Zapolskiy, Sasha Levin

From: Vladimir Zapolskiy <vz@mleia.com>

[ Upstream commit 30fc01bae3cda747e7d9c352b1aa51ca113c8a9d ]

The originally added ARM PrimeCell PL111 clocks property misses
the required "clcdclk" clock, which is the same as a clock to enable
the LCD controller on NXP LPC3230 and NXP LPC3250 SoCs.

Fixes: 93898eb775e5 ("arm: dts: lpc32xx: add clock properties to device nodes")
Signed-off-by: Vladimir Zapolskiy <vz@mleia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/lpc32xx.dtsi | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm/boot/dts/lpc32xx.dtsi b/arch/arm/boot/dts/lpc32xx.dtsi
index cfd422e7f774d..9ad3df11db0d8 100644
--- a/arch/arm/boot/dts/lpc32xx.dtsi
+++ b/arch/arm/boot/dts/lpc32xx.dtsi
@@ -142,8 +142,8 @@
 			compatible = "arm,pl111", "arm,primecell";
 			reg = <0x31040000 0x1000>;
 			interrupts = <14 IRQ_TYPE_LEVEL_HIGH>;
-			clocks = <&clk LPC32XX_CLK_LCD>;
-			clock-names = "apb_pclk";
+			clocks = <&clk LPC32XX_CLK_LCD>, <&clk LPC32XX_CLK_LCD>;
+			clock-names = "clcdclk", "apb_pclk";
 			status = "disabled";
 		};
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 167/639] ARM: dts: lpc32xx: phy3250: fix SD card regulator voltage
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (165 preceding siblings ...)
  2020-01-24  9:25 ` [PATCH 4.19 166/639] ARM: dts: lpc32xx: fix ARM PrimeCell LCD controller clocks property Greg Kroah-Hartman
@ 2020-01-24  9:25 ` Greg Kroah-Hartman
  2020-01-24  9:25 ` [PATCH 4.19 168/639] drm/xen-front: Fix mmap attributes for display buffers Greg Kroah-Hartman
                   ` (475 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:25 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Vladimir Zapolskiy, Sasha Levin

From: Vladimir Zapolskiy <vz@mleia.com>

[ Upstream commit dc141b99fc36cf910a1d8d5ee30f43f2442fd1bd ]

The fixed voltage regulator on Phytec phyCORE-LPC3250 board, which
supplies SD/MMC card's power, has a constant output voltage level
of either 3.15V or 3.3V, the actual value depends on JP4 position,
the power rail is referenced as VCC_SDIO in the board hardware manual.

Fixes: d06670e96267 ("arm: dts: phy3250: add SD fixed regulator")
Signed-off-by: Vladimir Zapolskiy <vz@mleia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/lpc3250-phy3250.dts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm/boot/dts/lpc3250-phy3250.dts b/arch/arm/boot/dts/lpc3250-phy3250.dts
index 1e1c2f517a82b..ffcf78631b226 100644
--- a/arch/arm/boot/dts/lpc3250-phy3250.dts
+++ b/arch/arm/boot/dts/lpc3250-phy3250.dts
@@ -49,8 +49,8 @@
 		sd_reg: regulator@2 {
 			compatible = "regulator-fixed";
 			regulator-name = "sd_reg";
-			regulator-min-microvolt = <1800000>;
-			regulator-max-microvolt = <1800000>;
+			regulator-min-microvolt = <3300000>;
+			regulator-max-microvolt = <3300000>;
 			gpio = <&gpio 5 5 0>;
 			enable-active-high;
 		};
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 168/639] drm/xen-front: Fix mmap attributes for display buffers
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (166 preceding siblings ...)
  2020-01-24  9:25 ` [PATCH 4.19 167/639] ARM: dts: lpc32xx: phy3250: fix SD card regulator voltage Greg Kroah-Hartman
@ 2020-01-24  9:25 ` Greg Kroah-Hartman
  2020-01-24  9:25 ` [PATCH 4.19 169/639] iwlwifi: mvm: fix RSS config command Greg Kroah-Hartman
                   ` (474 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:25 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Oleksandr Andrushchenko,
	Julien Grall, Sasha Levin

From: Oleksandr Andrushchenko <oleksandr_andrushchenko@epam.com>

[ Upstream commit 24ded292a5c2ed476f01c77fee65f8320552cd27 ]

When GEM backing storage is allocated those are normal pages,
so there is no point using pgprot_writecombine while mmaping.
This fixes mismatch of buffer pages' memory attributes between
the frontend and backend which may cause screen artifacts.

Fixes: c575b7eeb89f ("drm/xen-front: Add support for Xen PV display frontend")

Signed-off-by: Oleksandr Andrushchenko <oleksandr_andrushchenko@epam.com>
Suggested-by: Julien Grall <julien.grall@arm.com>
Acked-by: Julien Grall <julien.grall@arm.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20190129150422.19867-1-andr2000@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/xen/xen_drm_front_gem.c | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/xen/xen_drm_front_gem.c b/drivers/gpu/drm/xen/xen_drm_front_gem.c
index c85bfe7571cbf..802662839e7ed 100644
--- a/drivers/gpu/drm/xen/xen_drm_front_gem.c
+++ b/drivers/gpu/drm/xen/xen_drm_front_gem.c
@@ -236,8 +236,14 @@ static int gem_mmap_obj(struct xen_gem_object *xen_obj,
 	vma->vm_flags &= ~VM_PFNMAP;
 	vma->vm_flags |= VM_MIXEDMAP;
 	vma->vm_pgoff = 0;
-	vma->vm_page_prot =
-			pgprot_writecombine(vm_get_page_prot(vma->vm_flags));
+	/*
+	 * According to Xen on ARM ABI (xen/include/public/arch-arm.h):
+	 * all memory which is shared with other entities in the system
+	 * (including the hypervisor and other guests) must reside in memory
+	 * which is mapped as Normal Inner Write-Back Outer Write-Back
+	 * Inner-Shareable.
+	 */
+	vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
 
 	/*
 	 * vm_operations_struct.fault handler will be called if CPU access
@@ -283,8 +289,9 @@ void *xen_drm_front_gem_prime_vmap(struct drm_gem_object *gem_obj)
 	if (!xen_obj->pages)
 		return NULL;
 
+	/* Please see comment in gem_mmap_obj on mapping and attributes. */
 	return vmap(xen_obj->pages, xen_obj->num_pages,
-		    VM_MAP, pgprot_writecombine(PAGE_KERNEL));
+		    VM_MAP, PAGE_KERNEL);
 }
 
 void xen_drm_front_gem_prime_vunmap(struct drm_gem_object *gem_obj,
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 169/639] iwlwifi: mvm: fix RSS config command
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (167 preceding siblings ...)
  2020-01-24  9:25 ` [PATCH 4.19 168/639] drm/xen-front: Fix mmap attributes for display buffers Greg Kroah-Hartman
@ 2020-01-24  9:25 ` Greg Kroah-Hartman
  2020-01-24  9:25 ` [PATCH 4.19 170/639] staging: most: cdev: add missing check for cdev_add failure Greg Kroah-Hartman
                   ` (473 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:25 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sara Sharon, Luca Coelho, Sasha Levin

From: Sara Sharon <sara.sharon@intel.com>

[ Upstream commit 608dce95db10b8ee1a26dbce3f60204bb69812a5 ]

The hash mask is a bitmap, so we should use BIT() on
the enum values.

Signed-off-by: Sara Sharon <sara.sharon@intel.com>
Fixes: 43413a975d06 ("iwlwifi: mvm: support rss queues configuration command")
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
index 9808d954dca29..c7e2b88cd5abb 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
@@ -110,12 +110,12 @@ static int iwl_send_rss_cfg_cmd(struct iwl_mvm *mvm)
 	int i;
 	struct iwl_rss_config_cmd cmd = {
 		.flags = cpu_to_le32(IWL_RSS_ENABLE),
-		.hash_mask = IWL_RSS_HASH_TYPE_IPV4_TCP |
-			     IWL_RSS_HASH_TYPE_IPV4_UDP |
-			     IWL_RSS_HASH_TYPE_IPV4_PAYLOAD |
-			     IWL_RSS_HASH_TYPE_IPV6_TCP |
-			     IWL_RSS_HASH_TYPE_IPV6_UDP |
-			     IWL_RSS_HASH_TYPE_IPV6_PAYLOAD,
+		.hash_mask = BIT(IWL_RSS_HASH_TYPE_IPV4_TCP) |
+			     BIT(IWL_RSS_HASH_TYPE_IPV4_UDP) |
+			     BIT(IWL_RSS_HASH_TYPE_IPV4_PAYLOAD) |
+			     BIT(IWL_RSS_HASH_TYPE_IPV6_TCP) |
+			     BIT(IWL_RSS_HASH_TYPE_IPV6_UDP) |
+			     BIT(IWL_RSS_HASH_TYPE_IPV6_PAYLOAD),
 	};
 
 	if (mvm->trans->num_rx_queues == 1)
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 170/639] staging: most: cdev: add missing check for cdev_add failure
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (168 preceding siblings ...)
  2020-01-24  9:25 ` [PATCH 4.19 169/639] iwlwifi: mvm: fix RSS config command Greg Kroah-Hartman
@ 2020-01-24  9:25 ` Greg Kroah-Hartman
  2020-01-24  9:25 ` [PATCH 4.19 171/639] clk: ingenic: jz4740: Fix gating of UDC clock Greg Kroah-Hartman
                   ` (472 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:25 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Colin Ian King, Sasha Levin

From: Colin Ian King <colin.king@canonical.com>

[ Upstream commit 5ae890780e1b4d08f2c0c5d4ea96fc3928fc0ee9 ]

Currently the call to cdev_add is missing a check for failure. Fix this by
checking for failure and exiting via a new error path that ensures the
allocated comp_channel struct is kfree'd.

Detected by CoverityScan, CID#1462359 ("Unchecked return value")

Fixes: 9bc79bbcd0c5 ("Staging: most: add MOST driver's aim-cdev module")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/staging/most/cdev/cdev.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/staging/most/cdev/cdev.c b/drivers/staging/most/cdev/cdev.c
index 0b48677fa958a..27d58b55b8108 100644
--- a/drivers/staging/most/cdev/cdev.c
+++ b/drivers/staging/most/cdev/cdev.c
@@ -453,7 +453,9 @@ static int comp_probe(struct most_interface *iface, int channel_id,
 	c->devno = MKDEV(comp.major, current_minor);
 	cdev_init(&c->cdev, &channel_fops);
 	c->cdev.owner = THIS_MODULE;
-	cdev_add(&c->cdev, c->devno, 1);
+	retval = cdev_add(&c->cdev, c->devno, 1);
+	if (retval < 0)
+		goto err_free_c;
 	c->iface = iface;
 	c->cfg = cfg;
 	c->channel_id = channel_id;
@@ -485,6 +487,7 @@ error_create_device:
 	list_del(&c->list);
 error_alloc_kfifo:
 	cdev_del(&c->cdev);
+err_free_c:
 	kfree(c);
 error_alloc_channel:
 	ida_simple_remove(&comp.minor_id, current_minor);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 171/639] clk: ingenic: jz4740: Fix gating of UDC clock
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (169 preceding siblings ...)
  2020-01-24  9:25 ` [PATCH 4.19 170/639] staging: most: cdev: add missing check for cdev_add failure Greg Kroah-Hartman
@ 2020-01-24  9:25 ` Greg Kroah-Hartman
  2020-01-24  9:25 ` [PATCH 4.19 172/639] rtc: ds1672: fix unintended sign extension Greg Kroah-Hartman
                   ` (471 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:25 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Paul Cercueil, Artur Rojek,
	Stephen Boyd, Sasha Levin

From: Paul Cercueil <paul@crapouillou.net>

[ Upstream commit b7e29924a1a628aec60d18651b493fa1601bf944 ]

The UDC clock is gated when the bit is cleared, not when it is set.

Signed-off-by: Paul Cercueil <paul@crapouillou.net>
Tested-by: Artur Rojek <contact@artur-rojek.eu>
Fixes: 2b555a4b9cae ("clk: ingenic: Add missing flag for UDC clock")
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/ingenic/jz4740-cgu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/clk/ingenic/jz4740-cgu.c b/drivers/clk/ingenic/jz4740-cgu.c
index 4479c102e8994..b86edd3282493 100644
--- a/drivers/clk/ingenic/jz4740-cgu.c
+++ b/drivers/clk/ingenic/jz4740-cgu.c
@@ -165,7 +165,7 @@ static const struct ingenic_cgu_clk_info jz4740_cgu_clocks[] = {
 		.parents = { JZ4740_CLK_EXT, JZ4740_CLK_PLL_HALF, -1, -1 },
 		.mux = { CGU_REG_CPCCR, 29, 1 },
 		.div = { CGU_REG_CPCCR, 23, 1, 6, -1, -1, -1 },
-		.gate = { CGU_REG_SCR, 6 },
+		.gate = { CGU_REG_SCR, 6, true },
 	},
 
 	/* Gate-only clocks */
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 172/639] rtc: ds1672: fix unintended sign extension
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (170 preceding siblings ...)
  2020-01-24  9:25 ` [PATCH 4.19 171/639] clk: ingenic: jz4740: Fix gating of UDC clock Greg Kroah-Hartman
@ 2020-01-24  9:25 ` Greg Kroah-Hartman
  2020-01-24  9:25 ` [PATCH 4.19 173/639] thermal: mediatek: fix register index error Greg Kroah-Hartman
                   ` (470 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:25 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Colin Ian King, Alexandre Belloni,
	Sasha Levin

From: Colin Ian King <colin.king@canonical.com>

[ Upstream commit f0c04c276739ed8acbb41b4868e942a55b128dca ]

Shifting a u8 by 24 will cause the value to be promoted to an integer. If
the top bit of the u8 is set then the following conversion to an unsigned
long will sign extend the value causing the upper 32 bits to be set in
the result.

Fix this by casting the u8 value to an unsigned long before the shift.

Detected by CoverityScan, CID#138801 ("Unintended sign extension")

Fixes: edf1aaa31fc5 ("[PATCH] RTC subsystem: DS1672 driver")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/rtc/rtc-ds1672.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/rtc/rtc-ds1672.c b/drivers/rtc/rtc-ds1672.c
index 9caaccccaa575..b1ebca099b0df 100644
--- a/drivers/rtc/rtc-ds1672.c
+++ b/drivers/rtc/rtc-ds1672.c
@@ -58,7 +58,8 @@ static int ds1672_get_datetime(struct i2c_client *client, struct rtc_time *tm)
 		"%s: raw read data - counters=%02x,%02x,%02x,%02x\n",
 		__func__, buf[0], buf[1], buf[2], buf[3]);
 
-	time = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
+	time = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
+	       (buf[1] << 8) | buf[0];
 
 	rtc_time_to_tm(time, tm);
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 173/639] thermal: mediatek: fix register index error
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (171 preceding siblings ...)
  2020-01-24  9:25 ` [PATCH 4.19 172/639] rtc: ds1672: fix unintended sign extension Greg Kroah-Hartman
@ 2020-01-24  9:25 ` Greg Kroah-Hartman
  2020-01-24  9:25 ` [PATCH 4.19 174/639] arm64: dts: msm8916: remove bogus argument to the cpu clock Greg Kroah-Hartman
                   ` (469 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:25 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Michael Kao, Eduardo Valentin, Sasha Levin

From: Michael Kao <michael.kao@mediatek.com>

[ Upstream commit eb9aecd90d1a39601e91cd08b90d5fee51d321a6 ]

The index of msr and adcpnp should match the sensor
which belongs to the selected bank in the for loop.

Fixes: b7cf0053738c ("thermal: Add Mediatek thermal driver for mt2701.")
Signed-off-by: Michael Kao <michael.kao@mediatek.com>
Signed-off-by: Eduardo Valentin <edubezval@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/thermal/mtk_thermal.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/thermal/mtk_thermal.c b/drivers/thermal/mtk_thermal.c
index 0691f260f6eab..f64643629d8b5 100644
--- a/drivers/thermal/mtk_thermal.c
+++ b/drivers/thermal/mtk_thermal.c
@@ -431,7 +431,8 @@ static int mtk_thermal_bank_temperature(struct mtk_thermal_bank *bank)
 	u32 raw;
 
 	for (i = 0; i < conf->bank_data[bank->id].num_sensors; i++) {
-		raw = readl(mt->thermal_base + conf->msr[i]);
+		raw = readl(mt->thermal_base +
+			    conf->msr[conf->bank_data[bank->id].sensors[i]]);
 
 		temp = raw_to_mcelsius(mt,
 				       conf->bank_data[bank->id].sensors[i],
@@ -568,7 +569,8 @@ static void mtk_thermal_init_bank(struct mtk_thermal *mt, int num,
 
 	for (i = 0; i < conf->bank_data[num].num_sensors; i++)
 		writel(conf->sensor_mux_values[conf->bank_data[num].sensors[i]],
-		       mt->thermal_base + conf->adcpnp[i]);
+		       mt->thermal_base +
+		       conf->adcpnp[conf->bank_data[num].sensors[i]]);
 
 	writel((1 << conf->bank_data[num].num_sensors) - 1,
 	       mt->thermal_base + TEMP_MONCTL0);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 174/639] arm64: dts: msm8916: remove bogus argument to the cpu clock
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (172 preceding siblings ...)
  2020-01-24  9:25 ` [PATCH 4.19 173/639] thermal: mediatek: fix register index error Greg Kroah-Hartman
@ 2020-01-24  9:25 ` Greg Kroah-Hartman
  2020-01-24  9:25 ` [PATCH 4.19 175/639] ath10k: fix dma unmap direction for management frames Greg Kroah-Hartman
                   ` (468 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:25 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Niklas Cassel, Bjorn Andersson,
	Amit Kucheria, Andy Gross, Sasha Levin

From: Niklas Cassel <niklas.cassel@linaro.org>

[ Upstream commit e4f045ef38e61ba37aa4afc916fce4fc1b37aa19 ]

The apcs node has #clock-cells = <0>, which means that those who
references it should specify 0 arguments.

The apcs reference in the cpu node incorrectly specifies an argument,
remove this bogus argument.

Fixes: 65afdf458360 ("arm64: dts: qcom: msm8916: Add CPU frequency scaling support")
Signed-off-by: Niklas Cassel <niklas.cassel@linaro.org>
Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Reviewed-by: Amit Kucheria <amit.kucheria@linaro.org>
Signed-off-by: Andy Gross <andy.gross@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/qcom/msm8916.dtsi | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/arch/arm64/boot/dts/qcom/msm8916.dtsi b/arch/arm64/boot/dts/qcom/msm8916.dtsi
index 7b32b8990d62f..8011e564a234b 100644
--- a/arch/arm64/boot/dts/qcom/msm8916.dtsi
+++ b/arch/arm64/boot/dts/qcom/msm8916.dtsi
@@ -114,7 +114,7 @@
 			next-level-cache = <&L2_0>;
 			enable-method = "psci";
 			cpu-idle-states = <&CPU_SPC>;
-			clocks = <&apcs 0>;
+			clocks = <&apcs>;
 			operating-points-v2 = <&cpu_opp_table>;
 			#cooling-cells = <2>;
 		};
@@ -126,7 +126,7 @@
 			next-level-cache = <&L2_0>;
 			enable-method = "psci";
 			cpu-idle-states = <&CPU_SPC>;
-			clocks = <&apcs 0>;
+			clocks = <&apcs>;
 			operating-points-v2 = <&cpu_opp_table>;
 			#cooling-cells = <2>;
 		};
@@ -138,7 +138,7 @@
 			next-level-cache = <&L2_0>;
 			enable-method = "psci";
 			cpu-idle-states = <&CPU_SPC>;
-			clocks = <&apcs 0>;
+			clocks = <&apcs>;
 			operating-points-v2 = <&cpu_opp_table>;
 			#cooling-cells = <2>;
 		};
@@ -150,7 +150,7 @@
 			next-level-cache = <&L2_0>;
 			enable-method = "psci";
 			cpu-idle-states = <&CPU_SPC>;
-			clocks = <&apcs 0>;
+			clocks = <&apcs>;
 			operating-points-v2 = <&cpu_opp_table>;
 			#cooling-cells = <2>;
 		};
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 175/639] ath10k: fix dma unmap direction for management frames
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (173 preceding siblings ...)
  2020-01-24  9:25 ` [PATCH 4.19 174/639] arm64: dts: msm8916: remove bogus argument to the cpu clock Greg Kroah-Hartman
@ 2020-01-24  9:25 ` Greg Kroah-Hartman
  2020-01-24  9:25 ` [PATCH 4.19 176/639] net: phy: fixed_phy: Fix fixed_phy not checking GPIO Greg Kroah-Hartman
                   ` (467 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:25 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Rakesh Pillai, Kalle Valo, Sasha Levin

From: Rakesh Pillai <pillair@codeaurora.org>

[ Upstream commit 6e8a8991e2103dcb6a9cff28f460390e8e360848 ]

The management frames transmitted are dma mapped with
direction TO_DEVICE, but incorrectly mapped with
direction FROM_DEVICE during tx complete and error cases.

Fix the direction of dma during dma unmap of the
transmitted management frames.

Tested HW: WCN3990
Tested FW: WLAN.HL.2.0-01188-QCAHLSWMTPLZ-1

Fixes: 38a1390e02b7 ("ath10k: dma unmap mgmt tx buffer if wmi cmd send fails")
Signed-off-by: Rakesh Pillai <pillair@codeaurora.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath10k/mac.c | 4 ++--
 drivers/net/wireless/ath/ath10k/wmi.c | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
index 448e3a8c33a6d..a09d7a07e90a8 100644
--- a/drivers/net/wireless/ath/ath10k/mac.c
+++ b/drivers/net/wireless/ath/ath10k/mac.c
@@ -1,7 +1,7 @@
 /*
  * Copyright (c) 2005-2011 Atheros Communications Inc.
  * Copyright (c) 2011-2017 Qualcomm Atheros, Inc.
- * Copyright (c) 2018, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2018-2019, The Linux Foundation. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -3853,7 +3853,7 @@ void ath10k_mgmt_over_wmi_tx_work(struct work_struct *work)
 				ath10k_warn(ar, "failed to transmit management frame by ref via WMI: %d\n",
 					    ret);
 				dma_unmap_single(ar->dev, paddr, skb->len,
-						 DMA_FROM_DEVICE);
+						 DMA_TO_DEVICE);
 				ieee80211_free_txskb(ar->hw, skb);
 			}
 		} else {
diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c
index aefc92d2c09b9..0f6ff7a78e49d 100644
--- a/drivers/net/wireless/ath/ath10k/wmi.c
+++ b/drivers/net/wireless/ath/ath10k/wmi.c
@@ -1,7 +1,7 @@
 /*
  * Copyright (c) 2005-2011 Atheros Communications Inc.
  * Copyright (c) 2011-2017 Qualcomm Atheros, Inc.
- * Copyright (c) 2018, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2018-2019, The Linux Foundation. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -2340,7 +2340,7 @@ static int wmi_process_mgmt_tx_comp(struct ath10k *ar, u32 desc_id,
 
 	msdu = pkt_addr->vaddr;
 	dma_unmap_single(ar->dev, pkt_addr->paddr,
-			 msdu->len, DMA_FROM_DEVICE);
+			 msdu->len, DMA_TO_DEVICE);
 	info = IEEE80211_SKB_CB(msdu);
 
 	if (status)
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 176/639] net: phy: fixed_phy: Fix fixed_phy not checking GPIO
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (174 preceding siblings ...)
  2020-01-24  9:25 ` [PATCH 4.19 175/639] ath10k: fix dma unmap direction for management frames Greg Kroah-Hartman
@ 2020-01-24  9:25 ` Greg Kroah-Hartman
  2020-01-24  9:25 ` [PATCH 4.19 177/639] rtc: ds1307: rx8130: Fix alarm handling Greg Kroah-Hartman
                   ` (466 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:25 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Andrew Lunn, Moritz Fischer,
	David S. Miller, Sasha Levin

From: Moritz Fischer <mdf@kernel.org>

[ Upstream commit 8f289805616e81f7c1690931aa8a586c76f4fa88 ]

Fix fixed_phy not checking GPIO if no link_update callback
is registered.

In the original version all users registered a link_update
callback so the issue was masked.

Fixes: a5597008dbc2 ("phy: fixed_phy: Add gpio to determine link up/down.")
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: Moritz Fischer <mdf@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/phy/fixed_phy.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/net/phy/fixed_phy.c b/drivers/net/phy/fixed_phy.c
index 67b260877f305..59820164502eb 100644
--- a/drivers/net/phy/fixed_phy.c
+++ b/drivers/net/phy/fixed_phy.c
@@ -67,11 +67,11 @@ static int fixed_mdio_read(struct mii_bus *bus, int phy_addr, int reg_num)
 			do {
 				s = read_seqcount_begin(&fp->seqcount);
 				/* Issue callback if user registered it. */
-				if (fp->link_update) {
+				if (fp->link_update)
 					fp->link_update(fp->phydev->attached_dev,
 							&fp->status);
-					fixed_phy_update(fp);
-				}
+				/* Check the GPIO for change in status */
+				fixed_phy_update(fp);
 				state = fp->status;
 			} while (read_seqcount_retry(&fp->seqcount, s));
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 177/639] rtc: ds1307: rx8130: Fix alarm handling
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (175 preceding siblings ...)
  2020-01-24  9:25 ` [PATCH 4.19 176/639] net: phy: fixed_phy: Fix fixed_phy not checking GPIO Greg Kroah-Hartman
@ 2020-01-24  9:25 ` Greg Kroah-Hartman
  2020-01-25 13:30   ` Pavel Machek
  2020-01-24  9:25 ` [PATCH 4.19 178/639] net/smc: original socket family in inet_sock_diag Greg Kroah-Hartman
                   ` (465 subsequent siblings)
  642 siblings, 1 reply; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:25 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Uwe Kleine-König,
	Alexandre Belloni, Sasha Levin

From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>

[ Upstream commit 3f929cad943380370b6db31fcb7a38d898d91089 ]

When the EXTENSION.WADA bit is set, register 0x19 contains a bitmap of
week days, not a day of month. As Linux only handles a single alarm
without repetition using day of month is more flexible, so clear this
bit. (Otherwise a value depending on time.tm_wday would have to be
written to register 0x19.)

Also optimize setting the AIE bit to use a single register write instead
of a bulk write of three registers.

Fixes: ee0981be7704 ("rtc: ds1307: Add support for Epson RX8130CE")
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/rtc/rtc-ds1307.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/drivers/rtc/rtc-ds1307.c b/drivers/rtc/rtc-ds1307.c
index 71396b62dc52b..ebd59e86a567b 100644
--- a/drivers/rtc/rtc-ds1307.c
+++ b/drivers/rtc/rtc-ds1307.c
@@ -749,8 +749,8 @@ static int rx8130_set_alarm(struct device *dev, struct rtc_wkalrm *t)
 	if (ret < 0)
 		return ret;
 
-	ctl[0] &= ~RX8130_REG_EXTENSION_WADA;
-	ctl[1] |= RX8130_REG_FLAG_AF;
+	ctl[0] &= RX8130_REG_EXTENSION_WADA;
+	ctl[1] &= ~RX8130_REG_FLAG_AF;
 	ctl[2] &= ~RX8130_REG_CONTROL0_AIE;
 
 	ret = regmap_bulk_write(ds1307->regmap, RX8130_REG_EXTENSION, ctl,
@@ -773,8 +773,7 @@ static int rx8130_set_alarm(struct device *dev, struct rtc_wkalrm *t)
 
 	ctl[2] |= RX8130_REG_CONTROL0_AIE;
 
-	return regmap_bulk_write(ds1307->regmap, RX8130_REG_EXTENSION, ctl,
-				 sizeof(ctl));
+	return regmap_write(ds1307->regmap, RX8130_REG_CONTROL0, ctl[2]);
 }
 
 static int rx8130_alarm_irq_enable(struct device *dev, unsigned int enabled)
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 178/639] net/smc: original socket family in inet_sock_diag
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (176 preceding siblings ...)
  2020-01-24  9:25 ` [PATCH 4.19 177/639] rtc: ds1307: rx8130: Fix alarm handling Greg Kroah-Hartman
@ 2020-01-24  9:25 ` Greg Kroah-Hartman
  2020-01-24  9:25 ` [PATCH 4.19 179/639] rtc: 88pm860x: fix unintended sign extension Greg Kroah-Hartman
                   ` (464 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:25 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Eugene Syromiatnikov, Karsten Graul,
	Ursula Braun, David S. Miller, Sasha Levin

From: Karsten Graul <kgraul@linux.ibm.com>

[ Upstream commit 232dc8ef647658a5352da807d9e994e0e03b43cd ]

Commit ed75986f4aae ("net/smc: ipv6 support for smc_diag.c") changed the
value of the diag_family field. The idea was to indicate the family of
the IP address in the inet_diag_sockid field. But the change makes it
impossible to distinguish an inet_sock_diag response message from SMC
sock_diag response. This patch restores the original behaviour and sends
AF_SMC as value of the diag_family field.

Fixes: ed75986f4aae ("net/smc: ipv6 support for smc_diag.c")
Reported-by: Eugene Syromiatnikov <esyr@redhat.com>
Signed-off-by: Karsten Graul <kgraul@linux.ibm.com>
Signed-off-by: Ursula Braun <ubraun@linux.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/smc/smc_diag.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/net/smc/smc_diag.c b/net/smc/smc_diag.c
index dbf64a93d68ad..371b4cf31fcd2 100644
--- a/net/smc/smc_diag.c
+++ b/net/smc/smc_diag.c
@@ -38,6 +38,7 @@ static void smc_diag_msg_common_fill(struct smc_diag_msg *r, struct sock *sk)
 {
 	struct smc_sock *smc = smc_sk(sk);
 
+	r->diag_family = sk->sk_family;
 	if (!smc->clcsock)
 		return;
 	r->id.idiag_sport = htons(smc->clcsock->sk->sk_num);
@@ -45,14 +46,12 @@ static void smc_diag_msg_common_fill(struct smc_diag_msg *r, struct sock *sk)
 	r->id.idiag_if = smc->clcsock->sk->sk_bound_dev_if;
 	sock_diag_save_cookie(sk, r->id.idiag_cookie);
 	if (sk->sk_protocol == SMCPROTO_SMC) {
-		r->diag_family = PF_INET;
 		memset(&r->id.idiag_src, 0, sizeof(r->id.idiag_src));
 		memset(&r->id.idiag_dst, 0, sizeof(r->id.idiag_dst));
 		r->id.idiag_src[0] = smc->clcsock->sk->sk_rcv_saddr;
 		r->id.idiag_dst[0] = smc->clcsock->sk->sk_daddr;
 #if IS_ENABLED(CONFIG_IPV6)
 	} else if (sk->sk_protocol == SMCPROTO_SMC6) {
-		r->diag_family = PF_INET6;
 		memcpy(&r->id.idiag_src, &smc->clcsock->sk->sk_v6_rcv_saddr,
 		       sizeof(smc->clcsock->sk->sk_v6_rcv_saddr));
 		memcpy(&r->id.idiag_dst, &smc->clcsock->sk->sk_v6_daddr,
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 179/639] rtc: 88pm860x: fix unintended sign extension
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (177 preceding siblings ...)
  2020-01-24  9:25 ` [PATCH 4.19 178/639] net/smc: original socket family in inet_sock_diag Greg Kroah-Hartman
@ 2020-01-24  9:25 ` Greg Kroah-Hartman
  2020-01-24  9:25 ` [PATCH 4.19 180/639] rtc: 88pm80x: " Greg Kroah-Hartman
                   ` (463 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:25 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Colin Ian King, Alexandre Belloni,
	Sasha Levin

From: Colin Ian King <colin.king@canonical.com>

[ Upstream commit dc9e47160626cdb58d5c39a4f43dcfdb27a5c004 ]

Shifting a u8 by 24 will cause the value to be promoted to an integer. If
the top bit of the u8 is set then the following conversion to an unsigned
long will sign extend the value causing the upper 32 bits to be set in
the result.

Fix this by casting the u8 value to an unsigned long before the shift.

Detected by CoverityScan, CID#144925-144928 ("Unintended sign extension")

Fixes: 008b30408c40 ("mfd: Add rtc support to 88pm860x")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/rtc/rtc-88pm860x.c | 21 ++++++++++++++-------
 1 file changed, 14 insertions(+), 7 deletions(-)

diff --git a/drivers/rtc/rtc-88pm860x.c b/drivers/rtc/rtc-88pm860x.c
index fbcf13bbbd8d1..73697e4b18a9d 100644
--- a/drivers/rtc/rtc-88pm860x.c
+++ b/drivers/rtc/rtc-88pm860x.c
@@ -115,11 +115,13 @@ static int pm860x_rtc_read_time(struct device *dev, struct rtc_time *tm)
 	pm860x_page_bulk_read(info->i2c, REG0_ADDR, 8, buf);
 	dev_dbg(info->dev, "%x-%x-%x-%x-%x-%x-%x-%x\n", buf[0], buf[1],
 		buf[2], buf[3], buf[4], buf[5], buf[6], buf[7]);
-	base = (buf[1] << 24) | (buf[3] << 16) | (buf[5] << 8) | buf[7];
+	base = ((unsigned long)buf[1] << 24) | (buf[3] << 16) |
+		(buf[5] << 8) | buf[7];
 
 	/* load 32-bit read-only counter */
 	pm860x_bulk_read(info->i2c, PM8607_RTC_COUNTER1, 4, buf);
-	data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
+	data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
+		(buf[1] << 8) | buf[0];
 	ticks = base + data;
 	dev_dbg(info->dev, "get base:0x%lx, RO count:0x%lx, ticks:0x%lx\n",
 		base, data, ticks);
@@ -145,7 +147,8 @@ static int pm860x_rtc_set_time(struct device *dev, struct rtc_time *tm)
 
 	/* load 32-bit read-only counter */
 	pm860x_bulk_read(info->i2c, PM8607_RTC_COUNTER1, 4, buf);
-	data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
+	data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
+		(buf[1] << 8) | buf[0];
 	base = ticks - data;
 	dev_dbg(info->dev, "set base:0x%lx, RO count:0x%lx, ticks:0x%lx\n",
 		base, data, ticks);
@@ -170,10 +173,12 @@ static int pm860x_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *alrm)
 	pm860x_page_bulk_read(info->i2c, REG0_ADDR, 8, buf);
 	dev_dbg(info->dev, "%x-%x-%x-%x-%x-%x-%x-%x\n", buf[0], buf[1],
 		buf[2], buf[3], buf[4], buf[5], buf[6], buf[7]);
-	base = (buf[1] << 24) | (buf[3] << 16) | (buf[5] << 8) | buf[7];
+	base = ((unsigned long)buf[1] << 24) | (buf[3] << 16) |
+		(buf[5] << 8) | buf[7];
 
 	pm860x_bulk_read(info->i2c, PM8607_RTC_EXPIRE1, 4, buf);
-	data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
+	data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
+		(buf[1] << 8) | buf[0];
 	ticks = base + data;
 	dev_dbg(info->dev, "get base:0x%lx, RO count:0x%lx, ticks:0x%lx\n",
 		base, data, ticks);
@@ -198,11 +203,13 @@ static int pm860x_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *alrm)
 	pm860x_page_bulk_read(info->i2c, REG0_ADDR, 8, buf);
 	dev_dbg(info->dev, "%x-%x-%x-%x-%x-%x-%x-%x\n", buf[0], buf[1],
 		buf[2], buf[3], buf[4], buf[5], buf[6], buf[7]);
-	base = (buf[1] << 24) | (buf[3] << 16) | (buf[5] << 8) | buf[7];
+	base = ((unsigned long)buf[1] << 24) | (buf[3] << 16) |
+		(buf[5] << 8) | buf[7];
 
 	/* load 32-bit read-only counter */
 	pm860x_bulk_read(info->i2c, PM8607_RTC_COUNTER1, 4, buf);
-	data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
+	data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
+		(buf[1] << 8) | buf[0];
 	ticks = base + data;
 	dev_dbg(info->dev, "get base:0x%lx, RO count:0x%lx, ticks:0x%lx\n",
 		base, data, ticks);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 180/639] rtc: 88pm80x: fix unintended sign extension
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (178 preceding siblings ...)
  2020-01-24  9:25 ` [PATCH 4.19 179/639] rtc: 88pm860x: fix unintended sign extension Greg Kroah-Hartman
@ 2020-01-24  9:25 ` Greg Kroah-Hartman
  2020-01-24  9:25 ` [PATCH 4.19 181/639] rtc: pm8xxx: " Greg Kroah-Hartman
                   ` (462 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:25 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Colin Ian King, Alexandre Belloni,
	Sasha Levin

From: Colin Ian King <colin.king@canonical.com>

[ Upstream commit fb0b322537a831b5b0cb948c56f8f958ce493d3a ]

Shifting a u8 by 24 will cause the value to be promoted to an integer. If
the top bit of the u8 is set then the following conversion to an unsigned
long will sign extend the value causing the upper 32 bits to be set in
the result.

Fix this by casting the u8 value to an unsigned long before the shift.

Detected by CoverityScan, CID#714646-714649 ("Unintended sign extension")

Fixes: 2985c29c1964 ("rtc: Add rtc support to 88PM80X PMIC")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/rtc/rtc-88pm80x.c | 21 ++++++++++++++-------
 1 file changed, 14 insertions(+), 7 deletions(-)

diff --git a/drivers/rtc/rtc-88pm80x.c b/drivers/rtc/rtc-88pm80x.c
index cab293cb2bf0b..1fc48ebd3cd05 100644
--- a/drivers/rtc/rtc-88pm80x.c
+++ b/drivers/rtc/rtc-88pm80x.c
@@ -114,12 +114,14 @@ static int pm80x_rtc_read_time(struct device *dev, struct rtc_time *tm)
 	unsigned char buf[4];
 	unsigned long ticks, base, data;
 	regmap_raw_read(info->map, PM800_RTC_EXPIRE2_1, buf, 4);
-	base = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
+	base = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
+		(buf[1] << 8) | buf[0];
 	dev_dbg(info->dev, "%x-%x-%x-%x\n", buf[0], buf[1], buf[2], buf[3]);
 
 	/* load 32-bit read-only counter */
 	regmap_raw_read(info->map, PM800_RTC_COUNTER1, buf, 4);
-	data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
+	data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
+		(buf[1] << 8) | buf[0];
 	ticks = base + data;
 	dev_dbg(info->dev, "get base:0x%lx, RO count:0x%lx, ticks:0x%lx\n",
 		base, data, ticks);
@@ -137,7 +139,8 @@ static int pm80x_rtc_set_time(struct device *dev, struct rtc_time *tm)
 
 	/* load 32-bit read-only counter */
 	regmap_raw_read(info->map, PM800_RTC_COUNTER1, buf, 4);
-	data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
+	data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
+		(buf[1] << 8) | buf[0];
 	base = ticks - data;
 	dev_dbg(info->dev, "set base:0x%lx, RO count:0x%lx, ticks:0x%lx\n",
 		base, data, ticks);
@@ -158,11 +161,13 @@ static int pm80x_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *alrm)
 	int ret;
 
 	regmap_raw_read(info->map, PM800_RTC_EXPIRE2_1, buf, 4);
-	base = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
+	base = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
+		(buf[1] << 8) | buf[0];
 	dev_dbg(info->dev, "%x-%x-%x-%x\n", buf[0], buf[1], buf[2], buf[3]);
 
 	regmap_raw_read(info->map, PM800_RTC_EXPIRE1_1, buf, 4);
-	data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
+	data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
+		(buf[1] << 8) | buf[0];
 	ticks = base + data;
 	dev_dbg(info->dev, "get base:0x%lx, RO count:0x%lx, ticks:0x%lx\n",
 		base, data, ticks);
@@ -185,12 +190,14 @@ static int pm80x_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *alrm)
 	regmap_update_bits(info->map, PM800_RTC_CONTROL, PM800_ALARM1_EN, 0);
 
 	regmap_raw_read(info->map, PM800_RTC_EXPIRE2_1, buf, 4);
-	base = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
+	base = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
+		(buf[1] << 8) | buf[0];
 	dev_dbg(info->dev, "%x-%x-%x-%x\n", buf[0], buf[1], buf[2], buf[3]);
 
 	/* load 32-bit read-only counter */
 	regmap_raw_read(info->map, PM800_RTC_COUNTER1, buf, 4);
-	data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
+	data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
+		(buf[1] << 8) | buf[0];
 	ticks = base + data;
 	dev_dbg(info->dev, "get base:0x%lx, RO count:0x%lx, ticks:0x%lx\n",
 		base, data, ticks);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 181/639] rtc: pm8xxx: fix unintended sign extension
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (179 preceding siblings ...)
  2020-01-24  9:25 ` [PATCH 4.19 180/639] rtc: 88pm80x: " Greg Kroah-Hartman
@ 2020-01-24  9:25 ` Greg Kroah-Hartman
  2020-01-24  9:25 ` [PATCH 4.19 182/639] fbdev: chipsfb: remove set but not used variable size Greg Kroah-Hartman
                   ` (461 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:25 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Colin Ian King, Alexandre Belloni,
	Sasha Levin

From: Colin Ian King <colin.king@canonical.com>

[ Upstream commit e42280886018c6f77f0a90190f7cba344b0df3e0 ]

Shifting a u8 by 24 will cause the value to be promoted to an integer. If
the top bit of the u8 is set then the following conversion to an unsigned
long will sign extend the value causing the upper 32 bits to be set in
the result.

Fix this by casting the u8 value to an unsigned long before the shift.

Detected by CoverityScan, CID#1309693 ("Unintended sign extension")

Fixes: 9a9a54ad7aa2 ("drivers/rtc: add support for Qualcomm PMIC8xxx RTC")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/rtc/rtc-pm8xxx.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/rtc/rtc-pm8xxx.c b/drivers/rtc/rtc-pm8xxx.c
index 29358a0459258..e03104b734fc9 100644
--- a/drivers/rtc/rtc-pm8xxx.c
+++ b/drivers/rtc/rtc-pm8xxx.c
@@ -213,7 +213,8 @@ static int pm8xxx_rtc_read_time(struct device *dev, struct rtc_time *tm)
 		}
 	}
 
-	secs = value[0] | (value[1] << 8) | (value[2] << 16) | (value[3] << 24);
+	secs = value[0] | (value[1] << 8) | (value[2] << 16) |
+	       ((unsigned long)value[3] << 24);
 
 	rtc_time_to_tm(secs, tm);
 
@@ -288,7 +289,8 @@ static int pm8xxx_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *alarm)
 		return rc;
 	}
 
-	secs = value[0] | (value[1] << 8) | (value[2] << 16) | (value[3] << 24);
+	secs = value[0] | (value[1] << 8) | (value[2] << 16) |
+	       ((unsigned long)value[3] << 24);
 
 	rtc_time_to_tm(secs, &alarm->time);
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 182/639] fbdev: chipsfb: remove set but not used variable size
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (180 preceding siblings ...)
  2020-01-24  9:25 ` [PATCH 4.19 181/639] rtc: pm8xxx: " Greg Kroah-Hartman
@ 2020-01-24  9:25 ` Greg Kroah-Hartman
  2020-01-24  9:25 ` [PATCH 4.19 183/639] iw_cxgb4: use tos when importing the endpoint Greg Kroah-Hartman
                   ` (460 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:25 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, YueHaibing, Michael Ellerman,
	Daniel Vetter, Christophe Leroy, Bartlomiej Zolnierkiewicz,
	Sasha Levin

From: YueHaibing <yuehaibing@huawei.com>

[ Upstream commit 8e71fa5e4d86bedfd26df85381d65d6b4c860020 ]

Fixes gcc '-Wunused-but-set-variable' warning:

drivers/video/fbdev/chipsfb.c: In function 'chipsfb_pci_init':
drivers/video/fbdev/chipsfb.c:352:22: warning:
 variable 'size' set but not used [-Wunused-but-set-variable]

Fixes: 8c8709334cec ("[PATCH] ppc32: Remove CONFIG_PMAC_PBOOK").
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Acked-by: Michael Ellerman <mpe@ellerman.id.au>
Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
Cc: Christophe Leroy <christophe.leroy@c-s.fr>
[b.zolnierkie: minor commit summary and description fixups]
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/video/fbdev/chipsfb.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/video/fbdev/chipsfb.c b/drivers/video/fbdev/chipsfb.c
index f103665cad431..f9b366d175875 100644
--- a/drivers/video/fbdev/chipsfb.c
+++ b/drivers/video/fbdev/chipsfb.c
@@ -350,7 +350,7 @@ static void init_chips(struct fb_info *p, unsigned long addr)
 static int chipsfb_pci_init(struct pci_dev *dp, const struct pci_device_id *ent)
 {
 	struct fb_info *p;
-	unsigned long addr, size;
+	unsigned long addr;
 	unsigned short cmd;
 	int rc = -ENODEV;
 
@@ -362,7 +362,6 @@ static int chipsfb_pci_init(struct pci_dev *dp, const struct pci_device_id *ent)
 	if ((dp->resource[0].flags & IORESOURCE_MEM) == 0)
 		goto err_disable;
 	addr = pci_resource_start(dp, 0);
-	size = pci_resource_len(dp, 0);
 	if (addr == 0)
 		goto err_disable;
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 183/639] iw_cxgb4: use tos when importing the endpoint
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (181 preceding siblings ...)
  2020-01-24  9:25 ` [PATCH 4.19 182/639] fbdev: chipsfb: remove set but not used variable size Greg Kroah-Hartman
@ 2020-01-24  9:25 ` Greg Kroah-Hartman
  2020-01-24  9:25 ` [PATCH 4.19 184/639] iw_cxgb4: use tos when finding ipv6 routes Greg Kroah-Hartman
                   ` (459 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:25 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Steve Wise, Jason Gunthorpe, Sasha Levin

From: Steve Wise <swise@opengridcomputing.com>

[ Upstream commit cb3ba0bde881f0cb7e3945d2a266901e2bd18c92 ]

import_ep() is passed the correct tos, but doesn't use it correctly.

Fixes: ac8e4c69a021 ("cxgb4/iw_cxgb4: TOS support")
Signed-off-by: Steve Wise <swise@opengridcomputing.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/hw/cxgb4/cm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
index 1b3d014fa1d6e..3c8b7eae918c5 100644
--- a/drivers/infiniband/hw/cxgb4/cm.c
+++ b/drivers/infiniband/hw/cxgb4/cm.c
@@ -2076,7 +2076,7 @@ static int import_ep(struct c4iw_ep *ep, int iptype, __u8 *peer_ip,
 	} else {
 		pdev = get_real_dev(n->dev);
 		ep->l2t = cxgb4_l2t_get(cdev->rdev.lldi.l2t,
-					n, pdev, 0);
+					n, pdev, rt_tos2priority(tos));
 		if (!ep->l2t)
 			goto out;
 		ep->mtu = dst_mtu(dst);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 184/639] iw_cxgb4: use tos when finding ipv6 routes
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (182 preceding siblings ...)
  2020-01-24  9:25 ` [PATCH 4.19 183/639] iw_cxgb4: use tos when importing the endpoint Greg Kroah-Hartman
@ 2020-01-24  9:25 ` Greg Kroah-Hartman
  2020-01-24  9:25 ` [PATCH 4.19 185/639] ipmi: kcs_bmc: handle devm_kasprintf() failure case Greg Kroah-Hartman
                   ` (458 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:25 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Steve Wise, Jason Gunthorpe, Sasha Levin

From: Steve Wise <swise@opengridcomputing.com>

[ Upstream commit c8a7eb554a83214c3d8ee5cb322da8c72810d2dc ]

When IPv6 support was added, the correct tos was not passed to
cxgb_find_route6(). This potentially results in the wrong route entry.

Fixes: 830662f6f032 ("RDMA/cxgb4: Add support for active and passive open connection with IPv6 address")
Signed-off-by: Steve Wise <swise@opengridcomputing.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/hw/cxgb4/cm.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
index 3c8b7eae918c5..16145b0a14583 100644
--- a/drivers/infiniband/hw/cxgb4/cm.c
+++ b/drivers/infiniband/hw/cxgb4/cm.c
@@ -2166,7 +2166,8 @@ static int c4iw_reconnect(struct c4iw_ep *ep)
 					   laddr6->sin6_addr.s6_addr,
 					   raddr6->sin6_addr.s6_addr,
 					   laddr6->sin6_port,
-					   raddr6->sin6_port, 0,
+					   raddr6->sin6_port,
+					   ep->com.cm_id->tos,
 					   raddr6->sin6_scope_id);
 		iptype = 6;
 		ra = (__u8 *)&raddr6->sin6_addr;
@@ -3326,7 +3327,7 @@ int c4iw_connect(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
 					   laddr6->sin6_addr.s6_addr,
 					   raddr6->sin6_addr.s6_addr,
 					   laddr6->sin6_port,
-					   raddr6->sin6_port, 0,
+					   raddr6->sin6_port, cm_id->tos,
 					   raddr6->sin6_scope_id);
 	}
 	if (!ep->dst) {
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 185/639] ipmi: kcs_bmc: handle devm_kasprintf() failure case
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (183 preceding siblings ...)
  2020-01-24  9:25 ` [PATCH 4.19 184/639] iw_cxgb4: use tos when finding ipv6 routes Greg Kroah-Hartman
@ 2020-01-24  9:25 ` Greg Kroah-Hartman
  2020-01-24  9:25 ` [PATCH 4.19 186/639] xsk: add missing smp_rmb() in xsk_mmap Greg Kroah-Hartman
                   ` (457 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:25 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Nicholas Mc Guire, Corey Minyard,
	Haiyue Wang, Sasha Levin

From: Nicholas Mc Guire <hofrat@osadl.org>

[ Upstream commit 42c7c6ef1e6fa5fc0425120f06f045190b1dda2d ]

devm_kasprintf() may return NULL if internal allocation failed so this
assignment is not safe. Moved the error exit path and added the !NULL
which then allows the devres manager to take care of cleanup.

Signed-off-by: Nicholas Mc Guire <hofrat@osadl.org>
Fixes: cd2315d471f4 ("ipmi: kcs_bmc: don't change device name")
Signed-off-by: Corey Minyard <cminyard@mvista.com>
Reviewed-by: Haiyue Wang <haiyue.wang@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/char/ipmi/kcs_bmc.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/char/ipmi/kcs_bmc.c b/drivers/char/ipmi/kcs_bmc.c
index e6124bd548df2..ed4dc3b1843e3 100644
--- a/drivers/char/ipmi/kcs_bmc.c
+++ b/drivers/char/ipmi/kcs_bmc.c
@@ -440,12 +440,13 @@ struct kcs_bmc *kcs_bmc_alloc(struct device *dev, int sizeof_priv, u32 channel)
 	kcs_bmc->data_in = devm_kmalloc(dev, KCS_MSG_BUFSIZ, GFP_KERNEL);
 	kcs_bmc->data_out = devm_kmalloc(dev, KCS_MSG_BUFSIZ, GFP_KERNEL);
 	kcs_bmc->kbuffer = devm_kmalloc(dev, KCS_MSG_BUFSIZ, GFP_KERNEL);
-	if (!kcs_bmc->data_in || !kcs_bmc->data_out || !kcs_bmc->kbuffer)
-		return NULL;
 
 	kcs_bmc->miscdev.minor = MISC_DYNAMIC_MINOR;
 	kcs_bmc->miscdev.name = devm_kasprintf(dev, GFP_KERNEL, "%s%u",
 					       DEVICE_NAME, channel);
+	if (!kcs_bmc->data_in || !kcs_bmc->data_out || !kcs_bmc->kbuffer ||
+	    !kcs_bmc->miscdev.name)
+		return NULL;
 	kcs_bmc->miscdev.fops = &kcs_bmc_fops;
 
 	return kcs_bmc;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 186/639] xsk: add missing smp_rmb() in xsk_mmap
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (184 preceding siblings ...)
  2020-01-24  9:25 ` [PATCH 4.19 185/639] ipmi: kcs_bmc: handle devm_kasprintf() failure case Greg Kroah-Hartman
@ 2020-01-24  9:25 ` Greg Kroah-Hartman
  2020-01-24  9:25 ` [PATCH 4.19 187/639] drm/etnaviv: potential NULL dereference Greg Kroah-Hartman
                   ` (456 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:25 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Magnus Karlsson, Alexei Starovoitov,
	Sasha Levin

From: Magnus Karlsson <magnus.karlsson@intel.com>

[ Upstream commit e6762c8bcf982821935a2b1cb33cf8335d0eefae ]

All the setup code in AF_XDP is protected by a mutex with the
exception of the mmap code that cannot use it. To make sure that a
process banging on the mmap call at the same time as another process
is setting up the socket, smp_wmb() calls were added in the umem
registration code and the queue creation code, so that the published
structures that xsk_mmap needs would be consistent. However, the
corresponding smp_rmb() calls were not added to the xsk_mmap
code. This patch adds these calls.

Fixes: 37b076933a8e3 ("xsk: add missing write- and data-dependency barrier")
Fixes: c0c77d8fb787c ("xsk: add user memory registration support sockopt")
Signed-off-by: Magnus Karlsson <magnus.karlsson@intel.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/xdp/xsk.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c
index ff15207036dc5..547fc4554b22c 100644
--- a/net/xdp/xsk.c
+++ b/net/xdp/xsk.c
@@ -661,6 +661,8 @@ static int xsk_mmap(struct file *file, struct socket *sock,
 		if (!umem)
 			return -EINVAL;
 
+		/* Matches the smp_wmb() in XDP_UMEM_REG */
+		smp_rmb();
 		if (offset == XDP_UMEM_PGOFF_FILL_RING)
 			q = READ_ONCE(umem->fq);
 		else if (offset == XDP_UMEM_PGOFF_COMPLETION_RING)
@@ -670,6 +672,8 @@ static int xsk_mmap(struct file *file, struct socket *sock,
 	if (!q)
 		return -EINVAL;
 
+	/* Matches the smp_wmb() in xsk_init_queue */
+	smp_rmb();
 	qpg = virt_to_head_page(q->ring);
 	if (size > (PAGE_SIZE << compound_order(qpg)))
 		return -EINVAL;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 187/639] drm/etnaviv: potential NULL dereference
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (185 preceding siblings ...)
  2020-01-24  9:25 ` [PATCH 4.19 186/639] xsk: add missing smp_rmb() in xsk_mmap Greg Kroah-Hartman
@ 2020-01-24  9:25 ` Greg Kroah-Hartman
  2020-01-24  9:25 ` [PATCH 4.19 188/639] ntb_hw_switchtec: debug print 64bit aligned crosslink BAR Numbers Greg Kroah-Hartman
                   ` (455 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:25 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Christian Gmeiner,
	Lucas Stach, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit 9e05352340d3a3e68c144136db9810b26ebb88c3 ]

The etnaviv_gem_prime_get_sg_table() is supposed to return error
pointers.  Otherwise it can lead to a NULL dereference when it's called
from drm_gem_map_dma_buf().

Fixes: 5f4a4a73f437 ("drm/etnaviv: fix gem_prime_get_sg_table to return new SG table")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Christian Gmeiner <christian.gmeiner@gmail.com>
Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c b/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c
index 0566171f8df22..f21529e635e3d 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c
@@ -15,7 +15,7 @@ struct sg_table *etnaviv_gem_prime_get_sg_table(struct drm_gem_object *obj)
 	int npages = obj->size >> PAGE_SHIFT;
 
 	if (WARN_ON(!etnaviv_obj->pages))  /* should have already pinned! */
-		return NULL;
+		return ERR_PTR(-EINVAL);
 
 	return drm_prime_pages_to_sg(etnaviv_obj->pages, npages);
 }
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 188/639] ntb_hw_switchtec: debug print 64bit aligned crosslink BAR Numbers
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (186 preceding siblings ...)
  2020-01-24  9:25 ` [PATCH 4.19 187/639] drm/etnaviv: potential NULL dereference Greg Kroah-Hartman
@ 2020-01-24  9:25 ` Greg Kroah-Hartman
  2020-01-24  9:25 ` [PATCH 4.19 189/639] ntb_hw_switchtec: NT req id mapping table register entry number should be 512 Greg Kroah-Hartman
                   ` (454 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:25 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Paul Selles, Wesley Sheng,
	Logan Gunthorpe, Jon Mason, Sasha Levin

From: Paul Selles <paul.selles@microchip.com>

[ Upstream commit cce8e04cf79e47809455215744685e8eb56f94bb ]

Switchtec NTB crosslink BARs are 64bit addressed but they are printed as
32bit addressed BARs. Fix debug log to increment the BAR numbers by 2 to
reflect the 64bit address alignment.

Fixes: 017525018202 ("ntb_hw_switchtec: Add initialization code for crosslink")
Signed-off-by: Paul Selles <paul.selles@microchip.com>
Signed-off-by: Wesley Sheng <wesley.sheng@microchip.com>
Reviewed-by: Logan Gunthorpe <logang@deltatee.com>
Signed-off-by: Jon Mason <jdmason@kudzu.us>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/ntb/hw/mscc/ntb_hw_switchtec.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/ntb/hw/mscc/ntb_hw_switchtec.c b/drivers/ntb/hw/mscc/ntb_hw_switchtec.c
index 5ee5f40b4dfc3..9916bc5b6759a 100644
--- a/drivers/ntb/hw/mscc/ntb_hw_switchtec.c
+++ b/drivers/ntb/hw/mscc/ntb_hw_switchtec.c
@@ -1120,7 +1120,7 @@ static int crosslink_enum_partition(struct switchtec_ntb *sndev,
 
 		dev_dbg(&sndev->stdev->dev,
 			"Crosslink BAR%d addr: %llx\n",
-			i, bar_addr);
+			i*2, bar_addr);
 
 		if (bar_addr != bar_space * i)
 			continue;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 189/639] ntb_hw_switchtec: NT req id mapping table register entry number should be 512
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (187 preceding siblings ...)
  2020-01-24  9:25 ` [PATCH 4.19 188/639] ntb_hw_switchtec: debug print 64bit aligned crosslink BAR Numbers Greg Kroah-Hartman
@ 2020-01-24  9:25 ` Greg Kroah-Hartman
  2020-01-24  9:26 ` [PATCH 4.19 190/639] pinctrl: sh-pfc: emev2: Add missing pinmux functions Greg Kroah-Hartman
                   ` (453 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:25 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Wesley Sheng, Logan Gunthorpe,
	Jon Mason, Sasha Levin

From: Wesley Sheng <wesley.sheng@microchip.com>

[ Upstream commit d123fab71f63aae129aebe052664fda73131921a ]

The number of available NT req id mapping table entries per NTB control
register is 512. The driver mistakenly limits the number to 256.

Fix the array size of NT req id mapping table.

Fixes: c082b04c9d40 ("NTB: switchtec: Add NTB hardware register definitions")
Signed-off-by: Wesley Sheng <wesley.sheng@microchip.com>
Reviewed-by: Logan Gunthorpe <logang@deltatee.com>
Signed-off-by: Jon Mason <jdmason@kudzu.us>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/switchtec.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/linux/switchtec.h b/include/linux/switchtec.h
index ab400af6f0ce3..623719c917061 100644
--- a/include/linux/switchtec.h
+++ b/include/linux/switchtec.h
@@ -244,8 +244,8 @@ struct ntb_ctrl_regs {
 		u64 xlate_addr;
 	} bar_entry[6];
 	u32 reserved2[216];
-	u32 req_id_table[256];
-	u32 reserved3[512];
+	u32 req_id_table[512];
+	u32 reserved3[256];
 	u64 lut_entry[512];
 } __packed;
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 190/639] pinctrl: sh-pfc: emev2: Add missing pinmux functions
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (188 preceding siblings ...)
  2020-01-24  9:25 ` [PATCH 4.19 189/639] ntb_hw_switchtec: NT req id mapping table register entry number should be 512 Greg Kroah-Hartman
@ 2020-01-24  9:26 ` Greg Kroah-Hartman
  2020-01-24  9:26 ` [PATCH 4.19 191/639] pinctrl: sh-pfc: r8a7791: Fix scifb2_data_c pin group Greg Kroah-Hartman
                   ` (452 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:26 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Geert Uytterhoeven, Simon Horman,
	Sasha Levin

From: Geert Uytterhoeven <geert+renesas@glider.be>

[ Upstream commit 1ecd8c9cb899ae277e6986ae134635cb1a50f5de ]

The err_rst_reqb, ext_clki, lowpwr, and ref_clko pin groups are present,
but no pinmux functions refer to them, hence they can not be selected.

Fixes: 1e7d5d849cf4f0c5 ("sh-pfc: Add emev2 pinmux support")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pinctrl/sh-pfc/pfc-emev2.c | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/drivers/pinctrl/sh-pfc/pfc-emev2.c b/drivers/pinctrl/sh-pfc/pfc-emev2.c
index 1cbbe04d7df65..eafd8edbcbe95 100644
--- a/drivers/pinctrl/sh-pfc/pfc-emev2.c
+++ b/drivers/pinctrl/sh-pfc/pfc-emev2.c
@@ -1263,6 +1263,14 @@ static const char * const dtv_groups[] = {
 	"dtv_b",
 };
 
+static const char * const err_rst_reqb_groups[] = {
+	"err_rst_reqb",
+};
+
+static const char * const ext_clki_groups[] = {
+	"ext_clki",
+};
+
 static const char * const iic0_groups[] = {
 	"iic0",
 };
@@ -1285,6 +1293,10 @@ static const char * const lcd_groups[] = {
 	"yuv3",
 };
 
+static const char * const lowpwr_groups[] = {
+	"lowpwr",
+};
+
 static const char * const ntsc_groups[] = {
 	"ntsc_clk",
 	"ntsc_data",
@@ -1298,6 +1310,10 @@ static const char * const pwm1_groups[] = {
 	"pwm1",
 };
 
+static const char * const ref_clko_groups[] = {
+	"ref_clko",
+};
+
 static const char * const sd_groups[] = {
 	"sd_cki",
 };
@@ -1391,13 +1407,17 @@ static const struct sh_pfc_function pinmux_functions[] = {
 	SH_PFC_FUNCTION(cam),
 	SH_PFC_FUNCTION(cf),
 	SH_PFC_FUNCTION(dtv),
+	SH_PFC_FUNCTION(err_rst_reqb),
+	SH_PFC_FUNCTION(ext_clki),
 	SH_PFC_FUNCTION(iic0),
 	SH_PFC_FUNCTION(iic1),
 	SH_PFC_FUNCTION(jtag),
 	SH_PFC_FUNCTION(lcd),
+	SH_PFC_FUNCTION(lowpwr),
 	SH_PFC_FUNCTION(ntsc),
 	SH_PFC_FUNCTION(pwm0),
 	SH_PFC_FUNCTION(pwm1),
+	SH_PFC_FUNCTION(ref_clko),
 	SH_PFC_FUNCTION(sd),
 	SH_PFC_FUNCTION(sdi0),
 	SH_PFC_FUNCTION(sdi1),
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 191/639] pinctrl: sh-pfc: r8a7791: Fix scifb2_data_c pin group
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (189 preceding siblings ...)
  2020-01-24  9:26 ` [PATCH 4.19 190/639] pinctrl: sh-pfc: emev2: Add missing pinmux functions Greg Kroah-Hartman
@ 2020-01-24  9:26 ` Greg Kroah-Hartman
  2020-01-24  9:26 ` [PATCH 4.19 192/639] pinctrl: sh-pfc: r8a7792: Fix vin1_data18_b " Greg Kroah-Hartman
                   ` (451 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:26 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Geert Uytterhoeven, Simon Horman,
	Sasha Levin

From: Geert Uytterhoeven <geert+renesas@glider.be>

[ Upstream commit a4b0350047f1b10207e25e72d7cd3f7826e93769 ]

The entry for "scifb2_data_c" in the SCIFB2 pin group array contains a
typo, thus the group cannot be selected.

Fixes: 5088451962389924 ("pinctrl: sh-pfc: r8a7791 PFC support")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pinctrl/sh-pfc/pfc-r8a7791.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7791.c b/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
index 6236ac55c65d3..9eb860c8f9174 100644
--- a/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
+++ b/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
@@ -5239,7 +5239,7 @@ static const char * const scifb2_groups[] = {
 	"scifb2_data_b",
 	"scifb2_clk_b",
 	"scifb2_ctrl_b",
-	"scifb0_data_c",
+	"scifb2_data_c",
 	"scifb2_clk_c",
 	"scifb2_data_d",
 };
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 192/639] pinctrl: sh-pfc: r8a7792: Fix vin1_data18_b pin group
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (190 preceding siblings ...)
  2020-01-24  9:26 ` [PATCH 4.19 191/639] pinctrl: sh-pfc: r8a7791: Fix scifb2_data_c pin group Greg Kroah-Hartman
@ 2020-01-24  9:26 ` Greg Kroah-Hartman
  2020-01-24  9:26 ` [PATCH 4.19 193/639] pinctrl: sh-pfc: sh73a0: Fix fsic_spdif pin groups Greg Kroah-Hartman
                   ` (450 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:26 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Geert Uytterhoeven, Simon Horman,
	Sasha Levin

From: Geert Uytterhoeven <geert+renesas@glider.be>

[ Upstream commit b9fd50488b4939ce5b3a026d29e752e17c2d1800 ]

The vin1_data18_b pin group itself is present, but it is not listed in
the VIN1 pin group array, and thus cannot be selected.

Fixes: 7dd74bb1f058786e ("pinctrl: sh-pfc: r8a7792: Add VIN pin groups")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pinctrl/sh-pfc/pfc-r8a7792.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7792.c b/drivers/pinctrl/sh-pfc/pfc-r8a7792.c
index cc3597f66605a..46c41ca6ea38b 100644
--- a/drivers/pinctrl/sh-pfc/pfc-r8a7792.c
+++ b/drivers/pinctrl/sh-pfc/pfc-r8a7792.c
@@ -1916,6 +1916,7 @@ static const char * const vin1_groups[] = {
 	"vin1_data8",
 	"vin1_data24_b",
 	"vin1_data20_b",
+	"vin1_data18_b",
 	"vin1_data16_b",
 	"vin1_sync",
 	"vin1_field",
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 193/639] pinctrl: sh-pfc: sh73a0: Fix fsic_spdif pin groups
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (191 preceding siblings ...)
  2020-01-24  9:26 ` [PATCH 4.19 192/639] pinctrl: sh-pfc: r8a7792: Fix vin1_data18_b " Greg Kroah-Hartman
@ 2020-01-24  9:26 ` Greg Kroah-Hartman
  2020-01-24  9:26 ` [PATCH 4.19 194/639] RDMA/mlx5: Fix memory leak in case we fail to add an IB device Greg Kroah-Hartman
                   ` (449 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:26 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Geert Uytterhoeven, Simon Horman,
	Sasha Levin

From: Geert Uytterhoeven <geert+renesas@glider.be>

[ Upstream commit 0e6e448bdcf896d001a289a6112a704542d51516 ]

There are two pin groups for the FSIC SPDIF signal, but the FSIC pin
group array lists only one, and it refers to a nonexistent group.

Fixes: 2ecd4154c906b7d6 ("sh-pfc: sh73a0: Add FSI pin groups and functions")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pinctrl/sh-pfc/pfc-sh73a0.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/pinctrl/sh-pfc/pfc-sh73a0.c b/drivers/pinctrl/sh-pfc/pfc-sh73a0.c
index f8fbedb46585d..6dca760f9f280 100644
--- a/drivers/pinctrl/sh-pfc/pfc-sh73a0.c
+++ b/drivers/pinctrl/sh-pfc/pfc-sh73a0.c
@@ -3367,7 +3367,8 @@ static const char * const fsic_groups[] = {
 	"fsic_sclk_out",
 	"fsic_data_in",
 	"fsic_data_out",
-	"fsic_spdif",
+	"fsic_spdif_0",
+	"fsic_spdif_1",
 };
 
 static const char * const fsid_groups[] = {
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 194/639] RDMA/mlx5: Fix memory leak in case we fail to add an IB device
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (192 preceding siblings ...)
  2020-01-24  9:26 ` [PATCH 4.19 193/639] pinctrl: sh-pfc: sh73a0: Fix fsic_spdif pin groups Greg Kroah-Hartman
@ 2020-01-24  9:26 ` Greg Kroah-Hartman
  2020-01-24  9:26 ` [PATCH 4.19 195/639] driver core: Fix possible supplier PM-usage counter imbalance Greg Kroah-Hartman
                   ` (448 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:26 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Mark Bloch, Bodong Wang,
	Håkon Bugge, Leon Romanovsky, Jason Gunthorpe, Sasha Levin

From: Mark Bloch <markb@mellanox.com>

[ Upstream commit fc9e4477f924e84d7798f7a1d41401d699de1219 ]

Make sure the IB device is freed on failure.

Fixes: b5ca15ad7e61 ("IB/mlx5: Add proper representors support")
Signed-off-by: Mark Bloch <markb@mellanox.com>
Reviewed-by: Bodong Wang <bodong@mellanox.com>
Reviewed-by: Håkon Bugge <haakon.bugge@oracle.com>
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/hw/mlx5/ib_rep.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/infiniband/hw/mlx5/ib_rep.c b/drivers/infiniband/hw/mlx5/ib_rep.c
index 35a0e04c38f28..b841589c27c9c 100644
--- a/drivers/infiniband/hw/mlx5/ib_rep.c
+++ b/drivers/infiniband/hw/mlx5/ib_rep.c
@@ -69,8 +69,10 @@ mlx5_ib_vport_rep_load(struct mlx5_core_dev *dev, struct mlx5_eswitch_rep *rep)
 	ibdev->mdev = dev;
 	ibdev->num_ports = max(MLX5_CAP_GEN(dev, num_ports),
 			       MLX5_CAP_GEN(dev, num_vhca_ports));
-	if (!__mlx5_ib_add(ibdev, &rep_profile))
+	if (!__mlx5_ib_add(ibdev, &rep_profile)) {
+		ib_dealloc_device(&ibdev->ib_dev);
 		return -EINVAL;
+	}
 
 	rep->rep_if[REP_IB].priv = ibdev;
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 195/639] driver core: Fix possible supplier PM-usage counter imbalance
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (193 preceding siblings ...)
  2020-01-24  9:26 ` [PATCH 4.19 194/639] RDMA/mlx5: Fix memory leak in case we fail to add an IB device Greg Kroah-Hartman
@ 2020-01-24  9:26 ` Greg Kroah-Hartman
  2020-01-24  9:26 ` [PATCH 4.19 196/639] PCI: endpoint: functions: Use memcpy_fromio()/memcpy_toio() Greg Kroah-Hartman
                   ` (447 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:26 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ulf Hansson, Rafael J. Wysocki, Sasha Levin

From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>

[ Upstream commit 4c06c4e6cf63d7f3d5dfe62593a073253d750a59 ]

If a stateless device link to a certain supplier with
DL_FLAG_PM_RUNTIME set in the flags is added and then removed by the
consumer driver's probe callback, the supplier's PM-runtime usage
counter will be nonzero after that which effectively causes the
supplier to remain "always on" going forward.

Namely, device_link_add() called to add the link invokes
device_link_rpm_prepare() which notices that the consumer driver is
probing, so it increments the supplier's PM-runtime usage counter
with the assumption that the link will stay around until
pm_runtime_put_suppliers() is called by driver_probe_device(),
but if the link goes away before that point, the supplier's
PM-runtime usage counter will remain nonzero.

To prevent that from happening, first rework pm_runtime_get_suppliers()
and pm_runtime_put_suppliers() to use the rpm_active refounts of device
links and make the latter only drop rpm_active and the supplier's
PM-runtime usage counter for each link by one, unless rpm_active is
one already for it.  Next, modify device_link_add() to bump up the
new link's rpm_active refcount and the suppliers PM-runtime usage
counter by two, to prevent pm_runtime_put_suppliers(), if it is
called subsequently, from suspending the supplier prematurely (in
case its PM-runtime usage counter goes down to 0 in there).

Due to the way rpm_put_suppliers() works, this change does not
affect runtime suspend of the consumer ends of new device links (or,
generally, device links for which DL_FLAG_PM_RUNTIME has just been
set).

Fixes: e2f3cd831a28 ("driver core: Fix handling of runtime PM flags in device_link_add()")
Reported-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Reviewed-by: Ulf Hansson <ulf.hansson@linaro.org>
Tested-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/base/core.c          | 21 ++++-----------------
 drivers/base/power/runtime.c | 27 +++++++++++++++++++++++++--
 include/linux/pm_runtime.h   |  4 ++++
 3 files changed, 33 insertions(+), 19 deletions(-)

diff --git a/drivers/base/core.c b/drivers/base/core.c
index 7599147d5f83c..ab08211ba5d2d 100644
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -165,19 +165,6 @@ void device_pm_move_to_tail(struct device *dev)
 	device_links_read_unlock(idx);
 }
 
-static void device_link_rpm_prepare(struct device *consumer,
-				    struct device *supplier)
-{
-	pm_runtime_new_link(consumer);
-	/*
-	 * If the link is being added by the consumer driver at probe time,
-	 * balance the decrementation of the supplier's runtime PM usage counter
-	 * after consumer probe in driver_probe_device().
-	 */
-	if (consumer->links.status == DL_DEV_PROBING)
-		pm_runtime_get_noresume(supplier);
-}
-
 /**
  * device_link_add - Create a link between two devices.
  * @consumer: Consumer end of the link.
@@ -262,11 +249,11 @@ struct device_link *device_link_add(struct device *consumer,
 
 		if (flags & DL_FLAG_PM_RUNTIME) {
 			if (!(link->flags & DL_FLAG_PM_RUNTIME)) {
-				device_link_rpm_prepare(consumer, supplier);
+				pm_runtime_new_link(consumer);
 				link->flags |= DL_FLAG_PM_RUNTIME;
 			}
 			if (flags & DL_FLAG_RPM_ACTIVE)
-				refcount_inc(&link->rpm_active);
+				pm_runtime_active_link(link, supplier);
 		}
 
 		kref_get(&link->kref);
@@ -281,9 +268,9 @@ struct device_link *device_link_add(struct device *consumer,
 
 	if (flags & DL_FLAG_PM_RUNTIME) {
 		if (flags & DL_FLAG_RPM_ACTIVE)
-			refcount_inc(&link->rpm_active);
+			pm_runtime_active_link(link, supplier);
 
-		device_link_rpm_prepare(consumer, supplier);
+		pm_runtime_new_link(consumer);
 	}
 
 	get_device(supplier);
diff --git a/drivers/base/power/runtime.c b/drivers/base/power/runtime.c
index ab454c4533ba1..0527890b4c191 100644
--- a/drivers/base/power/runtime.c
+++ b/drivers/base/power/runtime.c
@@ -1570,8 +1570,10 @@ void pm_runtime_get_suppliers(struct device *dev)
 	idx = device_links_read_lock();
 
 	list_for_each_entry_rcu(link, &dev->links.suppliers, c_node)
-		if (link->flags & DL_FLAG_PM_RUNTIME)
+		if (link->flags & DL_FLAG_PM_RUNTIME) {
+			refcount_inc(&link->rpm_active);
 			pm_runtime_get_sync(link->supplier);
+		}
 
 	device_links_read_unlock(idx);
 }
@@ -1588,7 +1590,8 @@ void pm_runtime_put_suppliers(struct device *dev)
 	idx = device_links_read_lock();
 
 	list_for_each_entry_rcu(link, &dev->links.suppliers, c_node)
-		if (link->flags & DL_FLAG_PM_RUNTIME)
+		if (link->flags & DL_FLAG_PM_RUNTIME &&
+		    refcount_dec_not_one(&link->rpm_active))
 			pm_runtime_put(link->supplier);
 
 	device_links_read_unlock(idx);
@@ -1601,6 +1604,26 @@ void pm_runtime_new_link(struct device *dev)
 	spin_unlock_irq(&dev->power.lock);
 }
 
+/**
+ * pm_runtime_active_link - Set up new device link as active for PM-runtime.
+ * @link: Device link to be set up as active.
+ * @supplier: Supplier end of the link.
+ *
+ * Add 2 to the rpm_active refcount of @link and increment the PM-runtime
+ * usage counter of @supplier once more in case the link is being added while
+ * the consumer driver is probing and pm_runtime_put_suppliers() will be called
+ * subsequently.
+ *
+ * Note that this doesn't prevent rpm_put_suppliers() from decreasing the link's
+ * rpm_active refcount down to one, so runtime suspend of the consumer end of
+ * @link is not affected.
+ */
+void pm_runtime_active_link(struct device_link *link, struct device *supplier)
+{
+	refcount_add(2, &link->rpm_active);
+	pm_runtime_get_noresume(supplier);
+}
+
 void pm_runtime_drop_link(struct device *dev)
 {
 	spin_lock_irq(&dev->power.lock);
diff --git a/include/linux/pm_runtime.h b/include/linux/pm_runtime.h
index f0fc4700b6ff5..bace7df51af4d 100644
--- a/include/linux/pm_runtime.h
+++ b/include/linux/pm_runtime.h
@@ -59,6 +59,8 @@ extern void pm_runtime_clean_up_links(struct device *dev);
 extern void pm_runtime_get_suppliers(struct device *dev);
 extern void pm_runtime_put_suppliers(struct device *dev);
 extern void pm_runtime_new_link(struct device *dev);
+extern void pm_runtime_active_link(struct device_link *link,
+				   struct device *supplier);
 extern void pm_runtime_drop_link(struct device *dev);
 
 static inline void pm_suspend_ignore_children(struct device *dev, bool enable)
@@ -176,6 +178,8 @@ static inline void pm_runtime_clean_up_links(struct device *dev) {}
 static inline void pm_runtime_get_suppliers(struct device *dev) {}
 static inline void pm_runtime_put_suppliers(struct device *dev) {}
 static inline void pm_runtime_new_link(struct device *dev) {}
+static inline void pm_runtime_active_link(struct device_link *link,
+					  struct device *supplier) {}
 static inline void pm_runtime_drop_link(struct device *dev) {}
 
 #endif /* !CONFIG_PM */
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 196/639] PCI: endpoint: functions: Use memcpy_fromio()/memcpy_toio()
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (194 preceding siblings ...)
  2020-01-24  9:26 ` [PATCH 4.19 195/639] driver core: Fix possible supplier PM-usage counter imbalance Greg Kroah-Hartman
@ 2020-01-24  9:26 ` Greg Kroah-Hartman
  2020-01-24  9:26 ` [PATCH 4.19 197/639] usb: phy: twl6030-usb: fix possible use-after-free on remove Greg Kroah-Hartman
                   ` (446 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:26 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Kishon Vijay Abraham I, Wen Yang,
	Lorenzo Pieralisi, Bjorn Helgaas, Gustavo Pimentel,
	Niklas Cassel, Cyrille Pitchen, linux-pci, Sasha Levin

From: Wen Yang <wen.yang99@zte.com.cn>

[ Upstream commit 726dabfde6aa35a4f1508e235ae37edbbf9fbc65 ]

Functions copying from/to IO addresses should use the
memcpy_fromio()/memcpy_toio() API rather than plain memcpy().

Fix the issue detected through the sparse tool.

Fixes: 349e7a85b25f ("PCI: endpoint: functions: Add an EP function to test PCI")
Suggested-by: Kishon Vijay Abraham I <kishon@ti.com>
Signed-off-by: Wen Yang <wen.yang99@zte.com.cn>
[lorenzo.pieralisi@arm.com: updated log]
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Acked-by: Kishon Vijay Abraham I <kishon@ti.com>
CC: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
CC: Bjorn Helgaas <bhelgaas@google.com>
CC: Gustavo Pimentel <gustavo.pimentel@synopsys.com>
CC: Niklas Cassel <niklas.cassel@axis.com>
CC: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
CC: Cyrille Pitchen <cyrille.pitchen@free-electrons.com>
CC: linux-pci@vger.kernel.org
CC: linux-kernel@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/endpoint/functions/pci-epf-test.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/pci/endpoint/functions/pci-epf-test.c b/drivers/pci/endpoint/functions/pci-epf-test.c
index 3e86fa3c7da32..4bbd26e8a9e2f 100644
--- a/drivers/pci/endpoint/functions/pci-epf-test.c
+++ b/drivers/pci/endpoint/functions/pci-epf-test.c
@@ -175,7 +175,7 @@ static int pci_epf_test_read(struct pci_epf_test *epf_test)
 		goto err_map_addr;
 	}
 
-	memcpy(buf, src_addr, reg->size);
+	memcpy_fromio(buf, src_addr, reg->size);
 
 	crc32 = crc32_le(~0, buf, reg->size);
 	if (crc32 != reg->checksum)
@@ -230,7 +230,7 @@ static int pci_epf_test_write(struct pci_epf_test *epf_test)
 	get_random_bytes(buf, reg->size);
 	reg->checksum = crc32_le(~0, buf, reg->size);
 
-	memcpy(dst_addr, buf, reg->size);
+	memcpy_toio(dst_addr, buf, reg->size);
 
 	/*
 	 * wait 1ms inorder for the write to complete. Without this delay L3
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 197/639] usb: phy: twl6030-usb: fix possible use-after-free on remove
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (195 preceding siblings ...)
  2020-01-24  9:26 ` [PATCH 4.19 196/639] PCI: endpoint: functions: Use memcpy_fromio()/memcpy_toio() Greg Kroah-Hartman
@ 2020-01-24  9:26 ` Greg Kroah-Hartman
  2020-01-24  9:26 ` [PATCH 4.19 198/639] block: dont use bio->bi_vcnt to figure out segment number Greg Kroah-Hartman
                   ` (445 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:26 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Tony Lindgren, Bin Liu,
	Sven Van Asbroeck, Felipe Balbi, Sasha Levin

From: Sven Van Asbroeck <thesven73@gmail.com>

[ Upstream commit 5895d311d28f2605e2f71c1a3e043ed38f3ac9d2 ]

In remove(), use cancel_delayed_work_sync() to cancel the
delayed work. Otherwise there's a chance that this work
will continue to run until after the device has been removed.

This issue was detected with the help of Coccinelle.

Cc: Tony Lindgren <tony@atomide.com>
Cc: Bin Liu <b-liu@ti.com>
Fixes: b6a619a883c3 ("usb: phy: Check initial state for twl6030")
Signed-off-by: Sven Van Asbroeck <TheSven73@gmail.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/phy/phy-twl6030-usb.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/phy/phy-twl6030-usb.c b/drivers/usb/phy/phy-twl6030-usb.c
index 183550b63faad..dade34d704198 100644
--- a/drivers/usb/phy/phy-twl6030-usb.c
+++ b/drivers/usb/phy/phy-twl6030-usb.c
@@ -400,7 +400,7 @@ static int twl6030_usb_remove(struct platform_device *pdev)
 {
 	struct twl6030_usb *twl = platform_get_drvdata(pdev);
 
-	cancel_delayed_work(&twl->get_status_work);
+	cancel_delayed_work_sync(&twl->get_status_work);
 	twl6030_interrupt_mask(TWL6030_USBOTG_INT_MASK,
 		REG_INT_MSK_LINE_C);
 	twl6030_interrupt_mask(TWL6030_USBOTG_INT_MASK,
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 198/639] block: dont use bio->bi_vcnt to figure out segment number
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (196 preceding siblings ...)
  2020-01-24  9:26 ` [PATCH 4.19 197/639] usb: phy: twl6030-usb: fix possible use-after-free on remove Greg Kroah-Hartman
@ 2020-01-24  9:26 ` Greg Kroah-Hartman
  2020-01-24  9:26 ` [PATCH 4.19 199/639] keys: Timestamp new keys Greg Kroah-Hartman
                   ` (444 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:26 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Omar Sandoval, Christoph Hellwig,
	Ming Lei, Jens Axboe, Sasha Levin

From: Ming Lei <ming.lei@redhat.com>

[ Upstream commit 1a67356e9a4829da2935dd338630a550c59c8489 ]

It is wrong to use bio->bi_vcnt to figure out how many segments
there are in the bio even though CLONED flag isn't set on this bio,
because this bio may be splitted or advanced.

So always use bio_segments() in blk_recount_segments(), and it shouldn't
cause any performance loss now because the physical segment number is figured
out in blk_queue_split() and BIO_SEG_VALID is set meantime since
bdced438acd83ad83a6c ("block: setup bi_phys_segments after splitting").

Reviewed-by: Omar Sandoval <osandov@fb.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Fixes: 76d8137a3113 ("blk-merge: recaculate segment if it isn't less than max segments")
Signed-off-by: Ming Lei <ming.lei@redhat.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 block/blk-merge.c | 8 +-------
 1 file changed, 1 insertion(+), 7 deletions(-)

diff --git a/block/blk-merge.c b/block/blk-merge.c
index 2776ee6c5c3dc..7efa8c3e2b727 100644
--- a/block/blk-merge.c
+++ b/block/blk-merge.c
@@ -309,13 +309,7 @@ void blk_recalc_rq_segments(struct request *rq)
 
 void blk_recount_segments(struct request_queue *q, struct bio *bio)
 {
-	unsigned short seg_cnt;
-
-	/* estimate segment number by bi_vcnt for non-cloned bio */
-	if (bio_flagged(bio, BIO_CLONED))
-		seg_cnt = bio_segments(bio);
-	else
-		seg_cnt = bio->bi_vcnt;
+	unsigned short seg_cnt = bio_segments(bio);
 
 	if (test_bit(QUEUE_FLAG_NO_SG_MERGE, &q->queue_flags) &&
 			(seg_cnt < queue_max_segments(q)))
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 199/639] keys: Timestamp new keys
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (197 preceding siblings ...)
  2020-01-24  9:26 ` [PATCH 4.19 198/639] block: dont use bio->bi_vcnt to figure out segment number Greg Kroah-Hartman
@ 2020-01-24  9:26 ` Greg Kroah-Hartman
  2020-01-24  9:26 ` [PATCH 4.19 200/639] net: dsa: b53: Fix default VLAN ID Greg Kroah-Hartman
                   ` (443 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:26 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, David Howells, James Morris, Sasha Levin

From: David Howells <dhowells@redhat.com>

[ Upstream commit 7c1857bdbdf1e4c541e45eab477ee23ed4333ea4 ]

Set the timestamp on new keys rather than leaving it unset.

Fixes: 31d5a79d7f3d ("KEYS: Do LRU discard in full keyrings")
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: James Morris <james.morris@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 security/keys/key.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/security/keys/key.c b/security/keys/key.c
index 249a6da4d2770..749a5cf27a192 100644
--- a/security/keys/key.c
+++ b/security/keys/key.c
@@ -297,6 +297,7 @@ struct key *key_alloc(struct key_type *type, const char *desc,
 	key->gid = gid;
 	key->perm = perm;
 	key->restrict_link = restrict_link;
+	key->last_used_at = ktime_get_real_seconds();
 
 	if (!(flags & KEY_ALLOC_NOT_IN_QUOTA))
 		key->flags |= 1 << KEY_FLAG_IN_QUOTA;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 200/639] net: dsa: b53: Fix default VLAN ID
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (198 preceding siblings ...)
  2020-01-24  9:26 ` [PATCH 4.19 199/639] keys: Timestamp new keys Greg Kroah-Hartman
@ 2020-01-24  9:26 ` Greg Kroah-Hartman
  2020-01-24  9:26 ` [PATCH 4.19 201/639] net: dsa: b53: Properly account for VLAN filtering Greg Kroah-Hartman
                   ` (442 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:26 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Florian Fainelli, David S. Miller,
	Sasha Levin

From: Florian Fainelli <f.fainelli@gmail.com>

[ Upstream commit fea83353177a55540c71c140887737c282137aa2 ]

We were not consistent in how the default VID of a given port was
defined, b53_br_leave() would make sure the VLAN ID would be either 0/1
depending on the switch generation, but b53_configure_vlan(), which is
the default configuration would unconditionally set it to 1. The correct
value is 1 for 5325/5365 series and 0 otherwise. To avoid repeating that
mistake ever again, introduce a helper function: b53_default_pvid() to
factor that out.

Fixes: 967dd82ffc52 ("net: dsa: b53: Add support for Broadcom RoboSwitch")
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/dsa/b53/b53_common.c | 29 ++++++++++++++++-------------
 1 file changed, 16 insertions(+), 13 deletions(-)

diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c
index 2d3a2cb026d26..bceda1e884426 100644
--- a/drivers/net/dsa/b53/b53_common.c
+++ b/drivers/net/dsa/b53/b53_common.c
@@ -622,15 +622,25 @@ static void b53_enable_mib(struct b53_device *dev)
 	b53_write8(dev, B53_MGMT_PAGE, B53_GLOBAL_CONFIG, gc);
 }
 
+static u16 b53_default_pvid(struct b53_device *dev)
+{
+	if (is5325(dev) || is5365(dev))
+		return 1;
+	else
+		return 0;
+}
+
 int b53_configure_vlan(struct dsa_switch *ds)
 {
 	struct b53_device *dev = ds->priv;
 	struct b53_vlan vl = { 0 };
-	int i;
+	int i, def_vid;
+
+	def_vid = b53_default_pvid(dev);
 
 	/* clear all vlan entries */
 	if (is5325(dev) || is5365(dev)) {
-		for (i = 1; i < dev->num_vlans; i++)
+		for (i = def_vid; i < dev->num_vlans; i++)
 			b53_set_vlan_entry(dev, i, &vl);
 	} else {
 		b53_do_vlan_op(dev, VTA_CMD_CLEAR);
@@ -640,7 +650,7 @@ int b53_configure_vlan(struct dsa_switch *ds)
 
 	b53_for_each_port(dev, i)
 		b53_write16(dev, B53_VLAN_PAGE,
-			    B53_VLAN_PORT_DEF_TAG(i), 1);
+			    B53_VLAN_PORT_DEF_TAG(i), def_vid);
 
 	if (!is5325(dev) && !is5365(dev))
 		b53_set_jumbo(dev, dev->enable_jumbo, false);
@@ -1142,12 +1152,8 @@ int b53_vlan_del(struct dsa_switch *ds, int port,
 
 		vl->members &= ~BIT(port);
 
-		if (pvid == vid) {
-			if (is5325(dev) || is5365(dev))
-				pvid = 1;
-			else
-				pvid = 0;
-		}
+		if (pvid == vid)
+			pvid = b53_default_pvid(dev);
 
 		if (untagged && !dsa_is_cpu_port(ds, port))
 			vl->untag &= ~(BIT(port));
@@ -1460,10 +1466,7 @@ void b53_br_leave(struct dsa_switch *ds, int port, struct net_device *br)
 	b53_write16(dev, B53_PVLAN_PAGE, B53_PVLAN_PORT_MASK(port), pvlan);
 	dev->ports[port].vlan_ctl_mask = pvlan;
 
-	if (is5325(dev) || is5365(dev))
-		pvid = 1;
-	else
-		pvid = 0;
+	pvid = b53_default_pvid(dev);
 
 	/* Make this port join all VLANs without VLAN entries */
 	if (is58xx(dev)) {
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 201/639] net: dsa: b53: Properly account for VLAN filtering
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (199 preceding siblings ...)
  2020-01-24  9:26 ` [PATCH 4.19 200/639] net: dsa: b53: Fix default VLAN ID Greg Kroah-Hartman
@ 2020-01-24  9:26 ` Greg Kroah-Hartman
  2020-01-24  9:26 ` [PATCH 4.19 202/639] net: dsa: b53: Do not program CPU ports PVID Greg Kroah-Hartman
                   ` (441 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:26 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Florian Fainelli, David S. Miller,
	Sasha Levin

From: Florian Fainelli <f.fainelli@gmail.com>

[ Upstream commit dad8d7c6452b5b9f9828c9e2c7ca143205fd40c7 ]

VLAN filtering can be built into the kernel, and also dynamically turned
on/off through the bridge master device. Allow re-configuring the switch
appropriately to account for that by deciding whether VLAN table
(v_table) misses should lead to a drop or forward.

Fixes: a2482d2ce349 ("net: dsa: b53: Plug in VLAN support")
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/dsa/b53/b53_common.c | 59 +++++++++++++++++++++++++++++---
 drivers/net/dsa/b53/b53_priv.h   |  3 ++
 2 files changed, 57 insertions(+), 5 deletions(-)

diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c
index bceda1e884426..426ec1c05799a 100644
--- a/drivers/net/dsa/b53/b53_common.c
+++ b/drivers/net/dsa/b53/b53_common.c
@@ -343,7 +343,8 @@ static void b53_set_forwarding(struct b53_device *dev, int enable)
 	b53_write8(dev, B53_CTRL_PAGE, B53_SWITCH_CTRL, mgmt);
 }
 
-static void b53_enable_vlan(struct b53_device *dev, bool enable)
+static void b53_enable_vlan(struct b53_device *dev, bool enable,
+			    bool enable_filtering)
 {
 	u8 mgmt, vc0, vc1, vc4 = 0, vc5;
 
@@ -368,8 +369,13 @@ static void b53_enable_vlan(struct b53_device *dev, bool enable)
 		vc0 |= VC0_VLAN_EN | VC0_VID_CHK_EN | VC0_VID_HASH_VID;
 		vc1 |= VC1_RX_MCST_UNTAG_EN | VC1_RX_MCST_FWD_EN;
 		vc4 &= ~VC4_ING_VID_CHECK_MASK;
-		vc4 |= VC4_ING_VID_VIO_DROP << VC4_ING_VID_CHECK_S;
-		vc5 |= VC5_DROP_VTABLE_MISS;
+		if (enable_filtering) {
+			vc4 |= VC4_ING_VID_VIO_DROP << VC4_ING_VID_CHECK_S;
+			vc5 |= VC5_DROP_VTABLE_MISS;
+		} else {
+			vc4 |= VC4_ING_VID_VIO_FWD << VC4_ING_VID_CHECK_S;
+			vc5 &= ~VC5_DROP_VTABLE_MISS;
+		}
 
 		if (is5325(dev))
 			vc0 &= ~VC0_RESERVED_1;
@@ -419,6 +425,9 @@ static void b53_enable_vlan(struct b53_device *dev, bool enable)
 	}
 
 	b53_write8(dev, B53_CTRL_PAGE, B53_SWITCH_MODE, mgmt);
+
+	dev->vlan_enabled = enable;
+	dev->vlan_filtering_enabled = enable_filtering;
 }
 
 static int b53_set_jumbo(struct b53_device *dev, bool enable, bool allow_10_100)
@@ -646,7 +655,7 @@ int b53_configure_vlan(struct dsa_switch *ds)
 		b53_do_vlan_op(dev, VTA_CMD_CLEAR);
 	}
 
-	b53_enable_vlan(dev, false);
+	b53_enable_vlan(dev, false, dev->vlan_filtering_enabled);
 
 	b53_for_each_port(dev, i)
 		b53_write16(dev, B53_VLAN_PAGE,
@@ -1081,6 +1090,46 @@ static void b53_adjust_link(struct dsa_switch *ds, int port,
 
 int b53_vlan_filtering(struct dsa_switch *ds, int port, bool vlan_filtering)
 {
+	struct b53_device *dev = ds->priv;
+	struct net_device *bridge_dev;
+	unsigned int i;
+	u16 pvid, new_pvid;
+
+	/* Handle the case were multiple bridges span the same switch device
+	 * and one of them has a different setting than what is being requested
+	 * which would be breaking filtering semantics for any of the other
+	 * bridge devices.
+	 */
+	b53_for_each_port(dev, i) {
+		bridge_dev = dsa_to_port(ds, i)->bridge_dev;
+		if (bridge_dev &&
+		    bridge_dev != dsa_to_port(ds, port)->bridge_dev &&
+		    br_vlan_enabled(bridge_dev) != vlan_filtering) {
+			netdev_err(bridge_dev,
+				   "VLAN filtering is global to the switch!\n");
+			return -EINVAL;
+		}
+	}
+
+	b53_read16(dev, B53_VLAN_PAGE, B53_VLAN_PORT_DEF_TAG(port), &pvid);
+	new_pvid = pvid;
+	if (dev->vlan_filtering_enabled && !vlan_filtering) {
+		/* Filtering is currently enabled, use the default PVID since
+		 * the bridge does not expect tagging anymore
+		 */
+		dev->ports[port].pvid = pvid;
+		new_pvid = b53_default_pvid(dev);
+	} else if (!dev->vlan_filtering_enabled && vlan_filtering) {
+		/* Filtering is currently disabled, restore the previous PVID */
+		new_pvid = dev->ports[port].pvid;
+	}
+
+	if (pvid != new_pvid)
+		b53_write16(dev, B53_VLAN_PAGE, B53_VLAN_PORT_DEF_TAG(port),
+			    new_pvid);
+
+	b53_enable_vlan(dev, dev->vlan_enabled, vlan_filtering);
+
 	return 0;
 }
 EXPORT_SYMBOL(b53_vlan_filtering);
@@ -1096,7 +1145,7 @@ int b53_vlan_prepare(struct dsa_switch *ds, int port,
 	if (vlan->vid_end > dev->num_vlans)
 		return -ERANGE;
 
-	b53_enable_vlan(dev, true);
+	b53_enable_vlan(dev, true, dev->vlan_filtering_enabled);
 
 	return 0;
 }
diff --git a/drivers/net/dsa/b53/b53_priv.h b/drivers/net/dsa/b53/b53_priv.h
index df149756c2820..e87af5db0d6d8 100644
--- a/drivers/net/dsa/b53/b53_priv.h
+++ b/drivers/net/dsa/b53/b53_priv.h
@@ -73,6 +73,7 @@ enum {
 struct b53_port {
 	u16		vlan_ctl_mask;
 	struct ethtool_eee eee;
+	u16		pvid;
 };
 
 struct b53_vlan {
@@ -118,6 +119,8 @@ struct b53_device {
 
 	unsigned int num_vlans;
 	struct b53_vlan *vlans;
+	bool vlan_enabled;
+	bool vlan_filtering_enabled;
 	unsigned int num_ports;
 	struct b53_port *ports;
 };
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 202/639] net: dsa: b53: Do not program CPU ports PVID
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (200 preceding siblings ...)
  2020-01-24  9:26 ` [PATCH 4.19 201/639] net: dsa: b53: Properly account for VLAN filtering Greg Kroah-Hartman
@ 2020-01-24  9:26 ` Greg Kroah-Hartman
  2020-01-24  9:26 ` [PATCH 4.19 203/639] mt76: usb: fix possible memory leak in mt76u_buf_free Greg Kroah-Hartman
                   ` (440 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:26 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Florian Fainelli, David S. Miller,
	Sasha Levin

From: Florian Fainelli <f.fainelli@gmail.com>

[ Upstream commit 10163aaee9671b01b2f4737922e1a4f43581047a ]

The CPU port is special and does not need to obey VLAN restrictions as
far as untagged traffic goes, also, having the CPU port be part of a
particular PVID is against the idea of keeping it tagged in all VLANs.

Fixes: ca8931948344 ("net: dsa: b53: Keep CPU port as tagged in all VLANs")
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/dsa/b53/b53_common.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c
index 426ec1c05799a..9f21e710fc38b 100644
--- a/drivers/net/dsa/b53/b53_common.c
+++ b/drivers/net/dsa/b53/b53_common.c
@@ -1175,7 +1175,7 @@ void b53_vlan_add(struct dsa_switch *ds, int port,
 		b53_fast_age_vlan(dev, vid);
 	}
 
-	if (pvid) {
+	if (pvid && !dsa_is_cpu_port(ds, port)) {
 		b53_write16(dev, B53_VLAN_PAGE, B53_VLAN_PORT_DEF_TAG(port),
 			    vlan->vid_end);
 		b53_fast_age_vlan(dev, vid);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 203/639] mt76: usb: fix possible memory leak in mt76u_buf_free
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (201 preceding siblings ...)
  2020-01-24  9:26 ` [PATCH 4.19 202/639] net: dsa: b53: Do not program CPU ports PVID Greg Kroah-Hartman
@ 2020-01-24  9:26 ` Greg Kroah-Hartman
  2020-01-24  9:26 ` [PATCH 4.19 204/639] media: sh: migor: Include missing dma-mapping header Greg Kroah-Hartman
                   ` (439 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:26 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lorenzo Bianconi, Felix Fietkau, Sasha Levin

From: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>

[ Upstream commit cb83585e1121bd6d6c039cf09fa32380bf8b6258 ]

Move q->ndesc initialization before the for loop in mt76u_alloc_rx
since otherwise allocated urbs will not be freed in mt76u_buf_free
Double-check scatterlist pointer in mt76u_buf_free

Fixes: b40b15e1521f ("mt76: add usb support to mt76 layer")
Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/mediatek/mt76/usb.c | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/drivers/net/wireless/mediatek/mt76/usb.c b/drivers/net/wireless/mediatek/mt76/usb.c
index 8d40e92fb6f27..dcf927de65f39 100644
--- a/drivers/net/wireless/mediatek/mt76/usb.c
+++ b/drivers/net/wireless/mediatek/mt76/usb.c
@@ -273,10 +273,16 @@ EXPORT_SYMBOL_GPL(mt76u_buf_alloc);
 void mt76u_buf_free(struct mt76u_buf *buf)
 {
 	struct urb *urb = buf->urb;
+	struct scatterlist *sg;
 	int i;
 
-	for (i = 0; i < urb->num_sgs; i++)
-		skb_free_frag(sg_virt(&urb->sg[i]));
+	for (i = 0; i < urb->num_sgs; i++) {
+		sg = &urb->sg[i];
+		if (!sg)
+			continue;
+
+		skb_free_frag(sg_virt(sg));
+	}
 	usb_free_urb(buf->urb);
 }
 EXPORT_SYMBOL_GPL(mt76u_buf_free);
@@ -478,7 +484,8 @@ static int mt76u_alloc_rx(struct mt76_dev *dev)
 		nsgs = 1;
 	}
 
-	for (i = 0; i < MT_NUM_RX_ENTRIES; i++) {
+	q->ndesc = MT_NUM_RX_ENTRIES;
+	for (i = 0; i < q->ndesc; i++) {
 		err = mt76u_buf_alloc(dev, &q->entry[i].ubuf,
 				      nsgs, q->buf_size,
 				      SKB_WITH_OVERHEAD(q->buf_size),
@@ -486,7 +493,6 @@ static int mt76u_alloc_rx(struct mt76_dev *dev)
 		if (err < 0)
 			return err;
 	}
-	q->ndesc = MT_NUM_RX_ENTRIES;
 
 	return mt76u_submit_rx_buffers(dev);
 }
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 204/639] media: sh: migor: Include missing dma-mapping header
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (202 preceding siblings ...)
  2020-01-24  9:26 ` [PATCH 4.19 203/639] mt76: usb: fix possible memory leak in mt76u_buf_free Greg Kroah-Hartman
@ 2020-01-24  9:26 ` Greg Kroah-Hartman
  2020-01-24  9:26 ` [PATCH 4.19 205/639] vfio_pci: Enable memory accesses before calling pci_map_rom Greg Kroah-Hartman
                   ` (438 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:26 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jacopo Mondi, Hans Verkuil,
	Mauro Carvalho Chehab, Sasha Levin

From: Jacopo Mondi <jacopo+renesas@jmondi.org>

[ Upstream commit 5c88ee02932a964096cbbcc7c9f38b78d230bacb ]

Since the removal of the stale soc_camera headers, Migo-R board fails to
build due to missing dma-mapping include directive.

Include missing dma-mapping.h header in Migo-R board file to fix the build
error.

Fixes: a50c7738e8ae ("media: sh: migor: Remove stale soc_camera include")

Signed-off-by: Jacopo Mondi <jacopo+renesas@jmondi.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/sh/boards/mach-migor/setup.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/sh/boards/mach-migor/setup.c b/arch/sh/boards/mach-migor/setup.c
index 254f2c6627036..6cd3cd468047c 100644
--- a/arch/sh/boards/mach-migor/setup.c
+++ b/arch/sh/boards/mach-migor/setup.c
@@ -5,6 +5,7 @@
  * Copyright (C) 2008 Magnus Damm
  */
 #include <linux/clkdev.h>
+#include <linux/dma-mapping.h>
 #include <linux/init.h>
 #include <linux/platform_device.h>
 #include <linux/interrupt.h>
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 205/639] vfio_pci: Enable memory accesses before calling pci_map_rom
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (203 preceding siblings ...)
  2020-01-24  9:26 ` [PATCH 4.19 204/639] media: sh: migor: Include missing dma-mapping header Greg Kroah-Hartman
@ 2020-01-24  9:26 ` Greg Kroah-Hartman
  2020-01-24  9:26 ` [PATCH 4.19 206/639] hwmon: (pmbus/tps53679) Fix driver info initialization in probe routine Greg Kroah-Hartman
                   ` (437 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:26 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Eric Auger, Alex Williamson, Sasha Levin

From: Eric Auger <eric.auger@redhat.com>

[ Upstream commit 0cfd027be1d6def4a462cdc180c055143af24069 ]

pci_map_rom/pci_get_rom_size() performs memory access in the ROM.
In case the Memory Space accesses were disabled, readw() is likely
to trigger a synchronous external abort on some platforms.

In case memory accesses were disabled, re-enable them before the
call and disable them back again just after.

Fixes: 89e1f7d4c66d ("vfio: Add PCI device driver")
Signed-off-by: Eric Auger <eric.auger@redhat.com>
Suggested-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/vfio/pci/vfio_pci.c | 19 ++++++++++++++-----
 1 file changed, 14 insertions(+), 5 deletions(-)

diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
index 0a6eb53e79fbf..66783a37f450c 100644
--- a/drivers/vfio/pci/vfio_pci.c
+++ b/drivers/vfio/pci/vfio_pci.c
@@ -696,6 +696,7 @@ static long vfio_pci_ioctl(void *device_data,
 		{
 			void __iomem *io;
 			size_t size;
+			u16 orig_cmd;
 
 			info.offset = VFIO_PCI_INDEX_TO_OFFSET(info.index);
 			info.flags = 0;
@@ -711,15 +712,23 @@ static long vfio_pci_ioctl(void *device_data,
 					break;
 			}
 
-			/* Is it really there? */
+			/*
+			 * Is it really there?  Enable memory decode for
+			 * implicit access in pci_map_rom().
+			 */
+			pci_read_config_word(pdev, PCI_COMMAND, &orig_cmd);
+			pci_write_config_word(pdev, PCI_COMMAND,
+					      orig_cmd | PCI_COMMAND_MEMORY);
+
 			io = pci_map_rom(pdev, &size);
-			if (!io || !size) {
+			if (io) {
+				info.flags = VFIO_REGION_INFO_FLAG_READ;
+				pci_unmap_rom(pdev, io);
+			} else {
 				info.size = 0;
-				break;
 			}
-			pci_unmap_rom(pdev, io);
 
-			info.flags = VFIO_REGION_INFO_FLAG_READ;
+			pci_write_config_word(pdev, PCI_COMMAND, orig_cmd);
 			break;
 		}
 		case VFIO_PCI_VGA_REGION_INDEX:
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 206/639] hwmon: (pmbus/tps53679) Fix driver info initialization in probe routine
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (204 preceding siblings ...)
  2020-01-24  9:26 ` [PATCH 4.19 205/639] vfio_pci: Enable memory accesses before calling pci_map_rom Greg Kroah-Hartman
@ 2020-01-24  9:26 ` Greg Kroah-Hartman
  2020-01-24  9:26 ` [PATCH 4.19 207/639] mdio_bus: Fix PTR_ERR() usage after initialization to constant Greg Kroah-Hartman
                   ` (436 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:26 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Vadim Pasternak, Guenter Roeck, Sasha Levin

From: Vadim Pasternak <vadimp@mellanox.com>

[ Upstream commit ff066653aeed8ee2d4dadb1e35774dd91ecbb19f ]

Fix tps53679_probe() by using dynamically allocated "pmbus_driver_info"
structure instead of static. Usage of static structures causes
overwritten of the field "vrm_version", in case the system is equipped
with several tps53679 devices with the different "vrm_version".
In such case the last probed device overwrites this field for all
others.

Fixes: 610526527a13 ("hwmon: (pmbus) Add support for Texas Instruments tps53679 device")
Signed-off-by: Vadim Pasternak <vadimp@mellanox.com>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hwmon/pmbus/tps53679.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/hwmon/pmbus/tps53679.c b/drivers/hwmon/pmbus/tps53679.c
index 85b515cd9df0e..2bc352c5357f4 100644
--- a/drivers/hwmon/pmbus/tps53679.c
+++ b/drivers/hwmon/pmbus/tps53679.c
@@ -80,7 +80,14 @@ static struct pmbus_driver_info tps53679_info = {
 static int tps53679_probe(struct i2c_client *client,
 			  const struct i2c_device_id *id)
 {
-	return pmbus_do_probe(client, id, &tps53679_info);
+	struct pmbus_driver_info *info;
+
+	info = devm_kmemdup(&client->dev, &tps53679_info, sizeof(*info),
+			    GFP_KERNEL);
+	if (!info)
+		return -ENOMEM;
+
+	return pmbus_do_probe(client, id, info);
 }
 
 static const struct i2c_device_id tps53679_id[] = {
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 207/639] mdio_bus: Fix PTR_ERR() usage after initialization to constant
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (205 preceding siblings ...)
  2020-01-24  9:26 ` [PATCH 4.19 206/639] hwmon: (pmbus/tps53679) Fix driver info initialization in probe routine Greg Kroah-Hartman
@ 2020-01-24  9:26 ` Greg Kroah-Hartman
  2020-01-24  9:26 ` [PATCH 4.19 208/639] KVM: PPC: Release all hardware TCE tables attached to a group Greg Kroah-Hartman
                   ` (435 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:26 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, YueHaibing, David S. Miller, Sasha Levin

From: YueHaibing <yuehaibing@huawei.com>

[ Upstream commit 780feae7eb69388c8d8b661cda6706b0dc0f642b ]

Fix coccinelle warning:

./drivers/net/phy/mdio_bus.c:51:5-12: ERROR: PTR_ERR applied after initialization to constant on line 44
./drivers/net/phy/mdio_bus.c:52:5-12: ERROR: PTR_ERR applied after initialization to constant on line 44

fix this by using IS_ERR before PTR_ERR

Fixes: bafbdd527d56 ("phylib: Add device reset GPIO support")
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/phy/mdio_bus.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c
index c5588d4508f97..5c89a310359de 100644
--- a/drivers/net/phy/mdio_bus.c
+++ b/drivers/net/phy/mdio_bus.c
@@ -56,11 +56,12 @@ static int mdiobus_register_gpiod(struct mdio_device *mdiodev)
 		gpiod = fwnode_get_named_gpiod(&mdiodev->dev.of_node->fwnode,
 					       "reset-gpios", 0, GPIOD_OUT_LOW,
 					       "PHY reset");
-	if (PTR_ERR(gpiod) == -ENOENT ||
-	    PTR_ERR(gpiod) == -ENOSYS)
-		gpiod = NULL;
-	else if (IS_ERR(gpiod))
-		return PTR_ERR(gpiod);
+	if (IS_ERR(gpiod)) {
+		if (PTR_ERR(gpiod) == -ENOENT || PTR_ERR(gpiod) == -ENOSYS)
+			gpiod = NULL;
+		else
+			return PTR_ERR(gpiod);
+	}
 
 	mdiodev->reset = gpiod;
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 208/639] KVM: PPC: Release all hardware TCE tables attached to a group
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (206 preceding siblings ...)
  2020-01-24  9:26 ` [PATCH 4.19 207/639] mdio_bus: Fix PTR_ERR() usage after initialization to constant Greg Kroah-Hartman
@ 2020-01-24  9:26 ` Greg Kroah-Hartman
  2020-01-24  9:26 ` [PATCH 4.19 209/639] staging: r8822be: check kzalloc return or bail Greg Kroah-Hartman
                   ` (434 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:26 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Alexey Kardashevskiy, Paul Mackerras,
	Sasha Levin

From: Alexey Kardashevskiy <aik@ozlabs.ru>

[ Upstream commit a67614cc05a5052b265ea48196dab2fce11f5f2e ]

The SPAPR TCE KVM device references all hardware IOMMU tables assigned to
some IOMMU group to ensure that in-kernel KVM acceleration of H_PUT_TCE
can work. The tables are references when an IOMMU group gets registered
with the VFIO KVM device by the KVM_DEV_VFIO_GROUP_ADD ioctl;
KVM_DEV_VFIO_GROUP_DEL calls into the dereferencing code
in kvm_spapr_tce_release_iommu_group() which walks through the list of
LIOBNs, finds a matching IOMMU table and calls kref_put() when found.

However that code stops after the very first successful derefencing
leaving other tables referenced till the SPAPR TCE KVM device is destroyed
which normally happens on guest reboot or termination so if we do hotplug
and unplug in a loop, we are leaking IOMMU tables here.

This removes a premature return to let kvm_spapr_tce_release_iommu_group()
find and dereference all attached tables.

Fixes: 121f80ba68f ("KVM: PPC: VFIO: Add in-kernel acceleration for VFIO")
Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
Signed-off-by: Paul Mackerras <paulus@ozlabs.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/kvm/book3s_64_vio.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/arch/powerpc/kvm/book3s_64_vio.c b/arch/powerpc/kvm/book3s_64_vio.c
index 65486c3d029b5..26b03af71abd2 100644
--- a/arch/powerpc/kvm/book3s_64_vio.c
+++ b/arch/powerpc/kvm/book3s_64_vio.c
@@ -133,7 +133,6 @@ extern void kvm_spapr_tce_release_iommu_group(struct kvm *kvm,
 					continue;
 
 				kref_put(&stit->kref, kvm_spapr_tce_liobn_put);
-				return;
 			}
 		}
 	}
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 209/639] staging: r8822be: check kzalloc return or bail
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (207 preceding siblings ...)
  2020-01-24  9:26 ` [PATCH 4.19 208/639] KVM: PPC: Release all hardware TCE tables attached to a group Greg Kroah-Hartman
@ 2020-01-24  9:26 ` Greg Kroah-Hartman
  2020-01-24  9:26 ` [PATCH 4.19 210/639] dmaengine: mv_xor: Use correct device for DMA API Greg Kroah-Hartman
                   ` (433 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:26 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Nicholas Mc Guire, Sasha Levin

From: Nicholas Mc Guire <hofrat@osadl.org>

[ Upstream commit e4b08e16b7d9d030b6475ef48f94d734a39f3c81 ]

The kzalloc() in halmac_parse_psd_data_88xx() can fail and return NULL
so check the psd_set->data after allocation and if allocation failed
return HALMAC_CMD_PROCESS_ERROR.

Signed-off-by: Nicholas Mc Guire <hofrat@osadl.org>
Fixes: 938a0447f094 ("staging: r8822be: Add code for halmac sub-drive")
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../staging/rtlwifi/halmac/halmac_88xx/halmac_func_88xx.c    | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_func_88xx.c b/drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_func_88xx.c
index 53f55f129a760..ec742da030dba 100644
--- a/drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_func_88xx.c
+++ b/drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_func_88xx.c
@@ -2466,8 +2466,11 @@ halmac_parse_psd_data_88xx(struct halmac_adapter *halmac_adapter, u8 *c2h_buf,
 	segment_size = (u8)PSD_DATA_GET_SEGMENT_SIZE(c2h_buf);
 	psd_set->data_size = total_size;
 
-	if (!psd_set->data)
+	if (!psd_set->data) {
 		psd_set->data = kzalloc(psd_set->data_size, GFP_KERNEL);
+		if (!psd_set->data)
+			return HALMAC_CMD_PROCESS_ERROR;
+	}
 
 	if (segment_id == 0)
 		psd_set->segment_size = segment_size;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 210/639] dmaengine: mv_xor: Use correct device for DMA API
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (208 preceding siblings ...)
  2020-01-24  9:26 ` [PATCH 4.19 209/639] staging: r8822be: check kzalloc return or bail Greg Kroah-Hartman
@ 2020-01-24  9:26 ` Greg Kroah-Hartman
  2020-01-24  9:26 ` [PATCH 4.19 211/639] cdc-wdm: pass return value of recover_from_urb_loss Greg Kroah-Hartman
                   ` (432 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:26 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, John David Anglin, Robin Murphy,
	Thomas Petazzoni, Vinod Koul, Sasha Levin

From: Robin Murphy <robin.murphy@arm.com>

[ Upstream commit 3e5daee5ecf314da33a890fabaa2404244cd2a36 ]

Using dma_dev->dev for mappings before it's assigned with the correct
device is unlikely to work as expected, and with future dma-direct
changes, passing a NULL device may end up crashing entirely. I don't
know enough about this hardware or the mv_xor_prep_dma_interrupt()
operation to implement the appropriate error-handling logic that would
have revealed those dma_map_single() calls failing on arm64 for as long
as the driver has been enabled there, but moving the assignment earlier
will at least make the current code operate as intended.

Fixes: 22843545b200 ("dma: mv_xor: Add support for DMA_INTERRUPT")
Reported-by: John David Anglin <dave.anglin@bell.net>
Tested-by: John David Anglin <dave.anglin@bell.net>
Signed-off-by: Robin Murphy <robin.murphy@arm.com>
Acked-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Tested-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/dma/mv_xor.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/dma/mv_xor.c b/drivers/dma/mv_xor.c
index 969534c1a6c63..abc8d3e0487b8 100644
--- a/drivers/dma/mv_xor.c
+++ b/drivers/dma/mv_xor.c
@@ -1059,6 +1059,7 @@ mv_xor_channel_add(struct mv_xor_device *xordev,
 		mv_chan->op_in_desc = XOR_MODE_IN_DESC;
 
 	dma_dev = &mv_chan->dmadev;
+	dma_dev->dev = &pdev->dev;
 	mv_chan->xordev = xordev;
 
 	/*
@@ -1091,7 +1092,6 @@ mv_xor_channel_add(struct mv_xor_device *xordev,
 	dma_dev->device_free_chan_resources = mv_xor_free_chan_resources;
 	dma_dev->device_tx_status = mv_xor_status;
 	dma_dev->device_issue_pending = mv_xor_issue_pending;
-	dma_dev->dev = &pdev->dev;
 
 	/* set prep routines based on capability */
 	if (dma_has_cap(DMA_INTERRUPT, dma_dev->cap_mask))
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 211/639] cdc-wdm: pass return value of recover_from_urb_loss
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (209 preceding siblings ...)
  2020-01-24  9:26 ` [PATCH 4.19 210/639] dmaengine: mv_xor: Use correct device for DMA API Greg Kroah-Hartman
@ 2020-01-24  9:26 ` Greg Kroah-Hartman
  2020-01-24  9:26 ` [PATCH 4.19 212/639] brcmfmac: create debugfs files for bus-specific layer Greg Kroah-Hartman
                   ` (431 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:26 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, YueHaibing, Sasha Levin

From: YueHaibing <yuehaibing@huawei.com>

[ Upstream commit 0742a338f5b3446a26de551ad8273fb41b2787f2 ]

'rv' is the correct return value, pass it upstream instead of 0

Fixes: 17d80d562fd7 ("USB: autosuspend for cdc-wdm")
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/class/cdc-wdm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
index b8a1fdefb5150..4929c58830688 100644
--- a/drivers/usb/class/cdc-wdm.c
+++ b/drivers/usb/class/cdc-wdm.c
@@ -1107,7 +1107,7 @@ static int wdm_post_reset(struct usb_interface *intf)
 	rv = recover_from_urb_loss(desc);
 	mutex_unlock(&desc->wlock);
 	mutex_unlock(&desc->rlock);
-	return 0;
+	return rv;
 }
 
 static struct usb_driver wdm_driver = {
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 212/639] brcmfmac: create debugfs files for bus-specific layer
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (210 preceding siblings ...)
  2020-01-24  9:26 ` [PATCH 4.19 211/639] cdc-wdm: pass return value of recover_from_urb_loss Greg Kroah-Hartman
@ 2020-01-24  9:26 ` Greg Kroah-Hartman
  2020-01-24  9:26 ` [PATCH 4.19 213/639] regulator: pv88060: Fix array out-of-bounds access Greg Kroah-Hartman
                   ` (430 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:26 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Russel King, Franky Lin,
	Arend van Spriel, Kalle Valo, Sasha Levin

From: Arend van Spriel <arend.vanspriel@broadcom.com>

[ Upstream commit aaf6a5e86e36766abbeedf220462bde8031f9a72 ]

Since we moved the drivers debugfs directory under ieee80211 debugfs the
debugfs entries need to be added after wiphy_register() has been called.
For most part that has been done accordingly, but for the debugfs entries
added by SDIO it was not and failed silently. This patch fixes that by
adding a bus-layer callback for it.

Fixes: 856d5a011c86 ("brcmfmac: allocate struct brcmf_pub instance using wiphy_new()")
Reported-by: Russel King <linux@armlinux.org.uk>
Reviewed-by: Franky Lin <franky.lin@broadcom.com>
Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../net/wireless/broadcom/brcm80211/brcmfmac/bus.h   | 10 ++++++++++
 .../net/wireless/broadcom/brcm80211/brcmfmac/core.c  |  1 +
 .../net/wireless/broadcom/brcm80211/brcmfmac/sdio.c  | 12 +++++++-----
 3 files changed, 18 insertions(+), 5 deletions(-)

diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
index c4965184cdf37..3d441c5c745cc 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
@@ -90,6 +90,7 @@ struct brcmf_bus_ops {
 	int (*get_memdump)(struct device *dev, void *data, size_t len);
 	int (*get_fwname)(struct device *dev, const char *ext,
 			  unsigned char *fw_name);
+	void (*debugfs_create)(struct device *dev);
 };
 
 
@@ -235,6 +236,15 @@ int brcmf_bus_get_fwname(struct brcmf_bus *bus, const char *ext,
 	return bus->ops->get_fwname(bus->dev, ext, fw_name);
 }
 
+static inline
+void brcmf_bus_debugfs_create(struct brcmf_bus *bus)
+{
+	if (!bus->ops->debugfs_create)
+		return;
+
+	return bus->ops->debugfs_create(bus->dev);
+}
+
 /*
  * interface functions from common layer
  */
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
index 584e05fdca6ad..9d7b8834b8545 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
@@ -1105,6 +1105,7 @@ static int brcmf_bus_started(struct brcmf_pub *drvr, struct cfg80211_ops *ops)
 	brcmf_debugfs_add_entry(drvr, "revinfo", brcmf_revinfo_read);
 	brcmf_feat_debugfs_create(drvr);
 	brcmf_proto_debugfs_create(drvr);
+	brcmf_bus_debugfs_create(bus_if);
 
 	return 0;
 
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
index abaed2fa2defd..5c3b62e619807 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
@@ -3131,9 +3131,12 @@ static int brcmf_debugfs_sdio_count_read(struct seq_file *seq, void *data)
 	return 0;
 }
 
-static void brcmf_sdio_debugfs_create(struct brcmf_sdio *bus)
+static void brcmf_sdio_debugfs_create(struct device *dev)
 {
-	struct brcmf_pub *drvr = bus->sdiodev->bus_if->drvr;
+	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
+	struct brcmf_pub *drvr = bus_if->drvr;
+	struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
+	struct brcmf_sdio *bus = sdiodev->bus;
 	struct dentry *dentry = brcmf_debugfs_get_devdir(drvr);
 
 	if (IS_ERR_OR_NULL(dentry))
@@ -3153,7 +3156,7 @@ static int brcmf_sdio_checkdied(struct brcmf_sdio *bus)
 	return 0;
 }
 
-static void brcmf_sdio_debugfs_create(struct brcmf_sdio *bus)
+static void brcmf_sdio_debugfs_create(struct device *dev)
 {
 }
 #endif /* DEBUG */
@@ -3438,8 +3441,6 @@ static int brcmf_sdio_bus_preinit(struct device *dev)
 	if (bus->rxbuf)
 		bus->rxblen = value;
 
-	brcmf_sdio_debugfs_create(bus);
-
 	/* the commands below use the terms tx and rx from
 	 * a device perspective, ie. bus:txglom affects the
 	 * bus transfers from device to host.
@@ -4050,6 +4051,7 @@ static const struct brcmf_bus_ops brcmf_sdio_bus_ops = {
 	.get_ramsize = brcmf_sdio_bus_get_ramsize,
 	.get_memdump = brcmf_sdio_bus_get_memdump,
 	.get_fwname = brcmf_sdio_get_fwname,
+	.debugfs_create = brcmf_sdio_debugfs_create
 };
 
 #define BRCMF_SDIO_FW_CODE	0
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 213/639] regulator: pv88060: Fix array out-of-bounds access
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (211 preceding siblings ...)
  2020-01-24  9:26 ` [PATCH 4.19 212/639] brcmfmac: create debugfs files for bus-specific layer Greg Kroah-Hartman
@ 2020-01-24  9:26 ` Greg Kroah-Hartman
  2020-01-24  9:26 ` [PATCH 4.19 214/639] regulator: pv88080: " Greg Kroah-Hartman
                   ` (429 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:26 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Axel Lin, Mark Brown, Sasha Levin

From: Axel Lin <axel.lin@ingics.com>

[ Upstream commit 7cd415f875591bc66c5ecb49bf84ef97e80d7b0e ]

Fix off-by-one while iterating current_limits array.
The valid index should be 0 ~ n_current_limits -1.

Fixes: f307a7e9b7af ("regulator: pv88060: new regulator driver")
Signed-off-by: Axel Lin <axel.lin@ingics.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/regulator/pv88060-regulator.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/regulator/pv88060-regulator.c b/drivers/regulator/pv88060-regulator.c
index a9446056435f9..1f2d8180506bc 100644
--- a/drivers/regulator/pv88060-regulator.c
+++ b/drivers/regulator/pv88060-regulator.c
@@ -135,7 +135,7 @@ static int pv88060_set_current_limit(struct regulator_dev *rdev, int min,
 	int i;
 
 	/* search for closest to maximum */
-	for (i = info->n_current_limits; i >= 0; i--) {
+	for (i = info->n_current_limits - 1; i >= 0; i--) {
 		if (min <= info->current_limits[i]
 			&& max >= info->current_limits[i]) {
 			return regmap_update_bits(rdev->regmap,
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 214/639] regulator: pv88080: Fix array out-of-bounds access
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (212 preceding siblings ...)
  2020-01-24  9:26 ` [PATCH 4.19 213/639] regulator: pv88060: Fix array out-of-bounds access Greg Kroah-Hartman
@ 2020-01-24  9:26 ` Greg Kroah-Hartman
  2020-01-24  9:26 ` [PATCH 4.19 215/639] regulator: pv88090: " Greg Kroah-Hartman
                   ` (428 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:26 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Axel Lin, Mark Brown, Sasha Levin

From: Axel Lin <axel.lin@ingics.com>

[ Upstream commit 3c413f594c4f9df40061445667ca11a12bc8ee34 ]

Fix off-by-one while iterating current_limits array.
The valid index should be 0 ~ n_current_limits -1.

Fixes: 99cf3af5e2d5 ("regulator: pv88080: new regulator driver")
Signed-off-by: Axel Lin <axel.lin@ingics.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/regulator/pv88080-regulator.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/regulator/pv88080-regulator.c b/drivers/regulator/pv88080-regulator.c
index 9a08cb2de501e..6770e4de20978 100644
--- a/drivers/regulator/pv88080-regulator.c
+++ b/drivers/regulator/pv88080-regulator.c
@@ -279,7 +279,7 @@ static int pv88080_set_current_limit(struct regulator_dev *rdev, int min,
 	int i;
 
 	/* search for closest to maximum */
-	for (i = info->n_current_limits; i >= 0; i--) {
+	for (i = info->n_current_limits - 1; i >= 0; i--) {
 		if (min <= info->current_limits[i]
 			&& max >= info->current_limits[i]) {
 				return regmap_update_bits(rdev->regmap,
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 215/639] regulator: pv88090: Fix array out-of-bounds access
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (213 preceding siblings ...)
  2020-01-24  9:26 ` [PATCH 4.19 214/639] regulator: pv88080: " Greg Kroah-Hartman
@ 2020-01-24  9:26 ` Greg Kroah-Hartman
  2020-01-24  9:26 ` [PATCH 4.19 216/639] net: dsa: qca8k: Enable delay for RGMII_ID mode Greg Kroah-Hartman
                   ` (427 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:26 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Axel Lin, Mark Brown, Sasha Levin

From: Axel Lin <axel.lin@ingics.com>

[ Upstream commit a5455c9159414748bed4678184bf69989a4f7ba3 ]

Fix off-by-one while iterating current_limits array.
The valid index should be 0 ~ n_current_limits -1.

Fixes: c90456e36d9c ("regulator: pv88090: new regulator driver")
Signed-off-by: Axel Lin <axel.lin@ingics.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/regulator/pv88090-regulator.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/regulator/pv88090-regulator.c b/drivers/regulator/pv88090-regulator.c
index 7a0c15957bd0b..2302b0df7630f 100644
--- a/drivers/regulator/pv88090-regulator.c
+++ b/drivers/regulator/pv88090-regulator.c
@@ -157,7 +157,7 @@ static int pv88090_set_current_limit(struct regulator_dev *rdev, int min,
 	int i;
 
 	/* search for closest to maximum */
-	for (i = info->n_current_limits; i >= 0; i--) {
+	for (i = info->n_current_limits - 1; i >= 0; i--) {
 		if (min <= info->current_limits[i]
 			&& max >= info->current_limits[i]) {
 			return regmap_update_bits(rdev->regmap,
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 216/639] net: dsa: qca8k: Enable delay for RGMII_ID mode
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (214 preceding siblings ...)
  2020-01-24  9:26 ` [PATCH 4.19 215/639] regulator: pv88090: " Greg Kroah-Hartman
@ 2020-01-24  9:26 ` Greg Kroah-Hartman
  2020-01-24  9:26 ` [PATCH 4.19 217/639] net/mlx5: Delete unused FPGA QPN variable Greg Kroah-Hartman
                   ` (426 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:26 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Michal Vokáč,
	Vinod Koul, Andrew Lunn, David S. Miller, Sasha Levin

From: Vinod Koul <vkoul@kernel.org>

[ Upstream commit a968b5e9d5879f9535d6099505f9e14abcafb623 ]

RGMII_ID specifies that we should have internal delay, so resurrect the
delay addition routine but under the RGMII_ID mode.

Fixes: 40269aa9f40a ("net: dsa: qca8k: disable delay for RGMII mode")
Tested-by: Michal Vokáč <michal.vokac@ysoft.com>
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/dsa/qca8k.c | 12 ++++++++++++
 drivers/net/dsa/qca8k.h |  1 +
 2 files changed, 13 insertions(+)

diff --git a/drivers/net/dsa/qca8k.c b/drivers/net/dsa/qca8k.c
index 33232cc9fb04d..6c04f32e96418 100644
--- a/drivers/net/dsa/qca8k.c
+++ b/drivers/net/dsa/qca8k.c
@@ -451,6 +451,18 @@ qca8k_set_pad_ctrl(struct qca8k_priv *priv, int port, int mode)
 		qca8k_write(priv, QCA8K_REG_PORT5_PAD_CTRL,
 			    QCA8K_PORT_PAD_RGMII_RX_DELAY_EN);
 		break;
+	case PHY_INTERFACE_MODE_RGMII_ID:
+		/* RGMII_ID needs internal delay. This is enabled through
+		 * PORT5_PAD_CTRL for all ports, rather than individual port
+		 * registers
+		 */
+		qca8k_write(priv, reg,
+			    QCA8K_PORT_PAD_RGMII_EN |
+			    QCA8K_PORT_PAD_RGMII_TX_DELAY(QCA8K_MAX_DELAY) |
+			    QCA8K_PORT_PAD_RGMII_RX_DELAY(QCA8K_MAX_DELAY));
+		qca8k_write(priv, QCA8K_REG_PORT5_PAD_CTRL,
+			    QCA8K_PORT_PAD_RGMII_RX_DELAY_EN);
+		break;
 	case PHY_INTERFACE_MODE_SGMII:
 		qca8k_write(priv, reg, QCA8K_PORT_PAD_SGMII_EN);
 		break;
diff --git a/drivers/net/dsa/qca8k.h b/drivers/net/dsa/qca8k.h
index 613fe5c50236c..d146e54c8a6c6 100644
--- a/drivers/net/dsa/qca8k.h
+++ b/drivers/net/dsa/qca8k.h
@@ -40,6 +40,7 @@
 						((0x8 + (x & 0x3)) << 22)
 #define   QCA8K_PORT_PAD_RGMII_RX_DELAY(x)		\
 						((0x10 + (x & 0x3)) << 20)
+#define   QCA8K_MAX_DELAY				3
 #define   QCA8K_PORT_PAD_RGMII_RX_DELAY_EN		BIT(24)
 #define   QCA8K_PORT_PAD_SGMII_EN			BIT(7)
 #define QCA8K_REG_MODULE_EN				0x030
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 217/639] net/mlx5: Delete unused FPGA QPN variable
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (215 preceding siblings ...)
  2020-01-24  9:26 ` [PATCH 4.19 216/639] net: dsa: qca8k: Enable delay for RGMII_ID mode Greg Kroah-Hartman
@ 2020-01-24  9:26 ` Greg Kroah-Hartman
  2020-01-24  9:26 ` [PATCH 4.19 218/639] drm/nouveau/bios/ramcfg: fix missing parentheses when calculating RON Greg Kroah-Hartman
                   ` (425 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:26 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Leon Romanovsky, Saeed Mahameed, Sasha Levin

From: Leon Romanovsky <leonro@mellanox.com>

[ Upstream commit 566428375a53619196e31803130dd1a7010c4d7f ]

fpga_qpn was assigned but never used and compilation with W=1
produced the following warning:

drivers/net/ethernet/mellanox/mlx5/core/fpga/core.c: In function _mlx5_fpga_event_:
drivers/net/ethernet/mellanox/mlx5/core/fpga/core.c:320:6: warning:
variable _fpga_qpn_ set but not used [-Wunused-but-set-variable]
  u32 fpga_qpn;
      ^~~~~~~~

Fixes: 98db16bab59f ("net/mlx5: FPGA, Handle QP error event")
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/mellanox/mlx5/core/fpga/core.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fpga/core.c b/drivers/net/ethernet/mellanox/mlx5/core/fpga/core.c
index 436a8136f26ff..310f9e7d83200 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fpga/core.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fpga/core.c
@@ -289,7 +289,6 @@ void mlx5_fpga_event(struct mlx5_core_dev *mdev, u8 event, void *data)
 	const char *event_name;
 	bool teardown = false;
 	unsigned long flags;
-	u32 fpga_qpn;
 	u8 syndrome;
 
 	switch (event) {
@@ -300,7 +299,6 @@ void mlx5_fpga_event(struct mlx5_core_dev *mdev, u8 event, void *data)
 	case MLX5_EVENT_TYPE_FPGA_QP_ERROR:
 		syndrome = MLX5_GET(fpga_qp_error_event, data, syndrome);
 		event_name = mlx5_fpga_qp_syndrome_to_string(syndrome);
-		fpga_qpn = MLX5_GET(fpga_qp_error_event, data, fpga_qpn);
 		break;
 	default:
 		mlx5_fpga_warn_ratelimited(fdev, "Unexpected event %u\n",
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 218/639] drm/nouveau/bios/ramcfg: fix missing parentheses when calculating RON
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (216 preceding siblings ...)
  2020-01-24  9:26 ` [PATCH 4.19 217/639] net/mlx5: Delete unused FPGA QPN variable Greg Kroah-Hartman
@ 2020-01-24  9:26 ` Greg Kroah-Hartman
  2020-01-24  9:26 ` [PATCH 4.19 219/639] drm/nouveau/pmu: dont print reply values if exec is false Greg Kroah-Hartman
                   ` (424 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:26 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Colin Ian King, Ben Skeggs, Sasha Levin

From: Colin Ian King <colin.king@canonical.com>

[ Upstream commit 13649101a25c53c87f4ab98a076dfe61f3636ab1 ]

Currently, the expression for calculating RON is always going to result
in zero no matter the value of ram->mr[1] because the ! operator has
higher precedence than the shift >> operator.  I believe the missing
parentheses around the expression before appying the ! operator will
result in the desired result.

[ Note, not tested ]

Detected by CoveritScan, CID#1324005 ("Operands don't affect result")

Fixes: c25bf7b6155c ("drm/nouveau/bios/ramcfg: Separate out RON pull value")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/nouveau/nvkm/subdev/fb/gddr3.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/fb/gddr3.c b/drivers/gpu/drm/nouveau/nvkm/subdev/fb/gddr3.c
index 60ece0a8a2e1b..1d2d6bae73cd1 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/fb/gddr3.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/fb/gddr3.c
@@ -87,7 +87,7 @@ nvkm_gddr3_calc(struct nvkm_ram *ram)
 		WR  = (ram->next->bios.timing[2] & 0x007f0000) >> 16;
 		/* XXX: Get these values from the VBIOS instead */
 		DLL = !(ram->mr[1] & 0x1);
-		RON = !(ram->mr[1] & 0x300) >> 8;
+		RON = !((ram->mr[1] & 0x300) >> 8);
 		break;
 	default:
 		return -ENOSYS;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 219/639] drm/nouveau/pmu: dont print reply values if exec is false
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (217 preceding siblings ...)
  2020-01-24  9:26 ` [PATCH 4.19 218/639] drm/nouveau/bios/ramcfg: fix missing parentheses when calculating RON Greg Kroah-Hartman
@ 2020-01-24  9:26 ` Greg Kroah-Hartman
  2020-01-24  9:26 ` [PATCH 4.19 220/639] drm/nouveau: fix missing break in switch statement Greg Kroah-Hartman
                   ` (423 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:26 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Colin Ian King, Ben Skeggs, Sasha Levin

From: Colin Ian King <colin.king@canonical.com>

[ Upstream commit b1d03fc36ec9834465a08c275c8d563e07f6f6bf ]

Currently the uninitialized values in the array reply are printed out
when exec is false and nvkm_pmu_send has not updated the array. Avoid
confusion by only dumping out these values if they have been actually
updated.

Detected by CoverityScan, CID#1271291 ("Uninitialized scaler variable")
Fixes: ebb58dc2ef8c ("drm/nouveau/pmu: rename from pwr (no binary change)")

Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/nouveau/nvkm/subdev/pmu/memx.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/memx.c b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/memx.c
index 11b28b086a062..7b052879af728 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/memx.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/memx.c
@@ -88,10 +88,10 @@ nvkm_memx_fini(struct nvkm_memx **pmemx, bool exec)
 	if (exec) {
 		nvkm_pmu_send(pmu, reply, PROC_MEMX, MEMX_MSG_EXEC,
 			      memx->base, finish);
+		nvkm_debug(subdev, "Exec took %uns, PMU_IN %08x\n",
+			   reply[0], reply[1]);
 	}
 
-	nvkm_debug(subdev, "Exec took %uns, PMU_IN %08x\n",
-		   reply[0], reply[1]);
 	kfree(memx);
 	return 0;
 }
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 220/639] drm/nouveau: fix missing break in switch statement
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (218 preceding siblings ...)
  2020-01-24  9:26 ` [PATCH 4.19 219/639] drm/nouveau/pmu: dont print reply values if exec is false Greg Kroah-Hartman
@ 2020-01-24  9:26 ` Greg Kroah-Hartman
  2020-01-24  9:26 ` [PATCH 4.19 221/639] driver core: Fix PM-runtime for links added during consumer probe Greg Kroah-Hartman
                   ` (422 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:26 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Colin Ian King, Gustavo A. R. Silva,
	Ben Skeggs, Sasha Levin

From: Colin Ian King <colin.king@canonical.com>

[ Upstream commit 785cf1eeafa23ec63f426d322401054d13abe2a3 ]

The NOUVEAU_GETPARAM_PCI_DEVICE case is missing a break statement and falls
through to the following NOUVEAU_GETPARAM_BUS_TYPE case and may end up
re-assigning the getparam->value to an undesired value. Fix this by adding
in the missing break.

Detected by CoverityScan, CID#1460507 ("Missing break in switch")

Fixes: 359088d5b8ec ("drm/nouveau: remove trivial cases of nvxx_device() usage")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Reviewed-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/nouveau/nouveau_abi16.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/gpu/drm/nouveau/nouveau_abi16.c b/drivers/gpu/drm/nouveau/nouveau_abi16.c
index e67a471331b51..6ec745873bc55 100644
--- a/drivers/gpu/drm/nouveau/nouveau_abi16.c
+++ b/drivers/gpu/drm/nouveau/nouveau_abi16.c
@@ -214,6 +214,7 @@ nouveau_abi16_ioctl_getparam(ABI16_IOCTL_ARGS)
 			WARN_ON(1);
 			break;
 		}
+		break;
 	case NOUVEAU_GETPARAM_FB_SIZE:
 		getparam->value = drm->gem.vram_available;
 		break;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 221/639] driver core: Fix PM-runtime for links added during consumer probe
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (219 preceding siblings ...)
  2020-01-24  9:26 ` [PATCH 4.19 220/639] drm/nouveau: fix missing break in switch statement Greg Kroah-Hartman
@ 2020-01-24  9:26 ` Greg Kroah-Hartman
  2020-01-24  9:26 ` [PATCH 4.19 222/639] ASoC: qcom: Fix of-node refcount unbalance in apq8016_sbc_parse_of() Greg Kroah-Hartman
                   ` (421 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:26 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jon Hunter, Ulf Hansson,
	Rafael J. Wysocki, Thierry Reding, Sasha Levin

From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>

[ Upstream commit 36003d4cf57ca431fb3f94d317bcca426a2394d6 ]

Commit 4c06c4e6cf63 ("driver core: Fix possible supplier PM-usage
counter imbalance") introduced a regression that causes suppliers
to be suspended prematurely for device links added during consumer
driver probe if the initial PM-runtime status of the consumer is
"suspended" and the consumer is resumed after adding the link and
before pm_runtime_put_suppliers() is called.  In that case,
pm_runtime_put_suppliers() will drop the rpm_active refcount for
the link by one and (since rpm_active is equal to two after the
preceding consumer resume) the supplier's PM-runtime usage counter
will be decremented, which may cause the supplier to suspend even
though the consumer's PM-runtime status is "active".

For this reason, partially revert commit 4c06c4e6cf63 as the problem
it tried to fix needs to be addressed somewhat differently, and
change pm_runtime_get_suppliers() and pm_runtime_put_suppliers() so
that the latter only drops rpm_active references acquired by the
former.  [This requires adding a new field to struct device_link,
but I coulnd't find a cleaner way to address the issue that would
work in all cases.]

This causes pm_runtime_put_suppliers() to effectively ignore device
links added during consumer probe, so device_link_add() doesn't need
to worry about ensuring that suppliers will remain active after
pm_runtime_put_suppliers() for links created with DL_FLAG_RPM_ACTIVE
set and it only needs to bump up rpm_active by one for those links,
so pm_runtime_active_link() is not necessary any more.

Fixes: 4c06c4e6cf63 ("driver core: Fix possible supplier PM-usage counter imbalance")
Reported-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Ulf Hansson <ulf.hansson@linaro.org>
Reviewed-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Tested-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/base/core.c          |  4 ++--
 drivers/base/power/runtime.c | 29 ++++++-----------------------
 include/linux/device.h       |  1 +
 include/linux/pm_runtime.h   |  4 ----
 4 files changed, 9 insertions(+), 29 deletions(-)

diff --git a/drivers/base/core.c b/drivers/base/core.c
index ab08211ba5d2d..742bc60e9ccac 100644
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -253,7 +253,7 @@ struct device_link *device_link_add(struct device *consumer,
 				link->flags |= DL_FLAG_PM_RUNTIME;
 			}
 			if (flags & DL_FLAG_RPM_ACTIVE)
-				pm_runtime_active_link(link, supplier);
+				refcount_inc(&link->rpm_active);
 		}
 
 		kref_get(&link->kref);
@@ -268,7 +268,7 @@ struct device_link *device_link_add(struct device *consumer,
 
 	if (flags & DL_FLAG_PM_RUNTIME) {
 		if (flags & DL_FLAG_RPM_ACTIVE)
-			pm_runtime_active_link(link, supplier);
+			refcount_inc(&link->rpm_active);
 
 		pm_runtime_new_link(consumer);
 	}
diff --git a/drivers/base/power/runtime.c b/drivers/base/power/runtime.c
index 0527890b4c191..303ce7d54a306 100644
--- a/drivers/base/power/runtime.c
+++ b/drivers/base/power/runtime.c
@@ -1571,6 +1571,7 @@ void pm_runtime_get_suppliers(struct device *dev)
 
 	list_for_each_entry_rcu(link, &dev->links.suppliers, c_node)
 		if (link->flags & DL_FLAG_PM_RUNTIME) {
+			link->supplier_preactivated = true;
 			refcount_inc(&link->rpm_active);
 			pm_runtime_get_sync(link->supplier);
 		}
@@ -1590,9 +1591,11 @@ void pm_runtime_put_suppliers(struct device *dev)
 	idx = device_links_read_lock();
 
 	list_for_each_entry_rcu(link, &dev->links.suppliers, c_node)
-		if (link->flags & DL_FLAG_PM_RUNTIME &&
-		    refcount_dec_not_one(&link->rpm_active))
-			pm_runtime_put(link->supplier);
+		if (link->supplier_preactivated) {
+			link->supplier_preactivated = false;
+			if (refcount_dec_not_one(&link->rpm_active))
+				pm_runtime_put(link->supplier);
+		}
 
 	device_links_read_unlock(idx);
 }
@@ -1604,26 +1607,6 @@ void pm_runtime_new_link(struct device *dev)
 	spin_unlock_irq(&dev->power.lock);
 }
 
-/**
- * pm_runtime_active_link - Set up new device link as active for PM-runtime.
- * @link: Device link to be set up as active.
- * @supplier: Supplier end of the link.
- *
- * Add 2 to the rpm_active refcount of @link and increment the PM-runtime
- * usage counter of @supplier once more in case the link is being added while
- * the consumer driver is probing and pm_runtime_put_suppliers() will be called
- * subsequently.
- *
- * Note that this doesn't prevent rpm_put_suppliers() from decreasing the link's
- * rpm_active refcount down to one, so runtime suspend of the consumer end of
- * @link is not affected.
- */
-void pm_runtime_active_link(struct device_link *link, struct device *supplier)
-{
-	refcount_add(2, &link->rpm_active);
-	pm_runtime_get_noresume(supplier);
-}
-
 void pm_runtime_drop_link(struct device *dev)
 {
 	spin_lock_irq(&dev->power.lock);
diff --git a/include/linux/device.h b/include/linux/device.h
index b8fd2a1f859db..e9d1c768f972a 100644
--- a/include/linux/device.h
+++ b/include/linux/device.h
@@ -854,6 +854,7 @@ struct device_link {
 #ifdef CONFIG_SRCU
 	struct rcu_head rcu_head;
 #endif
+	bool supplier_preactivated; /* Owned by consumer probe. */
 };
 
 /**
diff --git a/include/linux/pm_runtime.h b/include/linux/pm_runtime.h
index bace7df51af4d..f0fc4700b6ff5 100644
--- a/include/linux/pm_runtime.h
+++ b/include/linux/pm_runtime.h
@@ -59,8 +59,6 @@ extern void pm_runtime_clean_up_links(struct device *dev);
 extern void pm_runtime_get_suppliers(struct device *dev);
 extern void pm_runtime_put_suppliers(struct device *dev);
 extern void pm_runtime_new_link(struct device *dev);
-extern void pm_runtime_active_link(struct device_link *link,
-				   struct device *supplier);
 extern void pm_runtime_drop_link(struct device *dev);
 
 static inline void pm_suspend_ignore_children(struct device *dev, bool enable)
@@ -178,8 +176,6 @@ static inline void pm_runtime_clean_up_links(struct device *dev) {}
 static inline void pm_runtime_get_suppliers(struct device *dev) {}
 static inline void pm_runtime_put_suppliers(struct device *dev) {}
 static inline void pm_runtime_new_link(struct device *dev) {}
-static inline void pm_runtime_active_link(struct device_link *link,
-					  struct device *supplier) {}
 static inline void pm_runtime_drop_link(struct device *dev) {}
 
 #endif /* !CONFIG_PM */
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 222/639] ASoC: qcom: Fix of-node refcount unbalance in apq8016_sbc_parse_of()
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (220 preceding siblings ...)
  2020-01-24  9:26 ` [PATCH 4.19 221/639] driver core: Fix PM-runtime for links added during consumer probe Greg Kroah-Hartman
@ 2020-01-24  9:26 ` Greg Kroah-Hartman
  2020-01-24  9:26 ` [PATCH 4.19 223/639] net: dsa: fix unintended change of bridge interface STP state Greg Kroah-Hartman
                   ` (420 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:26 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Patrick Lai, Banajit Goswami,
	Takashi Iwai, Mark Brown, Sasha Levin

From: Takashi Iwai <tiwai@suse.de>

[ Upstream commit 8d1667200850f8753c0265fa4bd25c9a6e5f94ce ]

The apq8016 driver leaves the of-node refcount at aborting from the
loop of for_each_child_of_node() in the error path.  Not only the
iterator node of for_each_child_of_node(), the children nodes referred
from it for codec and cpu have to be properly unreferenced.

Fixes: bdb052e81f62 ("ASoC: qcom: add apq8016 sound card support")
Cc: Patrick Lai <plai@codeaurora.org>
Cc: Banajit Goswami <bgoswami@codeaurora.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/qcom/apq8016_sbc.c | 21 ++++++++++++++++-----
 1 file changed, 16 insertions(+), 5 deletions(-)

diff --git a/sound/soc/qcom/apq8016_sbc.c b/sound/soc/qcom/apq8016_sbc.c
index 1dd23bba1bedb..4b559932adc33 100644
--- a/sound/soc/qcom/apq8016_sbc.c
+++ b/sound/soc/qcom/apq8016_sbc.c
@@ -164,41 +164,52 @@ static struct apq8016_sbc_data *apq8016_sbc_parse_of(struct snd_soc_card *card)
 
 		if (!cpu || !codec) {
 			dev_err(dev, "Can't find cpu/codec DT node\n");
-			return ERR_PTR(-EINVAL);
+			ret = -EINVAL;
+			goto error;
 		}
 
 		link->cpu_of_node = of_parse_phandle(cpu, "sound-dai", 0);
 		if (!link->cpu_of_node) {
 			dev_err(card->dev, "error getting cpu phandle\n");
-			return ERR_PTR(-EINVAL);
+			ret = -EINVAL;
+			goto error;
 		}
 
 		ret = snd_soc_of_get_dai_name(cpu, &link->cpu_dai_name);
 		if (ret) {
 			dev_err(card->dev, "error getting cpu dai name\n");
-			return ERR_PTR(ret);
+			goto error;
 		}
 
 		ret = snd_soc_of_get_dai_link_codecs(dev, codec, link);
 
 		if (ret < 0) {
 			dev_err(card->dev, "error getting codec dai name\n");
-			return ERR_PTR(ret);
+			goto error;
 		}
 
 		link->platform_of_node = link->cpu_of_node;
 		ret = of_property_read_string(np, "link-name", &link->name);
 		if (ret) {
 			dev_err(card->dev, "error getting codec dai_link name\n");
-			return ERR_PTR(ret);
+			goto error;
 		}
 
 		link->stream_name = link->name;
 		link->init = apq8016_sbc_dai_init;
 		link++;
+
+		of_node_put(cpu);
+		of_node_put(codec);
 	}
 
 	return data;
+
+ error:
+	of_node_put(np);
+	of_node_put(cpu);
+	of_node_put(codec);
+	return ERR_PTR(ret);
 }
 
 static const struct snd_soc_dapm_widget apq8016_sbc_dapm_widgets[] = {
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 223/639] net: dsa: fix unintended change of bridge interface STP state
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (221 preceding siblings ...)
  2020-01-24  9:26 ` [PATCH 4.19 222/639] ASoC: qcom: Fix of-node refcount unbalance in apq8016_sbc_parse_of() Greg Kroah-Hartman
@ 2020-01-24  9:26 ` Greg Kroah-Hartman
  2020-01-24  9:26 ` [PATCH 4.19 224/639] fs/nfs: Fix nfs_parse_devname to not modify its argument Greg Kroah-Hartman
                   ` (419 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:26 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Russell King, Vivien Didelot,
	Florian Fainelli, David S. Miller, Sasha Levin

From: Russell King <rmk+kernel@armlinux.org.uk>

[ Upstream commit 9c2054a5cf415a9dc32c91ffde78399955deb571 ]

When a DSA port is added to a bridge and brought up, the resulting STP
state programmed into the hardware depends on the order that these
operations are performed.  However, the Linux bridge code believes that
the port is in disabled mode.

If the DSA port is first added to a bridge and then brought up, it will
be in blocking mode.  If it is brought up and then added to the bridge,
it will be in disabled mode.

This difference is caused by DSA always setting the STP mode in
dsa_port_enable() whether or not this port is part of a bridge.  Since
bridge always sets the STP state when the port is added, brought up or
taken down, it is unnecessary for us to manipulate the STP state.

Apparently, this code was copied from Rocker, and the very next day a
similar fix for Rocker was merged but was not propagated to DSA.  See
e47172ab7e41 ("rocker: put port in FORWADING state after leaving bridge")

Fixes: b73adef67765 ("net: dsa: integrate with SWITCHDEV for HW bridging")
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Reviewed-by: Vivien Didelot <vivien.didelot@gmail.com>
Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/dsa/port.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/net/dsa/port.c b/net/dsa/port.c
index ed0595459df13..ea7efc86b9d7c 100644
--- a/net/dsa/port.c
+++ b/net/dsa/port.c
@@ -69,7 +69,6 @@ static void dsa_port_set_state_now(struct dsa_port *dp, u8 state)
 
 int dsa_port_enable(struct dsa_port *dp, struct phy_device *phy)
 {
-	u8 stp_state = dp->bridge_dev ? BR_STATE_BLOCKING : BR_STATE_FORWARDING;
 	struct dsa_switch *ds = dp->ds;
 	int port = dp->index;
 	int err;
@@ -80,7 +79,8 @@ int dsa_port_enable(struct dsa_port *dp, struct phy_device *phy)
 			return err;
 	}
 
-	dsa_port_set_state_now(dp, stp_state);
+	if (!dp->bridge_dev)
+		dsa_port_set_state_now(dp, BR_STATE_FORWARDING);
 
 	return 0;
 }
@@ -90,7 +90,8 @@ void dsa_port_disable(struct dsa_port *dp, struct phy_device *phy)
 	struct dsa_switch *ds = dp->ds;
 	int port = dp->index;
 
-	dsa_port_set_state_now(dp, BR_STATE_DISABLED);
+	if (!dp->bridge_dev)
+		dsa_port_set_state_now(dp, BR_STATE_DISABLED);
 
 	if (ds->ops->port_disable)
 		ds->ops->port_disable(ds, port, phy);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 224/639] fs/nfs: Fix nfs_parse_devname to not modify its argument
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (222 preceding siblings ...)
  2020-01-24  9:26 ` [PATCH 4.19 223/639] net: dsa: fix unintended change of bridge interface STP state Greg Kroah-Hartman
@ 2020-01-24  9:26 ` Greg Kroah-Hartman
  2020-01-24  9:26 ` [PATCH 4.19 225/639] staging: rtlwifi: Use proper enum for return in halmac_parse_psd_data_88xx Greg Kroah-Hartman
                   ` (418 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:26 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Eric W. Biederman, Trond Myklebust,
	Sasha Levin

From: Eric W. Biederman <ebiederm@xmission.com>

[ Upstream commit 40cc394be1aa18848b8757e03bd8ed23281f572e ]

In the rare and unsupported case of a hostname list nfs_parse_devname
will modify dev_name.  There is no need to modify dev_name as the all
that is being computed is the length of the hostname, so the computed
length can just be shorted.

Fixes: dc04589827f7 ("NFS: Use common device name parsing logic for NFSv4 and NFSv2/v3")
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/nfs/super.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/nfs/super.c b/fs/nfs/super.c
index d90efdea9fbd6..5db7aceb41907 100644
--- a/fs/nfs/super.c
+++ b/fs/nfs/super.c
@@ -1930,7 +1930,7 @@ static int nfs_parse_devname(const char *dev_name,
 		/* kill possible hostname list: not supported */
 		comma = strchr(dev_name, ',');
 		if (comma != NULL && comma < end)
-			*comma = 0;
+			len = comma - dev_name;
 	}
 
 	if (len > maxnamlen)
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 225/639] staging: rtlwifi: Use proper enum for return in halmac_parse_psd_data_88xx
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (223 preceding siblings ...)
  2020-01-24  9:26 ` [PATCH 4.19 224/639] fs/nfs: Fix nfs_parse_devname to not modify its argument Greg Kroah-Hartman
@ 2020-01-24  9:26 ` Greg Kroah-Hartman
  2020-01-24  9:26 ` [PATCH 4.19 226/639] powerpc/64s: Fix logic when handling unknown CPU features Greg Kroah-Hartman
                   ` (417 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:26 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Nathan Chancellor, Nicholas Mc Guire,
	Sasha Levin

From: Nathan Chancellor <natechancellor@gmail.com>

[ Upstream commit e8edc32d70a4e09160835792eb5d1af71a0eec14 ]

Clang warns:

drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_func_88xx.c:2472:11:
warning: implicit conversion from enumeration type 'enum
halmac_cmd_process_status' to different enumeration type 'enum
halmac_ret_status' [-Wenum-conversion]
                        return HALMAC_CMD_PROCESS_ERROR;
                        ~~~~~~ ^~~~~~~~~~~~~~~~~~~~~~~~
1 warning generated.

Fix this by using the proper enum for allocation failures,
HALMAC_RET_MALLOC_FAIL, which is used in the rest of this file.

Fixes: e4b08e16b7d9 ("staging: r8822be: check kzalloc return or bail")
Link: https://github.com/ClangBuiltLinux/linux/issues/375
Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
Reviewed-by: Nicholas Mc Guire <hofrat@osadl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_func_88xx.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_func_88xx.c b/drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_func_88xx.c
index ec742da030dba..ddbeff8224ab6 100644
--- a/drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_func_88xx.c
+++ b/drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_func_88xx.c
@@ -2469,7 +2469,7 @@ halmac_parse_psd_data_88xx(struct halmac_adapter *halmac_adapter, u8 *c2h_buf,
 	if (!psd_set->data) {
 		psd_set->data = kzalloc(psd_set->data_size, GFP_KERNEL);
 		if (!psd_set->data)
-			return HALMAC_CMD_PROCESS_ERROR;
+			return HALMAC_RET_MALLOC_FAIL;
 	}
 
 	if (segment_id == 0)
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 226/639] powerpc/64s: Fix logic when handling unknown CPU features
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (224 preceding siblings ...)
  2020-01-24  9:26 ` [PATCH 4.19 225/639] staging: rtlwifi: Use proper enum for return in halmac_parse_psd_data_88xx Greg Kroah-Hartman
@ 2020-01-24  9:26 ` Greg Kroah-Hartman
  2020-01-24  9:26 ` [PATCH 4.19 227/639] NFS: Fix a soft lockup in the delegation recovery code Greg Kroah-Hartman
                   ` (416 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:26 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Segher Boessenkool, Michael Ellerman,
	Andrew Donnellan, Sasha Levin

From: Michael Ellerman <mpe@ellerman.id.au>

[ Upstream commit 8cfaf106918a8c13abb24c641556172afbb9545c ]

In cpufeatures_process_feature(), if a provided CPU feature is unknown and
enable_unknown is false, we erroneously print that the feature is being
enabled and return true, even though no feature has been enabled, and
may also set feature bits based on the last entry in the match table.

Fix this so that we only set feature bits from the match table if we have
actually enabled a feature from that table, and when failing to enable an
unknown feature, always print the "not enabling" message and return false.

Coincidentally, some older gccs (<GCC 7), when invoked with
-fsanitize-coverage=trace-pc, cause a spurious uninitialised variable
warning in this function:

  arch/powerpc/kernel/dt_cpu_ftrs.c: In function ‘cpufeatures_process_feature’:
  arch/powerpc/kernel/dt_cpu_ftrs.c:686:7: warning: ‘m’ may be used uninitialized in this function [-Wmaybe-uninitialized]
    if (m->cpu_ftr_bit_mask)

An upcoming patch will enable support for kcov, which requires this option.
This patch avoids the warning.

Fixes: 5a61ef74f269 ("powerpc/64s: Support new device tree binding for discovering CPU features")
Reported-by: Segher Boessenkool <segher@kernel.crashing.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
[ajd: add commit message]
Signed-off-by: Andrew Donnellan <andrew.donnellan@au1.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/kernel/dt_cpu_ftrs.c | 17 +++++++----------
 1 file changed, 7 insertions(+), 10 deletions(-)

diff --git a/arch/powerpc/kernel/dt_cpu_ftrs.c b/arch/powerpc/kernel/dt_cpu_ftrs.c
index c6f41907f0d71..a4b31e17492d3 100644
--- a/arch/powerpc/kernel/dt_cpu_ftrs.c
+++ b/arch/powerpc/kernel/dt_cpu_ftrs.c
@@ -666,8 +666,10 @@ static bool __init cpufeatures_process_feature(struct dt_cpu_feature *f)
 		m = &dt_cpu_feature_match_table[i];
 		if (!strcmp(f->name, m->name)) {
 			known = true;
-			if (m->enable(f))
+			if (m->enable(f)) {
+				cur_cpu_spec->cpu_features |= m->cpu_ftr_bit_mask;
 				break;
+			}
 
 			pr_info("not enabling: %s (disabled or unsupported by kernel)\n",
 				f->name);
@@ -675,17 +677,12 @@ static bool __init cpufeatures_process_feature(struct dt_cpu_feature *f)
 		}
 	}
 
-	if (!known && enable_unknown) {
-		if (!feat_try_enable_unknown(f)) {
-			pr_info("not enabling: %s (unknown and unsupported by kernel)\n",
-				f->name);
-			return false;
-		}
+	if (!known && (!enable_unknown || !feat_try_enable_unknown(f))) {
+		pr_info("not enabling: %s (unknown and unsupported by kernel)\n",
+			f->name);
+		return false;
 	}
 
-	if (m->cpu_ftr_bit_mask)
-		cur_cpu_spec->cpu_features |= m->cpu_ftr_bit_mask;
-
 	if (known)
 		pr_debug("enabling: %s\n", f->name);
 	else
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 227/639] NFS: Fix a soft lockup in the delegation recovery code
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (225 preceding siblings ...)
  2020-01-24  9:26 ` [PATCH 4.19 226/639] powerpc/64s: Fix logic when handling unknown CPU features Greg Kroah-Hartman
@ 2020-01-24  9:26 ` Greg Kroah-Hartman
  2020-01-24  9:26 ` [PATCH 4.19 228/639] perf: Copy parents address filter offsets on clone Greg Kroah-Hartman
                   ` (415 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:26 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Trond Myklebust, Sasha Levin

From: Trond Myklebust <trond.myklebust@hammerspace.com>

[ Upstream commit 6f9449be53f3ce383caed797708b332ede8d952c ]

Fix a soft lockup when NFS client delegation recovery is attempted
but the inode is in the process of being freed. When the
igrab(inode) call fails, and we have to restart the recovery process,
we need to ensure that we won't attempt to recover the same delegation
again.

Fixes: 45870d6909d5a ("NFSv4.1: Test delegation stateids when server...")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/nfs/delegation.c | 20 ++++++++++++--------
 fs/nfs/delegation.h |  1 +
 2 files changed, 13 insertions(+), 8 deletions(-)

diff --git a/fs/nfs/delegation.c b/fs/nfs/delegation.c
index 74ff459b75efa..b0c0c2fc2fbac 100644
--- a/fs/nfs/delegation.c
+++ b/fs/nfs/delegation.c
@@ -240,6 +240,8 @@ static struct inode *nfs_delegation_grab_inode(struct nfs_delegation *delegation
 	spin_lock(&delegation->lock);
 	if (delegation->inode != NULL)
 		inode = igrab(delegation->inode);
+	if (!inode)
+		set_bit(NFS_DELEGATION_INODE_FREEING, &delegation->flags);
 	spin_unlock(&delegation->lock);
 	return inode;
 }
@@ -955,10 +957,11 @@ restart:
 	list_for_each_entry_rcu(server, &clp->cl_superblocks, client_link) {
 		list_for_each_entry_rcu(delegation, &server->delegations,
 								super_list) {
-			if (test_bit(NFS_DELEGATION_RETURNING,
-						&delegation->flags))
-				continue;
-			if (test_bit(NFS_DELEGATION_NEED_RECLAIM,
+			if (test_bit(NFS_DELEGATION_INODE_FREEING,
+						&delegation->flags) ||
+			    test_bit(NFS_DELEGATION_RETURNING,
+						&delegation->flags) ||
+			    test_bit(NFS_DELEGATION_NEED_RECLAIM,
 						&delegation->flags) == 0)
 				continue;
 			if (!nfs_sb_active(server->super))
@@ -1064,10 +1067,11 @@ restart:
 	list_for_each_entry_rcu(server, &clp->cl_superblocks, client_link) {
 		list_for_each_entry_rcu(delegation, &server->delegations,
 								super_list) {
-			if (test_bit(NFS_DELEGATION_RETURNING,
-						&delegation->flags))
-				continue;
-			if (test_bit(NFS_DELEGATION_TEST_EXPIRED,
+			if (test_bit(NFS_DELEGATION_INODE_FREEING,
+						&delegation->flags) ||
+			    test_bit(NFS_DELEGATION_RETURNING,
+						&delegation->flags) ||
+			    test_bit(NFS_DELEGATION_TEST_EXPIRED,
 						&delegation->flags) == 0)
 				continue;
 			if (!nfs_sb_active(server->super))
diff --git a/fs/nfs/delegation.h b/fs/nfs/delegation.h
index dd0f3eed3890d..f09b153ac82ff 100644
--- a/fs/nfs/delegation.h
+++ b/fs/nfs/delegation.h
@@ -34,6 +34,7 @@ enum {
 	NFS_DELEGATION_RETURNING,
 	NFS_DELEGATION_REVOKED,
 	NFS_DELEGATION_TEST_EXPIRED,
+	NFS_DELEGATION_INODE_FREEING,
 };
 
 int nfs_inode_set_delegation(struct inode *inode, struct rpc_cred *cred,
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 228/639] perf: Copy parents address filter offsets on clone
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (226 preceding siblings ...)
  2020-01-24  9:26 ` [PATCH 4.19 227/639] NFS: Fix a soft lockup in the delegation recovery code Greg Kroah-Hartman
@ 2020-01-24  9:26 ` Greg Kroah-Hartman
  2020-01-24  9:26 ` [PATCH 4.19 229/639] perf, pt, coresight: Fix address filters for vmas with non-zero offset Greg Kroah-Hartman
                   ` (414 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:26 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Mansour Alharthi, Alexander Shishkin,
	Mathieu Poirier, Peter Zijlstra, Jiri Olsa,
	Arnaldo Carvalho de Melo, Sasha Levin

From: Alexander Shishkin <alexander.shishkin@linux.intel.com>

[ Upstream commit 18736eef12137c59f60cc9f56dc5bea05c92e0eb ]

When a child event is allocated in the inherit_event() path, the VMA
based filter offsets are not copied from the parent, even though the
address space mapping of the new task remains the same, which leads to
no trace for the new task until exec.

Reported-by: Mansour Alharthi <malharthi9@gatech.edu>
Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Tested-by: Mathieu Poirier <mathieu.poirier@linaro.org>
Acked-by: Peter Zijlstra <peterz@infradead.org>
Cc: Jiri Olsa <jolsa@redhat.com>
Fixes: 375637bc5249 ("perf/core: Introduce address range filtering")
Link: http://lkml.kernel.org/r/20190215115655.63469-2-alexander.shishkin@linux.intel.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/events/core.c | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/kernel/events/core.c b/kernel/events/core.c
index 460d5fd3ec4e4..9a5559f5938a5 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -1254,6 +1254,7 @@ static void put_ctx(struct perf_event_context *ctx)
  *	      perf_event_context::lock
  *	    perf_event::mmap_mutex
  *	    mmap_sem
+ *	      perf_addr_filters_head::lock
  *
  *    cpu_hotplug_lock
  *      pmus_lock
@@ -10136,6 +10137,20 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu,
 			goto err_per_task;
 		}
 
+		/*
+		 * Clone the parent's vma offsets: they are valid until exec()
+		 * even if the mm is not shared with the parent.
+		 */
+		if (event->parent) {
+			struct perf_addr_filters_head *ifh = perf_event_addr_filters(event);
+
+			raw_spin_lock_irq(&ifh->lock);
+			memcpy(event->addr_filters_offs,
+			       event->parent->addr_filters_offs,
+			       pmu->nr_addr_filters * sizeof(unsigned long));
+			raw_spin_unlock_irq(&ifh->lock);
+		}
+
 		/* force hw sync on the address filters */
 		event->addr_filters_gen = 1;
 	}
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 229/639] perf, pt, coresight: Fix address filters for vmas with non-zero offset
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (227 preceding siblings ...)
  2020-01-24  9:26 ` [PATCH 4.19 228/639] perf: Copy parents address filter offsets on clone Greg Kroah-Hartman
@ 2020-01-24  9:26 ` Greg Kroah-Hartman
  2020-01-24  9:26 ` [PATCH 4.19 230/639] clocksource/drivers/sun5i: Fail gracefully when clock rate is unavailable Greg Kroah-Hartman
                   ` (413 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:26 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Adrian Hunter, Alexander Shishkin,
	Mathieu Poirier, Peter Zijlstra, Jiri Olsa,
	Arnaldo Carvalho de Melo, Sasha Levin

From: Alexander Shishkin <alexander.shishkin@linux.intel.com>

[ Upstream commit c60f83b813e5b25ccd5de7e8c8925c31b3aebcc1 ]

Currently, the address range calculation for file-based filters works as
long as the vma that maps the matching part of the object file starts
from offset zero into the file (vm_pgoff==0). Otherwise, the resulting
filter range would be off by vm_pgoff pages. Another related problem is
that in case of a partially matching vma, that is, a vma that matches
part of a filter region, the filter range size wouldn't be adjusted.

Fix the arithmetics around address filter range calculations, taking
into account vma offset, so that the entire calculation is done before
the filter configuration is passed to the PMU drivers instead of having
those drivers do the final bit of arithmetics.

Based on the patch by Adrian Hunter <adrian.hunter.intel.com>.

Reported-by: Adrian Hunter <adrian.hunter@intel.com>
Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Tested-by: Mathieu Poirier <mathieu.poirier@linaro.org>
Acked-by: Peter Zijlstra <peterz@infradead.org>
Cc: Jiri Olsa <jolsa@redhat.com>
Fixes: 375637bc5249 ("perf/core: Introduce address range filtering")
Link: http://lkml.kernel.org/r/20190215115655.63469-3-alexander.shishkin@linux.intel.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/events/intel/pt.c                    |  9 ++-
 .../hwtracing/coresight/coresight-etm-perf.c  |  7 +-
 include/linux/perf_event.h                    |  7 +-
 kernel/events/core.c                          | 81 +++++++++++--------
 4 files changed, 62 insertions(+), 42 deletions(-)

diff --git a/arch/x86/events/intel/pt.c b/arch/x86/events/intel/pt.c
index 8f4c98fdd03c5..f03100bc5fd12 100644
--- a/arch/x86/events/intel/pt.c
+++ b/arch/x86/events/intel/pt.c
@@ -1213,7 +1213,8 @@ static int pt_event_addr_filters_validate(struct list_head *filters)
 static void pt_event_addr_filters_sync(struct perf_event *event)
 {
 	struct perf_addr_filters_head *head = perf_event_addr_filters(event);
-	unsigned long msr_a, msr_b, *offs = event->addr_filters_offs;
+	unsigned long msr_a, msr_b;
+	struct perf_addr_filter_range *fr = event->addr_filter_ranges;
 	struct pt_filters *filters = event->hw.addr_filters;
 	struct perf_addr_filter *filter;
 	int range = 0;
@@ -1222,12 +1223,12 @@ static void pt_event_addr_filters_sync(struct perf_event *event)
 		return;
 
 	list_for_each_entry(filter, &head->list, entry) {
-		if (filter->path.dentry && !offs[range]) {
+		if (filter->path.dentry && !fr[range].start) {
 			msr_a = msr_b = 0;
 		} else {
 			/* apply the offset */
-			msr_a = filter->offset + offs[range];
-			msr_b = filter->size + msr_a - 1;
+			msr_a = fr[range].start;
+			msr_b = msr_a + fr[range].size - 1;
 		}
 
 		filters->filter[range].msr_a  = msr_a;
diff --git a/drivers/hwtracing/coresight/coresight-etm-perf.c b/drivers/hwtracing/coresight/coresight-etm-perf.c
index c3c6452015142..567f46ca25998 100644
--- a/drivers/hwtracing/coresight/coresight-etm-perf.c
+++ b/drivers/hwtracing/coresight/coresight-etm-perf.c
@@ -437,15 +437,16 @@ static int etm_addr_filters_validate(struct list_head *filters)
 static void etm_addr_filters_sync(struct perf_event *event)
 {
 	struct perf_addr_filters_head *head = perf_event_addr_filters(event);
-	unsigned long start, stop, *offs = event->addr_filters_offs;
+	unsigned long start, stop;
+	struct perf_addr_filter_range *fr = event->addr_filter_ranges;
 	struct etm_filters *filters = event->hw.addr_filters;
 	struct etm_filter *etm_filter;
 	struct perf_addr_filter *filter;
 	int i = 0;
 
 	list_for_each_entry(filter, &head->list, entry) {
-		start = filter->offset + offs[i];
-		stop = start + filter->size;
+		start = fr[i].start;
+		stop = start + fr[i].size;
 		etm_filter = &filters->etm_filter[i];
 
 		switch (filter->action) {
diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h
index b22bc81f3669a..d8b4d31acd18e 100644
--- a/include/linux/perf_event.h
+++ b/include/linux/perf_event.h
@@ -494,6 +494,11 @@ struct perf_addr_filters_head {
 	unsigned int		nr_file_filters;
 };
 
+struct perf_addr_filter_range {
+	unsigned long		start;
+	unsigned long		size;
+};
+
 /**
  * enum perf_event_state - the states of an event:
  */
@@ -670,7 +675,7 @@ struct perf_event {
 	/* address range filters */
 	struct perf_addr_filters_head	addr_filters;
 	/* vma address array for file-based filders */
-	unsigned long			*addr_filters_offs;
+	struct perf_addr_filter_range	*addr_filter_ranges;
 	unsigned long			addr_filters_gen;
 
 	void (*destroy)(struct perf_event *);
diff --git a/kernel/events/core.c b/kernel/events/core.c
index 9a5559f5938a5..4eef2d42d05c4 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -2804,7 +2804,7 @@ static int perf_event_stop(struct perf_event *event, int restart)
  *
  * (p1) when userspace mappings change as a result of (1) or (2) or (3) below,
  *      we update the addresses of corresponding vmas in
- *	event::addr_filters_offs array and bump the event::addr_filters_gen;
+ *	event::addr_filter_ranges array and bump the event::addr_filters_gen;
  * (p2) when an event is scheduled in (pmu::add), it calls
  *      perf_event_addr_filters_sync() which calls pmu::addr_filters_sync()
  *      if the generation has changed since the previous call.
@@ -4448,7 +4448,7 @@ static void _free_event(struct perf_event *event)
 
 	perf_event_free_bpf_prog(event);
 	perf_addr_filters_splice(event, NULL);
-	kfree(event->addr_filters_offs);
+	kfree(event->addr_filter_ranges);
 
 	if (event->destroy)
 		event->destroy(event);
@@ -6743,7 +6743,8 @@ static void perf_event_addr_filters_exec(struct perf_event *event, void *data)
 	raw_spin_lock_irqsave(&ifh->lock, flags);
 	list_for_each_entry(filter, &ifh->list, entry) {
 		if (filter->path.dentry) {
-			event->addr_filters_offs[count] = 0;
+			event->addr_filter_ranges[count].start = 0;
+			event->addr_filter_ranges[count].size = 0;
 			restart++;
 		}
 
@@ -7425,28 +7426,47 @@ static bool perf_addr_filter_match(struct perf_addr_filter *filter,
 	return true;
 }
 
+static bool perf_addr_filter_vma_adjust(struct perf_addr_filter *filter,
+					struct vm_area_struct *vma,
+					struct perf_addr_filter_range *fr)
+{
+	unsigned long vma_size = vma->vm_end - vma->vm_start;
+	unsigned long off = vma->vm_pgoff << PAGE_SHIFT;
+	struct file *file = vma->vm_file;
+
+	if (!perf_addr_filter_match(filter, file, off, vma_size))
+		return false;
+
+	if (filter->offset < off) {
+		fr->start = vma->vm_start;
+		fr->size = min(vma_size, filter->size - (off - filter->offset));
+	} else {
+		fr->start = vma->vm_start + filter->offset - off;
+		fr->size = min(vma->vm_end - fr->start, filter->size);
+	}
+
+	return true;
+}
+
 static void __perf_addr_filters_adjust(struct perf_event *event, void *data)
 {
 	struct perf_addr_filters_head *ifh = perf_event_addr_filters(event);
 	struct vm_area_struct *vma = data;
-	unsigned long off = vma->vm_pgoff << PAGE_SHIFT, flags;
-	struct file *file = vma->vm_file;
 	struct perf_addr_filter *filter;
 	unsigned int restart = 0, count = 0;
+	unsigned long flags;
 
 	if (!has_addr_filter(event))
 		return;
 
-	if (!file)
+	if (!vma->vm_file)
 		return;
 
 	raw_spin_lock_irqsave(&ifh->lock, flags);
 	list_for_each_entry(filter, &ifh->list, entry) {
-		if (perf_addr_filter_match(filter, file, off,
-					     vma->vm_end - vma->vm_start)) {
-			event->addr_filters_offs[count] = vma->vm_start;
+		if (perf_addr_filter_vma_adjust(filter, vma,
+						&event->addr_filter_ranges[count]))
 			restart++;
-		}
 
 		count++;
 	}
@@ -8806,26 +8826,19 @@ static void perf_addr_filters_splice(struct perf_event *event,
  * @filter; if so, adjust filter's address range.
  * Called with mm::mmap_sem down for reading.
  */
-static unsigned long perf_addr_filter_apply(struct perf_addr_filter *filter,
-					    struct mm_struct *mm)
+static void perf_addr_filter_apply(struct perf_addr_filter *filter,
+				   struct mm_struct *mm,
+				   struct perf_addr_filter_range *fr)
 {
 	struct vm_area_struct *vma;
 
 	for (vma = mm->mmap; vma; vma = vma->vm_next) {
-		struct file *file = vma->vm_file;
-		unsigned long off = vma->vm_pgoff << PAGE_SHIFT;
-		unsigned long vma_size = vma->vm_end - vma->vm_start;
-
-		if (!file)
+		if (!vma->vm_file)
 			continue;
 
-		if (!perf_addr_filter_match(filter, file, off, vma_size))
-			continue;
-
-		return vma->vm_start;
+		if (perf_addr_filter_vma_adjust(filter, vma, fr))
+			return;
 	}
-
-	return 0;
 }
 
 /*
@@ -8859,15 +8872,15 @@ static void perf_event_addr_filters_apply(struct perf_event *event)
 
 	raw_spin_lock_irqsave(&ifh->lock, flags);
 	list_for_each_entry(filter, &ifh->list, entry) {
-		event->addr_filters_offs[count] = 0;
+		event->addr_filter_ranges[count].start = 0;
+		event->addr_filter_ranges[count].size = 0;
 
 		/*
 		 * Adjust base offset if the filter is associated to a binary
 		 * that needs to be mapped:
 		 */
 		if (filter->path.dentry)
-			event->addr_filters_offs[count] =
-				perf_addr_filter_apply(filter, mm);
+			perf_addr_filter_apply(filter, mm, &event->addr_filter_ranges[count]);
 
 		count++;
 	}
@@ -10129,10 +10142,10 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu,
 		goto err_pmu;
 
 	if (has_addr_filter(event)) {
-		event->addr_filters_offs = kcalloc(pmu->nr_addr_filters,
-						   sizeof(unsigned long),
-						   GFP_KERNEL);
-		if (!event->addr_filters_offs) {
+		event->addr_filter_ranges = kcalloc(pmu->nr_addr_filters,
+						    sizeof(struct perf_addr_filter_range),
+						    GFP_KERNEL);
+		if (!event->addr_filter_ranges) {
 			err = -ENOMEM;
 			goto err_per_task;
 		}
@@ -10145,9 +10158,9 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu,
 			struct perf_addr_filters_head *ifh = perf_event_addr_filters(event);
 
 			raw_spin_lock_irq(&ifh->lock);
-			memcpy(event->addr_filters_offs,
-			       event->parent->addr_filters_offs,
-			       pmu->nr_addr_filters * sizeof(unsigned long));
+			memcpy(event->addr_filter_ranges,
+			       event->parent->addr_filter_ranges,
+			       pmu->nr_addr_filters * sizeof(struct perf_addr_filter_range));
 			raw_spin_unlock_irq(&ifh->lock);
 		}
 
@@ -10169,7 +10182,7 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu,
 	return event;
 
 err_addr_filters:
-	kfree(event->addr_filters_offs);
+	kfree(event->addr_filter_ranges);
 
 err_per_task:
 	exclusive_event_destroy(event);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 230/639] clocksource/drivers/sun5i: Fail gracefully when clock rate is unavailable
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (228 preceding siblings ...)
  2020-01-24  9:26 ` [PATCH 4.19 229/639] perf, pt, coresight: Fix address filters for vmas with non-zero offset Greg Kroah-Hartman
@ 2020-01-24  9:26 ` Greg Kroah-Hartman
  2020-01-24  9:26 ` [PATCH 4.19 231/639] clocksource/drivers/exynos_mct: Fix error path in timer resources initialization Greg Kroah-Hartman
                   ` (412 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:26 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chen-Yu Tsai, Maxime Ripard,
	Daniel Lezcano, Sasha Levin

From: Chen-Yu Tsai <wens@csie.org>

[ Upstream commit e7e7e0d7beafebd11b0c065cd5fbc1e5759c5aab ]

If the clock tree is not fully populated when the timer-sun5i init code
is called, attempts to get the clock rate for the timer would fail and
return 0.

Make the init code for both clock events and clocksource check the
returned clock rate and fail gracefully if the result is 0, instead of
causing a divide by 0 exception later on.

Fixes: 4a59058f0b09 ("clocksource/drivers/sun5i: Refactor the current code")
Signed-off-by: Chen-Yu Tsai <wens@csie.org>
Acked-by: Maxime Ripard <maxime.ripard@bootlin.com>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clocksource/timer-sun5i.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/drivers/clocksource/timer-sun5i.c b/drivers/clocksource/timer-sun5i.c
index 3b56ea3f52afc..552c5254390cb 100644
--- a/drivers/clocksource/timer-sun5i.c
+++ b/drivers/clocksource/timer-sun5i.c
@@ -202,6 +202,11 @@ static int __init sun5i_setup_clocksource(struct device_node *node,
 	}
 
 	rate = clk_get_rate(clk);
+	if (!rate) {
+		pr_err("Couldn't get parent clock rate\n");
+		ret = -EINVAL;
+		goto err_disable_clk;
+	}
 
 	cs->timer.base = base;
 	cs->timer.clk = clk;
@@ -275,6 +280,11 @@ static int __init sun5i_setup_clockevent(struct device_node *node, void __iomem
 	}
 
 	rate = clk_get_rate(clk);
+	if (!rate) {
+		pr_err("Couldn't get parent clock rate\n");
+		ret = -EINVAL;
+		goto err_disable_clk;
+	}
 
 	ce->timer.base = base;
 	ce->timer.ticks_per_jiffy = DIV_ROUND_UP(rate, HZ);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 231/639] clocksource/drivers/exynos_mct: Fix error path in timer resources initialization
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (229 preceding siblings ...)
  2020-01-24  9:26 ` [PATCH 4.19 230/639] clocksource/drivers/sun5i: Fail gracefully when clock rate is unavailable Greg Kroah-Hartman
@ 2020-01-24  9:26 ` Greg Kroah-Hartman
  2020-01-24  9:26 ` [PATCH 4.19 232/639] platform/x86: wmi: fix potential null pointer dereference Greg Kroah-Hartman
                   ` (411 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:26 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Krzysztof Kozlowski,
	Marek Szyprowski, Chanwoo Choi, Daniel Lezcano, Sasha Levin

From: Marek Szyprowski <m.szyprowski@samsung.com>

[ Upstream commit b9307420196009cdf18bad55e762ac49fb9a80f4 ]

While freeing interrupt handlers in error path, don't assume that all
requested interrupts are per-processor interrupts and properly release
standard interrupts too.

Reported-by: Krzysztof Kozlowski <krzk@kernel.org>
Fixes: 56a94f13919c ("clocksource: exynos_mct: Avoid blocking calls in the cpu hotplug notifier")
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Reviewed-by: Krzysztof Kozlowski <krzk@kernel.org>
Reviewed-by: Chanwoo Choi <cw00.choi@samsung.com>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clocksource/exynos_mct.c | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/drivers/clocksource/exynos_mct.c b/drivers/clocksource/exynos_mct.c
index aaf5bfa9bd9c9..e3ae041ac30e1 100644
--- a/drivers/clocksource/exynos_mct.c
+++ b/drivers/clocksource/exynos_mct.c
@@ -563,7 +563,19 @@ static int __init exynos4_timer_resources(struct device_node *np, void __iomem *
 	return 0;
 
 out_irq:
-	free_percpu_irq(mct_irqs[MCT_L0_IRQ], &percpu_mct_tick);
+	if (mct_int_type == MCT_INT_PPI) {
+		free_percpu_irq(mct_irqs[MCT_L0_IRQ], &percpu_mct_tick);
+	} else {
+		for_each_possible_cpu(cpu) {
+			struct mct_clock_event_device *pcpu_mevt =
+				per_cpu_ptr(&percpu_mct_tick, cpu);
+
+			if (pcpu_mevt->evt.irq != -1) {
+				free_irq(pcpu_mevt->evt.irq, pcpu_mevt);
+				pcpu_mevt->evt.irq = -1;
+			}
+		}
+	}
 	return err;
 }
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 232/639] platform/x86: wmi: fix potential null pointer dereference
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (230 preceding siblings ...)
  2020-01-24  9:26 ` [PATCH 4.19 231/639] clocksource/drivers/exynos_mct: Fix error path in timer resources initialization Greg Kroah-Hartman
@ 2020-01-24  9:26 ` Greg Kroah-Hartman
  2020-01-24  9:26 ` [PATCH 4.19 233/639] NFS/pnfs: Bulk destroy of layouts needs to be safe w.r.t. umount Greg Kroah-Hartman
                   ` (410 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:26 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Mattias Jacobsson,
	Darren Hart (VMware),
	Sasha Levin

From: Mattias Jacobsson <2pi@mok.nu>

[ Upstream commit c355ec651a8941864549f2586f969d0eb7bf499a ]

In the function wmi_dev_match() the variable id is dereferenced without
first performing a NULL check. The variable can for example be NULL if
a WMI driver is registered without specifying the id_table field in
struct wmi_driver.

Add a NULL check and return that the driver can't handle the device if
the variable is NULL.

Fixes: 844af950da94 ("platform/x86: wmi: Turn WMI into a bus driver")
Signed-off-by: Mattias Jacobsson <2pi@mok.nu>
Signed-off-by: Darren Hart (VMware) <dvhart@infradead.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/x86/wmi.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/platform/x86/wmi.c b/drivers/platform/x86/wmi.c
index 04791ea5d97b6..35cdc3998eb59 100644
--- a/drivers/platform/x86/wmi.c
+++ b/drivers/platform/x86/wmi.c
@@ -768,6 +768,9 @@ static int wmi_dev_match(struct device *dev, struct device_driver *driver)
 	struct wmi_block *wblock = dev_to_wblock(dev);
 	const struct wmi_device_id *id = wmi_driver->id_table;
 
+	if (id == NULL)
+		return 0;
+
 	while (id->guid_string) {
 		uuid_le driver_guid;
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 233/639] NFS/pnfs: Bulk destroy of layouts needs to be safe w.r.t. umount
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (231 preceding siblings ...)
  2020-01-24  9:26 ` [PATCH 4.19 232/639] platform/x86: wmi: fix potential null pointer dereference Greg Kroah-Hartman
@ 2020-01-24  9:26 ` Greg Kroah-Hartman
  2020-01-24  9:26 ` [PATCH 4.19 234/639] mmc: sdhci-brcmstb: handle mmc_of_parse() errors during probe Greg Kroah-Hartman
                   ` (409 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:26 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Trond Myklebust, Sasha Levin

From: Trond Myklebust <trond.myklebust@hammerspace.com>

[ Upstream commit 5085607d209102b37b169bc94d0aa39566a9842a ]

If a bulk layout recall or a metadata server reboot coincides with a
umount, then holding a reference to an inode is unsafe unless we
also hold a reference to the super block.

Fixes: fd9a8d7160937 ("NFSv4.1: Fix bulk recall and destroy of layouts")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/nfs/pnfs.c | 33 +++++++++++++++++++++++----------
 fs/nfs/pnfs.h |  1 +
 2 files changed, 24 insertions(+), 10 deletions(-)

diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
index c818f9886f618..66f699e18755c 100644
--- a/fs/nfs/pnfs.c
+++ b/fs/nfs/pnfs.c
@@ -758,22 +758,35 @@ static int
 pnfs_layout_bulk_destroy_byserver_locked(struct nfs_client *clp,
 		struct nfs_server *server,
 		struct list_head *layout_list)
+	__must_hold(&clp->cl_lock)
+	__must_hold(RCU)
 {
 	struct pnfs_layout_hdr *lo, *next;
 	struct inode *inode;
 
 	list_for_each_entry_safe(lo, next, &server->layouts, plh_layouts) {
-		if (test_bit(NFS_LAYOUT_INVALID_STID, &lo->plh_flags))
+		if (test_bit(NFS_LAYOUT_INVALID_STID, &lo->plh_flags) ||
+		    test_bit(NFS_LAYOUT_INODE_FREEING, &lo->plh_flags) ||
+		    !list_empty(&lo->plh_bulk_destroy))
 			continue;
+		/* If the sb is being destroyed, just bail */
+		if (!nfs_sb_active(server->super))
+			break;
 		inode = igrab(lo->plh_inode);
-		if (inode == NULL)
-			continue;
-		list_del_init(&lo->plh_layouts);
-		if (pnfs_layout_add_bulk_destroy_list(inode, layout_list))
-			continue;
-		rcu_read_unlock();
-		spin_unlock(&clp->cl_lock);
-		iput(inode);
+		if (inode != NULL) {
+			list_del_init(&lo->plh_layouts);
+			if (pnfs_layout_add_bulk_destroy_list(inode,
+						layout_list))
+				continue;
+			rcu_read_unlock();
+			spin_unlock(&clp->cl_lock);
+			iput(inode);
+		} else {
+			rcu_read_unlock();
+			spin_unlock(&clp->cl_lock);
+			set_bit(NFS_LAYOUT_INODE_FREEING, &lo->plh_flags);
+		}
+		nfs_sb_deactive(server->super);
 		spin_lock(&clp->cl_lock);
 		rcu_read_lock();
 		return -EAGAIN;
@@ -811,7 +824,7 @@ pnfs_layout_free_bulk_destroy_list(struct list_head *layout_list,
 		/* Free all lsegs that are attached to commit buckets */
 		nfs_commit_inode(inode, 0);
 		pnfs_put_layout_hdr(lo);
-		iput(inode);
+		nfs_iput_and_deactive(inode);
 	}
 	return ret;
 }
diff --git a/fs/nfs/pnfs.h b/fs/nfs/pnfs.h
index ece367ebde692..3ba44819a88ae 100644
--- a/fs/nfs/pnfs.h
+++ b/fs/nfs/pnfs.h
@@ -104,6 +104,7 @@ enum {
 	NFS_LAYOUT_RETURN_REQUESTED,	/* Return this layout ASAP */
 	NFS_LAYOUT_INVALID_STID,	/* layout stateid id is invalid */
 	NFS_LAYOUT_FIRST_LAYOUTGET,	/* Serialize first layoutget */
+	NFS_LAYOUT_INODE_FREEING,	/* The inode is being freed */
 };
 
 enum layoutdriver_policy_flags {
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 234/639] mmc: sdhci-brcmstb: handle mmc_of_parse() errors during probe
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (232 preceding siblings ...)
  2020-01-24  9:26 ` [PATCH 4.19 233/639] NFS/pnfs: Bulk destroy of layouts needs to be safe w.r.t. umount Greg Kroah-Hartman
@ 2020-01-24  9:26 ` Greg Kroah-Hartman
  2020-01-24  9:26 ` [PATCH 4.19 235/639] iommu: Fix IOMMU debugfs fallout Greg Kroah-Hartman
                   ` (408 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:26 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Stefan Wahren, Ulf Hansson, Sasha Levin

From: Stefan Wahren <stefan.wahren@i2se.com>

[ Upstream commit 1e20186e706da8446f9435f2924cd65ab1397e73 ]

We need to handle mmc_of_parse() errors during probe otherwise the
MMC driver could start without proper initialization (e.g. power sequence).

Fixes: 476bf3d62d5c ("mmc: sdhci-brcmstb: Add driver for Broadcom BRCMSTB SoCs")
Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mmc/host/sdhci-brcmstb.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/mmc/host/sdhci-brcmstb.c b/drivers/mmc/host/sdhci-brcmstb.c
index 552bddc5096ce..1cd10356fc14f 100644
--- a/drivers/mmc/host/sdhci-brcmstb.c
+++ b/drivers/mmc/host/sdhci-brcmstb.c
@@ -55,7 +55,9 @@ static int sdhci_brcmstb_probe(struct platform_device *pdev)
 	}
 
 	sdhci_get_of_property(pdev);
-	mmc_of_parse(host->mmc);
+	res = mmc_of_parse(host->mmc);
+	if (res)
+		goto err;
 
 	/*
 	 * Supply the existing CAPS, but clear the UHS modes. This
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 235/639] iommu: Fix IOMMU debugfs fallout
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (233 preceding siblings ...)
  2020-01-24  9:26 ` [PATCH 4.19 234/639] mmc: sdhci-brcmstb: handle mmc_of_parse() errors during probe Greg Kroah-Hartman
@ 2020-01-24  9:26 ` Greg Kroah-Hartman
  2020-01-24  9:26 ` [PATCH 4.19 236/639] ARM: 8847/1: pm: fix HYP/SVC mode mismatch when MCPM is used Greg Kroah-Hartman
                   ` (407 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:26 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Geert Uytterhoeven, Gary R Hook,
	Joerg Roedel, Sasha Levin

From: Geert Uytterhoeven <geert+renesas@glider.be>

[ Upstream commit 18b3af4492a0aa6046b86d712f6ba4cbb66100fb ]

A change made in the final version of IOMMU debugfs support replaced the
public function iommu_debugfs_new_driver_dir() by the public dentry
iommu_debugfs_dir in <linux/iommu.h>, but forgot to update both the
implementation in iommu-debugfs.c, and the patch description.

Fix this by exporting iommu_debugfs_dir, and removing the reference to
and implementation of iommu_debugfs_new_driver_dir().

Fixes: bad614b24293ae46 ("iommu: Enable debugfs exposure of IOMMU driver internals")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Acked-by: Gary R Hook <gary.hook@amd.com>
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iommu/iommu-debugfs.c | 23 ++++-------------------
 1 file changed, 4 insertions(+), 19 deletions(-)

diff --git a/drivers/iommu/iommu-debugfs.c b/drivers/iommu/iommu-debugfs.c
index 3b1bf88fd1b04..f035489420964 100644
--- a/drivers/iommu/iommu-debugfs.c
+++ b/drivers/iommu/iommu-debugfs.c
@@ -12,6 +12,7 @@
 #include <linux/debugfs.h>
 
 struct dentry *iommu_debugfs_dir;
+EXPORT_SYMBOL_GPL(iommu_debugfs_dir);
 
 /**
  * iommu_debugfs_setup - create the top-level iommu directory in debugfs
@@ -23,9 +24,9 @@ struct dentry *iommu_debugfs_dir;
  * Emit a strong warning at boot time to indicate that this feature is
  * enabled.
  *
- * This function is called from iommu_init; drivers may then call
- * iommu_debugfs_new_driver_dir() to instantiate a vendor-specific
- * directory to be used to expose internal data.
+ * This function is called from iommu_init; drivers may then use
+ * iommu_debugfs_dir to instantiate a vendor-specific directory to be used
+ * to expose internal data.
  */
 void iommu_debugfs_setup(void)
 {
@@ -48,19 +49,3 @@ void iommu_debugfs_setup(void)
 		pr_warn("*************************************************************\n");
 	}
 }
-
-/**
- * iommu_debugfs_new_driver_dir - create a vendor directory under debugfs/iommu
- * @vendor: name of the vendor-specific subdirectory to create
- *
- * This function is called by an IOMMU driver to create the top-level debugfs
- * directory for that driver.
- *
- * Return: upon success, a pointer to the dentry for the new directory.
- *         NULL in case of failure.
- */
-struct dentry *iommu_debugfs_new_driver_dir(const char *vendor)
-{
-	return debugfs_create_dir(vendor, iommu_debugfs_dir);
-}
-EXPORT_SYMBOL_GPL(iommu_debugfs_new_driver_dir);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 236/639] ARM: 8847/1: pm: fix HYP/SVC mode mismatch when MCPM is used
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (234 preceding siblings ...)
  2020-01-24  9:26 ` [PATCH 4.19 235/639] iommu: Fix IOMMU debugfs fallout Greg Kroah-Hartman
@ 2020-01-24  9:26 ` Greg Kroah-Hartman
  2020-01-24  9:26 ` [PATCH 4.19 237/639] ARM: 8848/1: virt: Align GIC version check with arm64 counterpart Greg Kroah-Hartman
                   ` (406 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:26 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Marek Szyprowski, Nicolas Pitre,
	Anand Moon, Russell King, Sasha Levin

From: Marek Szyprowski <m.szyprowski@samsung.com>

[ Upstream commit ca70ea43f80c98582f5ffbbd1e6f4da2742da0c4 ]

MCPM does a soft reset of the CPUs and uses common cpu_resume() routine to
perform low-level platform initialization. This results in a try to install
HYP stubs for the second time for each CPU and results in false HYP/SVC
mode mismatch detection. The HYP stubs are already installed at the
beginning of the kernel initialization on the boot CPU (head.S) or in the
secondary_startup() for other CPUs. To fix this issue MCPM code should use
a cpu_resume() routine without HYP stubs installation.

This change fixes HYP/SVC mode mismatch on Samsung Exynos5422-based Odroid
XU3/XU4/HC1 boards.

Fixes: 3721924c8154 ("ARM: 8081/1: MCPM: provide infrastructure to allow for MCPM loopback")
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Acked-by: Nicolas Pitre <nico@linaro.org>
Tested-by: Anand Moon <linux.amoon@gmail.com>
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/common/mcpm_entry.c   |  2 +-
 arch/arm/include/asm/suspend.h |  1 +
 arch/arm/kernel/sleep.S        | 12 ++++++++++++
 3 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/arch/arm/common/mcpm_entry.c b/arch/arm/common/mcpm_entry.c
index ad574d20415c2..1b1b82b37ce03 100644
--- a/arch/arm/common/mcpm_entry.c
+++ b/arch/arm/common/mcpm_entry.c
@@ -381,7 +381,7 @@ static int __init nocache_trampoline(unsigned long _arg)
 	unsigned int cluster = MPIDR_AFFINITY_LEVEL(mpidr, 1);
 	phys_reset_t phys_reset;
 
-	mcpm_set_entry_vector(cpu, cluster, cpu_resume);
+	mcpm_set_entry_vector(cpu, cluster, cpu_resume_no_hyp);
 	setup_mm_for_reboot();
 
 	__mcpm_cpu_going_down(cpu, cluster);
diff --git a/arch/arm/include/asm/suspend.h b/arch/arm/include/asm/suspend.h
index 452bbdcbcc835..506314265c6f1 100644
--- a/arch/arm/include/asm/suspend.h
+++ b/arch/arm/include/asm/suspend.h
@@ -10,6 +10,7 @@ struct sleep_save_sp {
 };
 
 extern void cpu_resume(void);
+extern void cpu_resume_no_hyp(void);
 extern void cpu_resume_arm(void);
 extern int cpu_suspend(unsigned long, int (*)(unsigned long));
 
diff --git a/arch/arm/kernel/sleep.S b/arch/arm/kernel/sleep.S
index a8257fc9cf2a9..5dc8b80bb6938 100644
--- a/arch/arm/kernel/sleep.S
+++ b/arch/arm/kernel/sleep.S
@@ -120,6 +120,14 @@ ENDPROC(cpu_resume_after_mmu)
 	.text
 	.align
 
+#ifdef CONFIG_MCPM
+	.arm
+THUMB(	.thumb			)
+ENTRY(cpu_resume_no_hyp)
+ARM_BE8(setend be)			@ ensure we are in BE mode
+	b	no_hyp
+#endif
+
 #ifdef CONFIG_MMU
 	.arm
 ENTRY(cpu_resume_arm)
@@ -135,6 +143,7 @@ ARM_BE8(setend be)			@ ensure we are in BE mode
 	bl	__hyp_stub_install_secondary
 #endif
 	safe_svcmode_maskall r1
+no_hyp:
 	mov	r1, #0
 	ALT_SMP(mrc p15, 0, r0, c0, c0, 5)
 	ALT_UP_B(1f)
@@ -163,6 +172,9 @@ ENDPROC(cpu_resume)
 
 #ifdef CONFIG_MMU
 ENDPROC(cpu_resume_arm)
+#endif
+#ifdef CONFIG_MCPM
+ENDPROC(cpu_resume_no_hyp)
 #endif
 
 	.align 2
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 237/639] ARM: 8848/1: virt: Align GIC version check with arm64 counterpart
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (235 preceding siblings ...)
  2020-01-24  9:26 ` [PATCH 4.19 236/639] ARM: 8847/1: pm: fix HYP/SVC mode mismatch when MCPM is used Greg Kroah-Hartman
@ 2020-01-24  9:26 ` Greg Kroah-Hartman
  2020-01-24  9:26 ` [PATCH 4.19 238/639] ARM: 8849/1: NOMMU: Fix encodings for PMSAv8s PRBAR4/PRLAR4 Greg Kroah-Hartman
                   ` (405 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:26 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Vladimir Murzin, Marc Zyngier,
	Russell King, Sasha Levin

From: Vladimir Murzin <vladimir.murzin@arm.com>

[ Upstream commit 9db043d36bd379f4cc99054c079de0dabfc38d03 ]

arm64 has got relaxation on GIC version check at early boot stage due
to update of the GIC architecture let's align ARM with that.

To help backports (even though the code was correct at the time of writing)
Fixes: e59941b9b381 ("ARM: 8527/1: virt: enable GICv3 system registers")
Signed-off-by: Vladimir Murzin <vladimir.murzin@arm.com>
Reviewed-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/kernel/hyp-stub.S | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm/kernel/hyp-stub.S b/arch/arm/kernel/hyp-stub.S
index 60146e32619a5..82a942894fc04 100644
--- a/arch/arm/kernel/hyp-stub.S
+++ b/arch/arm/kernel/hyp-stub.S
@@ -180,8 +180,8 @@ ARM_BE8(orr	r7, r7, #(1 << 25))     @ HSCTLR.EE
 	@ Check whether GICv3 system registers are available
 	mrc	p15, 0, r7, c0, c1, 1	@ ID_PFR1
 	ubfx	r7, r7, #28, #4
-	cmp	r7, #1
-	bne	2f
+	teq	r7, #0
+	beq	2f
 
 	@ Enable system register accesses
 	mrc	p15, 4, r7, c12, c9, 5	@ ICC_HSRE
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 238/639] ARM: 8849/1: NOMMU: Fix encodings for PMSAv8s PRBAR4/PRLAR4
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (236 preceding siblings ...)
  2020-01-24  9:26 ` [PATCH 4.19 237/639] ARM: 8848/1: virt: Align GIC version check with arm64 counterpart Greg Kroah-Hartman
@ 2020-01-24  9:26 ` Greg Kroah-Hartman
  2020-01-24  9:26 ` [PATCH 4.19 239/639] regulator: wm831x-dcdc: Fix list of wm831x_dcdc_ilim from mA to uA Greg Kroah-Hartman
                   ` (404 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:26 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Vladimir Murzin, Russell King, Sasha Levin

From: Vladimir Murzin <vladimir.murzin@arm.com>

[ Upstream commit d410a8a49e3e00e07d43037e90f776d522b25a6a ]

To access PRBARn, where n is referenced as a binary number:

MRC p15, 0, <Rt>, c6, c8+n[3:1], 4*n[0] ; Read PRBARn into Rt
MCR p15, 0, <Rt>, c6, c8+n[3:1], 4*n[0] ; Write Rt into PRBARn

To access PRLARn, where n is referenced as a binary number:

MRC p15, 0, <Rt>, c6, c8+n[3:1], 4*n[0]+1 ; Read PRLARn into Rt
MCR p15, 0, <Rt>, c6, c8+n[3:1], 4*n[0]+1 ; Write Rt into PRLARn

For PR{B,L}AR4, n is 4, n[0] is 0, n[3:1] is 2, while current encoding
done with n[0] set to 1 which is wrong. Use proper encoding instead.

Fixes: 046835b4aa22b9ab6aa0bb274e3b71047c4b887d ("ARM: 8757/1: NOMMU: Support PMSAv8 MPU")
Signed-off-by: Vladimir Murzin <vladimir.murzin@arm.com>
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/kernel/head-nommu.S | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm/kernel/head-nommu.S b/arch/arm/kernel/head-nommu.S
index 326a97aa3ea0c..22efcf48604cd 100644
--- a/arch/arm/kernel/head-nommu.S
+++ b/arch/arm/kernel/head-nommu.S
@@ -441,8 +441,8 @@ M_CLASS(str	r6, [r12, #PMSAv8_RLAR_A(3)])
 	str	r5, [r12, #PMSAv8_RBAR_A(0)]
 	str	r6, [r12, #PMSAv8_RLAR_A(0)]
 #else
-	mcr	p15, 0, r5, c6, c10, 1			@ PRBAR4
-	mcr	p15, 0, r6, c6, c10, 2			@ PRLAR4
+	mcr	p15, 0, r5, c6, c10, 0			@ PRBAR4
+	mcr	p15, 0, r6, c6, c10, 1			@ PRLAR4
 #endif
 #endif
 	ret	lr
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 239/639] regulator: wm831x-dcdc: Fix list of wm831x_dcdc_ilim from mA to uA
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (237 preceding siblings ...)
  2020-01-24  9:26 ` [PATCH 4.19 238/639] ARM: 8849/1: NOMMU: Fix encodings for PMSAv8s PRBAR4/PRLAR4 Greg Kroah-Hartman
@ 2020-01-24  9:26 ` Greg Kroah-Hartman
  2020-01-24  9:26 ` [PATCH 4.19 240/639] ath10k: Fix length of wmi tlv command for protected mgmt frames Greg Kroah-Hartman
                   ` (403 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:26 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Axel Lin, Charles Keepax, Mark Brown,
	Sasha Levin

From: Axel Lin <axel.lin@ingics.com>

[ Upstream commit c25d47888f0fb3d836d68322d4aea2caf31a75a6 ]

The wm831x_dcdc_ilim entries needs to be uA because it is used to compare
with min_uA and max_uA.
While at it also make the array const and change to use unsigned int.

Fixes: e4ee831f949a ("regulator: Add WM831x DC-DC buck convertor support")
Signed-off-by: Axel Lin <axel.lin@ingics.com>
Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/regulator/wm831x-dcdc.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/regulator/wm831x-dcdc.c b/drivers/regulator/wm831x-dcdc.c
index 5a5bc4bb08d26..df591435d12a3 100644
--- a/drivers/regulator/wm831x-dcdc.c
+++ b/drivers/regulator/wm831x-dcdc.c
@@ -327,8 +327,8 @@ static int wm831x_buckv_get_voltage_sel(struct regulator_dev *rdev)
 }
 
 /* Current limit options */
-static u16 wm831x_dcdc_ilim[] = {
-	125, 250, 375, 500, 625, 750, 875, 1000
+static const unsigned int wm831x_dcdc_ilim[] = {
+	125000, 250000, 375000, 500000, 625000, 750000, 875000, 1000000
 };
 
 static int wm831x_buckv_set_current_limit(struct regulator_dev *rdev,
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 240/639] ath10k: Fix length of wmi tlv command for protected mgmt frames
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (238 preceding siblings ...)
  2020-01-24  9:26 ` [PATCH 4.19 239/639] regulator: wm831x-dcdc: Fix list of wm831x_dcdc_ilim from mA to uA Greg Kroah-Hartman
@ 2020-01-24  9:26 ` Greg Kroah-Hartman
  2020-01-24  9:26 ` [PATCH 4.19 241/639] netfilter: nft_set_hash: fix lookups with fixed size hash on big endian Greg Kroah-Hartman
                   ` (402 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:26 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Surabhi Vishnoi, Kalle Valo, Sasha Levin

From: Surabhi Vishnoi <svishnoi@codeaurora.org>

[ Upstream commit 761156ff573d1002983416e4fd1fe8d3489c4bd8 ]

The length of wmi tlv command for management tx send is calculated
incorrectly in case of protected management frames as there is addition
of IEEE80211_CCMP_MIC_LEN twice. This leads to improper behaviour of
firmware as the wmi tlv mgmt tx send command for protected mgmt frames
is formed wrongly.

Fix the length calculation of wmi tlv command for mgmt tx send in case
of protected management frames by adding the IEEE80211_CCMP_MIC_LEN only
once.

Tested HW: WCN3990
Tested FW: WLAN.HL.3.1-00784-QCAHLSWMTPLZ-1

Fixes: 1807da49733e "ath10k: wmi: add management tx by reference support over wmi"
Signed-off-by: Surabhi Vishnoi <svishnoi@codeaurora.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath10k/wmi-tlv.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/drivers/net/wireless/ath/ath10k/wmi-tlv.c b/drivers/net/wireless/ath/ath10k/wmi-tlv.c
index cdc1e64d52ad5..a90990b8008de 100644
--- a/drivers/net/wireless/ath/ath10k/wmi-tlv.c
+++ b/drivers/net/wireless/ath/ath10k/wmi-tlv.c
@@ -2692,10 +2692,8 @@ ath10k_wmi_tlv_op_gen_mgmt_tx_send(struct ath10k *ar, struct sk_buff *msdu,
 	if ((ieee80211_is_action(hdr->frame_control) ||
 	     ieee80211_is_deauth(hdr->frame_control) ||
 	     ieee80211_is_disassoc(hdr->frame_control)) &&
-	     ieee80211_has_protected(hdr->frame_control)) {
-		len += IEEE80211_CCMP_MIC_LEN;
+	     ieee80211_has_protected(hdr->frame_control))
 		buf_len += IEEE80211_CCMP_MIC_LEN;
-	}
 
 	buf_len = min_t(u32, buf_len, WMI_TLV_MGMT_TX_FRAME_MAX_LEN);
 	buf_len = round_up(buf_len, 4);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 241/639] netfilter: nft_set_hash: fix lookups with fixed size hash on big endian
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (239 preceding siblings ...)
  2020-01-24  9:26 ` [PATCH 4.19 240/639] ath10k: Fix length of wmi tlv command for protected mgmt frames Greg Kroah-Hartman
@ 2020-01-24  9:26 ` Greg Kroah-Hartman
  2020-01-24  9:26 ` [PATCH 4.19 242/639] netfilter: nft_set_hash: bogus element self comparison from deactivation path Greg Kroah-Hartman
                   ` (401 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:26 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Florian Westphal, Pablo Neira Ayuso,
	Sasha Levin

From: Pablo Neira Ayuso <pablo@netfilter.org>

[ Upstream commit 3b02b0adc242a72b5e46019b6a9e4f84823592f6 ]

Call jhash_1word() for the 4-bytes key case from the insertion and
deactivation path, otherwise big endian arch set lookups fail.

Fixes: 446a8268b7f5 ("netfilter: nft_set_hash: add lookup variant for fixed size hashtable")
Reported-by: Florian Westphal <fw@strlen.de>
Tested-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/netfilter/nft_set_hash.c | 23 +++++++++++++++++++----
 1 file changed, 19 insertions(+), 4 deletions(-)

diff --git a/net/netfilter/nft_set_hash.c b/net/netfilter/nft_set_hash.c
index 015124e649cbd..8dde4bfe8b8a4 100644
--- a/net/netfilter/nft_set_hash.c
+++ b/net/netfilter/nft_set_hash.c
@@ -488,6 +488,23 @@ static bool nft_hash_lookup_fast(const struct net *net,
 	return false;
 }
 
+static u32 nft_jhash(const struct nft_set *set, const struct nft_hash *priv,
+		     const struct nft_set_ext *ext)
+{
+	const struct nft_data *key = nft_set_ext_key(ext);
+	u32 hash, k1;
+
+	if (set->klen == 4) {
+		k1 = *(u32 *)key;
+		hash = jhash_1word(k1, priv->seed);
+	} else {
+		hash = jhash(key, set->klen, priv->seed);
+	}
+	hash = reciprocal_scale(hash, priv->buckets);
+
+	return hash;
+}
+
 static int nft_hash_insert(const struct net *net, const struct nft_set *set,
 			   const struct nft_set_elem *elem,
 			   struct nft_set_ext **ext)
@@ -497,8 +514,7 @@ static int nft_hash_insert(const struct net *net, const struct nft_set *set,
 	u8 genmask = nft_genmask_next(net);
 	u32 hash;
 
-	hash = jhash(nft_set_ext_key(&this->ext), set->klen, priv->seed);
-	hash = reciprocal_scale(hash, priv->buckets);
+	hash = nft_jhash(set, priv, &this->ext);
 	hlist_for_each_entry(he, &priv->table[hash], node) {
 		if (!memcmp(nft_set_ext_key(&this->ext),
 			    nft_set_ext_key(&he->ext), set->klen) &&
@@ -537,8 +553,7 @@ static void *nft_hash_deactivate(const struct net *net,
 	u8 genmask = nft_genmask_next(net);
 	u32 hash;
 
-	hash = jhash(nft_set_ext_key(&this->ext), set->klen, priv->seed);
-	hash = reciprocal_scale(hash, priv->buckets);
+	hash = nft_jhash(set, priv, &this->ext);
 	hlist_for_each_entry(he, &priv->table[hash], node) {
 		if (!memcmp(nft_set_ext_key(&this->ext), &elem->key.val,
 			    set->klen) &&
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 242/639] netfilter: nft_set_hash: bogus element self comparison from deactivation path
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (240 preceding siblings ...)
  2020-01-24  9:26 ` [PATCH 4.19 241/639] netfilter: nft_set_hash: fix lookups with fixed size hash on big endian Greg Kroah-Hartman
@ 2020-01-24  9:26 ` Greg Kroah-Hartman
  2020-01-24  9:26 ` [PATCH 4.19 243/639] net: sched: act_csum: Fix csum calc for tagged packets Greg Kroah-Hartman
                   ` (400 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:26 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Florian Westphal, Pablo Neira Ayuso,
	Sasha Levin

From: Pablo Neira Ayuso <pablo@netfilter.org>

[ Upstream commit a01cbae57ec29b161d42ee1caa4ffffda5d519c2 ]

Use the element from the loop iteration, not the same element we want to
deactivate otherwise this branch always evaluates true.

Fixes: 6c03ae210ce3 ("netfilter: nft_set_hash: add non-resizable hashtable implementation")
Reported-by: Florian Westphal <fw@strlen.de>
Tested-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/netfilter/nft_set_hash.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/netfilter/nft_set_hash.c b/net/netfilter/nft_set_hash.c
index 8dde4bfe8b8a4..05118e03c3e48 100644
--- a/net/netfilter/nft_set_hash.c
+++ b/net/netfilter/nft_set_hash.c
@@ -555,7 +555,7 @@ static void *nft_hash_deactivate(const struct net *net,
 
 	hash = nft_jhash(set, priv, &this->ext);
 	hlist_for_each_entry(he, &priv->table[hash], node) {
-		if (!memcmp(nft_set_ext_key(&this->ext), &elem->key.val,
+		if (!memcmp(nft_set_ext_key(&he->ext), &elem->key.val,
 			    set->klen) &&
 		    nft_set_elem_active(&he->ext, genmask)) {
 			nft_set_elem_change_active(net, set, &he->ext);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 243/639] net: sched: act_csum: Fix csum calc for tagged packets
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (241 preceding siblings ...)
  2020-01-24  9:26 ` [PATCH 4.19 242/639] netfilter: nft_set_hash: bogus element self comparison from deactivation path Greg Kroah-Hartman
@ 2020-01-24  9:26 ` Greg Kroah-Hartman
  2020-01-24  9:26 ` [PATCH 4.19 244/639] hwrng: bcm2835 - fix probe as platform device Greg Kroah-Hartman
                   ` (399 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:26 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Eli Britstein, Jiri Pirko,
	David S. Miller, Sasha Levin

From: Eli Britstein <elibr@mellanox.com>

[ Upstream commit 2ecba2d1e45b24620a7c3df9531895cf68d5dec6 ]

The csum calculation is different for IPv4/6. For VLAN packets,
tc_skb_protocol returns the VLAN protocol rather than the packet's one
(e.g. IPv4/6), so csum is not calculated. Furthermore, VLAN may not be
stripped so csum is not calculated in this case too. Calculate the
csum for those cases.

Fixes: d8b9605d2697 ("net: sched: fix skb->protocol use in case of accelerated vlan path")
Signed-off-by: Eli Britstein <elibr@mellanox.com>
Signed-off-by: Jiri Pirko <jiri@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/sched/act_csum.c | 31 +++++++++++++++++++++++++++++--
 1 file changed, 29 insertions(+), 2 deletions(-)

diff --git a/net/sched/act_csum.c b/net/sched/act_csum.c
index 1e269441065a6..9ecbf8edcf390 100644
--- a/net/sched/act_csum.c
+++ b/net/sched/act_csum.c
@@ -560,8 +560,11 @@ static int tcf_csum_act(struct sk_buff *skb, const struct tc_action *a,
 			struct tcf_result *res)
 {
 	struct tcf_csum *p = to_tcf_csum(a);
+	bool orig_vlan_tag_present = false;
+	unsigned int vlan_hdr_count = 0;
 	struct tcf_csum_params *params;
 	u32 update_flags;
+	__be16 protocol;
 	int action;
 
 	params = rcu_dereference_bh(p->params);
@@ -574,7 +577,9 @@ static int tcf_csum_act(struct sk_buff *skb, const struct tc_action *a,
 		goto drop;
 
 	update_flags = params->update_flags;
-	switch (tc_skb_protocol(skb)) {
+	protocol = tc_skb_protocol(skb);
+again:
+	switch (protocol) {
 	case cpu_to_be16(ETH_P_IP):
 		if (!tcf_csum_ipv4(skb, update_flags))
 			goto drop;
@@ -583,13 +588,35 @@ static int tcf_csum_act(struct sk_buff *skb, const struct tc_action *a,
 		if (!tcf_csum_ipv6(skb, update_flags))
 			goto drop;
 		break;
+	case cpu_to_be16(ETH_P_8021AD): /* fall through */
+	case cpu_to_be16(ETH_P_8021Q):
+		if (skb_vlan_tag_present(skb) && !orig_vlan_tag_present) {
+			protocol = skb->protocol;
+			orig_vlan_tag_present = true;
+		} else {
+			struct vlan_hdr *vlan = (struct vlan_hdr *)skb->data;
+
+			protocol = vlan->h_vlan_encapsulated_proto;
+			skb_pull(skb, VLAN_HLEN);
+			skb_reset_network_header(skb);
+			vlan_hdr_count++;
+		}
+		goto again;
+	}
+
+out:
+	/* Restore the skb for the pulled VLAN tags */
+	while (vlan_hdr_count--) {
+		skb_push(skb, VLAN_HLEN);
+		skb_reset_network_header(skb);
 	}
 
 	return action;
 
 drop:
 	qstats_drop_inc(this_cpu_ptr(p->common.cpu_qstats));
-	return TC_ACT_SHOT;
+	action = TC_ACT_SHOT;
+	goto out;
 }
 
 static int tcf_csum_dump(struct sk_buff *skb, struct tc_action *a, int bind,
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 244/639] hwrng: bcm2835 - fix probe as platform device
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (242 preceding siblings ...)
  2020-01-24  9:26 ` [PATCH 4.19 243/639] net: sched: act_csum: Fix csum calc for tagged packets Greg Kroah-Hartman
@ 2020-01-24  9:26 ` Greg Kroah-Hartman
  2020-01-24  9:26 ` [PATCH 4.19 245/639] iommu/vt-d: Fix NULL pointer reference in intel_svm_bind_mm() Greg Kroah-Hartman
                   ` (398 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:26 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jonas Gorski, Florian Fainelli,
	Herbert Xu, Sasha Levin

From: Jonas Gorski <jonas.gorski@gmail.com>

[ Upstream commit 984798de671a927ac73da31096a150df42e6aaf3 ]

BCM63XX (MIPS) does not use device tree, so there cannot be any
of_device_id, causing the driver to fail on probe:

[    0.904564] bcm2835-rng: probe of bcm63xx-rng failed with error -22

Fix this by checking for match data only if we are probing from device
tree.

Fixes: 8705f24f7b57 ("hwrng: bcm2835 - Enable BCM2835 RNG to work on BCM63xx platforms")
Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
Acked-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/char/hw_random/bcm2835-rng.c | 18 ++++++++++--------
 1 file changed, 10 insertions(+), 8 deletions(-)

diff --git a/drivers/char/hw_random/bcm2835-rng.c b/drivers/char/hw_random/bcm2835-rng.c
index 6767d965c36c5..19bde680aee1d 100644
--- a/drivers/char/hw_random/bcm2835-rng.c
+++ b/drivers/char/hw_random/bcm2835-rng.c
@@ -171,14 +171,16 @@ static int bcm2835_rng_probe(struct platform_device *pdev)
 	priv->rng.read = bcm2835_rng_read;
 	priv->rng.cleanup = bcm2835_rng_cleanup;
 
-	rng_id = of_match_node(bcm2835_rng_of_match, np);
-	if (!rng_id)
-		return -EINVAL;
-
-	/* Check for rng init function, execute it */
-	of_data = rng_id->data;
-	if (of_data)
-		priv->mask_interrupts = of_data->mask_interrupts;
+	if (dev_of_node(dev)) {
+		rng_id = of_match_node(bcm2835_rng_of_match, np);
+		if (!rng_id)
+			return -EINVAL;
+
+		/* Check for rng init function, execute it */
+		of_data = rng_id->data;
+		if (of_data)
+			priv->mask_interrupts = of_data->mask_interrupts;
+	}
 
 	/* register driver */
 	err = devm_hwrng_register(dev, &priv->rng);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 245/639] iommu/vt-d: Fix NULL pointer reference in intel_svm_bind_mm()
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (243 preceding siblings ...)
  2020-01-24  9:26 ` [PATCH 4.19 244/639] hwrng: bcm2835 - fix probe as platform device Greg Kroah-Hartman
@ 2020-01-24  9:26 ` Greg Kroah-Hartman
  2020-01-24  9:26 ` [PATCH 4.19 246/639] NFS: Add missing encode / decode sequence_maxsz to v4.2 operations Greg Kroah-Hartman
                   ` (397 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:26 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ashok Raj, Jacob Pan, Dave Jiang,
	Lu Baolu, Joerg Roedel, Sasha Levin

From: Lu Baolu <baolu.lu@linux.intel.com>

[ Upstream commit c56cba5daf45d2d091ef1cfe2f1d6a930446687b ]

Intel IOMMU could be turned off with intel_iommu=off. If Intel
IOMMU is off,  the intel_iommu struct will not be initialized.
When device drivers call intel_svm_bind_mm(), the NULL pointer
reference will happen there.

Add dmar_disabled check to avoid NULL pointer reference.

Cc: Ashok Raj <ashok.raj@intel.com>
Cc: Jacob Pan <jacob.jun.pan@linux.intel.com>
Reported-by: Dave Jiang <dave.jiang@intel.com>
Fixes: 2f26e0a9c9860 ("iommu/vt-d: Add basic SVM PASID support")
Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iommu/intel-svm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/iommu/intel-svm.c b/drivers/iommu/intel-svm.c
index 188f4eaed6e59..fd8730b2cd46e 100644
--- a/drivers/iommu/intel-svm.c
+++ b/drivers/iommu/intel-svm.c
@@ -293,7 +293,7 @@ int intel_svm_bind_mm(struct device *dev, int *pasid, int flags, struct svm_dev_
 	int pasid_max;
 	int ret;
 
-	if (!iommu)
+	if (!iommu || dmar_disabled)
 		return -EINVAL;
 
 	if (dev_is_pci(dev)) {
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 246/639] NFS: Add missing encode / decode sequence_maxsz to v4.2 operations
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (244 preceding siblings ...)
  2020-01-24  9:26 ` [PATCH 4.19 245/639] iommu/vt-d: Fix NULL pointer reference in intel_svm_bind_mm() Greg Kroah-Hartman
@ 2020-01-24  9:26 ` Greg Kroah-Hartman
  2020-01-24  9:26 ` [PATCH 4.19 247/639] NFSv4/flexfiles: Fix invalid deref in FF_LAYOUT_DEVID_NODE() Greg Kroah-Hartman
                   ` (396 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:26 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Anna Schumaker, Trond Myklebust, Sasha Levin

From: Anna Schumaker <Anna.Schumaker@Netapp.com>

[ Upstream commit 1a3466aed3a17eed41cd9411f89eb637f58349b0 ]

These really should have been there from the beginning, but we never
noticed because there was enough slack in the RPC request for the extra
bytes. Chuck's recent patch to use au_cslack and au_rslack to compute
buffer size shrunk the buffer enough that this was now a problem for
SEEK operations on my test client.

Fixes: f4ac1674f5da4 ("nfs: Add ALLOCATE support")
Fixes: 2e72448b07dc3 ("NFS: Add COPY nfs operation")
Fixes: cb95deea0b4aa ("NFS OFFLOAD_CANCEL xdr")
Fixes: 624bd5b7b683c ("nfs: Add DEALLOCATE support")
Fixes: 1c6dcbe5ceff8 ("NFS: Implement SEEK")
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/nfs/nfs42xdr.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/fs/nfs/nfs42xdr.c b/fs/nfs/nfs42xdr.c
index 69f72ed2bf879..ec9803088f6b8 100644
--- a/fs/nfs/nfs42xdr.c
+++ b/fs/nfs/nfs42xdr.c
@@ -59,43 +59,53 @@
 #define decode_clone_maxsz		(op_decode_hdr_maxsz)
 
 #define NFS4_enc_allocate_sz		(compound_encode_hdr_maxsz + \
+					 encode_sequence_maxsz + \
 					 encode_putfh_maxsz + \
 					 encode_allocate_maxsz + \
 					 encode_getattr_maxsz)
 #define NFS4_dec_allocate_sz		(compound_decode_hdr_maxsz + \
+					 decode_sequence_maxsz + \
 					 decode_putfh_maxsz + \
 					 decode_allocate_maxsz + \
 					 decode_getattr_maxsz)
 #define NFS4_enc_copy_sz		(compound_encode_hdr_maxsz + \
+					 encode_sequence_maxsz + \
 					 encode_putfh_maxsz + \
 					 encode_savefh_maxsz + \
 					 encode_putfh_maxsz + \
 					 encode_copy_maxsz + \
 					 encode_commit_maxsz)
 #define NFS4_dec_copy_sz		(compound_decode_hdr_maxsz + \
+					 decode_sequence_maxsz + \
 					 decode_putfh_maxsz + \
 					 decode_savefh_maxsz + \
 					 decode_putfh_maxsz + \
 					 decode_copy_maxsz + \
 					 decode_commit_maxsz)
 #define NFS4_enc_offload_cancel_sz	(compound_encode_hdr_maxsz + \
+					 encode_sequence_maxsz + \
 					 encode_putfh_maxsz + \
 					 encode_offload_cancel_maxsz)
 #define NFS4_dec_offload_cancel_sz	(compound_decode_hdr_maxsz + \
+					 decode_sequence_maxsz + \
 					 decode_putfh_maxsz + \
 					 decode_offload_cancel_maxsz)
 #define NFS4_enc_deallocate_sz		(compound_encode_hdr_maxsz + \
+					 encode_sequence_maxsz + \
 					 encode_putfh_maxsz + \
 					 encode_deallocate_maxsz + \
 					 encode_getattr_maxsz)
 #define NFS4_dec_deallocate_sz		(compound_decode_hdr_maxsz + \
+					 decode_sequence_maxsz + \
 					 decode_putfh_maxsz + \
 					 decode_deallocate_maxsz + \
 					 decode_getattr_maxsz)
 #define NFS4_enc_seek_sz		(compound_encode_hdr_maxsz + \
+					 encode_sequence_maxsz + \
 					 encode_putfh_maxsz + \
 					 encode_seek_maxsz)
 #define NFS4_dec_seek_sz		(compound_decode_hdr_maxsz + \
+					 decode_sequence_maxsz + \
 					 decode_putfh_maxsz + \
 					 decode_seek_maxsz)
 #define NFS4_enc_layoutstats_sz		(compound_encode_hdr_maxsz + \
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 247/639] NFSv4/flexfiles: Fix invalid deref in FF_LAYOUT_DEVID_NODE()
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (245 preceding siblings ...)
  2020-01-24  9:26 ` [PATCH 4.19 246/639] NFS: Add missing encode / decode sequence_maxsz to v4.2 operations Greg Kroah-Hartman
@ 2020-01-24  9:26 ` Greg Kroah-Hartman
  2020-01-24  9:26 ` [PATCH 4.19 248/639] net: aquantia: fixed instack structure overflow Greg Kroah-Hartman
                   ` (395 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:26 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Trond Myklebust, Sasha Levin

From: Trond Myklebust <trond.myklebust@hammerspace.com>

[ Upstream commit 108bb4afd351d65826648a47f11fa3104e250d9b ]

If the attempt to instantiate the mirror's layout DS pointer failed,
then that pointer may hold a value of type ERR_PTR(), so we need
to check that before we dereference it.

Fixes: 65990d1afbd2d ("pNFS/flexfiles: Fix a deadlock on LAYOUTGET")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/nfs/flexfilelayout/flexfilelayout.h | 32 +++++++++++++++-----------
 1 file changed, 19 insertions(+), 13 deletions(-)

diff --git a/fs/nfs/flexfilelayout/flexfilelayout.h b/fs/nfs/flexfilelayout/flexfilelayout.h
index de50a342d5a50..2ac99124474cb 100644
--- a/fs/nfs/flexfilelayout/flexfilelayout.h
+++ b/fs/nfs/flexfilelayout/flexfilelayout.h
@@ -132,16 +132,6 @@ FF_LAYOUT_LSEG(struct pnfs_layout_segment *lseg)
 			    generic_hdr);
 }
 
-static inline struct nfs4_deviceid_node *
-FF_LAYOUT_DEVID_NODE(struct pnfs_layout_segment *lseg, u32 idx)
-{
-	if (idx >= FF_LAYOUT_LSEG(lseg)->mirror_array_cnt ||
-	    FF_LAYOUT_LSEG(lseg)->mirror_array[idx] == NULL ||
-	    FF_LAYOUT_LSEG(lseg)->mirror_array[idx]->mirror_ds == NULL)
-		return NULL;
-	return &FF_LAYOUT_LSEG(lseg)->mirror_array[idx]->mirror_ds->id_node;
-}
-
 static inline struct nfs4_ff_layout_ds *
 FF_LAYOUT_MIRROR_DS(struct nfs4_deviceid_node *node)
 {
@@ -151,9 +141,25 @@ FF_LAYOUT_MIRROR_DS(struct nfs4_deviceid_node *node)
 static inline struct nfs4_ff_layout_mirror *
 FF_LAYOUT_COMP(struct pnfs_layout_segment *lseg, u32 idx)
 {
-	if (idx >= FF_LAYOUT_LSEG(lseg)->mirror_array_cnt)
-		return NULL;
-	return FF_LAYOUT_LSEG(lseg)->mirror_array[idx];
+	struct nfs4_ff_layout_segment *fls = FF_LAYOUT_LSEG(lseg);
+
+	if (idx < fls->mirror_array_cnt)
+		return fls->mirror_array[idx];
+	return NULL;
+}
+
+static inline struct nfs4_deviceid_node *
+FF_LAYOUT_DEVID_NODE(struct pnfs_layout_segment *lseg, u32 idx)
+{
+	struct nfs4_ff_layout_mirror *mirror = FF_LAYOUT_COMP(lseg, idx);
+
+	if (mirror != NULL) {
+		struct nfs4_ff_layout_ds *mirror_ds = mirror->mirror_ds;
+
+		if (!IS_ERR_OR_NULL(mirror_ds))
+			return &mirror_ds->id_node;
+	}
+	return NULL;
 }
 
 static inline u32
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 248/639] net: aquantia: fixed instack structure overflow
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (246 preceding siblings ...)
  2020-01-24  9:26 ` [PATCH 4.19 247/639] NFSv4/flexfiles: Fix invalid deref in FF_LAYOUT_DEVID_NODE() Greg Kroah-Hartman
@ 2020-01-24  9:26 ` Greg Kroah-Hartman
  2020-01-24  9:26 ` [PATCH 4.19 249/639] powerpc/mm: Check secondary hash page table Greg Kroah-Hartman
                   ` (394 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:26 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Nikita Danilov, Igor Russkikh,
	David S. Miller, Sasha Levin

From: Igor Russkikh <Igor.Russkikh@aquantia.com>

[ Upstream commit 8006e3730b6e900319411e35cee85b4513d298df ]

This is a real stack undercorruption found by kasan build.

The issue did no harm normally because it only overflowed
2 bytes after `bitary` array which on most architectures
were mapped into `err` local.

Fixes: bab6de8fd180 ("net: ethernet: aquantia: Atlantic A0 and B0 specific functions.")
Signed-off-by: Nikita Danilov <nikita.danilov@aquantia.com>
Signed-off-by: Igor Russkikh <igor.russkikh@aquantia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c | 4 ++--
 drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c
index 97addfa6f8956..dab5891b97145 100644
--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c
+++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c
@@ -207,8 +207,8 @@ static int hw_atl_a0_hw_rss_set(struct aq_hw_s *self,
 	u32 i = 0U;
 	u32 num_rss_queues = max(1U, self->aq_nic_cfg->num_rss_queues);
 	int err = 0;
-	u16 bitary[(HW_ATL_A0_RSS_REDIRECTION_MAX *
-					HW_ATL_A0_RSS_REDIRECTION_BITS / 16U)];
+	u16 bitary[1 + (HW_ATL_A0_RSS_REDIRECTION_MAX *
+		   HW_ATL_A0_RSS_REDIRECTION_BITS / 16U)];
 
 	memset(bitary, 0, sizeof(bitary));
 
diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
index 51cd1f98bcf07..c4f914a29c385 100644
--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
+++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
@@ -192,8 +192,8 @@ static int hw_atl_b0_hw_rss_set(struct aq_hw_s *self,
 	u32 i = 0U;
 	u32 num_rss_queues = max(1U, self->aq_nic_cfg->num_rss_queues);
 	int err = 0;
-	u16 bitary[(HW_ATL_B0_RSS_REDIRECTION_MAX *
-					HW_ATL_B0_RSS_REDIRECTION_BITS / 16U)];
+	u16 bitary[1 + (HW_ATL_B0_RSS_REDIRECTION_MAX *
+		   HW_ATL_B0_RSS_REDIRECTION_BITS / 16U)];
 
 	memset(bitary, 0, sizeof(bitary));
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 249/639] powerpc/mm: Check secondary hash page table
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (247 preceding siblings ...)
  2020-01-24  9:26 ` [PATCH 4.19 248/639] net: aquantia: fixed instack structure overflow Greg Kroah-Hartman
@ 2020-01-24  9:26 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.19 250/639] media: dvb/earth-pt1: fix wrong initialization for demod blocks Greg Kroah-Hartman
                   ` (393 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:26 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Rashmica Gupta, Michael Ellerman,
	Sasha Levin

From: Rashmica Gupta <rashmica.g@gmail.com>

[ Upstream commit 790845e2f12709d273d08ea7a2af7c2593689519 ]

We were always calling base_hpte_find() with primary = true,
even when we wanted to check the secondary table.

mpe: I broke this when refactoring Rashmica's original patch.

Fixes: 1515ab932156 ("powerpc/mm: Dump hash table")
Signed-off-by: Rashmica Gupta <rashmica.g@gmail.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/mm/dump_hashpagetable.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/powerpc/mm/dump_hashpagetable.c b/arch/powerpc/mm/dump_hashpagetable.c
index 8692946950485..b430e4e08af69 100644
--- a/arch/powerpc/mm/dump_hashpagetable.c
+++ b/arch/powerpc/mm/dump_hashpagetable.c
@@ -342,7 +342,7 @@ static unsigned long hpte_find(struct pg_state *st, unsigned long ea, int psize)
 
 	/* Look in secondary table */
 	if (slot == -1)
-		slot = base_hpte_find(ea, psize, true, &v, &r);
+		slot = base_hpte_find(ea, psize, false, &v, &r);
 
 	/* No entry found */
 	if (slot == -1)
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 250/639] media: dvb/earth-pt1: fix wrong initialization for demod blocks
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (248 preceding siblings ...)
  2020-01-24  9:26 ` [PATCH 4.19 249/639] powerpc/mm: Check secondary hash page table Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.19 251/639] rbd: clear ->xferred on error from rbd_obj_issue_copyup() Greg Kroah-Hartman
                   ` (392 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Akihiro Tsukada, Sean Young,
	Mauro Carvalho Chehab, Sasha Levin

From: Akihiro Tsukada <tskd08@gmail.com>

[ Upstream commit 15d90a6ae98e6d2c68497b44a491cb9efbb98ab1 ]

earth-pt1 driver was decomposed/restructured by the commit b732539efdba
("media: dvb: earth-pt1: decompose pt1 driver into sub drivers"),
but it introduced a problem regarding concurrent streaming:
Opening a new terrestial stream stops the reception of an existing,
already-opened satellite stream.

The demod IC in earth-pt1 boards contains 2 pairs of terr. and sat. blocks,
supporting 4 concurrent demodulations, and the above problem was because
the config of a terr. block contained whole reset/init of the pair blocks,
thus each open() of a terrestrial frontend wrongly cleared the config of
its peer satellite block of the demod.
This whole/pair reset should be executed earlier and not on each open().

Fixes: b732539efdba ("media: dvb: earth-pt1: decompose pt1 driver into sub drivers")

Signed-off-by: Akihiro Tsukada <tskd08@gmail.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/pci/pt1/pt1.c | 54 ++++++++++++++++++++++++++++++++-----
 1 file changed, 48 insertions(+), 6 deletions(-)

diff --git a/drivers/media/pci/pt1/pt1.c b/drivers/media/pci/pt1/pt1.c
index 7f878fc41b7e6..93fecffb36ee7 100644
--- a/drivers/media/pci/pt1/pt1.c
+++ b/drivers/media/pci/pt1/pt1.c
@@ -200,16 +200,10 @@ static const u8 va1j5jf8007t_25mhz_configs[][2] = {
 static int config_demod(struct i2c_client *cl, enum pt1_fe_clk clk)
 {
 	int ret;
-	u8 buf[2] = {0x01, 0x80};
 	bool is_sat;
 	const u8 (*cfg_data)[2];
 	int i, len;
 
-	ret = i2c_master_send(cl, buf, 2);
-	if (ret < 0)
-		return ret;
-	usleep_range(30000, 50000);
-
 	is_sat = !strncmp(cl->name, TC90522_I2C_DEV_SAT,
 			  strlen(TC90522_I2C_DEV_SAT));
 	if (is_sat) {
@@ -260,6 +254,46 @@ static int config_demod(struct i2c_client *cl, enum pt1_fe_clk clk)
 	return 0;
 }
 
+/*
+ * Init registers for (each pair of) terrestrial/satellite block in demod.
+ * Note that resetting terr. block also resets its peer sat. block as well.
+ * This function must be called before configuring any demod block
+ * (before pt1_wakeup(), fe->ops.init()).
+ */
+static int pt1_demod_block_init(struct pt1 *pt1)
+{
+	struct i2c_client *cl;
+	u8 buf[2] = {0x01, 0x80};
+	int ret;
+	int i;
+
+	/* reset all terr. & sat. pairs first */
+	for (i = 0; i < PT1_NR_ADAPS; i++) {
+		cl = pt1->adaps[i]->demod_i2c_client;
+		if (strncmp(cl->name, TC90522_I2C_DEV_TER,
+			    strlen(TC90522_I2C_DEV_TER)))
+			continue;
+
+		ret = i2c_master_send(cl, buf, 2);
+		if (ret < 0)
+			return ret;
+		usleep_range(30000, 50000);
+	}
+
+	for (i = 0; i < PT1_NR_ADAPS; i++) {
+		cl = pt1->adaps[i]->demod_i2c_client;
+		if (strncmp(cl->name, TC90522_I2C_DEV_SAT,
+			    strlen(TC90522_I2C_DEV_SAT)))
+			continue;
+
+		ret = i2c_master_send(cl, buf, 2);
+		if (ret < 0)
+			return ret;
+		usleep_range(30000, 50000);
+	}
+	return 0;
+}
+
 static void pt1_write_reg(struct pt1 *pt1, int reg, u32 data)
 {
 	writel(data, pt1->regs + reg * 4);
@@ -987,6 +1021,10 @@ static int pt1_init_frontends(struct pt1 *pt1)
 			goto tuner_release;
 	}
 
+	ret = pt1_demod_block_init(pt1);
+	if (ret < 0)
+		goto fe_unregister;
+
 	return 0;
 
 tuner_release:
@@ -1245,6 +1283,10 @@ static int pt1_resume(struct device *dev)
 	pt1_update_power(pt1);
 	usleep_range(1000, 2000);
 
+	ret = pt1_demod_block_init(pt1);
+	if (ret < 0)
+		goto resume_err;
+
 	for (i = 0; i < PT1_NR_ADAPS; i++)
 		dvb_frontend_reinitialise(pt1->adaps[i]->fe);
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 251/639] rbd: clear ->xferred on error from rbd_obj_issue_copyup()
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (249 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.19 250/639] media: dvb/earth-pt1: fix wrong initialization for demod blocks Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.19 252/639] PCI: Fix "try" semantics of bus and slot reset Greg Kroah-Hartman
                   ` (391 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Ilya Dryomov, Sasha Levin

From: Ilya Dryomov <idryomov@gmail.com>

[ Upstream commit 356889c49d84f11f446ec235bd52ca1a7d581aa0 ]

Otherwise the assert in rbd_obj_end_request() is triggered.

Fixes: 3da691bf4366 ("rbd: new request handling code")
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/block/rbd.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
index 585378bc988cd..b942f4c8cea8c 100644
--- a/drivers/block/rbd.c
+++ b/drivers/block/rbd.c
@@ -2506,6 +2506,7 @@ again:
 		ret = rbd_obj_issue_copyup(obj_req, obj_req->xferred);
 		if (ret) {
 			obj_req->result = ret;
+			obj_req->xferred = 0;
 			return true;
 		}
 		return false;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 252/639] PCI: Fix "try" semantics of bus and slot reset
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (250 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.19 251/639] rbd: clear ->xferred on error from rbd_obj_issue_copyup() Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.19 253/639] nios2: ksyms: Add missing symbol exports Greg Kroah-Hartman
                   ` (390 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Alex Williamson, Bjorn Helgaas,
	Sinan Kaya, Sasha Levin

From: Alex Williamson <alex.williamson@redhat.com>

[ Upstream commit ddefc033eecf23f1e8b81d0663c5db965adf5516 ]

The commit referenced below introduced device locking around save and
restore of state for each device during a PCI bus "try" reset, making it
decidely non-"try" and prone to deadlock in the event that a device is
already locked.  Restore __pci_reset_bus() and __pci_reset_slot() to their
advertised locking semantics by pushing the save and restore functions into
the branch where the entire tree is already locked.  Extend the helper
function names with "_locked" and update the comment to reflect this
calling requirement.

Fixes: b014e96d1abb ("PCI: Protect pci_error_handlers->reset_notify() usage with device_lock()")
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Sinan Kaya <okaya@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/pci.c | 54 +++++++++++++++++++++++------------------------
 1 file changed, 26 insertions(+), 28 deletions(-)

diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index c9f51fc24563c..57a87a001b4f4 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -5039,39 +5039,42 @@ unlock:
 	return 0;
 }
 
-/* Save and disable devices from the top of the tree down */
-static void pci_bus_save_and_disable(struct pci_bus *bus)
+/*
+ * Save and disable devices from the top of the tree down while holding
+ * the @dev mutex lock for the entire tree.
+ */
+static void pci_bus_save_and_disable_locked(struct pci_bus *bus)
 {
 	struct pci_dev *dev;
 
 	list_for_each_entry(dev, &bus->devices, bus_list) {
-		pci_dev_lock(dev);
 		pci_dev_save_and_disable(dev);
-		pci_dev_unlock(dev);
 		if (dev->subordinate)
-			pci_bus_save_and_disable(dev->subordinate);
+			pci_bus_save_and_disable_locked(dev->subordinate);
 	}
 }
 
 /*
- * Restore devices from top of the tree down - parent bridges need to be
- * restored before we can get to subordinate devices.
+ * Restore devices from top of the tree down while holding @dev mutex lock
+ * for the entire tree.  Parent bridges need to be restored before we can
+ * get to subordinate devices.
  */
-static void pci_bus_restore(struct pci_bus *bus)
+static void pci_bus_restore_locked(struct pci_bus *bus)
 {
 	struct pci_dev *dev;
 
 	list_for_each_entry(dev, &bus->devices, bus_list) {
-		pci_dev_lock(dev);
 		pci_dev_restore(dev);
-		pci_dev_unlock(dev);
 		if (dev->subordinate)
-			pci_bus_restore(dev->subordinate);
+			pci_bus_restore_locked(dev->subordinate);
 	}
 }
 
-/* Save and disable devices from the top of the tree down */
-static void pci_slot_save_and_disable(struct pci_slot *slot)
+/*
+ * Save and disable devices from the top of the tree down while holding
+ * the @dev mutex lock for the entire tree.
+ */
+static void pci_slot_save_and_disable_locked(struct pci_slot *slot)
 {
 	struct pci_dev *dev;
 
@@ -5080,26 +5083,25 @@ static void pci_slot_save_and_disable(struct pci_slot *slot)
 			continue;
 		pci_dev_save_and_disable(dev);
 		if (dev->subordinate)
-			pci_bus_save_and_disable(dev->subordinate);
+			pci_bus_save_and_disable_locked(dev->subordinate);
 	}
 }
 
 /*
- * Restore devices from top of the tree down - parent bridges need to be
- * restored before we can get to subordinate devices.
+ * Restore devices from top of the tree down while holding @dev mutex lock
+ * for the entire tree.  Parent bridges need to be restored before we can
+ * get to subordinate devices.
  */
-static void pci_slot_restore(struct pci_slot *slot)
+static void pci_slot_restore_locked(struct pci_slot *slot)
 {
 	struct pci_dev *dev;
 
 	list_for_each_entry(dev, &slot->bus->devices, bus_list) {
 		if (!dev->slot || dev->slot != slot)
 			continue;
-		pci_dev_lock(dev);
 		pci_dev_restore(dev);
-		pci_dev_unlock(dev);
 		if (dev->subordinate)
-			pci_bus_restore(dev->subordinate);
+			pci_bus_restore_locked(dev->subordinate);
 	}
 }
 
@@ -5158,17 +5160,15 @@ static int __pci_reset_slot(struct pci_slot *slot)
 	if (rc)
 		return rc;
 
-	pci_slot_save_and_disable(slot);
-
 	if (pci_slot_trylock(slot)) {
+		pci_slot_save_and_disable_locked(slot);
 		might_sleep();
 		rc = pci_reset_hotplug_slot(slot->hotplug, 0);
+		pci_slot_restore_locked(slot);
 		pci_slot_unlock(slot);
 	} else
 		rc = -EAGAIN;
 
-	pci_slot_restore(slot);
-
 	return rc;
 }
 
@@ -5254,17 +5254,15 @@ static int __pci_reset_bus(struct pci_bus *bus)
 	if (rc)
 		return rc;
 
-	pci_bus_save_and_disable(bus);
-
 	if (pci_bus_trylock(bus)) {
+		pci_bus_save_and_disable_locked(bus);
 		might_sleep();
 		rc = pci_bridge_secondary_bus_reset(bus->self);
+		pci_bus_restore_locked(bus);
 		pci_bus_unlock(bus);
 	} else
 		rc = -EAGAIN;
 
-	pci_bus_restore(bus);
-
 	return rc;
 }
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 253/639] nios2: ksyms: Add missing symbol exports
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (251 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.19 252/639] PCI: Fix "try" semantics of bus and slot reset Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.19 254/639] x86/mm: Remove unused variable cpu Greg Kroah-Hartman
                   ` (389 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Guenter Roeck, Ley Foon Tan, Sasha Levin

From: Guenter Roeck <linux@roeck-us.net>

[ Upstream commit 0f8ed994575429d6042cf5d7ef70081c94091587 ]

Building nios2:allmodconfig fails as follows (each symbol is only listed
once).

ERROR: "__ashldi3" [drivers/md/dm-writecache.ko] undefined!
ERROR: "__ashrdi3" [fs/xfs/xfs.ko] undefined!
ERROR: "__ucmpdi2" [drivers/media/i2c/adv7842.ko] undefined!
ERROR: "__lshrdi3" [drivers/md/dm-zoned.ko] undefined!
ERROR: "flush_icache_range" [drivers/misc/lkdtm/lkdtm.ko] undefined!
ERROR: "empty_zero_page" [drivers/md/dm-mod.ko] undefined!

The problem is seen with gcc 7.3.0.

Export the missing symbols.

Fixes: 2fc8483fdcde ("nios2: Build infrastructure")
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Ley Foon Tan <ley.foon.tan@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/nios2/kernel/nios2_ksyms.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/arch/nios2/kernel/nios2_ksyms.c b/arch/nios2/kernel/nios2_ksyms.c
index bf2f55d10a4d8..4e704046a150c 100644
--- a/arch/nios2/kernel/nios2_ksyms.c
+++ b/arch/nios2/kernel/nios2_ksyms.c
@@ -9,12 +9,20 @@
 #include <linux/export.h>
 #include <linux/string.h>
 
+#include <asm/cacheflush.h>
+#include <asm/pgtable.h>
+
 /* string functions */
 
 EXPORT_SYMBOL(memcpy);
 EXPORT_SYMBOL(memset);
 EXPORT_SYMBOL(memmove);
 
+/* memory management */
+
+EXPORT_SYMBOL(empty_zero_page);
+EXPORT_SYMBOL(flush_icache_range);
+
 /*
  * libgcc functions - functions that are used internally by the
  * compiler...  (prototypes are not correct though, but that
@@ -31,3 +39,7 @@ DECLARE_EXPORT(__udivsi3);
 DECLARE_EXPORT(__umoddi3);
 DECLARE_EXPORT(__umodsi3);
 DECLARE_EXPORT(__muldi3);
+DECLARE_EXPORT(__ucmpdi2);
+DECLARE_EXPORT(__lshrdi3);
+DECLARE_EXPORT(__ashldi3);
+DECLARE_EXPORT(__ashrdi3);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 254/639] x86/mm: Remove unused variable cpu
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (252 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.19 253/639] nios2: ksyms: Add missing symbol exports Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.19 255/639] scsi: megaraid_sas: reduce module load time Greg Kroah-Hartman
                   ` (388 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Qian Cai, Thomas Gleixner,
	Andyt Lutomirski, dave.hansen, peterz, bp, hpa, Sasha Levin

From: Qian Cai <cai@lca.pw>

[ Upstream commit 3609e31bc8dc03b701390f79c74fc7fe92b95039 ]

The commit a2055abe9c67 ("x86/mm: Pass flush_tlb_info to
flush_tlb_others() etc") removed the unnecessary cpu parameter from
uv_flush_tlb_others() but left an unused variable.

arch/x86/mm/tlb.c: In function 'native_flush_tlb_others':
arch/x86/mm/tlb.c:688:16: warning: variable 'cpu' set but not used
[-Wunused-but-set-variable]
   unsigned int cpu;
                ^~~

Fixes: a2055abe9c67 ("x86/mm: Pass flush_tlb_info to flush_tlb_others() etc")
Signed-off-by: Qian Cai <cai@lca.pw>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Andyt Lutomirski <luto@kernel.org>
Cc: dave.hansen@linux.intel.com
Cc: peterz@infradead.org
Cc: bp@alien8.de
Cc: hpa@zytor.com
Link: https://lkml.kernel.org/r/20190228220155.88124-1-cai@lca.pw
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/mm/tlb.c | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/arch/x86/mm/tlb.c b/arch/x86/mm/tlb.c
index a6836ab0fcc73..b72296bd04a29 100644
--- a/arch/x86/mm/tlb.c
+++ b/arch/x86/mm/tlb.c
@@ -664,9 +664,6 @@ void native_flush_tlb_others(const struct cpumask *cpumask,
 		 * that UV should be updated so that smp_call_function_many(),
 		 * etc, are optimal on UV.
 		 */
-		unsigned int cpu;
-
-		cpu = smp_processor_id();
 		cpumask = uv_flush_tlb_others(cpumask, info);
 		if (cpumask)
 			smp_call_function_many(cpumask, flush_tlb_func_remote,
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 255/639] scsi: megaraid_sas: reduce module load time
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (253 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.19 254/639] x86/mm: Remove unused variable cpu Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-25 16:52   ` Pavel Machek
  2020-01-24  9:27 ` [PATCH 4.19 256/639] nfp: fix simple vNIC mailbox length Greg Kroah-Hartman
                   ` (387 subsequent siblings)
  642 siblings, 1 reply; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Steve Sistare, Sumit Saxena,
	Martin K. Petersen, Sasha Levin

From: Steve Sistare <steven.sistare@oracle.com>

[ Upstream commit 31b6a05f86e690e1818116fd23c3be915cc9d9ed ]

megaraid_sas takes 1+ seconds to load while waiting for firmware:

[2.822603] megaraid_sas 0000:03:00.0: Waiting for FW to come to ready state
[3.871003] megaraid_sas 0000:03:00.0: FW now in Ready state

This is due to the following loop in megasas_transition_to_ready(), which
waits a minimum of 1 second, even though the FW becomes ready in tens of
millisecs:

        /*
         * The cur_state should not last for more than max_wait secs
         */
        for (i = 0; i < max_wait; i++) {
                ...
                msleep(1000);
        ...
        dev_info(&instance->pdev->dev, "FW now in Ready state\n");

This is a regression, caused by a change of the msleep granularity from 1
to 1000 due to concern about waiting too long on systems with coarse
jiffies.

To fix, increase iterations and use msleep(20), which results in:

[2.670627] megaraid_sas 0000:03:00.0: Waiting for FW to come to ready state
[2.739386] megaraid_sas 0000:03:00.0: FW now in Ready state

Fixes: fb2f3e96d80f ("scsi: megaraid_sas: Fix msleep granularity")
Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
Acked-by: Sumit Saxena <sumit.saxena@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/megaraid/megaraid_sas_base.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
index 2f31d266339f8..99469f9057eea 100644
--- a/drivers/scsi/megaraid/megaraid_sas_base.c
+++ b/drivers/scsi/megaraid/megaraid_sas_base.c
@@ -3894,12 +3894,12 @@ megasas_transition_to_ready(struct megasas_instance *instance, int ocr)
 		/*
 		 * The cur_state should not last for more than max_wait secs
 		 */
-		for (i = 0; i < max_wait; i++) {
+		for (i = 0; i < max_wait * 50; i++) {
 			curr_abs_state = instance->instancet->
 				read_fw_status_reg(instance->reg_set);
 
 			if (abs_state == curr_abs_state) {
-				msleep(1000);
+				msleep(20);
 			} else
 				break;
 		}
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 256/639] nfp: fix simple vNIC mailbox length
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (254 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.19 255/639] scsi: megaraid_sas: reduce module load time Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.19 257/639] drivers/rapidio/rio_cm.c: fix potential oops in riocm_ch_listen() Greg Kroah-Hartman
                   ` (386 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dirk van der Merwe, Jakub Kicinski,
	David S. Miller, Sasha Levin

From: Dirk van der Merwe <dirk.vandermerwe@netronome.com>

[ Upstream commit eaab2d2d0fe4393b040dbf3922e18cd2ab7d6b85 ]

The simple vNIC mailbox length should be 12 decimal and not 0x12.
Using a decimal also makes it clear this is a length value and not
another field within the simple mailbox defines.

Found by code inspection, there are no known firmware configurations
where this would cause issues.

Fixes: 527d7d1b9949 ("nfp: read mailbox address from TLV caps")
Signed-off-by: Dirk van der Merwe <dirk.vandermerwe@netronome.com>
Reviewed-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/netronome/nfp/nfp_net_ctrl.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_ctrl.h b/drivers/net/ethernet/netronome/nfp/nfp_net_ctrl.h
index 44d3ea75d043a..ab602a79b084d 100644
--- a/drivers/net/ethernet/netronome/nfp/nfp_net_ctrl.h
+++ b/drivers/net/ethernet/netronome/nfp/nfp_net_ctrl.h
@@ -423,7 +423,7 @@
 #define NFP_NET_CFG_MBOX_SIMPLE_CMD	0x0
 #define NFP_NET_CFG_MBOX_SIMPLE_RET	0x4
 #define NFP_NET_CFG_MBOX_SIMPLE_VAL	0x8
-#define NFP_NET_CFG_MBOX_SIMPLE_LEN	0x12
+#define NFP_NET_CFG_MBOX_SIMPLE_LEN	12
 
 #define NFP_NET_CFG_MBOX_CMD_CTAG_FILTER_ADD 1
 #define NFP_NET_CFG_MBOX_CMD_CTAG_FILTER_KILL 2
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 257/639] drivers/rapidio/rio_cm.c: fix potential oops in riocm_ch_listen()
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (255 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.19 256/639] nfp: fix simple vNIC mailbox length Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.19 258/639] xen, cpu_hotplug: Prevent an out of bounds access Greg Kroah-Hartman
                   ` (385 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Andrew Morton,
	Matt Porter, Alexandre Bounine, Linus Torvalds, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit 5ac188b12e7cbdd92dee60877d1fac913fc1d074 ]

If riocm_get_channel() fails, then we should just return -EINVAL.
Calling riocm_put_channel() will trigger a NULL dereference and
generally we should call put() if the get() didn't succeed.

Link: http://lkml.kernel.org/r/20190110130230.GB27017@kadam
Fixes: b6e8d4aa1110 ("rapidio: add RapidIO channelized messaging driver")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Matt Porter <mporter@kernel.crashing.org>
Cc: Alexandre Bounine <alexandre.bounine@idt.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/rapidio/rio_cm.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/rapidio/rio_cm.c b/drivers/rapidio/rio_cm.c
index ef989a15aefc4..b29fc258eeba4 100644
--- a/drivers/rapidio/rio_cm.c
+++ b/drivers/rapidio/rio_cm.c
@@ -1215,7 +1215,9 @@ static int riocm_ch_listen(u16 ch_id)
 	riocm_debug(CHOP, "(ch_%d)", ch_id);
 
 	ch = riocm_get_channel(ch_id);
-	if (!ch || !riocm_cmp_exch(ch, RIO_CM_CHAN_BOUND, RIO_CM_LISTEN))
+	if (!ch)
+		return -EINVAL;
+	if (!riocm_cmp_exch(ch, RIO_CM_CHAN_BOUND, RIO_CM_LISTEN))
 		ret = -EINVAL;
 	riocm_put_channel(ch);
 	return ret;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 258/639] xen, cpu_hotplug: Prevent an out of bounds access
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (256 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.19 257/639] drivers/rapidio/rio_cm.c: fix potential oops in riocm_ch_listen() Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.19 259/639] net/mlx5: Fix multiple updates of steering rules in parallel Greg Kroah-Hartman
                   ` (384 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Juergen Gross, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit 201676095dda7e5b31a5e1d116d10fc22985075e ]

The "cpu" variable comes from the sscanf() so Smatch marks it as
untrusted data.  We can't pass a higher value than "nr_cpu_ids" to
cpu_possible() or it results in an out of bounds access.

Fixes: d68d82afd4c8 ("xen: implement CPU hotplugging")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/xen/cpu_hotplug.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/xen/cpu_hotplug.c b/drivers/xen/cpu_hotplug.c
index b1357aa4bc552..f192b6f42da9f 100644
--- a/drivers/xen/cpu_hotplug.c
+++ b/drivers/xen/cpu_hotplug.c
@@ -54,7 +54,7 @@ static int vcpu_online(unsigned int cpu)
 }
 static void vcpu_hotplug(unsigned int cpu)
 {
-	if (!cpu_possible(cpu))
+	if (cpu >= nr_cpu_ids || !cpu_possible(cpu))
 		return;
 
 	switch (vcpu_online(cpu)) {
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 259/639] net/mlx5: Fix multiple updates of steering rules in parallel
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (257 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.19 258/639] xen, cpu_hotplug: Prevent an out of bounds access Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.19 260/639] net/mlx5e: IPoIB, Fix RX checksum statistics update Greg Kroah-Hartman
                   ` (383 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Eli Britstein, Maor Gottlieb,
	Saeed Mahameed, Sasha Levin

From: Eli Britstein <elibr@mellanox.com>

[ Upstream commit 6237634d8fcc65c9e3348382910e7cdb15084c68 ]

There might be a condition where the fte found is not active yet. In
this case we should not use it, but continue to search for another, or
allocate a new one.

Fixes: bd71b08ec2ee ("net/mlx5: Support multiple updates of steering rules in parallel")
Signed-off-by: Eli Britstein <elibr@mellanox.com>
Reviewed-by: Maor Gottlieb <maorg@mellanox.com>
Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/mellanox/mlx5/core/fs_core.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
index 82a53317285d0..b16e0f45d28c5 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
@@ -469,6 +469,7 @@ static void del_hw_fte(struct fs_node *node)
 			mlx5_core_warn(dev,
 				       "flow steering can't delete fte in index %d of flow group id %d\n",
 				       fte->index, fg->id);
+		node->active = 0;
 	}
 }
 
@@ -1597,6 +1598,11 @@ lookup_fte_locked(struct mlx5_flow_group *g,
 		fte_tmp = NULL;
 		goto out;
 	}
+	if (!fte_tmp->node.active) {
+		tree_put_node(&fte_tmp->node);
+		fte_tmp = NULL;
+		goto out;
+	}
 
 	nested_down_write_ref_node(&fte_tmp->node, FS_LOCK_CHILD);
 out:
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 260/639] net/mlx5e: IPoIB, Fix RX checksum statistics update
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (258 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.19 259/639] net/mlx5: Fix multiple updates of steering rules in parallel Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.19 261/639] net: sh_eth: fix a missing check of of_get_phy_mode Greg Kroah-Hartman
                   ` (382 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Feras Daoud, Saeed Mahameed, Sasha Levin

From: Feras Daoud <ferasda@mellanox.com>

[ Upstream commit 3d6f3cdf9bfe92c430674308db0f1c8655f2c11d ]

Update the RX checksum only if the feature is enabled.

Fixes: 9d6bd752c63c ("net/mlx5e: IPoIB, RX handler")
Signed-off-by: Feras Daoud <ferasda@mellanox.com>
Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
index 9cbc4173973e9..044687a1f27cc 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
@@ -1364,8 +1364,14 @@ static inline void mlx5i_complete_rx_cqe(struct mlx5e_rq *rq,
 
 	skb->protocol = *((__be16 *)(skb->data));
 
-	skb->ip_summed = CHECKSUM_COMPLETE;
-	skb->csum = csum_unfold((__force __sum16)cqe->check_sum);
+	if (netdev->features & NETIF_F_RXCSUM) {
+		skb->ip_summed = CHECKSUM_COMPLETE;
+		skb->csum = csum_unfold((__force __sum16)cqe->check_sum);
+		stats->csum_complete++;
+	} else {
+		skb->ip_summed = CHECKSUM_NONE;
+		stats->csum_none++;
+	}
 
 	if (unlikely(mlx5e_rx_hw_stamp(tstamp)))
 		skb_hwtstamps(skb)->hwtstamp =
@@ -1384,7 +1390,6 @@ static inline void mlx5i_complete_rx_cqe(struct mlx5e_rq *rq,
 
 	skb->dev = netdev;
 
-	stats->csum_complete++;
 	stats->packets++;
 	stats->bytes += cqe_bcnt;
 }
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 261/639] net: sh_eth: fix a missing check of of_get_phy_mode
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (259 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.19 260/639] net/mlx5e: IPoIB, Fix RX checksum statistics update Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.19 262/639] regulator: lp87565: Fix missing register for LP87565_BUCK_0 Greg Kroah-Hartman
                   ` (381 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Kangjie Lu, Sergei Shtylyov,
	Geert Uytterhoeven, David S. Miller, Sasha Levin

From: Kangjie Lu <kjlu@umn.edu>

[ Upstream commit 035a14e71f27eefa50087963b94cbdb3580d08bf ]

of_get_phy_mode may fail and return a negative error code;
the fix checks the return value of of_get_phy_mode and
returns NULL of it fails.

Fixes: b356e978e92f ("sh_eth: add device tree support")
Signed-off-by: Kangjie Lu <kjlu@umn.edu>
Reviewed-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/renesas/sh_eth.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
index 6068e96f5ac1e..441643670ac0e 100644
--- a/drivers/net/ethernet/renesas/sh_eth.c
+++ b/drivers/net/ethernet/renesas/sh_eth.c
@@ -3133,12 +3133,16 @@ static struct sh_eth_plat_data *sh_eth_parse_dt(struct device *dev)
 	struct device_node *np = dev->of_node;
 	struct sh_eth_plat_data *pdata;
 	const char *mac_addr;
+	int ret;
 
 	pdata = devm_kzalloc(dev, sizeof(*pdata), GFP_KERNEL);
 	if (!pdata)
 		return NULL;
 
-	pdata->phy_interface = of_get_phy_mode(np);
+	ret = of_get_phy_mode(np);
+	if (ret < 0)
+		return NULL;
+	pdata->phy_interface = ret;
 
 	mac_addr = of_get_mac_address(np);
 	if (mac_addr)
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 262/639] regulator: lp87565: Fix missing register for LP87565_BUCK_0
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (260 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.19 261/639] net: sh_eth: fix a missing check of of_get_phy_mode Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.19 263/639] soc: amlogic: gx-socinfo: Add mask for each SoC packages Greg Kroah-Hartman
                   ` (380 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Axel Lin, Keerthy, Mark Brown, Sasha Levin

From: Axel Lin <axel.lin@ingics.com>

[ Upstream commit d1a6cbdf1e597917cb642c655512d91b71a35d22 ]

LP87565_BUCK_0 is missed, fix it.

Fixes: f0168a9bf ("regulator: lp87565: Add support for lp87565 PMIC regulators")
Signed-off-by: Axel Lin <axel.lin@ingics.com>
Reviewed-by: Keerthy <j-keerthy@ti.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/regulator/lp87565-regulator.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/regulator/lp87565-regulator.c b/drivers/regulator/lp87565-regulator.c
index c192357d1dea0..7cd6862406b70 100644
--- a/drivers/regulator/lp87565-regulator.c
+++ b/drivers/regulator/lp87565-regulator.c
@@ -193,7 +193,7 @@ static int lp87565_regulator_probe(struct platform_device *pdev)
 	struct lp87565 *lp87565 = dev_get_drvdata(pdev->dev.parent);
 	struct regulator_config config = { };
 	struct regulator_dev *rdev;
-	int i, min_idx = LP87565_BUCK_1, max_idx = LP87565_BUCK_3;
+	int i, min_idx = LP87565_BUCK_0, max_idx = LP87565_BUCK_3;
 
 	platform_set_drvdata(pdev, lp87565);
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 263/639] soc: amlogic: gx-socinfo: Add mask for each SoC packages
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (261 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.19 262/639] regulator: lp87565: Fix missing register for LP87565_BUCK_0 Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.19 264/639] media: ivtv: update *pos correctly in ivtv_read_pos() Greg Kroah-Hartman
                   ` (379 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Neil Armstrong, Kevin Hilman, Sasha Levin

From: Neil Armstrong <narmstrong@baylibre.com>

[ Upstream commit dce47aed20c7de3ee2011b7a63e67f08e9dcfb5e ]

When updated IDs on f842c41adc04 ("amlogic: meson-gx-socinfo: Update soc ids")
we introduced packages ids using the full 8bit value, but in the function
socinfo_to_package_id() the id was filtered with the 0xf0 mask.

While the 0xf0 mask is valid for most board, it filters out the lower
4 bits which encodes some characteristics of the chip.

This patch moves the mask into the meson_gx_package_id table to be applied
on each package name independently and add the correct mask for some
specific entries.

An example is the S905, in the vendor code the S905 is package_id
different from 0x20, and S905M is exactly 0x20.

Another example are the The Wetek Hub & Play2 boards using a S905-H
variant, which is the S905 SoC with some licence bits enabled.
These licence bits are encoded in the lower 4bits, so to detect
the -H variant, we must detect the id == 0x3 with the 0xf mask.

Fixes: f842c41adc04 ("amlogic: meson-gx-socinfo: Update soc ids")
Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
Signed-off-by: Kevin Hilman <khilman@baylibre.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/soc/amlogic/meson-gx-socinfo.c | 32 ++++++++++++++------------
 1 file changed, 17 insertions(+), 15 deletions(-)

diff --git a/drivers/soc/amlogic/meson-gx-socinfo.c b/drivers/soc/amlogic/meson-gx-socinfo.c
index 37ea0a1c24c82..1ae339f5eadbd 100644
--- a/drivers/soc/amlogic/meson-gx-socinfo.c
+++ b/drivers/soc/amlogic/meson-gx-socinfo.c
@@ -43,20 +43,21 @@ static const struct meson_gx_package_id {
 	const char *name;
 	unsigned int major_id;
 	unsigned int pack_id;
+	unsigned int pack_mask;
 } soc_packages[] = {
-	{ "S905", 0x1f, 0 },
-	{ "S905H", 0x1f, 0x13 },
-	{ "S905M", 0x1f, 0x20 },
-	{ "S905D", 0x21, 0 },
-	{ "S905X", 0x21, 0x80 },
-	{ "S905W", 0x21, 0xa0 },
-	{ "S905L", 0x21, 0xc0 },
-	{ "S905M2", 0x21, 0xe0 },
-	{ "S912", 0x22, 0 },
-	{ "962X", 0x24, 0x10 },
-	{ "962E", 0x24, 0x20 },
-	{ "A113X", 0x25, 0x37 },
-	{ "A113D", 0x25, 0x22 },
+	{ "S905", 0x1f, 0, 0x20 }, /* pack_id != 0x20 */
+	{ "S905H", 0x1f, 0x3, 0xf }, /* pack_id & 0xf == 0x3 */
+	{ "S905M", 0x1f, 0x20, 0xf0 }, /* pack_id == 0x20 */
+	{ "S905D", 0x21, 0, 0xf0 },
+	{ "S905X", 0x21, 0x80, 0xf0 },
+	{ "S905W", 0x21, 0xa0, 0xf0 },
+	{ "S905L", 0x21, 0xc0, 0xf0 },
+	{ "S905M2", 0x21, 0xe0, 0xf0 },
+	{ "S912", 0x22, 0, 0x0 }, /* Only S912 is known for GXM */
+	{ "962X", 0x24, 0x10, 0xf0 },
+	{ "962E", 0x24, 0x20, 0xf0 },
+	{ "A113X", 0x25, 0x37, 0xff },
+	{ "A113D", 0x25, 0x22, 0xff },
 };
 
 static inline unsigned int socinfo_to_major(u32 socinfo)
@@ -81,13 +82,14 @@ static inline unsigned int socinfo_to_misc(u32 socinfo)
 
 static const char *socinfo_to_package_id(u32 socinfo)
 {
-	unsigned int pack = socinfo_to_pack(socinfo) & 0xf0;
+	unsigned int pack = socinfo_to_pack(socinfo);
 	unsigned int major = socinfo_to_major(socinfo);
 	int i;
 
 	for (i = 0 ; i < ARRAY_SIZE(soc_packages) ; ++i) {
 		if (soc_packages[i].major_id == major &&
-		    soc_packages[i].pack_id == pack)
+		    soc_packages[i].pack_id ==
+				(pack & soc_packages[i].pack_mask))
 			return soc_packages[i].name;
 	}
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 264/639] media: ivtv: update *pos correctly in ivtv_read_pos()
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (262 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.19 263/639] soc: amlogic: gx-socinfo: Add mask for each SoC packages Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.19 265/639] media: cx18: update *pos correctly in cx18_read_pos() Greg Kroah-Hartman
                   ` (378 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Hans Verkuil,
	Mauro Carvalho Chehab, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit f8e579f3ca0973daef263f513da5edff520a6c0d ]

We had intended to update *pos, but the current code is a no-op.

Fixes: 1a0adaf37c30 ("V4L/DVB (5345): ivtv driver for Conexant cx23416/cx23415 MPEG encoder/decoder")

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/pci/ivtv/ivtv-fileops.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/pci/ivtv/ivtv-fileops.c b/drivers/media/pci/ivtv/ivtv-fileops.c
index 6196daae4b3e0..043ac0ae9ed07 100644
--- a/drivers/media/pci/ivtv/ivtv-fileops.c
+++ b/drivers/media/pci/ivtv/ivtv-fileops.c
@@ -420,7 +420,7 @@ static ssize_t ivtv_read_pos(struct ivtv_stream *s, char __user *ubuf, size_t co
 
 	IVTV_DEBUG_HI_FILE("read %zd from %s, got %zd\n", count, s->name, rc);
 	if (rc > 0)
-		pos += rc;
+		*pos += rc;
 	return rc;
 }
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 265/639] media: cx18: update *pos correctly in cx18_read_pos()
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (263 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.19 264/639] media: ivtv: update *pos correctly in ivtv_read_pos() Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.19 266/639] media: wl128x: Fix an error code in fm_download_firmware() Greg Kroah-Hartman
                   ` (377 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Hans Verkuil,
	Mauro Carvalho Chehab, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit 7afb0df554292dca7568446f619965fb8153085d ]

We should be updating *pos.  The current code is a no-op.

Fixes: 1c1e45d17b66 ("V4L/DVB (7786): cx18: new driver for the Conexant CX23418 MPEG encoder chip")

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/pci/cx18/cx18-fileops.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/pci/cx18/cx18-fileops.c b/drivers/media/pci/cx18/cx18-fileops.c
index a3f44e30f8219..88c2f3bea2b61 100644
--- a/drivers/media/pci/cx18/cx18-fileops.c
+++ b/drivers/media/pci/cx18/cx18-fileops.c
@@ -484,7 +484,7 @@ static ssize_t cx18_read_pos(struct cx18_stream *s, char __user *ubuf,
 
 	CX18_DEBUG_HI_FILE("read %zd from %s, got %zd\n", count, s->name, rc);
 	if (rc > 0)
-		pos += rc;
+		*pos += rc;
 	return rc;
 }
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 266/639] media: wl128x: Fix an error code in fm_download_firmware()
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (264 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.19 265/639] media: cx18: update *pos correctly in cx18_read_pos() Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.19 267/639] media: cx23885: check allocation return Greg Kroah-Hartman
                   ` (376 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Hans Verkuil,
	Mauro Carvalho Chehab, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit ef4bb63dc1f7213c08e13f6943c69cd27f69e4a3 ]

We forgot to set "ret" on this error path.

Fixes: e8454ff7b9a4 ("[media] drivers:media:radio: wl128x: FM Driver Common sources")

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/radio/wl128x/fmdrv_common.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/media/radio/wl128x/fmdrv_common.c b/drivers/media/radio/wl128x/fmdrv_common.c
index 1cf4019689a56..cccf1a743f4e6 100644
--- a/drivers/media/radio/wl128x/fmdrv_common.c
+++ b/drivers/media/radio/wl128x/fmdrv_common.c
@@ -1271,8 +1271,9 @@ static int fm_download_firmware(struct fmdev *fmdev, const u8 *fw_name)
 
 		switch (action->type) {
 		case ACTION_SEND_COMMAND:	/* Send */
-			if (fmc_send_cmd(fmdev, 0, 0, action->data,
-						action->size, NULL, NULL))
+			ret = fmc_send_cmd(fmdev, 0, 0, action->data,
+					   action->size, NULL, NULL);
+			if (ret)
 				goto rel_fw;
 
 			cmd_cnt++;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 267/639] media: cx23885: check allocation return
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (265 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.19 266/639] media: wl128x: Fix an error code in fm_download_firmware() Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.19 268/639] regulator: tps65086: Fix tps65086_ldoa1_ranges for selector 0xB Greg Kroah-Hartman
                   ` (375 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Nicholas Mc Guire, Sean Young,
	Mauro Carvalho Chehab, Sasha Levin

From: Nicholas Mc Guire <hofrat@osadl.org>

[ Upstream commit a3d7f22ef34ec4206b50ee121384d5c8bebd5591 ]

Checking of kmalloc() seems to have been committed - as
cx23885_dvb_register() is checking for != 0 return, returning
-ENOMEM should be fine here.  While at it address the coccicheck
suggestion to move to kmemdup rather than using kmalloc+memcpy.

Fixes: 46b21bbaa8a8 ("[media] Add support for DViCO FusionHDTV DVB-T Dual Express2")

Signed-off-by: Nicholas Mc Guire <hofrat@osadl.org>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/pci/cx23885/cx23885-dvb.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/media/pci/cx23885/cx23885-dvb.c b/drivers/media/pci/cx23885/cx23885-dvb.c
index 7d52173073d6e..bafcb39822747 100644
--- a/drivers/media/pci/cx23885/cx23885-dvb.c
+++ b/drivers/media/pci/cx23885/cx23885-dvb.c
@@ -1474,8 +1474,9 @@ static int dvb_register(struct cx23885_tsport *port)
 		if (fe0->dvb.frontend != NULL) {
 			struct i2c_adapter *tun_i2c;
 
-			fe0->dvb.frontend->sec_priv = kmalloc(sizeof(dib7000p_ops), GFP_KERNEL);
-			memcpy(fe0->dvb.frontend->sec_priv, &dib7000p_ops, sizeof(dib7000p_ops));
+			fe0->dvb.frontend->sec_priv = kmemdup(&dib7000p_ops, sizeof(dib7000p_ops), GFP_KERNEL);
+			if (!fe0->dvb.frontend->sec_priv)
+				return -ENOMEM;
 			tun_i2c = dib7000p_ops.get_i2c_master(fe0->dvb.frontend, DIBX000_I2C_INTERFACE_TUNER, 1);
 			if (!dvb_attach(dib0070_attach, fe0->dvb.frontend, tun_i2c, &dib7070p_dib0070_config))
 				return -ENODEV;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 268/639] regulator: tps65086: Fix tps65086_ldoa1_ranges for selector 0xB
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (266 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.19 267/639] media: cx23885: check allocation return Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.19 269/639] crypto: ccree - reduce kernel stack usage with clang Greg Kroah-Hartman
                   ` (374 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Axel Lin, Andrew F. Davis,
	Mark Brown, Sasha Levin

From: Axel Lin <axel.lin@ingics.com>

[ Upstream commit e69b394703e032e56a140172440ec4f9890b536d ]

selector 0xB (1011) should be 2.6V rather than 2.7V, fit ix.

Table 5-4. LDOA1 Output Voltage Options
VID Bits VOUT VID Bits VOUT VID Bits VOUT VID Bits VOUT
0000     1.35 0100     1.8  1000     2.3  1100     2.85
0001     1.5  0101     1.9  1001     2.4  1101     3.0
0010     1.6  0110     2.0  1010     2.5  1110     3.3
0011     1.7  0111     2.1  1011     2.6  1111     Not Used

Fixes: d2a2e729a666 ("regulator: tps65086: Add regulator driver for the TPS65086 PMIC")
Signed-off-by: Axel Lin <axel.lin@ingics.com>
Acked-by: Andrew F. Davis <afd@ti.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/regulator/tps65086-regulator.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/regulator/tps65086-regulator.c b/drivers/regulator/tps65086-regulator.c
index 45e96e1546900..5a5e9b5bf4bea 100644
--- a/drivers/regulator/tps65086-regulator.c
+++ b/drivers/regulator/tps65086-regulator.c
@@ -90,8 +90,8 @@ static const struct regulator_linear_range tps65086_buck345_25mv_ranges[] = {
 static const struct regulator_linear_range tps65086_ldoa1_ranges[] = {
 	REGULATOR_LINEAR_RANGE(1350000, 0x0, 0x0, 0),
 	REGULATOR_LINEAR_RANGE(1500000, 0x1, 0x7, 100000),
-	REGULATOR_LINEAR_RANGE(2300000, 0x8, 0xA, 100000),
-	REGULATOR_LINEAR_RANGE(2700000, 0xB, 0xD, 150000),
+	REGULATOR_LINEAR_RANGE(2300000, 0x8, 0xB, 100000),
+	REGULATOR_LINEAR_RANGE(2850000, 0xC, 0xD, 150000),
 	REGULATOR_LINEAR_RANGE(3300000, 0xE, 0xE, 0),
 };
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 269/639] crypto: ccree - reduce kernel stack usage with clang
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (267 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.19 268/639] regulator: tps65086: Fix tps65086_ldoa1_ranges for selector 0xB Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.19 270/639] jfs: fix bogus variable self-initialization Greg Kroah-Hartman
                   ` (373 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Arnd Bergmann, Gilad Ben-Yossef,
	Herbert Xu, Sasha Levin

From: Arnd Bergmann <arnd@arndb.de>

[ Upstream commit 5db46ac29a6797541943d3c4081821747e342732 ]

Building with clang for a 32-bit architecture runs over the stack
frame limit in the setkey function:

drivers/crypto/ccree/cc_cipher.c:318:12: error: stack frame size of 1152 bytes in function 'cc_cipher_setkey' [-Werror,-Wframe-larger-than=]

The problem is that there are two large variables: the temporary
'tmp' array and the SHASH_DESC_ON_STACK() declaration. Moving
the first into the block in which it is used reduces the
total frame size to 768 bytes, which seems more reasonable
and is under the warning limit.

Fixes: 63ee04c8b491 ("crypto: ccree - add skcipher support")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Acked-By: Gilad Ben-Yossef <gilad@benyossef.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/ccree/cc_cipher.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/crypto/ccree/cc_cipher.c b/drivers/crypto/ccree/cc_cipher.c
index 54a39164aab8f..28a5b8b38fa2f 100644
--- a/drivers/crypto/ccree/cc_cipher.c
+++ b/drivers/crypto/ccree/cc_cipher.c
@@ -306,7 +306,6 @@ static int cc_cipher_setkey(struct crypto_skcipher *sktfm, const u8 *key,
 	struct crypto_tfm *tfm = crypto_skcipher_tfm(sktfm);
 	struct cc_cipher_ctx *ctx_p = crypto_tfm_ctx(tfm);
 	struct device *dev = drvdata_to_dev(ctx_p->drvdata);
-	u32 tmp[DES3_EDE_EXPKEY_WORDS];
 	struct cc_crypto_alg *cc_alg =
 			container_of(tfm->__crt_alg, struct cc_crypto_alg,
 				     skcipher_alg.base);
@@ -332,6 +331,7 @@ static int cc_cipher_setkey(struct crypto_skcipher *sktfm, const u8 *key,
 	 * HW does the expansion on its own.
 	 */
 	if (ctx_p->flow_mode == S_DIN_to_DES) {
+		u32 tmp[DES3_EDE_EXPKEY_WORDS];
 		if (keylen == DES3_EDE_KEY_SIZE &&
 		    __des3_ede_setkey(tmp, &tfm->crt_flags, key,
 				      DES3_EDE_KEY_SIZE)) {
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 270/639] jfs: fix bogus variable self-initialization
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (268 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.19 269/639] crypto: ccree - reduce kernel stack usage with clang Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.19 271/639] tipc: tipc clang warning Greg Kroah-Hartman
                   ` (372 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Arnd Bergmann, Dave Kleikamp, Sasha Levin

From: Arnd Bergmann <arnd@arndb.de>

[ Upstream commit a5fdd713d256887b5f012608701149fa939e5645 ]

A statement was originally added in 2006 to shut up a gcc warning,
now but now clang warns about it:

fs/jfs/jfs_txnmgr.c:1932:15: error: variable 'pxd' is uninitialized when used within its own initialization
      [-Werror,-Wuninitialized]
                pxd_t pxd = pxd;        /* truncated extent of xad */
                      ~~~   ^~~

Modern versions of gcc are fine without the silly assignment, so just
drop it. Tested with gcc-4.6 (released 2011), 4.7, 4.8, and 4.9.

Fixes: c9e3ad6021e5 ("JFS: Get rid of "may be used uninitialized" warnings")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/jfs/jfs_txnmgr.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/fs/jfs/jfs_txnmgr.c b/fs/jfs/jfs_txnmgr.c
index a5663cb621d8d..78789c5ed36b0 100644
--- a/fs/jfs/jfs_txnmgr.c
+++ b/fs/jfs/jfs_txnmgr.c
@@ -1928,8 +1928,7 @@ static void xtLog(struct jfs_log * log, struct tblock * tblk, struct lrd * lrd,
 	 * header ?
 	 */
 	if (tlck->type & tlckTRUNCATE) {
-		/* This odd declaration suppresses a bogus gcc warning */
-		pxd_t pxd = pxd;	/* truncated extent of xad */
+		pxd_t pxd;	/* truncated extent of xad */
 		int twm;
 
 		/*
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 271/639] tipc: tipc clang warning
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (269 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.19 270/639] jfs: fix bogus variable self-initialization Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.19 272/639] m68k: mac: Fix VIA timer counter accesses Greg Kroah-Hartman
                   ` (371 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Nathan Chancellor, Jon Maloy,
	David S. Miller, Sasha Levin

From: Jon Maloy <jon.maloy@ericsson.com>

[ Upstream commit 737889efe9713a0f20a75fd0de952841d9275e6b ]

When checking the code with clang -Wsometimes-uninitialized we get the
following warning:

if (!tipc_link_is_establishing(l)) {
    ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
net/tipc/node.c:847:46: note: uninitialized use occurs here
      tipc_bearer_xmit(n->net, bearer_id, &xmitq, maddr);

net/tipc/node.c:831:2: note: remove the 'if' if its condition is always
true
if (!tipc_link_is_establishing(l)) {
    ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
net/tipc/node.c:821:31: note: initialize the variable 'maddr' to silence
this warning
struct tipc_media_addr *maddr;

We fix this by initializing 'maddr' to NULL. For the matter of clarity,
we also test if 'xmitq' is non-empty before we use it and 'maddr'
further down in the  function. It will never happen that 'xmitq' is non-
empty at the same time as 'maddr' is NULL, so this is a sufficient test.

Fixes: 598411d70f85 ("tipc: make resetting of links non-atomic")
Reported-by: Nathan Chancellor <natechancellor@gmail.com>
Signed-off-by: Jon Maloy <jon.maloy@ericsson.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/tipc/node.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/net/tipc/node.c b/net/tipc/node.c
index 32556f480a606..e67ffd1949272 100644
--- a/net/tipc/node.c
+++ b/net/tipc/node.c
@@ -810,10 +810,10 @@ static void __tipc_node_link_down(struct tipc_node *n, int *bearer_id,
 static void tipc_node_link_down(struct tipc_node *n, int bearer_id, bool delete)
 {
 	struct tipc_link_entry *le = &n->links[bearer_id];
+	struct tipc_media_addr *maddr = NULL;
 	struct tipc_link *l = le->link;
-	struct tipc_media_addr *maddr;
-	struct sk_buff_head xmitq;
 	int old_bearer_id = bearer_id;
+	struct sk_buff_head xmitq;
 
 	if (!l)
 		return;
@@ -835,7 +835,8 @@ static void tipc_node_link_down(struct tipc_node *n, int bearer_id, bool delete)
 	tipc_node_write_unlock(n);
 	if (delete)
 		tipc_mon_remove_peer(n->net, n->addr, old_bearer_id);
-	tipc_bearer_xmit(n->net, bearer_id, &xmitq, maddr);
+	if (!skb_queue_empty(&xmitq))
+		tipc_bearer_xmit(n->net, bearer_id, &xmitq, maddr);
 	tipc_sk_rcv(n->net, &le->inputq);
 }
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 272/639] m68k: mac: Fix VIA timer counter accesses
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (270 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.19 271/639] tipc: tipc clang warning Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.19 273/639] ARM: dts: sun8i: a33: Reintroduce default pinctrl muxing Greg Kroah-Hartman
                   ` (370 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Finn Thain, Geert Uytterhoeven, Sasha Levin

From: Finn Thain <fthain@telegraphics.com.au>

[ Upstream commit 0ca7ce7db771580433bf24454f7a1542bd326078 ]

This resolves some bugs that affect VIA timer counter accesses.
Avoid lost interrupts caused by reading the counter low byte register.
Make allowance for the fact that the counter will be decremented to
0xFFFF before being reloaded.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/m68k/mac/via.c | 102 +++++++++++++++++++++++---------------------
 1 file changed, 53 insertions(+), 49 deletions(-)

diff --git a/arch/m68k/mac/via.c b/arch/m68k/mac/via.c
index acdabbeecfd2e..288ec3aa5b575 100644
--- a/arch/m68k/mac/via.c
+++ b/arch/m68k/mac/via.c
@@ -54,16 +54,6 @@ static __u8 rbv_clear;
 
 static int gIER,gIFR,gBufA,gBufB;
 
-/*
- * Timer defs.
- */
-
-#define TICK_SIZE		10000
-#define MAC_CLOCK_TICK		(783300/HZ)		/* ticks per HZ */
-#define MAC_CLOCK_LOW		(MAC_CLOCK_TICK&0xFF)
-#define MAC_CLOCK_HIGH		(MAC_CLOCK_TICK>>8)
-
-
 /*
  * On Macs with a genuine VIA chip there is no way to mask an individual slot
  * interrupt. This limitation also seems to apply to VIA clone logic cores in
@@ -267,22 +257,6 @@ void __init via_init(void)
 	}
 }
 
-/*
- * Start the 100 Hz clock
- */
-
-void __init via_init_clock(irq_handler_t func)
-{
-	via1[vACR] |= 0x40;
-	via1[vT1LL] = MAC_CLOCK_LOW;
-	via1[vT1LH] = MAC_CLOCK_HIGH;
-	via1[vT1CL] = MAC_CLOCK_LOW;
-	via1[vT1CH] = MAC_CLOCK_HIGH;
-
-	if (request_irq(IRQ_MAC_TIMER_1, func, 0, "timer", func))
-		pr_err("Couldn't register %s interrupt\n", "timer");
-}
-
 /*
  * Debugging dump, used in various places to see what's going on.
  */
@@ -310,29 +284,6 @@ void via_debug_dump(void)
 	}
 }
 
-/*
- * This is always executed with interrupts disabled.
- *
- * TBI: get time offset between scheduling timer ticks
- */
-
-u32 mac_gettimeoffset(void)
-{
-	unsigned long ticks, offset = 0;
-
-	/* read VIA1 timer 2 current value */
-	ticks = via1[vT1CL] | (via1[vT1CH] << 8);
-	/* The probability of underflow is less than 2% */
-	if (ticks > MAC_CLOCK_TICK - MAC_CLOCK_TICK / 50)
-		/* Check for pending timer interrupt in VIA1 IFR */
-		if (via1[vIFR] & 0x40) offset = TICK_SIZE;
-
-	ticks = MAC_CLOCK_TICK - ticks;
-	ticks = ticks * 10000L / MAC_CLOCK_TICK;
-
-	return (ticks + offset) * 1000;
-}
-
 /*
  * Flush the L2 cache on Macs that have it by flipping
  * the system into 24-bit mode for an instant.
@@ -601,3 +552,56 @@ int via2_scsi_drq_pending(void)
 	return via2[gIFR] & (1 << IRQ_IDX(IRQ_MAC_SCSIDRQ));
 }
 EXPORT_SYMBOL(via2_scsi_drq_pending);
+
+/* timer and clock source */
+
+#define VIA_CLOCK_FREQ     783360                /* VIA "phase 2" clock in Hz */
+#define VIA_TIMER_INTERVAL (1000000 / HZ)        /* microseconds per jiffy */
+#define VIA_TIMER_CYCLES   (VIA_CLOCK_FREQ / HZ) /* clock cycles per jiffy */
+
+#define VIA_TC             (VIA_TIMER_CYCLES - 2) /* including 0 and -1 */
+#define VIA_TC_LOW         (VIA_TC & 0xFF)
+#define VIA_TC_HIGH        (VIA_TC >> 8)
+
+void __init via_init_clock(irq_handler_t timer_routine)
+{
+	if (request_irq(IRQ_MAC_TIMER_1, timer_routine, 0, "timer", NULL)) {
+		pr_err("Couldn't register %s interrupt\n", "timer");
+		return;
+	}
+
+	via1[vT1LL] = VIA_TC_LOW;
+	via1[vT1LH] = VIA_TC_HIGH;
+	via1[vT1CL] = VIA_TC_LOW;
+	via1[vT1CH] = VIA_TC_HIGH;
+	via1[vACR] |= 0x40;
+}
+
+u32 mac_gettimeoffset(void)
+{
+	unsigned long flags;
+	u8 count_high;
+	u16 count, offset = 0;
+
+	/*
+	 * Timer counter wrap-around is detected with the timer interrupt flag
+	 * but reading the counter low byte (vT1CL) would reset the flag.
+	 * Also, accessing both counter registers is essentially a data race.
+	 * These problems are avoided by ignoring the low byte. Clock accuracy
+	 * is 256 times worse (error can reach 0.327 ms) but CPU overhead is
+	 * reduced by avoiding slow VIA register accesses.
+	 */
+
+	local_irq_save(flags);
+	count_high = via1[vT1CH];
+	if (count_high == 0xFF)
+		count_high = 0;
+	if (count_high > 0 && (via1[vIFR] & VIA_TIMER_1_INT))
+		offset = VIA_TIMER_CYCLES;
+	local_irq_restore(flags);
+
+	count = count_high << 8;
+	count = VIA_TIMER_CYCLES - count + offset;
+
+	return ((count * VIA_TIMER_INTERVAL) / VIA_TIMER_CYCLES) * 1000;
+}
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 273/639] ARM: dts: sun8i: a33: Reintroduce default pinctrl muxing
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (271 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.19 272/639] m68k: mac: Fix VIA timer counter accesses Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.19 274/639] arm64: dts: allwinner: a64: Add missing PIO clocks Greg Kroah-Hartman
                   ` (369 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chen-Yu Tsai, Maxime Ripard, Sasha Levin

From: Maxime Ripard <maxime.ripard@bootlin.com>

[ Upstream commit fa44328f4eb0b762a1fcb148809068e9646e7156 ]

Commit d02752149759 ("ARM: dts: sun8i-a23-a33: Move NAND controller device
node to sort by address") moved the NAND controller node around, but
dropped the default muxing in the process.

Reintroduce it.

Fixes: d02752149759 ("ARM: dts: sun8i-a23-a33: Move NAND controller device node to sort by address")
Acked-by: Chen-Yu Tsai <wens@csie.org>
Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/sun8i-a23-a33.dtsi | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/arm/boot/dts/sun8i-a23-a33.dtsi b/arch/arm/boot/dts/sun8i-a23-a33.dtsi
index a272a69519a26..1efad1a6bcfd9 100644
--- a/arch/arm/boot/dts/sun8i-a23-a33.dtsi
+++ b/arch/arm/boot/dts/sun8i-a23-a33.dtsi
@@ -163,6 +163,8 @@
 			clock-names = "ahb", "mod";
 			resets = <&ccu RST_BUS_NAND>;
 			reset-names = "ahb";
+			pinctrl-names = "default";
+			pinctrl-0 = <&nand_pins &nand_pins_cs0 &nand_pins_rb0>;
 			status = "disabled";
 			#address-cells = <1>;
 			#size-cells = <0>;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 274/639] arm64: dts: allwinner: a64: Add missing PIO clocks
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (272 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.19 273/639] ARM: dts: sun8i: a33: Reintroduce default pinctrl muxing Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.19 275/639] ARM: dts: sun9i: optimus: Fix fixed-regulators Greg Kroah-Hartman
                   ` (368 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chen-Yu Tsai, Maxime Ripard, Sasha Levin

From: Maxime Ripard <maxime.ripard@bootlin.com>

[ Upstream commit 562bf19611c000cb7219431c3cc78aa60c2b371e ]

The pinctrl binding mandates that we have the three clocks fed into the PIO
described.

Even though the old case is still supported for backward compatibility, we
should update our DTs to fix this.

Fixes: 6bc37fac30cf ("arm64: dts: add Allwinner A64 SoC .dtsi")
Acked-by: Chen-Yu Tsai <wens@csie.org>
Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi b/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi
index d3daf90a8715c..7abc4ea305410 100644
--- a/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi
+++ b/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi
@@ -366,7 +366,8 @@
 			interrupts = <GIC_SPI 11 IRQ_TYPE_LEVEL_HIGH>,
 				     <GIC_SPI 17 IRQ_TYPE_LEVEL_HIGH>,
 				     <GIC_SPI 21 IRQ_TYPE_LEVEL_HIGH>;
-			clocks = <&ccu 58>;
+			clocks = <&ccu 58>, <&osc24M>, <&rtc 0>;
+			clock-names = "apb", "hosc", "losc";
 			gpio-controller;
 			#gpio-cells = <3>;
 			interrupt-controller;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 275/639] ARM: dts: sun9i: optimus: Fix fixed-regulators
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (273 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.19 274/639] arm64: dts: allwinner: a64: Add missing PIO clocks Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.19 276/639] net: phy: dont clear BMCR in genphy_soft_reset Greg Kroah-Hartman
                   ` (367 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chen-Yu Tsai, Maxime Ripard, Sasha Levin

From: Maxime Ripard <maxime.ripard@bootlin.com>

[ Upstream commit c2a5b554751545023056559121a8ecf86aebe541 ]

Commit 1848f3f44444 ("ARM: dts: sun9i: Remove GPIO pinctrl nodes to avoid
warnings") was wrong on the optimus, and instead of droping the
pinctrl-names property, it dropped the regulator-name one.

Obviously, that wasn't what was intended. Reinstate regulator-name and drop
pinctrl-names.

Fixes: 1848f3f44444 ("ARM: dts: sun9i: Remove GPIO pinctrl nodes to avoid warnings")
Acked-by: Chen-Yu Tsai <wens@csie.org>
Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/sun9i-a80-optimus.dts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm/boot/dts/sun9i-a80-optimus.dts b/arch/arm/boot/dts/sun9i-a80-optimus.dts
index 58a199b0e4943..d1e58a6a43432 100644
--- a/arch/arm/boot/dts/sun9i-a80-optimus.dts
+++ b/arch/arm/boot/dts/sun9i-a80-optimus.dts
@@ -82,7 +82,7 @@
 
 	reg_usb1_vbus: usb1-vbus {
 		compatible = "regulator-fixed";
-		pinctrl-names = "default";
+		regulator-name = "usb1-vbus";
 		regulator-min-microvolt = <5000000>;
 		regulator-max-microvolt = <5000000>;
 		enable-active-high;
@@ -91,7 +91,7 @@
 
 	reg_usb3_vbus: usb3-vbus {
 		compatible = "regulator-fixed";
-		pinctrl-names = "default";
+		regulator-name = "usb3-vbus";
 		regulator-min-microvolt = <5000000>;
 		regulator-max-microvolt = <5000000>;
 		enable-active-high;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 276/639] net: phy: dont clear BMCR in genphy_soft_reset
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (274 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.19 275/639] ARM: dts: sun9i: optimus: Fix fixed-regulators Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.19 277/639] ARM: OMAP2+: Fix potentially uninitialized return value for _setup_reset() Greg Kroah-Hartman
                   ` (366 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Phil Reid, liweihang,
	Heiner Kallweit, Florian Fainelli, David S. Miller, Sasha Levin

From: Heiner Kallweit <hkallweit1@gmail.com>

[ Upstream commit d29f5aa0bc0c321e1b9e4658a2a7e08e885da52a ]

So far we effectively clear the BMCR register. Some PHY's can deal
with this (e.g. because they reset BMCR to a default as part of a
soft-reset) whilst on others this causes issues because e.g. the
autoneg bit is cleared. Marvell is an example, see also thread [0].
So let's be a little bit more gentle and leave all bits we're not
interested in as-is. This change is needed for PHY drivers to
properly deal with the original patch.

[0] https://marc.info/?t=155264050700001&r=1&w=2

Fixes: 6e2d85ec0559 ("net: phy: Stop with excessive soft reset")
Tested-by: Phil Reid <preid@electromag.com.au>
Tested-by: liweihang <liweihang@hisilicon.com>
Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/phy/phy_device.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index 9c7e51443f6b6..ae40d8137fd20 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -1657,7 +1657,7 @@ int genphy_soft_reset(struct phy_device *phydev)
 {
 	int ret;
 
-	ret = phy_write(phydev, MII_BMCR, BMCR_RESET);
+	ret = phy_set_bits(phydev, MII_BMCR, BMCR_RESET);
 	if (ret < 0)
 		return ret;
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 277/639] ARM: OMAP2+: Fix potentially uninitialized return value for _setup_reset()
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (275 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.19 276/639] net: phy: dont clear BMCR in genphy_soft_reset Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.19 278/639] net: dsa: Avoid null pointer when failing to connect to PHY Greg Kroah-Hartman
                   ` (365 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Paul Walmsley, Tero Kristo,
	Tony Lindgren, Sasha Levin

From: Tony Lindgren <tony@atomide.com>

[ Upstream commit 7f0d078667a494466991aa7133f49594f32ff6a2 ]

Commit 747834ab8347 ("ARM: OMAP2+: hwmod: revise hardreset behavior") made
the call to _enable() conditional based on no oh->rst_lines_cnt. This
caused the return value to be potentially uninitialized. Curiously we see
no compiler warnings for this, probably as this gets inlined.

We call _setup_reset() from _setup() and only _setup_postsetup() if the
return value is zero. Currently the return value can be uninitialized for
cases where oh->rst_lines_cnt is set and HWMOD_INIT_NO_RESET is not set.

Fixes: 747834ab8347 ("ARM: OMAP2+: hwmod: revise hardreset behavior")
Cc: Paul Walmsley <paul@pwsan.com>
Cc: Tero Kristo <t-kristo@ti.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/mach-omap2/omap_hwmod.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/mach-omap2/omap_hwmod.c b/arch/arm/mach-omap2/omap_hwmod.c
index ec3789ba17b8b..a8269f0a87ced 100644
--- a/arch/arm/mach-omap2/omap_hwmod.c
+++ b/arch/arm/mach-omap2/omap_hwmod.c
@@ -2430,7 +2430,7 @@ static void _setup_iclk_autoidle(struct omap_hwmod *oh)
  */
 static int _setup_reset(struct omap_hwmod *oh)
 {
-	int r;
+	int r = 0;
 
 	if (oh->_state != _HWMOD_STATE_INITIALIZED)
 		return -EINVAL;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 278/639] net: dsa: Avoid null pointer when failing to connect to PHY
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (276 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.19 277/639] ARM: OMAP2+: Fix potentially uninitialized return value for _setup_reset() Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.19 279/639] soc: qcom: cmd-db: Fix an error code in cmd_db_dev_probe() Greg Kroah-Hartman
                   ` (364 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Vladimir Oltean, Florian Fainelli,
	David S. Miller, Sasha Levin

From: Vladimir Oltean <olteanv@gmail.com>

[ Upstream commit 6146dd453e235c487d85ae4dc6cc08978a1c890f ]

When phylink_of_phy_connect fails, dsa_slave_phy_setup tries to save the
day by connecting to an alternative PHY, none other than a PHY on the
switch's internal MDIO bus, at an address equal to the port's index.

However this does not take into consideration the scenario when the
switch that failed to probe an external PHY does not have an internal
MDIO bus at all.

Fixes: aab9c4067d23 ("net: dsa: Plug in PHYLINK support")
Signed-off-by: Vladimir Oltean <olteanv@gmail.com>
Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/dsa/slave.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/net/dsa/slave.c b/net/dsa/slave.c
index b39720d0995d3..8ee28b6016d82 100644
--- a/net/dsa/slave.c
+++ b/net/dsa/slave.c
@@ -1219,9 +1219,9 @@ static int dsa_slave_phy_setup(struct net_device *slave_dev)
 		phy_flags = ds->ops->get_phy_flags(ds, dp->index);
 
 	ret = phylink_of_phy_connect(dp->pl, port_dn, phy_flags);
-	if (ret == -ENODEV) {
-		/* We could not connect to a designated PHY or SFP, so use the
-		 * switch internal MDIO bus instead
+	if (ret == -ENODEV && ds->slave_mii_bus) {
+		/* We could not connect to a designated PHY or SFP, so try to
+		 * use the switch internal MDIO bus instead
 		 */
 		ret = dsa_slave_phy_connect(slave_dev, dp->index);
 		if (ret) {
@@ -1233,7 +1233,7 @@ static int dsa_slave_phy_setup(struct net_device *slave_dev)
 		}
 	}
 
-	return 0;
+	return ret;
 }
 
 static struct lock_class_key dsa_slave_netdev_xmit_lock_key;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 279/639] soc: qcom: cmd-db: Fix an error code in cmd_db_dev_probe()
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (277 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.19 278/639] net: dsa: Avoid null pointer when failing to connect to PHY Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.19 280/639] media: davinci-isif: avoid uninitialized variable use Greg Kroah-Hartman
                   ` (363 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Bjorn Andersson,
	Andy Gross, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit 93b260528020792032e50725383f27a27897bb0f ]

The memremap() function doesn't return error pointers, it returns NULL.
This code is returning "ret = PTR_ERR(NULL);" which is success, but it
should return -ENOMEM.

Fixes: 312416d9171a ("drivers: qcom: add command DB driver")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Andy Gross <andy.gross@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/soc/qcom/cmd-db.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/soc/qcom/cmd-db.c b/drivers/soc/qcom/cmd-db.c
index a6f646295f067..78d73ec587e11 100644
--- a/drivers/soc/qcom/cmd-db.c
+++ b/drivers/soc/qcom/cmd-db.c
@@ -283,8 +283,8 @@ static int cmd_db_dev_probe(struct platform_device *pdev)
 	}
 
 	cmd_db_header = memremap(rmem->base, rmem->size, MEMREMAP_WB);
-	if (IS_ERR_OR_NULL(cmd_db_header)) {
-		ret = PTR_ERR(cmd_db_header);
+	if (!cmd_db_header) {
+		ret = -ENOMEM;
 		cmd_db_header = NULL;
 		return ret;
 	}
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 280/639] media: davinci-isif: avoid uninitialized variable use
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (278 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.19 279/639] soc: qcom: cmd-db: Fix an error code in cmd_db_dev_probe() Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.19 281/639] media: tw5864: Fix possible NULL pointer dereference in tw5864_handle_frame Greg Kroah-Hartman
                   ` (362 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Arnd Bergmann, Nathan Chancellor,
	Lad, Prabhakar, Hans Verkuil, Mauro Carvalho Chehab, Sasha Levin

From: Arnd Bergmann <arnd@arndb.de>

[ Upstream commit 0e633f97162c1c74c68e2eb20bbd9259dce87cd9 ]

clang warns about a possible variable use that gcc never
complained about:

drivers/media/platform/davinci/isif.c:982:32: error: variable 'frame_size' is uninitialized when used here
      [-Werror,-Wuninitialized]
                dm365_vpss_set_pg_frame_size(frame_size);
                                             ^~~~~~~~~~
drivers/media/platform/davinci/isif.c:887:2: note: variable 'frame_size' is declared here
        struct vpss_pg_frame_size frame_size;
        ^
1 error generated.

There is no initialization for this variable at all, and there
has never been one in the mainline kernel, so we really should
not put that stack data into an mmio register.

On the other hand, I suspect that gcc checks the condition
more closely and notices that the global
isif_cfg.bayer.config_params.test_pat_gen flag is initialized
to zero and never written to from any code path, so anything
depending on it can be eliminated.

To shut up the clang warning, just remove the dead code manually,
it has probably never been used because any attempt to do so
would have resulted in undefined behavior.

Fixes: 63e3ab142fa3 ("V4L/DVB: V4L - vpfe capture - source for ISIF driver on DM365")

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Nathan Chancellor <natechancellor@gmail.com>
Acked-by: Lad, Prabhakar <prabhakar.csengg@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/davinci/isif.c | 9 ---------
 1 file changed, 9 deletions(-)

diff --git a/drivers/media/platform/davinci/isif.c b/drivers/media/platform/davinci/isif.c
index 340f8218f54d3..80fa60a4c4489 100644
--- a/drivers/media/platform/davinci/isif.c
+++ b/drivers/media/platform/davinci/isif.c
@@ -884,9 +884,7 @@ static int isif_set_hw_if_params(struct vpfe_hw_if_param *params)
 static int isif_config_ycbcr(void)
 {
 	struct isif_ycbcr_config *params = &isif_cfg.ycbcr;
-	struct vpss_pg_frame_size frame_size;
 	u32 modeset = 0, ccdcfg = 0;
-	struct vpss_sync_pol sync;
 
 	dev_dbg(isif_cfg.dev, "\nStarting isif_config_ycbcr...");
 
@@ -974,13 +972,6 @@ static int isif_config_ycbcr(void)
 		/* two fields are interleaved in memory */
 		regw(0x00000249, SDOFST);
 
-	/* Setup test pattern if enabled */
-	if (isif_cfg.bayer.config_params.test_pat_gen) {
-		sync.ccdpg_hdpol = params->hd_pol;
-		sync.ccdpg_vdpol = params->vd_pol;
-		dm365_vpss_set_sync_pol(sync);
-		dm365_vpss_set_pg_frame_size(frame_size);
-	}
 	return 0;
 }
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 281/639] media: tw5864: Fix possible NULL pointer dereference in tw5864_handle_frame
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (279 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.19 280/639] media: davinci-isif: avoid uninitialized variable use Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.19 282/639] spi: tegra114: clear packed bit for unpacked mode Greg Kroah-Hartman
                   ` (361 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, YueHaibing, Hans Verkuil,
	Mauro Carvalho Chehab, Sasha Levin

From: YueHaibing <yuehaibing@huawei.com>

[ Upstream commit 2e7682ebfc750177a4944eeb56e97a3f05734528 ]

'vb' null check should be done before dereferencing it in
tw5864_handle_frame, otherwise a NULL pointer dereference
may occur.

Fixes: 34d1324edd31 ("[media] pci: Add tw5864 driver")

Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/pci/tw5864/tw5864-video.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/media/pci/tw5864/tw5864-video.c b/drivers/media/pci/tw5864/tw5864-video.c
index ff2b7da90c088..6c40e60ac9939 100644
--- a/drivers/media/pci/tw5864/tw5864-video.c
+++ b/drivers/media/pci/tw5864/tw5864-video.c
@@ -1395,13 +1395,13 @@ static void tw5864_handle_frame(struct tw5864_h264_frame *frame)
 	input->vb = NULL;
 	spin_unlock_irqrestore(&input->slock, flags);
 
-	v4l2_buf = to_vb2_v4l2_buffer(&vb->vb.vb2_buf);
-
 	if (!vb) { /* Gone because of disabling */
 		dev_dbg(&dev->pci->dev, "vb is empty, dropping frame\n");
 		return;
 	}
 
+	v4l2_buf = to_vb2_v4l2_buffer(&vb->vb.vb2_buf);
+
 	/*
 	 * Check for space.
 	 * Mind the overhead of startcode emulation prevention.
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 282/639] spi: tegra114: clear packed bit for unpacked mode
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (280 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.19 281/639] media: tw5864: Fix possible NULL pointer dereference in tw5864_handle_frame Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.19 283/639] spi: tegra114: fix for unpacked mode transfers Greg Kroah-Hartman
                   ` (360 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sowjanya Komatineni, Mark Brown, Sasha Levin

From: Sowjanya Komatineni <skomatineni@nvidia.com>

[ Upstream commit 7b3d10cdf54b8bc1dc0da21faed9789ac4da3684 ]

Fixes: Clear packed bit when not using packed mode.

Packed bit is not cleared when not using packed mode. This results
in transfer timeouts for the unpacked mode transfers followed by the
packed mode transfers.

Signed-off-by: Sowjanya Komatineni <skomatineni@nvidia.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-tegra114.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/spi/spi-tegra114.c b/drivers/spi/spi-tegra114.c
index a1888dc6a938a..fd039cab768a0 100644
--- a/drivers/spi/spi-tegra114.c
+++ b/drivers/spi/spi-tegra114.c
@@ -730,6 +730,8 @@ static int tegra_spi_start_transfer_one(struct spi_device *spi,
 
 	if (tspi->is_packed)
 		command1 |= SPI_PACKED;
+	else
+		command1 &= ~SPI_PACKED;
 
 	command1 &= ~(SPI_CS_SEL_MASK | SPI_TX_EN | SPI_RX_EN);
 	tspi->cur_direction = 0;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 283/639] spi: tegra114: fix for unpacked mode transfers
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (281 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.19 282/639] spi: tegra114: clear packed bit for unpacked mode Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.19 284/639] spi: tegra114: terminate dma and reset on transfer timeout Greg Kroah-Hartman
                   ` (359 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sowjanya Komatineni, Mark Brown, Sasha Levin

From: Sowjanya Komatineni <skomatineni@nvidia.com>

[ Upstream commit 1a89ac5b91895127f7c586ec5075c3753ca25501 ]

Fixes: computation of actual bytes to fill/receive in/from FIFO in unpacked
mode when transfer length is not a multiple of requested bits per word.

unpacked mode transfers fails when the transfer includes partial bytes in
the last word.

Total words to be written/read to/from FIFO is computed based on transfer
length and bits per word. Unpacked mode includes 0 padding bytes for partial
words to align with bits per word and these extra bytes are also accounted
for calculating bytes left to transfer in the current driver.

This causes extra bytes access of tx/rx buffers along with buffer index
position crossing actual length where remain_len becomes negative and due to
unsigned type, negative value is a 32 bit representation of signed value
and transferred bytes never meets the actual transfer length resulting in
transfer timeout and a hang.

This patch fixes this with proper computation of the actual bytes to fill in
FIFO during transmit and the actual bytes to read from FIFO during receive
ignoring 0 padded bytes.

Signed-off-by: Sowjanya Komatineni <skomatineni@nvidia.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-tegra114.c | 43 +++++++++++++++++++++++++++++++-------
 1 file changed, 36 insertions(+), 7 deletions(-)

diff --git a/drivers/spi/spi-tegra114.c b/drivers/spi/spi-tegra114.c
index fd039cab768a0..17c2c78318f71 100644
--- a/drivers/spi/spi-tegra114.c
+++ b/drivers/spi/spi-tegra114.c
@@ -307,10 +307,16 @@ static unsigned tegra_spi_fill_tx_fifo_from_client_txbuf(
 				x |= (u32)(*tx_buf++) << (i * 8);
 			tegra_spi_writel(tspi, x, SPI_TX_FIFO);
 		}
+
+		tspi->cur_tx_pos += written_words * tspi->bytes_per_word;
 	} else {
+		unsigned int write_bytes;
 		max_n_32bit = min(tspi->curr_dma_words,  tx_empty_count);
 		written_words = max_n_32bit;
 		nbytes = written_words * tspi->bytes_per_word;
+		if (nbytes > t->len - tspi->cur_pos)
+			nbytes = t->len - tspi->cur_pos;
+		write_bytes = nbytes;
 		for (count = 0; count < max_n_32bit; count++) {
 			u32 x = 0;
 
@@ -319,8 +325,10 @@ static unsigned tegra_spi_fill_tx_fifo_from_client_txbuf(
 				x |= (u32)(*tx_buf++) << (i * 8);
 			tegra_spi_writel(tspi, x, SPI_TX_FIFO);
 		}
+
+		tspi->cur_tx_pos += write_bytes;
 	}
-	tspi->cur_tx_pos += written_words * tspi->bytes_per_word;
+
 	return written_words;
 }
 
@@ -344,20 +352,27 @@ static unsigned int tegra_spi_read_rx_fifo_to_client_rxbuf(
 			for (i = 0; len && (i < 4); i++, len--)
 				*rx_buf++ = (x >> i*8) & 0xFF;
 		}
-		tspi->cur_rx_pos += tspi->curr_dma_words * tspi->bytes_per_word;
 		read_words += tspi->curr_dma_words;
+		tspi->cur_rx_pos += tspi->curr_dma_words * tspi->bytes_per_word;
 	} else {
 		u32 rx_mask = ((u32)1 << t->bits_per_word) - 1;
+		u8 bytes_per_word = tspi->bytes_per_word;
+		unsigned int read_bytes;
 
+		len = rx_full_count * bytes_per_word;
+		if (len > t->len - tspi->cur_pos)
+			len = t->len - tspi->cur_pos;
+		read_bytes = len;
 		for (count = 0; count < rx_full_count; count++) {
 			u32 x = tegra_spi_readl(tspi, SPI_RX_FIFO) & rx_mask;
 
-			for (i = 0; (i < tspi->bytes_per_word); i++)
+			for (i = 0; len && (i < bytes_per_word); i++, len--)
 				*rx_buf++ = (x >> (i*8)) & 0xFF;
 		}
-		tspi->cur_rx_pos += rx_full_count * tspi->bytes_per_word;
 		read_words += rx_full_count;
+		tspi->cur_rx_pos += read_bytes;
 	}
+
 	return read_words;
 }
 
@@ -372,12 +387,17 @@ static void tegra_spi_copy_client_txbuf_to_spi_txbuf(
 		unsigned len = tspi->curr_dma_words * tspi->bytes_per_word;
 
 		memcpy(tspi->tx_dma_buf, t->tx_buf + tspi->cur_pos, len);
+		tspi->cur_tx_pos += tspi->curr_dma_words * tspi->bytes_per_word;
 	} else {
 		unsigned int i;
 		unsigned int count;
 		u8 *tx_buf = (u8 *)t->tx_buf + tspi->cur_tx_pos;
 		unsigned consume = tspi->curr_dma_words * tspi->bytes_per_word;
+		unsigned int write_bytes;
 
+		if (consume > t->len - tspi->cur_pos)
+			consume = t->len - tspi->cur_pos;
+		write_bytes = consume;
 		for (count = 0; count < tspi->curr_dma_words; count++) {
 			u32 x = 0;
 
@@ -386,8 +406,9 @@ static void tegra_spi_copy_client_txbuf_to_spi_txbuf(
 				x |= (u32)(*tx_buf++) << (i * 8);
 			tspi->tx_dma_buf[count] = x;
 		}
+
+		tspi->cur_tx_pos += write_bytes;
 	}
-	tspi->cur_tx_pos += tspi->curr_dma_words * tspi->bytes_per_word;
 
 	/* Make the dma buffer to read by dma */
 	dma_sync_single_for_device(tspi->dev, tspi->tx_dma_phys,
@@ -405,20 +426,28 @@ static void tegra_spi_copy_spi_rxbuf_to_client_rxbuf(
 		unsigned len = tspi->curr_dma_words * tspi->bytes_per_word;
 
 		memcpy(t->rx_buf + tspi->cur_rx_pos, tspi->rx_dma_buf, len);
+		tspi->cur_rx_pos += tspi->curr_dma_words * tspi->bytes_per_word;
 	} else {
 		unsigned int i;
 		unsigned int count;
 		unsigned char *rx_buf = t->rx_buf + tspi->cur_rx_pos;
 		u32 rx_mask = ((u32)1 << t->bits_per_word) - 1;
+		unsigned consume = tspi->curr_dma_words * tspi->bytes_per_word;
+		unsigned int read_bytes;
 
+		if (consume > t->len - tspi->cur_pos)
+			consume = t->len - tspi->cur_pos;
+		read_bytes = consume;
 		for (count = 0; count < tspi->curr_dma_words; count++) {
 			u32 x = tspi->rx_dma_buf[count] & rx_mask;
 
-			for (i = 0; (i < tspi->bytes_per_word); i++)
+			for (i = 0; consume && (i < tspi->bytes_per_word);
+							i++, consume--)
 				*rx_buf++ = (x >> (i*8)) & 0xFF;
 		}
+
+		tspi->cur_rx_pos += read_bytes;
 	}
-	tspi->cur_rx_pos += tspi->curr_dma_words * tspi->bytes_per_word;
 
 	/* Make the dma buffer to read by dma */
 	dma_sync_single_for_device(tspi->dev, tspi->rx_dma_phys,
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 284/639] spi: tegra114: terminate dma and reset on transfer timeout
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (282 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.19 283/639] spi: tegra114: fix for unpacked mode transfers Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.19 285/639] spi: tegra114: flush fifos Greg Kroah-Hartman
                   ` (358 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sowjanya Komatineni, Mark Brown, Sasha Levin

From: Sowjanya Komatineni <skomatineni@nvidia.com>

[ Upstream commit 32bd1a9551cae34e6889afa235c7afdfede9aeac ]

Fixes: terminate DMA and perform controller reset on transfer timeout
to clear the FIFO's and errors.

Signed-off-by: Sowjanya Komatineni <skomatineni@nvidia.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-tegra114.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/drivers/spi/spi-tegra114.c b/drivers/spi/spi-tegra114.c
index 17c2c78318f71..b1b726673f850 100644
--- a/drivers/spi/spi-tegra114.c
+++ b/drivers/spi/spi-tegra114.c
@@ -869,7 +869,16 @@ static int tegra_spi_transfer_one_message(struct spi_master *master,
 		if (WARN_ON(ret == 0)) {
 			dev_err(tspi->dev,
 				"spi transfer timeout, err %d\n", ret);
+			if (tspi->is_curr_dma_xfer &&
+			    (tspi->cur_direction & DATA_DIR_TX))
+				dmaengine_terminate_all(tspi->tx_dma_chan);
+			if (tspi->is_curr_dma_xfer &&
+			    (tspi->cur_direction & DATA_DIR_RX))
+				dmaengine_terminate_all(tspi->rx_dma_chan);
 			ret = -EIO;
+			reset_control_assert(tspi->rst);
+			udelay(2);
+			reset_control_deassert(tspi->rst);
 			goto complete_xfer;
 		}
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 285/639] spi: tegra114: flush fifos
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (283 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.19 284/639] spi: tegra114: terminate dma and reset on transfer timeout Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.19 286/639] spi: tegra114: configure dma burst size to fifo trig level Greg Kroah-Hartman
                   ` (357 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sowjanya Komatineni, Mark Brown, Sasha Levin

From: Sowjanya Komatineni <skomatineni@nvidia.com>

[ Upstream commit c4fc9e5b28ff787e35137c2cc13316bb11d7657b ]

Fixes: Flush TX and RX FIFOs before start of new transfer and on FIFO
overflow or underrun errors.

Signed-off-by: Sowjanya Komatineni <skomatineni@nvidia.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-tegra114.c | 39 +++++++++++++++++++++++++++++---------
 1 file changed, 30 insertions(+), 9 deletions(-)

diff --git a/drivers/spi/spi-tegra114.c b/drivers/spi/spi-tegra114.c
index b1b726673f850..5114b80084722 100644
--- a/drivers/spi/spi-tegra114.c
+++ b/drivers/spi/spi-tegra114.c
@@ -499,22 +499,37 @@ static int tegra_spi_start_rx_dma(struct tegra_spi_data *tspi, int len)
 	return 0;
 }
 
-static int tegra_spi_start_dma_based_transfer(
-		struct tegra_spi_data *tspi, struct spi_transfer *t)
+static int tegra_spi_flush_fifos(struct tegra_spi_data *tspi)
 {
-	u32 val;
-	unsigned int len;
-	int ret = 0;
+	unsigned long timeout = jiffies + HZ;
 	u32 status;
 
-	/* Make sure that Rx and Tx fifo are empty */
 	status = tegra_spi_readl(tspi, SPI_FIFO_STATUS);
 	if ((status & SPI_FIFO_EMPTY) != SPI_FIFO_EMPTY) {
-		dev_err(tspi->dev, "Rx/Tx fifo are not empty status 0x%08x\n",
-			(unsigned)status);
-		return -EIO;
+		status |= SPI_RX_FIFO_FLUSH | SPI_TX_FIFO_FLUSH;
+		tegra_spi_writel(tspi, status, SPI_FIFO_STATUS);
+		while ((status & SPI_FIFO_EMPTY) != SPI_FIFO_EMPTY) {
+			status = tegra_spi_readl(tspi, SPI_FIFO_STATUS);
+			if (time_after(jiffies, timeout)) {
+				dev_err(tspi->dev,
+					"timeout waiting for fifo flush\n");
+				return -EIO;
+			}
+
+			udelay(1);
+		}
 	}
 
+	return 0;
+}
+
+static int tegra_spi_start_dma_based_transfer(
+		struct tegra_spi_data *tspi, struct spi_transfer *t)
+{
+	u32 val;
+	unsigned int len;
+	int ret = 0;
+
 	val = SPI_DMA_BLK_SET(tspi->curr_dma_words - 1);
 	tegra_spi_writel(tspi, val, SPI_DMA_BLK);
 
@@ -779,6 +794,9 @@ static int tegra_spi_start_transfer_one(struct spi_device *spi,
 	dev_dbg(tspi->dev, "The def 0x%x and written 0x%x\n",
 		tspi->def_command1_reg, (unsigned)command1);
 
+	ret = tegra_spi_flush_fifos(tspi);
+	if (ret < 0)
+		return ret;
 	if (total_fifo_words > SPI_FIFO_DEPTH)
 		ret = tegra_spi_start_dma_based_transfer(tspi, t);
 	else
@@ -876,6 +894,7 @@ static int tegra_spi_transfer_one_message(struct spi_master *master,
 			    (tspi->cur_direction & DATA_DIR_RX))
 				dmaengine_terminate_all(tspi->rx_dma_chan);
 			ret = -EIO;
+			tegra_spi_flush_fifos(tspi);
 			reset_control_assert(tspi->rst);
 			udelay(2);
 			reset_control_deassert(tspi->rst);
@@ -929,6 +948,7 @@ static irqreturn_t handle_cpu_based_xfer(struct tegra_spi_data *tspi)
 			tspi->status_reg);
 		dev_err(tspi->dev, "CpuXfer 0x%08x:0x%08x\n",
 			tspi->command1_reg, tspi->dma_control_reg);
+		tegra_spi_flush_fifos(tspi);
 		reset_control_assert(tspi->rst);
 		udelay(2);
 		reset_control_deassert(tspi->rst);
@@ -1001,6 +1021,7 @@ static irqreturn_t handle_dma_based_xfer(struct tegra_spi_data *tspi)
 			tspi->status_reg);
 		dev_err(tspi->dev, "DmaXfer 0x%08x:0x%08x\n",
 			tspi->command1_reg, tspi->dma_control_reg);
+		tegra_spi_flush_fifos(tspi);
 		reset_control_assert(tspi->rst);
 		udelay(2);
 		reset_control_deassert(tspi->rst);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 286/639] spi: tegra114: configure dma burst size to fifo trig level
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (284 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.19 285/639] spi: tegra114: flush fifos Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.19 287/639] bus: ti-sysc: Fix sysc_unprepare() when no clocks have been allocated Greg Kroah-Hartman
                   ` (356 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sowjanya Komatineni, Mark Brown, Sasha Levin

From: Sowjanya Komatineni <skomatineni@nvidia.com>

[ Upstream commit f4ce428c41fb22e3ed55496dded94df44cb920fa ]

Fixes: Configure DMA burst size to be same as SPI TX/RX trigger levels
to avoid mismatch.

SPI FIFO trigger levels are calculated based on the transfer length.
So this patch moves DMA slave configuration to happen before start
of DMAs.

Signed-off-by: Sowjanya Komatineni <skomatineni@nvidia.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-tegra114.c | 52 ++++++++++++++++++++++----------------
 1 file changed, 30 insertions(+), 22 deletions(-)

diff --git a/drivers/spi/spi-tegra114.c b/drivers/spi/spi-tegra114.c
index 5114b80084722..09cfae3abce2d 100644
--- a/drivers/spi/spi-tegra114.c
+++ b/drivers/spi/spi-tegra114.c
@@ -529,6 +529,8 @@ static int tegra_spi_start_dma_based_transfer(
 	u32 val;
 	unsigned int len;
 	int ret = 0;
+	u8 dma_burst;
+	struct dma_slave_config dma_sconfig = {0};
 
 	val = SPI_DMA_BLK_SET(tspi->curr_dma_words - 1);
 	tegra_spi_writel(tspi, val, SPI_DMA_BLK);
@@ -540,12 +542,16 @@ static int tegra_spi_start_dma_based_transfer(
 		len = tspi->curr_dma_words * 4;
 
 	/* Set attention level based on length of transfer */
-	if (len & 0xF)
+	if (len & 0xF) {
 		val |= SPI_TX_TRIG_1 | SPI_RX_TRIG_1;
-	else if (((len) >> 4) & 0x1)
+		dma_burst = 1;
+	} else if (((len) >> 4) & 0x1) {
 		val |= SPI_TX_TRIG_4 | SPI_RX_TRIG_4;
-	else
+		dma_burst = 4;
+	} else {
 		val |= SPI_TX_TRIG_8 | SPI_RX_TRIG_8;
+		dma_burst = 8;
+	}
 
 	if (tspi->cur_direction & DATA_DIR_TX)
 		val |= SPI_IE_TX;
@@ -556,7 +562,18 @@ static int tegra_spi_start_dma_based_transfer(
 	tegra_spi_writel(tspi, val, SPI_DMA_CTL);
 	tspi->dma_control_reg = val;
 
+	dma_sconfig.device_fc = true;
 	if (tspi->cur_direction & DATA_DIR_TX) {
+		dma_sconfig.dst_addr = tspi->phys + SPI_TX_FIFO;
+		dma_sconfig.dst_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
+		dma_sconfig.dst_maxburst = dma_burst;
+		ret = dmaengine_slave_config(tspi->tx_dma_chan, &dma_sconfig);
+		if (ret < 0) {
+			dev_err(tspi->dev,
+				"DMA slave config failed: %d\n", ret);
+			return ret;
+		}
+
 		tegra_spi_copy_client_txbuf_to_spi_txbuf(tspi, t);
 		ret = tegra_spi_start_tx_dma(tspi, len);
 		if (ret < 0) {
@@ -567,6 +584,16 @@ static int tegra_spi_start_dma_based_transfer(
 	}
 
 	if (tspi->cur_direction & DATA_DIR_RX) {
+		dma_sconfig.src_addr = tspi->phys + SPI_RX_FIFO;
+		dma_sconfig.src_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
+		dma_sconfig.src_maxburst = dma_burst;
+		ret = dmaengine_slave_config(tspi->rx_dma_chan, &dma_sconfig);
+		if (ret < 0) {
+			dev_err(tspi->dev,
+				"DMA slave config failed: %d\n", ret);
+			return ret;
+		}
+
 		/* Make the dma buffer to read by dma */
 		dma_sync_single_for_device(tspi->dev, tspi->rx_dma_phys,
 				tspi->dma_buf_size, DMA_FROM_DEVICE);
@@ -626,7 +653,6 @@ static int tegra_spi_init_dma_param(struct tegra_spi_data *tspi,
 	u32 *dma_buf;
 	dma_addr_t dma_phys;
 	int ret;
-	struct dma_slave_config dma_sconfig;
 
 	dma_chan = dma_request_slave_channel_reason(tspi->dev,
 					dma_to_memory ? "rx" : "tx");
@@ -646,19 +672,6 @@ static int tegra_spi_init_dma_param(struct tegra_spi_data *tspi,
 		return -ENOMEM;
 	}
 
-	if (dma_to_memory) {
-		dma_sconfig.src_addr = tspi->phys + SPI_RX_FIFO;
-		dma_sconfig.src_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
-		dma_sconfig.src_maxburst = 0;
-	} else {
-		dma_sconfig.dst_addr = tspi->phys + SPI_TX_FIFO;
-		dma_sconfig.dst_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
-		dma_sconfig.dst_maxburst = 0;
-	}
-
-	ret = dmaengine_slave_config(dma_chan, &dma_sconfig);
-	if (ret)
-		goto scrub;
 	if (dma_to_memory) {
 		tspi->rx_dma_chan = dma_chan;
 		tspi->rx_dma_buf = dma_buf;
@@ -669,11 +682,6 @@ static int tegra_spi_init_dma_param(struct tegra_spi_data *tspi,
 		tspi->tx_dma_phys = dma_phys;
 	}
 	return 0;
-
-scrub:
-	dma_free_coherent(tspi->dev, tspi->dma_buf_size, dma_buf, dma_phys);
-	dma_release_channel(dma_chan);
-	return ret;
 }
 
 static void tegra_spi_deinit_dma_param(struct tegra_spi_data *tspi,
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 287/639] bus: ti-sysc: Fix sysc_unprepare() when no clocks have been allocated
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (285 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.19 286/639] spi: tegra114: configure dma burst size to fifo trig level Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.19 288/639] soc/fsl/qe: Fix an error code in qe_pin_request() Greg Kroah-Hartman
                   ` (355 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Tony Lindgren, Sasha Levin

From: Tony Lindgren <tony@atomide.com>

[ Upstream commit aaa29bb01cc4bf5a87dbdb219efba3b09f259d8e ]

If we return early before ddata->clocks have been allocated we will get a
NULL pointer dereference in sysc_unprepare(). Let's fix this by returning
early when no clocks are allocated.

Fixes: 0eecc636e5a2 ("bus: ti-sysc: Add minimal TI sysc interconnect target driver")
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/bus/ti-sysc.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c
index 2813f9ed57c0d..54c8c8644df2e 100644
--- a/drivers/bus/ti-sysc.c
+++ b/drivers/bus/ti-sysc.c
@@ -1400,6 +1400,9 @@ static void sysc_unprepare(struct sysc *ddata)
 {
 	int i;
 
+	if (!ddata->clocks)
+		return;
+
 	for (i = 0; i < SYSC_MAX_CLOCKS; i++) {
 		if (!IS_ERR_OR_NULL(ddata->clocks[i]))
 			clk_unprepare(ddata->clocks[i]);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 288/639] soc/fsl/qe: Fix an error code in qe_pin_request()
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (286 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.19 287/639] bus: ti-sysc: Fix sysc_unprepare() when no clocks have been allocated Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.19 289/639] spi: bcm2835aux: fix driver to not allow 65535 (=-1) cs-gpios Greg Kroah-Hartman
                   ` (354 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Li Yang, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit 5674a92ca4b7e5a6a19231edd10298d30324cd27 ]

We forgot to set "err" on this error path.

Fixes: 1a2d397a6eb5 ("gpio/powerpc: Eliminate duplication of of_get_named_gpio_flags()")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Li Yang <leoyang.li@nxp.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/soc/fsl/qe/gpio.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/soc/fsl/qe/gpio.c b/drivers/soc/fsl/qe/gpio.c
index 819bed0f56679..51b3a47b5a559 100644
--- a/drivers/soc/fsl/qe/gpio.c
+++ b/drivers/soc/fsl/qe/gpio.c
@@ -179,8 +179,10 @@ struct qe_pin *qe_pin_request(struct device_node *np, int index)
 	if (err < 0)
 		goto err0;
 	gc = gpio_to_chip(err);
-	if (WARN_ON(!gc))
+	if (WARN_ON(!gc)) {
+		err = -ENODEV;
 		goto err0;
+	}
 
 	if (!of_device_is_compatible(gc->of_node, "fsl,mpc8323-qe-pario-bank")) {
 		pr_debug("%s: tried to get a non-qe pin\n", __func__);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 289/639] spi: bcm2835aux: fix driver to not allow 65535 (=-1) cs-gpios
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (287 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.19 288/639] soc/fsl/qe: Fix an error code in qe_pin_request() Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.19 290/639] drm/fb-helper: generic: Call drm_client_add() after setup is done Greg Kroah-Hartman
                   ` (353 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Martin Sperl, Stefan Wahren,
	Mark Brown, Sasha Levin

From: Martin Sperl <kernel@martin.sperl.org>

[ Upstream commit 509c583620e9053e43d611bf1614fc3d3abafa96 ]

The original driver by default defines num_chipselects as -1.
This actually allicates an array of 65535 entries in
of_spi_register_master.

There is a side-effect for buggy device trees that (contrary to
dt-binding documentation) have no cs-gpio defined.

This mode was never supported by the driver due to limitations
of native cs and additional code complexity and is explicitly
not stated to be implemented.

To keep backwards compatibility with such buggy DTs we limit
the number of chip_selects to 1, as for all practical purposes
it is only ever realistic to use a single chip select in
native cs mode without negative side-effects.

Fixes: 1ea29b39f4c812ec ("spi: bcm2835aux: add bcm2835 auxiliary spi device...")
Signed-off-by: Martin Sperl <kernel@martin.sperl.org>
Acked-by: Stefan Wahren <stefan.wahren@i2se.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-bcm2835aux.c | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/drivers/spi/spi-bcm2835aux.c b/drivers/spi/spi-bcm2835aux.c
index 12c1fa5b06c5b..c63ed402cf860 100644
--- a/drivers/spi/spi-bcm2835aux.c
+++ b/drivers/spi/spi-bcm2835aux.c
@@ -416,7 +416,18 @@ static int bcm2835aux_spi_probe(struct platform_device *pdev)
 	platform_set_drvdata(pdev, master);
 	master->mode_bits = (SPI_CPOL | SPI_CS_HIGH | SPI_NO_CS);
 	master->bits_per_word_mask = SPI_BPW_MASK(8);
-	master->num_chipselect = -1;
+	/* even though the driver never officially supported native CS
+	 * allow a single native CS for legacy DT support purposes when
+	 * no cs-gpio is configured.
+	 * Known limitations for native cs are:
+	 * * multiple chip-selects: cs0-cs2 are all simultaniously asserted
+	 *     whenever there is a transfer -  this even includes SPI_NO_CS
+	 * * SPI_CS_HIGH: is ignores - cs are always asserted low
+	 * * cs_change: cs is deasserted after each spi_transfer
+	 * * cs_delay_usec: cs is always deasserted one SCK cycle after
+	 *     a spi_transfer
+	 */
+	master->num_chipselect = 1;
 	master->transfer_one = bcm2835aux_spi_transfer_one;
 	master->handle_err = bcm2835aux_spi_handle_err;
 	master->prepare_message = bcm2835aux_spi_prepare_message;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 290/639] drm/fb-helper: generic: Call drm_client_add() after setup is done
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (288 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.19 289/639] spi: bcm2835aux: fix driver to not allow 65535 (=-1) cs-gpios Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.19 291/639] arm64/vdso: dont leak kernel addresses Greg Kroah-Hartman
                   ` (352 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Daniel Vetter, Noralf Trønnes,
	Sasha Levin

From: Noralf Trønnes <noralf@tronnes.org>

[ Upstream commit 6e3f17ee73f7e3c2ef0e2c8fd8624b2ece8ef2c9 ]

Hotplug can happen while drm_fbdev_generic_setup() is running so move
drm_client_add() call after setup is done to avoid
drm_fbdev_client_hotplug() running in two threads at the same time.

Fixes: 9060d7f49376 ("drm/fb-helper: Finish the generic fbdev emulation")
Cc: stable@vger.kernel.org
Reported-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20190401141358.25309-1-noralf@tronnes.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/drm_fb_helper.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
index 1c87ad6667e73..da9a381d6b577 100644
--- a/drivers/gpu/drm/drm_fb_helper.c
+++ b/drivers/gpu/drm/drm_fb_helper.c
@@ -3257,8 +3257,6 @@ int drm_fbdev_generic_setup(struct drm_device *dev, unsigned int preferred_bpp)
 		return ret;
 	}
 
-	drm_client_add(&fb_helper->client);
-
 	if (!preferred_bpp)
 		preferred_bpp = dev->mode_config.preferred_depth;
 	if (!preferred_bpp)
@@ -3267,6 +3265,8 @@ int drm_fbdev_generic_setup(struct drm_device *dev, unsigned int preferred_bpp)
 
 	drm_fbdev_client_hotplug(&fb_helper->client);
 
+	drm_client_add(&fb_helper->client);
+
 	return 0;
 }
 EXPORT_SYMBOL(drm_fbdev_generic_setup);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 291/639] arm64/vdso: dont leak kernel addresses
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (289 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.19 290/639] drm/fb-helper: generic: Call drm_client_add() after setup is done Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.19 292/639] rtc: Fix timestamp value for RTC_TIMESTAMP_BEGIN_1900 Greg Kroah-Hartman
                   ` (351 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Mark Rutland, Matteo Croce,
	Will Deacon, Sasha Levin

From: Matteo Croce <mcroce@redhat.com>

[ Upstream commit 0f1bf7e39822476b2f921435cf990f67a61f5f92 ]

Since commit ad67b74d2469d9b8 ("printk: hash addresses printed with %p"),
two obfuscated kernel pointer are printed at every boot:

    vdso: 2 pages (1 code @ (____ptrval____), 1 data @ (____ptrval____))

Remove the the print completely, as it's useless without the addresses.

Fixes: ad67b74d2469d9b8 ("printk: hash addresses printed with %p")
Acked-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Matteo Croce <mcroce@redhat.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/kernel/vdso.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/arch/arm64/kernel/vdso.c b/arch/arm64/kernel/vdso.c
index ec0bb588d7553..42b7082029e1d 100644
--- a/arch/arm64/kernel/vdso.c
+++ b/arch/arm64/kernel/vdso.c
@@ -146,8 +146,6 @@ static int __init vdso_init(void)
 	}
 
 	vdso_pages = (vdso_end - vdso_start) >> PAGE_SHIFT;
-	pr_info("vdso: %ld pages (%ld code @ %p, %ld data @ %p)\n",
-		vdso_pages + 1, vdso_pages, vdso_start, 1L, vdso_data);
 
 	/* Allocate the vDSO pagelist, plus a page for the data. */
 	vdso_pagelist = kcalloc(vdso_pages + 1, sizeof(struct page *),
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 292/639] rtc: Fix timestamp value for RTC_TIMESTAMP_BEGIN_1900
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (290 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.19 291/639] arm64/vdso: dont leak kernel addresses Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.19 293/639] rtc: mt6397: Dont call irq_dispose_mapping Greg Kroah-Hartman
                   ` (350 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Geert Uytterhoeven,
	Alexandre Belloni, Sasha Levin

From: Geert Uytterhoeven <geert+renesas@glider.be>

[ Upstream commit d3062d1d7415cb5a37777220357aca51a491c3d7 ]

Printing "mktime64(1900, 1, 1, 0, 0, 0)" gives -2208988800.

Fixes: 83bbc5ac63326433 ("rtc: Add useful timestamp definitions")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/rtc.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/linux/rtc.h b/include/linux/rtc.h
index 6aedc30003e73..5a34f59941fb7 100644
--- a/include/linux/rtc.h
+++ b/include/linux/rtc.h
@@ -163,7 +163,7 @@ struct rtc_device {
 #define to_rtc_device(d) container_of(d, struct rtc_device, dev)
 
 /* useful timestamps */
-#define RTC_TIMESTAMP_BEGIN_1900	-2208989361LL /* 1900-01-01 00:00:00 */
+#define RTC_TIMESTAMP_BEGIN_1900	-2208988800LL /* 1900-01-01 00:00:00 */
 #define RTC_TIMESTAMP_BEGIN_2000	946684800LL /* 2000-01-01 00:00:00 */
 #define RTC_TIMESTAMP_END_2099		4102444799LL /* 2099-12-31 23:59:59 */
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 293/639] rtc: mt6397: Dont call irq_dispose_mapping.
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (291 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.19 292/639] rtc: Fix timestamp value for RTC_TIMESTAMP_BEGIN_1900 Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.19 294/639] ehea: Fix a copy-paste err in ehea_init_port_res Greg Kroah-Hartman
                   ` (349 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Pi-Hsun Shih, Alexandre Belloni, Sasha Levin

From: Pi-Hsun Shih <pihsun@chromium.org>

[ Upstream commit 24db953e942bd7a983e97892bdaddf69d00b1199 ]

The IRQ mapping was changed to not being created in the rtc-mt6397
driver, so the irq_dispose_mapping is no longer needed.
Also the dev_id passed to free_irq should be the same as the last
argument passed to request_threaded_irq.
This prevents a "Trying to free already-free IRQ 274" warning when
unbinding the driver.

Fixes: e695d3a0b3b3 ("mfd: mt6397: Create irq mappings in mfd core driver")
Signed-off-by: Pi-Hsun Shih <pihsun@chromium.org>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/rtc/rtc-mt6397.c | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/drivers/rtc/rtc-mt6397.c b/drivers/rtc/rtc-mt6397.c
index f85f1fc29e32e..964ed91416e1b 100644
--- a/drivers/rtc/rtc-mt6397.c
+++ b/drivers/rtc/rtc-mt6397.c
@@ -362,7 +362,7 @@ static int mtk_rtc_probe(struct platform_device *pdev)
 	if (ret) {
 		dev_err(&pdev->dev, "Failed to request alarm IRQ: %d: %d\n",
 			rtc->irq, ret);
-		goto out_dispose_irq;
+		return ret;
 	}
 
 	device_init_wakeup(&pdev->dev, 1);
@@ -378,9 +378,7 @@ static int mtk_rtc_probe(struct platform_device *pdev)
 	return 0;
 
 out_free_irq:
-	free_irq(rtc->irq, rtc->rtc_dev);
-out_dispose_irq:
-	irq_dispose_mapping(rtc->irq);
+	free_irq(rtc->irq, rtc);
 	return ret;
 }
 
@@ -388,8 +386,7 @@ static int mtk_rtc_remove(struct platform_device *pdev)
 {
 	struct mt6397_rtc *rtc = platform_get_drvdata(pdev);
 
-	free_irq(rtc->irq, rtc->rtc_dev);
-	irq_dispose_mapping(rtc->irq);
+	free_irq(rtc->irq, rtc);
 
 	return 0;
 }
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 294/639] ehea: Fix a copy-paste err in ehea_init_port_res
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (292 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.19 293/639] rtc: mt6397: Dont call irq_dispose_mapping Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.19 295/639] bpf: Add missed newline in verifier verbose log Greg Kroah-Hartman
                   ` (348 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, YueHaibing, Mukesh Ojha,
	David S. Miller, Sasha Levin

From: YueHaibing <yuehaibing@huawei.com>

[ Upstream commit c8f191282f819ab4e9b47b22a65c6c29734cefce ]

pr->tx_bytes should be assigned to tx_bytes other than
rx_bytes.

Reported-by: Hulk Robot <hulkci@huawei.com>
Fixes: ce45b873028f ("ehea: Fixing statistics")
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Reviewed-by: Mukesh Ojha <mojha@codeaurora.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/ibm/ehea/ehea_main.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/ibm/ehea/ehea_main.c b/drivers/net/ethernet/ibm/ehea/ehea_main.c
index e8ee69d4e4d34..0f799e8e093cd 100644
--- a/drivers/net/ethernet/ibm/ehea/ehea_main.c
+++ b/drivers/net/ethernet/ibm/ehea/ehea_main.c
@@ -1464,7 +1464,7 @@ static int ehea_init_port_res(struct ehea_port *port, struct ehea_port_res *pr,
 
 	memset(pr, 0, sizeof(struct ehea_port_res));
 
-	pr->tx_bytes = rx_bytes;
+	pr->tx_bytes = tx_bytes;
 	pr->tx_packets = tx_packets;
 	pr->rx_bytes = rx_bytes;
 	pr->rx_packets = rx_packets;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 295/639] bpf: Add missed newline in verifier verbose log
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (293 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.19 294/639] ehea: Fix a copy-paste err in ehea_init_port_res Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.19 296/639] drm/vmwgfx: Remove set but not used variable restart Greg Kroah-Hartman
                   ` (347 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Andrey Ignatov, Daniel Borkmann, Sasha Levin

From: Andrey Ignatov <rdna@fb.com>

[ Upstream commit 1fbd20f8b77b366ea4aeb92ade72daa7f36a7e3b ]

check_stack_access() that prints verbose log is used in
adjust_ptr_min_max_vals() that prints its own verbose log and now they
stick together, e.g.:

  variable stack access var_off=(0xfffffffffffffff0; 0x4) off=-16
  size=1R2 stack pointer arithmetic goes out of range, prohibited for
  !root

Add missing newline so that log is more readable:
  variable stack access var_off=(0xfffffffffffffff0; 0x4) off=-16 size=1
  R2 stack pointer arithmetic goes out of range, prohibited for !root

Fixes: f1174f77b50c ("bpf/verifier: rework value tracking")
Signed-off-by: Andrey Ignatov <rdna@fb.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/bpf/verifier.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 9bbfb1ff4ac94..e85636fb81b9c 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -1253,7 +1253,7 @@ static int check_stack_access(struct bpf_verifier_env *env,
 		char tn_buf[48];
 
 		tnum_strn(tn_buf, sizeof(tn_buf), reg->var_off);
-		verbose(env, "variable stack access var_off=%s off=%d size=%d",
+		verbose(env, "variable stack access var_off=%s off=%d size=%d\n",
 			tn_buf, off, size);
 		return -EACCES;
 	}
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 296/639] drm/vmwgfx: Remove set but not used variable restart
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (294 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.19 295/639] bpf: Add missed newline in verifier verbose log Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.19 297/639] scsi: qla2xxx: Unregister chrdev if module initialization fails Greg Kroah-Hartman
                   ` (346 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, YueHaibing, Deepak Rawat, Sasha Levin

From: YueHaibing <yuehaibing@huawei.com>

[ Upstream commit b2130cca9c8db5073b71d832da2a6c8311a8f3bb ]

Fixes gcc '-Wunused-but-set-variable' warning:

drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf.c: In function 'vmw_cmdbuf_work_func':
drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf.c:514:7: warning:
 variable 'restart' set but not used [-Wunused-but-set-variable]

It not used any more after commit dc366364c4ef ("drm/vmwgfx: Fix multiple
command buffer context use")

Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Reviewed-by: Deepak Rawat <drawat@vmware.com>
Signed-off-by: Deepak Rawat <drawat@vmware.com>
Fixes: dc366364c4ef ("drm/vmwgfx: Fix multiple command buffer context use")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf.c | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf.c
index e7e4655d3f36b..ce1ad7cd78996 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf.c
@@ -511,17 +511,14 @@ static void vmw_cmdbuf_work_func(struct work_struct *work)
 		container_of(work, struct vmw_cmdbuf_man, work);
 	struct vmw_cmdbuf_header *entry, *next;
 	uint32_t dummy;
-	bool restart[SVGA_CB_CONTEXT_MAX];
 	bool send_fence = false;
 	struct list_head restart_head[SVGA_CB_CONTEXT_MAX];
 	int i;
 	struct vmw_cmdbuf_context *ctx;
 	bool global_block = false;
 
-	for_each_cmdbuf_ctx(man, i, ctx) {
+	for_each_cmdbuf_ctx(man, i, ctx)
 		INIT_LIST_HEAD(&restart_head[i]);
-		restart[i] = false;
-	}
 
 	mutex_lock(&man->error_mutex);
 	spin_lock(&man->lock);
@@ -533,7 +530,6 @@ static void vmw_cmdbuf_work_func(struct work_struct *work)
 		const char *cmd_name;
 
 		list_del_init(&entry->list);
-		restart[entry->cb_context] = true;
 		global_block = true;
 
 		if (!vmw_cmd_describe(header, &error_cmd_size, &cmd_name)) {
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 297/639] scsi: qla2xxx: Unregister chrdev if module initialization fails
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (295 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.19 296/639] drm/vmwgfx: Remove set but not used variable restart Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.19 298/639] of: use correct function prototype for of_overlay_fdt_apply() Greg Kroah-Hartman
                   ` (345 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Himanshu Madhani, Giridhar Malavali,
	Bart Van Assche, Martin K. Petersen, Sasha Levin

From: Bart Van Assche <bvanassche@acm.org>

[ Upstream commit c794d24ec9eb6658909955772e70f34bef5b5b91 ]

If module initialization fails after the character device has been
registered, unregister the character device. Additionally, avoid
duplicating error path code.

Cc: Himanshu Madhani <hmadhani@marvell.com>
Cc: Giridhar Malavali <giridhar.malavali@qlogic.com>
Fixes: 6a03b4cd78f3 ("[SCSI] qla2xxx: Add char device to increase driver use count") # v2.6.35.
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/qla2xxx/qla_os.c | 34 +++++++++++++++++++++-------------
 1 file changed, 21 insertions(+), 13 deletions(-)

diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index bb20a4a228cfe..fff20a3707677 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -6967,8 +6967,7 @@ qla2x00_module_init(void)
 	/* Initialize target kmem_cache and mem_pools */
 	ret = qlt_init();
 	if (ret < 0) {
-		kmem_cache_destroy(srb_cachep);
-		return ret;
+		goto destroy_cache;
 	} else if (ret > 0) {
 		/*
 		 * If initiator mode is explictly disabled by qlt_init(),
@@ -6989,11 +6988,10 @@ qla2x00_module_init(void)
 	qla2xxx_transport_template =
 	    fc_attach_transport(&qla2xxx_transport_functions);
 	if (!qla2xxx_transport_template) {
-		kmem_cache_destroy(srb_cachep);
 		ql_log(ql_log_fatal, NULL, 0x0002,
 		    "fc_attach_transport failed...Failing load!.\n");
-		qlt_exit();
-		return -ENODEV;
+		ret = -ENODEV;
+		goto qlt_exit;
 	}
 
 	apidev_major = register_chrdev(0, QLA2XXX_APIDEV, &apidev_fops);
@@ -7005,27 +7003,37 @@ qla2x00_module_init(void)
 	qla2xxx_transport_vport_template =
 	    fc_attach_transport(&qla2xxx_transport_vport_functions);
 	if (!qla2xxx_transport_vport_template) {
-		kmem_cache_destroy(srb_cachep);
-		qlt_exit();
-		fc_release_transport(qla2xxx_transport_template);
 		ql_log(ql_log_fatal, NULL, 0x0004,
 		    "fc_attach_transport vport failed...Failing load!.\n");
-		return -ENODEV;
+		ret = -ENODEV;
+		goto unreg_chrdev;
 	}
 	ql_log(ql_log_info, NULL, 0x0005,
 	    "QLogic Fibre Channel HBA Driver: %s.\n",
 	    qla2x00_version_str);
 	ret = pci_register_driver(&qla2xxx_pci_driver);
 	if (ret) {
-		kmem_cache_destroy(srb_cachep);
-		qlt_exit();
-		fc_release_transport(qla2xxx_transport_template);
-		fc_release_transport(qla2xxx_transport_vport_template);
 		ql_log(ql_log_fatal, NULL, 0x0006,
 		    "pci_register_driver failed...ret=%d Failing load!.\n",
 		    ret);
+		goto release_vport_transport;
 	}
 	return ret;
+
+release_vport_transport:
+	fc_release_transport(qla2xxx_transport_vport_template);
+
+unreg_chrdev:
+	if (apidev_major >= 0)
+		unregister_chrdev(apidev_major, QLA2XXX_APIDEV);
+	fc_release_transport(qla2xxx_transport_template);
+
+qlt_exit:
+	qlt_exit();
+
+destroy_cache:
+	kmem_cache_destroy(srb_cachep);
+	return ret;
 }
 
 /**
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 298/639] of: use correct function prototype for of_overlay_fdt_apply()
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (296 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.19 297/639] scsi: qla2xxx: Unregister chrdev if module initialization fails Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.19 299/639] net/sched: cbs: fix port_rate miscalculation Greg Kroah-Hartman
                   ` (344 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chris Packham, Frank Rowand,
	Rob Herring, Sasha Levin

From: Chris Packham <chris.packham@alliedtelesis.co.nz>

[ Upstream commit ecb0abc1d8528015957fbd034be8bfe760363b3b ]

When CONFIG_OF_OVERLAY is not enabled the fallback stub for
of_overlay_fdt_apply() does not match the prototype for the case when
CONFIG_OF_OVERLAY is enabled. Update the stub to use the correct
function prototype.

Fixes: 39a751a4cb7e ("of: change overlay apply input data from unflattened to FDT")
Signed-off-by: Chris Packham <chris.packham@alliedtelesis.co.nz>
Reviewed-by: Frank Rowand <frank.rowand@sony.com>
Signed-off-by: Rob Herring <robh@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/of.h | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/include/linux/of.h b/include/linux/of.h
index dac0201eacef7..d4f14b0302b63 100644
--- a/include/linux/of.h
+++ b/include/linux/of.h
@@ -1425,7 +1425,8 @@ int of_overlay_notifier_unregister(struct notifier_block *nb);
 
 #else
 
-static inline int of_overlay_fdt_apply(void *overlay_fdt, int *ovcs_id)
+static inline int of_overlay_fdt_apply(void *overlay_fdt, u32 overlay_fdt_size,
+				       int *ovcs_id)
 {
 	return -ENOTSUPP;
 }
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 299/639] net/sched: cbs: fix port_rate miscalculation
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (297 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.19 298/639] of: use correct function prototype for of_overlay_fdt_apply() Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.19 300/639] clk: qcom: Skip halt checks on gcc_pcie_0_pipe_clk for 8998 Greg Kroah-Hartman
                   ` (343 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Leandro Dorileo, Vedang Patel,
	David S. Miller, Sasha Levin

From: Leandro Dorileo <leandro.maciel.dorileo@intel.com>

[ Upstream commit e0a7683d30e91e30ee6cf96314ae58a0314a095e ]

The Credit Based Shaper heavily depends on link speed to calculate
the scheduling credits, we can't properly calculate the credits if the
device has failed to report the link speed.

In that case we can't dequeue packets assuming a wrong port rate that will
result into an inconsistent credit distribution.

This patch makes sure we fail to dequeue case:

1) __ethtool_get_link_ksettings() reports error or 2) the ethernet driver
failed to set the ksettings' speed value (setting link speed to
SPEED_UNKNOWN).

Additionally we properly re calculate the port rate whenever the link speed
is changed.

Fixes: 3d0bd028ffb4a ("net/sched: Add support for HW offloading for CBS")
Signed-off-by: Leandro Dorileo <leandro.maciel.dorileo@intel.com>
Reviewed-by: Vedang Patel <vedang.patel@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/sched/sch_cbs.c | 98 ++++++++++++++++++++++++++++++++++++++-------
 1 file changed, 84 insertions(+), 14 deletions(-)

diff --git a/net/sched/sch_cbs.c b/net/sched/sch_cbs.c
index e26a24017faa6..81f84cb5dd23b 100644
--- a/net/sched/sch_cbs.c
+++ b/net/sched/sch_cbs.c
@@ -61,16 +61,20 @@
 #include <linux/string.h>
 #include <linux/errno.h>
 #include <linux/skbuff.h>
+#include <net/netevent.h>
 #include <net/netlink.h>
 #include <net/sch_generic.h>
 #include <net/pkt_sched.h>
 
+static LIST_HEAD(cbs_list);
+static DEFINE_SPINLOCK(cbs_list_lock);
+
 #define BYTES_PER_KBIT (1000LL / 8)
 
 struct cbs_sched_data {
 	bool offload;
 	int queue;
-	s64 port_rate; /* in bytes/s */
+	atomic64_t port_rate; /* in bytes/s */
 	s64 last; /* timestamp in ns */
 	s64 credits; /* in bytes */
 	s32 locredit; /* in bytes */
@@ -82,6 +86,7 @@ struct cbs_sched_data {
 		       struct sk_buff **to_free);
 	struct sk_buff *(*dequeue)(struct Qdisc *sch);
 	struct Qdisc *qdisc;
+	struct list_head cbs_list;
 };
 
 static int cbs_child_enqueue(struct sk_buff *skb, struct Qdisc *sch,
@@ -180,6 +185,11 @@ static struct sk_buff *cbs_dequeue_soft(struct Qdisc *sch)
 	s64 credits;
 	int len;
 
+	if (atomic64_read(&q->port_rate) == -1) {
+		WARN_ONCE(1, "cbs: dequeue() called with unknown port rate.");
+		return NULL;
+	}
+
 	if (q->credits < 0) {
 		credits = timediff_to_credits(now - q->last, q->idleslope);
 
@@ -206,7 +216,8 @@ static struct sk_buff *cbs_dequeue_soft(struct Qdisc *sch)
 	/* As sendslope is a negative number, this will decrease the
 	 * amount of q->credits.
 	 */
-	credits = credits_from_len(len, q->sendslope, q->port_rate);
+	credits = credits_from_len(len, q->sendslope,
+				   atomic64_read(&q->port_rate));
 	credits += q->credits;
 
 	q->credits = max_t(s64, credits, q->locredit);
@@ -293,6 +304,50 @@ static int cbs_enable_offload(struct net_device *dev, struct cbs_sched_data *q,
 	return 0;
 }
 
+static void cbs_set_port_rate(struct net_device *dev, struct cbs_sched_data *q)
+{
+	struct ethtool_link_ksettings ecmd;
+	int port_rate = -1;
+
+	if (!__ethtool_get_link_ksettings(dev, &ecmd) &&
+	    ecmd.base.speed != SPEED_UNKNOWN)
+		port_rate = ecmd.base.speed * 1000 * BYTES_PER_KBIT;
+
+	atomic64_set(&q->port_rate, port_rate);
+	netdev_dbg(dev, "cbs: set %s's port_rate to: %lld, linkspeed: %d\n",
+		   dev->name, (long long)atomic64_read(&q->port_rate),
+		   ecmd.base.speed);
+}
+
+static int cbs_dev_notifier(struct notifier_block *nb, unsigned long event,
+			    void *ptr)
+{
+	struct net_device *dev = netdev_notifier_info_to_dev(ptr);
+	struct cbs_sched_data *q;
+	struct net_device *qdev;
+	bool found = false;
+
+	ASSERT_RTNL();
+
+	if (event != NETDEV_UP && event != NETDEV_CHANGE)
+		return NOTIFY_DONE;
+
+	spin_lock(&cbs_list_lock);
+	list_for_each_entry(q, &cbs_list, cbs_list) {
+		qdev = qdisc_dev(q->qdisc);
+		if (qdev == dev) {
+			found = true;
+			break;
+		}
+	}
+	spin_unlock(&cbs_list_lock);
+
+	if (found)
+		cbs_set_port_rate(dev, q);
+
+	return NOTIFY_DONE;
+}
+
 static int cbs_change(struct Qdisc *sch, struct nlattr *opt,
 		      struct netlink_ext_ack *extack)
 {
@@ -314,16 +369,7 @@ static int cbs_change(struct Qdisc *sch, struct nlattr *opt,
 	qopt = nla_data(tb[TCA_CBS_PARMS]);
 
 	if (!qopt->offload) {
-		struct ethtool_link_ksettings ecmd;
-		s64 link_speed;
-
-		if (!__ethtool_get_link_ksettings(dev, &ecmd))
-			link_speed = ecmd.base.speed;
-		else
-			link_speed = SPEED_1000;
-
-		q->port_rate = link_speed * 1000 * BYTES_PER_KBIT;
-
+		cbs_set_port_rate(dev, q);
 		cbs_disable_offload(dev, q);
 	} else {
 		err = cbs_enable_offload(dev, q, qopt, extack);
@@ -346,6 +392,7 @@ static int cbs_init(struct Qdisc *sch, struct nlattr *opt,
 {
 	struct cbs_sched_data *q = qdisc_priv(sch);
 	struct net_device *dev = qdisc_dev(sch);
+	int err;
 
 	if (!opt) {
 		NL_SET_ERR_MSG(extack, "Missing CBS qdisc options  which are mandatory");
@@ -366,7 +413,17 @@ static int cbs_init(struct Qdisc *sch, struct nlattr *opt,
 
 	qdisc_watchdog_init(&q->watchdog, sch);
 
-	return cbs_change(sch, opt, extack);
+	err = cbs_change(sch, opt, extack);
+	if (err)
+		return err;
+
+	if (!q->offload) {
+		spin_lock(&cbs_list_lock);
+		list_add(&q->cbs_list, &cbs_list);
+		spin_unlock(&cbs_list_lock);
+	}
+
+	return 0;
 }
 
 static void cbs_destroy(struct Qdisc *sch)
@@ -374,8 +431,11 @@ static void cbs_destroy(struct Qdisc *sch)
 	struct cbs_sched_data *q = qdisc_priv(sch);
 	struct net_device *dev = qdisc_dev(sch);
 
-	qdisc_watchdog_cancel(&q->watchdog);
+	spin_lock(&cbs_list_lock);
+	list_del(&q->cbs_list);
+	spin_unlock(&cbs_list_lock);
 
+	qdisc_watchdog_cancel(&q->watchdog);
 	cbs_disable_offload(dev, q);
 
 	if (q->qdisc)
@@ -486,14 +546,24 @@ static struct Qdisc_ops cbs_qdisc_ops __read_mostly = {
 	.owner		=	THIS_MODULE,
 };
 
+static struct notifier_block cbs_device_notifier = {
+	.notifier_call = cbs_dev_notifier,
+};
+
 static int __init cbs_module_init(void)
 {
+	int err = register_netdevice_notifier(&cbs_device_notifier);
+
+	if (err)
+		return err;
+
 	return register_qdisc(&cbs_qdisc_ops);
 }
 
 static void __exit cbs_module_exit(void)
 {
 	unregister_qdisc(&cbs_qdisc_ops);
+	unregister_netdevice_notifier(&cbs_device_notifier);
 }
 module_init(cbs_module_init)
 module_exit(cbs_module_exit)
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 300/639] clk: qcom: Skip halt checks on gcc_pcie_0_pipe_clk for 8998
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (298 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.19 299/639] net/sched: cbs: fix port_rate miscalculation Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.19 301/639] ACPI: button: reinitialize button state upon resume Greg Kroah-Hartman
                   ` (342 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Marc Gonzalez, Jeffrey Hugo,
	Stephen Boyd, Sasha Levin

From: Marc Gonzalez <marc.w.gonzalez@free.fr>

[ Upstream commit c0ee0e43c049a13d11e913edf875e4ee376dc84b ]

See similar issue solved by commit 5f2420ed2189
("clk: qcom: Skip halt checks on gcc_usb3_phy_pipe_clk for 8998")

Without this patch, PCIe PHY init fails:

qcom-qmp-phy 1c06000.phy: pipe_clk enable failed err=-16
phy phy-1c06000.phy.0: phy init failed --> -16

Signed-off-by: Marc Gonzalez <marc.w.gonzalez@free.fr>
Reviewed-by: Jeffrey Hugo <jhugo@codeaurora.org>
Fixes: b5f5f525c547 ("clk: qcom: Add MSM8998 Global Clock Control (GCC) driver")
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/qcom/gcc-msm8998.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/clk/qcom/gcc-msm8998.c b/drivers/clk/qcom/gcc-msm8998.c
index 4e23973b6cd16..772a08101ddf2 100644
--- a/drivers/clk/qcom/gcc-msm8998.c
+++ b/drivers/clk/qcom/gcc-msm8998.c
@@ -2144,7 +2144,7 @@ static struct clk_branch gcc_pcie_0_mstr_axi_clk = {
 
 static struct clk_branch gcc_pcie_0_pipe_clk = {
 	.halt_reg = 0x6b018,
-	.halt_check = BRANCH_HALT,
+	.halt_check = BRANCH_HALT_SKIP,
 	.clkr = {
 		.enable_reg = 0x6b018,
 		.enable_mask = BIT(0),
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 301/639] ACPI: button: reinitialize button state upon resume
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (299 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.19 300/639] clk: qcom: Skip halt checks on gcc_pcie_0_pipe_clk for 8998 Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.19 302/639] firmware: arm_scmi: fix of_node leak in scmi_mailbox_check Greg Kroah-Hartman
                   ` (341 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Zhang Rui, Rafael J. Wysocki,
	Sasha Levin, Zhao Lijian

From: Zhang Rui <rui.zhang@intel.com>

[ Upstream commit 13e962140be671f31a011543f11477af67a6c33e ]

With commit dfa46c50f65b ("ACPI / button: Fix an issue in
button.lid_init_state=ignore mode"), the lid device is considered to be
not compliant to SW_LID if the Lid state is unchanged when updating it.

This is not wrong, but we overlooked the resume case, where Lid state is
updated unconditionally in the button driver .resume() callback. And this
results in warning message "ACPI: button: The lid device is not compliant
to  SW_LID." after resume, if the machine is suspended with Lid opened and
then resumed with Lid opened.

Fix this by flushing the cached lid state before updating the Lid device
in .resume() callback.

Fixes: dfa46c50f65b ("ACPI / button: Fix an issue in button.lid_init_state=ignore mode")
Reported-and-tested-by: Zhao Lijian <lijian.zhao@intel.com>
Signed-off-by: Zhang Rui <rui.zhang@intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/acpi/button.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/acpi/button.c b/drivers/acpi/button.c
index 870eb5c7516a5..a25d77b3a16ad 100644
--- a/drivers/acpi/button.c
+++ b/drivers/acpi/button.c
@@ -467,8 +467,11 @@ static int acpi_button_resume(struct device *dev)
 	struct acpi_button *button = acpi_driver_data(device);
 
 	button->suspended = false;
-	if (button->type == ACPI_BUTTON_TYPE_LID && button->input->users)
+	if (button->type == ACPI_BUTTON_TYPE_LID && button->input->users) {
+		button->last_state = !!acpi_lid_evaluate_state(device);
+		button->last_time = ktime_get();
 		acpi_lid_initialize_state(device);
+	}
 	return 0;
 }
 #endif
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 302/639] firmware: arm_scmi: fix of_node leak in scmi_mailbox_check
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (300 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.19 301/639] ACPI: button: reinitialize button state upon resume Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.19 303/639] rxrpc: Fix detection of out of order acks Greg Kroah-Hartman
                   ` (340 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Steven Price, Sudeep Holla, Sasha Levin

From: Steven Price <steven.price@arm.com>

[ Upstream commit fa7fe29a645b4da08efe8ff2392898b88f9ded9f ]

of_parse_phandle_with_args() requires the caller to call of_node_put() on
the returned args->np pointer. Otherwise the reference count will remain
incremented.

However, in this case, since we don't actually use the returned pointer,
we can simply pass in NULL.

Fixes: aa4f886f3893f ("firmware: arm_scmi: add basic driver infrastructure for SCMI")
Signed-off-by: Steven Price <steven.price@arm.com>
Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/firmware/arm_scmi/driver.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/drivers/firmware/arm_scmi/driver.c b/drivers/firmware/arm_scmi/driver.c
index 09119e3f5c018..effc4c17e0fb9 100644
--- a/drivers/firmware/arm_scmi/driver.c
+++ b/drivers/firmware/arm_scmi/driver.c
@@ -662,9 +662,7 @@ static int scmi_xfer_info_init(struct scmi_info *sinfo)
 
 static int scmi_mailbox_check(struct device_node *np)
 {
-	struct of_phandle_args arg;
-
-	return of_parse_phandle_with_args(np, "mboxes", "#mbox-cells", 0, &arg);
+	return of_parse_phandle_with_args(np, "mboxes", "#mbox-cells", 0, NULL);
 }
 
 static int scmi_mbox_free_channel(int id, void *p, void *data)
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 303/639] rxrpc: Fix detection of out of order acks
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (301 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.19 302/639] firmware: arm_scmi: fix of_node leak in scmi_mailbox_check Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.19 304/639] scsi: target/core: Fix a race condition in the LUN lookup code Greg Kroah-Hartman
                   ` (339 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jeffrey Altman, David Howells,
	Marc Dionne, David S. Miller, Sasha Levin

From: Jeffrey Altman <jaltman@auristor.com>

[ Upstream commit 1a2391c30c0b9d041bc340f68df81d49c53546cc ]

The rxrpc packet serial number cannot be safely used to compute out of
order ack packets for several reasons:

 1. The allocation of serial numbers cannot be assumed to imply the order
    by which acks are populated and transmitted.  In some rxrpc
    implementations, delayed acks and ping acks are transmitted
    asynchronously to the receipt of data packets and so may be transmitted
    out of order.  As a result, they can race with idle acks.

 2. Serial numbers are allocated by the rxrpc connection and not the call
    and as such may wrap independently if multiple channels are in use.

In any case, what matters is whether the ack packet provides new
information relating to the bounds of the window (the firstPacket and
previousPacket in the ACK data).

Fix this by discarding packets that appear to wind back the window bounds
rather than on serial number procession.

Fixes: 298bc15b2079 ("rxrpc: Only take the rwind and mtu values from latest ACK")
Signed-off-by: Jeffrey Altman <jaltman@auristor.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Tested-by: Marc Dionne <marc.dionne@auristor.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/rxrpc/ar-internal.h |  1 +
 net/rxrpc/input.c       | 18 ++++++++++++------
 2 files changed, 13 insertions(+), 6 deletions(-)

diff --git a/net/rxrpc/ar-internal.h b/net/rxrpc/ar-internal.h
index dfd9eab77cc8a..37e4c1801a41f 100644
--- a/net/rxrpc/ar-internal.h
+++ b/net/rxrpc/ar-internal.h
@@ -644,6 +644,7 @@ struct rxrpc_call {
 	u8			ackr_reason;	/* reason to ACK */
 	u16			ackr_skew;	/* skew on packet being ACK'd */
 	rxrpc_serial_t		ackr_serial;	/* serial of packet being ACK'd */
+	rxrpc_serial_t		ackr_first_seq;	/* first sequence number received */
 	rxrpc_seq_t		ackr_prev_seq;	/* previous sequence number received */
 	rxrpc_seq_t		ackr_consumed;	/* Highest packet shown consumed */
 	rxrpc_seq_t		ackr_seen;	/* Highest packet shown seen */
diff --git a/net/rxrpc/input.c b/net/rxrpc/input.c
index 7965600ee5dec..2f91ab909191b 100644
--- a/net/rxrpc/input.c
+++ b/net/rxrpc/input.c
@@ -837,7 +837,7 @@ static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb,
 		u8 acks[RXRPC_MAXACKS];
 	} buf;
 	rxrpc_serial_t acked_serial;
-	rxrpc_seq_t first_soft_ack, hard_ack;
+	rxrpc_seq_t first_soft_ack, hard_ack, prev_pkt;
 	int nr_acks, offset, ioffset;
 
 	_enter("");
@@ -851,13 +851,14 @@ static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb,
 
 	acked_serial = ntohl(buf.ack.serial);
 	first_soft_ack = ntohl(buf.ack.firstPacket);
+	prev_pkt = ntohl(buf.ack.previousPacket);
 	hard_ack = first_soft_ack - 1;
 	nr_acks = buf.ack.nAcks;
 	summary.ack_reason = (buf.ack.reason < RXRPC_ACK__INVALID ?
 			      buf.ack.reason : RXRPC_ACK__INVALID);
 
 	trace_rxrpc_rx_ack(call, sp->hdr.serial, acked_serial,
-			   first_soft_ack, ntohl(buf.ack.previousPacket),
+			   first_soft_ack, prev_pkt,
 			   summary.ack_reason, nr_acks);
 
 	if (buf.ack.reason == RXRPC_ACK_PING_RESPONSE)
@@ -878,8 +879,9 @@ static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb,
 				  rxrpc_propose_ack_respond_to_ack);
 	}
 
-	/* Discard any out-of-order or duplicate ACKs. */
-	if (before_eq(sp->hdr.serial, call->acks_latest))
+	/* Discard any out-of-order or duplicate ACKs (outside lock). */
+	if (before(first_soft_ack, call->ackr_first_seq) ||
+	    before(prev_pkt, call->ackr_prev_seq))
 		return;
 
 	buf.info.rxMTU = 0;
@@ -890,12 +892,16 @@ static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb,
 
 	spin_lock(&call->input_lock);
 
-	/* Discard any out-of-order or duplicate ACKs. */
-	if (before_eq(sp->hdr.serial, call->acks_latest))
+	/* Discard any out-of-order or duplicate ACKs (inside lock). */
+	if (before(first_soft_ack, call->ackr_first_seq) ||
+	    before(prev_pkt, call->ackr_prev_seq))
 		goto out;
 	call->acks_latest_ts = skb->tstamp;
 	call->acks_latest = sp->hdr.serial;
 
+	call->ackr_first_seq = first_soft_ack;
+	call->ackr_prev_seq = prev_pkt;
+
 	/* Parse rwind and mtu sizes if provided. */
 	if (buf.info.rxMTU)
 		rxrpc_input_ackinfo(call, skb, &buf.info);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 304/639] scsi: target/core: Fix a race condition in the LUN lookup code
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (302 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.19 303/639] rxrpc: Fix detection of out of order acks Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.19 305/639] brcmfmac: fix leak of mypkt on error return path Greg Kroah-Hartman
                   ` (338 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Mike Christie, Christoph Hellwig,
	Hannes Reinecke, Nicholas Bellinger, Bart Van Assche,
	Martin K. Petersen, Sasha Levin

From: Bart Van Assche <bvanassche@acm.org>

[ Upstream commit 63f7479439c95bcd49b7dd4af809862c316c71a3 ]

The rcu_dereference(deve->se_lun) expression occurs twice in the LUN lookup
functions. Since these expressions are not serialized against deve->se_lun
assignments each of these expressions may yield a different result. Avoid
that the wrong LUN pointer is stored in se_cmd by reading deve->se_lun only
once.

Cc: Mike Christie <mchristi@redhat.com>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Hannes Reinecke <hare@suse.com>
Cc: Nicholas Bellinger <nab@linux-iscsi.org>
Fixes: 29a05deebf6c ("target: Convert se_node_acl->device_list[] to RCU hlist") # v4.10
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/target/target_core_device.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c
index e9ff2a7c0c0e6..22e97a93728db 100644
--- a/drivers/target/target_core_device.c
+++ b/drivers/target/target_core_device.c
@@ -85,7 +85,7 @@ transport_lookup_cmd_lun(struct se_cmd *se_cmd, u64 unpacked_lun)
 			goto out_unlock;
 		}
 
-		se_cmd->se_lun = rcu_dereference(deve->se_lun);
+		se_cmd->se_lun = se_lun;
 		se_cmd->pr_res_key = deve->pr_res_key;
 		se_cmd->orig_fe_lun = unpacked_lun;
 		se_cmd->se_cmd_flags |= SCF_SE_LUN_CMD;
@@ -176,7 +176,7 @@ int transport_lookup_tmr_lun(struct se_cmd *se_cmd, u64 unpacked_lun)
 			goto out_unlock;
 		}
 
-		se_cmd->se_lun = rcu_dereference(deve->se_lun);
+		se_cmd->se_lun = se_lun;
 		se_cmd->pr_res_key = deve->pr_res_key;
 		se_cmd->orig_fe_lun = unpacked_lun;
 		se_cmd->se_cmd_flags |= SCF_SE_LUN_CMD;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 305/639] brcmfmac: fix leak of mypkt on error return path
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (303 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.19 304/639] scsi: target/core: Fix a race condition in the LUN lookup code Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.19 306/639] ARM: pxa: ssp: Fix "WARNING: invalid free of devm_ allocated data" Greg Kroah-Hartman
                   ` (337 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Colin Ian King, Mukesh Ojha,
	Kalle Valo, Sasha Levin

From: Colin Ian King <colin.king@canonical.com>

[ Upstream commit a927e8d8ab57e696800e20cf09a72b7dfe3bbebb ]

Currently if the call to brcmf_sdiod_set_backplane_window fails then
error return path leaks mypkt. Fix this by returning by a new
error path labelled 'out' that calls brcmu_pkt_buf_free_skb to free
mypkt.  Also remove redundant check on err before calling
brcmf_sdiod_skbuff_write.

Addresses-Coverity: ("Resource Leak")
Fixes: a7c3aa1509e2 ("brcmfmac: Remove brcmf_sdiod_addrprep()")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Reviewed-by: Mukesh Ojha <mojha@codeaurora.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
index d2f788d886681..710dc59c5d34d 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
@@ -617,15 +617,13 @@ int brcmf_sdiod_send_buf(struct brcmf_sdio_dev *sdiodev, u8 *buf, uint nbytes)
 
 	err = brcmf_sdiod_set_backplane_window(sdiodev, addr);
 	if (err)
-		return err;
+		goto out;
 
 	addr &= SBSDIO_SB_OFT_ADDR_MASK;
 	addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
 
-	if (!err)
-		err = brcmf_sdiod_skbuff_write(sdiodev, sdiodev->func2, addr,
-					       mypkt);
-
+	err = brcmf_sdiod_skbuff_write(sdiodev, sdiodev->func2, addr, mypkt);
+out:
 	brcmu_pkt_buf_free_skb(mypkt);
 
 	return err;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 306/639] ARM: pxa: ssp: Fix "WARNING: invalid free of devm_ allocated data"
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (304 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.19 305/639] brcmfmac: fix leak of mypkt on error return path Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.19 307/639] PCI: rockchip: Fix rockchip_pcie_ep_assert_intx() bitwise operations Greg Kroah-Hartman
                   ` (336 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, YueHaibing, Robert Jarzmik, Sasha Levin

From: YueHaibing <yuehaibing@huawei.com>

[ Upstream commit 9ee8578d953023cc57e7e736ae48502c707c0210 ]

Since commit 1c459de1e645 ("ARM: pxa: ssp: use devm_ functions")
kfree, iounmap, clk_put etc are not needed anymore in remove path.

Fixes: 1c459de1e645 ("ARM: pxa: ssp: use devm_ functions")
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
[ commit message spelling fix ]
Signed-off-by: Robert Jarzmik <robert.jarzmik@free.fr>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/plat-pxa/ssp.c | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/arch/arm/plat-pxa/ssp.c b/arch/arm/plat-pxa/ssp.c
index f519199741837..bf25f780c1c9e 100644
--- a/arch/arm/plat-pxa/ssp.c
+++ b/arch/arm/plat-pxa/ssp.c
@@ -183,18 +183,12 @@ static int pxa_ssp_probe(struct platform_device *pdev)
 
 static int pxa_ssp_remove(struct platform_device *pdev)
 {
-	struct resource *res;
 	struct ssp_device *ssp;
 
 	ssp = platform_get_drvdata(pdev);
 	if (ssp == NULL)
 		return -ENODEV;
 
-	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-	release_mem_region(res->start, resource_size(res));
-
-	clk_put(ssp->clk);
-
 	mutex_lock(&ssp_lock);
 	list_del(&ssp->node);
 	mutex_unlock(&ssp_lock);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 307/639] PCI: rockchip: Fix rockchip_pcie_ep_assert_intx() bitwise operations
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (305 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.19 306/639] ARM: pxa: ssp: Fix "WARNING: invalid free of devm_ allocated data" Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.19 308/639] net: hns3: fix for vport->bw_limit overflow problem Greg Kroah-Hartman
                   ` (335 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Colin Ian King, Lorenzo Pieralisi,
	Mukesh Ojha, Shawn Lin, Sasha Levin

From: Colin Ian King <colin.king@canonical.com>

[ Upstream commit c577f4a5a08bb9677e12ddafb62e2f3a901de87f ]

Currently the bitwise operations on the u16 variable 'status' with
the setting ROCKCHIP_PCIE_EP_CMD_STATUS_IS are incorrect because
ROCKCHIP_PCIE_EP_CMD_STATUS_IS is 1UL<<19 which is wider than the
u16 variable.

Fix this by making status a u32.

Fixes: cf590b078391 ("PCI: rockchip: Add EP driver for Rockchip PCIe controller")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Reviewed-by: Mukesh Ojha <mojha@codeaurora.org>
Acked-by: Shawn Lin <shawn.lin@rock-chips.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/controller/pcie-rockchip-ep.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/pci/controller/pcie-rockchip-ep.c b/drivers/pci/controller/pcie-rockchip-ep.c
index b8163c56a142d..caf34661d38d4 100644
--- a/drivers/pci/controller/pcie-rockchip-ep.c
+++ b/drivers/pci/controller/pcie-rockchip-ep.c
@@ -350,7 +350,7 @@ static void rockchip_pcie_ep_assert_intx(struct rockchip_pcie_ep *ep, u8 fn,
 	struct rockchip_pcie *rockchip = &ep->rockchip;
 	u32 r = ep->max_regions - 1;
 	u32 offset;
-	u16 status;
+	u32 status;
 	u8 msg_code;
 
 	if (unlikely(ep->irq_pci_addr != ROCKCHIP_PCIE_EP_PCI_LEGACY_IRQ_ADDR ||
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 308/639] net: hns3: fix for vport->bw_limit overflow problem
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (306 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.19 307/639] PCI: rockchip: Fix rockchip_pcie_ep_assert_intx() bitwise operations Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-24  9:27 ` [PATCH 4.19 309/639] hwmon: (w83627hf) Use request_muxed_region for Super-IO accesses Greg Kroah-Hartman
                   ` (334 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Yunsheng Lin,
	Huazhong Tan, David S. Miller, Sasha Levin

From: Yunsheng Lin <linyunsheng@huawei.com>

[ Upstream commit 2566f10676ba996b745e138f54f3e2f974311692 ]

When setting vport->bw_limit to hdev->tm_info.pg_info[0].bw_limit
in hclge_tm_vport_tc_info_update, vport->bw_limit can be as big as
HCLGE_ETHER_MAX_RATE (100000), which can not fit into u16 (65535).

So this patch fixes it by using u32 for vport->bw_limit.

Fixes: 848440544b41 ("net: hns3: Add support of TX Scheduler & Shaper to HNS3 driver")
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Yunsheng Lin <linyunsheng@huawei.com>
Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h
index 260b1e7796908..d14b7018fdf34 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h
@@ -600,7 +600,7 @@ struct hclge_vport {
 	u16 alloc_rss_size;
 
 	u16 qs_offset;
-	u16 bw_limit;		/* VSI BW Limit (0 = disabled) */
+	u32 bw_limit;		/* VSI BW Limit (0 = disabled) */
 	u8  dwrr;
 
 	struct hclge_tx_vtag_cfg  txvlan_cfg;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 309/639] hwmon: (w83627hf) Use request_muxed_region for Super-IO accesses
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (307 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.19 308/639] net: hns3: fix for vport->bw_limit overflow problem Greg Kroah-Hartman
@ 2020-01-24  9:27 ` Greg Kroah-Hartman
  2020-01-25 18:59   ` Pavel Machek
  2020-01-24  9:28 ` [PATCH 4.19 310/639] perf/core: Fix the address filtering fix Greg Kroah-Hartman
                   ` (333 subsequent siblings)
  642 siblings, 1 reply; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:27 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Guenter Roeck, Sasha Levin

From: Guenter Roeck <linux@roeck-us.net>

[ Upstream commit e95fd518d05bfc087da6fcdea4900a57cfb083bd ]

Super-IO accesses may fail on a system with no or unmapped LPC bus.

Also, other drivers may attempt to access the LPC bus at the same time,
resulting in undefined behavior.

Use request_muxed_region() to ensure that IO access on the requested
address space is supported, and to ensure that access by multiple drivers
is synchronized.

Fixes: b72656dbc491 ("hwmon: (w83627hf) Stop using globals for I/O port numbers")
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hwmon/w83627hf.c | 42 +++++++++++++++++++++++++++++++++++-----
 1 file changed, 37 insertions(+), 5 deletions(-)

diff --git a/drivers/hwmon/w83627hf.c b/drivers/hwmon/w83627hf.c
index 8ac89d0781ccc..a575e1cdb81a8 100644
--- a/drivers/hwmon/w83627hf.c
+++ b/drivers/hwmon/w83627hf.c
@@ -130,17 +130,23 @@ superio_select(struct w83627hf_sio_data *sio, int ld)
 	outb(ld,  sio->sioaddr + 1);
 }
 
-static inline void
+static inline int
 superio_enter(struct w83627hf_sio_data *sio)
 {
+	if (!request_muxed_region(sio->sioaddr, 2, DRVNAME))
+		return -EBUSY;
+
 	outb(0x87, sio->sioaddr);
 	outb(0x87, sio->sioaddr);
+
+	return 0;
 }
 
 static inline void
 superio_exit(struct w83627hf_sio_data *sio)
 {
 	outb(0xAA, sio->sioaddr);
+	release_region(sio->sioaddr, 2);
 }
 
 #define W627_DEVID 0x52
@@ -1278,7 +1284,7 @@ static DEVICE_ATTR_RO(name);
 static int __init w83627hf_find(int sioaddr, unsigned short *addr,
 				struct w83627hf_sio_data *sio_data)
 {
-	int err = -ENODEV;
+	int err;
 	u16 val;
 
 	static __initconst char *const names[] = {
@@ -1290,7 +1296,11 @@ static int __init w83627hf_find(int sioaddr, unsigned short *addr,
 	};
 
 	sio_data->sioaddr = sioaddr;
-	superio_enter(sio_data);
+	err = superio_enter(sio_data);
+	if (err)
+		return err;
+
+	err = -ENODEV;
 	val = force_id ? force_id : superio_inb(sio_data, DEVID);
 	switch (val) {
 	case W627_DEVID:
@@ -1644,9 +1654,21 @@ static int w83627thf_read_gpio5(struct platform_device *pdev)
 	struct w83627hf_sio_data *sio_data = dev_get_platdata(&pdev->dev);
 	int res = 0xff, sel;
 
-	superio_enter(sio_data);
+	if (superio_enter(sio_data)) {
+		/*
+		 * Some other driver reserved the address space for itself.
+		 * We don't want to fail driver instantiation because of that,
+		 * so display a warning and keep going.
+		 */
+		dev_warn(&pdev->dev,
+			 "Can not read VID data: Failed to enable SuperIO access\n");
+		return res;
+	}
+
 	superio_select(sio_data, W83627HF_LD_GPIO5);
 
+	res = 0xff;
+
 	/* Make sure these GPIO pins are enabled */
 	if (!(superio_inb(sio_data, W83627THF_GPIO5_EN) & (1<<3))) {
 		dev_dbg(&pdev->dev, "GPIO5 disabled, no VID function\n");
@@ -1677,7 +1699,17 @@ static int w83687thf_read_vid(struct platform_device *pdev)
 	struct w83627hf_sio_data *sio_data = dev_get_platdata(&pdev->dev);
 	int res = 0xff;
 
-	superio_enter(sio_data);
+	if (superio_enter(sio_data)) {
+		/*
+		 * Some other driver reserved the address space for itself.
+		 * We don't want to fail driver instantiation because of that,
+		 * so display a warning and keep going.
+		 */
+		dev_warn(&pdev->dev,
+			 "Can not read VID data: Failed to enable SuperIO access\n");
+		return res;
+	}
+
 	superio_select(sio_data, W83627HF_LD_HWM);
 
 	/* Make sure these GPIO pins are enabled */
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 310/639] perf/core: Fix the address filtering fix
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (308 preceding siblings ...)
  2020-01-24  9:27 ` [PATCH 4.19 309/639] hwmon: (w83627hf) Use request_muxed_region for Super-IO accesses Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.19 311/639] staging: android: vsoc: fix copy_from_user overrun Greg Kroah-Hartman
                   ` (332 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Adrian Hunter, Alexander Shishkin,
	Peter Zijlstra (Intel),
	Arnaldo Carvalho de Melo, Jiri Olsa, Linus Torvalds,
	Stephane Eranian, Thomas Gleixner, Vince Weaver, Ingo Molnar,
	Sasha Levin

From: Alexander Shishkin <alexander.shishkin@linux.intel.com>

[ Upstream commit 52a44f83fc2d64a5e74d5d685fad2fecc7b7a321 ]

The following recent commit:

  c60f83b813e5 ("perf, pt, coresight: Fix address filters for vmas with non-zero offset")

changes the address filtering logic to communicate filter ranges to the PMU driver
via a single address range object, instead of having the driver do the final bit of
math.

That change forgets to take into account kernel filters, which are not calculated
the same way as DSO based filters.

Fix that by passing the kernel filters the same way as file-based filters.
This doesn't require any additional changes in the drivers.

Reported-by: Adrian Hunter <adrian.hunter@intel.com>
Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Stephane Eranian <eranian@google.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Vince Weaver <vincent.weaver@maine.edu>
Fixes: c60f83b813e5 ("perf, pt, coresight: Fix address filters for vmas with non-zero offset")
Link: https://lkml.kernel.org/r/20190329091212.29870-1-alexander.shishkin@linux.intel.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/events/core.c | 37 +++++++++++++++++++++----------------
 1 file changed, 21 insertions(+), 16 deletions(-)

diff --git a/kernel/events/core.c b/kernel/events/core.c
index 4eef2d42d05c4..751888cbed5c0 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -8861,26 +8861,29 @@ static void perf_event_addr_filters_apply(struct perf_event *event)
 	if (task == TASK_TOMBSTONE)
 		return;
 
-	if (!ifh->nr_file_filters)
-		return;
-
-	mm = get_task_mm(event->ctx->task);
-	if (!mm)
-		goto restart;
+	if (ifh->nr_file_filters) {
+		mm = get_task_mm(event->ctx->task);
+		if (!mm)
+			goto restart;
 
-	down_read(&mm->mmap_sem);
+		down_read(&mm->mmap_sem);
+	}
 
 	raw_spin_lock_irqsave(&ifh->lock, flags);
 	list_for_each_entry(filter, &ifh->list, entry) {
-		event->addr_filter_ranges[count].start = 0;
-		event->addr_filter_ranges[count].size = 0;
+		if (filter->path.dentry) {
+			/*
+			 * Adjust base offset if the filter is associated to a
+			 * binary that needs to be mapped:
+			 */
+			event->addr_filter_ranges[count].start = 0;
+			event->addr_filter_ranges[count].size = 0;
 
-		/*
-		 * Adjust base offset if the filter is associated to a binary
-		 * that needs to be mapped:
-		 */
-		if (filter->path.dentry)
 			perf_addr_filter_apply(filter, mm, &event->addr_filter_ranges[count]);
+		} else {
+			event->addr_filter_ranges[count].start = filter->offset;
+			event->addr_filter_ranges[count].size  = filter->size;
+		}
 
 		count++;
 	}
@@ -8888,9 +8891,11 @@ static void perf_event_addr_filters_apply(struct perf_event *event)
 	event->addr_filters_gen++;
 	raw_spin_unlock_irqrestore(&ifh->lock, flags);
 
-	up_read(&mm->mmap_sem);
+	if (ifh->nr_file_filters) {
+		up_read(&mm->mmap_sem);
 
-	mmput(mm);
+		mmput(mm);
+	}
 
 restart:
 	perf_event_stop(event, 1);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 311/639] staging: android: vsoc: fix copy_from_user overrun
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (309 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.19 310/639] perf/core: Fix the address filtering fix Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.19 312/639] PCI: dwc: Fix dw_pcie_ep_find_capability() to return correct capability offset Greg Kroah-Hartman
                   ` (331 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Vincent Stehlé,
	Dan Carpenter, Sasha Levin

From: Vincent Stehlé <vincent.stehle@laposte.net>

[ Upstream commit 060ea4271a82270be6d44e8e9aefe8f155fb5626 ]

The `np->permission' structure is smaller than the `np' structure but
sizeof(*np) worth of data is copied in there. Fix the size passed to
copy_from_user() to avoid overrun.

Fixes: 3d2ec9dcd553 ("staging: Android: Add 'vsoc' driver for cuttlefish.")
Signed-off-by: Vincent Stehlé <vincent.stehle@laposte.net>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/staging/android/vsoc.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/staging/android/vsoc.c b/drivers/staging/android/vsoc.c
index 22571abcaa4e8..034d86869772e 100644
--- a/drivers/staging/android/vsoc.c
+++ b/drivers/staging/android/vsoc.c
@@ -260,7 +260,8 @@ do_create_fd_scoped_permission(struct vsoc_device_region *region_p,
 	atomic_t *owner_ptr = NULL;
 	struct vsoc_device_region *managed_region_p;
 
-	if (copy_from_user(&np->permission, &arg->perm, sizeof(*np)) ||
+	if (copy_from_user(&np->permission,
+			   &arg->perm, sizeof(np->permission)) ||
 	    copy_from_user(&managed_fd,
 			   &arg->managed_region_fd, sizeof(managed_fd))) {
 		return -EFAULT;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 312/639] PCI: dwc: Fix dw_pcie_ep_find_capability() to return correct capability offset
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (310 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.19 311/639] staging: android: vsoc: fix copy_from_user overrun Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.19 313/639] soc: amlogic: meson-gx-pwrc-vpu: Fix power on/off register bitmask Greg Kroah-Hartman
                   ` (330 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Kishon Vijay Abraham I,
	Lorenzo Pieralisi, Sasha Levin

From: Kishon Vijay Abraham I <kishon@ti.com>

[ Upstream commit 421db1ab287eebe80fd203eb009ae92836c586ad ]

commit beb4641a787d ("PCI: dwc: Add MSI-X callbacks handler") while
adding MSI-X callback handler, introduced dw_pcie_ep_find_capability()
and __dw_pcie_ep_find_next_cap() for finding the MSI and MSIX capability.

However if MSI or MSIX capability is the last capability (i.e there are
no additional items in the capabilities list and the Next Capability
Pointer is set to '0'), __dw_pcie_ep_find_next_cap will return '0'
even though MSI or MSIX capability may be present because of
incorrect ordering of the "next_cap_ptr" check. Fix it.

Fixes: beb4641a787d ("PCI: dwc: Add MSI-X callbacks handler")
Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/controller/dwc/pcie-designware-ep.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/pci/controller/dwc/pcie-designware-ep.c b/drivers/pci/controller/dwc/pcie-designware-ep.c
index 739d97080d3bd..a3d07d9c598bf 100644
--- a/drivers/pci/controller/dwc/pcie-designware-ep.c
+++ b/drivers/pci/controller/dwc/pcie-designware-ep.c
@@ -46,16 +46,19 @@ static u8 __dw_pcie_ep_find_next_cap(struct dw_pcie *pci, u8 cap_ptr,
 	u8 cap_id, next_cap_ptr;
 	u16 reg;
 
+	if (!cap_ptr)
+		return 0;
+
 	reg = dw_pcie_readw_dbi(pci, cap_ptr);
-	next_cap_ptr = (reg & 0xff00) >> 8;
 	cap_id = (reg & 0x00ff);
 
-	if (!next_cap_ptr || cap_id > PCI_CAP_ID_MAX)
+	if (cap_id > PCI_CAP_ID_MAX)
 		return 0;
 
 	if (cap_id == cap)
 		return cap_ptr;
 
+	next_cap_ptr = (reg & 0xff00) >> 8;
 	return __dw_pcie_ep_find_next_cap(pci, next_cap_ptr, cap);
 }
 
@@ -67,9 +70,6 @@ static u8 dw_pcie_ep_find_capability(struct dw_pcie *pci, u8 cap)
 	reg = dw_pcie_readw_dbi(pci, PCI_CAPABILITY_LIST);
 	next_cap_ptr = (reg & 0x00ff);
 
-	if (!next_cap_ptr)
-		return 0;
-
 	return __dw_pcie_ep_find_next_cap(pci, next_cap_ptr, cap);
 }
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 313/639] soc: amlogic: meson-gx-pwrc-vpu: Fix power on/off register bitmask
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (311 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.19 312/639] PCI: dwc: Fix dw_pcie_ep_find_capability() to return correct capability offset Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.19 314/639] platform/x86: alienware-wmi: fix kfree on potentially uninitialized pointer Greg Kroah-Hartman
                   ` (329 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Neil Armstrong, Kevin Hilman, Sasha Levin

From: Neil Armstrong <narmstrong@baylibre.com>

[ Upstream commit 2fe3b4bbc93ec30a173ebae7d2b8c530416df3af ]

The register bitmask to power on/off the VPU memories was incorectly set
to 0x2 instead of 0x3. While still working, let's use the recommended
vendor value instead.

Fixes: 75fcb5ca4b46 ("soc: amlogic: add Meson GX VPU Domains driver")
Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
Signed-off-by: Kevin Hilman <khilman@baylibre.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/soc/amlogic/meson-gx-pwrc-vpu.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/soc/amlogic/meson-gx-pwrc-vpu.c b/drivers/soc/amlogic/meson-gx-pwrc-vpu.c
index 6289965c42e98..05421d029dff9 100644
--- a/drivers/soc/amlogic/meson-gx-pwrc-vpu.c
+++ b/drivers/soc/amlogic/meson-gx-pwrc-vpu.c
@@ -54,12 +54,12 @@ static int meson_gx_pwrc_vpu_power_off(struct generic_pm_domain *genpd)
 	/* Power Down Memories */
 	for (i = 0; i < 32; i += 2) {
 		regmap_update_bits(pd->regmap_hhi, HHI_VPU_MEM_PD_REG0,
-				   0x2 << i, 0x3 << i);
+				   0x3 << i, 0x3 << i);
 		udelay(5);
 	}
 	for (i = 0; i < 32; i += 2) {
 		regmap_update_bits(pd->regmap_hhi, HHI_VPU_MEM_PD_REG1,
-				   0x2 << i, 0x3 << i);
+				   0x3 << i, 0x3 << i);
 		udelay(5);
 	}
 	for (i = 8; i < 16; i++) {
@@ -108,13 +108,13 @@ static int meson_gx_pwrc_vpu_power_on(struct generic_pm_domain *genpd)
 	/* Power Up Memories */
 	for (i = 0; i < 32; i += 2) {
 		regmap_update_bits(pd->regmap_hhi, HHI_VPU_MEM_PD_REG0,
-				   0x2 << i, 0);
+				   0x3 << i, 0);
 		udelay(5);
 	}
 
 	for (i = 0; i < 32; i += 2) {
 		regmap_update_bits(pd->regmap_hhi, HHI_VPU_MEM_PD_REG1,
-				   0x2 << i, 0);
+				   0x3 << i, 0);
 		udelay(5);
 	}
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 314/639] platform/x86: alienware-wmi: fix kfree on potentially uninitialized pointer
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (312 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.19 313/639] soc: amlogic: meson-gx-pwrc-vpu: Fix power on/off register bitmask Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.19 315/639] tipc: set sysctl_tipc_rmem and named_timeout right range Greg Kroah-Hartman
                   ` (328 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Colin Ian King, Darren Hart (VMware),
	Sasha Levin

From: Colin Ian King <colin.king@canonical.com>

[ Upstream commit 98e2630284ab741804bd0713e932e725466f2f84 ]

Currently the kfree of output.pointer can be potentially freeing
an uninitalized pointer in the case where out_data is NULL. Fix this
by reworking the case where out_data is not-null to perform the
ACPI status check and also the kfree of outpoint.pointer in one block
and hence ensuring the pointer is only freed when it has been used.

Also replace the if (ptr != NULL) idiom with just if (ptr).

Fixes: ff0e9f26288d ("platform/x86: alienware-wmi: Correct a memory leak")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Darren Hart (VMware) <dvhart@infradead.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/x86/alienware-wmi.c | 17 ++++++++---------
 1 file changed, 8 insertions(+), 9 deletions(-)

diff --git a/drivers/platform/x86/alienware-wmi.c b/drivers/platform/x86/alienware-wmi.c
index f10af5c383c55..c0d1555735cdd 100644
--- a/drivers/platform/x86/alienware-wmi.c
+++ b/drivers/platform/x86/alienware-wmi.c
@@ -522,23 +522,22 @@ static acpi_status alienware_wmax_command(struct wmax_basic_args *in_args,
 
 	input.length = (acpi_size) sizeof(*in_args);
 	input.pointer = in_args;
-	if (out_data != NULL) {
+	if (out_data) {
 		output.length = ACPI_ALLOCATE_BUFFER;
 		output.pointer = NULL;
 		status = wmi_evaluate_method(WMAX_CONTROL_GUID, 0,
 					     command, &input, &output);
-	} else
+		if (ACPI_SUCCESS(status)) {
+			obj = (union acpi_object *)output.pointer;
+			if (obj && obj->type == ACPI_TYPE_INTEGER)
+				*out_data = (u32)obj->integer.value;
+		}
+		kfree(output.pointer);
+	} else {
 		status = wmi_evaluate_method(WMAX_CONTROL_GUID, 0,
 					     command, &input, NULL);
-
-	if (ACPI_SUCCESS(status) && out_data != NULL) {
-		obj = (union acpi_object *)output.pointer;
-		if (obj && obj->type == ACPI_TYPE_INTEGER)
-			*out_data = (u32) obj->integer.value;
 	}
-	kfree(output.pointer);
 	return status;
-
 }
 
 /*
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 315/639] tipc: set sysctl_tipc_rmem and named_timeout right range
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (313 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.19 314/639] platform/x86: alienware-wmi: fix kfree on potentially uninitialized pointer Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.19 316/639] usb: typec: tcpm: Notify the tcpc to start connection-detection for SRPs Greg Kroah-Hartman
                   ` (327 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jie Liu, Qiang Ning, Zhiqiang Liu,
	Miaohe Lin, David S. Miller, Sasha Levin

From: Jie Liu <liujie165@huawei.com>

[ Upstream commit 4bcd4ec1017205644a2697bccbc3b5143f522f5f ]

We find that sysctl_tipc_rmem and named_timeout do not have the right minimum
setting. sysctl_tipc_rmem should be larger than zero, like sysctl_tcp_rmem.
And named_timeout as a timeout setting should be not less than zero.

Fixes: cc79dd1ba9c10 ("tipc: change socket buffer overflow control to respect sk_rcvbuf")
Fixes: a5325ae5b8bff ("tipc: add name distributor resiliency queue")
Signed-off-by: Jie Liu <liujie165@huawei.com>
Reported-by: Qiang Ning <ningqiang1@huawei.com>
Reviewed-by: Zhiqiang Liu <liuzhiqiang26@huawei.com>
Reviewed-by: Miaohe Lin <linmiaohe@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/tipc/sysctl.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/net/tipc/sysctl.c b/net/tipc/sysctl.c
index 1a779b1e85100..40f6d82083d7b 100644
--- a/net/tipc/sysctl.c
+++ b/net/tipc/sysctl.c
@@ -37,6 +37,8 @@
 
 #include <linux/sysctl.h>
 
+static int zero;
+static int one = 1;
 static struct ctl_table_header *tipc_ctl_hdr;
 
 static struct ctl_table tipc_table[] = {
@@ -45,14 +47,16 @@ static struct ctl_table tipc_table[] = {
 		.data		= &sysctl_tipc_rmem,
 		.maxlen		= sizeof(sysctl_tipc_rmem),
 		.mode		= 0644,
-		.proc_handler	= proc_dointvec,
+		.proc_handler	= proc_dointvec_minmax,
+		.extra1         = &one,
 	},
 	{
 		.procname	= "named_timeout",
 		.data		= &sysctl_tipc_named_timeout,
 		.maxlen		= sizeof(sysctl_tipc_named_timeout),
 		.mode		= 0644,
-		.proc_handler	= proc_dointvec,
+		.proc_handler	= proc_dointvec_minmax,
+		.extra1         = &zero,
 	},
 	{}
 };
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 316/639] usb: typec: tcpm: Notify the tcpc to start connection-detection for SRPs
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (314 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.19 315/639] tipc: set sysctl_tipc_rmem and named_timeout right range Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.19 317/639] selftests/ipc: Fix msgque compiler warnings Greg Kroah-Hartman
                   ` (326 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Adam Thomson, Hans de Goede,
	Guenter Roeck, Heikki Krogerus, Sasha Levin

From: Hans de Goede <hdegoede@redhat.com>

[ Upstream commit 7893f9e1c26d1f9ea02622902ee671de45ad377b ]

Some tcpc device-drivers need to explicitly be told to watch for connection
events, otherwise the tcpc will not generate any TCPM_CC_EVENTs and devices
being plugged into the Type-C port will not be noticed.

For dual-role ports tcpm_start_drp_toggling() is used to tell the tcpc to
watch for connection events. Sofar we lack a similar callback to the tcpc
for single-role ports. With some tcpc-s such as the fusb302 this means
no TCPM_CC_EVENTs will be generated when the port is configured as a
single-role port.

This commit renames start_drp_toggling to start_toggling and since the
device-properties are parsed by the tcpm-core, adds a port_type parameter
to the start_toggling callback so that the tcpc_dev driver knows the
port-type and can act accordingly when it starts toggling.

The new start_toggling callback now always gets called if defined, instead
of only being called for DRP ports.

To avoid this causing undesirable functional changes all existing
start_drp_toggling implementations are not only renamed to start_toggling,
but also get a port_type check added and return -EOPNOTSUPP when port_type
is not DRP.

Fixes: ea3b4d5523bc("usb: typec: fusb302: Resolve fixed power role ...")
Cc: Adam Thomson <Adam.Thomson.Opensource@diasemi.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Acked-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Tested-by: Adam Thomson <Adam.Thomson.Opensource@diasemi.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/typec/fusb302/fusb302.c | 10 ++++++---
 drivers/usb/typec/tcpci.c           | 10 ++++++---
 drivers/usb/typec/tcpm.c            | 32 +++++++++++++----------------
 drivers/usb/typec/typec_wcove.c     | 10 ++++++---
 include/linux/usb/tcpm.h            | 13 ++++++------
 5 files changed, 42 insertions(+), 33 deletions(-)

diff --git a/drivers/usb/typec/fusb302/fusb302.c b/drivers/usb/typec/fusb302/fusb302.c
index 62a0060d39d8d..c749ce486ec85 100644
--- a/drivers/usb/typec/fusb302/fusb302.c
+++ b/drivers/usb/typec/fusb302/fusb302.c
@@ -990,13 +990,17 @@ done:
 	return ret;
 }
 
-static int tcpm_start_drp_toggling(struct tcpc_dev *dev,
-				   enum typec_cc_status cc)
+static int tcpm_start_toggling(struct tcpc_dev *dev,
+			       enum typec_port_type port_type,
+			       enum typec_cc_status cc)
 {
 	struct fusb302_chip *chip = container_of(dev, struct fusb302_chip,
 						 tcpc_dev);
 	int ret = 0;
 
+	if (port_type != TYPEC_PORT_DRP)
+		return -EOPNOTSUPP;
+
 	mutex_lock(&chip->lock);
 	ret = fusb302_set_src_current(chip, cc_src_current[cc]);
 	if (ret < 0) {
@@ -1206,7 +1210,7 @@ static void init_tcpc_dev(struct tcpc_dev *fusb302_tcpc_dev)
 	fusb302_tcpc_dev->set_vbus = tcpm_set_vbus;
 	fusb302_tcpc_dev->set_pd_rx = tcpm_set_pd_rx;
 	fusb302_tcpc_dev->set_roles = tcpm_set_roles;
-	fusb302_tcpc_dev->start_drp_toggling = tcpm_start_drp_toggling;
+	fusb302_tcpc_dev->start_toggling = tcpm_start_toggling;
 	fusb302_tcpc_dev->pd_transmit = tcpm_pd_transmit;
 }
 
diff --git a/drivers/usb/typec/tcpci.c b/drivers/usb/typec/tcpci.c
index ac6b418b15f1f..c1f7073a56de7 100644
--- a/drivers/usb/typec/tcpci.c
+++ b/drivers/usb/typec/tcpci.c
@@ -100,13 +100,17 @@ static int tcpci_set_cc(struct tcpc_dev *tcpc, enum typec_cc_status cc)
 	return 0;
 }
 
-static int tcpci_start_drp_toggling(struct tcpc_dev *tcpc,
-				    enum typec_cc_status cc)
+static int tcpci_start_toggling(struct tcpc_dev *tcpc,
+				enum typec_port_type port_type,
+				enum typec_cc_status cc)
 {
 	int ret;
 	struct tcpci *tcpci = tcpc_to_tcpci(tcpc);
 	unsigned int reg = TCPC_ROLE_CTRL_DRP;
 
+	if (port_type != TYPEC_PORT_DRP)
+		return -EOPNOTSUPP;
+
 	/* Handle vendor drp toggling */
 	if (tcpci->data->start_drp_toggling) {
 		ret = tcpci->data->start_drp_toggling(tcpci, tcpci->data, cc);
@@ -511,7 +515,7 @@ struct tcpci *tcpci_register_port(struct device *dev, struct tcpci_data *data)
 	tcpci->tcpc.get_cc = tcpci_get_cc;
 	tcpci->tcpc.set_polarity = tcpci_set_polarity;
 	tcpci->tcpc.set_vconn = tcpci_set_vconn;
-	tcpci->tcpc.start_drp_toggling = tcpci_start_drp_toggling;
+	tcpci->tcpc.start_toggling = tcpci_start_toggling;
 
 	tcpci->tcpc.set_pd_rx = tcpci_set_pd_rx;
 	tcpci->tcpc.set_roles = tcpci_set_roles;
diff --git a/drivers/usb/typec/tcpm.c b/drivers/usb/typec/tcpm.c
index 39cf190012393..29d72e9b0f017 100644
--- a/drivers/usb/typec/tcpm.c
+++ b/drivers/usb/typec/tcpm.c
@@ -31,7 +31,7 @@
 
 #define FOREACH_STATE(S)			\
 	S(INVALID_STATE),			\
-	S(DRP_TOGGLING),			\
+	S(TOGGLING),			\
 	S(SRC_UNATTACHED),			\
 	S(SRC_ATTACH_WAIT),			\
 	S(SRC_ATTACHED),			\
@@ -473,7 +473,7 @@ static void tcpm_log(struct tcpm_port *port, const char *fmt, ...)
 	/* Do not log while disconnected and unattached */
 	if (tcpm_port_is_disconnected(port) &&
 	    (port->state == SRC_UNATTACHED || port->state == SNK_UNATTACHED ||
-	     port->state == DRP_TOGGLING))
+	     port->state == TOGGLING))
 		return;
 
 	va_start(args, fmt);
@@ -2561,20 +2561,16 @@ static int tcpm_set_charge(struct tcpm_port *port, bool charge)
 	return 0;
 }
 
-static bool tcpm_start_drp_toggling(struct tcpm_port *port,
-				    enum typec_cc_status cc)
+static bool tcpm_start_toggling(struct tcpm_port *port, enum typec_cc_status cc)
 {
 	int ret;
 
-	if (port->tcpc->start_drp_toggling &&
-	    port->port_type == TYPEC_PORT_DRP) {
-		tcpm_log_force(port, "Start DRP toggling");
-		ret = port->tcpc->start_drp_toggling(port->tcpc, cc);
-		if (!ret)
-			return true;
-	}
+	if (!port->tcpc->start_toggling)
+		return false;
 
-	return false;
+	tcpm_log_force(port, "Start toggling");
+	ret = port->tcpc->start_toggling(port->tcpc, port->port_type, cc);
+	return ret == 0;
 }
 
 static void tcpm_set_cc(struct tcpm_port *port, enum typec_cc_status cc)
@@ -2868,15 +2864,15 @@ static void run_state_machine(struct tcpm_port *port)
 
 	port->enter_state = port->state;
 	switch (port->state) {
-	case DRP_TOGGLING:
+	case TOGGLING:
 		break;
 	/* SRC states */
 	case SRC_UNATTACHED:
 		if (!port->non_pd_role_swap)
 			tcpm_swap_complete(port, -ENOTCONN);
 		tcpm_src_detach(port);
-		if (tcpm_start_drp_toggling(port, tcpm_rp_cc(port))) {
-			tcpm_set_state(port, DRP_TOGGLING, 0);
+		if (tcpm_start_toggling(port, tcpm_rp_cc(port))) {
+			tcpm_set_state(port, TOGGLING, 0);
 			break;
 		}
 		tcpm_set_cc(port, tcpm_rp_cc(port));
@@ -3074,8 +3070,8 @@ static void run_state_machine(struct tcpm_port *port)
 			tcpm_swap_complete(port, -ENOTCONN);
 		tcpm_pps_complete(port, -ENOTCONN);
 		tcpm_snk_detach(port);
-		if (tcpm_start_drp_toggling(port, TYPEC_CC_RD)) {
-			tcpm_set_state(port, DRP_TOGGLING, 0);
+		if (tcpm_start_toggling(port, TYPEC_CC_RD)) {
+			tcpm_set_state(port, TOGGLING, 0);
 			break;
 		}
 		tcpm_set_cc(port, TYPEC_CC_RD);
@@ -3642,7 +3638,7 @@ static void _tcpm_cc_change(struct tcpm_port *port, enum typec_cc_status cc1,
 						       : "connected");
 
 	switch (port->state) {
-	case DRP_TOGGLING:
+	case TOGGLING:
 		if (tcpm_port_is_debug(port) || tcpm_port_is_audio(port) ||
 		    tcpm_port_is_source(port))
 			tcpm_set_state(port, SRC_ATTACH_WAIT, 0);
diff --git a/drivers/usb/typec/typec_wcove.c b/drivers/usb/typec/typec_wcove.c
index 6770afd407654..f1f8f45e2f3dc 100644
--- a/drivers/usb/typec/typec_wcove.c
+++ b/drivers/usb/typec/typec_wcove.c
@@ -416,12 +416,16 @@ static int wcove_pd_transmit(struct tcpc_dev *tcpc,
 	return regmap_write(wcove->regmap, USBC_TXCMD, cmd | USBC_TXCMD_START);
 }
 
-static int wcove_start_drp_toggling(struct tcpc_dev *tcpc,
-				    enum typec_cc_status cc)
+static int wcove_start_toggling(struct tcpc_dev *tcpc,
+				enum typec_port_type port_type,
+				enum typec_cc_status cc)
 {
 	struct wcove_typec *wcove = tcpc_to_wcove(tcpc);
 	unsigned int usbc_ctrl;
 
+	if (port_type != TYPEC_PORT_DRP)
+		return -EOPNOTSUPP;
+
 	usbc_ctrl = USBC_CONTROL1_MODE_DRP | USBC_CONTROL1_DRPTOGGLE_RANDOM;
 
 	switch (cc) {
@@ -642,7 +646,7 @@ static int wcove_typec_probe(struct platform_device *pdev)
 	wcove->tcpc.set_polarity = wcove_set_polarity;
 	wcove->tcpc.set_vconn = wcove_set_vconn;
 	wcove->tcpc.set_current_limit = wcove_set_current_limit;
-	wcove->tcpc.start_drp_toggling = wcove_start_drp_toggling;
+	wcove->tcpc.start_toggling = wcove_start_toggling;
 
 	wcove->tcpc.set_pd_rx = wcove_set_pd_rx;
 	wcove->tcpc.set_roles = wcove_set_roles;
diff --git a/include/linux/usb/tcpm.h b/include/linux/usb/tcpm.h
index 50c74a77db55c..8cb93aff69f1e 100644
--- a/include/linux/usb/tcpm.h
+++ b/include/linux/usb/tcpm.h
@@ -121,10 +121,10 @@ struct tcpc_config {
  *		with partner.
  * @set_pd_rx:	Called to enable or disable reception of PD messages
  * @set_roles:	Called to set power and data roles
- * @start_drp_toggling:
- *		Optional; if supported by hardware, called to start DRP
- *		toggling. DRP toggling is stopped automatically if
- *		a connection is established.
+ * @start_toggling:
+ *		Optional; if supported by hardware, called to start dual-role
+ *		toggling or single-role connection detection. Toggling stops
+ *		automatically if a connection is established.
  * @try_role:	Optional; called to set a preferred role
  * @pd_transmit:Called to transmit PD message
  * @mux:	Pointer to multiplexer data
@@ -147,8 +147,9 @@ struct tcpc_dev {
 	int (*set_pd_rx)(struct tcpc_dev *dev, bool on);
 	int (*set_roles)(struct tcpc_dev *dev, bool attached,
 			 enum typec_role role, enum typec_data_role data);
-	int (*start_drp_toggling)(struct tcpc_dev *dev,
-				  enum typec_cc_status cc);
+	int (*start_toggling)(struct tcpc_dev *dev,
+			      enum typec_port_type port_type,
+			      enum typec_cc_status cc);
 	int (*try_role)(struct tcpc_dev *dev, int role);
 	int (*pd_transmit)(struct tcpc_dev *dev, enum tcpm_transmit_type type,
 			   const struct pd_message *msg);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 317/639] selftests/ipc: Fix msgque compiler warnings
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (315 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.19 316/639] usb: typec: tcpm: Notify the tcpc to start connection-detection for SRPs Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.19 318/639] net: hns3: fix loop condition of hns3_get_tx_timeo_queue_info() Greg Kroah-Hartman
                   ` (325 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Kees Cook, Shuah Khan, Sasha Levin

From: Kees Cook <keescook@chromium.org>

[ Upstream commit a147faa96f832f76e772b1e448e94ea84c774081 ]

This fixes the various compiler warnings when building the msgque
selftest. The primary change is using sys/msg.h instead of linux/msg.h
directly to gain the API declarations.

Fixes: 3a665531a3b7 ("selftests: IPC message queue copy feature test")
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/testing/selftests/ipc/msgque.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/tools/testing/selftests/ipc/msgque.c b/tools/testing/selftests/ipc/msgque.c
index dac927e823363..4c156aeab6b80 100644
--- a/tools/testing/selftests/ipc/msgque.c
+++ b/tools/testing/selftests/ipc/msgque.c
@@ -1,9 +1,10 @@
 // SPDX-License-Identifier: GPL-2.0
+#define _GNU_SOURCE
 #include <stdlib.h>
 #include <stdio.h>
 #include <string.h>
 #include <errno.h>
-#include <linux/msg.h>
+#include <sys/msg.h>
 #include <fcntl.h>
 
 #include "../kselftest.h"
@@ -73,7 +74,7 @@ int restore_queue(struct msgque_data *msgque)
 	return 0;
 
 destroy:
-	if (msgctl(id, IPC_RMID, 0))
+	if (msgctl(id, IPC_RMID, NULL))
 		printf("Failed to destroy queue: %d\n", -errno);
 	return ret;
 }
@@ -120,7 +121,7 @@ int check_and_destroy_queue(struct msgque_data *msgque)
 
 	ret = 0;
 err:
-	if (msgctl(msgque->msq_id, IPC_RMID, 0)) {
+	if (msgctl(msgque->msq_id, IPC_RMID, NULL)) {
 		printf("Failed to destroy queue: %d\n", -errno);
 		return -errno;
 	}
@@ -129,7 +130,7 @@ err:
 
 int dump_queue(struct msgque_data *msgque)
 {
-	struct msqid64_ds ds;
+	struct msqid_ds ds;
 	int kern_id;
 	int i, ret;
 
@@ -245,7 +246,7 @@ int main(int argc, char **argv)
 	return ksft_exit_pass();
 
 err_destroy:
-	if (msgctl(msgque.msq_id, IPC_RMID, 0)) {
+	if (msgctl(msgque.msq_id, IPC_RMID, NULL)) {
 		printf("Failed to destroy queue: %d\n", -errno);
 		return ksft_exit_fail();
 	}
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 318/639] net: hns3: fix loop condition of hns3_get_tx_timeo_queue_info()
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (316 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.19 317/639] selftests/ipc: Fix msgque compiler warnings Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.19 319/639] powerpc: vdso: Make vdso32 installation conditional in vdso_install Greg Kroah-Hartman
                   ` (324 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jian Shen, Peng Li, Huazhong Tan,
	David S. Miller, Sasha Levin

From: Jian Shen <shenjian15@huawei.com>

[ Upstream commit fa6c4084b98b82c98cada0f0d5c9f8577579f962 ]

In function hns3_get_tx_timeo_queue_info(), it should use
netdev->num_tx_queues, instead of netdve->real_num_tx_queues
as the loop limitation.

Fixes: 424eb834a9be ("net: hns3: Unified HNS3 {VF|PF} Ethernet Driver for hip08 SoC")
Signed-off-by: Jian Shen <shenjian15@huawei.com>
Signed-off-by: Peng Li <lipeng321@huawei.com>
Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
index 10fa7f5df57e7..3eb8b85f6afb6 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
@@ -1464,7 +1464,7 @@ static bool hns3_get_tx_timeo_queue_info(struct net_device *ndev)
 	int i;
 
 	/* Find the stopped queue the same way the stack does */
-	for (i = 0; i < ndev->real_num_tx_queues; i++) {
+	for (i = 0; i < ndev->num_tx_queues; i++) {
 		struct netdev_queue *q;
 		unsigned long trans_start;
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 319/639] powerpc: vdso: Make vdso32 installation conditional in vdso_install
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (317 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.19 318/639] net: hns3: fix loop condition of hns3_get_tx_timeo_queue_info() Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.19 320/639] ARM: dts: ls1021: Fix SGMII PCS link remaining down after PHY disconnect Greg Kroah-Hartman
                   ` (323 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ben Hutchings, Michael Ellerman, Sasha Levin

From: Ben Hutchings <ben@decadent.org.uk>

[ Upstream commit ff6d27823f619892ab96f7461764840e0d786b15 ]

The 32-bit vDSO is not needed and not normally built for 64-bit
little-endian configurations.  However, the vdso_install target still
builds and installs it.  Add the same config condition as is normally
used for the build.

Fixes: e0d005916994 ("powerpc/vdso: Disable building the 32-bit VDSO ...")
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/Makefile | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile
index e43321f46a3be..8954108df4570 100644
--- a/arch/powerpc/Makefile
+++ b/arch/powerpc/Makefile
@@ -412,7 +412,9 @@ vdso_install:
 ifdef CONFIG_PPC64
 	$(Q)$(MAKE) $(build)=arch/$(ARCH)/kernel/vdso64 $@
 endif
+ifdef CONFIG_VDSO32
 	$(Q)$(MAKE) $(build)=arch/$(ARCH)/kernel/vdso32 $@
+endif
 
 archclean:
 	$(Q)$(MAKE) $(clean)=$(boot)
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 320/639] ARM: dts: ls1021: Fix SGMII PCS link remaining down after PHY disconnect
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (318 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.19 319/639] powerpc: vdso: Make vdso32 installation conditional in vdso_install Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-25 19:13   ` Pavel Machek
  2020-01-24  9:28 ` [PATCH 4.19 321/639] media: ov2659: fix unbalanced mutex_lock/unlock Greg Kroah-Hartman
                   ` (322 subsequent siblings)
  642 siblings, 1 reply; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Vladimir Oltean, Claudiu Manoil,
	Li Yang, Shawn Guo, Sasha Levin

From: Vladimir Oltean <olteanv@gmail.com>

[ Upstream commit c7861adbe37f576931650ad8ef805e0c47564b9a ]

Each eTSEC MAC has its own TBI (SGMII) PCS and private MDIO bus.
But due to a DTS oversight, both SGMII-compatible MACs of the LS1021 SoC
are pointing towards the same internal PCS. Therefore nobody is
controlling the internal PCS of eTSEC0.

Upon initial ndo_open, the SGMII link is ok by virtue of U-boot
initialization. But upon an ifdown/ifup sequence, the code path from
ndo_open -> init_phy -> gfar_configure_serdes does not get executed for
the PCS of eTSEC0 (and is executed twice for MAC eTSEC1). So the SGMII
link remains down for eTSEC0. On the LS1021A-TWR board, to signal this
failure condition, the PHY driver keeps printing
'803x_aneg_done: SGMII link is not ok'.

Also, it changes compatible of mdio0 to "fsl,etsec2-mdio" to match
mdio1 device.

Fixes: 055223d4d22d ("ARM: dts: ls1021a: Enable the eTSEC ports on QDS and TWR")
Signed-off-by: Vladimir Oltean <olteanv@gmail.com>
Reviewed-by: Claudiu Manoil <claudiu.manoil@nxp.com>
Acked-by: Li Yang <leoyang.li@nxp.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/ls1021a-twr.dts |  9 ++++++++-
 arch/arm/boot/dts/ls1021a.dtsi    | 11 ++++++++++-
 2 files changed, 18 insertions(+), 2 deletions(-)

diff --git a/arch/arm/boot/dts/ls1021a-twr.dts b/arch/arm/boot/dts/ls1021a-twr.dts
index f0c949d748331..ec5afad3efd8e 100644
--- a/arch/arm/boot/dts/ls1021a-twr.dts
+++ b/arch/arm/boot/dts/ls1021a-twr.dts
@@ -143,7 +143,7 @@
 };
 
 &enet0 {
-	tbi-handle = <&tbi1>;
+	tbi-handle = <&tbi0>;
 	phy-handle = <&sgmii_phy2>;
 	phy-connection-type = "sgmii";
 	status = "okay";
@@ -222,6 +222,13 @@
 	sgmii_phy2: ethernet-phy@2 {
 		reg = <0x2>;
 	};
+	tbi0: tbi-phy@1f {
+		reg = <0x1f>;
+		device_type = "tbi-phy";
+	};
+};
+
+&mdio1 {
 	tbi1: tbi-phy@1f {
 		reg = <0x1f>;
 		device_type = "tbi-phy";
diff --git a/arch/arm/boot/dts/ls1021a.dtsi b/arch/arm/boot/dts/ls1021a.dtsi
index f18490548c785..7e22309bccac7 100644
--- a/arch/arm/boot/dts/ls1021a.dtsi
+++ b/arch/arm/boot/dts/ls1021a.dtsi
@@ -584,7 +584,7 @@
 		};
 
 		mdio0: mdio@2d24000 {
-			compatible = "gianfar";
+			compatible = "fsl,etsec2-mdio";
 			device_type = "mdio";
 			#address-cells = <1>;
 			#size-cells = <0>;
@@ -592,6 +592,15 @@
 			      <0x0 0x2d10030 0x0 0x4>;
 		};
 
+		mdio1: mdio@2d64000 {
+			compatible = "fsl,etsec2-mdio";
+			device_type = "mdio";
+			#address-cells = <1>;
+			#size-cells = <0>;
+			reg = <0x0 0x2d64000 0x0 0x4000>,
+			      <0x0 0x2d50030 0x0 0x4>;
+		};
+
 		ptp_clock@2d10e00 {
 			compatible = "fsl,etsec-ptp";
 			reg = <0x0 0x2d10e00 0x0 0xb0>;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 321/639] media: ov2659: fix unbalanced mutex_lock/unlock
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (319 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.19 320/639] ARM: dts: ls1021: Fix SGMII PCS link remaining down after PHY disconnect Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.19 322/639] 6lowpan: Off by one handling ->nexthdr Greg Kroah-Hartman
                   ` (321 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lad, Prabhakar, Akinobu Mita,
	Sakari Ailus, Mauro Carvalho Chehab, Sasha Levin

From: Akinobu Mita <akinobu.mita@gmail.com>

[ Upstream commit 384538bda10913e5c94ec5b5d34bd3075931bcf4 ]

Avoid returning with mutex locked.

Fixes: fa8cb6444c32 ("[media] ov2659: Don't depend on subdev API")

Cc: "Lad, Prabhakar" <prabhakar.csengg@gmail.com>
Signed-off-by: Akinobu Mita <akinobu.mita@gmail.com>
Acked-by: Lad, Prabhakar <prabhakar.csengg@gmail.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/i2c/ov2659.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/i2c/ov2659.c b/drivers/media/i2c/ov2659.c
index 4b6be3b0fd528..5cdda9d6ca31e 100644
--- a/drivers/media/i2c/ov2659.c
+++ b/drivers/media/i2c/ov2659.c
@@ -1136,7 +1136,7 @@ static int ov2659_set_fmt(struct v4l2_subdev *sd,
 		mf = v4l2_subdev_get_try_format(sd, cfg, fmt->pad);
 		*mf = fmt->format;
 #else
-		return -ENOTTY;
+		ret = -ENOTTY;
 #endif
 	} else {
 		s64 val;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 322/639] 6lowpan: Off by one handling ->nexthdr
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (320 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.19 321/639] media: ov2659: fix unbalanced mutex_lock/unlock Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.19 323/639] dmaengine: axi-dmac: Dont check the number of frames for alignment Greg Kroah-Hartman
                   ` (320 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Jukka Rissanen,
	Alexander Aring, Marcel Holtmann, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit f57c4bbf34439531adccd7d3a4ecc14f409c1399 ]

NEXTHDR_MAX is 255.  What happens here is that we take a u8 value
"hdr->nexthdr" from the network and then look it up in
lowpan_nexthdr_nhcs[].  The problem is that if hdr->nexthdr is 0xff then
we read one element beyond the end of the array so the array needs to
be one element larger.

Fixes: 92aa7c65d295 ("6lowpan: add generic nhc layer interface")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Jukka Rissanen <jukka.rissanen@linux.intel.com>
Acked-by: Alexander Aring <aring@mojatatu.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/6lowpan/nhc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/6lowpan/nhc.c b/net/6lowpan/nhc.c
index 4fa2fdda174d0..9e56fb98f33cf 100644
--- a/net/6lowpan/nhc.c
+++ b/net/6lowpan/nhc.c
@@ -18,7 +18,7 @@
 #include "nhc.h"
 
 static struct rb_root rb_root = RB_ROOT;
-static struct lowpan_nhc *lowpan_nexthdr_nhcs[NEXTHDR_MAX];
+static struct lowpan_nhc *lowpan_nexthdr_nhcs[NEXTHDR_MAX + 1];
 static DEFINE_SPINLOCK(lowpan_nhc_lock);
 
 static int lowpan_nhc_insert(struct lowpan_nhc *nhc)
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 323/639] dmaengine: axi-dmac: Dont check the number of frames for alignment
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (321 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.19 322/639] 6lowpan: Off by one handling ->nexthdr Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.19 324/639] ALSA: usb-audio: Handle the error from snd_usb_mixer_apply_create_quirk() Greg Kroah-Hartman
                   ` (319 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Alexandru Ardelean, Vinod Koul, Sasha Levin

From: Alexandru Ardelean <alexandru.ardelean@analog.com>

[ Upstream commit 648865a79d8ee3d1aa64aab5eb2a9d12eeed14f9 ]

In 2D transfers (for the AXI DMAC), the number of frames (numf) represents
Y_LENGTH, and the length of a frame is X_LENGTH. 2D transfers are useful
for video transfers where screen resolutions ( X * Y ) are typically
aligned for X, but not for Y.

There is no requirement for Y_LENGTH to be aligned to the bus-width (or
anything), and this is also true for AXI DMAC.

Checking the Y_LENGTH for alignment causes false errors when initiating DMA
transfers. This change fixes this by checking only that the Y_LENGTH is
non-zero.

Fixes: 0e3b67b348b8 ("dmaengine: Add support for the Analog Devices AXI-DMAC DMA controller")
Signed-off-by: Alexandru Ardelean <alexandru.ardelean@analog.com>
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/dma/dma-axi-dmac.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/dma/dma-axi-dmac.c b/drivers/dma/dma-axi-dmac.c
index 15b2453d2647f..b2c755b74bea0 100644
--- a/drivers/dma/dma-axi-dmac.c
+++ b/drivers/dma/dma-axi-dmac.c
@@ -486,7 +486,7 @@ static struct dma_async_tx_descriptor *axi_dmac_prep_interleaved(
 
 	if (chan->hw_2d) {
 		if (!axi_dmac_check_len(chan, xt->sgl[0].size) ||
-		    !axi_dmac_check_len(chan, xt->numf))
+		    xt->numf == 0)
 			return NULL;
 		if (xt->sgl[0].size + dst_icg > chan->max_length ||
 		    xt->sgl[0].size + src_icg > chan->max_length)
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 324/639] ALSA: usb-audio: Handle the error from snd_usb_mixer_apply_create_quirk()
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (322 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.19 323/639] dmaengine: axi-dmac: Dont check the number of frames for alignment Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.19 325/639] afs: Fix AFS file locking to allow fine grained locks Greg Kroah-Hartman
                   ` (318 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Takashi Iwai, Sasha Levin

From: Takashi Iwai <tiwai@suse.de>

[ Upstream commit 328e9f6973be2ee67862cb17bf6c0c5c5918cd72 ]

The error from snd_usb_mixer_apply_create_quirk() is ignored in the
current usb-audio driver code, which will continue the probing even
after the error.  Let's take it more serious.

Fixes: 7b1eda223deb ("ALSA: usb-mixer: factor out quirks")
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/usb/mixer.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
index d7778f2bcbf86..6ac6a09801245 100644
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -3480,7 +3480,9 @@ int snd_usb_create_mixer(struct snd_usb_audio *chip, int ctrlif,
 	if (err < 0)
 		goto _error;
 
-	snd_usb_mixer_apply_create_quirk(mixer);
+	err = snd_usb_mixer_apply_create_quirk(mixer);
+	if (err < 0)
+		goto _error;
 
 	err = snd_device_new(chip->card, SNDRV_DEV_CODEC, mixer, &dev_ops);
 	if (err < 0)
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 325/639] afs: Fix AFS file locking to allow fine grained locks
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (323 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.19 324/639] ALSA: usb-audio: Handle the error from snd_usb_mixer_apply_create_quirk() Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-26 18:57   ` Pavel Machek
  2020-01-24  9:28 ` [PATCH 4.19 326/639] afs: Further fix file locking Greg Kroah-Hartman
                   ` (317 subsequent siblings)
  642 siblings, 1 reply; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jonathan Billings, David Howells,
	Sasha Levin

From: David Howells <dhowells@redhat.com>

[ Upstream commit 68ce801ffd82e72d5005ab5458e8b9e59f24d9cc ]

Fix AFS file locking to allow fine grained locks as some applications, such
as firefox, won't work if they can't take such locks on certain state files
- thereby preventing the use of kAFS to distribute a home directory.

Note that this cannot be made completely functional as the protocol only
has provision for whole-file locks, so there exists the possibility of a
process deadlocking itself by getting a partial read-lock on a file first
and then trying to get a non-overlapping write-lock - but we got the
server's read lock with the first lock, so we're now stuck.

OpenAFS solves this by just granting any partial-range lock directly
without consulting the server - and hoping there's no remote collision.  I
want to implement that in a separate patch and it requires a bit more
thought.

Fixes: 8d6c554126b8 ("AFS: implement file locking")
Reported-by: Jonathan Billings <jsbillings@jsbillings.org>
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/afs/flock.c | 23 +++++++++--------------
 1 file changed, 9 insertions(+), 14 deletions(-)

diff --git a/fs/afs/flock.c b/fs/afs/flock.c
index 1bb300ef362b0..dffbb456629c9 100644
--- a/fs/afs/flock.c
+++ b/fs/afs/flock.c
@@ -432,10 +432,6 @@ static int afs_do_setlk(struct file *file, struct file_lock *fl)
 
 	_enter("{%x:%u},%u", vnode->fid.vid, vnode->fid.vnode, fl->fl_type);
 
-	/* only whole-file locks are supported */
-	if (fl->fl_start != 0 || fl->fl_end != OFFSET_MAX)
-		return -EINVAL;
-
 	fl->fl_ops = &afs_lock_ops;
 	INIT_LIST_HEAD(&fl->fl_u.afs.link);
 	fl->fl_u.afs.state = AFS_LOCK_PENDING;
@@ -587,10 +583,6 @@ static int afs_do_unlk(struct file *file, struct file_lock *fl)
 	/* Flush all pending writes before doing anything with locks. */
 	vfs_fsync(file, 0);
 
-	/* only whole-file unlocks are supported */
-	if (fl->fl_start != 0 || fl->fl_end != OFFSET_MAX)
-		return -EINVAL;
-
 	ret = posix_lock_file(file, fl, NULL);
 	_leave(" = %d [%u]", ret, vnode->lock_state);
 	return ret;
@@ -618,12 +610,15 @@ static int afs_do_getlk(struct file *file, struct file_lock *fl)
 			goto error;
 
 		lock_count = READ_ONCE(vnode->status.lock_count);
-		if (lock_count > 0)
-			fl->fl_type = F_RDLCK;
-		else
-			fl->fl_type = F_WRLCK;
-		fl->fl_start = 0;
-		fl->fl_end = OFFSET_MAX;
+		if (lock_count != 0) {
+			if (lock_count > 0)
+				fl->fl_type = F_RDLCK;
+			else
+				fl->fl_type = F_WRLCK;
+			fl->fl_start = 0;
+			fl->fl_end = OFFSET_MAX;
+			fl->fl_pid = 0;
+		}
 	}
 
 	ret = 0;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 326/639] afs: Further fix file locking
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (324 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.19 325/639] afs: Fix AFS file locking to allow fine grained locks Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.19 327/639] NFS: Dont interrupt file writeout due to fatal errors Greg Kroah-Hartman
                   ` (316 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jonathan Billings, David Howells,
	Sasha Levin

From: David Howells <dhowells@redhat.com>

[ Upstream commit 4be5975aea154e164696128d049dec9ed341585c ]

Further fix the file locking in the afs filesystem client in a number of
ways, including:

 (1) Don't submit the operation to obtain a lock from the server in a work
     queue context, but rather do it in the process context of whoever
     issued the requesting system call.

 (2) The owner of the file_lock struct at the front of the pending_locks
     queue now owns right to talk to the server.

 (3) Write locks can be instantly granted if they don't overlap with any
     other locks *and* we have a write lock on the server.

 (4) In the event of an authentication/permission error, all other matching
     pending locks requests are also immediately aborted.

 (5) Properly use VFS core locks_lock_file_wait() to distribute the server
     lock amongst local client locks, including waiting for the lock to
     become available.

Test with:

	sqlite3 /afs/.../scratch/billings.sqlite <<EOF
	CREATE TABLE hosts (
	    hostname varchar(80),
	    shorthost varchar(80),
	    room varchar(30),
	    building varchar(30),
	    PRIMARY KEY(shorthost)
	    );
	EOF

With the version of sqlite3 that I have, this should fail consistently with
EAGAIN, whether or not the program is straced (which introduces some delays
between lock syscalls).

Fixes: 0fafdc9f888b ("afs: Fix file locking")
Reported-by: Jonathan Billings <jsbillin@umich.edu>
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/afs/flock.c | 392 ++++++++++++++++++++++++-------------------------
 1 file changed, 196 insertions(+), 196 deletions(-)

diff --git a/fs/afs/flock.c b/fs/afs/flock.c
index dffbb456629c9..aea7224ba1981 100644
--- a/fs/afs/flock.c
+++ b/fs/afs/flock.c
@@ -13,9 +13,11 @@
 
 #define AFS_LOCK_GRANTED	0
 #define AFS_LOCK_PENDING	1
+#define AFS_LOCK_YOUR_TRY	2
 
 struct workqueue_struct *afs_lock_manager;
 
+static void afs_next_locker(struct afs_vnode *vnode, int error);
 static void afs_fl_copy_lock(struct file_lock *new, struct file_lock *fl);
 static void afs_fl_release_private(struct file_lock *fl);
 
@@ -24,6 +26,12 @@ static const struct file_lock_operations afs_lock_ops = {
 	.fl_release_private	= afs_fl_release_private,
 };
 
+static inline void afs_set_lock_state(struct afs_vnode *vnode, enum afs_lock_state state)
+{
+	_debug("STATE %u -> %u", vnode->lock_state, state);
+	vnode->lock_state = state;
+}
+
 /*
  * if the callback is broken on this vnode, then the lock may now be available
  */
@@ -31,14 +39,20 @@ void afs_lock_may_be_available(struct afs_vnode *vnode)
 {
 	_enter("{%x:%u}", vnode->fid.vid, vnode->fid.vnode);
 
-	queue_delayed_work(afs_lock_manager, &vnode->lock_work, 0);
+	if (vnode->lock_state != AFS_VNODE_LOCK_WAITING_FOR_CB)
+		return;
+
+	spin_lock(&vnode->lock);
+	if (vnode->lock_state == AFS_VNODE_LOCK_WAITING_FOR_CB)
+		afs_next_locker(vnode, 0);
+	spin_unlock(&vnode->lock);
 }
 
 /*
  * the lock will time out in 5 minutes unless we extend it, so schedule
  * extension in a bit less than that time
  */
-static void afs_schedule_lock_extension(struct afs_vnode *vnode)
+static void __maybe_unused afs_schedule_lock_extension(struct afs_vnode *vnode)
 {
 	queue_delayed_work(afs_lock_manager, &vnode->lock_work,
 			   AFS_LOCKWAIT * HZ / 2);
@@ -49,22 +63,65 @@ static void afs_schedule_lock_extension(struct afs_vnode *vnode)
  * first lock in the queue is itself a readlock)
  * - the caller must hold the vnode lock
  */
-static void afs_grant_locks(struct afs_vnode *vnode, struct file_lock *fl)
+static void afs_grant_locks(struct afs_vnode *vnode)
 {
 	struct file_lock *p, *_p;
+	bool exclusive = (vnode->lock_type == AFS_LOCK_WRITE);
 
-	list_move_tail(&fl->fl_u.afs.link, &vnode->granted_locks);
-	if (fl->fl_type == F_RDLCK) {
-		list_for_each_entry_safe(p, _p, &vnode->pending_locks,
-					 fl_u.afs.link) {
-			if (p->fl_type == F_RDLCK) {
-				p->fl_u.afs.state = AFS_LOCK_GRANTED;
-				list_move_tail(&p->fl_u.afs.link,
-					       &vnode->granted_locks);
-				wake_up(&p->fl_wait);
-			}
+	list_for_each_entry_safe(p, _p, &vnode->pending_locks, fl_u.afs.link) {
+		if (!exclusive && p->fl_type == F_WRLCK)
+			continue;
+
+		list_move_tail(&p->fl_u.afs.link, &vnode->granted_locks);
+		p->fl_u.afs.state = AFS_LOCK_GRANTED;
+		wake_up(&p->fl_wait);
+	}
+}
+
+/*
+ * If an error is specified, reject every pending lock that matches the
+ * authentication and type of the lock we failed to get.  If there are any
+ * remaining lockers, try to wake up one of them to have a go.
+ */
+static void afs_next_locker(struct afs_vnode *vnode, int error)
+{
+	struct file_lock *p, *_p, *next = NULL;
+	struct key *key = vnode->lock_key;
+	unsigned int fl_type = F_RDLCK;
+
+	_enter("");
+
+	if (vnode->lock_type == AFS_LOCK_WRITE)
+		fl_type = F_WRLCK;
+
+	list_for_each_entry_safe(p, _p, &vnode->pending_locks, fl_u.afs.link) {
+		if (error &&
+		    p->fl_type == fl_type &&
+		    afs_file_key(p->fl_file) == key) {
+			list_del_init(&p->fl_u.afs.link);
+			p->fl_u.afs.state = error;
+			wake_up(&p->fl_wait);
 		}
+
+		/* Select the next locker to hand off to. */
+		if (next &&
+		    (next->fl_type == F_WRLCK || p->fl_type == F_RDLCK))
+			continue;
+		next = p;
 	}
+
+	vnode->lock_key = NULL;
+	key_put(key);
+
+	if (next) {
+		afs_set_lock_state(vnode, AFS_VNODE_LOCK_SETTING);
+		next->fl_u.afs.state = AFS_LOCK_YOUR_TRY;
+		wake_up(&next->fl_wait);
+	} else {
+		afs_set_lock_state(vnode, AFS_VNODE_LOCK_NONE);
+	}
+
+	_leave("");
 }
 
 /*
@@ -170,8 +227,6 @@ void afs_lock_work(struct work_struct *work)
 {
 	struct afs_vnode *vnode =
 		container_of(work, struct afs_vnode, lock_work.work);
-	struct file_lock *fl, *next;
-	afs_lock_type_t type;
 	struct key *key;
 	int ret;
 
@@ -184,7 +239,7 @@ again:
 	switch (vnode->lock_state) {
 	case AFS_VNODE_LOCK_NEED_UNLOCK:
 		_debug("unlock");
-		vnode->lock_state = AFS_VNODE_LOCK_UNLOCKING;
+		afs_set_lock_state(vnode, AFS_VNODE_LOCK_UNLOCKING);
 		spin_unlock(&vnode->lock);
 
 		/* attempt to release the server lock; if it fails, we just
@@ -196,22 +251,9 @@ again:
 			       vnode->fid.vid, vnode->fid.vnode, ret);
 
 		spin_lock(&vnode->lock);
-		key_put(vnode->lock_key);
-		vnode->lock_key = NULL;
-		vnode->lock_state = AFS_VNODE_LOCK_NONE;
-
-		if (list_empty(&vnode->pending_locks)) {
-			spin_unlock(&vnode->lock);
-			return;
-		}
-
-		/* The new front of the queue now owns the state variables. */
-		next = list_entry(vnode->pending_locks.next,
-				  struct file_lock, fl_u.afs.link);
-		vnode->lock_key = key_get(afs_file_key(next->fl_file));
-		vnode->lock_type = (next->fl_type == F_RDLCK) ? AFS_LOCK_READ : AFS_LOCK_WRITE;
-		vnode->lock_state = AFS_VNODE_LOCK_WAITING_FOR_CB;
-		goto again;
+		afs_next_locker(vnode, 0);
+		spin_unlock(&vnode->lock);
+		return;
 
 	/* If we've already got a lock, then it must be time to extend that
 	 * lock as AFS locks time out after 5 minutes.
@@ -222,7 +264,7 @@ again:
 		ASSERT(!list_empty(&vnode->granted_locks));
 
 		key = key_get(vnode->lock_key);
-		vnode->lock_state = AFS_VNODE_LOCK_EXTENDING;
+		afs_set_lock_state(vnode, AFS_VNODE_LOCK_EXTENDING);
 		spin_unlock(&vnode->lock);
 
 		ret = afs_extend_lock(vnode, key); /* RPC */
@@ -236,72 +278,26 @@ again:
 
 		if (vnode->lock_state != AFS_VNODE_LOCK_EXTENDING)
 			goto again;
-		vnode->lock_state = AFS_VNODE_LOCK_GRANTED;
+		afs_set_lock_state(vnode, AFS_VNODE_LOCK_GRANTED);
 
-		if (ret == 0)
-			afs_schedule_lock_extension(vnode);
-		else
+		if (ret != 0)
 			queue_delayed_work(afs_lock_manager, &vnode->lock_work,
 					   HZ * 10);
 		spin_unlock(&vnode->lock);
 		_leave(" [ext]");
 		return;
 
-		/* If we don't have a granted lock, then we must've been called
-		 * back by the server, and so if might be possible to get a
-		 * lock we're currently waiting for.
-		 */
+	/* If we're waiting for a callback to indicate lock release, we can't
+	 * actually rely on this, so need to recheck at regular intervals.  The
+	 * problem is that the server might not notify us if the lock just
+	 * expires (say because a client died) rather than being explicitly
+	 * released.
+	 */
 	case AFS_VNODE_LOCK_WAITING_FOR_CB:
-		_debug("get");
-
-		key = key_get(vnode->lock_key);
-		type = vnode->lock_type;
-		vnode->lock_state = AFS_VNODE_LOCK_SETTING;
+		_debug("retry");
+		afs_next_locker(vnode, 0);
 		spin_unlock(&vnode->lock);
-
-		ret = afs_set_lock(vnode, key, type); /* RPC */
-		key_put(key);
-
-		spin_lock(&vnode->lock);
-		switch (ret) {
-		case -EWOULDBLOCK:
-			_debug("blocked");
-			break;
-		case 0:
-			_debug("acquired");
-			vnode->lock_state = AFS_VNODE_LOCK_GRANTED;
-			/* Fall through */
-		default:
-			/* Pass the lock or the error onto the first locker in
-			 * the list - if they're looking for this type of lock.
-			 * If they're not, we assume that whoever asked for it
-			 * took a signal.
-			 */
-			if (list_empty(&vnode->pending_locks)) {
-				_debug("withdrawn");
-				vnode->lock_state = AFS_VNODE_LOCK_NEED_UNLOCK;
-				goto again;
-			}
-
-			fl = list_entry(vnode->pending_locks.next,
-					struct file_lock, fl_u.afs.link);
-			type = (fl->fl_type == F_RDLCK) ? AFS_LOCK_READ : AFS_LOCK_WRITE;
-			if (vnode->lock_type != type) {
-				_debug("changed");
-				vnode->lock_state = AFS_VNODE_LOCK_NEED_UNLOCK;
-				goto again;
-			}
-
-			fl->fl_u.afs.state = ret;
-			if (ret == 0)
-				afs_grant_locks(vnode, fl);
-			else
-				list_del_init(&fl->fl_u.afs.link);
-			wake_up(&fl->fl_wait);
-			spin_unlock(&vnode->lock);
-			_leave(" [granted]");
-			return;
-		}
+		return;
 
 	default:
 		/* Looks like a lock request was withdrawn. */
@@ -319,14 +315,15 @@ again:
  */
 static void afs_defer_unlock(struct afs_vnode *vnode)
 {
-	_enter("");
+	_enter("%u", vnode->lock_state);
 
-	if (vnode->lock_state == AFS_VNODE_LOCK_GRANTED ||
-	    vnode->lock_state == AFS_VNODE_LOCK_EXTENDING) {
+	if (list_empty(&vnode->granted_locks) &&
+	    (vnode->lock_state == AFS_VNODE_LOCK_GRANTED ||
+	     vnode->lock_state == AFS_VNODE_LOCK_EXTENDING)) {
 		cancel_delayed_work(&vnode->lock_work);
 
-		vnode->lock_state = AFS_VNODE_LOCK_NEED_UNLOCK;
-		afs_lock_may_be_available(vnode);
+		afs_set_lock_state(vnode, AFS_VNODE_LOCK_NEED_UNLOCK);
+		queue_delayed_work(afs_lock_manager, &vnode->lock_work, 0);
 	}
 }
 
@@ -375,50 +372,6 @@ static int afs_do_setlk_check(struct afs_vnode *vnode, struct key *key,
 	return 0;
 }
 
-/*
- * Remove the front runner from the pending queue.
- * - The caller must hold vnode->lock.
- */
-static void afs_dequeue_lock(struct afs_vnode *vnode, struct file_lock *fl)
-{
-	struct file_lock *next;
-
-	_enter("");
-
-	/* ->lock_type, ->lock_key and ->lock_state only belong to this
-	 * file_lock if we're at the front of the pending queue or if we have
-	 * the lock granted or if the lock_state is NEED_UNLOCK or UNLOCKING.
-	 */
-	if (vnode->granted_locks.next == &fl->fl_u.afs.link &&
-	    vnode->granted_locks.prev == &fl->fl_u.afs.link) {
-		list_del_init(&fl->fl_u.afs.link);
-		afs_defer_unlock(vnode);
-		return;
-	}
-
-	if (!list_empty(&vnode->granted_locks) ||
-	    vnode->pending_locks.next != &fl->fl_u.afs.link) {
-		list_del_init(&fl->fl_u.afs.link);
-		return;
-	}
-
-	list_del_init(&fl->fl_u.afs.link);
-	key_put(vnode->lock_key);
-	vnode->lock_key = NULL;
-	vnode->lock_state = AFS_VNODE_LOCK_NONE;
-
-	if (list_empty(&vnode->pending_locks))
-		return;
-
-	/* The new front of the queue now owns the state variables. */
-	next = list_entry(vnode->pending_locks.next,
-			  struct file_lock, fl_u.afs.link);
-	vnode->lock_key = key_get(afs_file_key(next->fl_file));
-	vnode->lock_type = (next->fl_type == F_RDLCK) ? AFS_LOCK_READ : AFS_LOCK_WRITE;
-	vnode->lock_state = AFS_VNODE_LOCK_WAITING_FOR_CB;
-	afs_lock_may_be_available(vnode);
-}
-
 /*
  * request a lock on a file on the server
  */
@@ -443,44 +396,66 @@ static int afs_do_setlk(struct file *file, struct file_lock *fl)
 		return ret;
 
 	spin_lock(&vnode->lock);
+	list_add_tail(&fl->fl_u.afs.link, &vnode->pending_locks);
 
-	/* If we've already got a readlock on the server then we instantly
-	 * grant another readlock, irrespective of whether there are any
-	 * pending writelocks.
+	/* If we've already got a lock on the server then try to move to having
+	 * the VFS grant the requested lock.  Note that this means that other
+	 * clients may get starved out.
 	 */
-	if (type == AFS_LOCK_READ &&
-	    vnode->lock_state == AFS_VNODE_LOCK_GRANTED &&
-	    vnode->lock_type == AFS_LOCK_READ) {
-		_debug("instant readlock");
-		ASSERT(!list_empty(&vnode->granted_locks));
-		goto share_existing_lock;
-	}
+	_debug("try %u", vnode->lock_state);
+	if (vnode->lock_state == AFS_VNODE_LOCK_GRANTED) {
+		if (type == AFS_LOCK_READ) {
+			_debug("instant readlock");
+			list_move_tail(&fl->fl_u.afs.link, &vnode->granted_locks);
+			fl->fl_u.afs.state = AFS_LOCK_GRANTED;
+			goto vnode_is_locked_u;
+		}
 
-	list_add_tail(&fl->fl_u.afs.link, &vnode->pending_locks);
+		if (vnode->lock_type == AFS_LOCK_WRITE) {
+			_debug("instant writelock");
+			list_move_tail(&fl->fl_u.afs.link, &vnode->granted_locks);
+			fl->fl_u.afs.state = AFS_LOCK_GRANTED;
+			goto vnode_is_locked_u;
+		}
+	}
 
 	if (vnode->lock_state != AFS_VNODE_LOCK_NONE)
 		goto need_to_wait;
 
+try_to_lock:
 	/* We don't have a lock on this vnode and we aren't currently waiting
 	 * for one either, so ask the server for a lock.
 	 *
 	 * Note that we need to be careful if we get interrupted by a signal
 	 * after dispatching the request as we may still get the lock, even
 	 * though we don't wait for the reply (it's not too bad a problem - the
-	 * lock will expire in 10 mins anyway).
+	 * lock will expire in 5 mins anyway).
 	 */
 	_debug("not locked");
 	vnode->lock_key = key_get(key);
 	vnode->lock_type = type;
-	vnode->lock_state = AFS_VNODE_LOCK_SETTING;
+	afs_set_lock_state(vnode, AFS_VNODE_LOCK_SETTING);
 	spin_unlock(&vnode->lock);
 
 	ret = afs_set_lock(vnode, key, type); /* RPC */
 
 	spin_lock(&vnode->lock);
 	switch (ret) {
+	case -EKEYREJECTED:
+	case -EKEYEXPIRED:
+	case -EKEYREVOKED:
+	case -EPERM:
+	case -EACCES:
+		fl->fl_u.afs.state = ret;
+		list_del_init(&fl->fl_u.afs.link);
+		afs_next_locker(vnode, ret);
+		goto error_unlock;
+
 	default:
-		goto abort_attempt;
+		fl->fl_u.afs.state = ret;
+		list_del_init(&fl->fl_u.afs.link);
+		afs_next_locker(vnode, 0);
+		goto error_unlock;
 
 	case -EWOULDBLOCK:
 		/* The server doesn't have a lock-waiting queue, so the client
@@ -490,29 +465,23 @@ static int afs_do_setlk(struct file *file, struct file_lock *fl)
 		_debug("would block");
 		ASSERT(list_empty(&vnode->granted_locks));
 		ASSERTCMP(vnode->pending_locks.next, ==, &fl->fl_u.afs.link);
-		vnode->lock_state = AFS_VNODE_LOCK_WAITING_FOR_CB;
-		goto need_to_wait;
+		goto lock_is_contended;
 
 	case 0:
 		_debug("acquired");
-		break;
+		afs_set_lock_state(vnode, AFS_VNODE_LOCK_GRANTED);
+		afs_grant_locks(vnode);
+		goto vnode_is_locked_u;
 	}
 
-	/* we've acquired a server lock, but it needs to be renewed after 5
-	 * mins */
-	vnode->lock_state = AFS_VNODE_LOCK_GRANTED;
-	afs_schedule_lock_extension(vnode);
-
-share_existing_lock:
-	/* the lock has been granted as far as we're concerned... */
-	fl->fl_u.afs.state = AFS_LOCK_GRANTED;
-	list_move_tail(&fl->fl_u.afs.link, &vnode->granted_locks);
-
-given_lock:
-	/* ... but we do still need to get the VFS's blessing */
+vnode_is_locked_u:
 	spin_unlock(&vnode->lock);
+vnode_is_locked:
+	/* the lock has been granted by the server... */
+	ASSERTCMP(fl->fl_u.afs.state, ==, AFS_LOCK_GRANTED);
 
-	ret = posix_lock_file(file, fl, NULL);
+	/* ... but the VFS still needs to distribute access on this client. */
+	ret = locks_lock_file_wait(file, fl);
 	if (ret < 0)
 		goto vfs_rejected_lock;
 
@@ -524,38 +493,61 @@ given_lock:
 	_leave(" = 0");
 	return 0;
 
+lock_is_contended:
+	if (!(fl->fl_flags & FL_SLEEP)) {
+		list_del_init(&fl->fl_u.afs.link);
+		afs_next_locker(vnode, 0);
+		ret = -EAGAIN;
+		goto error_unlock;
+	}
+
+	afs_set_lock_state(vnode, AFS_VNODE_LOCK_WAITING_FOR_CB);
+	queue_delayed_work(afs_lock_manager, &vnode->lock_work, HZ * 5);
+
 need_to_wait:
 	/* We're going to have to wait.  Either this client doesn't have a lock
 	 * on the server yet and we need to wait for a callback to occur, or
-	 * the client does have a lock on the server, but it belongs to some
-	 * other process(es) and is incompatible with the lock we want.
+	 * the client does have a lock on the server, but it's shared and we
+	 * need an exclusive lock.
 	 */
-	ret = -EAGAIN;
-	if (fl->fl_flags & FL_SLEEP) {
-		spin_unlock(&vnode->lock);
+	spin_unlock(&vnode->lock);
 
-		_debug("sleep");
-		ret = wait_event_interruptible(fl->fl_wait,
-					       fl->fl_u.afs.state != AFS_LOCK_PENDING);
+	_debug("sleep");
+	ret = wait_event_interruptible(fl->fl_wait,
+				       fl->fl_u.afs.state != AFS_LOCK_PENDING);
+	_debug("wait = %d", ret);
 
+	if (fl->fl_u.afs.state >= 0 && fl->fl_u.afs.state != AFS_LOCK_GRANTED) {
 		spin_lock(&vnode->lock);
-	}
 
-	if (fl->fl_u.afs.state == AFS_LOCK_GRANTED)
-		goto given_lock;
-	if (fl->fl_u.afs.state < 0)
-		ret = fl->fl_u.afs.state;
+		switch (fl->fl_u.afs.state) {
+		case AFS_LOCK_YOUR_TRY:
+			fl->fl_u.afs.state = AFS_LOCK_PENDING;
+			goto try_to_lock;
+		case AFS_LOCK_PENDING:
+			if (ret > 0) {
+				/* We need to retry the lock.  We may not be
+				 * notified by the server if it just expired
+				 * rather than being released.
+				 */
+				ASSERTCMP(vnode->lock_state, ==, AFS_VNODE_LOCK_WAITING_FOR_CB);
+				afs_set_lock_state(vnode, AFS_VNODE_LOCK_SETTING);
+				fl->fl_u.afs.state = AFS_LOCK_PENDING;
+				goto try_to_lock;
+			}
+			goto error_unlock;
+		case AFS_LOCK_GRANTED:
+		default:
+			break;
+		}
 
-abort_attempt:
-	/* we aren't going to get the lock, either because we're unwilling to
-	 * wait, or because some signal happened */
-	_debug("abort");
-	afs_dequeue_lock(vnode, fl);
+		spin_unlock(&vnode->lock);
+	}
 
-error_unlock:
-	spin_unlock(&vnode->lock);
-	_leave(" = %d", ret);
-	return ret;
+	if (fl->fl_u.afs.state == AFS_LOCK_GRANTED)
+		goto vnode_is_locked;
+	ret = fl->fl_u.afs.state;
+	goto error;
 
 vfs_rejected_lock:
 	/* The VFS rejected the lock we just obtained, so we have to discard
@@ -565,9 +557,13 @@ vfs_rejected_lock:
 	_debug("vfs refused %d", ret);
 	spin_lock(&vnode->lock);
 	list_del_init(&fl->fl_u.afs.link);
-	if (list_empty(&vnode->granted_locks))
-		afs_defer_unlock(vnode);
-	goto error_unlock;
+	afs_defer_unlock(vnode);
+
+error_unlock:
+	spin_unlock(&vnode->lock);
+error:
+	_leave(" = %d", ret);
+	return ret;
 }
 
 /*
@@ -583,7 +579,7 @@ static int afs_do_unlk(struct file *file, struct file_lock *fl)
 	/* Flush all pending writes before doing anything with locks. */
 	vfs_fsync(file, 0);
 
-	ret = posix_lock_file(file, fl, NULL);
+	ret = locks_lock_file_wait(file, fl);
 	_leave(" = %d [%u]", ret, vnode->lock_state);
 	return ret;
 }
@@ -705,7 +701,11 @@ static void afs_fl_release_private(struct file_lock *fl)
 	_enter("");
 
 	spin_lock(&vnode->lock);
-	afs_dequeue_lock(vnode, fl);
+
+	list_del_init(&fl->fl_u.afs.link);
+	if (list_empty(&vnode->granted_locks))
+		afs_defer_unlock(vnode);
+
 	_debug("state %u for %p", vnode->lock_state, vnode);
 	spin_unlock(&vnode->lock);
 }
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 327/639] NFS: Dont interrupt file writeout due to fatal errors
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (325 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.19 326/639] afs: Further fix file locking Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.19 328/639] coresight: catu: fix clang build warning Greg Kroah-Hartman
                   ` (315 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Trond Myklebust, Anna Schumaker, Sasha Levin

From: Trond Myklebust <trondmy@gmail.com>

[ Upstream commit 14bebe3c90b326d2a0df78aed5e9de090c71d878 ]

When flushing out dirty pages, the fact that we may hit fatal errors
is not a reason to stop writeback. Those errors are reported through
fsync(), not through the flush mechanism.

Fixes: a6598813a4c5b ("NFS: Don't write back further requests if there...")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/nfs/write.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/nfs/write.c b/fs/nfs/write.c
index 117ffd90419e2..e27637fa0f790 100644
--- a/fs/nfs/write.c
+++ b/fs/nfs/write.c
@@ -646,7 +646,7 @@ out:
 	return ret;
 out_launder:
 	nfs_write_error_remove_page(req);
-	return ret;
+	return 0;
 }
 
 static int nfs_do_writepage(struct page *page, struct writeback_control *wbc,
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 328/639] coresight: catu: fix clang build warning
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (326 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.19 327/639] NFS: Dont interrupt file writeout due to fatal errors Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.19 329/639] s390/kexec_file: Fix potential segment overlap in ELF loader Greg Kroah-Hartman
                   ` (314 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Arnd Bergmann, Suzuki K Poulose,
	Mathieu Poirier, Sasha Levin

From: Arnd Bergmann <arnd@arndb.de>

[ Upstream commit 59d63de076607a9334b11628b5c3ddda1d8f56cd ]

Clang points out a syntax error, as the etr_catu_buf_ops structure is
declared 'static' before the type is known:

In file included from drivers/hwtracing/coresight/coresight-tmc-etr.c:12:
drivers/hwtracing/coresight/coresight-catu.h:116:40: warning: tentative definition of variable with internal linkage has incomplete non-array type 'const struct etr_buf_operations' [-Wtentative-definition-incomplete-type]
static const struct etr_buf_operations etr_catu_buf_ops;
                                       ^
drivers/hwtracing/coresight/coresight-catu.h:116:21: note: forward declaration of 'struct etr_buf_operations'
static const struct etr_buf_operations etr_catu_buf_ops;

This seems worth fixing in the code, so replace pointer to the empty
constant structure with a NULL pointer. We need an extra NULL pointer
check here, but the result should be better object code otherwise,
avoiding the silly empty structure.

Fixes: 434d611cddef ("coresight: catu: Plug in CATU as a backend for ETR buffer")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Suzuki K Poulose <suzuki.poulose@arm.com>
[Fixed line over 80 characters]
Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hwtracing/coresight/coresight-catu.h    | 5 -----
 drivers/hwtracing/coresight/coresight-tmc-etr.c | 5 +++--
 2 files changed, 3 insertions(+), 7 deletions(-)

diff --git a/drivers/hwtracing/coresight/coresight-catu.h b/drivers/hwtracing/coresight/coresight-catu.h
index 1b281f0dcccca..1d2ad183fd92d 100644
--- a/drivers/hwtracing/coresight/coresight-catu.h
+++ b/drivers/hwtracing/coresight/coresight-catu.h
@@ -109,11 +109,6 @@ static inline bool coresight_is_catu_device(struct coresight_device *csdev)
 	return true;
 }
 
-#ifdef CONFIG_CORESIGHT_CATU
 extern const struct etr_buf_operations etr_catu_buf_ops;
-#else
-/* Dummy declaration for the CATU ops */
-static const struct etr_buf_operations etr_catu_buf_ops;
-#endif
 
 #endif
diff --git a/drivers/hwtracing/coresight/coresight-tmc-etr.c b/drivers/hwtracing/coresight/coresight-tmc-etr.c
index 2d6f428176ff8..3b684687b5a7d 100644
--- a/drivers/hwtracing/coresight/coresight-tmc-etr.c
+++ b/drivers/hwtracing/coresight/coresight-tmc-etr.c
@@ -747,7 +747,8 @@ static inline void tmc_etr_disable_catu(struct tmc_drvdata *drvdata)
 static const struct etr_buf_operations *etr_buf_ops[] = {
 	[ETR_MODE_FLAT] = &etr_flat_buf_ops,
 	[ETR_MODE_ETR_SG] = &etr_sg_buf_ops,
-	[ETR_MODE_CATU] = &etr_catu_buf_ops,
+	[ETR_MODE_CATU] = IS_ENABLED(CONFIG_CORESIGHT_CATU)
+						? &etr_catu_buf_ops : NULL,
 };
 
 static inline int tmc_etr_mode_alloc_buf(int mode,
@@ -761,7 +762,7 @@ static inline int tmc_etr_mode_alloc_buf(int mode,
 	case ETR_MODE_FLAT:
 	case ETR_MODE_ETR_SG:
 	case ETR_MODE_CATU:
-		if (etr_buf_ops[mode]->alloc)
+		if (etr_buf_ops[mode] && etr_buf_ops[mode]->alloc)
 			rc = etr_buf_ops[mode]->alloc(drvdata, etr_buf,
 						      node, pages);
 		if (!rc)
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 329/639] s390/kexec_file: Fix potential segment overlap in ELF loader
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (327 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.19 328/639] coresight: catu: fix clang build warning Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.19 330/639] irqchip/gic-v3-its: fix some definitions of inner cacheability attributes Greg Kroah-Hartman
                   ` (313 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Philipp Rudo, Martin Schwidefsky,
	Sasha Levin

From: Philipp Rudo <prudo@linux.ibm.com>

[ Upstream commit 6339a3889ad4d0dd930ed7a1e873fb81d3e690f7 ]

When loading an ELF image via kexec_file the segment alignment is ignored
in the calculation for the load address of the next segment. When there are
multiple segments this can lead to segment overlap and thus load failure.

Signed-off-by: Philipp Rudo <prudo@linux.ibm.com>
Fixes: 8be018827154 ("s390/kexec_file: Add ELF loader")
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/s390/kernel/kexec_elf.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/s390/kernel/kexec_elf.c b/arch/s390/kernel/kexec_elf.c
index 602e7cc26d118..5cf340b778f18 100644
--- a/arch/s390/kernel/kexec_elf.c
+++ b/arch/s390/kernel/kexec_elf.c
@@ -58,7 +58,7 @@ static int kexec_file_add_elf_kernel(struct kimage *image,
 		if (ret)
 			return ret;
 
-		data->memsz += buf.memsz;
+		data->memsz = ALIGN(data->memsz, phdr->p_align) + buf.memsz;
 	}
 
 	return 0;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 330/639] irqchip/gic-v3-its: fix some definitions of inner cacheability attributes
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (328 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.19 329/639] s390/kexec_file: Fix potential segment overlap in ELF loader Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.19 331/639] scsi: qla2xxx: Fix a format specifier Greg Kroah-Hartman
                   ` (312 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hongbo Yao, Marc Zyngier, Sasha Levin

From: Hongbo Yao <yaohongbo@huawei.com>

[ Upstream commit 0f29456d08042134aff6e562d07a6365c841c4ad ]

Some definitions of Inner Cacheability attibutes need to be corrected.

Fixes: 8c828a535e29f ("irqchip/gicv3-its: Restore all cacheability attributes")
Signed-off-by: Hongbo Yao <yaohongbo@huawei.com>
Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/irqchip/arm-gic-v3.h | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/include/linux/irqchip/arm-gic-v3.h b/include/linux/irqchip/arm-gic-v3.h
index 3188c0bef3e79..1d21e98d68549 100644
--- a/include/linux/irqchip/arm-gic-v3.h
+++ b/include/linux/irqchip/arm-gic-v3.h
@@ -165,7 +165,7 @@
 #define GICR_PROPBASER_nCnB	GIC_BASER_CACHEABILITY(GICR_PROPBASER, INNER, nCnB)
 #define GICR_PROPBASER_nC 	GIC_BASER_CACHEABILITY(GICR_PROPBASER, INNER, nC)
 #define GICR_PROPBASER_RaWt	GIC_BASER_CACHEABILITY(GICR_PROPBASER, INNER, RaWt)
-#define GICR_PROPBASER_RaWb	GIC_BASER_CACHEABILITY(GICR_PROPBASER, INNER, RaWt)
+#define GICR_PROPBASER_RaWb	GIC_BASER_CACHEABILITY(GICR_PROPBASER, INNER, RaWb)
 #define GICR_PROPBASER_WaWt	GIC_BASER_CACHEABILITY(GICR_PROPBASER, INNER, WaWt)
 #define GICR_PROPBASER_WaWb	GIC_BASER_CACHEABILITY(GICR_PROPBASER, INNER, WaWb)
 #define GICR_PROPBASER_RaWaWt	GIC_BASER_CACHEABILITY(GICR_PROPBASER, INNER, RaWaWt)
@@ -192,7 +192,7 @@
 #define GICR_PENDBASER_nCnB	GIC_BASER_CACHEABILITY(GICR_PENDBASER, INNER, nCnB)
 #define GICR_PENDBASER_nC 	GIC_BASER_CACHEABILITY(GICR_PENDBASER, INNER, nC)
 #define GICR_PENDBASER_RaWt	GIC_BASER_CACHEABILITY(GICR_PENDBASER, INNER, RaWt)
-#define GICR_PENDBASER_RaWb	GIC_BASER_CACHEABILITY(GICR_PENDBASER, INNER, RaWt)
+#define GICR_PENDBASER_RaWb	GIC_BASER_CACHEABILITY(GICR_PENDBASER, INNER, RaWb)
 #define GICR_PENDBASER_WaWt	GIC_BASER_CACHEABILITY(GICR_PENDBASER, INNER, WaWt)
 #define GICR_PENDBASER_WaWb	GIC_BASER_CACHEABILITY(GICR_PENDBASER, INNER, WaWb)
 #define GICR_PENDBASER_RaWaWt	GIC_BASER_CACHEABILITY(GICR_PENDBASER, INNER, RaWaWt)
@@ -251,7 +251,7 @@
 #define GICR_VPROPBASER_nCnB	GIC_BASER_CACHEABILITY(GICR_VPROPBASER, INNER, nCnB)
 #define GICR_VPROPBASER_nC 	GIC_BASER_CACHEABILITY(GICR_VPROPBASER, INNER, nC)
 #define GICR_VPROPBASER_RaWt	GIC_BASER_CACHEABILITY(GICR_VPROPBASER, INNER, RaWt)
-#define GICR_VPROPBASER_RaWb	GIC_BASER_CACHEABILITY(GICR_VPROPBASER, INNER, RaWt)
+#define GICR_VPROPBASER_RaWb	GIC_BASER_CACHEABILITY(GICR_VPROPBASER, INNER, RaWb)
 #define GICR_VPROPBASER_WaWt	GIC_BASER_CACHEABILITY(GICR_VPROPBASER, INNER, WaWt)
 #define GICR_VPROPBASER_WaWb	GIC_BASER_CACHEABILITY(GICR_VPROPBASER, INNER, WaWb)
 #define GICR_VPROPBASER_RaWaWt	GIC_BASER_CACHEABILITY(GICR_VPROPBASER, INNER, RaWaWt)
@@ -277,7 +277,7 @@
 #define GICR_VPENDBASER_nCnB	GIC_BASER_CACHEABILITY(GICR_VPENDBASER, INNER, nCnB)
 #define GICR_VPENDBASER_nC 	GIC_BASER_CACHEABILITY(GICR_VPENDBASER, INNER, nC)
 #define GICR_VPENDBASER_RaWt	GIC_BASER_CACHEABILITY(GICR_VPENDBASER, INNER, RaWt)
-#define GICR_VPENDBASER_RaWb	GIC_BASER_CACHEABILITY(GICR_VPENDBASER, INNER, RaWt)
+#define GICR_VPENDBASER_RaWb	GIC_BASER_CACHEABILITY(GICR_VPENDBASER, INNER, RaWb)
 #define GICR_VPENDBASER_WaWt	GIC_BASER_CACHEABILITY(GICR_VPENDBASER, INNER, WaWt)
 #define GICR_VPENDBASER_WaWb	GIC_BASER_CACHEABILITY(GICR_VPENDBASER, INNER, WaWb)
 #define GICR_VPENDBASER_RaWaWt	GIC_BASER_CACHEABILITY(GICR_VPENDBASER, INNER, RaWaWt)
@@ -351,7 +351,7 @@
 #define GITS_CBASER_nCnB	GIC_BASER_CACHEABILITY(GITS_CBASER, INNER, nCnB)
 #define GITS_CBASER_nC		GIC_BASER_CACHEABILITY(GITS_CBASER, INNER, nC)
 #define GITS_CBASER_RaWt	GIC_BASER_CACHEABILITY(GITS_CBASER, INNER, RaWt)
-#define GITS_CBASER_RaWb	GIC_BASER_CACHEABILITY(GITS_CBASER, INNER, RaWt)
+#define GITS_CBASER_RaWb	GIC_BASER_CACHEABILITY(GITS_CBASER, INNER, RaWb)
 #define GITS_CBASER_WaWt	GIC_BASER_CACHEABILITY(GITS_CBASER, INNER, WaWt)
 #define GITS_CBASER_WaWb	GIC_BASER_CACHEABILITY(GITS_CBASER, INNER, WaWb)
 #define GITS_CBASER_RaWaWt	GIC_BASER_CACHEABILITY(GITS_CBASER, INNER, RaWaWt)
@@ -375,7 +375,7 @@
 #define GITS_BASER_nCnB		GIC_BASER_CACHEABILITY(GITS_BASER, INNER, nCnB)
 #define GITS_BASER_nC		GIC_BASER_CACHEABILITY(GITS_BASER, INNER, nC)
 #define GITS_BASER_RaWt		GIC_BASER_CACHEABILITY(GITS_BASER, INNER, RaWt)
-#define GITS_BASER_RaWb		GIC_BASER_CACHEABILITY(GITS_BASER, INNER, RaWt)
+#define GITS_BASER_RaWb		GIC_BASER_CACHEABILITY(GITS_BASER, INNER, RaWb)
 #define GITS_BASER_WaWt		GIC_BASER_CACHEABILITY(GITS_BASER, INNER, WaWt)
 #define GITS_BASER_WaWb		GIC_BASER_CACHEABILITY(GITS_BASER, INNER, WaWb)
 #define GITS_BASER_RaWaWt	GIC_BASER_CACHEABILITY(GITS_BASER, INNER, RaWaWt)
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 331/639] scsi: qla2xxx: Fix a format specifier
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (329 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.19 330/639] irqchip/gic-v3-its: fix some definitions of inner cacheability attributes Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.19 332/639] scsi: qla2xxx: Fix error handling in qlt_alloc_qfull_cmd() Greg Kroah-Hartman
                   ` (311 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Himanshu Madhani, Giridhar Malavali,
	Bart Van Assche, Martin K. Petersen, Sasha Levin

From: Bart Van Assche <bvanassche@acm.org>

[ Upstream commit 19ce192cd718e02f880197c0983404ca48236807 ]

Since mcmd->sess->port_name is eight bytes long, use %8phC to format that
port name instead of %phC.

Cc: Himanshu Madhani <hmadhani@marvell.com>
Cc: Giridhar Malavali <gmalavali@marvell.com>
Fixes: 726b85487067 ("qla2xxx: Add framework for async fabric discovery") # v4.11.
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Acked-by: Himanshu Madhani <hmadhani@marvell.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/qla2xxx/qla_target.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
index e9545411ec5a9..bbbe1996620bf 100644
--- a/drivers/scsi/qla2xxx/qla_target.c
+++ b/drivers/scsi/qla2xxx/qla_target.c
@@ -2290,7 +2290,7 @@ void qlt_xmit_tm_rsp(struct qla_tgt_mgmt_cmd *mcmd)
 		    mcmd->orig_iocb.imm_ntfy.u.isp24.status_subcode ==
 		    ELS_TPRLO) {
 			ql_dbg(ql_dbg_disc, vha, 0x2106,
-			    "TM response logo %phC status %#x state %#x",
+			    "TM response logo %8phC status %#x state %#x",
 			    mcmd->sess->port_name, mcmd->fc_tm_rsp,
 			    mcmd->flags);
 			qlt_schedule_sess_for_deletion(mcmd->sess);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 332/639] scsi: qla2xxx: Fix error handling in qlt_alloc_qfull_cmd()
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (330 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.19 331/639] scsi: qla2xxx: Fix a format specifier Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.19 333/639] scsi: qla2xxx: Avoid that qlt_send_resp_ctio() corrupts memory Greg Kroah-Hartman
                   ` (310 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Himanshu Madhani, Giridhar Malavali,
	Bart Van Assche, Martin K. Petersen, Sasha Levin

From: Bart Van Assche <bvanassche@acm.org>

[ Upstream commit c04466c17142d5eb566984372b9a5003d1900fe3 ]

The test "if (!cmd)" is not useful because it is guaranteed that cmd !=
NULL.  Instead of testing the cmd pointer, rely on the tag to decide
whether or not command allocation failed.

Cc: Himanshu Madhani <hmadhani@marvell.com>
Cc: Giridhar Malavali <gmalavali@marvell.com>
Fixes: 33e799775593 ("qla2xxx: Add support for QFull throttling and Term Exchange retry") # v3.18.
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Acked-by: Himanshu Madhani <hmadhani@marvell.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/qla2xxx/qla_target.c | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
index bbbe1996620bf..c925ca7875374 100644
--- a/drivers/scsi/qla2xxx/qla_target.c
+++ b/drivers/scsi/qla2xxx/qla_target.c
@@ -5334,11 +5334,7 @@ qlt_alloc_qfull_cmd(struct scsi_qla_host *vha,
 	se_sess = sess->se_sess;
 
 	tag = sbitmap_queue_get(&se_sess->sess_tag_pool, &cpu);
-	if (tag < 0)
-		return;
-
-	cmd = &((struct qla_tgt_cmd *)se_sess->sess_cmd_map)[tag];
-	if (!cmd) {
+	if (tag < 0) {
 		ql_dbg(ql_dbg_io, vha, 0x3009,
 			"qla_target(%d): %s: Allocation of cmd failed\n",
 			vha->vp_idx, __func__);
@@ -5353,6 +5349,7 @@ qlt_alloc_qfull_cmd(struct scsi_qla_host *vha,
 		return;
 	}
 
+	cmd = &((struct qla_tgt_cmd *)se_sess->sess_cmd_map)[tag];
 	memset(cmd, 0, sizeof(struct qla_tgt_cmd));
 
 	qlt_incr_num_pend_cmds(vha);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 333/639] scsi: qla2xxx: Avoid that qlt_send_resp_ctio() corrupts memory
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (331 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.19 332/639] scsi: qla2xxx: Fix error handling in qlt_alloc_qfull_cmd() Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.19 334/639] KVM: PPC: Book3S HV: Fix lockdep warning when entering the guest Greg Kroah-Hartman
                   ` (309 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Himanshu Madhani, Giridhar Malavali,
	Bart Van Assche, Martin K. Petersen, Sasha Levin

From: Bart Van Assche <bvanassche@acm.org>

[ Upstream commit a861b49273578e255426a499842cf7f465456351 ]

The "(&ctio->u.status1.sense_data)[i]" where i >= 0 expressions in
qlt_send_resp_ctio() are probably typos and should have been
"(&ctio->u.status1.sense_data[4 * i])" instead. Instead of only fixing
these typos, modify the code for storing sense data such that it becomes
easy to read. This patch fixes a Coverity complaint about accessing an
array outside its bounds.

Cc: Himanshu Madhani <hmadhani@marvell.com>
Cc: Giridhar Malavali <gmalavali@marvell.com>
Fixes: be25152c0d9e ("qla2xxx: Improve T10-DIF/PI handling in driver.") # v4.11.
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Acked-by: Himanshu Madhani <hmadhani@marvell.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/qla2xxx/qla_target.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
index c925ca7875374..95206e227730c 100644
--- a/drivers/scsi/qla2xxx/qla_target.c
+++ b/drivers/scsi/qla2xxx/qla_target.c
@@ -2233,14 +2233,14 @@ void qlt_send_resp_ctio(struct qla_qpair *qpair, struct qla_tgt_cmd *cmd,
 		ctio->u.status1.scsi_status |=
 		    cpu_to_le16(SS_RESIDUAL_UNDER);
 
-	/* Response code and sense key */
-	put_unaligned_le32(((0x70 << 24) | (sense_key << 8)),
-	    (&ctio->u.status1.sense_data)[0]);
+	/* Fixed format sense data. */
+	ctio->u.status1.sense_data[0] = 0x70;
+	ctio->u.status1.sense_data[2] = sense_key;
 	/* Additional sense length */
-	put_unaligned_le32(0x0a, (&ctio->u.status1.sense_data)[1]);
+	ctio->u.status1.sense_data[7] = 0xa;
 	/* ASC and ASCQ */
-	put_unaligned_le32(((asc << 24) | (ascq << 16)),
-	    (&ctio->u.status1.sense_data)[3]);
+	ctio->u.status1.sense_data[12] = asc;
+	ctio->u.status1.sense_data[13] = ascq;
 
 	/* Memory Barrier */
 	wmb();
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 334/639] KVM: PPC: Book3S HV: Fix lockdep warning when entering the guest
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (332 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.19 333/639] scsi: qla2xxx: Avoid that qlt_send_resp_ctio() corrupts memory Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.19 335/639] netfilter: nft_flow_offload: add entry to flowtable after confirmation Greg Kroah-Hartman
                   ` (308 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Alexey Kardashevskiy, Paul Mackerras,
	Sasha Levin

From: Alexey Kardashevskiy <aik@ozlabs.ru>

[ Upstream commit 3309bec85e60d60d6394802cb8e183a4f4a72def ]

The trace_hardirqs_on() sets current->hardirqs_enabled and from here
the lockdep assumes interrupts are enabled although they are remain
disabled until the context switches to the guest. Consequent
srcu_read_lock() checks the flags in rcu_lock_acquire(), observes
disabled interrupts and prints a warning (see below).

This moves trace_hardirqs_on/off closer to __kvmppc_vcore_entry to
prevent lockdep from being confused.

DEBUG_LOCKS_WARN_ON(current->hardirqs_enabled)
WARNING: CPU: 16 PID: 8038 at kernel/locking/lockdep.c:4128 check_flags.part.25+0x224/0x280
[...]
NIP [c000000000185b84] check_flags.part.25+0x224/0x280
LR [c000000000185b80] check_flags.part.25+0x220/0x280
Call Trace:
[c000003fec253710] [c000000000185b80] check_flags.part.25+0x220/0x280 (unreliable)
[c000003fec253780] [c000000000187ea4] lock_acquire+0x94/0x260
[c000003fec253840] [c00800001a1e9768] kvmppc_run_core+0xa60/0x1ab0 [kvm_hv]
[c000003fec253a10] [c00800001a1ed944] kvmppc_vcpu_run_hv+0x73c/0xec0 [kvm_hv]
[c000003fec253ae0] [c00800001a1095dc] kvmppc_vcpu_run+0x34/0x48 [kvm]
[c000003fec253b00] [c00800001a1056bc] kvm_arch_vcpu_ioctl_run+0x2f4/0x400 [kvm]
[c000003fec253b90] [c00800001a0f3618] kvm_vcpu_ioctl+0x460/0x850 [kvm]
[c000003fec253d00] [c00000000041c4f4] do_vfs_ioctl+0xe4/0x930
[c000003fec253db0] [c00000000041ce04] ksys_ioctl+0xc4/0x110
[c000003fec253e00] [c00000000041ce78] sys_ioctl+0x28/0x80
[c000003fec253e20] [c00000000000b5a4] system_call+0x5c/0x70
Instruction dump:
419e0034 3d220004 39291730 81290000 2f890000 409e0020 3c82ffc6 3c62ffc5
3884be70 386329c0 4bf6ea71 60000000 <0fe00000> 3c62ffc6 3863be90 4801273d
irq event stamp: 1025
hardirqs last  enabled at (1025): [<c00800001a1e9728>] kvmppc_run_core+0xa20/0x1ab0 [kvm_hv]
hardirqs last disabled at (1024): [<c00800001a1e9358>] kvmppc_run_core+0x650/0x1ab0 [kvm_hv]
softirqs last  enabled at (0): [<c0000000000f1210>] copy_process.isra.4.part.5+0x5f0/0x1d00
softirqs last disabled at (0): [<0000000000000000>]           (null)
---[ end trace 31180adcc848993e ]---
possible reason: unannotated irqs-off.
irq event stamp: 1025
hardirqs last  enabled at (1025): [<c00800001a1e9728>] kvmppc_run_core+0xa20/0x1ab0 [kvm_hv]
hardirqs last disabled at (1024): [<c00800001a1e9358>] kvmppc_run_core+0x650/0x1ab0 [kvm_hv]
softirqs last  enabled at (0): [<c0000000000f1210>] copy_process.isra.4.part.5+0x5f0/0x1d00
softirqs last disabled at (0): [<0000000000000000>]           (null)

Fixes: 8b24e69fc47e ("KVM: PPC: Book3S HV: Close race with testing for signals on guest entry", 2017-06-26)
Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
Signed-off-by: Paul Mackerras <paulus@ozlabs.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/kvm/book3s_hv.c | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c
index 3ae3e8d141e3e..dbfe32327212e 100644
--- a/arch/powerpc/kvm/book3s_hv.c
+++ b/arch/powerpc/kvm/book3s_hv.c
@@ -2993,25 +2993,26 @@ static noinline void kvmppc_run_core(struct kvmppc_vcore *vc)
 		}
 	}
 
-	/*
-	 * Interrupts will be enabled once we get into the guest,
-	 * so tell lockdep that we're about to enable interrupts.
-	 */
-	trace_hardirqs_on();
-
 	guest_enter_irqoff();
 
 	srcu_idx = srcu_read_lock(&vc->kvm->srcu);
 
 	this_cpu_disable_ftrace();
 
+	/*
+	 * Interrupts will be enabled once we get into the guest,
+	 * so tell lockdep that we're about to enable interrupts.
+	 */
+	trace_hardirqs_on();
+
 	trap = __kvmppc_vcore_entry();
 
+	trace_hardirqs_off();
+
 	this_cpu_enable_ftrace();
 
 	srcu_read_unlock(&vc->kvm->srcu, srcu_idx);
 
-	trace_hardirqs_off();
 	set_irq_happened(trap);
 
 	spin_lock(&vc->lock);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 335/639] netfilter: nft_flow_offload: add entry to flowtable after confirmation
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (333 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.19 334/639] KVM: PPC: Book3S HV: Fix lockdep warning when entering the guest Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.19 336/639] PCI: iproc: Enable iProc config read for PAXBv2 Greg Kroah-Hartman
                   ` (307 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Pablo Neira Ayuso, Sasha Levin

From: Pablo Neira Ayuso <pablo@netfilter.org>

[ Upstream commit 270a8a297f42ecff82060aaa53118361f09c1f7d ]

This is fixing flow offload for UDP traffic where packets only follow
one single direction.

The flow_offload_fixup_tcp() mechanism works fine in case that the
offloaded entry remains in SYN_RECV state, given sequence tracking is
reset and that conntrack handles syn+ack packets as a retransmission, ie.

	sES + synack => sIG

for reply traffic.

Fixes: a3c90f7a2323 ("netfilter: nf_tables: flow offload expression")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/netfilter/nft_flow_offload.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/net/netfilter/nft_flow_offload.c b/net/netfilter/nft_flow_offload.c
index 1ef8cb789c41a..166edea0e4527 100644
--- a/net/netfilter/nft_flow_offload.c
+++ b/net/netfilter/nft_flow_offload.c
@@ -103,8 +103,7 @@ static void nft_flow_offload_eval(const struct nft_expr *expr,
 	    ct->status & IPS_SEQ_ADJUST)
 		goto out;
 
-	if (ctinfo == IP_CT_NEW ||
-	    ctinfo == IP_CT_RELATED)
+	if (!nf_ct_is_confirmed(ct))
 		goto out;
 
 	if (test_and_set_bit(IPS_OFFLOAD_BIT, &ct->status))
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 336/639] PCI: iproc: Enable iProc config read for PAXBv2
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (334 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.19 335/639] netfilter: nft_flow_offload: add entry to flowtable after confirmation Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.19 337/639] ARM: dts: logicpd-som-lv: Fix MMC1 card detect Greg Kroah-Hartman
                   ` (306 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Srinath Mannam, Lorenzo Pieralisi,
	Ray Jui, Sasha Levin

From: Srinath Mannam <srinath.mannam@broadcom.com>

[ Upstream commit 8cff995405eb0b563e7a0d2c49838611ea3f2692 ]

iProc config read flag has to be enabled for PAXBv2 instead of PAXB.

Fixes: f78e60a29d4f ("PCI: iproc: Reject unconfigured physical functions from PAXC")
Signed-off-by: Srinath Mannam <srinath.mannam@broadcom.com>
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Reviewed-by: Ray Jui <ray.jui@broadcom.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/controller/pcie-iproc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/pci/controller/pcie-iproc.c b/drivers/pci/controller/pcie-iproc.c
index c20fd6bd68fd8..9d5cbc75d5ae0 100644
--- a/drivers/pci/controller/pcie-iproc.c
+++ b/drivers/pci/controller/pcie-iproc.c
@@ -1347,7 +1347,6 @@ static int iproc_pcie_rev_init(struct iproc_pcie *pcie)
 		break;
 	case IPROC_PCIE_PAXB:
 		regs = iproc_pcie_reg_paxb;
-		pcie->iproc_cfg_read = true;
 		pcie->has_apb_err_disable = true;
 		if (pcie->need_ob_cfg) {
 			pcie->ob_map = paxb_ob_map;
@@ -1356,6 +1355,7 @@ static int iproc_pcie_rev_init(struct iproc_pcie *pcie)
 		break;
 	case IPROC_PCIE_PAXB_V2:
 		regs = iproc_pcie_reg_paxb_v2;
+		pcie->iproc_cfg_read = true;
 		pcie->has_apb_err_disable = true;
 		if (pcie->need_ob_cfg) {
 			pcie->ob_map = paxb_v2_ob_map;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 337/639] ARM: dts: logicpd-som-lv: Fix MMC1 card detect
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (335 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.19 336/639] PCI: iproc: Enable iProc config read for PAXBv2 Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.19 338/639] packet: in recvmsg msg_name return at least sizeof sockaddr_ll Greg Kroah-Hartman
                   ` (305 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Adam Ford, Tony Lindgren, Sasha Levin

From: Adam Ford <aford173@gmail.com>

[ Upstream commit 6a38df676a0a06bfc7ff8607ac62ccd6d95969ad ]

The card detect pin was incorrectly using IRQ_TYPE_LEVEL_LOW
instead of GPIO_ACTIVE_LOW when reading the state of the CD pin.

This was previosly fixed on Torpedo, but missed on the SOM-LV

Fixes: 5cb8b0fa55a9 ("ARM: dts: Move most of logicpd-som-lv-37xx-devkit.dts to logicpd-som-lv-baseboard.dtsi")
Signed-off-by: Adam Ford <aford173@gmail.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/logicpd-som-lv-baseboard.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/logicpd-som-lv-baseboard.dtsi b/arch/arm/boot/dts/logicpd-som-lv-baseboard.dtsi
index 4990ed90dcea4..3e39b9a1f35d0 100644
--- a/arch/arm/boot/dts/logicpd-som-lv-baseboard.dtsi
+++ b/arch/arm/boot/dts/logicpd-som-lv-baseboard.dtsi
@@ -153,7 +153,7 @@
 	pinctrl-names = "default";
 	pinctrl-0 = <&mmc1_pins>;
 	wp-gpios = <&gpio4 30 GPIO_ACTIVE_HIGH>;		/* gpio_126 */
-	cd-gpios = <&gpio4 14 IRQ_TYPE_LEVEL_LOW>;		/* gpio_110 */
+	cd-gpios = <&gpio4 14 GPIO_ACTIVE_LOW>;			/* gpio_110 */
 	vmmc-supply = <&vmmc1>;
 	bus-width = <4>;
 	cap-power-off-card;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 338/639] packet: in recvmsg msg_name return at least sizeof sockaddr_ll
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (336 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.19 337/639] ARM: dts: logicpd-som-lv: Fix MMC1 card detect Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.19 339/639] ASoC: fix valid stream condition Greg Kroah-Hartman
                   ` (304 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, David Laight, Willem de Bruijn,
	David S. Miller, Sasha Levin

From: Willem de Bruijn <willemb@google.com>

[ Upstream commit b2cf86e1563e33a14a1c69b3e508d15dc12f804c ]

Packet send checks that msg_name is at least sizeof sockaddr_ll.
Packet recv must return at least this length, so that its output
can be passed unmodified to packet send.

This ceased to be true since adding support for lladdr longer than
sll_addr. Since, the return value uses true address length.

Always return at least sizeof sockaddr_ll, even if address length
is shorter. Zero the padding bytes.

Change v1->v2: do not overwrite zeroed padding again. use copy_len.

Fixes: 0fb375fb9b93 ("[AF_PACKET]: Allow for > 8 byte hardware addresses.")
Suggested-by: David Laight <David.Laight@aculab.com>
Signed-off-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/packet/af_packet.c | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index ac65e66d1d727..60ba18a4bb0ff 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -3371,20 +3371,29 @@ static int packet_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
 	sock_recv_ts_and_drops(msg, sk, skb);
 
 	if (msg->msg_name) {
+		int copy_len;
+
 		/* If the address length field is there to be filled
 		 * in, we fill it in now.
 		 */
 		if (sock->type == SOCK_PACKET) {
 			__sockaddr_check_size(sizeof(struct sockaddr_pkt));
 			msg->msg_namelen = sizeof(struct sockaddr_pkt);
+			copy_len = msg->msg_namelen;
 		} else {
 			struct sockaddr_ll *sll = &PACKET_SKB_CB(skb)->sa.ll;
 
 			msg->msg_namelen = sll->sll_halen +
 				offsetof(struct sockaddr_ll, sll_addr);
+			copy_len = msg->msg_namelen;
+			if (msg->msg_namelen < sizeof(struct sockaddr_ll)) {
+				memset(msg->msg_name +
+				       offsetof(struct sockaddr_ll, sll_addr),
+				       0, sizeof(sll->sll_addr));
+				msg->msg_namelen = sizeof(struct sockaddr_ll);
+			}
 		}
-		memcpy(msg->msg_name, &PACKET_SKB_CB(skb)->sa,
-		       msg->msg_namelen);
+		memcpy(msg->msg_name, &PACKET_SKB_CB(skb)->sa, copy_len);
 	}
 
 	if (pkt_sk(sk)->auxdata) {
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 339/639] ASoC: fix valid stream condition
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (337 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.19 338/639] packet: in recvmsg msg_name return at least sizeof sockaddr_ll Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.19 340/639] usb: gadget: fsl: fix link error against usb-gadget module Greg Kroah-Hartman
                   ` (303 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jerome Brunet, Mark Brown, Sasha Levin

From: Jerome Brunet <jbrunet@baylibre.com>

[ Upstream commit 6a7c59c6d9f3b280e81d7a04bbe4e55e90152dce ]

A stream may specify a rate range using 'rate_min' and 'rate_max', so a
stream may be valid and not specify any rates. However, as stream cannot
be valid and not have any channel. Let's use this condition instead to
determine if a stream is valid or not.

Fixes: cde79035c6cf ("ASoC: Handle multiple codecs with split playback / capture")
Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/soc-pcm.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c
index 551bfc581fc12..53fefa7c982f8 100644
--- a/sound/soc/soc-pcm.c
+++ b/sound/soc/soc-pcm.c
@@ -42,8 +42,8 @@ static bool snd_soc_dai_stream_valid(struct snd_soc_dai *dai, int stream)
 	else
 		codec_stream = &dai->driver->capture;
 
-	/* If the codec specifies any rate at all, it supports the stream. */
-	return codec_stream->rates;
+	/* If the codec specifies any channels at all, it supports the stream */
+	return codec_stream->channels_min;
 }
 
 /**
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 340/639] usb: gadget: fsl: fix link error against usb-gadget module
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (338 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.19 339/639] ASoC: fix valid stream condition Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.19 341/639] dwc2: gadget: Fix completed transfer size calculation in DDMA Greg Kroah-Hartman
                   ` (302 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Arnd Bergmann, Felipe Balbi, Sasha Levin

From: Arnd Bergmann <arnd@arndb.de>

[ Upstream commit 2100e3ca3676e894fa48b8f6f01d01733387fe81 ]

The dependency to ensure this driver links correctly fails since
it can not be a loadable module:

drivers/usb/phy/phy-fsl-usb.o: In function `fsl_otg_set_peripheral':
phy-fsl-usb.c:(.text+0x2224): undefined reference to `usb_gadget_vbus_disconnect'

Make the option 'tristate' so it can work correctly.

Fixes: 5a8d651a2bde ("usb: gadget: move gadget API functions to udc-core")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/phy/Kconfig | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/phy/Kconfig b/drivers/usb/phy/Kconfig
index 91ea3083e7ad9..affb5393c4c6d 100644
--- a/drivers/usb/phy/Kconfig
+++ b/drivers/usb/phy/Kconfig
@@ -20,7 +20,7 @@ config AB8500_USB
 	  in host mode, low speed.
 
 config FSL_USB2_OTG
-	bool "Freescale USB OTG Transceiver Driver"
+	tristate "Freescale USB OTG Transceiver Driver"
 	depends on USB_EHCI_FSL && USB_FSL_USB2 && USB_OTG_FSM=y && PM
 	depends on USB_GADGET || !USB_GADGET # if USB_GADGET=m, this can't be 'y'
 	select USB_PHY
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 341/639] dwc2: gadget: Fix completed transfer size calculation in DDMA
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (339 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.19 340/639] usb: gadget: fsl: fix link error against usb-gadget module Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.19 342/639] IB/mlx5: Add missing XRC options to QP optional params mask Greg Kroah-Hartman
                   ` (301 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Minas Harutyunyan, Felipe Balbi, Sasha Levin

From: Minas Harutyunyan <minas.harutyunyan@synopsys.com>

[ Upstream commit 5acb4b970184d189d901192d075997c933b82260 ]

Fix calculation of transfer size on completion in function
dwc2_gadget_get_xfersize_ddma().

Added increment of descriptor pointer to move to next descriptor in
the loop.

Fixes: aa3e8bc81311 ("usb: dwc2: gadget: DDMA transfer start and complete")

Signed-off-by: Minas Harutyunyan <hminas@synopsys.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/dwc2/gadget.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
index 3f68edde0f03a..f64d1cd08fb67 100644
--- a/drivers/usb/dwc2/gadget.c
+++ b/drivers/usb/dwc2/gadget.c
@@ -2230,6 +2230,7 @@ static unsigned int dwc2_gadget_get_xfersize_ddma(struct dwc2_hsotg_ep *hs_ep)
 		if (status & DEV_DMA_STS_MASK)
 			dev_err(hsotg->dev, "descriptor %d closed with %x\n",
 				i, status & DEV_DMA_STS_MASK);
+		desc++;
 	}
 
 	return bytes_rem;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 342/639] IB/mlx5: Add missing XRC options to QP optional params mask
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (340 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.19 341/639] dwc2: gadget: Fix completed transfer size calculation in DDMA Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.19 343/639] RDMA/rxe: Consider skb reserve space based on netdev of GID Greg Kroah-Hartman
                   ` (300 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jack Morgenstein, Leon Romanovsky,
	Jason Gunthorpe, Sasha Levin

From: Jack Morgenstein <jackm@dev.mellanox.co.il>

[ Upstream commit 8f4426aa19fcdb9326ac44154a117b1a3a5ae126 ]

The QP transition optional parameters for the various transition for XRC
QPs are identical to those for RC QPs.

Many of the XRC QP transition optional parameter bits are missing from the
QP optional mask table.  These omissions caused failures when doing XRC QP
state transitions.

For example, when trying to change the response timer of an XRC receive QP
via the RTS2RTS transition, the new timer value was ignored because
MLX5_QP_OPTPAR_RNR_TIMEOUT bit was missing from the optional params mask
for XRC qps for the RTS2RTS transition.

Fix this by adding the missing XRC optional parameters for all QP
transitions to the opt_mask table.

Fixes: e126ba97dba9 ("mlx5: Add driver for Mellanox Connect-IB adapters")
Fixes: a4774e9095de ("IB/mlx5: Fix opt param mask according to firmware spec")
Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il>
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/hw/mlx5/qp.c | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
index ef0f710587ad8..4c0f0ce02d2f7 100644
--- a/drivers/infiniband/hw/mlx5/qp.c
+++ b/drivers/infiniband/hw/mlx5/qp.c
@@ -2598,6 +2598,11 @@ static enum mlx5_qp_optpar opt_mask[MLX5_QP_NUM_STATE][MLX5_QP_NUM_STATE][MLX5_Q
 			[MLX5_QP_ST_UD] = MLX5_QP_OPTPAR_PKEY_INDEX	|
 					  MLX5_QP_OPTPAR_Q_KEY		|
 					  MLX5_QP_OPTPAR_PRI_PORT,
+			[MLX5_QP_ST_XRC] = MLX5_QP_OPTPAR_RRE		|
+					  MLX5_QP_OPTPAR_RAE		|
+					  MLX5_QP_OPTPAR_RWE		|
+					  MLX5_QP_OPTPAR_PKEY_INDEX	|
+					  MLX5_QP_OPTPAR_PRI_PORT,
 		},
 		[MLX5_QP_STATE_RTR] = {
 			[MLX5_QP_ST_RC] = MLX5_QP_OPTPAR_ALT_ADDR_PATH  |
@@ -2631,6 +2636,12 @@ static enum mlx5_qp_optpar opt_mask[MLX5_QP_NUM_STATE][MLX5_QP_NUM_STATE][MLX5_Q
 					  MLX5_QP_OPTPAR_RWE		|
 					  MLX5_QP_OPTPAR_PM_STATE,
 			[MLX5_QP_ST_UD] = MLX5_QP_OPTPAR_Q_KEY,
+			[MLX5_QP_ST_XRC] = MLX5_QP_OPTPAR_ALT_ADDR_PATH	|
+					  MLX5_QP_OPTPAR_RRE		|
+					  MLX5_QP_OPTPAR_RAE		|
+					  MLX5_QP_OPTPAR_RWE		|
+					  MLX5_QP_OPTPAR_PM_STATE	|
+					  MLX5_QP_OPTPAR_RNR_TIMEOUT,
 		},
 	},
 	[MLX5_QP_STATE_RTS] = {
@@ -2647,6 +2658,12 @@ static enum mlx5_qp_optpar opt_mask[MLX5_QP_NUM_STATE][MLX5_QP_NUM_STATE][MLX5_Q
 			[MLX5_QP_ST_UD] = MLX5_QP_OPTPAR_Q_KEY		|
 					  MLX5_QP_OPTPAR_SRQN		|
 					  MLX5_QP_OPTPAR_CQN_RCV,
+			[MLX5_QP_ST_XRC] = MLX5_QP_OPTPAR_RRE		|
+					  MLX5_QP_OPTPAR_RAE		|
+					  MLX5_QP_OPTPAR_RWE		|
+					  MLX5_QP_OPTPAR_RNR_TIMEOUT	|
+					  MLX5_QP_OPTPAR_PM_STATE	|
+					  MLX5_QP_OPTPAR_ALT_ADDR_PATH,
 		},
 	},
 	[MLX5_QP_STATE_SQER] = {
@@ -2658,6 +2675,10 @@ static enum mlx5_qp_optpar opt_mask[MLX5_QP_NUM_STATE][MLX5_QP_NUM_STATE][MLX5_Q
 					   MLX5_QP_OPTPAR_RWE		|
 					   MLX5_QP_OPTPAR_RAE		|
 					   MLX5_QP_OPTPAR_RRE,
+			[MLX5_QP_ST_XRC]  = MLX5_QP_OPTPAR_RNR_TIMEOUT	|
+					   MLX5_QP_OPTPAR_RWE		|
+					   MLX5_QP_OPTPAR_RAE		|
+					   MLX5_QP_OPTPAR_RRE,
 		},
 	},
 };
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 343/639] RDMA/rxe: Consider skb reserve space based on netdev of GID
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (341 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.19 342/639] IB/mlx5: Add missing XRC options to QP optional params mask Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.19 344/639] iommu/vt-d: Make kernel parameter igfx_off work with vIOMMU Greg Kroah-Hartman
                   ` (299 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Parav Pandit, Leon Romanovsky,
	Jason Gunthorpe, Sasha Levin

From: Parav Pandit <parav@mellanox.com>

[ Upstream commit 3bf3e2b881c1412d0329ce9376dfe1518489b8fc ]

Always consider the skb reserve space based on netdevice of the GID
attribute, regardless of vlan or non vlan netdevice.

Fixes: 43c9fc509fa5 ("rdma_rxe: make rxe work over 802.1q VLAN devices")
Signed-off-by: Parav Pandit <parav@mellanox.com>
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/sw/rxe/rxe_net.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/infiniband/sw/rxe/rxe_net.c b/drivers/infiniband/sw/rxe/rxe_net.c
index 8094cbaa54a9e..54add70c22b5c 100644
--- a/drivers/infiniband/sw/rxe/rxe_net.c
+++ b/drivers/infiniband/sw/rxe/rxe_net.c
@@ -533,8 +533,9 @@ struct sk_buff *rxe_init_packet(struct rxe_dev *rxe, struct rxe_av *av,
 	if (unlikely(!skb))
 		goto out;
 
-	skb_reserve(skb, hdr_len + LL_RESERVED_SPACE(rxe->ndev));
+	skb_reserve(skb, hdr_len + LL_RESERVED_SPACE(ndev));
 
+	/* FIXME: hold reference to this netdev until life of this skb. */
 	skb->dev	= ndev;
 	if (av->network_type == RDMA_NETWORK_IPV4)
 		skb->protocol = htons(ETH_P_IP);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 344/639] iommu/vt-d: Make kernel parameter igfx_off work with vIOMMU
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (342 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.19 343/639] RDMA/rxe: Consider skb reserve space based on netdev of GID Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.19 345/639] net: ena: fix swapped parameters when calling ena_com_indirect_table_fill_entry Greg Kroah-Hartman
                   ` (298 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ashok Raj, Jacob Pan, Kevin Tian,
	Lu Baolu, Zhenyu Wang, Joerg Roedel, Sasha Levin

From: Lu Baolu <baolu.lu@linux.intel.com>

[ Upstream commit 5daab58043ee2bca861068e2595564828f3bc663 ]

The kernel parameter igfx_off is used by users to disable
DMA remapping for the Intel integrated graphic device. It
was designed for bare metal cases where a dedicated IOMMU
is used for graphic. This doesn't apply to virtual IOMMU
case where an include-all IOMMU is used.  This makes the
kernel parameter work with virtual IOMMU as well.

Cc: Ashok Raj <ashok.raj@intel.com>
Cc: Jacob Pan <jacob.jun.pan@linux.intel.com>
Suggested-by: Kevin Tian <kevin.tian@intel.com>
Fixes: c0771df8d5297 ("intel-iommu: Export a flag indicating that the IOMMU is used for iGFX.")
Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
Tested-by: Zhenyu Wang <zhenyuw@linux.intel.com>
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iommu/intel-iommu.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
index b9af2419006f8..abbbc614c5225 100644
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -3387,9 +3387,12 @@ static int __init init_dmars(void)
 		iommu_identity_mapping |= IDENTMAP_ALL;
 
 #ifdef CONFIG_INTEL_IOMMU_BROKEN_GFX_WA
-	iommu_identity_mapping |= IDENTMAP_GFX;
+	dmar_map_gfx = 0;
 #endif
 
+	if (!dmar_map_gfx)
+		iommu_identity_mapping |= IDENTMAP_GFX;
+
 	check_tylersburg_isoch();
 
 	if (iommu_identity_mapping) {
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 345/639] net: ena: fix swapped parameters when calling ena_com_indirect_table_fill_entry
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (343 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.19 344/639] iommu/vt-d: Make kernel parameter igfx_off work with vIOMMU Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.19 346/639] net: ena: fix: Free napi resources when ena_up() fails Greg Kroah-Hartman
                   ` (297 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Saeed Bshara, Sameeh Jubran,
	David S. Miller, Sasha Levin

From: Sameeh Jubran <sameehj@amazon.com>

[ Upstream commit 3c6eeff295f01bdf1c6c3addcb0a04c0c6c029e9 ]

second parameter should be the index of the table rather than the value.

Fixes: 1738cd3ed342 ("net: ena: Add a driver for Amazon Elastic Network Adapters (ENA)")
Signed-off-by: Saeed Bshara <saeedb@amazon.com>
Signed-off-by: Sameeh Jubran <sameehj@amazon.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/amazon/ena/ena_ethtool.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/amazon/ena/ena_ethtool.c b/drivers/net/ethernet/amazon/ena/ena_ethtool.c
index 521607bc43937..eb9e07fa427ee 100644
--- a/drivers/net/ethernet/amazon/ena/ena_ethtool.c
+++ b/drivers/net/ethernet/amazon/ena/ena_ethtool.c
@@ -695,8 +695,8 @@ static int ena_set_rxfh(struct net_device *netdev, const u32 *indir,
 	if (indir) {
 		for (i = 0; i < ENA_RX_RSS_TABLE_SIZE; i++) {
 			rc = ena_com_indirect_table_fill_entry(ena_dev,
-							       ENA_IO_RXQ_IDX(indir[i]),
-							       i);
+							       i,
+							       ENA_IO_RXQ_IDX(indir[i]));
 			if (unlikely(rc)) {
 				netif_err(adapter, drv, netdev,
 					  "Cannot fill indirect table (index is too large)\n");
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 346/639] net: ena: fix: Free napi resources when ena_up() fails
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (344 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.19 345/639] net: ena: fix swapped parameters when calling ena_com_indirect_table_fill_entry Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.19 347/639] net: ena: fix incorrect test of supported hash function Greg Kroah-Hartman
                   ` (296 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Arthur Kiyanovski, Sameeh Jubran,
	David S. Miller, Sasha Levin

From: Sameeh Jubran <sameehj@amazon.com>

[ Upstream commit b287cdbd1cedfc9606682c6e02b58d00ff3a33ae ]

ena_up() calls ena_init_napi() but does not call ena_del_napi() in
case of failure. This causes a segmentation fault upon rmmod when
netif_napi_del() is called. Fix this bug by calling ena_del_napi()
before returning error from ena_up().

Fixes: 1738cd3ed342 ("net: ena: Add a driver for Amazon Elastic Network Adapters (ENA)")
Signed-off-by: Arthur Kiyanovski <akiyano@amazon.com>
Signed-off-by: Sameeh Jubran <sameehj@amazon.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/amazon/ena/ena_netdev.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.c b/drivers/net/ethernet/amazon/ena/ena_netdev.c
index e26c195fec83b..9afb19ebba580 100644
--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c
+++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c
@@ -1800,6 +1800,7 @@ err_setup_rx:
 err_setup_tx:
 	ena_free_io_irq(adapter);
 err_req_irq:
+	ena_del_napi(adapter);
 
 	return rc;
 }
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 347/639] net: ena: fix incorrect test of supported hash function
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (345 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.19 346/639] net: ena: fix: Free napi resources when ena_up() fails Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.19 348/639] net: ena: fix ena_com_fill_hash_function() implementation Greg Kroah-Hartman
                   ` (295 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Arthur Kiyanovski, Sameeh Jubran,
	David S. Miller, Sasha Levin

From: Sameeh Jubran <sameehj@amazon.com>

[ Upstream commit d3cfe7ddbc3dfbb9b201615b7fef8fd66d1b5fe8 ]

ena_com_set_hash_function() tests if a hash function is supported
by the device before setting it.
The test returns the opposite result than needed.
Reverse the condition to return the correct value.
Also use the BIT macro instead of inline shift.

Fixes: 1738cd3ed342 ("net: ena: Add a driver for Amazon Elastic Network Adapters (ENA)")
Signed-off-by: Arthur Kiyanovski <akiyano@amazon.com>
Signed-off-by: Sameeh Jubran <sameehj@amazon.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/amazon/ena/ena_com.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/amazon/ena/ena_com.c b/drivers/net/ethernet/amazon/ena/ena_com.c
index 7635c38e77dd0..005882c402625 100644
--- a/drivers/net/ethernet/amazon/ena/ena_com.c
+++ b/drivers/net/ethernet/amazon/ena/ena_com.c
@@ -2008,7 +2008,7 @@ int ena_com_set_hash_function(struct ena_com_dev *ena_dev)
 	if (unlikely(ret))
 		return ret;
 
-	if (get_resp.u.flow_hash_func.supported_func & (1 << rss->hash_func)) {
+	if (!(get_resp.u.flow_hash_func.supported_func & BIT(rss->hash_func))) {
 		pr_err("Func hash %d isn't supported by device, abort\n",
 		       rss->hash_func);
 		return -EOPNOTSUPP;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 348/639] net: ena: fix ena_com_fill_hash_function() implementation
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (346 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.19 347/639] net: ena: fix incorrect test of supported hash function Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.19 349/639] dmaengine: tegra210-adma: restore channel status Greg Kroah-Hartman
                   ` (294 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Netanel Belgazal, Sameeh Jubran,
	David S. Miller, Sasha Levin

From: Sameeh Jubran <sameehj@amazon.com>

[ Upstream commit 11bd7a00c0d8ffe33d1e926f8e789b4aea787186 ]

ena_com_fill_hash_function() didn't configure the rss->hash_func.

Fixes: 1738cd3ed342 ("net: ena: Add a driver for Amazon Elastic Network Adapters (ENA)")
Signed-off-by: Netanel Belgazal <netanel@amazon.com>
Signed-off-by: Sameeh Jubran <sameehj@amazon.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/amazon/ena/ena_com.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/ethernet/amazon/ena/ena_com.c b/drivers/net/ethernet/amazon/ena/ena_com.c
index 005882c402625..92261c946e2a3 100644
--- a/drivers/net/ethernet/amazon/ena/ena_com.c
+++ b/drivers/net/ethernet/amazon/ena/ena_com.c
@@ -2093,6 +2093,7 @@ int ena_com_fill_hash_function(struct ena_com_dev *ena_dev,
 		return -EINVAL;
 	}
 
+	rss->hash_func = func;
 	rc = ena_com_set_hash_function(ena_dev);
 
 	/* Restore the old function */
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 349/639] dmaengine: tegra210-adma: restore channel status
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (347 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.19 348/639] net: ena: fix ena_com_fill_hash_function() implementation Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.19 350/639] watchdog: rtd119x_wdt: Fix remove function Greg Kroah-Hartman
                   ` (293 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sameer Pujar, Jon Hunter, Vinod Koul,
	Sasha Levin

From: Sameer Pujar <spujar@nvidia.com>

[ Upstream commit f33e7bb3eb922618612a90f0a828c790e8880773 ]

Status of ADMA channel registers is not saved and restored during system
suspend. During active playback if system enters suspend, this results in
wrong state of channel registers during system resume and playback fails
to resume properly. Fix this by saving following channel registers in
runtime suspend and restore during runtime resume.
 * ADMA_CH_LOWER_SRC_ADDR
 * ADMA_CH_LOWER_TRG_ADDR
 * ADMA_CH_FIFO_CTRL
 * ADMA_CH_CONFIG
 * ADMA_CH_CTRL
 * ADMA_CH_CMD
 * ADMA_CH_TC
Runtime PM calls will be inovked during system resume path if a playback
or capture needs to be resumed. Hence above changes work fine for system
suspend case.

Fixes: f46b195799b5 ("dmaengine: tegra-adma: Add support for Tegra210 ADMA")
Signed-off-by: Sameer Pujar <spujar@nvidia.com>
Reviewed-by: Jon Hunter <jonathanh@nvidia.com>
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/dma/tegra210-adma.c | 46 ++++++++++++++++++++++++++++++++++++-
 1 file changed, 45 insertions(+), 1 deletion(-)

diff --git a/drivers/dma/tegra210-adma.c b/drivers/dma/tegra210-adma.c
index 09b6756366c30..ac2a6b800db3e 100644
--- a/drivers/dma/tegra210-adma.c
+++ b/drivers/dma/tegra210-adma.c
@@ -98,6 +98,7 @@ struct tegra_adma_chan_regs {
 	unsigned int src_addr;
 	unsigned int trg_addr;
 	unsigned int fifo_ctrl;
+	unsigned int cmd;
 	unsigned int tc;
 };
 
@@ -127,6 +128,7 @@ struct tegra_adma_chan {
 	enum dma_transfer_direction	sreq_dir;
 	unsigned int			sreq_index;
 	bool				sreq_reserved;
+	struct tegra_adma_chan_regs	ch_regs;
 
 	/* Transfer count and position info */
 	unsigned int			tx_buf_count;
@@ -635,8 +637,30 @@ static struct dma_chan *tegra_dma_of_xlate(struct of_phandle_args *dma_spec,
 static int tegra_adma_runtime_suspend(struct device *dev)
 {
 	struct tegra_adma *tdma = dev_get_drvdata(dev);
+	struct tegra_adma_chan_regs *ch_reg;
+	struct tegra_adma_chan *tdc;
+	int i;
 
 	tdma->global_cmd = tdma_read(tdma, ADMA_GLOBAL_CMD);
+	if (!tdma->global_cmd)
+		goto clk_disable;
+
+	for (i = 0; i < tdma->nr_channels; i++) {
+		tdc = &tdma->channels[i];
+		ch_reg = &tdc->ch_regs;
+		ch_reg->cmd = tdma_ch_read(tdc, ADMA_CH_CMD);
+		/* skip if channel is not active */
+		if (!ch_reg->cmd)
+			continue;
+		ch_reg->tc = tdma_ch_read(tdc, ADMA_CH_TC);
+		ch_reg->src_addr = tdma_ch_read(tdc, ADMA_CH_LOWER_SRC_ADDR);
+		ch_reg->trg_addr = tdma_ch_read(tdc, ADMA_CH_LOWER_TRG_ADDR);
+		ch_reg->ctrl = tdma_ch_read(tdc, ADMA_CH_CTRL);
+		ch_reg->fifo_ctrl = tdma_ch_read(tdc, ADMA_CH_FIFO_CTRL);
+		ch_reg->config = tdma_ch_read(tdc, ADMA_CH_CONFIG);
+	}
+
+clk_disable:
 	clk_disable_unprepare(tdma->ahub_clk);
 
 	return 0;
@@ -645,7 +669,9 @@ static int tegra_adma_runtime_suspend(struct device *dev)
 static int tegra_adma_runtime_resume(struct device *dev)
 {
 	struct tegra_adma *tdma = dev_get_drvdata(dev);
-	int ret;
+	struct tegra_adma_chan_regs *ch_reg;
+	struct tegra_adma_chan *tdc;
+	int ret, i;
 
 	ret = clk_prepare_enable(tdma->ahub_clk);
 	if (ret) {
@@ -654,6 +680,24 @@ static int tegra_adma_runtime_resume(struct device *dev)
 	}
 	tdma_write(tdma, ADMA_GLOBAL_CMD, tdma->global_cmd);
 
+	if (!tdma->global_cmd)
+		return 0;
+
+	for (i = 0; i < tdma->nr_channels; i++) {
+		tdc = &tdma->channels[i];
+		ch_reg = &tdc->ch_regs;
+		/* skip if channel was not active earlier */
+		if (!ch_reg->cmd)
+			continue;
+		tdma_ch_write(tdc, ADMA_CH_TC, ch_reg->tc);
+		tdma_ch_write(tdc, ADMA_CH_LOWER_SRC_ADDR, ch_reg->src_addr);
+		tdma_ch_write(tdc, ADMA_CH_LOWER_TRG_ADDR, ch_reg->trg_addr);
+		tdma_ch_write(tdc, ADMA_CH_CTRL, ch_reg->ctrl);
+		tdma_ch_write(tdc, ADMA_CH_FIFO_CTRL, ch_reg->fifo_ctrl);
+		tdma_ch_write(tdc, ADMA_CH_CONFIG, ch_reg->config);
+		tdma_ch_write(tdc, ADMA_CH_CMD, ch_reg->cmd);
+	}
+
 	return 0;
 }
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 350/639] watchdog: rtd119x_wdt: Fix remove function
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (348 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.19 349/639] dmaengine: tegra210-adma: restore channel status Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.19 351/639] mmc: core: fix possible use after free of host Greg Kroah-Hartman
                   ` (292 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Andreas Färber, Guenter Roeck,
	Wim Van Sebroeck, Sasha Levin

From: Guenter Roeck <linux@roeck-us.net>

[ Upstream commit 8dd29f19512cc75ee470d7bb8ec86af199de23a8 ]

The driver registers the watchdog with devm_watchdog_register_device() but
still calls watchdog_unregister_device() on remove. Since clocks have to
be stopped when removing the driver, after the watchdog device has been
unregistered, we can not drop the call to watchdog_unregister_device().
Use watchdog_register_device() to register the watchdog.

Fixes: 2bdf6acbfead7 ("watchdog: Add Realtek RTD1295")
Cc: Andreas Färber <afaerber@suse.de>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/watchdog/rtd119x_wdt.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/watchdog/rtd119x_wdt.c b/drivers/watchdog/rtd119x_wdt.c
index d001c17ddfdee..99caec6882d2f 100644
--- a/drivers/watchdog/rtd119x_wdt.c
+++ b/drivers/watchdog/rtd119x_wdt.c
@@ -135,7 +135,7 @@ static int rtd119x_wdt_probe(struct platform_device *pdev)
 	rtd119x_wdt_set_timeout(&data->wdt_dev, data->wdt_dev.timeout);
 	rtd119x_wdt_stop(&data->wdt_dev);
 
-	ret = devm_watchdog_register_device(&pdev->dev, &data->wdt_dev);
+	ret = watchdog_register_device(&data->wdt_dev);
 	if (ret) {
 		clk_disable_unprepare(data->clk);
 		clk_put(data->clk);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 351/639] mmc: core: fix possible use after free of host
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (349 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.19 350/639] watchdog: rtd119x_wdt: Fix remove function Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.19 352/639] lightnvm: pblk: fix lock order in pblk_rb_tear_down_check Greg Kroah-Hartman
                   ` (291 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Pan Bian, Ulf Hansson, Sasha Levin

From: Pan Bian <bianpan2016@163.com>

[ Upstream commit 8e1943af2986db42bee2b8dddf49a36cdb2e9219 ]

In the function mmc_alloc_host, the function put_device is called to
release allocated resources when mmc_gpio_alloc fails. Finally, the
function pointed by host->class_dev.class->dev_release (i.e.,
mmc_host_classdev_release) is used to release resources including the
host structure. However, after put_device, host is used and released
again. Resulting in a use-after-free bug.

Fixes: 1ed217194488 ("mmc: core: fix error path in mmc_host_alloc")
Signed-off-by: Pan Bian <bianpan2016@163.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mmc/core/host.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/drivers/mmc/core/host.c b/drivers/mmc/core/host.c
index f57f5de542064..dd1c14d8f6863 100644
--- a/drivers/mmc/core/host.c
+++ b/drivers/mmc/core/host.c
@@ -385,8 +385,6 @@ struct mmc_host *mmc_alloc_host(int extra, struct device *dev)
 
 	if (mmc_gpio_alloc(host)) {
 		put_device(&host->class_dev);
-		ida_simple_remove(&mmc_host_ida, host->index);
-		kfree(host);
 		return NULL;
 	}
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 352/639] lightnvm: pblk: fix lock order in pblk_rb_tear_down_check
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (350 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.19 351/639] mmc: core: fix possible use after free of host Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.19 353/639] ath10k: Fix encoding for protected management frames Greg Kroah-Hartman
                   ` (290 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Igor Konopko, Javier González,
	Hans Holmberg, Matias Bjørling, Jens Axboe, Sasha Levin

From: Igor Konopko <igor.j.konopko@intel.com>

[ Upstream commit 486b5aac85f6ec0b2df3e82a6a629d5eb7804db5 ]

In pblk_rb_tear_down_check() the spinlock functions are not
called in proper order.

Fixes: a4bd217 ("lightnvm: physical block device (pblk) target")
Signed-off-by: Igor Konopko <igor.j.konopko@intel.com>
Reviewed-by: Javier González <javier@javigon.com>
Reviewed-by: Hans Holmberg <hans.holmberg@cnexlabs.com>
Signed-off-by: Matias Bjørling <mb@lightnvm.io>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/lightnvm/pblk-rb.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/lightnvm/pblk-rb.c b/drivers/lightnvm/pblk-rb.c
index f6eec0212dfcf..d22c13b556221 100644
--- a/drivers/lightnvm/pblk-rb.c
+++ b/drivers/lightnvm/pblk-rb.c
@@ -784,8 +784,8 @@ int pblk_rb_tear_down_check(struct pblk_rb *rb)
 	}
 
 out:
-	spin_unlock(&rb->w_lock);
 	spin_unlock_irq(&rb->s_lock);
+	spin_unlock(&rb->w_lock);
 
 	return ret;
 }
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 353/639] ath10k: Fix encoding for protected management frames
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (351 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.19 352/639] lightnvm: pblk: fix lock order in pblk_rb_tear_down_check Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.19 354/639] afs: Fix the afs.cell and afs.volume xattr handlers Greg Kroah-Hartman
                   ` (289 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Rakesh Pillai, Kalle Valo, Sasha Levin

From: Rakesh Pillai <pillair@codeaurora.org>

[ Upstream commit 42f1bc43e6a97b9ddbe976eba9bd05306c990c75 ]

Currently the protected management frames are
not appended with the MIC_LEN which results in
the protected management frames being encoded
incorrectly.

Add the extra space at the end of the protected
management frames to fix this encoding error for
the protected management frames.

Tested HW: WCN3990
Tested FW: WLAN.HL.3.1-00784-QCAHLSWMTPLZ-1

Fixes: 1807da49733e ("ath10k: wmi: add management tx by reference support over wmi")
Signed-off-by: Rakesh Pillai <pillair@codeaurora.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath10k/wmi-tlv.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/ath/ath10k/wmi-tlv.c b/drivers/net/wireless/ath/ath10k/wmi-tlv.c
index a90990b8008de..248decb494c28 100644
--- a/drivers/net/wireless/ath/ath10k/wmi-tlv.c
+++ b/drivers/net/wireless/ath/ath10k/wmi-tlv.c
@@ -2692,8 +2692,10 @@ ath10k_wmi_tlv_op_gen_mgmt_tx_send(struct ath10k *ar, struct sk_buff *msdu,
 	if ((ieee80211_is_action(hdr->frame_control) ||
 	     ieee80211_is_deauth(hdr->frame_control) ||
 	     ieee80211_is_disassoc(hdr->frame_control)) &&
-	     ieee80211_has_protected(hdr->frame_control))
+	     ieee80211_has_protected(hdr->frame_control)) {
+		skb_put(msdu, IEEE80211_CCMP_MIC_LEN);
 		buf_len += IEEE80211_CCMP_MIC_LEN;
+	}
 
 	buf_len = min_t(u32, buf_len, WMI_TLV_MGMT_TX_FRAME_MAX_LEN);
 	buf_len = round_up(buf_len, 4);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 354/639] afs: Fix the afs.cell and afs.volume xattr handlers
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (352 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.19 353/639] ath10k: Fix encoding for protected management frames Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.19 355/639] vfio/mdev: Avoid release parent reference during error path Greg Kroah-Hartman
                   ` (288 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, David Howells, Sasha Levin

From: David Howells <dhowells@redhat.com>

[ Upstream commit c73aa4102f5b9f261a907c3b3df94cd2c478504d ]

Fix the ->get handlers for the afs.cell and afs.volume xattrs to pass the
source data size to memcpy() rather than target buffer size.

Overcopying the source data occasionally causes the kernel to oops.

Fixes: d3e3b7eac886 ("afs: Add metadata xattrs")
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/afs/xattr.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/afs/xattr.c b/fs/afs/xattr.c
index cfcc674e64a55..411f67c79f090 100644
--- a/fs/afs/xattr.c
+++ b/fs/afs/xattr.c
@@ -50,7 +50,7 @@ static int afs_xattr_get_cell(const struct xattr_handler *handler,
 		return namelen;
 	if (namelen > size)
 		return -ERANGE;
-	memcpy(buffer, cell->name, size);
+	memcpy(buffer, cell->name, namelen);
 	return namelen;
 }
 
@@ -104,7 +104,7 @@ static int afs_xattr_get_volume(const struct xattr_handler *handler,
 		return namelen;
 	if (namelen > size)
 		return -ERANGE;
-	memcpy(buffer, volname, size);
+	memcpy(buffer, volname, namelen);
 	return namelen;
 }
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 355/639] vfio/mdev: Avoid release parent reference during error path
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (353 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.19 354/639] afs: Fix the afs.cell and afs.volume xattr handlers Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.19 356/639] vfio/mdev: Follow correct remove sequence Greg Kroah-Hartman
                   ` (287 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Cornelia Huck, Kirti Wankhede,
	Maxim Levitsky, Parav Pandit, Alex Williamson, Sasha Levin

From: Parav Pandit <parav@mellanox.com>

[ Upstream commit 60e7f2c3fe9919cee9534b422865eed49f4efb15 ]

During mdev parent registration in mdev_register_device(),
if parent device is duplicate, it releases the reference of existing
parent device.
This is incorrect. Existing parent device should not be touched.

Fixes: 7b96953bc640 ("vfio: Mediated device Core driver")
Reviewed-by: Cornelia Huck <cohuck@redhat.com>
Reviewed-by: Kirti Wankhede <kwankhede@nvidia.com>
Reviewed-by: Maxim Levitsky <mlevitsk@redhat.com>
Signed-off-by: Parav Pandit <parav@mellanox.com>
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/vfio/mdev/mdev_core.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/vfio/mdev/mdev_core.c b/drivers/vfio/mdev/mdev_core.c
index 0212f0ee8aea7..8cfa712308773 100644
--- a/drivers/vfio/mdev/mdev_core.c
+++ b/drivers/vfio/mdev/mdev_core.c
@@ -182,6 +182,7 @@ int mdev_register_device(struct device *dev, const struct mdev_parent_ops *ops)
 	/* Check for duplicate */
 	parent = __find_parent_device(dev);
 	if (parent) {
+		parent = NULL;
 		ret = -EEXIST;
 		goto add_dev_err;
 	}
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 356/639] vfio/mdev: Follow correct remove sequence
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (354 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.19 355/639] vfio/mdev: Avoid release parent reference during error path Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.19 357/639] vfio/mdev: Fix aborting mdev child device removal if one fails Greg Kroah-Hartman
                   ` (286 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Cornelia Huck, Maxim Levitsky,
	Parav Pandit, Alex Williamson, Sasha Levin

From: Parav Pandit <parav@mellanox.com>

[ Upstream commit a6d6f4f160f76d840e59affe664b8d3159e23056 ]

mdev_remove_sysfs_files() should follow exact mirror sequence of a
create, similar to what is followed in error unwinding path of
mdev_create_sysfs_files().

Fixes: 6a62c1dfb5c7 ("vfio/mdev: Re-order sysfs attribute creation")
Reviewed-by: Cornelia Huck <cohuck@redhat.com>
Reviewed-by: Maxim Levitsky <mlevitsk@redhat.com>
Signed-off-by: Parav Pandit <parav@mellanox.com>
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/vfio/mdev/mdev_sysfs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/vfio/mdev/mdev_sysfs.c b/drivers/vfio/mdev/mdev_sysfs.c
index 249472f055097..e7770b511d033 100644
--- a/drivers/vfio/mdev/mdev_sysfs.c
+++ b/drivers/vfio/mdev/mdev_sysfs.c
@@ -280,7 +280,7 @@ type_link_failed:
 
 void mdev_remove_sysfs_files(struct device *dev, struct mdev_type *type)
 {
+	sysfs_remove_files(&dev->kobj, mdev_device_attrs);
 	sysfs_remove_link(&dev->kobj, "mdev_type");
 	sysfs_remove_link(type->devices_kobj, dev_name(dev));
-	sysfs_remove_files(&dev->kobj, mdev_device_attrs);
 }
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 357/639] vfio/mdev: Fix aborting mdev child device removal if one fails
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (355 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.19 356/639] vfio/mdev: Follow correct remove sequence Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.19 358/639] l2tp: Fix possible NULL pointer dereference Greg Kroah-Hartman
                   ` (285 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Maxim Levitsky, Parav Pandit,
	Alex Williamson, Sasha Levin

From: Parav Pandit <parav@mellanox.com>

[ Upstream commit 6093e348a5e2475c5bb2e571346460f939998670 ]

device_for_each_child() stops executing callback function for remaining
child devices, if callback hits an error.
Each child mdev device is independent of each other.
While unregistering parent device, mdev core must remove all child mdev
devices.
Therefore, mdev_device_remove_cb() always returns success so that
device_for_each_child doesn't abort if one child removal hits error.

While at it, improve remove and unregister functions for below simplicity.

There isn't need to pass forced flag pointer during mdev parent
removal which invokes mdev_device_remove(). So simplify the flow.

mdev_device_remove() is called from two paths.
1. mdev_unregister_driver()
     mdev_device_remove_cb()
       mdev_device_remove()
2. remove_store()
     mdev_device_remove()

Fixes: 7b96953bc640 ("vfio: Mediated device Core driver")
Reviewed-by: Maxim Levitsky <mlevitsk@redhat.com>
Signed-off-by: Parav Pandit <parav@mellanox.com>
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/vfio/mdev/mdev_core.c | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/drivers/vfio/mdev/mdev_core.c b/drivers/vfio/mdev/mdev_core.c
index 8cfa712308773..e052f62fdea7e 100644
--- a/drivers/vfio/mdev/mdev_core.c
+++ b/drivers/vfio/mdev/mdev_core.c
@@ -150,10 +150,10 @@ static int mdev_device_remove_ops(struct mdev_device *mdev, bool force_remove)
 
 static int mdev_device_remove_cb(struct device *dev, void *data)
 {
-	if (!dev_is_mdev(dev))
-		return 0;
+	if (dev_is_mdev(dev))
+		mdev_device_remove(dev, true);
 
-	return mdev_device_remove(dev, data ? *(bool *)data : true);
+	return 0;
 }
 
 /*
@@ -241,7 +241,6 @@ EXPORT_SYMBOL(mdev_register_device);
 void mdev_unregister_device(struct device *dev)
 {
 	struct mdev_parent *parent;
-	bool force_remove = true;
 
 	mutex_lock(&parent_list_lock);
 	parent = __find_parent_device(dev);
@@ -255,8 +254,7 @@ void mdev_unregister_device(struct device *dev)
 	list_del(&parent->next);
 	class_compat_remove_link(mdev_bus_compat_class, dev, NULL);
 
-	device_for_each_child(dev, (void *)&force_remove,
-			      mdev_device_remove_cb);
+	device_for_each_child(dev, NULL, mdev_device_remove_cb);
 
 	parent_remove_sysfs_files(parent);
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 358/639] l2tp: Fix possible NULL pointer dereference
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (356 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.19 357/639] vfio/mdev: Fix aborting mdev child device removal if one fails Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.19 359/639] ALSA: aica: Fix a long-time build breakage Greg Kroah-Hartman
                   ` (284 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, YueHaibing, Guillaume Nault,
	David S. Miller, Sasha Levin

From: YueHaibing <yuehaibing@huawei.com>

[ Upstream commit 638a3a1e349ddf5b82f222ff5cb3b4f266e7c278 ]

BUG: unable to handle kernel NULL pointer dereference at 0000000000000128
PGD 0 P4D 0
Oops: 0000 [#1
CPU: 0 PID: 5697 Comm: modprobe Tainted: G        W         5.1.0-rc7+ #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.9.3-0-ge2fc41e-prebuilt.qemu-project.org 04/01/2014
RIP: 0010:__lock_acquire+0x53/0x10b0
Code: 8b 1c 25 40 5e 01 00 4c 8b 6d 10 45 85 e4 0f 84 bd 06 00 00 44 8b 1d 7c d2 09 02 49 89 fe 41 89 d2 45 85 db 0f 84 47 02 00 00 <48> 81 3f a0 05 70 83 b8 00 00 00 00 44 0f 44 c0 83 fe 01 0f 86 3a
RSP: 0018:ffffc90001c07a28 EFLAGS: 00010002
RAX: 0000000000000000 RBX: ffff88822f038440 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000128
RBP: ffffc90001c07a88 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000001
R13: 0000000000000000 R14: 0000000000000128 R15: 0000000000000000
FS:  00007fead0811540(0000) GS:ffff888237a00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000128 CR3: 00000002310da000 CR4: 00000000000006f0
Call Trace:
 ? __lock_acquire+0x24e/0x10b0
 lock_acquire+0xdf/0x230
 ? flush_workqueue+0x71/0x530
 flush_workqueue+0x97/0x530
 ? flush_workqueue+0x71/0x530
 l2tp_exit_net+0x170/0x2b0 [l2tp_core
 ? l2tp_exit_net+0x93/0x2b0 [l2tp_core
 ops_exit_list.isra.6+0x36/0x60
 unregister_pernet_operations+0xb8/0x110
 unregister_pernet_device+0x25/0x40
 l2tp_init+0x55/0x1000 [l2tp_core
 ? 0xffffffffa018d000
 do_one_initcall+0x6c/0x3cc
 ? do_init_module+0x22/0x1f1
 ? rcu_read_lock_sched_held+0x97/0xb0
 ? kmem_cache_alloc_trace+0x325/0x3b0
 do_init_module+0x5b/0x1f1
 load_module+0x1db1/0x2690
 ? m_show+0x1d0/0x1d0
 __do_sys_finit_module+0xc5/0xd0
 __x64_sys_finit_module+0x15/0x20
 do_syscall_64+0x6b/0x1d0
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7fead031a839
Code: 00 f3 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 1f f6 2c 00 f7 d8 64 89 01 48
RSP: 002b:00007ffe8d9acca8 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
RAX: ffffffffffffffda RBX: 0000560078398b80 RCX: 00007fead031a839
RDX: 0000000000000000 RSI: 000056007659dc2e RDI: 0000000000000003
RBP: 000056007659dc2e R08: 0000000000000000 R09: 0000560078398b80
R10: 0000000000000003 R11: 0000000000000246 R12: 0000000000000000
R13: 00005600783a04a0 R14: 0000000000040000 R15: 0000560078398b80
Modules linked in: l2tp_core(+) e1000 ip_tables ipv6 [last unloaded: l2tp_core
CR2: 0000000000000128
---[ end trace 8322b2b8bf83f8e1

If alloc_workqueue fails in l2tp_init, l2tp_net_ops
is unregistered on failure path. Then l2tp_exit_net
is called which will flush NULL workqueue, this patch
add a NULL check to fix it.

Fixes: 67e04c29ec0d ("l2tp: unregister l2tp_net_ops on failure path")
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Acked-by: Guillaume Nault <gnault@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/l2tp/l2tp_core.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
index 52b5a2797c0c6..e4dec03a19fe9 100644
--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -1735,7 +1735,8 @@ static __net_exit void l2tp_exit_net(struct net *net)
 	}
 	rcu_read_unlock_bh();
 
-	flush_workqueue(l2tp_wq);
+	if (l2tp_wq)
+		flush_workqueue(l2tp_wq);
 	rcu_barrier();
 
 	for (hash = 0; hash < L2TP_HASH_SIZE_2; hash++)
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 359/639] ALSA: aica: Fix a long-time build breakage
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (357 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.19 358/639] l2tp: Fix possible NULL pointer dereference Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.19 360/639] media: omap_vout: potential buffer overflow in vidioc_dqbuf() Greg Kroah-Hartman
                   ` (283 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Takashi Iwai, Sasha Levin

From: Takashi Iwai <tiwai@suse.de>

[ Upstream commit 534420c6ff87d3052540f1fd346e0adcff440819 ]

The build of aica sound driver has been broken since the timer API
conversion and some code rewrite.  This patch fixes the breakage by
using the common substream field, as well as a bit cleaning up wrt the
timer handling in the code.

Fixes: d522bb6a105f ("ALSA: sh: aica: Convert timers to use timer_setup()")
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/sh/aica.c | 14 ++++----------
 1 file changed, 4 insertions(+), 10 deletions(-)

diff --git a/sound/sh/aica.c b/sound/sh/aica.c
index 2b26311405a42..ad3f71358486a 100644
--- a/sound/sh/aica.c
+++ b/sound/sh/aica.c
@@ -303,7 +303,7 @@ static void aica_period_elapsed(struct timer_list *t)
 {
 	struct snd_card_aica *dreamcastcard = from_timer(dreamcastcard,
 							      t, timer);
-	struct snd_pcm_substream *substream = dreamcastcard->timer_substream;
+	struct snd_pcm_substream *substream = dreamcastcard->substream;
 	/*timer function - so cannot sleep */
 	int play_period;
 	struct snd_pcm_runtime *runtime;
@@ -335,13 +335,6 @@ static void spu_begin_dma(struct snd_pcm_substream *substream)
 	dreamcastcard = substream->pcm->private_data;
 	/*get the queue to do the work */
 	schedule_work(&(dreamcastcard->spu_dma_work));
-	/* Timer may already be running */
-	if (unlikely(dreamcastcard->timer_substream)) {
-		mod_timer(&dreamcastcard->timer, jiffies + 4);
-		return;
-	}
-	timer_setup(&dreamcastcard->timer, aica_period_elapsed, 0);
-	dreamcastcard->timer_substream = substream;
 	mod_timer(&dreamcastcard->timer, jiffies + 4);
 }
 
@@ -379,8 +372,8 @@ static int snd_aicapcm_pcm_close(struct snd_pcm_substream
 {
 	struct snd_card_aica *dreamcastcard = substream->pcm->private_data;
 	flush_work(&(dreamcastcard->spu_dma_work));
-	if (dreamcastcard->timer_substream)
-		del_timer(&dreamcastcard->timer);
+	del_timer(&dreamcastcard->timer);
+	dreamcastcard->substream = NULL;
 	kfree(dreamcastcard->channel);
 	spu_disable();
 	return 0;
@@ -615,6 +608,7 @@ static int snd_aica_probe(struct platform_device *devptr)
 	       "Yamaha AICA Super Intelligent Sound Processor for SEGA Dreamcast");
 	/* Prepare to use the queue */
 	INIT_WORK(&(dreamcastcard->spu_dma_work), run_spu_dma);
+	timer_setup(&dreamcastcard->timer, aica_period_elapsed, 0);
 	/* Load the PCM 'chip' */
 	err = snd_aicapcmchip(dreamcastcard, 0);
 	if (unlikely(err < 0))
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 360/639] media: omap_vout: potential buffer overflow in vidioc_dqbuf()
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (358 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.19 359/639] ALSA: aica: Fix a long-time build breakage Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.19 361/639] media: davinci/vpbe: array underflow in vpbe_enum_outputs() Greg Kroah-Hartman
                   ` (282 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Hans Verkuil,
	Mauro Carvalho Chehab, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit dd6e2a981bfe83aa4a493143fd8cf1edcda6c091 ]

The "b->index" is a u32 the comes from the user in the ioctl.  It hasn't
been checked.  We aren't supposed to use it but we're instead supposed
to use the value that gets written to it when we call videobuf_dqbuf().

The videobuf_dqbuf() first memsets it to zero and then re-initializes it
inside the videobuf_status() function.  It's this final value which we
want.

Hans Verkuil pointed out that we need to check the return from
videobuf_dqbuf().  I ended up doing a little cleanup related to that as
well.

Fixes: 72915e851da9 ("[media] V4L2: OMAP: VOUT: dma map and unmap v4l2 buffers in qbuf and dqbuf")

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/omap/omap_vout.c | 15 ++++++---------
 1 file changed, 6 insertions(+), 9 deletions(-)

diff --git a/drivers/media/platform/omap/omap_vout.c b/drivers/media/platform/omap/omap_vout.c
index 5700b7818621d..45511d24d5705 100644
--- a/drivers/media/platform/omap/omap_vout.c
+++ b/drivers/media/platform/omap/omap_vout.c
@@ -1527,23 +1527,20 @@ static int vidioc_dqbuf(struct file *file, void *fh, struct v4l2_buffer *b)
 	unsigned long size;
 	struct videobuf_buffer *vb;
 
-	vb = q->bufs[b->index];
-
 	if (!vout->streaming)
 		return -EINVAL;
 
-	if (file->f_flags & O_NONBLOCK)
-		/* Call videobuf_dqbuf for non blocking mode */
-		ret = videobuf_dqbuf(q, (struct v4l2_buffer *)b, 1);
-	else
-		/* Call videobuf_dqbuf for  blocking mode */
-		ret = videobuf_dqbuf(q, (struct v4l2_buffer *)b, 0);
+	ret = videobuf_dqbuf(q, b, !!(file->f_flags & O_NONBLOCK));
+	if (ret)
+		return ret;
+
+	vb = q->bufs[b->index];
 
 	addr = (unsigned long) vout->buf_phy_addr[vb->i];
 	size = (unsigned long) vb->size;
 	dma_unmap_single(vout->vid_dev->v4l2_dev.dev,  addr,
 				size, DMA_TO_DEVICE);
-	return ret;
+	return 0;
 }
 
 static int vidioc_streamon(struct file *file, void *fh, enum v4l2_buf_type i)
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 361/639] media: davinci/vpbe: array underflow in vpbe_enum_outputs()
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (359 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.19 360/639] media: omap_vout: potential buffer overflow in vidioc_dqbuf() Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.19 362/639] platform/x86: alienware-wmi: printing the wrong error code Greg Kroah-Hartman
                   ` (281 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Lad, Prabhakar,
	Hans Verkuil, Mauro Carvalho Chehab, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit b72845ee5577b227131b1fef23f9d9a296621d7b ]

In vpbe_enum_outputs() we check if (temp_index >= cfg->num_outputs) but
the problem is that "temp_index" can be negative.  This patch changes
the types to unsigned to address this array underflow bug.

Fixes: 66715cdc3224 ("[media] davinci vpbe: VPBE display driver")

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: "Lad, Prabhakar" <prabhakar.csengg@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/davinci/vpbe.c | 2 +-
 include/media/davinci/vpbe.h          | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/media/platform/davinci/vpbe.c b/drivers/media/platform/davinci/vpbe.c
index df1ae6b5c8545..e45e062f44425 100644
--- a/drivers/media/platform/davinci/vpbe.c
+++ b/drivers/media/platform/davinci/vpbe.c
@@ -126,7 +126,7 @@ static int vpbe_enum_outputs(struct vpbe_device *vpbe_dev,
 			     struct v4l2_output *output)
 {
 	struct vpbe_config *cfg = vpbe_dev->cfg;
-	int temp_index = output->index;
+	unsigned int temp_index = output->index;
 
 	if (temp_index >= cfg->num_outputs)
 		return -EINVAL;
diff --git a/include/media/davinci/vpbe.h b/include/media/davinci/vpbe.h
index 79a566d7defd0..180a05e914979 100644
--- a/include/media/davinci/vpbe.h
+++ b/include/media/davinci/vpbe.h
@@ -92,7 +92,7 @@ struct vpbe_config {
 	struct encoder_config_info *ext_encoders;
 	/* amplifier information goes here */
 	struct amp_config_info *amp;
-	int num_outputs;
+	unsigned int num_outputs;
 	/* Order is venc outputs followed by LCD and then external encoders */
 	struct vpbe_output *outputs;
 };
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 362/639] platform/x86: alienware-wmi: printing the wrong error code
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (360 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.19 361/639] media: davinci/vpbe: array underflow in vpbe_enum_outputs() Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.19 363/639] crypto: caam - fix caam_dump_sg that iterates through scatterlist Greg Kroah-Hartman
                   ` (280 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Mario Limonciello,
	Andy Shevchenko, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit 6d1f8b3d75419a8659ac916a1e9543bb3513a882 ]

The "out_data" variable is uninitialized at the point.  Originally, this
used to print "status" instead and that seems like the correct thing to
print.

Fixes: bc2ef884320b ("alienware-wmi: For WMAX HDMI method, introduce a way to query HDMI cable status")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Mario Limonciello <mario.limonciello@dell.com>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/x86/alienware-wmi.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/platform/x86/alienware-wmi.c b/drivers/platform/x86/alienware-wmi.c
index c0d1555735cdd..83fd7677af24c 100644
--- a/drivers/platform/x86/alienware-wmi.c
+++ b/drivers/platform/x86/alienware-wmi.c
@@ -587,7 +587,7 @@ static ssize_t show_hdmi_source(struct device *dev,
 			return scnprintf(buf, PAGE_SIZE,
 					 "input [gpu] unknown\n");
 	}
-	pr_err("alienware-wmi: unknown HDMI source status: %d\n", out_data);
+	pr_err("alienware-wmi: unknown HDMI source status: %u\n", status);
 	return scnprintf(buf, PAGE_SIZE, "input gpu [unknown]\n");
 }
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 363/639] crypto: caam - fix caam_dump_sg that iterates through scatterlist
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (361 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.19 362/639] platform/x86: alienware-wmi: printing the wrong error code Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.19 364/639] netfilter: ebtables: CONFIG_COMPAT: reject trailing data after last rule Greg Kroah-Hartman
                   ` (279 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Iuliana Prodan, Horia Geantă,
	Herbert Xu, Sasha Levin

From: Iuliana Prodan <iuliana.prodan@nxp.com>

[ Upstream commit 8c65d35435e8cbfdf953cafe5ebe3648ee9276a2 ]

Fix caam_dump_sg by correctly determining the next scatterlist
entry in the list.

Fixes: 5ecf8ef9103c ("crypto: caam - fix sg dump")
Signed-off-by: Iuliana Prodan <iuliana.prodan@nxp.com>
Reviewed-by: Horia Geantă <horia.geanta@nxp.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/caam/error.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/crypto/caam/error.c b/drivers/crypto/caam/error.c
index 8da88beb1abbe..832ba2afdcd57 100644
--- a/drivers/crypto/caam/error.c
+++ b/drivers/crypto/caam/error.c
@@ -22,7 +22,7 @@ void caam_dump_sg(const char *level, const char *prefix_str, int prefix_type,
 	size_t len;
 	void *buf;
 
-	for (it = sg; it && tlen > 0 ; it = sg_next(sg)) {
+	for (it = sg; it && tlen > 0 ; it = sg_next(it)) {
 		/*
 		 * make sure the scatterlist's page
 		 * has a valid virtual memory mapping
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 364/639] netfilter: ebtables: CONFIG_COMPAT: reject trailing data after last rule
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (362 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.19 363/639] crypto: caam - fix caam_dump_sg that iterates through scatterlist Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.19 365/639] pwm: meson: Consider 128 a valid pre-divider Greg Kroah-Hartman
                   ` (278 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Tetsuo Handa, Florian Westphal,
	Pablo Neira Ayuso, Sasha Levin

From: Florian Westphal <fw@strlen.de>

[ Upstream commit 680f6af5337c98d116e4f127cea7845339dba8da ]

If userspace provides a rule blob with trailing data after last target,
we trigger a splat, then convert ruleset to 64bit format (with trailing
data), then pass that to do_replace_finish() which then returns -EINVAL.

Erroring out right away avoids the splat plus unneeded translation and
error unwind.

Fixes: 81e675c227ec ("netfilter: ebtables: add CONFIG_COMPAT support")
Reported-by: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/bridge/netfilter/ebtables.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 785e19afd6aaa..f59230e4fc295 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -2165,7 +2165,9 @@ static int compat_copy_entries(unsigned char *data, unsigned int size_user,
 	if (ret < 0)
 		return ret;
 
-	WARN_ON(size_remaining);
+	if (size_remaining)
+		return -EINVAL;
+
 	return state->buf_kern_offset;
 }
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 365/639] pwm: meson: Consider 128 a valid pre-divider
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (363 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.19 364/639] netfilter: ebtables: CONFIG_COMPAT: reject trailing data after last rule Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.19 366/639] pwm: meson: Dont disable PWM when setting duty repeatedly Greg Kroah-Hartman
                   ` (277 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Martin Blumenstingl,
	Uwe Kleine-König, Neil Armstrong, Thierry Reding,
	Sasha Levin

From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>

[ Upstream commit 51496e4446875726d50a5617a6e0e0dabbc2e6da ]

The pre-divider allows configuring longer PWM periods compared to using
the input clock directly. The pre-divider is 7 bit wide, meaning it's
maximum value is 128 (the register value is off-by-one: 0x7f or 127).

Change the loop to also allow for the maximum possible value to be
considered valid.

Fixes: 211ed630753d2f ("pwm: Add support for Meson PWM Controller")
Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Acked-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Reviewed-by: Neil Armstrong <narmstrong@baylibre.com>
Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pwm/pwm-meson.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/pwm/pwm-meson.c b/drivers/pwm/pwm-meson.c
index f6e738ad7bd92..4b708c1fcb1d2 100644
--- a/drivers/pwm/pwm-meson.c
+++ b/drivers/pwm/pwm-meson.c
@@ -188,7 +188,7 @@ static int meson_pwm_calc(struct meson_pwm *meson,
 	do_div(fin_ps, fin_freq);
 
 	/* Calc pre_div with the period */
-	for (pre_div = 0; pre_div < MISC_CLK_DIV_MASK; pre_div++) {
+	for (pre_div = 0; pre_div <= MISC_CLK_DIV_MASK; pre_div++) {
 		cnt = DIV_ROUND_CLOSEST_ULL((u64)period * 1000,
 					    fin_ps * (pre_div + 1));
 		dev_dbg(meson->chip.dev, "fin_ps=%llu pre_div=%u cnt=%u\n",
@@ -197,7 +197,7 @@ static int meson_pwm_calc(struct meson_pwm *meson,
 			break;
 	}
 
-	if (pre_div == MISC_CLK_DIV_MASK) {
+	if (pre_div > MISC_CLK_DIV_MASK) {
 		dev_err(meson->chip.dev, "unable to get period pre_div\n");
 		return -EINVAL;
 	}
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 366/639] pwm: meson: Dont disable PWM when setting duty repeatedly
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (364 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.19 365/639] pwm: meson: Consider 128 a valid pre-divider Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.19 367/639] ARM: riscpc: fix lack of keyboard interrupts after irq conversion Greg Kroah-Hartman
                   ` (276 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Bichao Zheng, Martin Blumenstingl,
	Neil Armstrong, Thierry Reding, Sasha Levin

From: Bichao Zheng <bichao.zheng@amlogic.com>

[ Upstream commit a279345807e1e0ae79567a52cfdd9d30c9174a3c ]

There is an abnormally low about 20ms,when setting duty repeatedly.
Because setting the duty will disable PWM and then enable. Delete
this operation now.

Fixes: 211ed630753d2f ("pwm: Add support for Meson PWM Controller")
Signed-off-by: Bichao Zheng <bichao.zheng@amlogic.com>
[ Dropped code instead of hiding it behind a comment ]
Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Reviewed-by: Neil Armstrong <narmstrong@baylibre.com>
Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pwm/pwm-meson.c | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/drivers/pwm/pwm-meson.c b/drivers/pwm/pwm-meson.c
index 4b708c1fcb1d2..e247ab632530b 100644
--- a/drivers/pwm/pwm-meson.c
+++ b/drivers/pwm/pwm-meson.c
@@ -325,11 +325,6 @@ static int meson_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm,
 	if (state->period != channel->state.period ||
 	    state->duty_cycle != channel->state.duty_cycle ||
 	    state->polarity != channel->state.polarity) {
-		if (channel->state.enabled) {
-			meson_pwm_disable(meson, pwm->hwpwm);
-			channel->state.enabled = false;
-		}
-
 		if (state->polarity != channel->state.polarity) {
 			if (state->polarity == PWM_POLARITY_NORMAL)
 				meson->inverter_mask |= BIT(pwm->hwpwm);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 367/639] ARM: riscpc: fix lack of keyboard interrupts after irq conversion
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (365 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.19 366/639] pwm: meson: Dont disable PWM when setting duty repeatedly Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.19 368/639] nfp: bpf: fix static check error through tightening shift amount adjustment Greg Kroah-Hartman
                   ` (275 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Russell King, Sasha Levin

From: Russell King <rmk+kernel@armlinux.org.uk>

[ Upstream commit 63a0666bca9311f35017be454587f3ba903644b8 ]

Fix lack of keyboard interrupts for RiscPC due to incorrect conversion.

Fixes: e8d36d5dbb6a ("ARM: kill off set_irq_flags usage")
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/mach-rpc/irq.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/arch/arm/mach-rpc/irq.c b/arch/arm/mach-rpc/irq.c
index b8a61cb112073..7f0f401786344 100644
--- a/arch/arm/mach-rpc/irq.c
+++ b/arch/arm/mach-rpc/irq.c
@@ -118,7 +118,7 @@ extern unsigned char rpc_default_fiq_start, rpc_default_fiq_end;
 
 void __init rpc_init_irq(void)
 {
-	unsigned int irq, clr, set = 0;
+	unsigned int irq, clr, set;
 
 	iomd_writeb(0, IOMD_IRQMASKA);
 	iomd_writeb(0, IOMD_IRQMASKB);
@@ -130,6 +130,7 @@ void __init rpc_init_irq(void)
 
 	for (irq = 0; irq < NR_IRQS; irq++) {
 		clr = IRQ_NOREQUEST;
+		set = 0;
 
 		if (irq <= 6 || (irq >= 9 && irq <= 15))
 			clr |= IRQ_NOPROBE;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 368/639] nfp: bpf: fix static check error through tightening shift amount adjustment
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (366 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.19 367/639] ARM: riscpc: fix lack of keyboard interrupts after irq conversion Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:28 ` [PATCH 4.19 369/639] kdb: do a sanity check on the cpu in kdb_per_cpu() Greg Kroah-Hartman
                   ` (274 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Oleksandr Natalenko, Quentin Monnet,
	Jakub Kicinski, Jiong Wang, Alexei Starovoitov, Sasha Levin

From: Jiong Wang <jiong.wang@netronome.com>

[ Upstream commit 69e168ebdcfcb87ce7252d4857d570f99996fa27 ]

NFP shift instruction has something special. If shift direction is left
then shift amount of 1 to 31 is specified as 32 minus the amount to shift.

But no need to do this for indirect shift which has shift amount be 0. Even
after we do this subtraction, shift amount 0 will be turned into 32 which
will eventually be encoded the same as 0 because only low 5 bits are
encoded, but shift amount be 32 will fail the FIELD_PREP check done later
on shift mask (0x1f), due to 32 is out of mask range. Such error has been
observed when compiling nfp/bpf/jit.c using gcc 8.3 + O3.

This issue has started when indirect shift support added after which the
incoming shift amount to __emit_shf could be 0, therefore it is at that
time shift amount adjustment inside __emit_shf should have been tightened.

Fixes: 991f5b3651f6 ("nfp: bpf: support logic indirect shifts (BPF_[L|R]SH | BPF_X)")
Reported-by: Oleksandr Natalenko <oleksandr@natalenko.name>
Reported-by: Pablo Cascón <pablo.cascon@netronome.com
Reviewed-by: Quentin Monnet <quentin.monnet@netronome.com>
Reviewed-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Signed-off-by: Jiong Wang <jiong.wang@netronome.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/netronome/nfp/bpf/jit.c | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/netronome/nfp/bpf/jit.c b/drivers/net/ethernet/netronome/nfp/bpf/jit.c
index 4e18d95e548f1..c3ce0fb47a0f0 100644
--- a/drivers/net/ethernet/netronome/nfp/bpf/jit.c
+++ b/drivers/net/ethernet/netronome/nfp/bpf/jit.c
@@ -326,7 +326,18 @@ __emit_shf(struct nfp_prog *nfp_prog, u16 dst, enum alu_dst_ab dst_ab,
 		return;
 	}
 
-	if (sc == SHF_SC_L_SHF)
+	/* NFP shift instruction has something special. If shift direction is
+	 * left then shift amount of 1 to 31 is specified as 32 minus the amount
+	 * to shift.
+	 *
+	 * But no need to do this for indirect shift which has shift amount be
+	 * 0. Even after we do this subtraction, shift amount 0 will be turned
+	 * into 32 which will eventually be encoded the same as 0 because only
+	 * low 5 bits are encoded, but shift amount be 32 will fail the
+	 * FIELD_PREP check done later on shift mask (0x1f), due to 32 is out of
+	 * mask range.
+	 */
+	if (sc == SHF_SC_L_SHF && shift)
 		shift = 32 - shift;
 
 	insn = OP_SHF_BASE |
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 369/639] kdb: do a sanity check on the cpu in kdb_per_cpu()
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (367 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.19 368/639] nfp: bpf: fix static check error through tightening shift amount adjustment Greg Kroah-Hartman
@ 2020-01-24  9:28 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.19 370/639] netfilter: nf_tables: correct NFT_LOGLEVEL_MAX value Greg Kroah-Hartman
                   ` (273 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:28 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Douglas Anderson,
	Daniel Thompson, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit b586627e10f57ee3aa8f0cfab0d6f7dc4ae63760 ]

The "whichcpu" comes from argv[3].  The cpu_online() macro looks up the
cpu in a bitmap of online cpus, but if the value is too high then it
could read beyond the end of the bitmap and possibly Oops.

Fixes: 5d5314d6795f ("kdb: core for kgdb back end (1 of 2)")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Signed-off-by: Daniel Thompson <daniel.thompson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/debug/kdb/kdb_main.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/debug/kdb/kdb_main.c b/kernel/debug/kdb/kdb_main.c
index f338d23b112b5..dc6bf35e78840 100644
--- a/kernel/debug/kdb/kdb_main.c
+++ b/kernel/debug/kdb/kdb_main.c
@@ -2604,7 +2604,7 @@ static int kdb_per_cpu(int argc, const char **argv)
 		diag = kdbgetularg(argv[3], &whichcpu);
 		if (diag)
 			return diag;
-		if (!cpu_online(whichcpu)) {
+		if (whichcpu >= nr_cpu_ids || !cpu_online(whichcpu)) {
 			kdb_printf("cpu %ld is not online\n", whichcpu);
 			return KDB_BADCPUNUM;
 		}
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 370/639] netfilter: nf_tables: correct NFT_LOGLEVEL_MAX value
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (368 preceding siblings ...)
  2020-01-24  9:28 ` [PATCH 4.19 369/639] kdb: do a sanity check on the cpu in kdb_per_cpu() Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.19 371/639] backlight: lm3630a: Return 0 on success in update_status functions Greg Kroah-Hartman
                   ` (272 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Florian Westphal, Pablo Neira Ayuso,
	Sasha Levin

From: Florian Westphal <fw@strlen.de>

[ Upstream commit 92285a079eedfe104a773a7c4293f77a01f456fb ]

should be same as NFT_LOGLEVEL_AUDIT, so use -, not +.

Fixes: 7eced5ab5a73 ("netfilter: nf_tables: add NFT_LOGLEVEL_* enumeration and use it")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/uapi/linux/netfilter/nf_tables.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
index 325ec6ef0a764..5eac62e1b68d5 100644
--- a/include/uapi/linux/netfilter/nf_tables.h
+++ b/include/uapi/linux/netfilter/nf_tables.h
@@ -1128,7 +1128,7 @@ enum nft_log_level {
 	NFT_LOGLEVEL_AUDIT,
 	__NFT_LOGLEVEL_MAX
 };
-#define NFT_LOGLEVEL_MAX	(__NFT_LOGLEVEL_MAX + 1)
+#define NFT_LOGLEVEL_MAX	(__NFT_LOGLEVEL_MAX - 1)
 
 /**
  * enum nft_queue_attributes - nf_tables queue expression netlink attributes
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 371/639] backlight: lm3630a: Return 0 on success in update_status functions
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (369 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.19 370/639] netfilter: nf_tables: correct NFT_LOGLEVEL_MAX value Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.19 372/639] thermal: rcar_gen3_thermal: fix interrupt type Greg Kroah-Hartman
                   ` (271 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Brian Masney, Pavel Machek,
	Daniel Thompson, Lee Jones, Sasha Levin

From: Brian Masney <masneyb@onstation.org>

[ Upstream commit d3f48ec0954c6aac736ab21c34a35d7554409112 ]

lm3630a_bank_a_update_status() and lm3630a_bank_b_update_status()
both return the brightness value if the brightness was successfully
updated. Writing to these attributes via sysfs would cause a 'Bad
address' error to be returned. These functions should return 0 on
success, so let's change it to correct that error.

Fixes: 28e64a68a2ef ("backlight: lm3630: apply chip revision")
Signed-off-by: Brian Masney <masneyb@onstation.org>
Acked-by: Pavel Machek <pavel@ucw.cz>
Acked-by: Daniel Thompson <daniel.thompson@linaro.org>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/video/backlight/lm3630a_bl.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/video/backlight/lm3630a_bl.c b/drivers/video/backlight/lm3630a_bl.c
index 2030a6b77a097..ef2553f452ca9 100644
--- a/drivers/video/backlight/lm3630a_bl.c
+++ b/drivers/video/backlight/lm3630a_bl.c
@@ -201,7 +201,7 @@ static int lm3630a_bank_a_update_status(struct backlight_device *bl)
 				      LM3630A_LEDA_ENABLE, LM3630A_LEDA_ENABLE);
 	if (ret < 0)
 		goto out_i2c_err;
-	return bl->props.brightness;
+	return 0;
 
 out_i2c_err:
 	dev_err(pchip->dev, "i2c failed to access\n");
@@ -278,7 +278,7 @@ static int lm3630a_bank_b_update_status(struct backlight_device *bl)
 				      LM3630A_LEDB_ENABLE, LM3630A_LEDB_ENABLE);
 	if (ret < 0)
 		goto out_i2c_err;
-	return bl->props.brightness;
+	return 0;
 
 out_i2c_err:
 	dev_err(pchip->dev, "i2c failed to access REG_CTRL\n");
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 372/639] thermal: rcar_gen3_thermal: fix interrupt type
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (370 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.19 371/639] backlight: lm3630a: Return 0 on success in update_status functions Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.19 373/639] thermal: cpu_cooling: Actually trace CPU load in thermal_power_cpu_get_power Greg Kroah-Hartman
                   ` (270 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jiada Wang, Simon Horman,
	Daniel Lezcano, Eduardo Valentin, Sasha Levin

From: Jiada Wang <jiada_wang@mentor.com>

[ Upstream commit 2c0928c9e004589dc9e7672c40a38d6c4ca12701 ]

Currently IRQF_SHARED type interrupt line is allocated, but it
is not appropriate, as the interrupt line isn't shared between
different devices, instead IRQF_ONESHOT is the proper type.

By changing interrupt type to IRQF_ONESHOT, now irq handler is
no longer needed, as clear of interrupt status can be done in
threaded interrupt context.

Because IRQF_ONESHOT type interrupt line is kept disabled until
the threaded handler has been run, so there is no need to protect
read/write of REG_GEN3_IRQSTR with lock.

Fixes: 7d4b269776ec6 ("enable hardware interrupts for trip points")
Signed-off-by: Jiada Wang <jiada_wang@mentor.com>
Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
Tested-by: Simon Horman <horms+renesas@verge.net.au>
Reviewed-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Signed-off-by: Eduardo Valentin <edubezval@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/thermal/rcar_gen3_thermal.c | 38 +++++------------------------
 1 file changed, 6 insertions(+), 32 deletions(-)

diff --git a/drivers/thermal/rcar_gen3_thermal.c b/drivers/thermal/rcar_gen3_thermal.c
index 704c8ad045bb5..8f553453dd7fc 100644
--- a/drivers/thermal/rcar_gen3_thermal.c
+++ b/drivers/thermal/rcar_gen3_thermal.c
@@ -14,7 +14,6 @@
 #include <linux/of_device.h>
 #include <linux/platform_device.h>
 #include <linux/pm_runtime.h>
-#include <linux/spinlock.h>
 #include <linux/sys_soc.h>
 #include <linux/thermal.h>
 
@@ -81,7 +80,6 @@ struct rcar_gen3_thermal_tsc {
 struct rcar_gen3_thermal_priv {
 	struct rcar_gen3_thermal_tsc *tscs[TSC_MAX_NUM];
 	unsigned int num_tscs;
-	spinlock_t lock; /* Protect interrupts on and off */
 	void (*thermal_init)(struct rcar_gen3_thermal_tsc *tsc);
 };
 
@@ -231,38 +229,16 @@ static irqreturn_t rcar_gen3_thermal_irq(int irq, void *data)
 {
 	struct rcar_gen3_thermal_priv *priv = data;
 	u32 status;
-	int i, ret = IRQ_HANDLED;
+	int i;
 
-	spin_lock(&priv->lock);
 	for (i = 0; i < priv->num_tscs; i++) {
 		status = rcar_gen3_thermal_read(priv->tscs[i], REG_GEN3_IRQSTR);
 		rcar_gen3_thermal_write(priv->tscs[i], REG_GEN3_IRQSTR, 0);
 		if (status)
-			ret = IRQ_WAKE_THREAD;
+			thermal_zone_device_update(priv->tscs[i]->zone,
+						   THERMAL_EVENT_UNSPECIFIED);
 	}
 
-	if (ret == IRQ_WAKE_THREAD)
-		rcar_thermal_irq_set(priv, false);
-
-	spin_unlock(&priv->lock);
-
-	return ret;
-}
-
-static irqreturn_t rcar_gen3_thermal_irq_thread(int irq, void *data)
-{
-	struct rcar_gen3_thermal_priv *priv = data;
-	unsigned long flags;
-	int i;
-
-	for (i = 0; i < priv->num_tscs; i++)
-		thermal_zone_device_update(priv->tscs[i]->zone,
-					   THERMAL_EVENT_UNSPECIFIED);
-
-	spin_lock_irqsave(&priv->lock, flags);
-	rcar_thermal_irq_set(priv, true);
-	spin_unlock_irqrestore(&priv->lock, flags);
-
 	return IRQ_HANDLED;
 }
 
@@ -364,8 +340,6 @@ static int rcar_gen3_thermal_probe(struct platform_device *pdev)
 	if (soc_device_match(r8a7795es1))
 		priv->thermal_init = rcar_gen3_thermal_init_r8a7795es1;
 
-	spin_lock_init(&priv->lock);
-
 	platform_set_drvdata(pdev, priv);
 
 	/*
@@ -383,9 +357,9 @@ static int rcar_gen3_thermal_probe(struct platform_device *pdev)
 		if (!irqname)
 			return -ENOMEM;
 
-		ret = devm_request_threaded_irq(dev, irq, rcar_gen3_thermal_irq,
-						rcar_gen3_thermal_irq_thread,
-						IRQF_SHARED, irqname, priv);
+		ret = devm_request_threaded_irq(dev, irq, NULL,
+						rcar_gen3_thermal_irq,
+						IRQF_ONESHOT, irqname, priv);
 		if (ret)
 			return ret;
 	}
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 373/639] thermal: cpu_cooling: Actually trace CPU load in thermal_power_cpu_get_power
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (371 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.19 372/639] thermal: rcar_gen3_thermal: fix interrupt type Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.19 374/639] EDAC/mc: Fix edac_mc_find() in case no device is found Greg Kroah-Hartman
                   ` (269 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Matthias Kaehlcke, Daniel Lezcano,
	Javi Merino, Viresh Kumar, Eduardo Valentin, Sasha Levin

From: Matthias Kaehlcke <mka@chromium.org>

[ Upstream commit bf45ac18b78038e43af3c1a273cae4ab5704d2ce ]

The CPU load values passed to the thermal_power_cpu_get_power
tracepoint are zero for all CPUs, unless, unless the
thermal_power_cpu_limit tracepoint is enabled too:

  irq/41-rockchip-98    [000] ....   290.972410: thermal_power_cpu_get_power:
  cpus=0000000f freq=1800000 load={{0x0,0x0,0x0,0x0}} dynamic_power=4815

vs

  irq/41-rockchip-96    [000] ....    95.773585: thermal_power_cpu_get_power:
  cpus=0000000f freq=1800000 load={{0x56,0x64,0x64,0x5e}} dynamic_power=4959
  irq/41-rockchip-96    [000] ....    95.773596: thermal_power_cpu_limit:
  cpus=0000000f freq=408000 cdev_state=10 power=416

There seems to be no good reason for omitting the CPU load information
depending on another tracepoint. My guess is that the intention was to
check whether thermal_power_cpu_get_power is (still) enabled, however
'load_cpu != NULL' already indicates that it was at least enabled when
cpufreq_get_requested_power() was entered, there seems little gain
from omitting the assignment if the tracepoint was just disabled, so
just remove the check.

Fixes: 6828a4711f99 ("thermal: add trace events to the power allocator governor")
Signed-off-by: Matthias Kaehlcke <mka@chromium.org>
Reviewed-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Acked-by: Javi Merino <javi.merino@kernel.org>
Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Eduardo Valentin <edubezval@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/thermal/cpu_cooling.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/thermal/cpu_cooling.c b/drivers/thermal/cpu_cooling.c
index dfd23245f778a..9df6b72604667 100644
--- a/drivers/thermal/cpu_cooling.c
+++ b/drivers/thermal/cpu_cooling.c
@@ -458,7 +458,7 @@ static int cpufreq_get_requested_power(struct thermal_cooling_device *cdev,
 			load = 0;
 
 		total_load += load;
-		if (trace_thermal_power_cpu_limit_enabled() && load_cpu)
+		if (load_cpu)
 			load_cpu[i] = load;
 
 		i++;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 374/639] EDAC/mc: Fix edac_mc_find() in case no device is found
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (372 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.19 373/639] thermal: cpu_cooling: Actually trace CPU load in thermal_power_cpu_get_power Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.19 375/639] afs: Fix key leak in afs_release() and afs_evict_inode() Greg Kroah-Hartman
                   ` (268 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Robert Richter, Borislav Petkov,
	linux-edac, James Morse, Mauro Carvalho Chehab, Sasha Levin

From: Robert Richter <rrichter@marvell.com>

[ Upstream commit 29a0c843973bc385918158c6976e4dbe891df969 ]

The function should return NULL in case no device is found, but it
always returns the last checked mc device from the list even if the
index did not match. Fix that.

I did some analysis why this did not raise any issues for about 3 years
and the reason is that edac_mc_find() is mostly used to search for
existing devices. Thus, the bug is not triggered.

 [ bp: Drop the if (mci->mc_idx > idx) test in favor of readability. ]

Fixes: c73e8833bec5 ("EDAC, mc: Fix locking around mc_devices list")
Signed-off-by: Robert Richter <rrichter@marvell.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Cc: "linux-edac@vger.kernel.org" <linux-edac@vger.kernel.org>
Cc: James Morse <james.morse@arm.com>
Cc: Mauro Carvalho Chehab <mchehab@kernel.org>
Link: https://lkml.kernel.org/r/20190514104838.15065-1-rrichter@marvell.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/edac/edac_mc.c | 12 ++++--------
 1 file changed, 4 insertions(+), 8 deletions(-)

diff --git a/drivers/edac/edac_mc.c b/drivers/edac/edac_mc.c
index f59511bd99261..fd440b35d76ed 100644
--- a/drivers/edac/edac_mc.c
+++ b/drivers/edac/edac_mc.c
@@ -681,22 +681,18 @@ static int del_mc_from_global_list(struct mem_ctl_info *mci)
 
 struct mem_ctl_info *edac_mc_find(int idx)
 {
-	struct mem_ctl_info *mci = NULL;
+	struct mem_ctl_info *mci;
 	struct list_head *item;
 
 	mutex_lock(&mem_ctls_mutex);
 
 	list_for_each(item, &mc_devices) {
 		mci = list_entry(item, struct mem_ctl_info, link);
-
-		if (mci->mc_idx >= idx) {
-			if (mci->mc_idx == idx) {
-				goto unlock;
-			}
-			break;
-		}
+		if (mci->mc_idx == idx)
+			goto unlock;
 	}
 
+	mci = NULL;
 unlock:
 	mutex_unlock(&mem_ctls_mutex);
 	return mci;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 375/639] afs: Fix key leak in afs_release() and afs_evict_inode()
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (373 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.19 374/639] EDAC/mc: Fix edac_mc_find() in case no device is found Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.19 376/639] afs: Dont invalidate callback if AFS_VNODE_DIR_VALID not set Greg Kroah-Hartman
                   ` (267 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, David Howells, Sasha Levin

From: David Howells <dhowells@redhat.com>

[ Upstream commit a1b879eefc2b34cd3f17187ef6fc1cf3960e9518 ]

Fix afs_release() to go through the cleanup part of the function if
FMODE_WRITE is set rather than exiting through vfs_fsync() (which skips the
cleanup).  The cleanup involves discarding the refs on the key used for
file ops and the writeback key record.

Also fix afs_evict_inode() to clean up any left over wb keys attached to
the inode/vnode when it is removed.

Fixes: 5a8132761609 ("afs: Do better accretion of small writes on newly created content")
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/afs/file.c  | 7 ++++---
 fs/afs/inode.c | 1 +
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/fs/afs/file.c b/fs/afs/file.c
index 843d3b970b845..0bd78df6a64e6 100644
--- a/fs/afs/file.c
+++ b/fs/afs/file.c
@@ -169,11 +169,12 @@ int afs_release(struct inode *inode, struct file *file)
 {
 	struct afs_vnode *vnode = AFS_FS_I(inode);
 	struct afs_file *af = file->private_data;
+	int ret = 0;
 
 	_enter("{%x:%u},", vnode->fid.vid, vnode->fid.vnode);
 
 	if ((file->f_mode & FMODE_WRITE))
-		return vfs_fsync(file, 0);
+		ret = vfs_fsync(file, 0);
 
 	file->private_data = NULL;
 	if (af->wb)
@@ -181,8 +182,8 @@ int afs_release(struct inode *inode, struct file *file)
 	key_put(af->key);
 	kfree(af);
 	afs_prune_wb_keys(vnode);
-	_leave(" = 0");
-	return 0;
+	_leave(" = %d", ret);
+	return ret;
 }
 
 /*
diff --git a/fs/afs/inode.c b/fs/afs/inode.c
index 0726e40db0f8b..718fab2f151a1 100644
--- a/fs/afs/inode.c
+++ b/fs/afs/inode.c
@@ -541,6 +541,7 @@ void afs_evict_inode(struct inode *inode)
 	}
 #endif
 
+	afs_prune_wb_keys(vnode);
 	afs_put_permits(rcu_access_pointer(vnode->permit_cache));
 	key_put(vnode->lock_key);
 	vnode->lock_key = NULL;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 376/639] afs: Dont invalidate callback if AFS_VNODE_DIR_VALID not set
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (374 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.19 375/639] afs: Fix key leak in afs_release() and afs_evict_inode() Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.19 377/639] afs: Fix lock-wait/callback-break double locking Greg Kroah-Hartman
                   ` (266 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, David Howells, Sasha Levin

From: David Howells <dhowells@redhat.com>

[ Upstream commit d9052dda8a39069312218f913d22d99c48d90004 ]

Don't invalidate the callback promise on a directory if the
AFS_VNODE_DIR_VALID flag is not set (which indicates that the directory
contents are invalid, due to edit failure, callback break, page reclaim).

The directory will be reloaded next time the directory is accessed, so
clearing the callback flag at this point may race with a reload of the
directory and cancel it's recorded callback promise.

Fixes: f3ddee8dc4e2 ("afs: Fix directory handling")
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/afs/inode.c | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/fs/afs/inode.c b/fs/afs/inode.c
index 718fab2f151a1..e6f11da5461be 100644
--- a/fs/afs/inode.c
+++ b/fs/afs/inode.c
@@ -398,12 +398,9 @@ int afs_validate(struct afs_vnode *vnode, struct key *key)
 			vnode->cb_s_break = vnode->cb_interest->server->cb_s_break;
 			vnode->cb_v_break = vnode->volume->cb_v_break;
 			valid = false;
-		} else if (vnode->status.type == AFS_FTYPE_DIR &&
-			   (!test_bit(AFS_VNODE_DIR_VALID, &vnode->flags) ||
-			    vnode->cb_expires_at - 10 <= now)) {
+		} else if (test_bit(AFS_VNODE_ZAP_DATA, &vnode->flags)) {
 			valid = false;
-		} else if (test_bit(AFS_VNODE_ZAP_DATA, &vnode->flags) ||
-			   vnode->cb_expires_at - 10 <= now) {
+		} else if (vnode->cb_expires_at - 10 <= now) {
 			valid = false;
 		} else {
 			valid = true;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 377/639] afs: Fix lock-wait/callback-break double locking
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (375 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.19 376/639] afs: Dont invalidate callback if AFS_VNODE_DIR_VALID not set Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.19 378/639] afs: Fix double inc of vnode->cb_break Greg Kroah-Hartman
                   ` (265 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, David Howells, Sasha Levin

From: David Howells <dhowells@redhat.com>

[ Upstream commit c7226e407b6065d3bda8bd9dc627663d2c505ea3 ]

__afs_break_callback() holds vnode->lock around its call of
afs_lock_may_be_available() - which also takes that lock.

Fix this by not taking the lock in __afs_break_callback().

Also, there's no point checking the granted_locks and pending_locks queues;
it's sufficient to check lock_state, so move that check out of
afs_lock_may_be_available() into __afs_break_callback() to replace the
queue checks.

Fixes: e8d6c554126b ("AFS: implement file locking")
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/afs/callback.c | 8 +-------
 fs/afs/flock.c    | 3 ---
 2 files changed, 1 insertion(+), 10 deletions(-)

diff --git a/fs/afs/callback.c b/fs/afs/callback.c
index 4ad7012502998..97283b04fa6fd 100644
--- a/fs/afs/callback.c
+++ b/fs/afs/callback.c
@@ -221,14 +221,8 @@ void afs_break_callback(struct afs_vnode *vnode)
 		vnode->cb_break++;
 		afs_clear_permits(vnode);
 
-		spin_lock(&vnode->lock);
-
-		_debug("break callback");
-
-		if (list_empty(&vnode->granted_locks) &&
-		    !list_empty(&vnode->pending_locks))
+		if (vnode->lock_state == AFS_VNODE_LOCK_WAITING_FOR_CB)
 			afs_lock_may_be_available(vnode);
-		spin_unlock(&vnode->lock);
 	}
 
 	write_sequnlock(&vnode->cb_lock);
diff --git a/fs/afs/flock.c b/fs/afs/flock.c
index aea7224ba1981..fbf4986b12245 100644
--- a/fs/afs/flock.c
+++ b/fs/afs/flock.c
@@ -39,9 +39,6 @@ void afs_lock_may_be_available(struct afs_vnode *vnode)
 {
 	_enter("{%x:%u}", vnode->fid.vid, vnode->fid.vnode);
 
-	if (vnode->lock_state != AFS_VNODE_LOCK_WAITING_FOR_CB)
-		return;
-
 	spin_lock(&vnode->lock);
 	if (vnode->lock_state == AFS_VNODE_LOCK_WAITING_FOR_CB)
 		afs_next_locker(vnode, 0);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 378/639] afs: Fix double inc of vnode->cb_break
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (376 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.19 377/639] afs: Fix lock-wait/callback-break double locking Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.19 379/639] ARM: dts: sun8i-h3: Fix wifi in Beelink X2 DT Greg Kroah-Hartman
                   ` (264 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, David Howells, Sasha Levin

From: David Howells <dhowells@redhat.com>

[ Upstream commit fd711586bb7d63f257da5eff234e68c446ac35ea ]

When __afs_break_callback() clears the CB_PROMISED flag, it increments
vnode->cb_break to trigger a future refetch of the status and callback -
however it also calls afs_clear_permits(), which also increments
vnode->cb_break.

Fix this by removing the increment from afs_clear_permits().

Whilst we're at it, fix the conditional call to afs_put_permits() as the
function checks to see if the argument is NULL, so the check is redundant.

Fixes: be080a6f43c4 ("afs: Overhaul permit caching");
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/afs/security.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/fs/afs/security.c b/fs/afs/security.c
index 81dfedb7879ff..66042b432baa8 100644
--- a/fs/afs/security.c
+++ b/fs/afs/security.c
@@ -87,11 +87,9 @@ void afs_clear_permits(struct afs_vnode *vnode)
 	permits = rcu_dereference_protected(vnode->permit_cache,
 					    lockdep_is_held(&vnode->lock));
 	RCU_INIT_POINTER(vnode->permit_cache, NULL);
-	vnode->cb_break++;
 	spin_unlock(&vnode->lock);
 
-	if (permits)
-		afs_put_permits(permits);
+	afs_put_permits(permits);
 }
 
 /*
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 379/639] ARM: dts: sun8i-h3: Fix wifi in Beelink X2 DT
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (377 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.19 378/639] afs: Fix double inc of vnode->cb_break Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.19 380/639] clk: meson: gxbb: no spread spectrum on mpll0 Greg Kroah-Hartman
                   ` (263 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jernej Skrabec, Maxime Ripard, Sasha Levin

From: Jernej Skrabec <jernej.skrabec@siol.net>

[ Upstream commit ca0961011db57e39880df0b5708df8aa3339dc6f ]

mmc1 node where wifi module is connected doesn't have properly defined
power supplies so wifi module is never powered up. Fix that by
specifying additional power supplies.

Additionally, this STB may have either Realtek or Broadcom based wifi
module. One based on Broadcom module also needs external clock to work
properly. Fix that by adding clock property to wifi_pwrseq node.

Fixes: e582b47a9252 ("ARM: dts: sun8i-h3: Add dts for the Beelink X2 STB")
Signed-off-by: Jernej Skrabec <jernej.skrabec@siol.net>
Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/sun8i-h3-beelink-x2.dts | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/arch/arm/boot/dts/sun8i-h3-beelink-x2.dts b/arch/arm/boot/dts/sun8i-h3-beelink-x2.dts
index 25540b7694d59..6523d81dd9c49 100644
--- a/arch/arm/boot/dts/sun8i-h3-beelink-x2.dts
+++ b/arch/arm/boot/dts/sun8i-h3-beelink-x2.dts
@@ -90,6 +90,8 @@
 	wifi_pwrseq: wifi_pwrseq {
 		compatible = "mmc-pwrseq-simple";
 		reset-gpios = <&r_pio 0 7 GPIO_ACTIVE_LOW>; /* PL7 */
+		clocks = <&rtc 1>;
+		clock-names = "ext_clock";
 	};
 
 	sound_spdif {
@@ -155,6 +157,8 @@
 
 &mmc1 {
 	vmmc-supply = <&reg_vcc3v3>;
+	vqmmc-supply = <&reg_vcc3v3>;
+	mmc-pwrseq = <&wifi_pwrseq>;
 	bus-width = <4>;
 	non-removable;
 	status = "okay";
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 380/639] clk: meson: gxbb: no spread spectrum on mpll0
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (378 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.19 379/639] ARM: dts: sun8i-h3: Fix wifi in Beelink X2 DT Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.19 381/639] clk: meson: axg: spread spectrum is on mpll2 Greg Kroah-Hartman
                   ` (262 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jerome Brunet, Sasha Levin

From: Jerome Brunet <jbrunet@baylibre.com>

[ Upstream commit 8925dbd03bb29b1b0de30ac4e02c18faf8ddc9db ]

The documentation says there is an SSEN bit on mpll0 but, after testing
it, no spread spectrum function appears to be enabled by this bit on any
of the MPLLs.

Let's remove it until we know more

Fixes: 1f737ffa13ef ("clk: meson: mpll: fix mpll0 fractional part ignored")
Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/meson/gxbb.c | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/drivers/clk/meson/gxbb.c b/drivers/clk/meson/gxbb.c
index b039909e03cf8..38ffa51a5bade 100644
--- a/drivers/clk/meson/gxbb.c
+++ b/drivers/clk/meson/gxbb.c
@@ -650,11 +650,6 @@ static struct clk_regmap gxbb_mpll0_div = {
 			.shift   = 16,
 			.width   = 9,
 		},
-		.ssen = {
-			.reg_off = HHI_MPLL_CNTL,
-			.shift   = 25,
-			.width	 = 1,
-		},
 		.lock = &meson_clk_lock,
 	},
 	.hw.init = &(struct clk_init_data){
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 381/639] clk: meson: axg: spread spectrum is on mpll2
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (379 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.19 380/639] clk: meson: gxbb: no spread spectrum on mpll0 Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.19 382/639] dmaengine: tegra210-adma: Fix crash during probe Greg Kroah-Hartman
                   ` (261 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jerome Brunet, Sasha Levin

From: Jerome Brunet <jbrunet@baylibre.com>

[ Upstream commit dc4e62d373f881cbf51513296a6db7806516a01a ]

After testing, it appears that the SSEN bit controls the spread
spectrum function on MPLL2, not MPLL0.

Fixes: 78b4af312f91 ("clk: meson-axg: add clock controller drivers")
Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/meson/axg.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/clk/meson/axg.c b/drivers/clk/meson/axg.c
index 02229d051d778..4e7dac24948b8 100644
--- a/drivers/clk/meson/axg.c
+++ b/drivers/clk/meson/axg.c
@@ -461,11 +461,6 @@ static struct clk_regmap axg_mpll0_div = {
 			.shift   = 16,
 			.width   = 9,
 		},
-		.ssen = {
-			.reg_off = HHI_MPLL_CNTL,
-			.shift   = 25,
-			.width	 = 1,
-		},
 		.misc = {
 			.reg_off = HHI_PLL_TOP_MISC,
 			.shift   = 0,
@@ -560,6 +555,11 @@ static struct clk_regmap axg_mpll2_div = {
 			.shift   = 16,
 			.width   = 9,
 		},
+		.ssen = {
+			.reg_off = HHI_MPLL_CNTL,
+			.shift   = 25,
+			.width	 = 1,
+		},
 		.misc = {
 			.reg_off = HHI_PLL_TOP_MISC,
 			.shift   = 2,
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 382/639] dmaengine: tegra210-adma: Fix crash during probe
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (380 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.19 381/639] clk: meson: axg: spread spectrum is on mpll2 Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.19 383/639] arm64: dts: meson: libretech-cc: set eMMC as removable Greg Kroah-Hartman
                   ` (260 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jon Hunter, Vinod Koul, Sasha Levin

From: Jon Hunter <jonathanh@nvidia.com>

[ Upstream commit b53611fb1ce9b1786bd18205473e0c1d6bfa8934 ]

Commit f33e7bb3eb92 ("dmaengine: tegra210-adma: restore channel status")
added support to save and restore the DMA channel registers when runtime
suspending the ADMA. This change is causing the kernel to crash when
probing the ADMA, if the device is probed deferred when looking up the
channel interrupts. The crash occurs because not all of the channel base
addresses have been setup at this point and in the clean-up path of the
probe, pm_runtime_suspend() is called invoking its callback which
expects all the channel base addresses to be initialised.

Although this could be fixed by simply checking for a NULL address, on
further review of the driver it seems more appropriate that we only call
pm_runtime_get_sync() after all the channel interrupts and base
addresses have been configured. Therefore, fix this crash by moving the
calls to pm_runtime_enable(), pm_runtime_get_sync() and
tegra_adma_init() after the DMA channels have been initialised.

Fixes: f33e7bb3eb92 ("dmaengine: tegra210-adma: restore channel status")

Signed-off-by: Jon Hunter <jonathanh@nvidia.com>
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/dma/tegra210-adma.c | 26 +++++++++++++-------------
 1 file changed, 13 insertions(+), 13 deletions(-)

diff --git a/drivers/dma/tegra210-adma.c b/drivers/dma/tegra210-adma.c
index ac2a6b800db3e..4f4733d831a1a 100644
--- a/drivers/dma/tegra210-adma.c
+++ b/drivers/dma/tegra210-adma.c
@@ -744,16 +744,6 @@ static int tegra_adma_probe(struct platform_device *pdev)
 		return PTR_ERR(tdma->ahub_clk);
 	}
 
-	pm_runtime_enable(&pdev->dev);
-
-	ret = pm_runtime_get_sync(&pdev->dev);
-	if (ret < 0)
-		goto rpm_disable;
-
-	ret = tegra_adma_init(tdma);
-	if (ret)
-		goto rpm_put;
-
 	INIT_LIST_HEAD(&tdma->dma_dev.channels);
 	for (i = 0; i < tdma->nr_channels; i++) {
 		struct tegra_adma_chan *tdc = &tdma->channels[i];
@@ -771,6 +761,16 @@ static int tegra_adma_probe(struct platform_device *pdev)
 		tdc->tdma = tdma;
 	}
 
+	pm_runtime_enable(&pdev->dev);
+
+	ret = pm_runtime_get_sync(&pdev->dev);
+	if (ret < 0)
+		goto rpm_disable;
+
+	ret = tegra_adma_init(tdma);
+	if (ret)
+		goto rpm_put;
+
 	dma_cap_set(DMA_SLAVE, tdma->dma_dev.cap_mask);
 	dma_cap_set(DMA_PRIVATE, tdma->dma_dev.cap_mask);
 	dma_cap_set(DMA_CYCLIC, tdma->dma_dev.cap_mask);
@@ -812,13 +812,13 @@ static int tegra_adma_probe(struct platform_device *pdev)
 
 dma_remove:
 	dma_async_device_unregister(&tdma->dma_dev);
-irq_dispose:
-	while (--i >= 0)
-		irq_dispose_mapping(tdma->channels[i].irq);
 rpm_put:
 	pm_runtime_put_sync(&pdev->dev);
 rpm_disable:
 	pm_runtime_disable(&pdev->dev);
+irq_dispose:
+	while (--i >= 0)
+		irq_dispose_mapping(tdma->channels[i].irq);
 
 	return ret;
 }
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 383/639] arm64: dts: meson: libretech-cc: set eMMC as removable
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (381 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.19 382/639] dmaengine: tegra210-adma: Fix crash during probe Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.19 384/639] RDMA/qedr: Fix incorrect device rate Greg Kroah-Hartman
                   ` (259 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jerome Brunet, Martin Blumenstingl,
	Kevin Hilman, Sasha Levin

From: Jerome Brunet <jbrunet@baylibre.com>

[ Upstream commit 9f72e321d5506fe3e162a6308a4a295d7f10bb5d ]

The eMMC on this board is add-on module which is not mandatory. Removing
'non-removable' property should prevent some errors when booting a board
w/o an eMMC module present.

Fixes: 72fb2c852188 ("ARM64: dts: meson-gxl-s905x-libretech-cc: fixup board definition")
Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
Reviewed-by: Martin Blumenstingl<martin.blumenstingl@googlemail.com>
Signed-off-by: Kevin Hilman <khilman@baylibre.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts | 1 -
 1 file changed, 1 deletion(-)

diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts
index db293440e4cae..daad007fac1f6 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts
@@ -256,7 +256,6 @@
 	cap-mmc-highspeed;
 	mmc-ddr-3_3v;
 	max-frequency = <50000000>;
-	non-removable;
 	disable-wp;
 
 	mmc-pwrseq = <&emmc_pwrseq>;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 384/639] RDMA/qedr: Fix incorrect device rate.
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (382 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.19 383/639] arm64: dts: meson: libretech-cc: set eMMC as removable Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.19 385/639] spi: spi-fsl-spi: call spi_finalize_current_message() at the end Greg Kroah-Hartman
                   ` (258 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sagiv Ozeri, Michal Kalderon,
	Jason Gunthorpe, Sasha Levin

From: Sagiv Ozeri <sagiv.ozeri@marvell.com>

[ Upstream commit 69054666df0a9b4e8331319f98b6b9a88bc3fcc4 ]

Use the correct enum value introduced in commit 12113a35ada6 ("IB/core:
Add HDR speed enum") Prior to this change a 50Gbps port would show 40Gbps.

This patch also cleaned up the redundant redefiniton of ib speeds for
qedr.

Fixes: 12113a35ada6 ("IB/core: Add HDR speed enum")
Signed-off-by: Sagiv Ozeri <sagiv.ozeri@marvell.com>
Signed-off-by: Michal Kalderon <michal.kalderon@marvell.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/hw/qedr/verbs.c | 25 +++++++++----------------
 1 file changed, 9 insertions(+), 16 deletions(-)

diff --git a/drivers/infiniband/hw/qedr/verbs.c b/drivers/infiniband/hw/qedr/verbs.c
index 8fd8b97348bfe..38fe2f7413757 100644
--- a/drivers/infiniband/hw/qedr/verbs.c
+++ b/drivers/infiniband/hw/qedr/verbs.c
@@ -158,54 +158,47 @@ int qedr_query_device(struct ib_device *ibdev,
 	return 0;
 }
 
-#define QEDR_SPEED_SDR		(1)
-#define QEDR_SPEED_DDR		(2)
-#define QEDR_SPEED_QDR		(4)
-#define QEDR_SPEED_FDR10	(8)
-#define QEDR_SPEED_FDR		(16)
-#define QEDR_SPEED_EDR		(32)
-
 static inline void get_link_speed_and_width(int speed, u8 *ib_speed,
 					    u8 *ib_width)
 {
 	switch (speed) {
 	case 1000:
-		*ib_speed = QEDR_SPEED_SDR;
+		*ib_speed = IB_SPEED_SDR;
 		*ib_width = IB_WIDTH_1X;
 		break;
 	case 10000:
-		*ib_speed = QEDR_SPEED_QDR;
+		*ib_speed = IB_SPEED_QDR;
 		*ib_width = IB_WIDTH_1X;
 		break;
 
 	case 20000:
-		*ib_speed = QEDR_SPEED_DDR;
+		*ib_speed = IB_SPEED_DDR;
 		*ib_width = IB_WIDTH_4X;
 		break;
 
 	case 25000:
-		*ib_speed = QEDR_SPEED_EDR;
+		*ib_speed = IB_SPEED_EDR;
 		*ib_width = IB_WIDTH_1X;
 		break;
 
 	case 40000:
-		*ib_speed = QEDR_SPEED_QDR;
+		*ib_speed = IB_SPEED_QDR;
 		*ib_width = IB_WIDTH_4X;
 		break;
 
 	case 50000:
-		*ib_speed = QEDR_SPEED_QDR;
-		*ib_width = IB_WIDTH_4X;
+		*ib_speed = IB_SPEED_HDR;
+		*ib_width = IB_WIDTH_1X;
 		break;
 
 	case 100000:
-		*ib_speed = QEDR_SPEED_EDR;
+		*ib_speed = IB_SPEED_EDR;
 		*ib_width = IB_WIDTH_4X;
 		break;
 
 	default:
 		/* Unsupported */
-		*ib_speed = QEDR_SPEED_SDR;
+		*ib_speed = IB_SPEED_SDR;
 		*ib_width = IB_WIDTH_1X;
 	}
 }
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 385/639] spi: spi-fsl-spi: call spi_finalize_current_message() at the end
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (383 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.19 384/639] RDMA/qedr: Fix incorrect device rate Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.19 386/639] crypto: ccp - fix AES CFB error exposed by new test vectors Greg Kroah-Hartman
                   ` (257 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christophe Leroy, Mark Brown, Sasha Levin

From: Christophe Leroy <christophe.leroy@c-s.fr>

[ Upstream commit 44a042182cb1e9f7916e015c836967bf638b33c4 ]

spi_finalize_current_message() shall be called once all
actions are finished, otherwise the last actions might
step over a newly started transfer.

Fixes: c592becbe704 ("spi: fsl-(e)spi: migrate to generic master queueing")
Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-fsl-spi.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/spi/spi-fsl-spi.c b/drivers/spi/spi-fsl-spi.c
index 8b79e36fab21c..cd784552de7f1 100644
--- a/drivers/spi/spi-fsl-spi.c
+++ b/drivers/spi/spi-fsl-spi.c
@@ -407,7 +407,6 @@ static int fsl_spi_do_one_msg(struct spi_master *master,
 	}
 
 	m->status = status;
-	spi_finalize_current_message(master);
 
 	if (status || !cs_change) {
 		ndelay(nsecs);
@@ -415,6 +414,7 @@ static int fsl_spi_do_one_msg(struct spi_master *master,
 	}
 
 	fsl_spi_setup_transfer(spi, NULL);
+	spi_finalize_current_message(master);
 	return 0;
 }
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 386/639] crypto: ccp - fix AES CFB error exposed by new test vectors
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (384 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.19 385/639] spi: spi-fsl-spi: call spi_finalize_current_message() at the end Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.19 387/639] crypto: ccp - Fix 3DES complaint from ccp-crypto module Greg Kroah-Hartman
                   ` (256 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Gary R Hook, Herbert Xu, Sasha Levin

From: Hook, Gary <Gary.Hook@amd.com>

[ Upstream commit c3b359d6567c0b8f413e924feb37cf025067d55a ]

Updated testmgr will exhibit this error message when loading the
ccp-crypto module:

alg: skcipher: cfb-aes-ccp encryption failed with err -22 on test vector 3, cfg="in-place"

Update the CCP crypto driver to correctly treat CFB as a streaming mode
cipher (instead of block mode). Update the configuration for CFB to
specify the block size as a single byte;

Fixes: 2b789435d7f3 ('crypto: ccp - CCP AES crypto API support')

Signed-off-by: Gary R Hook <gary.hook@amd.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/ccp/ccp-crypto-aes.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/crypto/ccp/ccp-crypto-aes.c b/drivers/crypto/ccp/ccp-crypto-aes.c
index 89291c15015cd..3f768699332ba 100644
--- a/drivers/crypto/ccp/ccp-crypto-aes.c
+++ b/drivers/crypto/ccp/ccp-crypto-aes.c
@@ -1,7 +1,8 @@
+// SPDX-License-Identifier: GPL-2.0
 /*
  * AMD Cryptographic Coprocessor (CCP) AES crypto API support
  *
- * Copyright (C) 2013,2016 Advanced Micro Devices, Inc.
+ * Copyright (C) 2013-2019 Advanced Micro Devices, Inc.
  *
  * Author: Tom Lendacky <thomas.lendacky@amd.com>
  *
@@ -79,8 +80,7 @@ static int ccp_aes_crypt(struct ablkcipher_request *req, bool encrypt)
 		return -EINVAL;
 
 	if (((ctx->u.aes.mode == CCP_AES_MODE_ECB) ||
-	     (ctx->u.aes.mode == CCP_AES_MODE_CBC) ||
-	     (ctx->u.aes.mode == CCP_AES_MODE_CFB)) &&
+	     (ctx->u.aes.mode == CCP_AES_MODE_CBC)) &&
 	    (req->nbytes & (AES_BLOCK_SIZE - 1)))
 		return -EINVAL;
 
@@ -291,7 +291,7 @@ static struct ccp_aes_def aes_algs[] = {
 		.version	= CCP_VERSION(3, 0),
 		.name		= "cfb(aes)",
 		.driver_name	= "cfb-aes-ccp",
-		.blocksize	= AES_BLOCK_SIZE,
+		.blocksize	= 1,
 		.ivsize		= AES_BLOCK_SIZE,
 		.alg_defaults	= &ccp_aes_defaults,
 	},
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 387/639] crypto: ccp - Fix 3DES complaint from ccp-crypto module
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (385 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.19 386/639] crypto: ccp - fix AES CFB error exposed by new test vectors Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.19 388/639] serial: stm32: fix word length configuration Greg Kroah-Hartman
                   ` (255 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Gary R Hook, Herbert Xu, Sasha Levin

From: Hook, Gary <Gary.Hook@amd.com>

[ Upstream commit 89646fdda4cae203185444ac7988835f36a21ee1 ]

Crypto self-tests reveal an error:

alg: skcipher: cbc-des3-ccp encryption test failed (wrong output IV) on test vector 0, cfg="in-place"

The offset value should not be recomputed when retrieving the context.
Also, a code path exists which makes decisions based on older (version 3)
hardware; a v3 device deosn't support 3DES so remove this check.

Fixes: 990672d48515 ('crypto: ccp - Enable 3DES function on v5 CCPs')

Signed-off-by: Gary R Hook <gary.hook@amd.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/ccp/ccp-ops.c | 15 ++++-----------
 1 file changed, 4 insertions(+), 11 deletions(-)

diff --git a/drivers/crypto/ccp/ccp-ops.c b/drivers/crypto/ccp/ccp-ops.c
index 1e2e42106dee0..4b48b8523a40c 100644
--- a/drivers/crypto/ccp/ccp-ops.c
+++ b/drivers/crypto/ccp/ccp-ops.c
@@ -1293,6 +1293,9 @@ static int ccp_run_des3_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
 	int ret;
 
 	/* Error checks */
+	if (cmd_q->ccp->vdata->version < CCP_VERSION(5, 0))
+		return -EINVAL;
+
 	if (!cmd_q->ccp->vdata->perform->des3)
 		return -EINVAL;
 
@@ -1375,8 +1378,6 @@ static int ccp_run_des3_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
 	 * passthru option to convert from big endian to little endian.
 	 */
 	if (des3->mode != CCP_DES3_MODE_ECB) {
-		u32 load_mode;
-
 		op.sb_ctx = cmd_q->sb_ctx;
 
 		ret = ccp_init_dm_workarea(&ctx, cmd_q,
@@ -1392,12 +1393,8 @@ static int ccp_run_des3_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
 		if (ret)
 			goto e_ctx;
 
-		if (cmd_q->ccp->vdata->version == CCP_VERSION(3, 0))
-			load_mode = CCP_PASSTHRU_BYTESWAP_NOOP;
-		else
-			load_mode = CCP_PASSTHRU_BYTESWAP_256BIT;
 		ret = ccp_copy_to_sb(cmd_q, &ctx, op.jobid, op.sb_ctx,
-				     load_mode);
+				     CCP_PASSTHRU_BYTESWAP_256BIT);
 		if (ret) {
 			cmd->engine_error = cmd_q->cmd_error;
 			goto e_ctx;
@@ -1459,10 +1456,6 @@ static int ccp_run_des3_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
 		}
 
 		/* ...but we only need the last DES3_EDE_BLOCK_SIZE bytes */
-		if (cmd_q->ccp->vdata->version == CCP_VERSION(3, 0))
-			dm_offset = CCP_SB_BYTES - des3->iv_len;
-		else
-			dm_offset = 0;
 		ccp_get_dm_area(&ctx, dm_offset, des3->iv, 0,
 				DES3_EDE_BLOCK_SIZE);
 	}
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 388/639] serial: stm32: fix word length configuration
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (386 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.19 387/639] crypto: ccp - Fix 3DES complaint from ccp-crypto module Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.19 389/639] serial: stm32: fix rx error handling Greg Kroah-Hartman
                   ` (254 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Erwan Le Ray, Sasha Levin

From: Erwan Le Ray <erwan.leray@st.com>

[ Upstream commit c8a9d043947b4acb19a65f7fac2bd0893e581cd5 ]

STM32 supports either:
- 8 and 9 bits word length (including parity bit) for stm32f4 compatible
  devices
- 7, 8 and 9 bits word length (including parity bit) for stm32f7 and
  stm32h7 compatible devices.

As a consequence STM32 supports the following termios configurations:
- CS7 with parity bit, and CS8 (with or without parity bit) for stm32f4
  compatible devices.
- CS6 with parity bit, CS7 and CS8 (with or without parity bit) for
  stm32f7 and stm32h7 compatible devices.

This patch is fixing word length by configuring correctly the SoC with
supported configurations.

Fixes: ada8618ff3bf ("serial: stm32: adding support for stm32f7")
Signed-off-by: Erwan Le Ray <erwan.leray@st.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/serial/stm32-usart.c | 56 ++++++++++++++++++++++++++++----
 drivers/tty/serial/stm32-usart.h |  3 +-
 2 files changed, 50 insertions(+), 9 deletions(-)

diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c
index e8d7a7bb4339e..e8321850938af 100644
--- a/drivers/tty/serial/stm32-usart.c
+++ b/drivers/tty/serial/stm32-usart.c
@@ -599,6 +599,36 @@ static void stm32_shutdown(struct uart_port *port)
 	free_irq(port->irq, port);
 }
 
+unsigned int stm32_get_databits(struct ktermios *termios)
+{
+	unsigned int bits;
+
+	tcflag_t cflag = termios->c_cflag;
+
+	switch (cflag & CSIZE) {
+	/*
+	 * CSIZE settings are not necessarily supported in hardware.
+	 * CSIZE unsupported configurations are handled here to set word length
+	 * to 8 bits word as default configuration and to print debug message.
+	 */
+	case CS5:
+		bits = 5;
+		break;
+	case CS6:
+		bits = 6;
+		break;
+	case CS7:
+		bits = 7;
+		break;
+	/* default including CS8 */
+	default:
+		bits = 8;
+		break;
+	}
+
+	return bits;
+}
+
 static void stm32_set_termios(struct uart_port *port, struct ktermios *termios,
 			    struct ktermios *old)
 {
@@ -606,7 +636,7 @@ static void stm32_set_termios(struct uart_port *port, struct ktermios *termios,
 	struct stm32_usart_offsets *ofs = &stm32_port->info->ofs;
 	struct stm32_usart_config *cfg = &stm32_port->info->cfg;
 	struct serial_rs485 *rs485conf = &port->rs485;
-	unsigned int baud;
+	unsigned int baud, bits;
 	u32 usartdiv, mantissa, fraction, oversampling;
 	tcflag_t cflag = termios->c_cflag;
 	u32 cr1, cr2, cr3;
@@ -632,16 +662,28 @@ static void stm32_set_termios(struct uart_port *port, struct ktermios *termios,
 	if (cflag & CSTOPB)
 		cr2 |= USART_CR2_STOP_2B;
 
+	bits = stm32_get_databits(termios);
+
 	if (cflag & PARENB) {
+		bits++;
 		cr1 |= USART_CR1_PCE;
-		if ((cflag & CSIZE) == CS8) {
-			if (cfg->has_7bits_data)
-				cr1 |= USART_CR1_M0;
-			else
-				cr1 |= USART_CR1_M;
-		}
 	}
 
+	/*
+	 * Word length configuration:
+	 * CS8 + parity, 9 bits word aka [M1:M0] = 0b01
+	 * CS7 or (CS6 + parity), 7 bits word aka [M1:M0] = 0b10
+	 * CS8 or (CS7 + parity), 8 bits word aka [M1:M0] = 0b00
+	 * M0 and M1 already cleared by cr1 initialization.
+	 */
+	if (bits == 9)
+		cr1 |= USART_CR1_M0;
+	else if ((bits == 7) && cfg->has_7bits_data)
+		cr1 |= USART_CR1_M1;
+	else if (bits != 8)
+		dev_dbg(port->dev, "Unsupported data bits config: %u bits\n"
+			, bits);
+
 	if (cflag & PARODD)
 		cr1 |= USART_CR1_PS;
 
diff --git a/drivers/tty/serial/stm32-usart.h b/drivers/tty/serial/stm32-usart.h
index 6f294e280ea30..a70aa5006ab97 100644
--- a/drivers/tty/serial/stm32-usart.h
+++ b/drivers/tty/serial/stm32-usart.h
@@ -151,8 +151,7 @@ struct stm32_usart_info stm32h7_info = {
 #define USART_CR1_PS		BIT(9)
 #define USART_CR1_PCE		BIT(10)
 #define USART_CR1_WAKE		BIT(11)
-#define USART_CR1_M		BIT(12)
-#define USART_CR1_M0		BIT(12)		/* F7 */
+#define USART_CR1_M0		BIT(12)		/* F7 (CR1_M for F4) */
 #define USART_CR1_MME		BIT(13)		/* F7 */
 #define USART_CR1_CMIE		BIT(14)		/* F7 */
 #define USART_CR1_OVER8		BIT(15)
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 389/639] serial: stm32: fix rx error handling
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (387 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.19 388/639] serial: stm32: fix word length configuration Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.19 390/639] serial: stm32: fix rx data length when parity enabled Greg Kroah-Hartman
                   ` (253 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Erwan Le Ray, Sasha Levin

From: Erwan Le Ray <erwan.leray@st.com>

[ Upstream commit 4f01d833fdcdd6f9b85d9e5d5d7568eb683626a7 ]

- Fixes parity and framing error bit by clearing parity and framing error
  flag. The current implementation doesn't clear the error bits when an
  error is detected.
- Fixes the incorrect name of framing error clearing flag in header file.
- Fixes misalignement between data frame and errors status. The status
  read for "n" frame was the status of "n+1" frame".
- Fixes break detection was not triggered by the expected register.

Fixes: 48a6092fb41f ("serial: stm32-usart: Add STM32 USART Driver")
Signed-off-by: Erwan Le Ray <erwan.leray@st.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/serial/stm32-usart.c | 54 +++++++++++++++++++++-----------
 drivers/tty/serial/stm32-usart.h | 10 ++----
 2 files changed, 37 insertions(+), 27 deletions(-)

diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c
index e8321850938af..f6b739351ddec 100644
--- a/drivers/tty/serial/stm32-usart.c
+++ b/drivers/tty/serial/stm32-usart.c
@@ -225,35 +225,51 @@ static void stm32_receive_chars(struct uart_port *port, bool threaded)
 
 	while (stm32_pending_rx(port, &sr, &stm32_port->last_res, threaded)) {
 		sr |= USART_SR_DUMMY_RX;
-		c = stm32_get_char(port, &sr, &stm32_port->last_res);
 		flag = TTY_NORMAL;
-		port->icount.rx++;
 
+		/*
+		 * Status bits has to be cleared before reading the RDR:
+		 * In FIFO mode, reading the RDR will pop the next data
+		 * (if any) along with its status bits into the SR.
+		 * Not doing so leads to misalignement between RDR and SR,
+		 * and clear status bits of the next rx data.
+		 *
+		 * Clear errors flags for stm32f7 and stm32h7 compatible
+		 * devices. On stm32f4 compatible devices, the error bit is
+		 * cleared by the sequence [read SR - read DR].
+		 */
+		if ((sr & USART_SR_ERR_MASK) && ofs->icr != UNDEF_REG)
+			stm32_clr_bits(port, ofs->icr, USART_ICR_ORECF |
+				       USART_ICR_PECF | USART_ICR_FECF);
+
+		c = stm32_get_char(port, &sr, &stm32_port->last_res);
+		port->icount.rx++;
 		if (sr & USART_SR_ERR_MASK) {
-			if (sr & USART_SR_LBD) {
-				port->icount.brk++;
-				if (uart_handle_break(port))
-					continue;
-			} else if (sr & USART_SR_ORE) {
-				if (ofs->icr != UNDEF_REG)
-					writel_relaxed(USART_ICR_ORECF,
-						       port->membase +
-						       ofs->icr);
+			if (sr & USART_SR_ORE) {
 				port->icount.overrun++;
 			} else if (sr & USART_SR_PE) {
 				port->icount.parity++;
 			} else if (sr & USART_SR_FE) {
-				port->icount.frame++;
+				/* Break detection if character is null */
+				if (!c) {
+					port->icount.brk++;
+					if (uart_handle_break(port))
+						continue;
+				} else {
+					port->icount.frame++;
+				}
 			}
 
 			sr &= port->read_status_mask;
 
-			if (sr & USART_SR_LBD)
-				flag = TTY_BREAK;
-			else if (sr & USART_SR_PE)
+			if (sr & USART_SR_PE) {
 				flag = TTY_PARITY;
-			else if (sr & USART_SR_FE)
-				flag = TTY_FRAME;
+			} else if (sr & USART_SR_FE) {
+				if (!c)
+					flag = TTY_BREAK;
+				else
+					flag = TTY_FRAME;
+			}
 		}
 
 		if (uart_handle_sysrq_char(port, c))
@@ -721,14 +737,14 @@ static void stm32_set_termios(struct uart_port *port, struct ktermios *termios,
 	if (termios->c_iflag & INPCK)
 		port->read_status_mask |= USART_SR_PE | USART_SR_FE;
 	if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
-		port->read_status_mask |= USART_SR_LBD;
+		port->read_status_mask |= USART_SR_FE;
 
 	/* Characters to ignore */
 	port->ignore_status_mask = 0;
 	if (termios->c_iflag & IGNPAR)
 		port->ignore_status_mask = USART_SR_PE | USART_SR_FE;
 	if (termios->c_iflag & IGNBRK) {
-		port->ignore_status_mask |= USART_SR_LBD;
+		port->ignore_status_mask |= USART_SR_FE;
 		/*
 		 * If we're ignoring parity and break indicators,
 		 * ignore overruns too (for real raw support).
diff --git a/drivers/tty/serial/stm32-usart.h b/drivers/tty/serial/stm32-usart.h
index a70aa5006ab97..8d34802e572ed 100644
--- a/drivers/tty/serial/stm32-usart.h
+++ b/drivers/tty/serial/stm32-usart.h
@@ -108,7 +108,6 @@ struct stm32_usart_info stm32h7_info = {
 #define USART_SR_RXNE		BIT(5)
 #define USART_SR_TC		BIT(6)
 #define USART_SR_TXE		BIT(7)
-#define USART_SR_LBD		BIT(8)
 #define USART_SR_CTSIF		BIT(9)
 #define USART_SR_CTS		BIT(10)		/* F7 */
 #define USART_SR_RTOF		BIT(11)		/* F7 */
@@ -120,8 +119,7 @@ struct stm32_usart_info stm32h7_info = {
 #define USART_SR_SBKF		BIT(18)		/* F7 */
 #define USART_SR_WUF		BIT(20)		/* H7 */
 #define USART_SR_TEACK		BIT(21)		/* F7 */
-#define USART_SR_ERR_MASK	(USART_SR_LBD | USART_SR_ORE | \
-				 USART_SR_FE | USART_SR_PE)
+#define USART_SR_ERR_MASK	(USART_SR_ORE | USART_SR_FE | USART_SR_PE)
 /* Dummy bits */
 #define USART_SR_DUMMY_RX	BIT(16)
 
@@ -168,8 +166,6 @@ struct stm32_usart_info stm32h7_info = {
 /* USART_CR2 */
 #define USART_CR2_ADD_MASK	GENMASK(3, 0)	/* F4 */
 #define USART_CR2_ADDM7		BIT(4)		/* F7 */
-#define USART_CR2_LBDL		BIT(5)
-#define USART_CR2_LBDIE		BIT(6)
 #define USART_CR2_LBCL		BIT(8)
 #define USART_CR2_CPHA		BIT(9)
 #define USART_CR2_CPOL		BIT(10)
@@ -226,12 +222,10 @@ struct stm32_usart_info stm32h7_info = {
 
 /* USART_ICR */
 #define USART_ICR_PECF		BIT(0)		/* F7 */
-#define USART_ICR_FFECF		BIT(1)		/* F7 */
-#define USART_ICR_NCF		BIT(2)		/* F7 */
+#define USART_ICR_FECF		BIT(1)		/* F7 */
 #define USART_ICR_ORECF		BIT(3)		/* F7 */
 #define USART_ICR_IDLECF	BIT(4)		/* F7 */
 #define USART_ICR_TCCF		BIT(6)		/* F7 */
-#define USART_ICR_LBDCF		BIT(8)		/* F7 */
 #define USART_ICR_CTSCF		BIT(9)		/* F7 */
 #define USART_ICR_RTOCF		BIT(11)		/* F7 */
 #define USART_ICR_EOBCF		BIT(12)		/* F7 */
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 390/639] serial: stm32: fix rx data length when parity enabled
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (388 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.19 389/639] serial: stm32: fix rx error handling Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.19 391/639] serial: stm32: fix transmit_chars when tx is stopped Greg Kroah-Hartman
                   ` (252 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Erwan Le Ray, Sasha Levin

From: Erwan Le Ray <erwan.leray@st.com>

[ Upstream commit 6c5962f30bce147b1c83869085f3ddde3b34c9e3 ]

- Fixes a rx data error when data length < 8 bits and parity is enabled.
RDR register MSB is used for parity bit reception.
- Adds a mask to ignore MSB when data is get from RDR.

Fixes: 3489187204eb ("serial: stm32: adding dma support")
Signed-off-by: Erwan Le Ray <erwan.leray@st.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/serial/stm32-usart.c | 12 ++++++++----
 drivers/tty/serial/stm32-usart.h |  1 +
 2 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c
index f6b739351ddec..0a7953e5ce47a 100644
--- a/drivers/tty/serial/stm32-usart.c
+++ b/drivers/tty/serial/stm32-usart.c
@@ -194,8 +194,8 @@ static int stm32_pending_rx(struct uart_port *port, u32 *sr, int *last_res,
 	return 0;
 }
 
-static unsigned long
-stm32_get_char(struct uart_port *port, u32 *sr, int *last_res)
+static unsigned long stm32_get_char(struct uart_port *port, u32 *sr,
+				    int *last_res)
 {
 	struct stm32_port *stm32_port = to_stm32_port(port);
 	struct stm32_usart_offsets *ofs = &stm32_port->info->ofs;
@@ -205,10 +205,13 @@ stm32_get_char(struct uart_port *port, u32 *sr, int *last_res)
 		c = stm32_port->rx_buf[RX_BUF_L - (*last_res)--];
 		if ((*last_res) == 0)
 			*last_res = RX_BUF_L;
-		return c;
 	} else {
-		return readl_relaxed(port->membase + ofs->rdr);
+		c = readl_relaxed(port->membase + ofs->rdr);
+		/* apply RDR data mask */
+		c &= stm32_port->rdr_mask;
 	}
+
+	return c;
 }
 
 static void stm32_receive_chars(struct uart_port *port, bool threaded)
@@ -679,6 +682,7 @@ static void stm32_set_termios(struct uart_port *port, struct ktermios *termios,
 		cr2 |= USART_CR2_STOP_2B;
 
 	bits = stm32_get_databits(termios);
+	stm32_port->rdr_mask = (BIT(bits) - 1);
 
 	if (cflag & PARENB) {
 		bits++;
diff --git a/drivers/tty/serial/stm32-usart.h b/drivers/tty/serial/stm32-usart.h
index 8d34802e572ed..30d2433e27c3c 100644
--- a/drivers/tty/serial/stm32-usart.h
+++ b/drivers/tty/serial/stm32-usart.h
@@ -254,6 +254,7 @@ struct stm32_port {
 	bool hw_flow_control;
 	bool fifoen;
 	int wakeirq;
+	int rdr_mask;		/* receive data register mask */
 };
 
 static struct stm32_port stm32_ports[STM32_MAX_PORTS];
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 391/639] serial: stm32: fix transmit_chars when tx is stopped
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (389 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.19 390/639] serial: stm32: fix rx data length when parity enabled Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.19 392/639] serial: stm32: Add support of TC bit status check Greg Kroah-Hartman
                   ` (251 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Erwan Le Ray, Sasha Levin

From: Erwan Le Ray <erwan.leray@st.com>

[ Upstream commit b83b957c91f68e53f0dc596e129e8305761f2a32 ]

Disables the tx irq  when the transmission is ended and updates stop_tx
conditions for code cleanup.

Fixes: 48a6092fb41f ("serial: stm32-usart: Add STM32 USART Driver")
Signed-off-by: Erwan Le Ray <erwan.leray@st.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/serial/stm32-usart.c | 11 +++--------
 1 file changed, 3 insertions(+), 8 deletions(-)

diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c
index 0a7953e5ce47a..2e7757d5e5d83 100644
--- a/drivers/tty/serial/stm32-usart.c
+++ b/drivers/tty/serial/stm32-usart.c
@@ -420,13 +420,8 @@ static void stm32_transmit_chars(struct uart_port *port)
 		return;
 	}
 
-	if (uart_tx_stopped(port)) {
-		stm32_stop_tx(port);
-		return;
-	}
-
-	if (uart_circ_empty(xmit)) {
-		stm32_stop_tx(port);
+	if (uart_circ_empty(xmit) || uart_tx_stopped(port)) {
+		stm32_clr_bits(port, ofs->cr1, USART_CR1_TXEIE);
 		return;
 	}
 
@@ -439,7 +434,7 @@ static void stm32_transmit_chars(struct uart_port *port)
 		uart_write_wakeup(port);
 
 	if (uart_circ_empty(xmit))
-		stm32_stop_tx(port);
+		stm32_clr_bits(port, ofs->cr1, USART_CR1_TXEIE);
 }
 
 static irqreturn_t stm32_interrupt(int irq, void *ptr)
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 392/639] serial: stm32: Add support of TC bit status check
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (390 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.19 391/639] serial: stm32: fix transmit_chars when tx is stopped Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.19 393/639] serial: stm32: fix wakeup source initialization Greg Kroah-Hartman
                   ` (250 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Erwan Le Ray, Sasha Levin

From: Erwan Le Ray <erwan.leray@st.com>

[ Upstream commit 64c32eab660386f9904bb295a104c9c425e9f8b2 ]

Adds a check on the Transmission Complete bit status before closing the
com port. Prevents the port closure before the end of the transmission.
TC poll loop is moved from stm32_tx_dma_complete to stm32_shutdown
routine, in order to check TC before shutdown in both dma and
PIO tx modes.
TC clear is added in stm32_transmit_char routine, in order to be cleared
before transmitting in both dma and PIO tx modes.

Fixes: 3489187204eb ("serial: stm32: adding dma support")
Signed-off-by: Erwan Le Ray <erwan.leray@st.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/serial/stm32-usart.c | 32 +++++++++++++++-----------------
 1 file changed, 15 insertions(+), 17 deletions(-)

diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c
index 2e7757d5e5d83..d603be9669a96 100644
--- a/drivers/tty/serial/stm32-usart.c
+++ b/drivers/tty/serial/stm32-usart.c
@@ -290,21 +290,6 @@ static void stm32_tx_dma_complete(void *arg)
 	struct uart_port *port = arg;
 	struct stm32_port *stm32port = to_stm32_port(port);
 	struct stm32_usart_offsets *ofs = &stm32port->info->ofs;
-	unsigned int isr;
-	int ret;
-
-	ret = readl_relaxed_poll_timeout_atomic(port->membase + ofs->isr,
-						isr,
-						(isr & USART_SR_TC),
-						10, 100000);
-
-	if (ret)
-		dev_err(port->dev, "terminal count not set\n");
-
-	if (ofs->icr == UNDEF_REG)
-		stm32_clr_bits(port, ofs->isr, USART_SR_TC);
-	else
-		stm32_set_bits(port, ofs->icr, USART_CR_TC);
 
 	stm32_clr_bits(port, ofs->cr3, USART_CR3_DMAT);
 	stm32port->tx_dma_busy = false;
@@ -396,7 +381,6 @@ static void stm32_transmit_chars_dma(struct uart_port *port)
 	/* Issue pending DMA TX requests */
 	dma_async_issue_pending(stm32port->tx_ch);
 
-	stm32_clr_bits(port, ofs->isr, USART_SR_TC);
 	stm32_set_bits(port, ofs->cr3, USART_CR3_DMAT);
 
 	xmit->tail = (xmit->tail + count) & (UART_XMIT_SIZE - 1);
@@ -425,6 +409,11 @@ static void stm32_transmit_chars(struct uart_port *port)
 		return;
 	}
 
+	if (ofs->icr == UNDEF_REG)
+		stm32_clr_bits(port, ofs->isr, USART_SR_TC);
+	else
+		stm32_set_bits(port, ofs->icr, USART_ICR_TCCF);
+
 	if (stm32_port->tx_ch)
 		stm32_transmit_chars_dma(port);
 	else
@@ -601,12 +590,21 @@ static void stm32_shutdown(struct uart_port *port)
 	struct stm32_port *stm32_port = to_stm32_port(port);
 	struct stm32_usart_offsets *ofs = &stm32_port->info->ofs;
 	struct stm32_usart_config *cfg = &stm32_port->info->cfg;
-	u32 val;
+	u32 val, isr;
+	int ret;
 
 	val = USART_CR1_TXEIE | USART_CR1_RXNEIE | USART_CR1_TE | USART_CR1_RE;
 	val |= BIT(cfg->uart_enable_bit);
 	if (stm32_port->fifoen)
 		val |= USART_CR1_FIFOEN;
+
+	ret = readl_relaxed_poll_timeout(port->membase + ofs->isr,
+					 isr, (isr & USART_SR_TC),
+					 10, 100000);
+
+	if (ret)
+		dev_err(port->dev, "transmission complete not set\n");
+
 	stm32_clr_bits(port, ofs->cr1, val);
 
 	dev_pm_clear_wake_irq(port->dev);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 393/639] serial: stm32: fix wakeup source initialization
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (391 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.19 392/639] serial: stm32: Add support of TC bit status check Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.19 394/639] misc: sgi-xp: Properly initialize buf in xpc_get_rsvd_page_pa Greg Kroah-Hartman
                   ` (249 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Erwan Le Ray, Sasha Levin

From: Erwan Le Ray <erwan.leray@st.com>

[ Upstream commit 5297f274e8b61ceb9676cba6649d3de9d03387ad ]

Fixes dedicated_irq_wakeup issue and deactivated uart as wakeup source by
default.

Fixes: 270e5a74fe4c ("serial: stm32: add wakeup mechanism")
Signed-off-by: Erwan Le Ray <erwan.leray@st.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/serial/stm32-usart.c | 28 +++++++++++++++-------------
 1 file changed, 15 insertions(+), 13 deletions(-)

diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c
index d603be9669a96..1334e42939776 100644
--- a/drivers/tty/serial/stm32-usart.c
+++ b/drivers/tty/serial/stm32-usart.c
@@ -557,7 +557,6 @@ static int stm32_startup(struct uart_port *port)
 {
 	struct stm32_port *stm32_port = to_stm32_port(port);
 	struct stm32_usart_offsets *ofs = &stm32_port->info->ofs;
-	struct stm32_usart_config *cfg = &stm32_port->info->cfg;
 	const char *name = to_platform_device(port->dev)->name;
 	u32 val;
 	int ret;
@@ -568,15 +567,6 @@ static int stm32_startup(struct uart_port *port)
 	if (ret)
 		return ret;
 
-	if (cfg->has_wakeup && stm32_port->wakeirq >= 0) {
-		ret = dev_pm_set_dedicated_wake_irq(port->dev,
-						    stm32_port->wakeirq);
-		if (ret) {
-			free_irq(port->irq, port);
-			return ret;
-		}
-	}
-
 	val = USART_CR1_RXNEIE | USART_CR1_TE | USART_CR1_RE;
 	if (stm32_port->fifoen)
 		val |= USART_CR1_FIFOEN;
@@ -607,7 +597,6 @@ static void stm32_shutdown(struct uart_port *port)
 
 	stm32_clr_bits(port, ofs->cr1, val);
 
-	dev_pm_clear_wake_irq(port->dev);
 	free_irq(port->irq, port);
 }
 
@@ -1079,11 +1068,18 @@ static int stm32_serial_probe(struct platform_device *pdev)
 		ret = device_init_wakeup(&pdev->dev, true);
 		if (ret)
 			goto err_uninit;
+
+		ret = dev_pm_set_dedicated_wake_irq(&pdev->dev,
+						    stm32port->wakeirq);
+		if (ret)
+			goto err_nowup;
+
+		device_set_wakeup_enable(&pdev->dev, false);
 	}
 
 	ret = uart_add_one_port(&stm32_usart_driver, &stm32port->port);
 	if (ret)
-		goto err_nowup;
+		goto err_wirq;
 
 	ret = stm32_of_dma_rx_probe(stm32port, pdev);
 	if (ret)
@@ -1097,6 +1093,10 @@ static int stm32_serial_probe(struct platform_device *pdev)
 
 	return 0;
 
+err_wirq:
+	if (stm32port->info->cfg.has_wakeup && stm32port->wakeirq >= 0)
+		dev_pm_clear_wake_irq(&pdev->dev);
+
 err_nowup:
 	if (stm32port->info->cfg.has_wakeup && stm32port->wakeirq >= 0)
 		device_init_wakeup(&pdev->dev, false);
@@ -1134,8 +1134,10 @@ static int stm32_serial_remove(struct platform_device *pdev)
 				  TX_BUF_L, stm32_port->tx_buf,
 				  stm32_port->tx_dma_buf);
 
-	if (cfg->has_wakeup && stm32_port->wakeirq >= 0)
+	if (cfg->has_wakeup && stm32_port->wakeirq >= 0) {
+		dev_pm_clear_wake_irq(&pdev->dev);
 		device_init_wakeup(&pdev->dev, false);
+	}
 
 	clk_disable_unprepare(stm32_port->clk);
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 394/639] misc: sgi-xp: Properly initialize buf in xpc_get_rsvd_page_pa
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (392 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.19 393/639] serial: stm32: fix wakeup source initialization Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.19 395/639] PCI: PM: Avoid possible suspend-to-idle issue Greg Kroah-Hartman
                   ` (248 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Stephen Hines, Arnd Bergmann,
	Nick Desaulniers, Nathan Chancellor, Sasha Levin

From: Nathan Chancellor <natechancellor@gmail.com>

[ Upstream commit b0576f9ecb5c51e9932531d23c447b2739261841 ]

Clang warns:

drivers/misc/sgi-xp/xpc_partition.c:73:14: warning: variable 'buf' is
uninitialized when used within its own initialization [-Wuninitialized]
        void *buf = buf;
              ~~~   ^~~
1 warning generated.

Arnd's explanation during review:

  /*
   * Returns the physical address of the partition's reserved page through
   * an iterative number of calls.
   *
   * On first call, 'cookie' and 'len' should be set to 0, and 'addr'
   * set to the nasid of the partition whose reserved page's address is
   * being sought.
   * On subsequent calls, pass the values, that were passed back on the
   * previous call.
   *
   * While the return status equals SALRET_MORE_PASSES, keep calling
   * this function after first copying 'len' bytes starting at 'addr'
   * into 'buf'. Once the return status equals SALRET_OK, 'addr' will
   * be the physical address of the partition's reserved page. If the
   * return status equals neither of these, an error as occurred.
   */
  static inline s64
  sn_partition_reserved_page_pa(u64 buf, u64 *cookie, u64 *addr, u64 *len)

  so *len is set to zero on the first call and tells the bios how many
  bytes are accessible at 'buf', and it does get updated by the BIOS to
  tell us how many bytes it needs, and then we allocate that and try again.

Fixes: 279290294662 ("[IA64-SGI] cleanup the way XPC locates the reserved page")
Link: https://github.com/ClangBuiltLinux/linux/issues/466
Suggested-by: Stephen Hines <srhines@google.com>
Reviewed-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/misc/sgi-xp/xpc_partition.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/misc/sgi-xp/xpc_partition.c b/drivers/misc/sgi-xp/xpc_partition.c
index 0c3ef6f1df546..519826ba13786 100644
--- a/drivers/misc/sgi-xp/xpc_partition.c
+++ b/drivers/misc/sgi-xp/xpc_partition.c
@@ -70,7 +70,7 @@ xpc_get_rsvd_page_pa(int nasid)
 	unsigned long rp_pa = nasid;	/* seed with nasid */
 	size_t len = 0;
 	size_t buf_len = 0;
-	void *buf = buf;
+	void *buf = NULL;
 	void *buf_base = NULL;
 	enum xp_retval (*get_partition_rsvd_page_pa)
 		(void *, u64 *, unsigned long *, size_t *) =
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 395/639] PCI: PM: Avoid possible suspend-to-idle issue
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (393 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.19 394/639] misc: sgi-xp: Properly initialize buf in xpc_get_rsvd_page_pa Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.19 396/639] iommu: Add missing new line for dma type Greg Kroah-Hartman
                   ` (247 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Rafael J. Wysocki, Keith Busch,
	Mika Westerberg, Sasha Levin

From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>

[ Upstream commit d491f2b75237ef37d8867830ab7fad8d9659e853 ]

If a PCI driver leaves the device handled by it in D0 and calls
pci_save_state() on the device in its ->suspend() or ->suspend_late()
callback, it can expect the device to stay in D0 over the whole
s2idle cycle.  However, that may not be the case if there is a
spurious wakeup while the system is suspended, because in that case
pci_pm_suspend_noirq() will run again after pci_pm_resume_noirq()
which calls pci_restore_state(), via pci_pm_default_resume_early(),
so state_saved is cleared and the second iteration of
pci_pm_suspend_noirq() will invoke pci_prepare_to_sleep() which
may change the power state of the device.

To avoid that, add a new internal flag, skip_bus_pm, that will be set
by pci_pm_suspend_noirq() when it runs for the first time during the
given system suspend-resume cycle if the state of the device has
been saved already and the device is still in D0.  Setting that flag
will cause the next iterations of pci_pm_suspend_noirq() to set
state_saved for pci_pm_resume_noirq(), so that it always restores the
device state from the originally saved data, and avoid calling
pci_prepare_to_sleep() for the device.

Fixes: 33e4f80ee69b ("ACPI / PM: Ignore spurious SCI wakeups from suspend-to-idle")
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Reviewed-by: Keith Busch <keith.busch@intel.com>
Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/pci-driver.c | 17 ++++++++++++++++-
 include/linux/pci.h      |  1 +
 2 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c
index bc1ff41ce3d35..5c9873fcbd08b 100644
--- a/drivers/pci/pci-driver.c
+++ b/drivers/pci/pci-driver.c
@@ -736,6 +736,8 @@ static int pci_pm_suspend(struct device *dev)
 	struct pci_dev *pci_dev = to_pci_dev(dev);
 	const struct dev_pm_ops *pm = dev->driver ? dev->driver->pm : NULL;
 
+	pci_dev->skip_bus_pm = false;
+
 	if (pci_has_legacy_pm_support(pci_dev))
 		return pci_legacy_suspend(dev, PMSG_SUSPEND);
 
@@ -829,7 +831,20 @@ static int pci_pm_suspend_noirq(struct device *dev)
 		}
 	}
 
-	if (!pci_dev->state_saved) {
+	if (pci_dev->skip_bus_pm) {
+		/*
+		 * The function is running for the second time in a row without
+		 * going through full resume, which is possible only during
+		 * suspend-to-idle in a spurious wakeup case.  Moreover, the
+		 * device was originally left in D0, so its power state should
+		 * not be changed here and the device register values saved
+		 * originally should be restored on resume again.
+		 */
+		pci_dev->state_saved = true;
+	} else if (pci_dev->state_saved) {
+		if (pci_dev->current_state == PCI_D0)
+			pci_dev->skip_bus_pm = true;
+	} else {
 		pci_save_state(pci_dev);
 		if (pci_power_manageable(pci_dev))
 			pci_prepare_to_sleep(pci_dev);
diff --git a/include/linux/pci.h b/include/linux/pci.h
index b1f297f4b7b0b..94853094b6ef4 100644
--- a/include/linux/pci.h
+++ b/include/linux/pci.h
@@ -342,6 +342,7 @@ struct pci_dev {
 						   D3cold, not set for devices
 						   powered on/off by the
 						   corresponding bridge */
+	unsigned int	skip_bus_pm:1;	/* Internal: Skip bus-level PM */
 	unsigned int	ignore_hotplug:1;	/* Ignore hotplug events */
 	unsigned int	hotplug_user_indicators:1; /* SlotCtl indicators
 						      controlled exclusively by
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 396/639] iommu: Add missing new line for dma type
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (394 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.19 395/639] PCI: PM: Avoid possible suspend-to-idle issue Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.19 397/639] iommu: Use right function to get group for device Greg Kroah-Hartman
                   ` (246 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lu Baolu, Joerg Roedel, Sasha Levin

From: Lu Baolu <baolu.lu@linux.intel.com>

[ Upstream commit 24f307d8abf79486dd3c1b645037df7d91602aaa ]

So that all types are printed in the same format.

Fixes: c52c72d3dee81 ("iommu: Add sysfs attribyte for domain type")
Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iommu/iommu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c
index ee25ec22778ef..b82bec4224b91 100644
--- a/drivers/iommu/iommu.c
+++ b/drivers/iommu/iommu.c
@@ -317,7 +317,7 @@ static ssize_t iommu_group_show_type(struct iommu_group *group,
 			type = "unmanaged\n";
 			break;
 		case IOMMU_DOMAIN_DMA:
-			type = "DMA";
+			type = "DMA\n";
 			break;
 		}
 	}
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 397/639] iommu: Use right function to get group for device
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (395 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.19 396/639] iommu: Add missing new line for dma type Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.19 398/639] signal/bpfilter: Fix bpfilter_kernl to use send_sig not force_sig Greg Kroah-Hartman
                   ` (245 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lu Baolu, Joerg Roedel, Sasha Levin

From: Lu Baolu <baolu.lu@linux.intel.com>

[ Upstream commit 57274ea25736496ee019a5c40479855b21888839 ]

The iommu_group_get_for_dev() will allocate a group for a
device if it isn't in any group. This isn't the use case
in iommu_request_dm_for_dev(). Let's use iommu_group_get()
instead.

Fixes: d290f1e70d85a ("iommu: Introduce iommu_request_dm_for_dev()")
Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iommu/iommu.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c
index b82bec4224b91..00e1c908cd8e7 100644
--- a/drivers/iommu/iommu.c
+++ b/drivers/iommu/iommu.c
@@ -1900,9 +1900,9 @@ int iommu_request_dm_for_dev(struct device *dev)
 	int ret;
 
 	/* Device must already be in a group before calling this function */
-	group = iommu_group_get_for_dev(dev);
-	if (IS_ERR(group))
-		return PTR_ERR(group);
+	group = iommu_group_get(dev);
+	if (!group)
+		return -EINVAL;
 
 	mutex_lock(&group->mutex);
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 398/639] signal/bpfilter: Fix bpfilter_kernl to use send_sig not force_sig
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (396 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.19 397/639] iommu: Use right function to get group for device Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.19 399/639] signal/cifs: Fix cifs_put_tcp_session to call send_sig instead of force_sig Greg Kroah-Hartman
                   ` (244 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Alexei Starovoitov, David S. Miller,
	Eric W. Biederman, Sasha Levin

From: Eric W. Biederman <ebiederm@xmission.com>

[ Upstream commit 1dfd1711de2952fd1bfeea7152bd1687a4eea771 ]

The locking in force_sig_info is not prepared to deal with
a task that exits or execs (as sighand may change).  As force_sig
is only built to handle synchronous exceptions.

Further the function force_sig_info changes the signal state if the
signal is ignored, or blocked or if SIGNAL_UNKILLABLE will prevent the
delivery of the signal.  The signal SIGKILL can not be ignored and can
not be blocked and SIGNAL_UNKILLABLE won't prevent it from being
delivered.

So using force_sig rather than send_sig for SIGKILL is pointless.

Because it won't impact the sending of the signal and and because
using force_sig is wrong, replace force_sig with send_sig.

Cc: Alexei Starovoitov <ast@kernel.org>
Cc: David S. Miller <davem@davemloft.net>
Fixes: d2ba09c17a06 ("net: add skeleton of bpfilter kernel module")
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/bpfilter/bpfilter_kern.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/bpfilter/bpfilter_kern.c b/net/bpfilter/bpfilter_kern.c
index 94e88f510c5b8..450b257afa84d 100644
--- a/net/bpfilter/bpfilter_kern.c
+++ b/net/bpfilter/bpfilter_kern.c
@@ -25,7 +25,7 @@ static void shutdown_umh(struct umh_info *info)
 		return;
 	tsk = get_pid_task(find_vpid(info->pid), PIDTYPE_PID);
 	if (tsk) {
-		force_sig(SIGKILL, tsk);
+		send_sig(SIGKILL, tsk, 1);
 		put_task_struct(tsk);
 	}
 	fput(info->pipe_to_umh);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 399/639] signal/cifs: Fix cifs_put_tcp_session to call send_sig instead of force_sig
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (397 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.19 398/639] signal/bpfilter: Fix bpfilter_kernl to use send_sig not force_sig Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.19 400/639] inet: frags: call inet_frags_fini() after unregister_pernet_subsys() Greg Kroah-Hartman
                   ` (243 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Namjae Jeon, Jeff Layton,
	Steve French, Eric W. Biederman, Sasha Levin

From: Eric W. Biederman <ebiederm@xmission.com>

[ Upstream commit 72abe3bcf0911d69b46c1e8bdb5612675e0ac42c ]

The locking in force_sig_info is not prepared to deal with a task that
exits or execs (as sighand may change).  The is not a locking problem
in force_sig as force_sig is only built to handle synchronous
exceptions.

Further the function force_sig_info changes the signal state if the
signal is ignored, or blocked or if SIGNAL_UNKILLABLE will prevent the
delivery of the signal.  The signal SIGKILL can not be ignored and can
not be blocked and SIGNAL_UNKILLABLE won't prevent it from being
delivered.

So using force_sig rather than send_sig for SIGKILL is confusing
and pointless.

Because it won't impact the sending of the signal and and because
using force_sig is wrong, replace force_sig with send_sig.

Cc: Namjae Jeon <namjae.jeon@samsung.com>
Cc: Jeff Layton <jlayton@primarydata.com>
Cc: Steve French <smfrench@gmail.com>
Fixes: a5c3e1c725af ("Revert "cifs: No need to send SIGKILL to demux_thread during umount"")
Fixes: e7ddee9037e7 ("cifs: disable sharing session and tcon and add new TCP sharing code")
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/cifs/connect.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index 7e85070d010f4..a59dcda075343 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -2454,7 +2454,7 @@ cifs_put_tcp_session(struct TCP_Server_Info *server, int from_reconnect)
 
 	task = xchg(&server->tsk, NULL);
 	if (task)
-		force_sig(SIGKILL, task);
+		send_sig(SIGKILL, task, 1);
 }
 
 static struct TCP_Server_Info *
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 400/639] inet: frags: call inet_frags_fini() after unregister_pernet_subsys()
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (398 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.19 399/639] signal/cifs: Fix cifs_put_tcp_session to call send_sig instead of force_sig Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.19 401/639] net: hns3: fix a memory leak issue for hclge_map_unmap_ring_to_vf_vector Greg Kroah-Hartman
                   ` (242 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Eric Dumazet, David S. Miller, Sasha Levin

From: Eric Dumazet <edumazet@google.com>

[ Upstream commit ae7352d384a552d8c799c242e74a934809990a71 ]

Both IPv6 and 6lowpan are calling inet_frags_fini() too soon.

inet_frags_fini() is dismantling a kmem_cache, that might be needed
later when unregister_pernet_subsys() eventually has to remove
frags queues from hash tables and free them.

This fixes potential use-after-free, and is a prereq for the following patch.

Fixes: d4ad4d22e7ac ("inet: frags: use kmem_cache for inet_frag_queue")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ieee802154/6lowpan/reassembly.c | 2 +-
 net/ipv6/reassembly.c               | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/ieee802154/6lowpan/reassembly.c b/net/ieee802154/6lowpan/reassembly.c
index e7857a8ac86db..f3074249c6fc9 100644
--- a/net/ieee802154/6lowpan/reassembly.c
+++ b/net/ieee802154/6lowpan/reassembly.c
@@ -629,7 +629,7 @@ err_sysctl:
 
 void lowpan_net_frag_exit(void)
 {
-	inet_frags_fini(&lowpan_frags);
 	lowpan_frags_sysctl_unregister();
 	unregister_pernet_subsys(&lowpan_frags_ops);
+	inet_frags_fini(&lowpan_frags);
 }
diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
index 095825f964e28..c6132e39ab16b 100644
--- a/net/ipv6/reassembly.c
+++ b/net/ipv6/reassembly.c
@@ -593,8 +593,8 @@ err_protocol:
 
 void ipv6_frag_exit(void)
 {
-	inet_frags_fini(&ip6_frags);
 	ip6_frags_sysctl_unregister();
 	unregister_pernet_subsys(&ip6_frags_ops);
 	inet6_del_protocol(&frag_protocol, IPPROTO_FRAGMENT);
+	inet_frags_fini(&ip6_frags);
 }
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 401/639] net: hns3: fix a memory leak issue for hclge_map_unmap_ring_to_vf_vector
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (399 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.19 400/639] inet: frags: call inet_frags_fini() after unregister_pernet_subsys() Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.19 402/639] media: Staging: media: Release the correct resource in an error handling path Greg Kroah-Hartman
                   ` (241 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Huazhong Tan, Peng Li,
	David S. Miller, Sasha Levin

From: Huazhong Tan <tanhuazhong@huawei.com>

[ Upstream commit 49f971bd308571fe466687227130a7082b662d0e ]

When hclge_bind_ring_with_vector() fails,
hclge_map_unmap_ring_to_vf_vector() returns the error
directly, so nobody will free the memory allocated by
hclge_get_ring_chain_from_mbx().

So hclge_free_vector_ring_chain() should be called no matter
hclge_bind_ring_with_vector() fails or not.

Fixes: 84e095d64ed9 ("net: hns3: Change PF to add ring-vect binding & resetQ to mailbox")
Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com>
Signed-off-by: Peng Li <lipeng321@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c
index e08e82020402a..997ca79ed892b 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c
@@ -181,12 +181,10 @@ static int hclge_map_unmap_ring_to_vf_vector(struct hclge_vport *vport, bool en,
 		return ret;
 
 	ret = hclge_bind_ring_with_vector(vport, vector_id, en, &ring_chain);
-	if (ret)
-		return ret;
 
 	hclge_free_vector_ring_chain(&ring_chain);
 
-	return 0;
+	return ret;
 }
 
 static int hclge_set_vf_promisc_mode(struct hclge_vport *vport,
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 402/639] media: Staging: media: Release the correct resource in an error handling path
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (400 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.19 401/639] net: hns3: fix a memory leak issue for hclge_map_unmap_ring_to_vf_vector Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
       [not found]   ` <1578497930.3188.1579867610896.JavaMail.www@wwinf1n19>
  2020-01-24  9:29 ` [PATCH 4.19 403/639] crypto: talitos - fix AEAD processing Greg Kroah-Hartman
                   ` (240 subsequent siblings)
  642 siblings, 1 reply; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christophe JAILLET,
	Mauro Carvalho Chehab, Sasha Levin

From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>

[ Upstream commit 3b6471c7becd06325eb5e701cc2602b2edbbc7b6 ]

'res' is reassigned several times in the function and if we 'goto
error_unmap', its value is not the returned value of 'request_mem_region()'
anymore.

Introduce a new 'struct resource *' variable (i.e. res2) to keep a pointer
to the right resource, if needed in the error handling path.

Fixes: 4b4eda001704 ("Staging: media: Unmap and release region obtained by ioremap_nocache")

Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/staging/media/davinci_vpfe/dm365_ipipe.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/staging/media/davinci_vpfe/dm365_ipipe.c b/drivers/staging/media/davinci_vpfe/dm365_ipipe.c
index 95942768639cd..7bf2648affc0c 100644
--- a/drivers/staging/media/davinci_vpfe/dm365_ipipe.c
+++ b/drivers/staging/media/davinci_vpfe/dm365_ipipe.c
@@ -1777,7 +1777,7 @@ vpfe_ipipe_init(struct vpfe_ipipe_device *ipipe, struct platform_device *pdev)
 	struct media_pad *pads = &ipipe->pads[0];
 	struct v4l2_subdev *sd = &ipipe->subdev;
 	struct media_entity *me = &sd->entity;
-	struct resource *res, *memres;
+	struct resource *res, *res2, *memres;
 
 	res = platform_get_resource(pdev, IORESOURCE_MEM, 4);
 	if (!res)
@@ -1791,11 +1791,11 @@ vpfe_ipipe_init(struct vpfe_ipipe_device *ipipe, struct platform_device *pdev)
 	if (!ipipe->base_addr)
 		goto error_release;
 
-	res = platform_get_resource(pdev, IORESOURCE_MEM, 6);
-	if (!res)
+	res2 = platform_get_resource(pdev, IORESOURCE_MEM, 6);
+	if (!res2)
 		goto error_unmap;
-	ipipe->isp5_base_addr = ioremap_nocache(res->start,
-						resource_size(res));
+	ipipe->isp5_base_addr = ioremap_nocache(res2->start,
+						resource_size(res2));
 	if (!ipipe->isp5_base_addr)
 		goto error_unmap;
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 403/639] crypto: talitos - fix AEAD processing.
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (401 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.19 402/639] media: Staging: media: Release the correct resource in an error handling path Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.19 404/639] netvsc: unshare skb in VF rx handler Greg Kroah-Hartman
                   ` (239 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christophe Leroy, Herbert Xu, Sasha Levin

From: Christophe Leroy <christophe.leroy@c-s.fr>

[ Upstream commit e345177ded17611e36c067751d63d64bf106cb54 ]

This driver is working well in 'simple cases', but as soon as
more exotic SG lists are provided (dst different from src,
auth part not in a single SG fragment, ...) there are
wrong results, overruns, etc ...

This patch cleans up the AEAD processing by:
- Simplifying the location of 'out of line' ICV
- Never using 'out of line' ICV on encryp
- Always using 'out of line' ICV on decrypt
- Forcing the generation of a SG table on decrypt

Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
Fixes: aeb4c132f33d ("crypto: talitos - Convert to new AEAD interface")
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/talitos.c | 158 +++++++++++++--------------------------
 drivers/crypto/talitos.h |   2 +-
 2 files changed, 55 insertions(+), 105 deletions(-)

diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c
index 634ae487c372e..db5f939f5aa35 100644
--- a/drivers/crypto/talitos.c
+++ b/drivers/crypto/talitos.c
@@ -974,8 +974,8 @@ static void ipsec_esp_unmap(struct device *dev,
 					 DMA_FROM_DEVICE);
 	unmap_single_talitos_ptr(dev, civ_ptr, DMA_TO_DEVICE);
 
-	talitos_sg_unmap(dev, edesc, areq->src, areq->dst, cryptlen,
-			 areq->assoclen);
+	talitos_sg_unmap(dev, edesc, areq->src, areq->dst,
+			 cryptlen + authsize, areq->assoclen);
 
 	if (edesc->dma_len)
 		dma_unmap_single(dev, edesc->dma_link_tbl, edesc->dma_len,
@@ -996,30 +996,15 @@ static void ipsec_esp_encrypt_done(struct device *dev,
 				   struct talitos_desc *desc, void *context,
 				   int err)
 {
-	struct talitos_private *priv = dev_get_drvdata(dev);
-	bool is_sec1 = has_ftr_sec1(priv);
 	struct aead_request *areq = context;
 	struct crypto_aead *authenc = crypto_aead_reqtfm(areq);
-	unsigned int authsize = crypto_aead_authsize(authenc);
 	unsigned int ivsize = crypto_aead_ivsize(authenc);
 	struct talitos_edesc *edesc;
-	void *icvdata;
 
 	edesc = container_of(desc, struct talitos_edesc, desc);
 
 	ipsec_esp_unmap(dev, edesc, areq, true);
 
-	/* copy the generated ICV to dst */
-	if (edesc->icv_ool) {
-		if (is_sec1)
-			icvdata = edesc->buf + areq->assoclen + areq->cryptlen;
-		else
-			icvdata = &edesc->link_tbl[edesc->src_nents +
-						   edesc->dst_nents + 2];
-		sg_pcopy_from_buffer(areq->dst, edesc->dst_nents ? : 1, icvdata,
-				     authsize, areq->assoclen + areq->cryptlen);
-	}
-
 	dma_unmap_single(dev, edesc->iv_dma, ivsize, DMA_TO_DEVICE);
 
 	kfree(edesc);
@@ -1036,39 +1021,15 @@ static void ipsec_esp_decrypt_swauth_done(struct device *dev,
 	unsigned int authsize = crypto_aead_authsize(authenc);
 	struct talitos_edesc *edesc;
 	char *oicv, *icv;
-	struct talitos_private *priv = dev_get_drvdata(dev);
-	bool is_sec1 = has_ftr_sec1(priv);
 
 	edesc = container_of(desc, struct talitos_edesc, desc);
 
 	ipsec_esp_unmap(dev, edesc, req, false);
 
 	if (!err) {
-		char icvdata[SHA512_DIGEST_SIZE];
-		int nents = edesc->dst_nents ? : 1;
-		unsigned int len = req->assoclen + req->cryptlen;
-
 		/* auth check */
-		if (nents > 1) {
-			sg_pcopy_to_buffer(req->dst, nents, icvdata, authsize,
-					   len - authsize);
-			icv = icvdata;
-		} else {
-			icv = (char *)sg_virt(req->dst) + len - authsize;
-		}
-
-		if (edesc->dma_len) {
-			if (is_sec1)
-				oicv = (char *)&edesc->dma_link_tbl +
-					       req->assoclen + req->cryptlen;
-			else
-				oicv = (char *)
-				       &edesc->link_tbl[edesc->src_nents +
-							edesc->dst_nents + 2];
-			if (edesc->icv_ool)
-				icv = oicv + authsize;
-		} else
-			oicv = (char *)&edesc->link_tbl[0];
+		oicv = edesc->buf + edesc->dma_len;
+		icv = oicv - authsize;
 
 		err = crypto_memneq(oicv, icv, authsize) ? -EBADMSG : 0;
 	}
@@ -1104,11 +1065,12 @@ static void ipsec_esp_decrypt_hwauth_done(struct device *dev,
  * stop at cryptlen bytes
  */
 static int sg_to_link_tbl_offset(struct scatterlist *sg, int sg_count,
-				 unsigned int offset, int cryptlen,
+				 unsigned int offset, int datalen, int elen,
 				 struct talitos_ptr *link_tbl_ptr)
 {
-	int n_sg = sg_count;
+	int n_sg = elen ? sg_count + 1 : sg_count;
 	int count = 0;
+	int cryptlen = datalen + elen;
 
 	while (cryptlen && sg && n_sg--) {
 		unsigned int len = sg_dma_len(sg);
@@ -1123,11 +1085,20 @@ static int sg_to_link_tbl_offset(struct scatterlist *sg, int sg_count,
 		if (len > cryptlen)
 			len = cryptlen;
 
+		if (datalen > 0 && len > datalen) {
+			to_talitos_ptr(link_tbl_ptr + count,
+				       sg_dma_address(sg) + offset, datalen, 0);
+			to_talitos_ptr_ext_set(link_tbl_ptr + count, 0, 0);
+			count++;
+			len -= datalen;
+			offset += datalen;
+		}
 		to_talitos_ptr(link_tbl_ptr + count,
 			       sg_dma_address(sg) + offset, len, 0);
 		to_talitos_ptr_ext_set(link_tbl_ptr + count, 0, 0);
 		count++;
 		cryptlen -= len;
+		datalen -= len;
 		offset = 0;
 
 next:
@@ -1137,7 +1108,7 @@ next:
 	/* tag end of link table */
 	if (count > 0)
 		to_talitos_ptr_ext_set(link_tbl_ptr + count - 1,
-				       DESC_PTR_LNKTBL_RETURN, 0);
+				       DESC_PTR_LNKTBL_RET, 0);
 
 	return count;
 }
@@ -1145,7 +1116,8 @@ next:
 static int talitos_sg_map_ext(struct device *dev, struct scatterlist *src,
 			      unsigned int len, struct talitos_edesc *edesc,
 			      struct talitos_ptr *ptr, int sg_count,
-			      unsigned int offset, int tbl_off, int elen)
+			      unsigned int offset, int tbl_off, int elen,
+			      bool force)
 {
 	struct talitos_private *priv = dev_get_drvdata(dev);
 	bool is_sec1 = has_ftr_sec1(priv);
@@ -1155,7 +1127,7 @@ static int talitos_sg_map_ext(struct device *dev, struct scatterlist *src,
 		return 1;
 	}
 	to_talitos_ptr_ext_set(ptr, elen, is_sec1);
-	if (sg_count == 1) {
+	if (sg_count == 1 && !force) {
 		to_talitos_ptr(ptr, sg_dma_address(src) + offset, len, is_sec1);
 		return sg_count;
 	}
@@ -1163,9 +1135,9 @@ static int talitos_sg_map_ext(struct device *dev, struct scatterlist *src,
 		to_talitos_ptr(ptr, edesc->dma_link_tbl + offset, len, is_sec1);
 		return sg_count;
 	}
-	sg_count = sg_to_link_tbl_offset(src, sg_count, offset, len + elen,
+	sg_count = sg_to_link_tbl_offset(src, sg_count, offset, len, elen,
 					 &edesc->link_tbl[tbl_off]);
-	if (sg_count == 1) {
+	if (sg_count == 1 && !force) {
 		/* Only one segment now, so no link tbl needed*/
 		copy_talitos_ptr(ptr, &edesc->link_tbl[tbl_off], is_sec1);
 		return sg_count;
@@ -1183,7 +1155,7 @@ static int talitos_sg_map(struct device *dev, struct scatterlist *src,
 			  unsigned int offset, int tbl_off)
 {
 	return talitos_sg_map_ext(dev, src, len, edesc, ptr, sg_count, offset,
-				  tbl_off, 0);
+				  tbl_off, 0, false);
 }
 
 /*
@@ -1211,6 +1183,7 @@ static int ipsec_esp(struct talitos_edesc *edesc, struct aead_request *areq,
 	bool is_ipsec_esp = desc->hdr & DESC_HDR_TYPE_IPSEC_ESP;
 	struct talitos_ptr *civ_ptr = &desc->ptr[is_ipsec_esp ? 2 : 3];
 	struct talitos_ptr *ckey_ptr = &desc->ptr[is_ipsec_esp ? 3 : 2];
+	dma_addr_t dma_icv = edesc->dma_link_tbl + edesc->dma_len - authsize;
 
 	/* hmac key */
 	to_talitos_ptr(&desc->ptr[0], ctx->dma_key, ctx->authkeylen, is_sec1);
@@ -1250,7 +1223,8 @@ static int ipsec_esp(struct talitos_edesc *edesc, struct aead_request *areq,
 		elen = authsize;
 
 	ret = talitos_sg_map_ext(dev, areq->src, cryptlen, edesc, &desc->ptr[4],
-				 sg_count, areq->assoclen, tbl_off, elen);
+				 sg_count, areq->assoclen, tbl_off, elen,
+				 false);
 
 	if (ret > 1) {
 		tbl_off += ret;
@@ -1264,55 +1238,35 @@ static int ipsec_esp(struct talitos_edesc *edesc, struct aead_request *areq,
 			dma_map_sg(dev, areq->dst, sg_count, DMA_FROM_DEVICE);
 	}
 
-	ret = talitos_sg_map(dev, areq->dst, cryptlen, edesc, &desc->ptr[5],
-			     sg_count, areq->assoclen, tbl_off);
-
-	if (is_ipsec_esp)
-		to_talitos_ptr_ext_or(&desc->ptr[5], authsize, is_sec1);
+	if (is_ipsec_esp && encrypt)
+		elen = authsize;
+	else
+		elen = 0;
+	ret = talitos_sg_map_ext(dev, areq->dst, cryptlen, edesc, &desc->ptr[5],
+				 sg_count, areq->assoclen, tbl_off, elen,
+				 is_ipsec_esp && !encrypt);
+	tbl_off += ret;
 
 	/* ICV data */
-	if (ret > 1) {
-		tbl_off += ret;
-		edesc->icv_ool = true;
-		sync_needed = true;
+	edesc->icv_ool = !encrypt;
 
-		if (is_ipsec_esp) {
-			struct talitos_ptr *tbl_ptr = &edesc->link_tbl[tbl_off];
-			int offset = (edesc->src_nents + edesc->dst_nents + 2) *
-				     sizeof(struct talitos_ptr) + authsize;
+	if (!encrypt && is_ipsec_esp) {
+		struct talitos_ptr *tbl_ptr = &edesc->link_tbl[tbl_off];
 
-			/* Add an entry to the link table for ICV data */
-			to_talitos_ptr_ext_set(tbl_ptr - 1, 0, is_sec1);
-			to_talitos_ptr_ext_set(tbl_ptr, DESC_PTR_LNKTBL_RETURN,
-					       is_sec1);
+		/* Add an entry to the link table for ICV data */
+		to_talitos_ptr_ext_set(tbl_ptr - 1, 0, is_sec1);
+		to_talitos_ptr_ext_set(tbl_ptr, DESC_PTR_LNKTBL_RET, is_sec1);
 
-			/* icv data follows link tables */
-			to_talitos_ptr(tbl_ptr, edesc->dma_link_tbl + offset,
-				       authsize, is_sec1);
-		} else {
-			dma_addr_t addr = edesc->dma_link_tbl;
-
-			if (is_sec1)
-				addr += areq->assoclen + cryptlen;
-			else
-				addr += sizeof(struct talitos_ptr) * tbl_off;
-
-			to_talitos_ptr(&desc->ptr[6], addr, authsize, is_sec1);
-		}
+		/* icv data follows link tables */
+		to_talitos_ptr(tbl_ptr, dma_icv, authsize, is_sec1);
+		to_talitos_ptr_ext_or(&desc->ptr[5], authsize, is_sec1);
+		sync_needed = true;
+	} else if (!encrypt) {
+		to_talitos_ptr(&desc->ptr[6], dma_icv, authsize, is_sec1);
+		sync_needed = true;
 	} else if (!is_ipsec_esp) {
-		ret = talitos_sg_map(dev, areq->dst, authsize, edesc,
-				     &desc->ptr[6], sg_count, areq->assoclen +
-							      cryptlen,
-				     tbl_off);
-		if (ret > 1) {
-			tbl_off += ret;
-			edesc->icv_ool = true;
-			sync_needed = true;
-		} else {
-			edesc->icv_ool = false;
-		}
-	} else {
-		edesc->icv_ool = false;
+		talitos_sg_map(dev, areq->dst, authsize, edesc, &desc->ptr[6],
+			       sg_count, areq->assoclen + cryptlen, tbl_off);
 	}
 
 	/* iv out */
@@ -1395,18 +1349,18 @@ static struct talitos_edesc *talitos_edesc_alloc(struct device *dev,
 	 * and space for two sets of ICVs (stashed and generated)
 	 */
 	alloc_len = sizeof(struct talitos_edesc);
-	if (src_nents || dst_nents) {
+	if (src_nents || dst_nents || !encrypt) {
 		if (is_sec1)
 			dma_len = (src_nents ? src_len : 0) +
-				  (dst_nents ? dst_len : 0);
+				  (dst_nents ? dst_len : 0) + authsize;
 		else
 			dma_len = (src_nents + dst_nents + 2) *
-				  sizeof(struct talitos_ptr) + authsize * 2;
+				  sizeof(struct talitos_ptr) + authsize;
 		alloc_len += dma_len;
 	} else {
 		dma_len = 0;
-		alloc_len += icv_stashing ? authsize : 0;
 	}
+	alloc_len += icv_stashing ? authsize : 0;
 
 	/* if its a ahash, add space for a second desc next to the first one */
 	if (is_sec1 && !dst)
@@ -1500,11 +1454,7 @@ static int aead_decrypt(struct aead_request *req)
 	edesc->desc.hdr = ctx->desc_hdr_template | DESC_HDR_DIR_INBOUND;
 
 	/* stash incoming ICV for later cmp with ICV generated by the h/w */
-	if (edesc->dma_len)
-		icvdata = (char *)&edesc->link_tbl[edesc->src_nents +
-						   edesc->dst_nents + 2];
-	else
-		icvdata = &edesc->link_tbl[0];
+	icvdata = edesc->buf + edesc->dma_len;
 
 	sg_pcopy_to_buffer(req->src, edesc->src_nents ? : 1, icvdata, authsize,
 			   req->assoclen + req->cryptlen - authsize);
diff --git a/drivers/crypto/talitos.h b/drivers/crypto/talitos.h
index 979f6a61e545f..cb0137e131cc8 100644
--- a/drivers/crypto/talitos.h
+++ b/drivers/crypto/talitos.h
@@ -442,5 +442,5 @@ static inline bool has_ftr_sec1(struct talitos_private *priv)
 
 /* link table extent field bits */
 #define DESC_PTR_LNKTBL_JUMP			0x80
-#define DESC_PTR_LNKTBL_RETURN			0x02
+#define DESC_PTR_LNKTBL_RET			0x02
 #define DESC_PTR_LNKTBL_NEXT			0x01
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 404/639] netvsc: unshare skb in VF rx handler
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (402 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.19 403/639] crypto: talitos - fix AEAD processing Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.19 405/639] net: core: support XDP generic on stacked devices Greg Kroah-Hartman
                   ` (238 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Stephen Hemminger, David S. Miller,
	Sasha Levin

From: Stephen Hemminger <stephen@networkplumber.org>

[ Upstream commit 996ed04741467f6d1552440c92988b132a9487ec ]

The netvsc VF skb handler should make sure that skb is not
shared. Similar logic already exists in bonding and team device
drivers.

This is not an issue in practice because the VF devicex
does not send up shared skb's. But the netvsc driver
should do the right thing if it did.

Fixes: 0c195567a8f6 ("netvsc: transparent VF management")
Signed-off-by: Stephen Hemminger <sthemmin@microsoft.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/hyperv/netvsc_drv.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
index 1f9f7fcdb0eb3..54670c9905c79 100644
--- a/drivers/net/hyperv/netvsc_drv.c
+++ b/drivers/net/hyperv/netvsc_drv.c
@@ -2004,6 +2004,12 @@ static rx_handler_result_t netvsc_vf_handle_frame(struct sk_buff **pskb)
 	struct netvsc_vf_pcpu_stats *pcpu_stats
 		 = this_cpu_ptr(ndev_ctx->vf_stats);
 
+	skb = skb_share_check(skb, GFP_ATOMIC);
+	if (unlikely(!skb))
+		return RX_HANDLER_CONSUMED;
+
+	*pskb = skb;
+
 	skb->dev = ndev;
 
 	u64_stats_update_begin(&pcpu_stats->syncp);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 405/639] net: core: support XDP generic on stacked devices.
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (403 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.19 404/639] netvsc: unshare skb in VF rx handler Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.19 406/639] RDMA/uverbs: check for allocation failure in uapi_add_elm() Greg Kroah-Hartman
                   ` (237 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Stephen Hemminger, David S. Miller,
	Sasha Levin

From: Stephen Hemminger <stephen@networkplumber.org>

[ Upstream commit 458bf2f224f04a513b0be972f8708e78ee2c986e ]

When a device is stacked like (team, bonding, failsafe or netvsc) the
XDP generic program for the parent device was not called.

Move the call to XDP generic inside __netif_receive_skb_core where
it can be done multiple times for stacked case.

Fixes: d445516966dc ("net: xdp: support xdp generic on virtual devices")
Signed-off-by: Stephen Hemminger <sthemmin@microsoft.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/core/dev.c | 58 +++++++++++---------------------------------------
 1 file changed, 12 insertions(+), 46 deletions(-)

diff --git a/net/core/dev.c b/net/core/dev.c
index a26d87073f714..935fe158cfaff 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -4465,23 +4465,6 @@ static int netif_rx_internal(struct sk_buff *skb)
 
 	trace_netif_rx(skb);
 
-	if (static_branch_unlikely(&generic_xdp_needed_key)) {
-		int ret;
-
-		preempt_disable();
-		rcu_read_lock();
-		ret = do_xdp_generic(rcu_dereference(skb->dev->xdp_prog), skb);
-		rcu_read_unlock();
-		preempt_enable();
-
-		/* Consider XDP consuming the packet a success from
-		 * the netdev point of view we do not want to count
-		 * this as an error.
-		 */
-		if (ret != XDP_PASS)
-			return NET_RX_SUCCESS;
-	}
-
 #ifdef CONFIG_RPS
 	if (static_key_false(&rps_needed)) {
 		struct rps_dev_flow voidflow, *rflow = &voidflow;
@@ -4815,6 +4798,18 @@ another_round:
 
 	__this_cpu_inc(softnet_data.processed);
 
+	if (static_branch_unlikely(&generic_xdp_needed_key)) {
+		int ret2;
+
+		preempt_disable();
+		ret2 = do_xdp_generic(rcu_dereference(skb->dev->xdp_prog), skb);
+		preempt_enable();
+
+		if (ret2 != XDP_PASS)
+			return NET_RX_DROP;
+		skb_reset_mac_len(skb);
+	}
+
 	if (skb->protocol == cpu_to_be16(ETH_P_8021Q) ||
 	    skb->protocol == cpu_to_be16(ETH_P_8021AD)) {
 		skb = skb_vlan_untag(skb);
@@ -5133,19 +5128,6 @@ static int netif_receive_skb_internal(struct sk_buff *skb)
 	if (skb_defer_rx_timestamp(skb))
 		return NET_RX_SUCCESS;
 
-	if (static_branch_unlikely(&generic_xdp_needed_key)) {
-		int ret;
-
-		preempt_disable();
-		rcu_read_lock();
-		ret = do_xdp_generic(rcu_dereference(skb->dev->xdp_prog), skb);
-		rcu_read_unlock();
-		preempt_enable();
-
-		if (ret != XDP_PASS)
-			return NET_RX_DROP;
-	}
-
 	rcu_read_lock();
 #ifdef CONFIG_RPS
 	if (static_key_false(&rps_needed)) {
@@ -5166,7 +5148,6 @@ static int netif_receive_skb_internal(struct sk_buff *skb)
 
 static void netif_receive_skb_list_internal(struct list_head *head)
 {
-	struct bpf_prog *xdp_prog = NULL;
 	struct sk_buff *skb, *next;
 	struct list_head sublist;
 
@@ -5179,21 +5160,6 @@ static void netif_receive_skb_list_internal(struct list_head *head)
 	}
 	list_splice_init(&sublist, head);
 
-	if (static_branch_unlikely(&generic_xdp_needed_key)) {
-		preempt_disable();
-		rcu_read_lock();
-		list_for_each_entry_safe(skb, next, head, list) {
-			xdp_prog = rcu_dereference(skb->dev->xdp_prog);
-			skb_list_del_init(skb);
-			if (do_xdp_generic(xdp_prog, skb) == XDP_PASS)
-				list_add_tail(&skb->list, &sublist);
-		}
-		rcu_read_unlock();
-		preempt_enable();
-		/* Put passed packets back on main list */
-		list_splice_init(&sublist, head);
-	}
-
 	rcu_read_lock();
 #ifdef CONFIG_RPS
 	if (static_key_false(&rps_needed)) {
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 406/639] RDMA/uverbs: check for allocation failure in uapi_add_elm()
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (404 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.19 405/639] net: core: support XDP generic on stacked devices Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.19 407/639] net: dont clear sock->sk early to avoid trouble in strparser Greg Kroah-Hartman
                   ` (236 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Jason Gunthorpe, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit cac2a301c02a9b178842e22df34217da7854e588 ]

If the kzalloc() fails then we should return ERR_PTR(-ENOMEM).  In the
current code it's possible that the kzalloc() fails and the
radix_tree_insert() inserts the NULL pointer successfully and we return
the NULL "elm" pointer to the caller.  That results in a NULL pointer
dereference.

Fixes: 9ed3e5f44772 ("IB/uverbs: Build the specs into a radix tree at runtime")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/core/uverbs_uapi.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/infiniband/core/uverbs_uapi.c b/drivers/infiniband/core/uverbs_uapi.c
index be854628a7c63..959a3418a192d 100644
--- a/drivers/infiniband/core/uverbs_uapi.c
+++ b/drivers/infiniband/core/uverbs_uapi.c
@@ -17,6 +17,8 @@ static void *uapi_add_elm(struct uverbs_api *uapi, u32 key, size_t alloc_size)
 		return ERR_PTR(-EOVERFLOW);
 
 	elm = kzalloc(alloc_size, GFP_KERNEL);
+	if (!elm)
+		return ERR_PTR(-ENOMEM);
 	rc = radix_tree_insert(&uapi->radix, key, elm);
 	if (rc) {
 		kfree(elm);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 407/639] net: dont clear sock->sk early to avoid trouble in strparser
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (405 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.19 406/639] RDMA/uverbs: check for allocation failure in uapi_add_elm() Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.19 408/639] phy: qcom-qusb2: fix missing assignment of ret when calling clk_prepare_enable Greg Kroah-Hartman
                   ` (235 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, David Beckett, Jakub Kicinski,
	Dirk van der Merwe, David S. Miller, Sasha Levin

From: Jakub Kicinski <jakub.kicinski@netronome.com>

[ Upstream commit 2b81f8161dfeda4017cef4f2498ccb64b13f0d61 ]

af_inet sets sock->sk to NULL which trips strparser over:

BUG: kernel NULL pointer dereference, address: 0000000000000012
PGD 0 P4D 0
Oops: 0000 [#1] SMP PTI
CPU: 7 PID: 0 Comm: swapper/7 Not tainted 5.2.0-rc1-00139-g14629453a6d3 #21
RIP: 0010:tcp_peek_len+0x10/0x60
RSP: 0018:ffffc02e41c54b98 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff9cf924c4e030 RCX: 0000000000000051
RDX: 0000000000000000 RSI: 000000000000000c RDI: ffff9cf97128f480
RBP: ffff9cf9365e0300 R08: ffff9cf94fe7d2c0 R09: 0000000000000000
R10: 000000000000036b R11: ffff9cf939735e00 R12: ffff9cf91ad9ae40
R13: ffff9cf924c4e000 R14: ffff9cf9a8fcbaae R15: 0000000000000020
FS: 0000000000000000(0000) GS:ffff9cf9af7c0000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000012 CR3: 000000013920a003 CR4: 00000000003606e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
 Call Trace:
 <IRQ>
 strp_data_ready+0x48/0x90
 tls_data_ready+0x22/0xd0 [tls]
 tcp_rcv_established+0x569/0x620
 tcp_v4_do_rcv+0x127/0x1e0
 tcp_v4_rcv+0xad7/0xbf0
 ip_protocol_deliver_rcu+0x2c/0x1c0
 ip_local_deliver_finish+0x41/0x50
 ip_local_deliver+0x6b/0xe0
 ? ip_protocol_deliver_rcu+0x1c0/0x1c0
 ip_rcv+0x52/0xd0
 ? ip_rcv_finish_core.isra.20+0x380/0x380
 __netif_receive_skb_one_core+0x7e/0x90
 netif_receive_skb_internal+0x42/0xf0
 napi_gro_receive+0xed/0x150
 nfp_net_poll+0x7a2/0xd30 [nfp]
 ? kmem_cache_free_bulk+0x286/0x310
 net_rx_action+0x149/0x3b0
 __do_softirq+0xe3/0x30a
 ? handle_irq_event_percpu+0x6a/0x80
 irq_exit+0xe8/0xf0
 do_IRQ+0x85/0xd0
 common_interrupt+0xf/0xf
 </IRQ>
RIP: 0010:cpuidle_enter_state+0xbc/0x450

To avoid this issue set sock->sk after sk_prot->close.
My grepping and testing did not discover any code which
would depend on the current behaviour.

Fixes: c46234ebb4d1 ("tls: RX path for ktls")
Reported-by: David Beckett <david.beckett@netronome.com>
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Reviewed-by: Dirk van der Merwe <dirk.vandermerwe@netronome.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ipv4/af_inet.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index 1fbe2f815474c..bbf3b3daa9994 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -424,8 +424,8 @@ int inet_release(struct socket *sock)
 		if (sock_flag(sk, SOCK_LINGER) &&
 		    !(current->flags & PF_EXITING))
 			timeout = sk->sk_lingertime;
-		sock->sk = NULL;
 		sk->sk_prot->close(sk, timeout);
+		sock->sk = NULL;
 	}
 	return 0;
 }
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 408/639] phy: qcom-qusb2: fix missing assignment of ret when calling clk_prepare_enable
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (406 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.19 407/639] net: dont clear sock->sk early to avoid trouble in strparser Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.19 409/639] cpufreq: brcmstb-avs-cpufreq: Fix initial command check Greg Kroah-Hartman
                   ` (234 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Colin Ian King,
	Kishon Vijay Abraham I, Sasha Levin

From: Colin Ian King <colin.king@canonical.com>

[ Upstream commit d98010817a26eba8d4d1e8a639e0b7d7f042308a ]

The error return from the call to clk_prepare_enable is not being assigned
to variable ret even though ret is being used to check if the call failed.
Fix this by adding in the missing assignment.

Addresses-Coverity: ("Logically dead code")
Fixes: 891a96f65ac3 ("phy: qcom-qusb2: Add support for runtime PM")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/phy/qualcomm/phy-qcom-qusb2.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/phy/qualcomm/phy-qcom-qusb2.c b/drivers/phy/qualcomm/phy-qcom-qusb2.c
index 69c92843eb3b2..9b7ae93e9df1e 100644
--- a/drivers/phy/qualcomm/phy-qcom-qusb2.c
+++ b/drivers/phy/qualcomm/phy-qcom-qusb2.c
@@ -526,7 +526,7 @@ static int __maybe_unused qusb2_phy_runtime_resume(struct device *dev)
 	}
 
 	if (!qphy->has_se_clk_scheme) {
-		clk_prepare_enable(qphy->ref_clk);
+		ret = clk_prepare_enable(qphy->ref_clk);
 		if (ret) {
 			dev_err(dev, "failed to enable ref clk, %d\n", ret);
 			goto disable_ahb_clk;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 409/639] cpufreq: brcmstb-avs-cpufreq: Fix initial command check
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (407 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.19 408/639] phy: qcom-qusb2: fix missing assignment of ret when calling clk_prepare_enable Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.19 410/639] cpufreq: brcmstb-avs-cpufreq: Fix types for voltage/frequency Greg Kroah-Hartman
                   ` (233 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Florian Fainelli, Markus Mayer,
	Viresh Kumar, Sasha Levin

From: Florian Fainelli <f.fainelli@gmail.com>

[ Upstream commit 22a26cc6a51ef73dcfeb64c50513903f6b2d53d8 ]

There is a logical error in brcm_avs_is_firmware_loaded() whereby if the
firmware returns -EINVAL, we will be reporting this as an error. The
comment is correct, the code was not.

Fixes: de322e085995 ("cpufreq: brcmstb-avs-cpufreq: AVS CPUfreq driver for Broadcom STB SoCs")
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Acked-by: Markus Mayer <mmayer@broadcom.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/cpufreq/brcmstb-avs-cpufreq.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/cpufreq/brcmstb-avs-cpufreq.c b/drivers/cpufreq/brcmstb-avs-cpufreq.c
index e6f9cbe5835f9..6ed53ca8aa980 100644
--- a/drivers/cpufreq/brcmstb-avs-cpufreq.c
+++ b/drivers/cpufreq/brcmstb-avs-cpufreq.c
@@ -446,8 +446,8 @@ static bool brcm_avs_is_firmware_loaded(struct private_data *priv)
 	rc = brcm_avs_get_pmap(priv, NULL);
 	magic = readl(priv->base + AVS_MBOX_MAGIC);
 
-	return (magic == AVS_FIRMWARE_MAGIC) && (rc != -ENOTSUPP) &&
-		(rc != -EINVAL);
+	return (magic == AVS_FIRMWARE_MAGIC) && ((rc != -ENOTSUPP) ||
+		(rc != -EINVAL));
 }
 
 static unsigned int brcm_avs_cpufreq_get(unsigned int cpu)
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 410/639] cpufreq: brcmstb-avs-cpufreq: Fix types for voltage/frequency
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (408 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.19 409/639] cpufreq: brcmstb-avs-cpufreq: Fix initial command check Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.19 411/639] clk: sunxi-ng: sun50i-h6-r: Fix incorrect W1 clock gate register Greg Kroah-Hartman
                   ` (232 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Florian Fainelli, Markus Mayer,
	Viresh Kumar, Sasha Levin

From: Florian Fainelli <f.fainelli@gmail.com>

[ Upstream commit 4c5681fcc684c762b09435de3e82ffeee7769d21 ]

What we read back from the register is going to be capped at 32-bits,
and cpufreq_freq_table.frequency is an unsigned int. Avoid any possible
value truncation by using the appropriate return value.

Fixes: de322e085995 ("cpufreq: brcmstb-avs-cpufreq: AVS CPUfreq driver for Broadcom STB SoCs")
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Acked-by: Markus Mayer <mmayer@broadcom.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/cpufreq/brcmstb-avs-cpufreq.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/cpufreq/brcmstb-avs-cpufreq.c b/drivers/cpufreq/brcmstb-avs-cpufreq.c
index 6ed53ca8aa980..77b0e5d0fb134 100644
--- a/drivers/cpufreq/brcmstb-avs-cpufreq.c
+++ b/drivers/cpufreq/brcmstb-avs-cpufreq.c
@@ -384,12 +384,12 @@ static int brcm_avs_set_pstate(struct private_data *priv, unsigned int pstate)
 	return __issue_avs_command(priv, AVS_CMD_SET_PSTATE, true, args);
 }
 
-static unsigned long brcm_avs_get_voltage(void __iomem *base)
+static u32 brcm_avs_get_voltage(void __iomem *base)
 {
 	return readl(base + AVS_MBOX_VOLTAGE1);
 }
 
-static unsigned long brcm_avs_get_frequency(void __iomem *base)
+static u32 brcm_avs_get_frequency(void __iomem *base)
 {
 	return readl(base + AVS_MBOX_FREQUENCY) * 1000;	/* in kHz */
 }
@@ -653,14 +653,14 @@ static ssize_t show_brcm_avs_voltage(struct cpufreq_policy *policy, char *buf)
 {
 	struct private_data *priv = policy->driver_data;
 
-	return sprintf(buf, "0x%08lx\n", brcm_avs_get_voltage(priv->base));
+	return sprintf(buf, "0x%08x\n", brcm_avs_get_voltage(priv->base));
 }
 
 static ssize_t show_brcm_avs_frequency(struct cpufreq_policy *policy, char *buf)
 {
 	struct private_data *priv = policy->driver_data;
 
-	return sprintf(buf, "0x%08lx\n", brcm_avs_get_frequency(priv->base));
+	return sprintf(buf, "0x%08x\n", brcm_avs_get_frequency(priv->base));
 }
 
 cpufreq_freq_attr_ro(brcm_avs_pstate);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 411/639] clk: sunxi-ng: sun50i-h6-r: Fix incorrect W1 clock gate register
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (409 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.19 410/639] cpufreq: brcmstb-avs-cpufreq: Fix types for voltage/frequency Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.19 412/639] media: vivid: fix incorrect assignment operation when setting video mode Greg Kroah-Hartman
                   ` (231 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ondrej Jirman,
	Clément Péron, Maxime Ripard, Sasha Levin

From: Ondrej Jirman <megous@megous.com>

[ Upstream commit f167675486c37b88620d344fbb12d06e34f11d47 ]

The current code defines W1 clock gate to be at 0x1cc, overlaying it
with the IR gate.

Clock gate for r-apb1-w1 is at 0x1ec. This fixes issues with IR receiver
causing interrupt floods on H6 (because interrupt flags can't be cleared,
due to IR module's bus being disabled).

Fixes: b7c7b05065aa77ae ("clk: sunxi-ng: add support for H6 PRCM CCU")
Signed-off-by: Ondrej Jirman <megous@megous.com>
Acked-by: Clément Péron <peron.clem@gmail.com>
Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/sunxi-ng/ccu-sun50i-h6-r.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/clk/sunxi-ng/ccu-sun50i-h6-r.c b/drivers/clk/sunxi-ng/ccu-sun50i-h6-r.c
index 27554eaf69298..8d05d4f1f8a1e 100644
--- a/drivers/clk/sunxi-ng/ccu-sun50i-h6-r.c
+++ b/drivers/clk/sunxi-ng/ccu-sun50i-h6-r.c
@@ -104,7 +104,7 @@ static SUNXI_CCU_GATE(r_apb2_i2c_clk,	"r-apb2-i2c",	"r-apb2",
 static SUNXI_CCU_GATE(r_apb1_ir_clk,	"r-apb1-ir",	"r-apb1",
 		      0x1cc, BIT(0), 0);
 static SUNXI_CCU_GATE(r_apb1_w1_clk,	"r-apb1-w1",	"r-apb1",
-		      0x1cc, BIT(0), 0);
+		      0x1ec, BIT(0), 0);
 
 /* Information of IR(RX) mod clock is gathered from BSP source code */
 static const char * const r_mod0_default_parents[] = { "osc32k", "osc24M" };
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 412/639] media: vivid: fix incorrect assignment operation when setting video mode
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (410 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.19 411/639] clk: sunxi-ng: sun50i-h6-r: Fix incorrect W1 clock gate register Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.19 413/639] crypto: inside-secure - fix zeroing of the request in ahash_exit_inv Greg Kroah-Hartman
                   ` (230 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Colin Ian King, Hans Verkuil,
	Mauro Carvalho Chehab, Sasha Levin

From: Colin Ian King <colin.king@canonical.com>

[ Upstream commit d4ec9550e4b2d2e357a46fdc65d8ef3d4d15984c ]

The assigment of FB_VMODE_NONINTERLACE to var->vmode should be a
bit-wise or of FB_VMODE_NONINTERLACE instead of an assignment,
otherwise the previous clearing of the FB_VMODE_MASK bits of
var->vmode makes no sense and is redundant.

Addresses-Coverity: ("Unused value")
Fixes: ad4e02d5081d ("[media] vivid: add a simple framebuffer device for overlay testing")

Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/vivid/vivid-osd.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/platform/vivid/vivid-osd.c b/drivers/media/platform/vivid/vivid-osd.c
index bbbc1b6938a56..b24596697f579 100644
--- a/drivers/media/platform/vivid/vivid-osd.c
+++ b/drivers/media/platform/vivid/vivid-osd.c
@@ -155,7 +155,7 @@ static int _vivid_fb_check_var(struct fb_var_screeninfo *var, struct vivid_dev *
 	var->nonstd = 0;
 
 	var->vmode &= ~FB_VMODE_MASK;
-	var->vmode = FB_VMODE_NONINTERLACED;
+	var->vmode |= FB_VMODE_NONINTERLACED;
 
 	/* Dummy values */
 	var->hsync_len = 24;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 413/639] crypto: inside-secure - fix zeroing of the request in ahash_exit_inv
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (411 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.19 412/639] media: vivid: fix incorrect assignment operation when setting video mode Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.19 414/639] crypto: inside-secure - fix queued len computation Greg Kroah-Hartman
                   ` (229 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Antoine Tenart, Herbert Xu, Sasha Levin

From: Antoine Tenart <antoine.tenart@bootlin.com>

[ Upstream commit b926213d6fede9c9427d7c12eaf7d9f0895deb4e ]

A request is zeroed in safexcel_ahash_exit_inv(). This request total
size is EIP197_AHASH_REQ_SIZE while the memset zeroing it uses
sizeof(struct ahash_request), which happens to be less than
EIP197_AHASH_REQ_SIZE. This patch fixes it.

Fixes: f6beaea30487 ("crypto: inside-secure - authenc(hmac(sha256), cbc(aes)) support")
Signed-off-by: Antoine Tenart <antoine.tenart@bootlin.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/inside-secure/safexcel_hash.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/crypto/inside-secure/safexcel_hash.c b/drivers/crypto/inside-secure/safexcel_hash.c
index ac9282c1a5ec1..9a02f64a45b96 100644
--- a/drivers/crypto/inside-secure/safexcel_hash.c
+++ b/drivers/crypto/inside-secure/safexcel_hash.c
@@ -486,7 +486,7 @@ static int safexcel_ahash_exit_inv(struct crypto_tfm *tfm)
 	struct safexcel_inv_result result = {};
 	int ring = ctx->base.ring;
 
-	memset(req, 0, sizeof(struct ahash_request));
+	memset(req, 0, EIP197_AHASH_REQ_SIZE);
 
 	/* create invalidation request */
 	init_completion(&result.completion);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 414/639] crypto: inside-secure - fix queued len computation
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (412 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.19 413/639] crypto: inside-secure - fix zeroing of the request in ahash_exit_inv Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.19 415/639] arm64: dts: renesas: ebisu: Remove renesas, no-ether-link property Greg Kroah-Hartman
                   ` (228 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Antoine Tenart, Herbert Xu, Sasha Levin

From: Antoine Tenart <antoine.tenart@bootlin.com>

[ Upstream commit ccd65a206a5025cf953a2e4f37e894921b131a5c ]

This patch fixes the queued len computation, which could theoretically
be wrong if req->len[1] - req->processed[1] > 1. Be future-proof here,
and fix it.

Fixes: b460edb6230a ("crypto: inside-secure - sha512 support")
Signed-off-by: Antoine Tenart <antoine.tenart@bootlin.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/inside-secure/safexcel_hash.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/drivers/crypto/inside-secure/safexcel_hash.c b/drivers/crypto/inside-secure/safexcel_hash.c
index 9a02f64a45b96..f3b02c00b7846 100644
--- a/drivers/crypto/inside-secure/safexcel_hash.c
+++ b/drivers/crypto/inside-secure/safexcel_hash.c
@@ -50,10 +50,12 @@ struct safexcel_ahash_req {
 
 static inline u64 safexcel_queued_len(struct safexcel_ahash_req *req)
 {
-	if (req->len[1] > req->processed[1])
-		return 0xffffffff - (req->len[0] - req->processed[0]);
+	u64 len, processed;
 
-	return req->len[0] - req->processed[0];
+	len = (0xffffffff * req->len[1]) + req->len[0];
+	processed = (0xffffffff * req->processed[1]) + req->processed[0];
+
+	return len - processed;
 }
 
 static void safexcel_hash_token(struct safexcel_command_desc *cdesc,
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 415/639] arm64: dts: renesas: ebisu: Remove renesas, no-ether-link property
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (413 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.19 414/639] crypto: inside-secure - fix queued len computation Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.19 416/639] mpls: fix warning with multi-label encap Greg Kroah-Hartman
                   ` (227 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Takeshi Kihara, Simon Horman, Sasha Levin

From: Takeshi Kihara <takeshi.kihara.df@renesas.com>

[ Upstream commit 90d4fa39d028f2e46c57c3d0e1b759e5287d98b7 ]

It is incorrect to specify the no-ether-link property for the AVB device on
the Ebisu board. This is because the property should only be used when a
board does not provide a proper AVB_LINK signal. However, the Ebisu board
does provide this signal.

As per 87c059e9c39d ("arm64: dts: renesas: salvator-x: Remove renesas,
no-ether-link property") this fixes a bug:

    Steps to reproduce:
    - start AVB TX stream (Using aplay via MSE),
    - disconnect+reconnect the eth cable,
    - after a reconnection the eth connection goes iteratively up/down
      without user interaction,
    - this may heal after some seconds or even stay for minutes.

    As the documentation specifies, the "renesas,no-ether-link" option
    should be used when a board does not provide a proper AVB_LINK signal.
    There is no need for this option enabled on RCAR H3/M3 Salvator-X/XS
    and ULCB starter kits since the AVB_LINK is correctly handled by HW.

    Choosing to keep or remove the "renesas,no-ether-link" option will have
    impact on the code flow in the following ways:
    - keeping this option enabled may lead to unexpected behavior since the
      RX & TX are enabled/disabled directly from adjust_link function
      without any HW interrogation,
    - removing this option, the RX & TX will only be enabled/disabled after
      HW interrogation. The HW check is made through the LMON pin in PSR
      register which specifies AVB_LINK signal value (0 - at low level;
      1 - at high level).

    In conclusion, the present change is also a safety improvement because
    it removes the "renesas,no-ether-link" option leading to a proper way
    of detecting the link state based on HW interrogation and not on
    software heuristic.

Fixes: 8441ef643d7d ("arm64: dts: renesas: r8a77990: ebisu: Enable EthernetAVB")
Signed-off-by: Takeshi Kihara <takeshi.kihara.df@renesas.com>
[simon: updated changelog]
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/renesas/r8a77990-ebisu.dts | 1 -
 1 file changed, 1 deletion(-)

diff --git a/arch/arm64/boot/dts/renesas/r8a77990-ebisu.dts b/arch/arm64/boot/dts/renesas/r8a77990-ebisu.dts
index 2bc3a4884b003..470c2a35a5aff 100644
--- a/arch/arm64/boot/dts/renesas/r8a77990-ebisu.dts
+++ b/arch/arm64/boot/dts/renesas/r8a77990-ebisu.dts
@@ -33,7 +33,6 @@
 &avb {
 	pinctrl-0 = <&avb_pins>;
 	pinctrl-names = "default";
-	renesas,no-ether-link;
 	phy-handle = <&phy0>;
 	phy-mode = "rgmii-txid";
 	status = "okay";
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 416/639] mpls: fix warning with multi-label encap
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (414 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.19 415/639] arm64: dts: renesas: ebisu: Remove renesas, no-ether-link property Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.19 417/639] serial: stm32: fix a recursive locking in stm32_config_rs485 Greg Kroah-Hartman
                   ` (226 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, George Wilkie, David Ahern,
	David S. Miller, Sasha Levin

From: George Wilkie <gwilkie@vyatta.att-mail.com>

[ Upstream commit 2f3f7d1fa0d1039b24a55d127ed190f196fc3e79 ]

If you configure a route with multiple labels, e.g.
  ip route add 10.10.3.0/24 encap mpls 16/100 via 10.10.2.2 dev ens4
A warning is logged:
  kernel: [  130.561819] netlink: 'ip': attribute type 1 has an invalid
  length.

This happens because mpls_iptunnel_policy has set the type of
MPLS_IPTUNNEL_DST to fixed size NLA_U32.
Change it to a minimum size.
nla_get_labels() does the remaining validation.

Fixes: e3e4712ec096 ("mpls: ip tunnel support")
Signed-off-by: George Wilkie <gwilkie@vyatta.att-mail.com>
Reviewed-by: David Ahern <dsahern@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/mpls/mpls_iptunnel.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/mpls/mpls_iptunnel.c b/net/mpls/mpls_iptunnel.c
index 94f53a9b7d1ae..faf6ef1b6a454 100644
--- a/net/mpls/mpls_iptunnel.c
+++ b/net/mpls/mpls_iptunnel.c
@@ -28,7 +28,7 @@
 #include "internal.h"
 
 static const struct nla_policy mpls_iptunnel_policy[MPLS_IPTUNNEL_MAX + 1] = {
-	[MPLS_IPTUNNEL_DST]	= { .type = NLA_U32 },
+	[MPLS_IPTUNNEL_DST]	= { .len = sizeof(u32) },
 	[MPLS_IPTUNNEL_TTL]	= { .type = NLA_U8 },
 };
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 417/639] serial: stm32: fix a recursive locking in stm32_config_rs485
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (415 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.19 416/639] mpls: fix warning with multi-label encap Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.19 418/639] arm64: dts: meson-gxm-khadas-vim2: fix gpio-keys-polled node Greg Kroah-Hartman
                   ` (225 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Borut Seljak, Sasha Levin

From: Borut Seljak <borut.seljak@t-2.net>

[ Upstream commit 707aeea13a9c85520262e11899d86df3c4b48262 ]

Remove spin_lock_irqsave in stm32_config_rs485, it cause recursive locking.
Already locked in uart_set_rs485_config.

Fixes: 1bcda09d291081 ("serial: stm32: add support for RS485 hardware control mode")
Signed-off-by: Borut Seljak <borut.seljak@t-2.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/serial/stm32-usart.c | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c
index 1334e42939776..d096e552176cc 100644
--- a/drivers/tty/serial/stm32-usart.c
+++ b/drivers/tty/serial/stm32-usart.c
@@ -105,9 +105,7 @@ static int stm32_config_rs485(struct uart_port *port,
 	struct stm32_usart_config *cfg = &stm32_port->info->cfg;
 	u32 usartdiv, baud, cr1, cr3;
 	bool over8;
-	unsigned long flags;
 
-	spin_lock_irqsave(&port->lock, flags);
 	stm32_clr_bits(port, ofs->cr1, BIT(cfg->uart_enable_bit));
 
 	port->rs485 = *rs485conf;
@@ -147,7 +145,6 @@ static int stm32_config_rs485(struct uart_port *port,
 	}
 
 	stm32_set_bits(port, ofs->cr1, BIT(cfg->uart_enable_bit));
-	spin_unlock_irqrestore(&port->lock, flags);
 
 	return 0;
 }
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 418/639] arm64: dts: meson-gxm-khadas-vim2: fix gpio-keys-polled node
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (416 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.19 417/639] serial: stm32: fix a recursive locking in stm32_config_rs485 Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.19 419/639] arm64: dts: meson-gxm-khadas-vim2: fix Bluetooth support Greg Kroah-Hartman
                   ` (224 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christian Hewitt, Neil Armstrong,
	Martin Blumenstingl, Kevin Hilman, Sasha Levin

From: Christian Hewitt <christianshewitt@gmail.com>

[ Upstream commit 0afd24c2fb61bd5163bab08ea1ee54d60d3ea37e ]

Fix DTC warnings:

meson-gxm-khadas-vim2.dtb: Warning (avoid_unnecessary_addr_size):
   /gpio-keys-polled: unnecessary #address-cells/#size-cells
	without "ranges" or child "reg" property

Fixes: b8b74dda3908 ("ARM64: dts: meson-gxm: Add support for Khadas VIM2")
Signed-off-by: Christian Hewitt <christianshewitt@gmail.com>
Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Tested-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Signed-off-by: Kevin Hilman <khilman@baylibre.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts b/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts
index 782e9edac8051..bfd3a510ff162 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts
@@ -63,11 +63,9 @@
 
 	gpio-keys-polled {
 		compatible = "gpio-keys-polled";
-		#address-cells = <1>;
-		#size-cells = <0>;
 		poll-interval = <100>;
 
-		button@0 {
+		power-button {
 			label = "power";
 			linux,code = <KEY_POWER>;
 			gpios = <&gpio_ao GPIOAO_2 GPIO_ACTIVE_LOW>;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 419/639] arm64: dts: meson-gxm-khadas-vim2: fix Bluetooth support
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (417 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.19 418/639] arm64: dts: meson-gxm-khadas-vim2: fix gpio-keys-polled node Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.19 420/639] iommu/vt-d: Duplicate iommu_resv_region objects per device list Greg Kroah-Hartman
                   ` (223 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christian Hewitt, Neil Armstrong,
	Kevin Hilman, Sasha Levin

From: Christian Hewitt <christianshewitt@gmail.com>

[ Upstream commit 33344e2111a3a07097a66f339ad213b047ccdfd2 ]

- Remove serial1 alias
- Add support for uart_A rts/cts
- Add bluetooth uart_A subnode qith shutdown gpio

Fixes: b8b74dda3908 ("ARM64: dts: meson-gxm: Add support for Khadas VIM2")
Signed-off-by: Christian Hewitt <christianshewitt@gmail.com>
Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
Signed-off-by: Kevin Hilman <khilman@baylibre.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts b/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts
index bfd3a510ff162..785240733d946 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts
@@ -18,7 +18,6 @@
 
 	aliases {
 		serial0 = &uart_AO;
-		serial1 = &uart_A;
 		serial2 = &uart_AO_B;
 	};
 
@@ -407,8 +406,14 @@
 /* This one is connected to the Bluetooth module */
 &uart_A {
 	status = "okay";
-	pinctrl-0 = <&uart_a_pins>;
+	pinctrl-0 = <&uart_a_pins>, <&uart_a_cts_rts_pins>;
 	pinctrl-names = "default";
+	uart-has-rtscts;
+
+	bluetooth {
+		compatible = "brcm,bcm43438-bt";
+		shutdown-gpios = <&gpio GPIOX_17 GPIO_ACTIVE_HIGH>;
+	};
 };
 
 /* This is brought out on the Linux_RX (18) and Linux_TX (19) pins: */
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 420/639] iommu/vt-d: Duplicate iommu_resv_region objects per device list
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (418 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.19 419/639] arm64: dts: meson-gxm-khadas-vim2: fix Bluetooth support Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.19 421/639] phy: usb: phy-brcm-usb: Remove sysfs attributes upon driver removal Greg Kroah-Hartman
                   ` (222 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Eric Auger, Lu Baolu, Joerg Roedel,
	Sasha Levin

From: Eric Auger <eric.auger@redhat.com>

[ Upstream commit 5f64ce5411b467f1cfea6c63e2494c22b773582b ]

intel_iommu_get_resv_regions() aims to return the list of
reserved regions accessible by a given @device. However several
devices can access the same reserved memory region and when
building the list it is not safe to use a single iommu_resv_region
object, whose container is the RMRR. This iommu_resv_region must
be duplicated per device reserved region list.

Let's remove the struct iommu_resv_region from the RMRR unit
and allocate the iommu_resv_region directly in
intel_iommu_get_resv_regions(). We hold the dmar_global_lock instead
of the rcu-lock to allow sleeping.

Fixes: 0659b8dc45a6 ("iommu/vt-d: Implement reserved region get/put callbacks")
Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Lu Baolu <baolu.lu@linux.intel.com>
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iommu/intel-iommu.c | 34 +++++++++++++++++-----------------
 1 file changed, 17 insertions(+), 17 deletions(-)

diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
index abbbc614c5225..9df3b84412274 100644
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -387,7 +387,6 @@ struct dmar_rmrr_unit {
 	u64	end_address;		/* reserved end address */
 	struct dmar_dev_scope *devices;	/* target devices */
 	int	devices_cnt;		/* target device count */
-	struct iommu_resv_region *resv; /* reserved region handle */
 };
 
 struct dmar_atsr_unit {
@@ -4185,7 +4184,6 @@ static inline void init_iommu_pm_ops(void) {}
 int __init dmar_parse_one_rmrr(struct acpi_dmar_header *header, void *arg)
 {
 	struct acpi_dmar_reserved_memory *rmrr;
-	int prot = DMA_PTE_READ|DMA_PTE_WRITE;
 	struct dmar_rmrr_unit *rmrru;
 	size_t length;
 
@@ -4199,22 +4197,16 @@ int __init dmar_parse_one_rmrr(struct acpi_dmar_header *header, void *arg)
 	rmrru->end_address = rmrr->end_address;
 
 	length = rmrr->end_address - rmrr->base_address + 1;
-	rmrru->resv = iommu_alloc_resv_region(rmrr->base_address, length, prot,
-					      IOMMU_RESV_DIRECT);
-	if (!rmrru->resv)
-		goto free_rmrru;
 
 	rmrru->devices = dmar_alloc_dev_scope((void *)(rmrr + 1),
 				((void *)rmrr) + rmrr->header.length,
 				&rmrru->devices_cnt);
 	if (rmrru->devices_cnt && rmrru->devices == NULL)
-		goto free_all;
+		goto free_rmrru;
 
 	list_add(&rmrru->list, &dmar_rmrr_units);
 
 	return 0;
-free_all:
-	kfree(rmrru->resv);
 free_rmrru:
 	kfree(rmrru);
 out:
@@ -4432,7 +4424,6 @@ static void intel_iommu_free_dmars(void)
 	list_for_each_entry_safe(rmrru, rmrr_n, &dmar_rmrr_units, list) {
 		list_del(&rmrru->list);
 		dmar_free_dev_scope(&rmrru->devices, &rmrru->devices_cnt);
-		kfree(rmrru->resv);
 		kfree(rmrru);
 	}
 
@@ -5206,22 +5197,33 @@ static void intel_iommu_remove_device(struct device *dev)
 static void intel_iommu_get_resv_regions(struct device *device,
 					 struct list_head *head)
 {
+	int prot = DMA_PTE_READ | DMA_PTE_WRITE;
 	struct iommu_resv_region *reg;
 	struct dmar_rmrr_unit *rmrr;
 	struct device *i_dev;
 	int i;
 
-	rcu_read_lock();
+	down_read(&dmar_global_lock);
 	for_each_rmrr_units(rmrr) {
 		for_each_active_dev_scope(rmrr->devices, rmrr->devices_cnt,
 					  i, i_dev) {
+			struct iommu_resv_region *resv;
+			size_t length;
+
 			if (i_dev != device)
 				continue;
 
-			list_add_tail(&rmrr->resv->list, head);
+			length = rmrr->end_address - rmrr->base_address + 1;
+			resv = iommu_alloc_resv_region(rmrr->base_address,
+						       length, prot,
+						       IOMMU_RESV_DIRECT);
+			if (!resv)
+				break;
+
+			list_add_tail(&resv->list, head);
 		}
 	}
-	rcu_read_unlock();
+	up_read(&dmar_global_lock);
 
 	reg = iommu_alloc_resv_region(IOAPIC_RANGE_START,
 				      IOAPIC_RANGE_END - IOAPIC_RANGE_START + 1,
@@ -5236,10 +5238,8 @@ static void intel_iommu_put_resv_regions(struct device *dev,
 {
 	struct iommu_resv_region *entry, *next;
 
-	list_for_each_entry_safe(entry, next, head, list) {
-		if (entry->type == IOMMU_RESV_MSI)
-			kfree(entry);
-	}
+	list_for_each_entry_safe(entry, next, head, list)
+		kfree(entry);
 }
 
 #ifdef CONFIG_INTEL_IOMMU_SVM
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 421/639] phy: usb: phy-brcm-usb: Remove sysfs attributes upon driver removal
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (419 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.19 420/639] iommu/vt-d: Duplicate iommu_resv_region objects per device list Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.19 422/639] firmware: arm_scmi: fix bitfield definitions for SENSOR_DESC attributes Greg Kroah-Hartman
                   ` (221 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Florian Fainelli,
	Kishon Vijay Abraham I, Sasha Levin

From: Florian Fainelli <f.fainelli@gmail.com>

[ Upstream commit d9e100829fca6cbd270d7e005b0c0bb2d14924b8 ]

We are not destroying the sysfs attribute groupe we registered during
the probe function which will make subsequent probe calls to that
driver fail. Correct that with adding a remove function which only
removes those attributes since the reference counting on clocks did its
job already.

Fixes: 415060b21f31 ("phy: usb: phy-brcm-usb: Add ability to force DRD mode to host or device")
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/phy/broadcom/phy-brcm-usb.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/phy/broadcom/phy-brcm-usb.c b/drivers/phy/broadcom/phy-brcm-usb.c
index d1dab36fa5b7b..e2455ffb85979 100644
--- a/drivers/phy/broadcom/phy-brcm-usb.c
+++ b/drivers/phy/broadcom/phy-brcm-usb.c
@@ -378,6 +378,13 @@ static int brcm_usb_phy_probe(struct platform_device *pdev)
 	return 0;
 }
 
+static int brcm_usb_phy_remove(struct platform_device *pdev)
+{
+	sysfs_remove_group(&pdev->dev.kobj, &brcm_usb_phy_group);
+
+	return 0;
+}
+
 #ifdef CONFIG_PM_SLEEP
 static int brcm_usb_phy_suspend(struct device *dev)
 {
@@ -443,6 +450,7 @@ MODULE_DEVICE_TABLE(of, brcm_usb_dt_ids);
 
 static struct platform_driver brcm_usb_driver = {
 	.probe		= brcm_usb_phy_probe,
+	.remove		= brcm_usb_phy_remove,
 	.driver		= {
 		.name	= "brcmstb-usb-phy",
 		.owner	= THIS_MODULE,
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 422/639] firmware: arm_scmi: fix bitfield definitions for SENSOR_DESC attributes
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (420 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.19 421/639] phy: usb: phy-brcm-usb: Remove sysfs attributes upon driver removal Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.19 423/639] firmware: arm_scmi: update rate_discrete in clock_describe_rates_get Greg Kroah-Hartman
                   ` (220 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Florian Fainelli, Sudeep Holla, Sasha Levin

From: Sudeep Holla <sudeep.holla@arm.com>

[ Upstream commit 430daaf96ad133be5ce7c3a5c60e94247f7c6f71 ]

As per the SCMI specification the bitfields for SENSOR_DESC attributes
are as follows:
attributes_low 	[7:0] 	Number of trip points supported
attributes_high	[15:11]	The power-of-10 multiplier in 2's-complement
			format that is applied to the sensor units

Looks like the code developed during the draft versions of the
specification slipped through and are wrong with respect to final
released version. Fix them by adjusting the bitfields appropriately.

Fixes: 5179c523c1ea ("firmware: arm_scmi: add initial support for sensor protocol")
Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/firmware/arm_scmi/sensors.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/firmware/arm_scmi/sensors.c b/drivers/firmware/arm_scmi/sensors.c
index b53d5cc9c9f6c..c00287b5f2c23 100644
--- a/drivers/firmware/arm_scmi/sensors.c
+++ b/drivers/firmware/arm_scmi/sensors.c
@@ -30,10 +30,10 @@ struct scmi_msg_resp_sensor_description {
 		__le32 id;
 		__le32 attributes_low;
 #define SUPPORTS_ASYNC_READ(x)	((x) & BIT(31))
-#define NUM_TRIP_POINTS(x)	(((x) >> 4) & 0xff)
+#define NUM_TRIP_POINTS(x)	((x) & 0xff)
 		__le32 attributes_high;
 #define SENSOR_TYPE(x)		((x) & 0xff)
-#define SENSOR_SCALE(x)		(((x) >> 11) & 0x3f)
+#define SENSOR_SCALE(x)		(((x) >> 11) & 0x1f)
 #define SENSOR_UPDATE_SCALE(x)	(((x) >> 22) & 0x1f)
 #define SENSOR_UPDATE_BASE(x)	(((x) >> 27) & 0x1f)
 		    u8 name[SCMI_MAX_STR_SIZE];
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 423/639] firmware: arm_scmi: update rate_discrete in clock_describe_rates_get
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (421 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.19 422/639] firmware: arm_scmi: fix bitfield definitions for SENSOR_DESC attributes Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.19 424/639] ntb_hw_switchtec: potential shift wrapping bug in switchtec_ntb_init_sndev() Greg Kroah-Hartman
                   ` (219 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Peng Fan, Sudeep Holla, Sasha Levin

From: Peng Fan <peng.fan@nxp.com>

[ Upstream commit c0759b9b5d411ab27c479125cee9bae391a96436 ]

The boolean rate_discrete needs to be assigned to clk->rate_discrete,
so that clock driver can distinguish between the continuous range and
discrete rates. It uses this in scmi_clk_round_rate could get the
rounded value if it's a continuous range.

Fixes: 5f6c6430e904 ("firmware: arm_scmi: add initial support for clock protocol")
Signed-off-by: Peng Fan <peng.fan@nxp.com>
[sudeep.holla: updated commit message]
Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/firmware/arm_scmi/clock.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/firmware/arm_scmi/clock.c b/drivers/firmware/arm_scmi/clock.c
index 30fc04e284312..0a194af924385 100644
--- a/drivers/firmware/arm_scmi/clock.c
+++ b/drivers/firmware/arm_scmi/clock.c
@@ -185,6 +185,8 @@ scmi_clock_describe_rates_get(const struct scmi_handle *handle, u32 clk_id,
 	if (rate_discrete)
 		clk->list.num_rates = tot_rate_cnt;
 
+	clk->rate_discrete = rate_discrete;
+
 err:
 	scmi_xfer_put(handle, t);
 	return ret;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 424/639] ntb_hw_switchtec: potential shift wrapping bug in switchtec_ntb_init_sndev()
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (422 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.19 423/639] firmware: arm_scmi: update rate_discrete in clock_describe_rates_get Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.19 425/639] ASoC: meson: axg-tdmin: right_j is not supported Greg Kroah-Hartman
                   ` (218 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Logan Gunthorpe,
	Jon Mason, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit ff148d8ac53e59802645bd3200c811620317eb9f ]

This code triggers a Smatch warning:

    drivers/ntb/hw/mscc/ntb_hw_switchtec.c:884 switchtec_ntb_init_sndev()
    warn: should '(1 << sndev->peer_partition)' be a 64 bit type?

The "part_map" and "tpart_vec" variables are u64 type so this seems like
a valid warning.

Fixes: 3df54c870f52 ("ntb_hw_switchtec: Allow using Switchtec NTB in multi-partition setups")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Logan Gunthorpe <logang@deltatee.com>
Signed-off-by: Jon Mason <jdmason@kudzu.us>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/ntb/hw/mscc/ntb_hw_switchtec.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/ntb/hw/mscc/ntb_hw_switchtec.c b/drivers/ntb/hw/mscc/ntb_hw_switchtec.c
index 9916bc5b6759a..313f6258c4249 100644
--- a/drivers/ntb/hw/mscc/ntb_hw_switchtec.c
+++ b/drivers/ntb/hw/mscc/ntb_hw_switchtec.c
@@ -899,7 +899,7 @@ static int switchtec_ntb_init_sndev(struct switchtec_ntb *sndev)
 		}
 
 		sndev->peer_partition = ffs(tpart_vec) - 1;
-		if (!(part_map & (1 << sndev->peer_partition))) {
+		if (!(part_map & (1ULL << sndev->peer_partition))) {
 			dev_err(&sndev->stdev->dev,
 				"ntb target partition is not NT partition\n");
 			return -ENODEV;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 425/639] ASoC: meson: axg-tdmin: right_j is not supported
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (423 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.19 424/639] ntb_hw_switchtec: potential shift wrapping bug in switchtec_ntb_init_sndev() Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.19 426/639] ASoC: meson: axg-tdmout: " Greg Kroah-Hartman
                   ` (217 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jerome Brunet, Mark Brown, Sasha Levin

From: Jerome Brunet <jbrunet@baylibre.com>

[ Upstream commit 47c317b786b6c1efc2cb3cdb894fd323422fe5ea ]

Right justified format is actually not supported by the amlogic tdm input
decoder.

Fixes: 13a22e6a98f8 ("ASoC: meson: add tdm input driver")
Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/meson/axg-tdmin.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/sound/soc/meson/axg-tdmin.c b/sound/soc/meson/axg-tdmin.c
index bbac44c816886..37207bbebb2a4 100644
--- a/sound/soc/meson/axg-tdmin.c
+++ b/sound/soc/meson/axg-tdmin.c
@@ -119,7 +119,6 @@ static int axg_tdmin_prepare(struct regmap *map, struct axg_tdm_stream *ts)
 		break;
 
 	case SND_SOC_DAIFMT_LEFT_J:
-	case SND_SOC_DAIFMT_RIGHT_J:
 	case SND_SOC_DAIFMT_DSP_B:
 		val = TDMIN_CTRL_IN_BIT_SKEW(2);
 		break;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 426/639] ASoC: meson: axg-tdmout: right_j is not supported
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (424 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.19 425/639] ASoC: meson: axg-tdmin: right_j is not supported Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.19 427/639] PCI: PM: Skip devices in D0 for suspend-to-idle Greg Kroah-Hartman
                   ` (216 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jerome Brunet, Mark Brown, Sasha Levin

From: Jerome Brunet <jbrunet@baylibre.com>

[ Upstream commit 7e0d7d0fbd06af0507611f85dba8daf24832abd9 ]

Right justified format is actually not supported by the amlogic tdm output
encoder.

Fixes: c41c2a355b86 ("ASoC: meson: add tdm output driver")
Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/meson/axg-tdmout.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/sound/soc/meson/axg-tdmout.c b/sound/soc/meson/axg-tdmout.c
index f73368ee1088f..d11acb3cc696f 100644
--- a/sound/soc/meson/axg-tdmout.c
+++ b/sound/soc/meson/axg-tdmout.c
@@ -136,7 +136,6 @@ static int axg_tdmout_prepare(struct regmap *map, struct axg_tdm_stream *ts)
 		break;
 
 	case SND_SOC_DAIFMT_LEFT_J:
-	case SND_SOC_DAIFMT_RIGHT_J:
 	case SND_SOC_DAIFMT_DSP_B:
 		val |= TDMOUT_CTRL0_INIT_BITNUM(2);
 		break;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 427/639] PCI: PM: Skip devices in D0 for suspend-to-idle
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (425 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.19 426/639] ASoC: meson: axg-tdmout: " Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.19 428/639] qed: iWARP - Use READ_ONCE and smp_store_release to access ep->state Greg Kroah-Hartman
                   ` (215 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Kai-Heng Feng, Rafael J. Wysocki,
	Mika Westerberg, Sasha Levin

From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>

[ Upstream commit 3e26c5feed2add218046ecf91bab3cfa9bf762a6 ]

Commit d491f2b75237 ("PCI: PM: Avoid possible suspend-to-idle issue")
attempted to avoid a problem with devices whose drivers want them to
stay in D0 over suspend-to-idle and resume, but it did not go as far
as it should with that.

Namely, first of all, the power state of a PCI bridge with a
downstream device in D0 must be D0 (based on the PCI PM spec r1.2,
sec 6, table 6-1, if the bridge is not in D0, there can be no PCI
transactions on its secondary bus), but that is not actively enforced
during system-wide PM transitions, so use the skip_bus_pm flag
introduced by commit d491f2b75237 for that.

Second, the configuration of devices left in D0 (whatever the reason)
during suspend-to-idle need not be changed and attempting to put them
into D0 again by force is pointless, so explicitly avoid doing that.

Fixes: d491f2b75237 ("PCI: PM: Avoid possible suspend-to-idle issue")
Reported-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Tested-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/pci-driver.c | 47 ++++++++++++++++++++++++++++++----------
 1 file changed, 35 insertions(+), 12 deletions(-)

diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c
index 5c9873fcbd08b..e69af9b8361dc 100644
--- a/drivers/pci/pci-driver.c
+++ b/drivers/pci/pci-driver.c
@@ -526,7 +526,6 @@ static void pci_pm_default_resume_early(struct pci_dev *pci_dev)
 	pci_power_up(pci_dev);
 	pci_restore_state(pci_dev);
 	pci_pme_restore(pci_dev);
-	pci_fixup_device(pci_fixup_resume_early, pci_dev);
 }
 
 /*
@@ -833,18 +832,16 @@ static int pci_pm_suspend_noirq(struct device *dev)
 
 	if (pci_dev->skip_bus_pm) {
 		/*
-		 * The function is running for the second time in a row without
+		 * Either the device is a bridge with a child in D0 below it, or
+		 * the function is running for the second time in a row without
 		 * going through full resume, which is possible only during
-		 * suspend-to-idle in a spurious wakeup case.  Moreover, the
-		 * device was originally left in D0, so its power state should
-		 * not be changed here and the device register values saved
-		 * originally should be restored on resume again.
+		 * suspend-to-idle in a spurious wakeup case.  The device should
+		 * be in D0 at this point, but if it is a bridge, it may be
+		 * necessary to save its state.
 		 */
-		pci_dev->state_saved = true;
-	} else if (pci_dev->state_saved) {
-		if (pci_dev->current_state == PCI_D0)
-			pci_dev->skip_bus_pm = true;
-	} else {
+		if (!pci_dev->state_saved)
+			pci_save_state(pci_dev);
+	} else if (!pci_dev->state_saved) {
 		pci_save_state(pci_dev);
 		if (pci_power_manageable(pci_dev))
 			pci_prepare_to_sleep(pci_dev);
@@ -853,6 +850,22 @@ static int pci_pm_suspend_noirq(struct device *dev)
 	dev_dbg(dev, "PCI PM: Suspend power state: %s\n",
 		pci_power_name(pci_dev->current_state));
 
+	if (pci_dev->current_state == PCI_D0) {
+		pci_dev->skip_bus_pm = true;
+		/*
+		 * Per PCI PM r1.2, table 6-1, a bridge must be in D0 if any
+		 * downstream device is in D0, so avoid changing the power state
+		 * of the parent bridge by setting the skip_bus_pm flag for it.
+		 */
+		if (pci_dev->bus->self)
+			pci_dev->bus->self->skip_bus_pm = true;
+	}
+
+	if (pci_dev->skip_bus_pm && !pm_suspend_via_firmware()) {
+		dev_dbg(dev, "PCI PM: Skipped\n");
+		goto Fixup;
+	}
+
 	pci_pm_set_unknown_state(pci_dev);
 
 	/*
@@ -900,7 +913,16 @@ static int pci_pm_resume_noirq(struct device *dev)
 	if (dev_pm_smart_suspend_and_suspended(dev))
 		pm_runtime_set_active(dev);
 
-	pci_pm_default_resume_early(pci_dev);
+	/*
+	 * In the suspend-to-idle case, devices left in D0 during suspend will
+	 * stay in D0, so it is not necessary to restore or update their
+	 * configuration here and attempting to put them into D0 again may
+	 * confuse some firmware, so avoid doing that.
+	 */
+	if (!pci_dev->skip_bus_pm || pm_suspend_via_firmware())
+		pci_pm_default_resume_early(pci_dev);
+
+	pci_fixup_device(pci_fixup_resume_early, pci_dev);
 
 	if (pci_has_legacy_pm_support(pci_dev))
 		return pci_legacy_resume_early(dev);
@@ -1201,6 +1223,7 @@ static int pci_pm_restore_noirq(struct device *dev)
 	}
 
 	pci_pm_default_resume_early(pci_dev);
+	pci_fixup_device(pci_fixup_resume_early, pci_dev);
 
 	if (pci_has_legacy_pm_support(pci_dev))
 		return pci_legacy_resume_early(dev);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 428/639] qed: iWARP - Use READ_ONCE and smp_store_release to access ep->state
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (426 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.19 427/639] PCI: PM: Skip devices in D0 for suspend-to-idle Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:29 ` [PATCH 4.19 429/639] qed: iWARP - fix uninitialized callback Greg Kroah-Hartman
                   ` (214 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ariel Elior, Michal Kalderon,
	David S. Miller, Sasha Levin

From: Michal Kalderon <michal.kalderon@marvell.com>

[ Upstream commit 6117561e1bb30b2fe7f51e1961f34dbedd0bec8a ]

Destroy QP waits for it's ep object state to be set to CLOSED
before proceeding. ep->state can be updated from a different
context. Add smp_store_release/READ_ONCE to synchronize.

Fixes: fc4c6065e661 ("qed: iWARP implement disconnect flows")
Signed-off-by: Ariel Elior <ariel.elior@marvell.com>
Signed-off-by: Michal Kalderon <michal.kalderon@marvell.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/qlogic/qed/qed_iwarp.c | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/drivers/net/ethernet/qlogic/qed/qed_iwarp.c b/drivers/net/ethernet/qlogic/qed/qed_iwarp.c
index 7002a660b6b4c..c77babd0ef952 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_iwarp.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_iwarp.c
@@ -532,7 +532,8 @@ int qed_iwarp_destroy_qp(struct qed_hwfn *p_hwfn, struct qed_rdma_qp *qp)
 
 	/* Make sure ep is closed before returning and freeing memory. */
 	if (ep) {
-		while (ep->state != QED_IWARP_EP_CLOSED && wait_count++ < 200)
+		while (READ_ONCE(ep->state) != QED_IWARP_EP_CLOSED &&
+		       wait_count++ < 200)
 			msleep(100);
 
 		if (ep->state != QED_IWARP_EP_CLOSED)
@@ -1023,8 +1024,6 @@ qed_iwarp_mpa_complete(struct qed_hwfn *p_hwfn,
 
 	params.ep_context = ep;
 
-	ep->state = QED_IWARP_EP_CLOSED;
-
 	switch (fw_return_code) {
 	case RDMA_RETURN_OK:
 		ep->qp->max_rd_atomic_req = ep->cm_info.ord;
@@ -1084,6 +1083,10 @@ qed_iwarp_mpa_complete(struct qed_hwfn *p_hwfn,
 		break;
 	}
 
+	if (fw_return_code != RDMA_RETURN_OK)
+		/* paired with READ_ONCE in destroy_qp */
+		smp_store_release(&ep->state, QED_IWARP_EP_CLOSED);
+
 	ep->event_cb(ep->cb_context, &params);
 
 	/* on passive side, if there is no associated QP (REJECT) we need to
@@ -2828,7 +2831,9 @@ static void qed_iwarp_qp_in_error(struct qed_hwfn *p_hwfn,
 	params.status = (fw_return_code == IWARP_QP_IN_ERROR_GOOD_CLOSE) ?
 			 0 : -ECONNRESET;
 
-	ep->state = QED_IWARP_EP_CLOSED;
+	/* paired with READ_ONCE in destroy_qp */
+	smp_store_release(&ep->state, QED_IWARP_EP_CLOSED);
+
 	spin_lock_bh(&p_hwfn->p_rdma_info->iwarp.iw_lock);
 	list_del(&ep->list_entry);
 	spin_unlock_bh(&p_hwfn->p_rdma_info->iwarp.iw_lock);
@@ -2917,7 +2922,8 @@ qed_iwarp_tcp_connect_unsuccessful(struct qed_hwfn *p_hwfn,
 	params.event = QED_IWARP_EVENT_ACTIVE_COMPLETE;
 	params.ep_context = ep;
 	params.cm_info = &ep->cm_info;
-	ep->state = QED_IWARP_EP_CLOSED;
+	/* paired with READ_ONCE in destroy_qp */
+	smp_store_release(&ep->state, QED_IWARP_EP_CLOSED);
 
 	switch (fw_return_code) {
 	case IWARP_CONN_ERROR_TCP_CONNECT_INVALID_PACKET:
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 429/639] qed: iWARP - fix uninitialized callback
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (427 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.19 428/639] qed: iWARP - Use READ_ONCE and smp_store_release to access ep->state Greg Kroah-Hartman
@ 2020-01-24  9:29 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.19 430/639] powerpc/cacheinfo: add cacheinfo_teardown, cacheinfo_rebuild Greg Kroah-Hartman
                   ` (213 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ariel Elior, Michal Kalderon,
	David S. Miller, Sasha Levin

From: Michal Kalderon <michal.kalderon@marvell.com>

[ Upstream commit 43cf40d93fadbb0d3edf0942a4612f8ff67478a1 ]

Fix uninitialized variable warning by static checker.

Fixes: ae3488ff37dc ("qed: Add ll2 connection for processing unaligned MPA packets")
Signed-off-by: Ariel Elior <ariel.elior@marvell.com>
Signed-off-by: Michal Kalderon <michal.kalderon@marvell.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/qlogic/qed/qed_iwarp.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/ethernet/qlogic/qed/qed_iwarp.c b/drivers/net/ethernet/qlogic/qed/qed_iwarp.c
index c77babd0ef952..39787bb885c86 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_iwarp.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_iwarp.c
@@ -2641,6 +2641,7 @@ qed_iwarp_ll2_start(struct qed_hwfn *p_hwfn,
 	cbs.rx_release_cb = qed_iwarp_ll2_rel_rx_pkt;
 	cbs.tx_comp_cb = qed_iwarp_ll2_comp_tx_pkt;
 	cbs.tx_release_cb = qed_iwarp_ll2_rel_tx_pkt;
+	cbs.slowpath_cb = NULL;
 	cbs.cookie = p_hwfn;
 
 	memset(&data, 0, sizeof(data));
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 430/639] powerpc/cacheinfo: add cacheinfo_teardown, cacheinfo_rebuild
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (428 preceding siblings ...)
  2020-01-24  9:29 ` [PATCH 4.19 429/639] qed: iWARP - fix uninitialized callback Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.19 431/639] powerpc/pseries/mobility: rebuild cacheinfo hierarchy post-migration Greg Kroah-Hartman
                   ` (212 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Nathan Lynch, Gautham R. Shenoy,
	Michael Ellerman, Sasha Levin

From: Nathan Lynch <nathanl@linux.ibm.com>

[ Upstream commit d4aa219a074a5abaf95a756b9f0d190b5c03a945 ]

Allow external callers to force the cacheinfo code to release all its
references to cache nodes, e.g. before processing device tree updates
post-migration, and to rebuild the hierarchy afterward.

CPU online/offline must be blocked by callers; enforce this.

Fixes: 410bccf97881 ("powerpc/pseries: Partition migration in the kernel")
Signed-off-by: Nathan Lynch <nathanl@linux.ibm.com>
Reviewed-by: Gautham R. Shenoy <ego@linux.vnet.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/kernel/cacheinfo.c | 21 +++++++++++++++++++++
 arch/powerpc/kernel/cacheinfo.h |  4 ++++
 2 files changed, 25 insertions(+)

diff --git a/arch/powerpc/kernel/cacheinfo.c b/arch/powerpc/kernel/cacheinfo.c
index a8f20e5928e13..9edb454301336 100644
--- a/arch/powerpc/kernel/cacheinfo.c
+++ b/arch/powerpc/kernel/cacheinfo.c
@@ -865,4 +865,25 @@ void cacheinfo_cpu_offline(unsigned int cpu_id)
 	if (cache)
 		cache_cpu_clear(cache, cpu_id);
 }
+
+void cacheinfo_teardown(void)
+{
+	unsigned int cpu;
+
+	lockdep_assert_cpus_held();
+
+	for_each_online_cpu(cpu)
+		cacheinfo_cpu_offline(cpu);
+}
+
+void cacheinfo_rebuild(void)
+{
+	unsigned int cpu;
+
+	lockdep_assert_cpus_held();
+
+	for_each_online_cpu(cpu)
+		cacheinfo_cpu_online(cpu);
+}
+
 #endif /* (CONFIG_PPC_PSERIES && CONFIG_SUSPEND) || CONFIG_HOTPLUG_CPU */
diff --git a/arch/powerpc/kernel/cacheinfo.h b/arch/powerpc/kernel/cacheinfo.h
index 955f5e999f1b8..52bd3fc6642da 100644
--- a/arch/powerpc/kernel/cacheinfo.h
+++ b/arch/powerpc/kernel/cacheinfo.h
@@ -6,4 +6,8 @@
 extern void cacheinfo_cpu_online(unsigned int cpu_id);
 extern void cacheinfo_cpu_offline(unsigned int cpu_id);
 
+/* Allow migration/suspend to tear down and rebuild the hierarchy. */
+extern void cacheinfo_teardown(void);
+extern void cacheinfo_rebuild(void);
+
 #endif /* _PPC_CACHEINFO_H */
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 431/639] powerpc/pseries/mobility: rebuild cacheinfo hierarchy post-migration
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (429 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.19 430/639] powerpc/cacheinfo: add cacheinfo_teardown, cacheinfo_rebuild Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.19 432/639] bpf: fix the check that forwarding is enabled in bpf_ipv6_fib_lookup Greg Kroah-Hartman
                   ` (211 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Nathan Lynch, Gautham R. Shenoy,
	Michael Ellerman, Sasha Levin

From: Nathan Lynch <nathanl@linux.ibm.com>

[ Upstream commit e610a466d16a086e321f0bd421e2fc75cff28605 ]

It's common for the platform to replace the cache device nodes after a
migration. Since the cacheinfo code is never informed about this, it
never drops its references to the source system's cache nodes, causing
it to wind up in an inconsistent state resulting in warnings and oopses
as soon as CPU online/offline occurs after the migration, e.g.

  cache for /cpus/l3-cache@3113(Unified) refers to cache for /cpus/l2-cache@200d(Unified)
  WARNING: CPU: 15 PID: 86 at arch/powerpc/kernel/cacheinfo.c:176 release_cache+0x1bc/0x1d0
  [...]
  NIP release_cache+0x1bc/0x1d0
  LR  release_cache+0x1b8/0x1d0
  Call Trace:
    release_cache+0x1b8/0x1d0 (unreliable)
    cacheinfo_cpu_offline+0x1c4/0x2c0
    unregister_cpu_online+0x1b8/0x260
    cpuhp_invoke_callback+0x114/0xf40
    cpuhp_thread_fun+0x270/0x310
    smpboot_thread_fn+0x2c8/0x390
    kthread+0x1b8/0x1c0
    ret_from_kernel_thread+0x5c/0x68

Using device tree notifiers won't work since we want to rebuild the
hierarchy only after all the removals and additions have occurred and
the device tree is in a consistent state. Call cacheinfo_teardown()
before processing device tree updates, and rebuild the hierarchy
afterward.

Fixes: 410bccf97881 ("powerpc/pseries: Partition migration in the kernel")
Signed-off-by: Nathan Lynch <nathanl@linux.ibm.com>
Reviewed-by: Gautham R. Shenoy <ego@linux.vnet.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/platforms/pseries/mobility.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/arch/powerpc/platforms/pseries/mobility.c b/arch/powerpc/platforms/pseries/mobility.c
index e4ea713833832..70744b4fbd9ed 100644
--- a/arch/powerpc/platforms/pseries/mobility.c
+++ b/arch/powerpc/platforms/pseries/mobility.c
@@ -24,6 +24,7 @@
 #include <asm/machdep.h>
 #include <asm/rtas.h>
 #include "pseries.h"
+#include "../../kernel/cacheinfo.h"
 
 static struct kobject *mobility_kobj;
 
@@ -360,11 +361,20 @@ void post_mobility_fixup(void)
 	 */
 	cpus_read_lock();
 
+	/*
+	 * It's common for the destination firmware to replace cache
+	 * nodes.  Release all of the cacheinfo hierarchy's references
+	 * before updating the device tree.
+	 */
+	cacheinfo_teardown();
+
 	rc = pseries_devicetree_update(MIGRATION_SCOPE);
 	if (rc)
 		printk(KERN_ERR "Post-mobility device tree update "
 			"failed: %d\n", rc);
 
+	cacheinfo_rebuild();
+
 	cpus_read_unlock();
 
 	/* Possibly switch to a new RFI flush type */
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 432/639] bpf: fix the check that forwarding is enabled in bpf_ipv6_fib_lookup
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (430 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.19 431/639] powerpc/pseries/mobility: rebuild cacheinfo hierarchy post-migration Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.19 433/639] IB/hfi1: Handle port down properly in pio Greg Kroah-Hartman
                   ` (210 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Anton Protopopov,
	Toke Høiland-Jørgensen, David Ahern, Daniel Borkmann,
	Sasha Levin

From: Anton Protopopov <a.s.protopopov@gmail.com>

[ Upstream commit 56f0f84e69c7a7f229dfa524b13b0ceb6ce9b09e ]

The bpf_ipv6_fib_lookup function should return BPF_FIB_LKUP_RET_FWD_DISABLED
when forwarding is disabled for the input device.  However instead of checking
if forwarding is enabled on the input device, it checked the global
net->ipv6.devconf_all->forwarding flag.  Change it to behave as expected.

Fixes: 87f5fc7e48dd ("bpf: Provide helper to do forwarding lookups in kernel FIB table")
Signed-off-by: Anton Protopopov <a.s.protopopov@gmail.com>
Acked-by: Toke Høiland-Jørgensen <toke@redhat.com>
Reviewed-by: David Ahern <dsahern@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/core/filter.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/core/filter.c b/net/core/filter.c
index 91b9502619757..9daf1a4118b51 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -4367,7 +4367,7 @@ static int bpf_ipv6_fib_lookup(struct net *net, struct bpf_fib_lookup *params,
 		return -ENODEV;
 
 	idev = __in6_dev_get_safely(dev);
-	if (unlikely(!idev || !net->ipv6.devconf_all->forwarding))
+	if (unlikely(!idev || !idev->cnf.forwarding))
 		return BPF_FIB_LKUP_RET_FWD_DISABLED;
 
 	if (flags & BPF_FIB_LOOKUP_OUTPUT) {
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 433/639] IB/hfi1: Handle port down properly in pio
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (431 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.19 432/639] bpf: fix the check that forwarding is enabled in bpf_ipv6_fib_lookup Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.19 434/639] drm/msm/mdp5: Fix mdp5_cfg_init error return Greg Kroah-Hartman
                   ` (209 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dennis Dalessandro, Mike Marciniszyn,
	Doug Ledford, Sasha Levin

From: Mike Marciniszyn <mike.marciniszyn@intel.com>

[ Upstream commit 942a899335707fc9cfc97cb382a60734b2ff4e03 ]

The call to sc_buffer_alloc currently returns NULL (no buffer) or
a buffer descriptor.

There is a third case when the port is down.  Currently that
returns NULL and this prevents the caller from properly handling the
sc_buffer_alloc() failure.  A verbs code link test after the call is
racy so the indication needs to come from the state check inside the allocation
routine to be valid.

Fix by encoding the ECOMM failure like SDMA.   IS_ERR_OR_NULL() tests
are added at all call sites.  For verbs send, this needs to treat any
error by returning a completion without any MMIO copy.

Fixes: 7724105686e7 ("IB/hfi1: add driver files")
Reviewed-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
Signed-off-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/hw/hfi1/pio.c   | 5 +++--
 drivers/infiniband/hw/hfi1/rc.c    | 2 +-
 drivers/infiniband/hw/hfi1/ud.c    | 4 ++--
 drivers/infiniband/hw/hfi1/verbs.c | 4 ++--
 4 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/drivers/infiniband/hw/hfi1/pio.c b/drivers/infiniband/hw/hfi1/pio.c
index 752057647f091..3fcbf56f8be23 100644
--- a/drivers/infiniband/hw/hfi1/pio.c
+++ b/drivers/infiniband/hw/hfi1/pio.c
@@ -1434,7 +1434,8 @@ void sc_stop(struct send_context *sc, int flag)
  * @cb: optional callback to call when the buffer is finished sending
  * @arg: argument for cb
  *
- * Return a pointer to a PIO buffer if successful, NULL if not enough room.
+ * Return a pointer to a PIO buffer, NULL if not enough room, -ECOMM
+ * when link is down.
  */
 struct pio_buf *sc_buffer_alloc(struct send_context *sc, u32 dw_len,
 				pio_release_cb cb, void *arg)
@@ -1450,7 +1451,7 @@ struct pio_buf *sc_buffer_alloc(struct send_context *sc, u32 dw_len,
 	spin_lock_irqsave(&sc->alloc_lock, flags);
 	if (!(sc->flags & SCF_ENABLED)) {
 		spin_unlock_irqrestore(&sc->alloc_lock, flags);
-		goto done;
+		return ERR_PTR(-ECOMM);
 	}
 
 retry:
diff --git a/drivers/infiniband/hw/hfi1/rc.c b/drivers/infiniband/hw/hfi1/rc.c
index 980168a567071..7ed6fb407a689 100644
--- a/drivers/infiniband/hw/hfi1/rc.c
+++ b/drivers/infiniband/hw/hfi1/rc.c
@@ -914,7 +914,7 @@ void hfi1_send_rc_ack(struct hfi1_packet *packet, bool is_fecn)
 	pbc = create_pbc(ppd, pbc_flags, qp->srate_mbps,
 			 sc_to_vlt(ppd->dd, sc5), plen);
 	pbuf = sc_buffer_alloc(rcd->sc, plen, NULL, NULL);
-	if (!pbuf) {
+	if (IS_ERR_OR_NULL(pbuf)) {
 		/*
 		 * We have no room to send at the moment.  Pass
 		 * responsibility for sending the ACK to the send engine
diff --git a/drivers/infiniband/hw/hfi1/ud.c b/drivers/infiniband/hw/hfi1/ud.c
index ef5b3ffd3888b..839593641e3fd 100644
--- a/drivers/infiniband/hw/hfi1/ud.c
+++ b/drivers/infiniband/hw/hfi1/ud.c
@@ -703,7 +703,7 @@ void return_cnp_16B(struct hfi1_ibport *ibp, struct rvt_qp *qp,
 	pbc = create_pbc(ppd, pbc_flags, qp->srate_mbps, vl, plen);
 	if (ctxt) {
 		pbuf = sc_buffer_alloc(ctxt, plen, NULL, NULL);
-		if (pbuf) {
+		if (!IS_ERR_OR_NULL(pbuf)) {
 			trace_pio_output_ibhdr(ppd->dd, &hdr, sc5);
 			ppd->dd->pio_inline_send(ppd->dd, pbuf, pbc,
 						 &hdr, hwords);
@@ -758,7 +758,7 @@ void return_cnp(struct hfi1_ibport *ibp, struct rvt_qp *qp, u32 remote_qpn,
 	pbc = create_pbc(ppd, pbc_flags, qp->srate_mbps, vl, plen);
 	if (ctxt) {
 		pbuf = sc_buffer_alloc(ctxt, plen, NULL, NULL);
-		if (pbuf) {
+		if (!IS_ERR_OR_NULL(pbuf)) {
 			trace_pio_output_ibhdr(ppd->dd, &hdr, sc5);
 			ppd->dd->pio_inline_send(ppd->dd, pbuf, pbc,
 						 &hdr, hwords);
diff --git a/drivers/infiniband/hw/hfi1/verbs.c b/drivers/infiniband/hw/hfi1/verbs.c
index 4e7b3c027901b..90e12f9433a39 100644
--- a/drivers/infiniband/hw/hfi1/verbs.c
+++ b/drivers/infiniband/hw/hfi1/verbs.c
@@ -1096,10 +1096,10 @@ int hfi1_verbs_send_pio(struct rvt_qp *qp, struct hfi1_pkt_state *ps,
 	if (cb)
 		iowait_pio_inc(&priv->s_iowait);
 	pbuf = sc_buffer_alloc(sc, plen, cb, qp);
-	if (unlikely(!pbuf)) {
+	if (unlikely(IS_ERR_OR_NULL(pbuf))) {
 		if (cb)
 			verbs_pio_complete(qp, 0);
-		if (ppd->host_link_state != HLS_UP_ACTIVE) {
+		if (IS_ERR(pbuf)) {
 			/*
 			 * If we have filled the PIO buffers to capacity and are
 			 * not in an active state this request is not going to
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 434/639] drm/msm/mdp5: Fix mdp5_cfg_init error return
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (432 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.19 433/639] IB/hfi1: Handle port down properly in pio Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.19 435/639] net: netem: fix backlog accounting for corrupted GSO frames Greg Kroah-Hartman
                   ` (208 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jeffrey Hugo, Bjorn Andersson,
	Rob Clark, Sasha Levin

From: Jeffrey Hugo <jeffrey.l.hugo@gmail.com>

[ Upstream commit fc19cbb785d7bbd1a1af26229b5240a3ab332744 ]

If mdp5_cfg_init fails because of an unknown major version, a null pointer
dereference occurs.  This is because the caller of init expects error
pointers, but init returns NULL on error.  Fix this by returning the
expected values on error.

Fixes: 2e362e1772b8 (drm/msm/mdp5: introduce mdp5_cfg module)
Signed-off-by: Jeffrey Hugo <jeffrey.l.hugo@gmail.com>
Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Rob Clark <robdclark@chromium.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/msm/disp/mdp5/mdp5_cfg.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_cfg.c b/drivers/gpu/drm/msm/disp/mdp5/mdp5_cfg.c
index 824067d2d4277..42f0ecb0cf35f 100644
--- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_cfg.c
+++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_cfg.c
@@ -635,7 +635,7 @@ fail:
 	if (cfg_handler)
 		mdp5_cfg_destroy(cfg_handler);
 
-	return NULL;
+	return ERR_PTR(ret);
 }
 
 static struct mdp5_cfg_platform *mdp5_get_config(struct platform_device *dev)
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 435/639] net: netem: fix backlog accounting for corrupted GSO frames
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (433 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.19 434/639] drm/msm/mdp5: Fix mdp5_cfg_init error return Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.19 436/639] net/udp_gso: Allow TX timestamp with UDP GSO Greg Kroah-Hartman
                   ` (207 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jakub Kicinski, Dirk van der Merwe,
	Cong Wang, David S. Miller, Sasha Levin

From: Jakub Kicinski <jakub.kicinski@netronome.com>

[ Upstream commit 177b8007463c4f36c9a2c7ce7aa9875a4cad9bd5 ]

When GSO frame has to be corrupted netem uses skb_gso_segment()
to produce the list of frames, and re-enqueues the segments one
by one.  The backlog length has to be adjusted to account for
new frames.

The current calculation is incorrect, leading to wrong backlog
lengths in the parent qdisc (both bytes and packets), and
incorrect packet backlog count in netem itself.

Parent backlog goes negative, netem's packet backlog counts
all non-first segments twice (thus remaining non-zero even
after qdisc is emptied).

Move the variables used to count the adjustment into local
scope to make 100% sure they aren't used at any stage in
backports.

Fixes: 6071bd1aa13e ("netem: Segment GSO packets on enqueue")
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Reviewed-by: Dirk van der Merwe <dirk.vandermerwe@netronome.com>
Acked-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/sched/sch_netem.c | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
index 15f8f24c190d4..1cd7266140e6a 100644
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -436,8 +436,7 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch,
 	struct netem_skb_cb *cb;
 	struct sk_buff *skb2;
 	struct sk_buff *segs = NULL;
-	unsigned int len = 0, last_len, prev_len = qdisc_pkt_len(skb);
-	int nb = 0;
+	unsigned int prev_len = qdisc_pkt_len(skb);
 	int count = 1;
 	int rc = NET_XMIT_SUCCESS;
 	int rc_drop = NET_XMIT_DROP;
@@ -494,6 +493,7 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch,
 			segs = netem_segment(skb, sch, to_free);
 			if (!segs)
 				return rc_drop;
+			qdisc_skb_cb(segs)->pkt_len = segs->len;
 		} else {
 			segs = skb;
 		}
@@ -583,6 +583,11 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch,
 
 finish_segs:
 	if (segs) {
+		unsigned int len, last_len;
+		int nb = 0;
+
+		len = skb->len;
+
 		while (segs) {
 			skb2 = segs->next;
 			segs->next = NULL;
@@ -598,9 +603,7 @@ finish_segs:
 			}
 			segs = skb2;
 		}
-		sch->q.qlen += nb;
-		if (nb > 1)
-			qdisc_tree_reduce_backlog(sch, 1 - nb, prev_len - len);
+		qdisc_tree_reduce_backlog(sch, -nb, prev_len - len);
 	}
 	return NET_XMIT_SUCCESS;
 }
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 436/639] net/udp_gso: Allow TX timestamp with UDP GSO
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (434 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.19 435/639] net: netem: fix backlog accounting for corrupted GSO frames Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.19 437/639] net/af_iucv: build proper skbs for HiperTransport Greg Kroah-Hartman
                   ` (206 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Fred Klassen, Willem de Bruijn,
	David S. Miller, Sasha Levin

From: Fred Klassen <fklassen@appneta.com>

[ Upstream commit 76e21533a48bb42d1fa894f93f6233bf4554f45e ]

Fixes an issue where TX Timestamps are not arriving on the error queue
when UDP_SEGMENT CMSG type is combined with CMSG type SO_TIMESTAMPING.
This can be illustrated with an updated updgso_bench_tx program which
includes the '-T' option to test for this condition. It also introduces
the '-P' option which will call poll() before reading the error queue.

    ./udpgso_bench_tx -4ucTPv -S 1472 -l2 -D 172.16.120.18
    poll timeout
    udp tx:      0 MB/s        1 calls/s      1 msg/s

The "poll timeout" message above indicates that TX timestamp never
arrived.

This patch preserves tx_flags for the first UDP GSO segment. Only the
first segment is timestamped, even though in some cases there may be
benefital in timestamping both the first and last segment.

Factors in deciding on first segment timestamp only:

- Timestamping both first and last segmented is not feasible. Hardware
can only have one outstanding TS request at a time.

- Timestamping last segment may under report network latency of the
previous segments. Even though the doorbell is suppressed, the ring
producer counter has been incremented.

- Timestamping the first segment has the upside in that it reports
timestamps from the application's view, e.g. RTT.

- Timestamping the first segment has the downside that it may
underreport tx host network latency. It appears that we have to pick
one or the other. And possibly follow-up with a config flag to choose
behavior.

v2: Remove tests as noted by Willem de Bruijn <willemb@google.com>
    Moving tests from net to net-next

v3: Update only relevant tx_flag bits as per
    Willem de Bruijn <willemb@google.com>

v4: Update comments and commit message as per
    Willem de Bruijn <willemb@google.com>

Fixes: ee80d1ebe5ba ("udp: add udp gso")
Signed-off-by: Fred Klassen <fklassen@appneta.com>
Acked-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ipv4/udp_offload.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/net/ipv4/udp_offload.c b/net/ipv4/udp_offload.c
index 0c0522b79b43f..aa343654abfc0 100644
--- a/net/ipv4/udp_offload.c
+++ b/net/ipv4/udp_offload.c
@@ -227,6 +227,11 @@ struct sk_buff *__udp_gso_segment(struct sk_buff *gso_skb,
 	seg = segs;
 	uh = udp_hdr(seg);
 
+	/* preserve TX timestamp flags and TS key for first segment */
+	skb_shinfo(seg)->tskey = skb_shinfo(gso_skb)->tskey;
+	skb_shinfo(seg)->tx_flags |=
+			(skb_shinfo(gso_skb)->tx_flags & SKBTX_ANY_TSTAMP);
+
 	/* compute checksum adjustment based on old length versus new */
 	newlen = htons(sizeof(*uh) + mss);
 	check = csum16_add(csum16_sub(uh->check, uh->len), newlen);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 437/639] net/af_iucv: build proper skbs for HiperTransport
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (435 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.19 436/639] net/udp_gso: Allow TX timestamp with UDP GSO Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.19 438/639] net/af_iucv: always register net_device notifier Greg Kroah-Hartman
                   ` (205 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Julian Wiedmann, David S. Miller,
	Sasha Levin

From: Julian Wiedmann <jwi@linux.ibm.com>

[ Upstream commit 238965b71b968dc5b3c0fe430e946f488322c4b5 ]

The HiperSockets-based transport path in af_iucv is still too closely
entangled with qeth.
With commit a647a02512ca ("s390/qeth: speed-up L3 IQD xmit"), the
relevant xmit code in qeth has begun to use skb_cow_head(). So to avoid
unnecessary skb head expansions, af_iucv must learn to
1) respect dev->needed_headroom when allocating skbs, and
2) drop the header reference before cloning the skb.

While at it, also stop hard-coding the LL-header creation stage and just
use the appropriate helper.

Fixes: a647a02512ca ("s390/qeth: speed-up L3 IQD xmit")
Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/iucv/af_iucv.c | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
index f024914da1b2d..e07daee1227c3 100644
--- a/net/iucv/af_iucv.c
+++ b/net/iucv/af_iucv.c
@@ -13,6 +13,7 @@
 #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
 
 #include <linux/module.h>
+#include <linux/netdevice.h>
 #include <linux/types.h>
 #include <linux/list.h>
 #include <linux/errno.h>
@@ -355,6 +356,9 @@ static int afiucv_hs_send(struct iucv_message *imsg, struct sock *sock,
 		err = -ENODEV;
 		goto err_free;
 	}
+
+	dev_hard_header(skb, skb->dev, ETH_P_AF_IUCV, NULL, NULL, skb->len);
+
 	if (!(skb->dev->flags & IFF_UP) || !netif_carrier_ok(skb->dev)) {
 		err = -ENETDOWN;
 		goto err_free;
@@ -367,6 +371,8 @@ static int afiucv_hs_send(struct iucv_message *imsg, struct sock *sock,
 		skb_trim(skb, skb->dev->mtu);
 	}
 	skb->protocol = cpu_to_be16(ETH_P_AF_IUCV);
+
+	__skb_header_release(skb);
 	nskb = skb_clone(skb, GFP_ATOMIC);
 	if (!nskb) {
 		err = -ENOMEM;
@@ -466,12 +472,14 @@ static void iucv_sever_path(struct sock *sk, int with_user_data)
 /* Send controlling flags through an IUCV socket for HIPER transport */
 static int iucv_send_ctrl(struct sock *sk, u8 flags)
 {
+	struct iucv_sock *iucv = iucv_sk(sk);
 	int err = 0;
 	int blen;
 	struct sk_buff *skb;
 	u8 shutdown = 0;
 
-	blen = sizeof(struct af_iucv_trans_hdr) + ETH_HLEN;
+	blen = sizeof(struct af_iucv_trans_hdr) +
+	       LL_RESERVED_SPACE(iucv->hs_dev);
 	if (sk->sk_shutdown & SEND_SHUTDOWN) {
 		/* controlling flags should be sent anyway */
 		shutdown = sk->sk_shutdown;
@@ -1131,7 +1139,8 @@ static int iucv_sock_sendmsg(struct socket *sock, struct msghdr *msg,
 	 * segmented records using the MSG_EOR flag), but
 	 * for SOCK_STREAM we might want to improve it in future */
 	if (iucv->transport == AF_IUCV_TRANS_HIPER) {
-		headroom = sizeof(struct af_iucv_trans_hdr) + ETH_HLEN;
+		headroom = sizeof(struct af_iucv_trans_hdr) +
+			   LL_RESERVED_SPACE(iucv->hs_dev);
 		linear = len;
 	} else {
 		if (len < PAGE_SIZE) {
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 438/639] net/af_iucv: always register net_device notifier
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (436 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.19 437/639] net/af_iucv: build proper skbs for HiperTransport Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.19 439/639] ASoC: ti: davinci-mcasp: Fix slot mask settings when using multiple AXRs Greg Kroah-Hartman
                   ` (204 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Julian Wiedmann, Ursula Braun,
	David S. Miller, Sasha Levin

From: Julian Wiedmann <jwi@linux.ibm.com>

[ Upstream commit 06996c1d4088a0d5f3e7789d7f96b4653cc947cc ]

Even when running as VM guest (ie pr_iucv != NULL), af_iucv can still
open HiperTransport-based connections. For robust operation these
connections require the af_iucv_netdev_notifier, so register it
unconditionally.

Also handle any error that register_netdevice_notifier() returns.

Fixes: 9fbd87d41392 ("af_iucv: handle netdev events")
Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com>
Reviewed-by: Ursula Braun <ubraun@linux.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/iucv/af_iucv.c | 27 ++++++++++++++++++++-------
 1 file changed, 20 insertions(+), 7 deletions(-)

diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
index e07daee1227c3..23a1002ed86dd 100644
--- a/net/iucv/af_iucv.c
+++ b/net/iucv/af_iucv.c
@@ -2465,6 +2465,13 @@ out:
 	return err;
 }
 
+static void afiucv_iucv_exit(void)
+{
+	device_unregister(af_iucv_dev);
+	driver_unregister(&af_iucv_driver);
+	pr_iucv->iucv_unregister(&af_iucv_handler, 0);
+}
+
 static int __init afiucv_init(void)
 {
 	int err;
@@ -2498,11 +2505,18 @@ static int __init afiucv_init(void)
 		err = afiucv_iucv_init();
 		if (err)
 			goto out_sock;
-	} else
-		register_netdevice_notifier(&afiucv_netdev_notifier);
+	}
+
+	err = register_netdevice_notifier(&afiucv_netdev_notifier);
+	if (err)
+		goto out_notifier;
+
 	dev_add_pack(&iucv_packet_type);
 	return 0;
 
+out_notifier:
+	if (pr_iucv)
+		afiucv_iucv_exit();
 out_sock:
 	sock_unregister(PF_IUCV);
 out_proto:
@@ -2516,12 +2530,11 @@ out:
 static void __exit afiucv_exit(void)
 {
 	if (pr_iucv) {
-		device_unregister(af_iucv_dev);
-		driver_unregister(&af_iucv_driver);
-		pr_iucv->iucv_unregister(&af_iucv_handler, 0);
+		afiucv_iucv_exit();
 		symbol_put(iucv_if);
-	} else
-		unregister_netdevice_notifier(&afiucv_netdev_notifier);
+	}
+
+	unregister_netdevice_notifier(&afiucv_netdev_notifier);
 	dev_remove_pack(&iucv_packet_type);
 	sock_unregister(PF_IUCV);
 	proto_unregister(&iucv_proto);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 439/639] ASoC: ti: davinci-mcasp: Fix slot mask settings when using multiple AXRs
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (437 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.19 438/639] net/af_iucv: always register net_device notifier Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.19 440/639] rtc: pcf8563: Fix interrupt trigger method Greg Kroah-Hartman
                   ` (203 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Peter Ujfalusi, Mark Brown, Sasha Levin

From: Peter Ujfalusi <peter.ujfalusi@ti.com>

[ Upstream commit fd14f4436fd47d5418023c90e933e66d3645552e ]

If multiple serializers are connected in the system and the number of
channels will need to use more than one serializer the mask to enable the
serializers were left to 0 if tdm_mask is provided

Fixes: dd55ff8346a97 ("ASoC: davinci-mcasp: Add set_tdm_slots() support")

Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/davinci/davinci-mcasp.c | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/sound/soc/davinci/davinci-mcasp.c b/sound/soc/davinci/davinci-mcasp.c
index 6a8c279a4b20b..14ab16e1369f8 100644
--- a/sound/soc/davinci/davinci-mcasp.c
+++ b/sound/soc/davinci/davinci-mcasp.c
@@ -874,14 +874,13 @@ static int mcasp_i2s_hw_param(struct davinci_mcasp *mcasp, int stream,
 		active_slots = hweight32(mcasp->tdm_mask[stream]);
 		active_serializers = (channels + active_slots - 1) /
 			active_slots;
-		if (active_serializers == 1) {
+		if (active_serializers == 1)
 			active_slots = channels;
-			for (i = 0; i < total_slots; i++) {
-				if ((1 << i) & mcasp->tdm_mask[stream]) {
-					mask |= (1 << i);
-					if (--active_slots <= 0)
-						break;
-				}
+		for (i = 0; i < total_slots; i++) {
+			if ((1 << i) & mcasp->tdm_mask[stream]) {
+				mask |= (1 << i);
+				if (--active_slots <= 0)
+					break;
 			}
 		}
 	} else {
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 440/639] rtc: pcf8563: Fix interrupt trigger method
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (438 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.19 439/639] ASoC: ti: davinci-mcasp: Fix slot mask settings when using multiple AXRs Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.19 441/639] rtc: pcf8563: Clear event flags and disable interrupts before requesting irq Greg Kroah-Hartman
                   ` (202 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chen-Yu Tsai, Alexandre Belloni, Sasha Levin

From: Chen-Yu Tsai <wens@csie.org>

[ Upstream commit 65f662cbf829834fa4d94190eb7691e5a9cb92d8 ]

The PCF8563 datasheet says the interrupt line is active low and stays
active until the events are cleared, i.e. a level trigger interrupt.

Fix the flags used to request the interrupt.

Fixes: ede3e9d47cca ("drivers/rtc/rtc-pcf8563.c: add alarm support")
Signed-off-by: Chen-Yu Tsai <wens@csie.org>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/rtc/rtc-pcf8563.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/rtc/rtc-pcf8563.c b/drivers/rtc/rtc-pcf8563.c
index 3efc86c25d27a..e358313466f19 100644
--- a/drivers/rtc/rtc-pcf8563.c
+++ b/drivers/rtc/rtc-pcf8563.c
@@ -605,7 +605,7 @@ static int pcf8563_probe(struct i2c_client *client,
 	if (client->irq > 0) {
 		err = devm_request_threaded_irq(&client->dev, client->irq,
 				NULL, pcf8563_irq,
-				IRQF_SHARED|IRQF_ONESHOT|IRQF_TRIGGER_FALLING,
+				IRQF_SHARED | IRQF_ONESHOT | IRQF_TRIGGER_LOW,
 				pcf8563_driver.driver.name, client);
 		if (err) {
 			dev_err(&client->dev, "unable to request IRQ %d\n",
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 441/639] rtc: pcf8563: Clear event flags and disable interrupts before requesting irq
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (439 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.19 440/639] rtc: pcf8563: Fix interrupt trigger method Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.19 442/639] ARM: dts: iwg20d-q7-common: Fix SDHI1 VccQ regularor Greg Kroah-Hartman
                   ` (201 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chen-Yu Tsai, Alexandre Belloni, Sasha Levin

From: Chen-Yu Tsai <wens@csie.org>

[ Upstream commit 3572e8aea3bf925dac1dbf86127657c39fe5c254 ]

Besides the alarm, the PCF8563 also has a timer triggered interrupt.
In cases where the previous system left the timer and interrupts on,
or somehow the bits got enabled, the interrupt would keep triggering
as the kernel doesn't know about it.

Clear both the alarm and timer event flags, and disable the interrupts,
before requesting the interrupt line.

Fixes: ede3e9d47cca ("drivers/rtc/rtc-pcf8563.c: add alarm support")
Fixes: a45d528aab8b ("rtc: pcf8563: clear expired alarm at boot time")
Signed-off-by: Chen-Yu Tsai <wens@csie.org>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/rtc/rtc-pcf8563.c | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/drivers/rtc/rtc-pcf8563.c b/drivers/rtc/rtc-pcf8563.c
index e358313466f19..d8adf69b66978 100644
--- a/drivers/rtc/rtc-pcf8563.c
+++ b/drivers/rtc/rtc-pcf8563.c
@@ -563,7 +563,6 @@ static int pcf8563_probe(struct i2c_client *client,
 	struct pcf8563 *pcf8563;
 	int err;
 	unsigned char buf;
-	unsigned char alm_pending;
 
 	dev_dbg(&client->dev, "%s\n", __func__);
 
@@ -587,13 +586,13 @@ static int pcf8563_probe(struct i2c_client *client,
 		return err;
 	}
 
-	err = pcf8563_get_alarm_mode(client, NULL, &alm_pending);
-	if (err) {
-		dev_err(&client->dev, "%s: read error\n", __func__);
+	/* Clear flags and disable interrupts */
+	buf = 0;
+	err = pcf8563_write_block_data(client, PCF8563_REG_ST2, 1, &buf);
+	if (err < 0) {
+		dev_err(&client->dev, "%s: write error\n", __func__);
 		return err;
 	}
-	if (alm_pending)
-		pcf8563_set_alarm_mode(client, 0);
 
 	pcf8563->rtc = devm_rtc_device_register(&client->dev,
 				pcf8563_driver.driver.name,
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 442/639] ARM: dts: iwg20d-q7-common: Fix SDHI1 VccQ regularor
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (440 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.19 441/639] rtc: pcf8563: Clear event flags and disable interrupts before requesting irq Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.19 443/639] net/sched: cbs: Fix error path of cbs_module_init Greg Kroah-Hartman
                   ` (200 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Fabrizio Castro, Simon Horman, Sasha Levin

From: Fabrizio Castro <fabrizio.castro@bp.renesas.com>

[ Upstream commit d211650a87edc7f4130651c0ccbc0a4583fd72d3 ]

SDR50 isn't working anymore because the GPIO regulator
driver is using descriptors since
commit d6cd33ad7102 ("regulator: gpio: Convert to use descriptors")
which in turn causes the system to use the polarity of the
GPIOs (as specified in the DT) for selecting the states,
but the polarity specified in the DT is wrong.
This patch fixes the regulator DT definition, and that fixes
SDR50.

Fixes: 029efb3a03c5 ("ARM: dts: iwg20d-q7: Add SDHI1 support")
Signed-off-by: Fabrizio Castro <fabrizio.castro@bp.renesas.com>
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/iwg20d-q7-common.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/iwg20d-q7-common.dtsi b/arch/arm/boot/dts/iwg20d-q7-common.dtsi
index 5cae74eb6cddf..a2c9a1e88c1a3 100644
--- a/arch/arm/boot/dts/iwg20d-q7-common.dtsi
+++ b/arch/arm/boot/dts/iwg20d-q7-common.dtsi
@@ -87,7 +87,7 @@
 		regulator-min-microvolt = <1800000>;
 		regulator-max-microvolt = <3300000>;
 
-		gpios = <&gpio2 30 GPIO_ACTIVE_LOW>;
+		gpios = <&gpio2 30 GPIO_ACTIVE_HIGH>;
 		gpios-states = <1>;
 		states = <3300000 1
 			  1800000 0>;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 443/639] net/sched: cbs: Fix error path of cbs_module_init
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (441 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.19 442/639] ARM: dts: iwg20d-q7-common: Fix SDHI1 VccQ regularor Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.19 444/639] arm64: dts: allwinner: h6: Pine H64: Add interrupt line for RTC Greg Kroah-Hartman
                   ` (199 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, YueHaibing,
	David S. Miller, Sasha Levin

From: YueHaibing <yuehaibing@huawei.com>

[ Upstream commit 45d5cb137c3638b3a310f41b31d8e79daf647f14 ]

If register_qdisc fails, we should unregister
netdevice notifier.

Reported-by: Hulk Robot <hulkci@huawei.com>
Fixes: e0a7683d30e9 ("net/sched: cbs: fix port_rate miscalculation")
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/sched/sch_cbs.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/net/sched/sch_cbs.c b/net/sched/sch_cbs.c
index 81f84cb5dd23b..b3c8d04929df2 100644
--- a/net/sched/sch_cbs.c
+++ b/net/sched/sch_cbs.c
@@ -552,12 +552,17 @@ static struct notifier_block cbs_device_notifier = {
 
 static int __init cbs_module_init(void)
 {
-	int err = register_netdevice_notifier(&cbs_device_notifier);
+	int err;
 
+	err = register_netdevice_notifier(&cbs_device_notifier);
 	if (err)
 		return err;
 
-	return register_qdisc(&cbs_qdisc_ops);
+	err = register_qdisc(&cbs_qdisc_ops);
+	if (err)
+		unregister_netdevice_notifier(&cbs_device_notifier);
+
+	return err;
 }
 
 static void __exit cbs_module_exit(void)
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 444/639] arm64: dts: allwinner: h6: Pine H64: Add interrupt line for RTC
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (442 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.19 443/639] net/sched: cbs: Fix error path of cbs_module_init Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.19 445/639] drm/msm/a3xx: remove TPL1 regs from snapshot Greg Kroah-Hartman
                   ` (198 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Maxime Ripard, Chen-Yu Tsai, Sasha Levin

From: Chen-Yu Tsai <wens@csie.org>

[ Upstream commit 0bb9d1876c0605815ea0452f68cb819a775a75f9 ]

The external PCF8563 RTC chip's interrupt line is connected to the NMI
line on the SoC.

Add the interrupt line to the device tree.

Fixes: 17ebc33afc35 ("arm64: allwinner: h6: add PCF8563 RTC on Pine H64 board")
Acked-by: Maxime Ripard <maxime.ripard@bootlin.com>
Signed-off-by: Chen-Yu Tsai <wens@csie.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/allwinner/sun50i-h6-pine-h64.dts | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h6-pine-h64.dts b/arch/arm64/boot/dts/allwinner/sun50i-h6-pine-h64.dts
index 48daec7f78ba7..6c3a47d90c793 100644
--- a/arch/arm64/boot/dts/allwinner/sun50i-h6-pine-h64.dts
+++ b/arch/arm64/boot/dts/allwinner/sun50i-h6-pine-h64.dts
@@ -176,6 +176,8 @@
 	pcf8563: rtc@51 {
 		compatible = "nxp,pcf8563";
 		reg = <0x51>;
+		interrupt-parent = <&r_intc>;
+		interrupts = <0 IRQ_TYPE_LEVEL_LOW>;
 		#clock-cells = <0>;
 	};
 };
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 445/639] drm/msm/a3xx: remove TPL1 regs from snapshot
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (443 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.19 444/639] arm64: dts: allwinner: h6: Pine H64: Add interrupt line for RTC Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.19 446/639] ip6_fib: Dont discard nodes with valid routing information in fib6_locate_1() Greg Kroah-Hartman
                   ` (197 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Rob Clark, Jordan Crouse, Sasha Levin

From: Rob Clark <robdclark@chromium.org>

[ Upstream commit f47bee2ba447bebc304111c16ef1e1a73a9744dd ]

These regs are write-only, and the hw throws a hissy-fit (ie. reboots)
when we try to read them for GPU state snapshot, in response to a GPU
hang.  It is rather impolite when GPU recovery triggers an insta-
reboot, so lets remove the TPL1 registers from the snapshot.

Fixes: 7198e6b03155 drm/msm: add a3xx gpu support
Signed-off-by: Rob Clark <robdclark@chromium.org>
Reviewed-by: Jordan Crouse <jcrouse@codeaurora.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/msm/adreno/a3xx_gpu.c | 24 +++++++++++-------------
 1 file changed, 11 insertions(+), 13 deletions(-)

diff --git a/drivers/gpu/drm/msm/adreno/a3xx_gpu.c b/drivers/gpu/drm/msm/adreno/a3xx_gpu.c
index 669c2d4b070de..5c068301d817c 100644
--- a/drivers/gpu/drm/msm/adreno/a3xx_gpu.c
+++ b/drivers/gpu/drm/msm/adreno/a3xx_gpu.c
@@ -395,19 +395,17 @@ static const unsigned int a3xx_registers[] = {
 	0x2200, 0x2212, 0x2214, 0x2217, 0x221a, 0x221a, 0x2240, 0x227e,
 	0x2280, 0x228b, 0x22c0, 0x22c0, 0x22c4, 0x22ce, 0x22d0, 0x22d8,
 	0x22df, 0x22e6, 0x22e8, 0x22e9, 0x22ec, 0x22ec, 0x22f0, 0x22f7,
-	0x22ff, 0x22ff, 0x2340, 0x2343, 0x2348, 0x2349, 0x2350, 0x2356,
-	0x2360, 0x2360, 0x2440, 0x2440, 0x2444, 0x2444, 0x2448, 0x244d,
-	0x2468, 0x2469, 0x246c, 0x246d, 0x2470, 0x2470, 0x2472, 0x2472,
-	0x2474, 0x2475, 0x2479, 0x247a, 0x24c0, 0x24d3, 0x24e4, 0x24ef,
-	0x2500, 0x2509, 0x250c, 0x250c, 0x250e, 0x250e, 0x2510, 0x2511,
-	0x2514, 0x2515, 0x25e4, 0x25e4, 0x25ea, 0x25ea, 0x25ec, 0x25ed,
-	0x25f0, 0x25f0, 0x2600, 0x2612, 0x2614, 0x2617, 0x261a, 0x261a,
-	0x2640, 0x267e, 0x2680, 0x268b, 0x26c0, 0x26c0, 0x26c4, 0x26ce,
-	0x26d0, 0x26d8, 0x26df, 0x26e6, 0x26e8, 0x26e9, 0x26ec, 0x26ec,
-	0x26f0, 0x26f7, 0x26ff, 0x26ff, 0x2740, 0x2743, 0x2748, 0x2749,
-	0x2750, 0x2756, 0x2760, 0x2760, 0x300c, 0x300e, 0x301c, 0x301d,
-	0x302a, 0x302a, 0x302c, 0x302d, 0x3030, 0x3031, 0x3034, 0x3036,
-	0x303c, 0x303c, 0x305e, 0x305f,
+	0x22ff, 0x22ff, 0x2340, 0x2343, 0x2440, 0x2440, 0x2444, 0x2444,
+	0x2448, 0x244d, 0x2468, 0x2469, 0x246c, 0x246d, 0x2470, 0x2470,
+	0x2472, 0x2472, 0x2474, 0x2475, 0x2479, 0x247a, 0x24c0, 0x24d3,
+	0x24e4, 0x24ef, 0x2500, 0x2509, 0x250c, 0x250c, 0x250e, 0x250e,
+	0x2510, 0x2511, 0x2514, 0x2515, 0x25e4, 0x25e4, 0x25ea, 0x25ea,
+	0x25ec, 0x25ed, 0x25f0, 0x25f0, 0x2600, 0x2612, 0x2614, 0x2617,
+	0x261a, 0x261a, 0x2640, 0x267e, 0x2680, 0x268b, 0x26c0, 0x26c0,
+	0x26c4, 0x26ce, 0x26d0, 0x26d8, 0x26df, 0x26e6, 0x26e8, 0x26e9,
+	0x26ec, 0x26ec, 0x26f0, 0x26f7, 0x26ff, 0x26ff, 0x2740, 0x2743,
+	0x300c, 0x300e, 0x301c, 0x301d, 0x302a, 0x302a, 0x302c, 0x302d,
+	0x3030, 0x3031, 0x3034, 0x3036, 0x303c, 0x303c, 0x305e, 0x305f,
 	~0   /* sentinel */
 };
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 446/639] ip6_fib: Dont discard nodes with valid routing information in fib6_locate_1()
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (444 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.19 445/639] drm/msm/a3xx: remove TPL1 regs from snapshot Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30   ` Greg Kroah-Hartman
                   ` (196 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Stefano Brivio, David S. Miller, Sasha Levin

From: Stefano Brivio <sbrivio@redhat.com>

[ Upstream commit 40cb35d5dc04e7f89cbc7b1fc9b4b48d9f1e5343 ]

When we perform an inexact match on FIB nodes via fib6_locate_1(), longer
prefixes will be preferred to shorter ones. However, it might happen that
a node, with higher fn_bit value than some other, has no valid routing
information.

In this case, we'll pick that node, but it will be discarded by the check
on RTN_RTINFO in fib6_locate(), and we might miss nodes with valid routing
information but with lower fn_bit value.

This is apparent when a routing exception is created for a default route:
 # ip -6 route list
 fc00:1::/64 dev veth_A-R1 proto kernel metric 256 pref medium
 fc00:2::/64 dev veth_A-R2 proto kernel metric 256 pref medium
 fc00:4::1 via fc00:2::2 dev veth_A-R2 metric 1024 pref medium
 fe80::/64 dev veth_A-R1 proto kernel metric 256 pref medium
 fe80::/64 dev veth_A-R2 proto kernel metric 256 pref medium
 default via fc00:1::2 dev veth_A-R1 metric 1024 pref medium
 # ip -6 route list cache
 fc00:4::1 via fc00:2::2 dev veth_A-R2 metric 1024 expires 593sec mtu 1500 pref medium
 fc00:3::1 via fc00:1::2 dev veth_A-R1 metric 1024 expires 593sec mtu 1500 pref medium
 # ip -6 route flush cache    # node for default route is discarded
 Failed to send flush request: No such process
 # ip -6 route list cache
 fc00:3::1 via fc00:1::2 dev veth_A-R1 metric 1024 expires 586sec mtu 1500 pref medium

Check right away if the node has a RTN_RTINFO flag, before replacing the
'prev' pointer, that indicates the longest matching prefix found so far.

Fixes: 38fbeeeeccdb ("ipv6: prepare fib6_locate() for exception table")
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ipv6/ip6_fib.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index bbb5ffb3397d8..7091568b9f630 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -1529,7 +1529,8 @@ static struct fib6_node *fib6_locate_1(struct fib6_node *root,
 		if (plen == fn->fn_bit)
 			return fn;
 
-		prev = fn;
+		if (fn->fn_flags & RTN_RTINFO)
+			prev = fn;
 
 next:
 		/*
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 447/639] perf/ioctl: Add check for the sample_period value
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
@ 2020-01-24  9:30   ` Greg Kroah-Hartman
  2020-01-24  9:22 ` [PATCH 4.19 002/639] xfs: Sanity check flags of Q_XQUOTARM call Greg Kroah-Hartman
                     ` (641 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ravi Bangoria, Peter Zijlstra (Intel),
	Alexander Shishkin, Arnaldo Carvalho de Melo, Jiri Olsa,
	Linus Torvalds, Stephane Eranian, Thomas Gleixner, Vince Weaver,
	acme, linuxppc-dev, maddy, mpe, Ingo Molnar, Sasha Levin

From: Ravi Bangoria <ravi.bangoria@linux.ibm.com>

[ Upstream commit 913a90bc5a3a06b1f04c337320e9aeee2328dd77 ]

perf_event_open() limits the sample_period to 63 bits. See:

  0819b2e30ccb ("perf: Limit perf_event_attr::sample_period to 63 bits")

Make ioctl() consistent with it.

Also on PowerPC, negative sample_period could cause a recursive
PMIs leading to a hang (reported when running perf-fuzzer).

Signed-off-by: Ravi Bangoria <ravi.bangoria@linux.ibm.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Stephane Eranian <eranian@google.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Vince Weaver <vincent.weaver@maine.edu>
Cc: acme@kernel.org
Cc: linuxppc-dev@lists.ozlabs.org
Cc: maddy@linux.vnet.ibm.com
Cc: mpe@ellerman.id.au
Fixes: 0819b2e30ccb ("perf: Limit perf_event_attr::sample_period to 63 bits")
Link: https://lkml.kernel.org/r/20190604042953.914-1-ravi.bangoria@linux.ibm.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/events/core.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/kernel/events/core.c b/kernel/events/core.c
index 751888cbed5c0..16af86ab24c42 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -5012,6 +5012,9 @@ static int perf_event_period(struct perf_event *event, u64 __user *arg)
 	if (perf_event_check_period(event, value))
 		return -EINVAL;
 
+	if (!event->attr.freq && (value & (1ULL << 63)))
+		return -EINVAL;
+
 	event_function_call(event, __perf_event_period, &value);
 
 	return 0;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 447/639] perf/ioctl: Add check for the sample_period value
@ 2020-01-24  9:30   ` Greg Kroah-Hartman
  0 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Sasha Levin, Ravi Bangoria, maddy, acme, Vince Weaver,
	Peter Zijlstra (Intel),
	Greg Kroah-Hartman, Linus Torvalds, linuxppc-dev, stable,
	Arnaldo Carvalho de Melo, Alexander Shishkin, Stephane Eranian,
	Thomas Gleixner, Jiri Olsa, Ingo Molnar

From: Ravi Bangoria <ravi.bangoria@linux.ibm.com>

[ Upstream commit 913a90bc5a3a06b1f04c337320e9aeee2328dd77 ]

perf_event_open() limits the sample_period to 63 bits. See:

  0819b2e30ccb ("perf: Limit perf_event_attr::sample_period to 63 bits")

Make ioctl() consistent with it.

Also on PowerPC, negative sample_period could cause a recursive
PMIs leading to a hang (reported when running perf-fuzzer).

Signed-off-by: Ravi Bangoria <ravi.bangoria@linux.ibm.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Stephane Eranian <eranian@google.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Vince Weaver <vincent.weaver@maine.edu>
Cc: acme@kernel.org
Cc: linuxppc-dev@lists.ozlabs.org
Cc: maddy@linux.vnet.ibm.com
Cc: mpe@ellerman.id.au
Fixes: 0819b2e30ccb ("perf: Limit perf_event_attr::sample_period to 63 bits")
Link: https://lkml.kernel.org/r/20190604042953.914-1-ravi.bangoria@linux.ibm.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/events/core.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/kernel/events/core.c b/kernel/events/core.c
index 751888cbed5c0..16af86ab24c42 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -5012,6 +5012,9 @@ static int perf_event_period(struct perf_event *event, u64 __user *arg)
 	if (perf_event_check_period(event, value))
 		return -EINVAL;
 
+	if (!event->attr.freq && (value & (1ULL << 63)))
+		return -EINVAL;
+
 	event_function_call(event, __perf_event_period, &value);
 
 	return 0;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 448/639] dmaengine: hsu: Revert "set HSU_CH_MTSR to memory width"
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (446 preceding siblings ...)
  2020-01-24  9:30   ` Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.19 449/639] clk: qcom: Fix -Wunused-const-variable Greg Kroah-Hartman
                   ` (194 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Andy Shevchenko, Vinod Koul, Sasha Levin

From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>

[ Upstream commit c24a5c735f87d0549060de31367c095e8810b895 ]

The commit

  080edf75d337 ("dmaengine: hsu: set HSU_CH_MTSR to memory width")

has been mistakenly submitted. The further investigations show that
the original code does better job since the memory side transfer size
has never been configured by DMA users.

As per latest revision of documentation: "Channel minimum transfer size
(CHnMTSR)... For IOSF UART, maximum value that can be programmed is 64 and
minimum value that can be programmed is 1."

This reverts commit 080edf75d337d35faa6fc3df99342b10d2848d16.

Fixes: 080edf75d337 ("dmaengine: hsu: set HSU_CH_MTSR to memory width")
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/dma/hsu/hsu.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/dma/hsu/hsu.c b/drivers/dma/hsu/hsu.c
index 202ffa9f7611c..18f155a974db6 100644
--- a/drivers/dma/hsu/hsu.c
+++ b/drivers/dma/hsu/hsu.c
@@ -64,10 +64,10 @@ static void hsu_dma_chan_start(struct hsu_dma_chan *hsuc)
 
 	if (hsuc->direction == DMA_MEM_TO_DEV) {
 		bsr = config->dst_maxburst;
-		mtsr = config->src_addr_width;
+		mtsr = config->dst_addr_width;
 	} else if (hsuc->direction == DMA_DEV_TO_MEM) {
 		bsr = config->src_maxburst;
-		mtsr = config->dst_addr_width;
+		mtsr = config->src_addr_width;
 	}
 
 	hsu_chan_disable(hsuc);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 449/639] clk: qcom: Fix -Wunused-const-variable
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (447 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.19 448/639] dmaengine: hsu: Revert "set HSU_CH_MTSR to memory width" Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.19 450/639] nvmem: imx-ocotp: Ensure WAIT bits are preserved when setting timing Greg Kroah-Hartman
                   ` (193 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, clang-built-linux, Nathan Chancellor,
	Nathan Huckleberry, Stephen Boyd, Sasha Levin

From: Nathan Huckleberry <nhuck@google.com>

[ Upstream commit da642427bd7710ec4f4140f693f59aa8521a358c ]

Clang produces the following warning

drivers/clk/qcom/gcc-msm8996.c:133:32: warning: unused variable
'gcc_xo_gpll0_gpll2_gpll3_gpll0_early_div_map' [-Wunused-const-variable]
static const struct
parent_map gcc_xo_gpll0_gpll2_gpll3_gpll0_early_div_map[] =
{ ^drivers/clk/qcom/gcc-msm8996.c:141:27: warning: unused variable
'gcc_xo_gpll0_gpll2_gpll3_gpll0_early_div' [-Wunused-const-variable] static
const char * const gcc_xo_gpll0_gpll2_gpll3_gpll0_early_div[] = { ^
drivers/clk/qcom/gcc-msm8996.c:187:32: warning: unused variable
'gcc_xo_gpll0_gpll2_gpll3_gpll1_gpll4_gpll0_early_div_map'
[-Wunused-const-variable] static const struct parent_map
gcc_xo_gpll0_gpll2_gpll3_gpll1_gpll4_gpll0_early_div_map[] = { ^
drivers/clk/qcom/gcc-msm8996.c:197:27: warning: unused variable
'gcc_xo_gpll0_gpll2_gpll3_gpll1_gpll4_gpll0_early_div'
[-Wunused-const-variable] static const char * const
gcc_xo_gpll0_gpll2_gpll3_gpll1_gpll4_gpll0_early_div[] = {

It looks like these were never used.

Fixes: b1e010c0730a ("clk: qcom: Add MSM8996 Global Clock Control (GCC) driver")
Cc: clang-built-linux@googlegroups.com
Link: https://github.com/ClangBuiltLinux/linux/issues/518
Suggested-by: Nathan Chancellor <natechancellor@gmail.com>
Signed-off-by: Nathan Huckleberry <nhuck@google.com>
Reviewed-by: Nathan Chancellor <natechancellor@gmail.com>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/qcom/gcc-msm8996.c | 36 ----------------------------------
 1 file changed, 36 deletions(-)

diff --git a/drivers/clk/qcom/gcc-msm8996.c b/drivers/clk/qcom/gcc-msm8996.c
index 9a3290fdd01b1..bea55c461cee9 100644
--- a/drivers/clk/qcom/gcc-msm8996.c
+++ b/drivers/clk/qcom/gcc-msm8996.c
@@ -138,22 +138,6 @@ static const char * const gcc_xo_gpll0_gpll4_gpll0_early_div[] = {
 	"gpll0_early_div"
 };
 
-static const struct parent_map gcc_xo_gpll0_gpll2_gpll3_gpll0_early_div_map[] = {
-	{ P_XO, 0 },
-	{ P_GPLL0, 1 },
-	{ P_GPLL2, 2 },
-	{ P_GPLL3, 3 },
-	{ P_GPLL0_EARLY_DIV, 6 }
-};
-
-static const char * const gcc_xo_gpll0_gpll2_gpll3_gpll0_early_div[] = {
-	"xo",
-	"gpll0",
-	"gpll2",
-	"gpll3",
-	"gpll0_early_div"
-};
-
 static const struct parent_map gcc_xo_gpll0_gpll1_early_div_gpll1_gpll4_gpll0_early_div_map[] = {
 	{ P_XO, 0 },
 	{ P_GPLL0, 1 },
@@ -192,26 +176,6 @@ static const char * const gcc_xo_gpll0_gpll2_gpll3_gpll1_gpll2_early_gpll0_early
 	"gpll0_early_div"
 };
 
-static const struct parent_map gcc_xo_gpll0_gpll2_gpll3_gpll1_gpll4_gpll0_early_div_map[] = {
-	{ P_XO, 0 },
-	{ P_GPLL0, 1 },
-	{ P_GPLL2, 2 },
-	{ P_GPLL3, 3 },
-	{ P_GPLL1, 4 },
-	{ P_GPLL4, 5 },
-	{ P_GPLL0_EARLY_DIV, 6 }
-};
-
-static const char * const gcc_xo_gpll0_gpll2_gpll3_gpll1_gpll4_gpll0_early_div[] = {
-	"xo",
-	"gpll0",
-	"gpll2",
-	"gpll3",
-	"gpll1",
-	"gpll4",
-	"gpll0_early_div"
-};
-
 static struct clk_fixed_factor xo = {
 	.mult = 1,
 	.div = 1,
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 450/639] nvmem: imx-ocotp: Ensure WAIT bits are preserved when setting timing
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (448 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.19 449/639] clk: qcom: Fix -Wunused-const-variable Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.19 451/639] nvmem: imx-ocotp: Change TIMING calculation to u-boot algorithm Greg Kroah-Hartman
                   ` (192 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Bryan ODonoghue, Leonard Crestez,
	Srinivas Kandagatla, Sasha Levin

From: Bryan O'Donoghue <pure.logic@nexus-software.ie>

[ Upstream commit 0493c4792b4eb260441e57f52cc11a9ded48b5a7 ]

The i.MX6 and i.MX8 both have a bit-field spanning bits 27:22 called the
WAIT field.

The WAIT field according to the documentation for both parts "specifies
time interval between auto read and write access in one time program. It is
given in number of ipg_clk periods."

This patch ensures that the relevant field is read and written back to the
timing register.

Fixes: 0642bac7da42 ("nvmem: imx-ocotp: add write support")

Signed-off-by: Bryan O'Donoghue <pure.logic@nexus-software.ie>
Reviewed-by: Leonard Crestez <leonard.crestez@nxp.com>
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nvmem/imx-ocotp.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/nvmem/imx-ocotp.c b/drivers/nvmem/imx-ocotp.c
index 926d9cc080cf4..04421a73f74aa 100644
--- a/drivers/nvmem/imx-ocotp.c
+++ b/drivers/nvmem/imx-ocotp.c
@@ -189,7 +189,8 @@ static void imx_ocotp_set_imx6_timing(struct ocotp_priv *priv)
 	strobe_prog = clk_rate / (1000000000 / 10000) + 2 * (DEF_RELAX + 1) - 1;
 	strobe_read = clk_rate / (1000000000 / 40) + 2 * (DEF_RELAX + 1) - 1;
 
-	timing = strobe_prog & 0x00000FFF;
+	timing = readl(priv->base + IMX_OCOTP_ADDR_TIMING) & 0x0FC00000;
+	timing |= strobe_prog & 0x00000FFF;
 	timing |= (relax       << 12) & 0x0000F000;
 	timing |= (strobe_read << 16) & 0x003F0000;
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 451/639] nvmem: imx-ocotp: Change TIMING calculation to u-boot algorithm
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (449 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.19 450/639] nvmem: imx-ocotp: Ensure WAIT bits are preserved when setting timing Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.19 452/639] tools: bpftool: use correct argument in cgroup errors Greg Kroah-Hartman
                   ` (191 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Bryan ODonoghue, Leonard Crestez,
	Srinivas Kandagatla, Sasha Levin

From: Bryan O'Donoghue <pure.logic@nexus-software.ie>

[ Upstream commit 159dbaf57b2f4f67ecb59b2c87d071e45ed41d7e ]

The RELAX field of the OCOTP block is turning out as a zero on i.MX8MM.
This messes up the subsequent re-load of the fuse shadow registers.

After some discussion with people @ NXP its clear we have missed a trick
here in Linux.

The OCOTP fuse programming time has a physical minimum 'burn time' that is
not related to the ipg_clk.

We need to define the RELAX, STROBE_READ and STROBE_PROG fields in terms of
desired timings to allow for the burn-in to safely complete. Right now only
the RELAX field is calculated in terms of an absolute time and we are
ending up with a value of zero.

This patch inherits the u-boot timings for the OCOTP_TIMING calculation on
the i.MX6 and i.MX8. Those timings are known to work and critically specify
values such as STROBE_PROG as a minimum timing.

Fixes: 0642bac7da42 ("nvmem: imx-ocotp: add write support")

Signed-off-by: Bryan O'Donoghue <pure.logic@nexus-software.ie>
Suggested-by: Leonard Crestez <leonard.crestez@nxp.com>
Reviewed-by: Leonard Crestez <leonard.crestez@nxp.com>
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nvmem/imx-ocotp.c | 36 ++++++++++++++++++++++++++++++++----
 1 file changed, 32 insertions(+), 4 deletions(-)

diff --git a/drivers/nvmem/imx-ocotp.c b/drivers/nvmem/imx-ocotp.c
index 04421a73f74aa..09281aca86c29 100644
--- a/drivers/nvmem/imx-ocotp.c
+++ b/drivers/nvmem/imx-ocotp.c
@@ -50,7 +50,9 @@
 #define IMX_OCOTP_BM_CTRL_ERROR		0x00000200
 #define IMX_OCOTP_BM_CTRL_REL_SHADOWS	0x00000400
 
-#define DEF_RELAX			20	/* > 16.5ns */
+#define TIMING_STROBE_PROG_US		10	/* Min time to blow a fuse */
+#define TIMING_STROBE_READ_NS		37	/* Min time before read */
+#define TIMING_RELAX_NS			17
 #define DEF_FSOURCE			1001	/* > 1000 ns */
 #define DEF_STROBE_PROG			10000	/* IPG clocks */
 #define IMX_OCOTP_WR_UNLOCK		0x3E770000
@@ -182,12 +184,38 @@ static void imx_ocotp_set_imx6_timing(struct ocotp_priv *priv)
 	 * fields with timing values to match the current frequency of the
 	 * ipg_clk. OTP writes will work at maximum bus frequencies as long
 	 * as the HW_OCOTP_TIMING parameters are set correctly.
+	 *
+	 * Note: there are minimum timings required to ensure an OTP fuse burns
+	 * correctly that are independent of the ipg_clk. Those values are not
+	 * formally documented anywhere however, working from the minimum
+	 * timings given in u-boot we can say:
+	 *
+	 * - Minimum STROBE_PROG time is 10 microseconds. Intuitively 10
+	 *   microseconds feels about right as representative of a minimum time
+	 *   to physically burn out a fuse.
+	 *
+	 * - Minimum STROBE_READ i.e. the time to wait post OTP fuse burn before
+	 *   performing another read is 37 nanoseconds
+	 *
+	 * - Minimum RELAX timing is 17 nanoseconds. This final RELAX minimum
+	 *   timing is not entirely clear the documentation says "This
+	 *   count value specifies the time to add to all default timing
+	 *   parameters other than the Tpgm and Trd. It is given in number
+	 *   of ipg_clk periods." where Tpgm and Trd refer to STROBE_PROG
+	 *   and STROBE_READ respectively. What the other timing parameters
+	 *   are though, is not specified. Experience shows a zero RELAX
+	 *   value will mess up a re-load of the shadow registers post OTP
+	 *   burn.
 	 */
 	clk_rate = clk_get_rate(priv->clk);
 
-	relax = clk_rate / (1000000000 / DEF_RELAX) - 1;
-	strobe_prog = clk_rate / (1000000000 / 10000) + 2 * (DEF_RELAX + 1) - 1;
-	strobe_read = clk_rate / (1000000000 / 40) + 2 * (DEF_RELAX + 1) - 1;
+	relax = DIV_ROUND_UP(clk_rate * TIMING_RELAX_NS, 1000000000) - 1;
+	strobe_read = DIV_ROUND_UP(clk_rate * TIMING_STROBE_READ_NS,
+				   1000000000);
+	strobe_read += 2 * (relax + 1) - 1;
+	strobe_prog = DIV_ROUND_CLOSEST(clk_rate * TIMING_STROBE_PROG_US,
+					1000000);
+	strobe_prog += 2 * (relax + 1) - 1;
 
 	timing = readl(priv->base + IMX_OCOTP_ADDR_TIMING) & 0x0FC00000;
 	timing |= strobe_prog & 0x00000FFF;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 452/639] tools: bpftool: use correct argument in cgroup errors
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (450 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.19 451/639] nvmem: imx-ocotp: Change TIMING calculation to u-boot algorithm Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.19 453/639] backlight: pwm_bl: Fix heuristic to determine number of brightness levels Greg Kroah-Hartman
                   ` (190 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jakub Kicinski, Quentin Monnet,
	Roman Gushchin, Daniel Borkmann, Sasha Levin

From: Jakub Kicinski <jakub.kicinski@netronome.com>

[ Upstream commit 6c6874f401e5a0caab3b6a0663169e1fb5e930bb ]

cgroup code tries to use argv[0] as the cgroup path,
but if it fails uses argv[1] to report errors.

Fixes: 5ccda64d38cc ("bpftool: implement cgroup bpf operations")
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Reviewed-by: Quentin Monnet <quentin.monnet@netronome.com>
Acked-by: Roman Gushchin <guro@fb.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/bpf/bpftool/cgroup.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/tools/bpf/bpftool/cgroup.c b/tools/bpf/bpftool/cgroup.c
index ee7a9765c6b32..adbcd84818f74 100644
--- a/tools/bpf/bpftool/cgroup.c
+++ b/tools/bpf/bpftool/cgroup.c
@@ -164,7 +164,7 @@ static int do_show(int argc, char **argv)
 
 	cgroup_fd = open(argv[0], O_RDONLY);
 	if (cgroup_fd < 0) {
-		p_err("can't open cgroup %s", argv[1]);
+		p_err("can't open cgroup %s", argv[0]);
 		goto exit;
 	}
 
@@ -345,7 +345,7 @@ static int do_attach(int argc, char **argv)
 
 	cgroup_fd = open(argv[0], O_RDONLY);
 	if (cgroup_fd < 0) {
-		p_err("can't open cgroup %s", argv[1]);
+		p_err("can't open cgroup %s", argv[0]);
 		goto exit;
 	}
 
@@ -403,7 +403,7 @@ static int do_detach(int argc, char **argv)
 
 	cgroup_fd = open(argv[0], O_RDONLY);
 	if (cgroup_fd < 0) {
-		p_err("can't open cgroup %s", argv[1]);
+		p_err("can't open cgroup %s", argv[0]);
 		goto exit;
 	}
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 453/639] backlight: pwm_bl: Fix heuristic to determine number of brightness levels
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (451 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.19 452/639] tools: bpftool: use correct argument in cgroup errors Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.19 454/639] fork,memcg: alloc_thread_stack_node needs to set tsk->stack Greg Kroah-Hartman
                   ` (189 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Matthias Kaehlcke, Daniel Thompson,
	Enric Balletbo i Serra, Lee Jones, Sasha Levin

From: Matthias Kaehlcke <mka@chromium.org>

[ Upstream commit 73fbfc499448455f1e1c77717040e09e25f1d976 ]

With commit 88ba95bedb79 ("backlight: pwm_bl: Compute brightness of
LED linearly to human eye") the number of set bits (aka hweight())
in the PWM period is used in the heuristic to determine the number
of brightness levels, when the brightness table isn't specified in
the DT. The number of set bits doesn't provide a reliable clue about
the length of the period, instead change the heuristic to:

 nlevels = period / fls(period)

Also limit the maximum number of brightness levels to 4096 to avoid
excessively large tables.

With this the number of levels increases monotonically with the PWM
period, until the maximum of 4096 levels is reached:

period (ns)    # levels

100    	       16
500	       62
1000	       111
5000	       416
10000	       769
50000	       3333
100000	       4096

Fixes: 88ba95bedb79 ("backlight: pwm_bl: Compute brightness of LED linearly to human eye")
Signed-off-by: Matthias Kaehlcke <mka@chromium.org>
Acked-by: Daniel Thompson <daniel.thompson@linaro.org>
Tested-by: Enric Balletbo i Serra <enric.balletbo@collabora.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/video/backlight/pwm_bl.c | 24 ++++++------------------
 1 file changed, 6 insertions(+), 18 deletions(-)

diff --git a/drivers/video/backlight/pwm_bl.c b/drivers/video/backlight/pwm_bl.c
index 7ddc0930e98c6..3a3098d4873be 100644
--- a/drivers/video/backlight/pwm_bl.c
+++ b/drivers/video/backlight/pwm_bl.c
@@ -199,29 +199,17 @@ int pwm_backlight_brightness_default(struct device *dev,
 				     struct platform_pwm_backlight_data *data,
 				     unsigned int period)
 {
-	unsigned int counter = 0;
-	unsigned int i, n;
+	unsigned int i;
 	u64 retval;
 
 	/*
-	 * Count the number of bits needed to represent the period number. The
-	 * number of bits is used to calculate the number of levels used for the
-	 * brightness-levels table, the purpose of this calculation is have a
-	 * pre-computed table with enough levels to get linear brightness
-	 * perception. The period is divided by the number of bits so for a
-	 * 8-bit PWM we have 255 / 8 = 32 brightness levels or for a 16-bit PWM
-	 * we have 65535 / 16 = 4096 brightness levels.
-	 *
-	 * Note that this method is based on empirical testing on different
-	 * devices with PWM of 8 and 16 bits of resolution.
+	 * Once we have 4096 levels there's little point going much higher...
+	 * neither interactive sliders nor animation benefits from having
+	 * more values in the table.
 	 */
-	n = period;
-	while (n) {
-		counter += n % 2;
-		n >>= 1;
-	}
+	data->max_brightness =
+		min((int)DIV_ROUND_UP(period, fls(period)), 4096);
 
-	data->max_brightness = DIV_ROUND_UP(period, counter);
 	data->levels = devm_kcalloc(dev, data->max_brightness,
 				    sizeof(*data->levels), GFP_KERNEL);
 	if (!data->levels)
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 454/639] fork,memcg: alloc_thread_stack_node needs to set tsk->stack
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (452 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.19 453/639] backlight: pwm_bl: Fix heuristic to determine number of brightness levels Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.19 455/639] bnxt_en: Fix ethtool selftest crash under error conditions Greg Kroah-Hartman
                   ` (188 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Andrea Arcangeli, Rik van Riel,
	Roman Gushchin, Michal Hocko, Andrew Morton, Linus Torvalds,
	Sasha Levin

From: Andrea Arcangeli <aarcange@redhat.com>

[ Upstream commit 1bf4580e00a248a2c86269125390eb3648e1877c ]

Commit 5eed6f1dff87 ("fork,memcg: fix crash in free_thread_stack on
memcg charge fail") corrected two instances, but there was a third
instance of this bug.

Without setting tsk->stack, if memcg_charge_kernel_stack fails, it'll
execute free_thread_stack() on a dangling pointer.

Enterprise kernels are compiled with VMAP_STACK=y so this isn't
critical, but custom VMAP_STACK=n builds should have some performance
advantage, with the drawback of risking to fail fork because compaction
didn't succeed.  So as long as VMAP_STACK=n is a supported option it's
worth fixing it upstream.

Link: http://lkml.kernel.org/r/20190619011450.28048-1-aarcange@redhat.com
Fixes: 9b6f7e163cd0 ("mm: rework memcg kernel stack accounting")
Signed-off-by: Andrea Arcangeli <aarcange@redhat.com>
Reviewed-by: Rik van Riel <riel@surriel.com>
Acked-by: Roman Gushchin <guro@fb.com>
Acked-by: Michal Hocko <mhocko@suse.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/fork.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/kernel/fork.c b/kernel/fork.c
index 1bd119530a492..1a2d18e98bf99 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -240,7 +240,11 @@ static unsigned long *alloc_thread_stack_node(struct task_struct *tsk, int node)
 	struct page *page = alloc_pages_node(node, THREADINFO_GFP,
 					     THREAD_SIZE_ORDER);
 
-	return page ? page_address(page) : NULL;
+	if (likely(page)) {
+		tsk->stack = page_address(page);
+		return tsk->stack;
+	}
+	return NULL;
 #endif
 }
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 455/639] bnxt_en: Fix ethtool selftest crash under error conditions.
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (453 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.19 454/639] fork,memcg: alloc_thread_stack_node needs to set tsk->stack Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.19 456/639] bnxt_en: Suppress error messages when querying DSCP DCB capabilities Greg Kroah-Hartman
                   ` (187 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Somasundaram Krishnasamy,
	Michael Chan, David S. Miller, Sasha Levin

From: Michael Chan <michael.chan@broadcom.com>

[ Upstream commit d27e2ca1166aefd54d9c48fb6647dee8115a5dfc ]

After ethtool loopback packet tests, we re-open the nic for the next
IRQ test.  If the open fails, we must not proceed with the IRQ test
or we will crash with NULL pointer dereference.  Fix it by checking
the bnxt_open_nic() return code before proceeding.

Reported-by: Somasundaram Krishnasamy <somasundaram.krishnasamy@oracle.com>
Fixes: 67fea463fd87 ("bnxt_en: Add interrupt test to ethtool -t selftest.")
Signed-off-by: Michael Chan <michael.chan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
index 0a409ba4012a3..dc63d269f01dc 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
@@ -2600,7 +2600,7 @@ static void bnxt_self_test(struct net_device *dev, struct ethtool_test *etest,
 	bool offline = false;
 	u8 test_results = 0;
 	u8 test_mask = 0;
-	int rc, i;
+	int rc = 0, i;
 
 	if (!bp->num_tests || !BNXT_SINGLE_PF(bp))
 		return;
@@ -2671,9 +2671,9 @@ static void bnxt_self_test(struct net_device *dev, struct ethtool_test *etest,
 		}
 		bnxt_hwrm_phy_loopback(bp, false, false);
 		bnxt_half_close_nic(bp);
-		bnxt_open_nic(bp, false, true);
+		rc = bnxt_open_nic(bp, false, true);
 	}
-	if (bnxt_test_irq(bp)) {
+	if (rc || bnxt_test_irq(bp)) {
 		buf[BNXT_IRQ_TEST_IDX] = 1;
 		etest->flags |= ETH_TEST_FL_FAILED;
 	}
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 456/639] bnxt_en: Suppress error messages when querying DSCP DCB capabilities.
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (454 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.19 455/639] bnxt_en: Fix ethtool selftest crash under error conditions Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.19 457/639] iommu/amd: Make iommu_disable safer Greg Kroah-Hartman
                   ` (186 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Michael Chan, David S. Miller, Sasha Levin

From: Michael Chan <michael.chan@broadcom.com>

[ Upstream commit 4ca5fa39e1aea2f85eb9c4257075c4077c6531da ]

Some firmware versions do not support this so use the silent variant
to send the message to firmware to suppress the harmless error.  This
error message is unnecessarily alarming the user.

Fixes: afdc8a84844a ("bnxt_en: Add DCBNL DSCP application protocol support.")
Signed-off-by: Michael Chan <michael.chan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c
index a85d2be986af4..0e4e0b47f5d85 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c
@@ -396,7 +396,7 @@ static int bnxt_hwrm_queue_dscp_qcaps(struct bnxt *bp)
 
 	bnxt_hwrm_cmd_hdr_init(bp, &req, HWRM_QUEUE_DSCP_QCAPS, -1, -1);
 	mutex_lock(&bp->hwrm_cmd_lock);
-	rc = _hwrm_send_message(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT);
+	rc = _hwrm_send_message_silent(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT);
 	if (!rc) {
 		bp->max_dscp_value = (1 << resp->num_dscp_bits) - 1;
 		if (bp->max_dscp_value < 0x3f)
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 457/639] iommu/amd: Make iommu_disable safer
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (455 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.19 456/639] bnxt_en: Suppress error messages when querying DSCP DCB capabilities Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.19 458/639] mfd: intel-lpss: Release IDA resources Greg Kroah-Hartman
                   ` (185 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Kevin Mitchell, Joerg Roedel, Sasha Levin

From: Kevin Mitchell <kevmitch@arista.com>

[ Upstream commit 3ddbe913e55516d3e2165d43d4d5570761769878 ]

Make it safe to call iommu_disable during early init error conditions
before mmio_base is set, but after the struct amd_iommu has been added
to the amd_iommu_list. For example, this happens if firmware fails to
fill in mmio_phys in the ACPI table leading to a NULL pointer
dereference in iommu_feature_disable.

Fixes: 2c0ae1720c09c ('iommu/amd: Convert iommu initialization to state machine')
Signed-off-by: Kevin Mitchell <kevmitch@arista.com>
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iommu/amd_iommu_init.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c
index 1e9a5da562f0d..465f28a7844c2 100644
--- a/drivers/iommu/amd_iommu_init.c
+++ b/drivers/iommu/amd_iommu_init.c
@@ -422,6 +422,9 @@ static void iommu_enable(struct amd_iommu *iommu)
 
 static void iommu_disable(struct amd_iommu *iommu)
 {
+	if (!iommu->mmio_base)
+		return;
+
 	/* Disable command buffer */
 	iommu_feature_disable(iommu, CONTROL_CMDBUF_EN);
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 458/639] mfd: intel-lpss: Release IDA resources
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (456 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.19 457/639] iommu/amd: Make iommu_disable safer Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.19 459/639] rxrpc: Fix uninitialized error code in rxrpc_send_data_packet() Greg Kroah-Hartman
                   ` (184 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Andy Shevchenko, Lee Jones, Sasha Levin

From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>

[ Upstream commit 02f36911c1b41fcd8779fa0c135aab0554333fa5 ]

ida instances allocate some internal memory for ->free_bitmap
in addition to the base 'struct ida'. Use ida_destroy() to release
that memory at module_exit().

Fixes: 4b45efe85263 ("mfd: Add support for Intel Sunrisepoint LPSS devices")
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mfd/intel-lpss.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/mfd/intel-lpss.c b/drivers/mfd/intel-lpss.c
index ff3fba16e7359..95e217e6b6d75 100644
--- a/drivers/mfd/intel-lpss.c
+++ b/drivers/mfd/intel-lpss.c
@@ -545,6 +545,7 @@ module_init(intel_lpss_init);
 
 static void __exit intel_lpss_exit(void)
 {
+	ida_destroy(&intel_lpss_devid_ida);
 	debugfs_remove(intel_lpss_debugfs);
 }
 module_exit(intel_lpss_exit);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 459/639] rxrpc: Fix uninitialized error code in rxrpc_send_data_packet()
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (457 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.19 458/639] mfd: intel-lpss: Release IDA resources Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.19 460/639] xprtrdma: Fix use-after-free in rpcrdma_post_recvs Greg Kroah-Hartman
                   ` (183 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Geert Uytterhoeven, David Howells,
	David S. Miller, Sasha Levin

From: David Howells <dhowells@redhat.com>

[ Upstream commit 3427beb6375d04e9627c67343872e79341a684ea ]

With gcc 4.1:

    net/rxrpc/output.c: In function ‘rxrpc_send_data_packet’:
    net/rxrpc/output.c:338: warning: ‘ret’ may be used uninitialized in this function

Indeed, if the first jump to the send_fragmentable label is made, and
the address family is not handled in the switch() statement, ret will be
used uninitialized.

Fix this by BUG()'ing as is done in other places in rxrpc where internal
support for future address families will need adding.  It should not be
possible to reach this normally as the address families are checked
up-front.

Fixes: 5a924b8951f835b5 ("rxrpc: Don't store the rxrpc header in the Tx queue sk_buffs")
Reported-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/rxrpc/output.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/rxrpc/output.c b/net/rxrpc/output.c
index 345dc1c5fe72f..31e47cfb3e68a 100644
--- a/net/rxrpc/output.c
+++ b/net/rxrpc/output.c
@@ -524,6 +524,9 @@ send_fragmentable:
 		}
 		break;
 #endif
+
+	default:
+		BUG();
 	}
 
 	if (ret < 0)
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 460/639] xprtrdma: Fix use-after-free in rpcrdma_post_recvs
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (458 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.19 459/639] rxrpc: Fix uninitialized error code in rxrpc_send_data_packet() Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.19 461/639] um: Fix IRQ controller regression on console read Greg Kroah-Hartman
                   ` (182 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chuck Lever, Anna Schumaker, Sasha Levin

From: Chuck Lever <chuck.lever@oracle.com>

[ Upstream commit 2d0abe36cf13fb7b577949fd1539326adddcc9bc ]

Dereference wr->next /before/ the memory backing wr has been
released. This issue was found by code inspection. It is not
expected to be a significant problem because it is in an error
path that is almost never executed.

Fixes: 7c8d9e7c8863 ("xprtrdma: Move Receive posting to ... ")
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/sunrpc/xprtrdma/verbs.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c
index 90ec322dbbc0f..ef1f3d076af96 100644
--- a/net/sunrpc/xprtrdma/verbs.c
+++ b/net/sunrpc/xprtrdma/verbs.c
@@ -1558,10 +1558,11 @@ rpcrdma_post_recvs(struct rpcrdma_xprt *r_xprt, bool temp)
 	rc = ib_post_recv(r_xprt->rx_ia.ri_id->qp, wr,
 			  (const struct ib_recv_wr **)&bad_wr);
 	if (rc) {
-		for (wr = bad_wr; wr; wr = wr->next) {
+		for (wr = bad_wr; wr;) {
 			struct rpcrdma_rep *rep;
 
 			rep = container_of(wr, struct rpcrdma_rep, rr_recv_wr);
+			wr = wr->next;
 			rpcrdma_recv_buffer_put(rep);
 			--count;
 		}
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 461/639] um: Fix IRQ controller regression on console read
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (459 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.19 460/639] xprtrdma: Fix use-after-free in rpcrdma_post_recvs Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.19 462/639] PM: ACPI/PCI: Resume all devices during hibernation Greg Kroah-Hartman
                   ` (181 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jouni Malinen, Johannes Berg,
	Richard Weinberger, Sasha Levin

From: Jouni Malinen <j@w1.fi>

[ Upstream commit bebe4681d0e7e1be2608282dc86645728bc7f623 ]

The conversion of UML to use epoll based IRQ controller claimed that
clone_one_chan() can safely call um_free_irq() while starting to ignore
the delay_free_irq parameter that explicitly noted that the IRQ cannot
be freed because this is being called from chan_interrupt(). This
resulted in free_irq() getting called in interrupt context ("Trying to
free IRQ 6 from IRQ context!").

Fix this by restoring previously used delay_free_irq processing.

Fixes: ff6a17989c08 ("Epoll based IRQ controller")
Signed-off-by: Jouni Malinen <j@w1.fi>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/um/drivers/chan_kern.c | 52 +++++++++++++++++++++++++++++++------
 arch/um/kernel/irq.c        |  4 +++
 2 files changed, 48 insertions(+), 8 deletions(-)

diff --git a/arch/um/drivers/chan_kern.c b/arch/um/drivers/chan_kern.c
index 05588f9466c7f..13ba195f9c9c8 100644
--- a/arch/um/drivers/chan_kern.c
+++ b/arch/um/drivers/chan_kern.c
@@ -171,19 +171,55 @@ int enable_chan(struct line *line)
 	return err;
 }
 
+/* Items are added in IRQ context, when free_irq can't be called, and
+ * removed in process context, when it can.
+ * This handles interrupt sources which disappear, and which need to
+ * be permanently disabled.  This is discovered in IRQ context, but
+ * the freeing of the IRQ must be done later.
+ */
+static DEFINE_SPINLOCK(irqs_to_free_lock);
+static LIST_HEAD(irqs_to_free);
+
+void free_irqs(void)
+{
+	struct chan *chan;
+	LIST_HEAD(list);
+	struct list_head *ele;
+	unsigned long flags;
+
+	spin_lock_irqsave(&irqs_to_free_lock, flags);
+	list_splice_init(&irqs_to_free, &list);
+	spin_unlock_irqrestore(&irqs_to_free_lock, flags);
+
+	list_for_each(ele, &list) {
+		chan = list_entry(ele, struct chan, free_list);
+
+		if (chan->input && chan->enabled)
+			um_free_irq(chan->line->driver->read_irq, chan);
+		if (chan->output && chan->enabled)
+			um_free_irq(chan->line->driver->write_irq, chan);
+		chan->enabled = 0;
+	}
+}
+
 static void close_one_chan(struct chan *chan, int delay_free_irq)
 {
+	unsigned long flags;
+
 	if (!chan->opened)
 		return;
 
-    /* we can safely call free now - it will be marked
-     *  as free and freed once the IRQ stopped processing
-     */
-	if (chan->input && chan->enabled)
-		um_free_irq(chan->line->driver->read_irq, chan);
-	if (chan->output && chan->enabled)
-		um_free_irq(chan->line->driver->write_irq, chan);
-	chan->enabled = 0;
+	if (delay_free_irq) {
+		spin_lock_irqsave(&irqs_to_free_lock, flags);
+		list_add(&chan->free_list, &irqs_to_free);
+		spin_unlock_irqrestore(&irqs_to_free_lock, flags);
+	} else {
+		if (chan->input && chan->enabled)
+			um_free_irq(chan->line->driver->read_irq, chan);
+		if (chan->output && chan->enabled)
+			um_free_irq(chan->line->driver->write_irq, chan);
+		chan->enabled = 0;
+	}
 	if (chan->ops->close != NULL)
 		(*chan->ops->close)(chan->fd, chan->data);
 
diff --git a/arch/um/kernel/irq.c b/arch/um/kernel/irq.c
index 6b7f3827d6e4a..2753718d31b9d 100644
--- a/arch/um/kernel/irq.c
+++ b/arch/um/kernel/irq.c
@@ -21,6 +21,8 @@
 #include <irq_user.h>
 
 
+extern void free_irqs(void);
+
 /* When epoll triggers we do not know why it did so
  * we can also have different IRQs for read and write.
  * This is why we keep a small irq_fd array for each fd -
@@ -100,6 +102,8 @@ void sigio_handler(int sig, struct siginfo *unused_si, struct uml_pt_regs *regs)
 			}
 		}
 	}
+
+	free_irqs();
 }
 
 static int assign_epoll_events_to_irq(struct irq_entry *irq_entry)
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 462/639] PM: ACPI/PCI: Resume all devices during hibernation
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (460 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.19 461/639] um: Fix IRQ controller regression on console read Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.19 463/639] ACPI: PM: Simplify and fix PM domain hibernation callbacks Greg Kroah-Hartman
                   ` (180 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Robert R. Howell, Rafael J. Wysocki,
	Mika Westerberg, Hans de Goede, Sasha Levin

From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>

[ Upstream commit 501debd4aa5edc755037c39ea5a8fba23b41e580 ]

Both the PCI bus type and the ACPI PM domain avoid resuming
runtime-suspended devices with DPM_FLAG_SMART_SUSPEND set during
hibernation (before creating the snapshot image of system memory),
but that turns out to be a mistake.  It leads to functional issues
and adds complexity that's hard to justify.

For this reason, resume all runtime-suspended PCI devices and all
devices in the ACPI PM domains before creating a snapshot image of
system memory during hibernation.

Fixes: 05087360fd7a (ACPI / PM: Take SMART_SUSPEND driver flag into account)
Fixes: c4b65157aeef (PCI / PM: Take SMART_SUSPEND driver flag into account)
Link: https://lore.kernel.org/linux-acpi/917d4399-2e22-67b1-9d54-808561f9083f@uwyo.edu/T/#maf065fe6e4974f2a9d79f332ab99dfaba635f64c
Reported-by: Robert R. Howell <RHowell@uwyo.edu>
Tested-by: Robert R. Howell <RHowell@uwyo.edu>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/acpi/device_pm.c | 13 +++++++------
 drivers/pci/pci-driver.c | 16 ++++++++--------
 2 files changed, 15 insertions(+), 14 deletions(-)

diff --git a/drivers/acpi/device_pm.c b/drivers/acpi/device_pm.c
index e0927c5fd2821..11b7a1632e5aa 100644
--- a/drivers/acpi/device_pm.c
+++ b/drivers/acpi/device_pm.c
@@ -1116,13 +1116,14 @@ EXPORT_SYMBOL_GPL(acpi_subsys_resume_early);
 int acpi_subsys_freeze(struct device *dev)
 {
 	/*
-	 * This used to be done in acpi_subsys_prepare() for all devices and
-	 * some drivers may depend on it, so do it here.  Ideally, however,
-	 * runtime-suspended devices should not be touched during freeze/thaw
-	 * transitions.
+	 * Resume all runtime-suspended devices before creating a snapshot
+	 * image of system memory, because the restore kernel generally cannot
+	 * be expected to always handle them consistently and they need to be
+	 * put into the runtime-active metastate during system resume anyway,
+	 * so it is better to ensure that the state saved in the image will be
+	 * always consistent with that.
 	 */
-	if (!dev_pm_test_driver_flags(dev, DPM_FLAG_SMART_SUSPEND))
-		pm_runtime_resume(dev);
+	pm_runtime_resume(dev);
 
 	return pm_generic_freeze(dev);
 }
diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c
index e69af9b8361dc..5def4b74d54a0 100644
--- a/drivers/pci/pci-driver.c
+++ b/drivers/pci/pci-driver.c
@@ -996,15 +996,15 @@ static int pci_pm_freeze(struct device *dev)
 	}
 
 	/*
-	 * This used to be done in pci_pm_prepare() for all devices and some
-	 * drivers may depend on it, so do it here.  Ideally, runtime-suspended
-	 * devices should not be touched during freeze/thaw transitions,
-	 * however.
+	 * Resume all runtime-suspended devices before creating a snapshot
+	 * image of system memory, because the restore kernel generally cannot
+	 * be expected to always handle them consistently and they need to be
+	 * put into the runtime-active metastate during system resume anyway,
+	 * so it is better to ensure that the state saved in the image will be
+	 * always consistent with that.
 	 */
-	if (!dev_pm_smart_suspend_and_suspended(dev)) {
-		pm_runtime_resume(dev);
-		pci_dev->state_saved = false;
-	}
+	pm_runtime_resume(dev);
+	pci_dev->state_saved = false;
 
 	if (pm->freeze) {
 		int error;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 463/639] ACPI: PM: Simplify and fix PM domain hibernation callbacks
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (461 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.19 462/639] PM: ACPI/PCI: Resume all devices during hibernation Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.19 464/639] ACPI: PM: Introduce "poweroff" callbacks for ACPI PM domain and LPSS Greg Kroah-Hartman
                   ` (179 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Rafael J. Wysocki, Mika Westerberg,
	Hans de Goede, Sasha Levin

From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>

[ Upstream commit 3cd7957e85e67120bb9f6bfb75d81dcc19af282b ]

First, after a previous change causing all runtime-suspended devices
in the ACPI PM domain (and ACPI LPSS devices) to be resumed before
creating a snapshot image of memory during hibernation, it is not
necessary to worry about the case in which them might be left in
runtime-suspend any more, so get rid of the code related to that from
ACPI PM domain and ACPI LPSS hibernation callbacks.

Second, it is not correct to use pm_generic_resume_early() and
acpi_subsys_resume_noirq() in hibernation "restore" callbacks (which
currently happens in the ACPI PM domain and ACPI LPSS), so introduce
proper _restore_late and _restore_noirq callbacks for the ACPI PM
domain and ACPI LPSS.

Fixes: 05087360fd7a (ACPI / PM: Take SMART_SUSPEND driver flag into account)
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/acpi/acpi_lpss.c | 61 ++++++++++++++++++++++++++++++++++------
 drivers/acpi/device_pm.c | 61 ++++++----------------------------------
 include/linux/acpi.h     | 10 -------
 3 files changed, 61 insertions(+), 71 deletions(-)

diff --git a/drivers/acpi/acpi_lpss.c b/drivers/acpi/acpi_lpss.c
index 30ccd94f87d24..11c460ab9de9c 100644
--- a/drivers/acpi/acpi_lpss.c
+++ b/drivers/acpi/acpi_lpss.c
@@ -1086,16 +1086,62 @@ static int acpi_lpss_resume_noirq(struct device *dev)
 	struct lpss_private_data *pdata = acpi_driver_data(ACPI_COMPANION(dev));
 	int ret;
 
-	ret = acpi_subsys_resume_noirq(dev);
+	/* Follow acpi_subsys_resume_noirq(). */
+	if (dev_pm_may_skip_resume(dev))
+		return 0;
+
+	if (dev_pm_smart_suspend_and_suspended(dev))
+		pm_runtime_set_active(dev);
+
+	ret = pm_generic_resume_noirq(dev);
 	if (ret)
 		return ret;
 
-	if (!dev_pm_may_skip_resume(dev) && pdata->dev_desc->resume_from_noirq)
-		ret = acpi_lpss_do_resume_early(dev);
+	if (!pdata->dev_desc->resume_from_noirq)
+		return 0;
 
-	return ret;
+	/*
+	 * The driver's ->resume_early callback will be invoked by
+	 * acpi_lpss_do_resume_early(), with the assumption that the driver
+	 * really wanted to run that code in ->resume_noirq, but it could not
+	 * run before acpi_dev_resume() and the driver expected the latter to be
+	 * called in the "early" phase.
+	 */
+	return acpi_lpss_do_resume_early(dev);
+}
+
+static int acpi_lpss_do_restore_early(struct device *dev)
+{
+	int ret = acpi_lpss_resume(dev);
+
+	return ret ? ret : pm_generic_restore_early(dev);
+}
+
+static int acpi_lpss_restore_early(struct device *dev)
+{
+	struct lpss_private_data *pdata = acpi_driver_data(ACPI_COMPANION(dev));
+
+	if (pdata->dev_desc->resume_from_noirq)
+		return 0;
+
+	return acpi_lpss_do_restore_early(dev);
 }
 
+static int acpi_lpss_restore_noirq(struct device *dev)
+{
+	struct lpss_private_data *pdata = acpi_driver_data(ACPI_COMPANION(dev));
+	int ret;
+
+	ret = pm_generic_restore_noirq(dev);
+	if (ret)
+		return ret;
+
+	if (!pdata->dev_desc->resume_from_noirq)
+		return 0;
+
+	/* This is analogous to what happens in acpi_lpss_resume_noirq(). */
+	return acpi_lpss_do_restore_early(dev);
+}
 #endif /* CONFIG_PM_SLEEP */
 
 static int acpi_lpss_runtime_suspend(struct device *dev)
@@ -1129,14 +1175,11 @@ static struct dev_pm_domain acpi_lpss_pm_domain = {
 		.resume_noirq = acpi_lpss_resume_noirq,
 		.resume_early = acpi_lpss_resume_early,
 		.freeze = acpi_subsys_freeze,
-		.freeze_late = acpi_subsys_freeze_late,
-		.freeze_noirq = acpi_subsys_freeze_noirq,
-		.thaw_noirq = acpi_subsys_thaw_noirq,
 		.poweroff = acpi_subsys_suspend,
 		.poweroff_late = acpi_lpss_suspend_late,
 		.poweroff_noirq = acpi_lpss_suspend_noirq,
-		.restore_noirq = acpi_lpss_resume_noirq,
-		.restore_early = acpi_lpss_resume_early,
+		.restore_noirq = acpi_lpss_restore_noirq,
+		.restore_early = acpi_lpss_restore_early,
 #endif
 		.runtime_suspend = acpi_lpss_runtime_suspend,
 		.runtime_resume = acpi_lpss_runtime_resume,
diff --git a/drivers/acpi/device_pm.c b/drivers/acpi/device_pm.c
index 11b7a1632e5aa..5a88a63e902dd 100644
--- a/drivers/acpi/device_pm.c
+++ b/drivers/acpi/device_pm.c
@@ -1077,7 +1077,7 @@ EXPORT_SYMBOL_GPL(acpi_subsys_suspend_noirq);
  * acpi_subsys_resume_noirq - Run the device driver's "noirq" resume callback.
  * @dev: Device to handle.
  */
-int acpi_subsys_resume_noirq(struct device *dev)
+static int acpi_subsys_resume_noirq(struct device *dev)
 {
 	if (dev_pm_may_skip_resume(dev))
 		return 0;
@@ -1092,7 +1092,6 @@ int acpi_subsys_resume_noirq(struct device *dev)
 
 	return pm_generic_resume_noirq(dev);
 }
-EXPORT_SYMBOL_GPL(acpi_subsys_resume_noirq);
 
 /**
  * acpi_subsys_resume_early - Resume device using ACPI.
@@ -1102,12 +1101,11 @@ EXPORT_SYMBOL_GPL(acpi_subsys_resume_noirq);
  * generic early resume procedure for it during system transition into the
  * working state.
  */
-int acpi_subsys_resume_early(struct device *dev)
+static int acpi_subsys_resume_early(struct device *dev)
 {
 	int ret = acpi_dev_resume(dev);
 	return ret ? ret : pm_generic_resume_early(dev);
 }
-EXPORT_SYMBOL_GPL(acpi_subsys_resume_early);
 
 /**
  * acpi_subsys_freeze - Run the device driver's freeze callback.
@@ -1130,52 +1128,15 @@ int acpi_subsys_freeze(struct device *dev)
 EXPORT_SYMBOL_GPL(acpi_subsys_freeze);
 
 /**
- * acpi_subsys_freeze_late - Run the device driver's "late" freeze callback.
- * @dev: Device to handle.
- */
-int acpi_subsys_freeze_late(struct device *dev)
-{
-
-	if (dev_pm_smart_suspend_and_suspended(dev))
-		return 0;
-
-	return pm_generic_freeze_late(dev);
-}
-EXPORT_SYMBOL_GPL(acpi_subsys_freeze_late);
-
-/**
- * acpi_subsys_freeze_noirq - Run the device driver's "noirq" freeze callback.
- * @dev: Device to handle.
- */
-int acpi_subsys_freeze_noirq(struct device *dev)
-{
-
-	if (dev_pm_smart_suspend_and_suspended(dev))
-		return 0;
-
-	return pm_generic_freeze_noirq(dev);
-}
-EXPORT_SYMBOL_GPL(acpi_subsys_freeze_noirq);
-
-/**
- * acpi_subsys_thaw_noirq - Run the device driver's "noirq" thaw callback.
- * @dev: Device to handle.
+ * acpi_subsys_restore_early - Restore device using ACPI.
+ * @dev: Device to restore.
  */
-int acpi_subsys_thaw_noirq(struct device *dev)
+int acpi_subsys_restore_early(struct device *dev)
 {
-	/*
-	 * If the device is in runtime suspend, the "thaw" code may not work
-	 * correctly with it, so skip the driver callback and make the PM core
-	 * skip all of the subsequent "thaw" callbacks for the device.
-	 */
-	if (dev_pm_smart_suspend_and_suspended(dev)) {
-		dev_pm_skip_next_resume_phases(dev);
-		return 0;
-	}
-
-	return pm_generic_thaw_noirq(dev);
+	int ret = acpi_dev_resume(dev);
+	return ret ? ret : pm_generic_restore_early(dev);
 }
-EXPORT_SYMBOL_GPL(acpi_subsys_thaw_noirq);
+EXPORT_SYMBOL_GPL(acpi_subsys_restore_early);
 #endif /* CONFIG_PM_SLEEP */
 
 static struct dev_pm_domain acpi_general_pm_domain = {
@@ -1191,14 +1152,10 @@ static struct dev_pm_domain acpi_general_pm_domain = {
 		.resume_noirq = acpi_subsys_resume_noirq,
 		.resume_early = acpi_subsys_resume_early,
 		.freeze = acpi_subsys_freeze,
-		.freeze_late = acpi_subsys_freeze_late,
-		.freeze_noirq = acpi_subsys_freeze_noirq,
-		.thaw_noirq = acpi_subsys_thaw_noirq,
 		.poweroff = acpi_subsys_suspend,
 		.poweroff_late = acpi_subsys_suspend_late,
 		.poweroff_noirq = acpi_subsys_suspend_noirq,
-		.restore_noirq = acpi_subsys_resume_noirq,
-		.restore_early = acpi_subsys_resume_early,
+		.restore_early = acpi_subsys_restore_early,
 #endif
 	},
 };
diff --git a/include/linux/acpi.h b/include/linux/acpi.h
index df1252e22dcfd..32fabeeda5e30 100644
--- a/include/linux/acpi.h
+++ b/include/linux/acpi.h
@@ -917,26 +917,16 @@ int acpi_subsys_prepare(struct device *dev);
 void acpi_subsys_complete(struct device *dev);
 int acpi_subsys_suspend_late(struct device *dev);
 int acpi_subsys_suspend_noirq(struct device *dev);
-int acpi_subsys_resume_noirq(struct device *dev);
-int acpi_subsys_resume_early(struct device *dev);
 int acpi_subsys_suspend(struct device *dev);
 int acpi_subsys_freeze(struct device *dev);
-int acpi_subsys_freeze_late(struct device *dev);
-int acpi_subsys_freeze_noirq(struct device *dev);
-int acpi_subsys_thaw_noirq(struct device *dev);
 #else
 static inline int acpi_dev_resume_early(struct device *dev) { return 0; }
 static inline int acpi_subsys_prepare(struct device *dev) { return 0; }
 static inline void acpi_subsys_complete(struct device *dev) {}
 static inline int acpi_subsys_suspend_late(struct device *dev) { return 0; }
 static inline int acpi_subsys_suspend_noirq(struct device *dev) { return 0; }
-static inline int acpi_subsys_resume_noirq(struct device *dev) { return 0; }
-static inline int acpi_subsys_resume_early(struct device *dev) { return 0; }
 static inline int acpi_subsys_suspend(struct device *dev) { return 0; }
 static inline int acpi_subsys_freeze(struct device *dev) { return 0; }
-static inline int acpi_subsys_freeze_late(struct device *dev) { return 0; }
-static inline int acpi_subsys_freeze_noirq(struct device *dev) { return 0; }
-static inline int acpi_subsys_thaw_noirq(struct device *dev) { return 0; }
 #endif
 
 #ifdef CONFIG_ACPI
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 464/639] ACPI: PM: Introduce "poweroff" callbacks for ACPI PM domain and LPSS
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (462 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.19 463/639] ACPI: PM: Simplify and fix PM domain hibernation callbacks Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.19 465/639] fsi/core: Fix error paths on CFAM init Greg Kroah-Hartman
                   ` (178 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Rafael J. Wysocki, Mika Westerberg,
	Hans de Goede, Sasha Levin

From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>

[ Upstream commit c95b7595f85c688d5c569ddbbd6ab6a4bdae2f36 ]

In general, it is not correct to call pm_generic_suspend(),
pm_generic_suspend_late() and pm_generic_suspend_noirq() during the
hibernation's "poweroff" transition, because device drivers may
provide special callbacks to be invoked then and the wrappers in
question cause system suspend callbacks to be run.  Unfortunately,
that happens in the ACPI PM domain and ACPI LPSS.

To address this potential issue, introduce "poweroff" callbacks
for the ACPI PM and LPSS that will use pm_generic_poweroff(),
pm_generic_poweroff_late() and pm_generic_poweroff_noirq() as
appropriate.

Fixes: 05087360fd7a (ACPI / PM: Take SMART_SUSPEND driver flag into account)
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/acpi/acpi_lpss.c | 50 +++++++++++++++++++++++++++++++---
 drivers/acpi/device_pm.c | 58 +++++++++++++++++++++++++++++++++++++---
 include/linux/acpi.h     |  2 ++
 3 files changed, 104 insertions(+), 6 deletions(-)

diff --git a/drivers/acpi/acpi_lpss.c b/drivers/acpi/acpi_lpss.c
index 11c460ab9de9c..ded6c5c17fd73 100644
--- a/drivers/acpi/acpi_lpss.c
+++ b/drivers/acpi/acpi_lpss.c
@@ -1056,6 +1056,13 @@ static int acpi_lpss_suspend_noirq(struct device *dev)
 	int ret;
 
 	if (pdata->dev_desc->resume_from_noirq) {
+		/*
+		 * The driver's ->suspend_late callback will be invoked by
+		 * acpi_lpss_do_suspend_late(), with the assumption that the
+		 * driver really wanted to run that code in ->suspend_noirq, but
+		 * it could not run after acpi_dev_suspend() and the driver
+		 * expected the latter to be called in the "late" phase.
+		 */
 		ret = acpi_lpss_do_suspend_late(dev);
 		if (ret)
 			return ret;
@@ -1142,6 +1149,43 @@ static int acpi_lpss_restore_noirq(struct device *dev)
 	/* This is analogous to what happens in acpi_lpss_resume_noirq(). */
 	return acpi_lpss_do_restore_early(dev);
 }
+
+static int acpi_lpss_do_poweroff_late(struct device *dev)
+{
+	int ret = pm_generic_poweroff_late(dev);
+
+	return ret ? ret : acpi_lpss_suspend(dev, device_may_wakeup(dev));
+}
+
+static int acpi_lpss_poweroff_late(struct device *dev)
+{
+	struct lpss_private_data *pdata = acpi_driver_data(ACPI_COMPANION(dev));
+
+	if (dev_pm_smart_suspend_and_suspended(dev))
+		return 0;
+
+	if (pdata->dev_desc->resume_from_noirq)
+		return 0;
+
+	return acpi_lpss_do_poweroff_late(dev);
+}
+
+static int acpi_lpss_poweroff_noirq(struct device *dev)
+{
+	struct lpss_private_data *pdata = acpi_driver_data(ACPI_COMPANION(dev));
+
+	if (dev_pm_smart_suspend_and_suspended(dev))
+		return 0;
+
+	if (pdata->dev_desc->resume_from_noirq) {
+		/* This is analogous to the acpi_lpss_suspend_noirq() case. */
+		int ret = acpi_lpss_do_poweroff_late(dev);
+		if (ret)
+			return ret;
+	}
+
+	return pm_generic_poweroff_noirq(dev);
+}
 #endif /* CONFIG_PM_SLEEP */
 
 static int acpi_lpss_runtime_suspend(struct device *dev)
@@ -1175,9 +1219,9 @@ static struct dev_pm_domain acpi_lpss_pm_domain = {
 		.resume_noirq = acpi_lpss_resume_noirq,
 		.resume_early = acpi_lpss_resume_early,
 		.freeze = acpi_subsys_freeze,
-		.poweroff = acpi_subsys_suspend,
-		.poweroff_late = acpi_lpss_suspend_late,
-		.poweroff_noirq = acpi_lpss_suspend_noirq,
+		.poweroff = acpi_subsys_poweroff,
+		.poweroff_late = acpi_lpss_poweroff_late,
+		.poweroff_noirq = acpi_lpss_poweroff_noirq,
 		.restore_noirq = acpi_lpss_restore_noirq,
 		.restore_early = acpi_lpss_restore_early,
 #endif
diff --git a/drivers/acpi/device_pm.c b/drivers/acpi/device_pm.c
index 5a88a63e902dd..54b6547d32b24 100644
--- a/drivers/acpi/device_pm.c
+++ b/drivers/acpi/device_pm.c
@@ -1137,6 +1137,58 @@ int acpi_subsys_restore_early(struct device *dev)
 	return ret ? ret : pm_generic_restore_early(dev);
 }
 EXPORT_SYMBOL_GPL(acpi_subsys_restore_early);
+
+/**
+ * acpi_subsys_poweroff - Run the device driver's poweroff callback.
+ * @dev: Device to handle.
+ *
+ * Follow PCI and resume devices from runtime suspend before running their
+ * system poweroff callbacks, unless the driver can cope with runtime-suspended
+ * devices during system suspend and there are no ACPI-specific reasons for
+ * resuming them.
+ */
+int acpi_subsys_poweroff(struct device *dev)
+{
+	if (!dev_pm_test_driver_flags(dev, DPM_FLAG_SMART_SUSPEND) ||
+	    acpi_dev_needs_resume(dev, ACPI_COMPANION(dev)))
+		pm_runtime_resume(dev);
+
+	return pm_generic_poweroff(dev);
+}
+EXPORT_SYMBOL_GPL(acpi_subsys_poweroff);
+
+/**
+ * acpi_subsys_poweroff_late - Run the device driver's poweroff callback.
+ * @dev: Device to handle.
+ *
+ * Carry out the generic late poweroff procedure for @dev and use ACPI to put
+ * it into a low-power state during system transition into a sleep state.
+ */
+static int acpi_subsys_poweroff_late(struct device *dev)
+{
+	int ret;
+
+	if (dev_pm_smart_suspend_and_suspended(dev))
+		return 0;
+
+	ret = pm_generic_poweroff_late(dev);
+	if (ret)
+		return ret;
+
+	return acpi_dev_suspend(dev, device_may_wakeup(dev));
+}
+
+/**
+ * acpi_subsys_poweroff_noirq - Run the driver's "noirq" poweroff callback.
+ * @dev: Device to suspend.
+ */
+static int acpi_subsys_poweroff_noirq(struct device *dev)
+{
+	if (dev_pm_smart_suspend_and_suspended(dev))
+		return 0;
+
+	return pm_generic_poweroff_noirq(dev);
+}
 #endif /* CONFIG_PM_SLEEP */
 
 static struct dev_pm_domain acpi_general_pm_domain = {
@@ -1152,9 +1204,9 @@ static struct dev_pm_domain acpi_general_pm_domain = {
 		.resume_noirq = acpi_subsys_resume_noirq,
 		.resume_early = acpi_subsys_resume_early,
 		.freeze = acpi_subsys_freeze,
-		.poweroff = acpi_subsys_suspend,
-		.poweroff_late = acpi_subsys_suspend_late,
-		.poweroff_noirq = acpi_subsys_suspend_noirq,
+		.poweroff = acpi_subsys_poweroff,
+		.poweroff_late = acpi_subsys_poweroff_late,
+		.poweroff_noirq = acpi_subsys_poweroff_noirq,
 		.restore_early = acpi_subsys_restore_early,
 #endif
 	},
diff --git a/include/linux/acpi.h b/include/linux/acpi.h
index 32fabeeda5e30..cd412817654fa 100644
--- a/include/linux/acpi.h
+++ b/include/linux/acpi.h
@@ -919,6 +919,7 @@ int acpi_subsys_suspend_late(struct device *dev);
 int acpi_subsys_suspend_noirq(struct device *dev);
 int acpi_subsys_suspend(struct device *dev);
 int acpi_subsys_freeze(struct device *dev);
+int acpi_subsys_poweroff(struct device *dev);
 #else
 static inline int acpi_dev_resume_early(struct device *dev) { return 0; }
 static inline int acpi_subsys_prepare(struct device *dev) { return 0; }
@@ -927,6 +928,7 @@ static inline int acpi_subsys_suspend_late(struct device *dev) { return 0; }
 static inline int acpi_subsys_suspend_noirq(struct device *dev) { return 0; }
 static inline int acpi_subsys_suspend(struct device *dev) { return 0; }
 static inline int acpi_subsys_freeze(struct device *dev) { return 0; }
+static inline int acpi_subsys_poweroff(struct device *dev) { return 0; }
 #endif
 
 #ifdef CONFIG_ACPI
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 465/639] fsi/core: Fix error paths on CFAM init
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (463 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.19 464/639] ACPI: PM: Introduce "poweroff" callbacks for ACPI PM domain and LPSS Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.19 466/639] devres: allow const resource arguments Greg Kroah-Hartman
                   ` (177 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lei YU, John Wang, Jeremy Kerr,
	Joel Stanley, Sasha Levin

From: Jeremy Kerr <jk@ozlabs.org>

[ Upstream commit 371975b0b07520c85098652d561639837a60a905 ]

Change d1dcd67825 re-worked the struct fsi_slave initialisation in
fsi_slave_init, but introduced a few inconsitencies: the slave->dev is
now registered through cdev_device_add, but we may kfree() the device
out from underneath the cdev registration. We may also leave an IDA
allocated.

This change fixes the error paths, so that we kfree() only before the
device is registered with the core code. We also move the smode write to
before we start creating proper devices, as it's the most likely to
fail. We also remove the IDA-allocated minor on error, and properly
clean up the of_node.

Fixes: d1dcd6782576 ("fsi: Add cfam char devices")
Reported-by: Lei YU <mine260309@gmail.com>
Tested-by: John Wang <wangzqbj@inspur.com>
Signed-off-by: Jeremy Kerr <jk@ozlabs.org>
Signed-off-by: Joel Stanley <joel@jms.id.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/fsi/fsi-core.c | 32 ++++++++++++++++++++------------
 1 file changed, 20 insertions(+), 12 deletions(-)

diff --git a/drivers/fsi/fsi-core.c b/drivers/fsi/fsi-core.c
index c6fa9b393e84b..bd62236d3f975 100644
--- a/drivers/fsi/fsi-core.c
+++ b/drivers/fsi/fsi-core.c
@@ -1060,6 +1060,14 @@ static int fsi_slave_init(struct fsi_master *master, int link, uint8_t id)
 
 	}
 
+	rc = fsi_slave_set_smode(slave);
+	if (rc) {
+		dev_warn(&master->dev,
+				"can't set smode on slave:%02x:%02x %d\n",
+				link, id, rc);
+		goto err_free;
+	}
+
 	/* Allocate a minor in the FSI space */
 	rc = __fsi_get_new_minor(slave, fsi_dev_cfam, &slave->dev.devt,
 				 &slave->cdev_idx);
@@ -1071,17 +1079,14 @@ static int fsi_slave_init(struct fsi_master *master, int link, uint8_t id)
 	rc = cdev_device_add(&slave->cdev, &slave->dev);
 	if (rc) {
 		dev_err(&slave->dev, "Error %d creating slave device\n", rc);
-		goto err_free;
+		goto err_free_ida;
 	}
 
-	rc = fsi_slave_set_smode(slave);
-	if (rc) {
-		dev_warn(&master->dev,
-				"can't set smode on slave:%02x:%02x %d\n",
-				link, id, rc);
-		kfree(slave);
-		return -ENODEV;
-	}
+	/* Now that we have the cdev registered with the core, any fatal
+	 * failures beyond this point will need to clean up through
+	 * cdev_device_del(). Fortunately though, nothing past here is fatal.
+	 */
+
 	if (master->link_config)
 		master->link_config(master, link,
 				    slave->t_send_delay,
@@ -1098,10 +1103,13 @@ static int fsi_slave_init(struct fsi_master *master, int link, uint8_t id)
 		dev_dbg(&master->dev, "failed during slave scan with: %d\n",
 				rc);
 
-	return rc;
+	return 0;
 
- err_free:
-	put_device(&slave->dev);
+err_free_ida:
+	fsi_free_minor(slave->dev.devt);
+err_free:
+	of_node_put(slave->dev.of_node);
+	kfree(slave);
 	return rc;
 }
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 466/639] devres: allow const resource arguments
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (464 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.19 465/639] fsi/core: Fix error paths on CFAM init Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.19 467/639] fsi: sbefifo: Dont fail operations when in SBE IPL state Greg Kroah-Hartman
                   ` (176 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Arnd Bergmann, Linus Walleij,
	Sasha Levin, Enrico Weigelt

From: Arnd Bergmann <arnd@arndb.de>

[ Upstream commit 9dea44c91469512d346e638694c22c30a5273992 ]

devm_ioremap_resource() does not currently take 'const' arguments,
which results in a warning from the first driver trying to do it
anyway:

drivers/gpio/gpio-amd-fch.c: In function 'amd_fch_gpio_probe':
drivers/gpio/gpio-amd-fch.c:171:49: error: passing argument 2 of 'devm_ioremap_resource' discards 'const' qualifier from pointer target type [-Werror=discarded-qualifiers]
  priv->base = devm_ioremap_resource(&pdev->dev, &amd_fch_gpio_iores);
                                                 ^~~~~~~~~~~~~~~~~~~

Change the prototype to allow it, as there is no real reason not to.

Fixes: 9bb2e0452508 ("gpio: amd: Make resource struct const")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Link: https://lore.kernel.org/r/20190628150049.1108048-1-arnd@arndb.de
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Reviwed-By: Enrico Weigelt <info@metux.net>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/device.h | 3 ++-
 lib/devres.c           | 3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/include/linux/device.h b/include/linux/device.h
index e9d1c768f972a..c74ce473589ae 100644
--- a/include/linux/device.h
+++ b/include/linux/device.h
@@ -701,7 +701,8 @@ extern unsigned long devm_get_free_pages(struct device *dev,
 					 gfp_t gfp_mask, unsigned int order);
 extern void devm_free_pages(struct device *dev, unsigned long addr);
 
-void __iomem *devm_ioremap_resource(struct device *dev, struct resource *res);
+void __iomem *devm_ioremap_resource(struct device *dev,
+				    const struct resource *res);
 
 void __iomem *devm_of_iomap(struct device *dev,
 			    struct device_node *node, int index,
diff --git a/lib/devres.c b/lib/devres.c
index faccf1a037d05..aa0f5308ac6be 100644
--- a/lib/devres.c
+++ b/lib/devres.c
@@ -131,7 +131,8 @@ EXPORT_SYMBOL(devm_iounmap);
  *	if (IS_ERR(base))
  *		return PTR_ERR(base);
  */
-void __iomem *devm_ioremap_resource(struct device *dev, struct resource *res)
+void __iomem *devm_ioremap_resource(struct device *dev,
+				    const struct resource *res)
 {
 	resource_size_t size;
 	const char *name;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 467/639] fsi: sbefifo: Dont fail operations when in SBE IPL state
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (465 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.19 466/639] devres: allow const resource arguments Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.19 468/639] RDMA/hns: Fixs hw access invalid dma memory error Greg Kroah-Hartman
                   ` (175 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Joel Stanley, Alistair Popple,
	Eddie James, Sasha Levin

From: Eddie James <eajames@linux.ibm.com>

[ Upstream commit 7ce98fb6c53d2311b3e9faae90b1a9c1a96534db ]

SBE fifo operations should be allowed while the SBE is in any of the
"IPL" states. Operations should succeed in this state.

Fixes: 9f4a8a2d7f9d fsi/sbefifo: Add driver for the SBE FIFO
Reviewed-by: Joel Stanley <joel@jms.id.au>
Tested-by: Alistair Popple <alistair@popple.id.au>
Signed-off-by: Eddie James <eajames@linux.ibm.com>
Link: https://lore.kernel.org/r/1561575415-3282-1-git-send-email-eajames@linux.ibm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/fsi/fsi-sbefifo.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/fsi/fsi-sbefifo.c b/drivers/fsi/fsi-sbefifo.c
index ae861342626e3..9fa3959e08554 100644
--- a/drivers/fsi/fsi-sbefifo.c
+++ b/drivers/fsi/fsi-sbefifo.c
@@ -289,11 +289,11 @@ static int sbefifo_check_sbe_state(struct sbefifo *sbefifo)
 	switch ((sbm & CFAM_SBM_SBE_STATE_MASK) >> CFAM_SBM_SBE_STATE_SHIFT) {
 	case SBE_STATE_UNKNOWN:
 		return -ESHUTDOWN;
+	case SBE_STATE_DMT:
+		return -EBUSY;
 	case SBE_STATE_IPLING:
 	case SBE_STATE_ISTEP:
 	case SBE_STATE_MPIPL:
-	case SBE_STATE_DMT:
-		return -EBUSY;
 	case SBE_STATE_RUNTIME:
 	case SBE_STATE_DUMP: /* Not sure about that one */
 		break;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 468/639] RDMA/hns: Fixs hw access invalid dma memory error
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (466 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.19 467/639] fsi: sbefifo: Dont fail operations when in SBE IPL state Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.19 469/639] PCI: mobiveil: Remove the flag MSI_FLAG_MULTI_PCI_MSI Greg Kroah-Hartman
                   ` (174 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Xi Wang, Jason Gunthorpe, Sasha Levin

From: Xi Wang <wangxi11@huawei.com>

[ Upstream commit ec5bc2cc69b4fc494e04d10fc5226f6f9cf67c56 ]

When smmu is enable, if execute the perftest command and then use 'kill
-9' to exit, follow this operation repeatedly, the kernel will have a high
probability to print the following smmu event:

  arm-smmu-v3 arm-smmu-v3.1.auto: event 0x10 received:
  arm-smmu-v3 arm-smmu-v3.1.auto:  0x00007d0000000010
  arm-smmu-v3 arm-smmu-v3.1.auto:  0x0000020900000080
  arm-smmu-v3 arm-smmu-v3.1.auto:  0x00000000f47cf000
  arm-smmu-v3 arm-smmu-v3.1.auto:  0x00000000f47cf000

This is because the hw will periodically refresh the qpc cache until the
next reset.

This patch fixed it by removing the action that release qpc memory in the
'hns_roce_qp_free' function.

Fixes: 9a4435375cd1 ("IB/hns: Add driver files for hns RoCE driver")
Signed-off-by: Xi Wang <wangxi11@huawei.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/hw/hns/hns_roce_qp.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/infiniband/hw/hns/hns_roce_qp.c b/drivers/infiniband/hw/hns/hns_roce_qp.c
index af24698ff2262..3012d7eb4ccb4 100644
--- a/drivers/infiniband/hw/hns/hns_roce_qp.c
+++ b/drivers/infiniband/hw/hns/hns_roce_qp.c
@@ -262,7 +262,6 @@ void hns_roce_qp_free(struct hns_roce_dev *hr_dev, struct hns_roce_qp *hr_qp)
 			hns_roce_table_put(hr_dev, &qp_table->trrl_table,
 					   hr_qp->qpn);
 		hns_roce_table_put(hr_dev, &qp_table->irrl_table, hr_qp->qpn);
-		hns_roce_table_put(hr_dev, &qp_table->qp_table, hr_qp->qpn);
 	}
 }
 EXPORT_SYMBOL_GPL(hns_roce_qp_free);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 469/639] PCI: mobiveil: Remove the flag MSI_FLAG_MULTI_PCI_MSI
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (467 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.19 468/639] RDMA/hns: Fixs hw access invalid dma memory error Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.19 470/639] PCI: mobiveil: Fix devfn check in mobiveil_pcie_valid_device() Greg Kroah-Hartman
                   ` (173 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hou Zhiqiang, Lorenzo Pieralisi,
	Minghuan Lian, Sasha Levin

From: Hou Zhiqiang <Zhiqiang.Hou@nxp.com>

[ Upstream commit a131fb6364c1be0924dcb969ecf6b988c556a5d5 ]

The Mobiveil internal MSI controller requires separate target addresses,
one per MSI vector; this is clearly incompatible with the Multiple MSI
feature, which requires the same target address for all vectors
requested by an endpoint (ie the Message Address field in the MSI
Capability structure), so the multi MSI feature is clearly not
supported by the host controller driver.

Remove the flag MSI_FLAG_MULTI_PCI_MSI and with it multi MSI support,
fixing the misconfiguration.

Fixes: 1e913e58335f ("PCI: mobiveil: Add MSI support")
Signed-off-by: Hou Zhiqiang <Zhiqiang.Hou@nxp.com>
[lorenzo.pieralisi@arm.com: commit log]
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Reviewed-by: Minghuan Lian <Minghuan.Lian@nxp.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/controller/pcie-mobiveil.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/pci/controller/pcie-mobiveil.c b/drivers/pci/controller/pcie-mobiveil.c
index a2d1e89d48674..dc228eb500edd 100644
--- a/drivers/pci/controller/pcie-mobiveil.c
+++ b/drivers/pci/controller/pcie-mobiveil.c
@@ -643,7 +643,7 @@ static struct irq_chip mobiveil_msi_irq_chip = {
 
 static struct msi_domain_info mobiveil_msi_domain_info = {
 	.flags	= (MSI_FLAG_USE_DEF_DOM_OPS | MSI_FLAG_USE_DEF_CHIP_OPS |
-		MSI_FLAG_MULTI_PCI_MSI | MSI_FLAG_PCI_MSIX),
+		   MSI_FLAG_PCI_MSIX),
 	.chip	= &mobiveil_msi_irq_chip,
 };
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 470/639] PCI: mobiveil: Fix devfn check in mobiveil_pcie_valid_device()
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (468 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.19 469/639] PCI: mobiveil: Remove the flag MSI_FLAG_MULTI_PCI_MSI Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.19 471/639] PCI: mobiveil: Fix the valid check for inbound and outbound windows Greg Kroah-Hartman
                   ` (172 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hou Zhiqiang, Lorenzo Pieralisi,
	Minghuan Lian, Sasha Levin

From: Hou Zhiqiang <Zhiqiang.Hou@nxp.com>

[ Upstream commit cbd50b3ca3964c79dac65fda277637577e029e8c ]

Current check for devfn number in mobiveil_pci_valid_device() is
wrong in that it flags as invalid functions present in PCI device 0
in the root bus while it is perfectly valid to access all functions
in PCI device 0 in the root bus.

Update the check in mobiveil_pci_valid_device() to fix the issue.

Fixes: 9af6bcb11e12 ("PCI: mobiveil: Add Mobiveil PCIe Host Bridge IP driver")
Signed-off-by: Hou Zhiqiang <Zhiqiang.Hou@nxp.com>
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Reviewed-by: Minghuan Lian <Minghuan.Lian@nxp.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/controller/pcie-mobiveil.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/pci/controller/pcie-mobiveil.c b/drivers/pci/controller/pcie-mobiveil.c
index dc228eb500edd..476be4f3c7f6e 100644
--- a/drivers/pci/controller/pcie-mobiveil.c
+++ b/drivers/pci/controller/pcie-mobiveil.c
@@ -174,7 +174,7 @@ static bool mobiveil_pcie_valid_device(struct pci_bus *bus, unsigned int devfn)
 	 * Do not read more than one device on the bus directly
 	 * attached to RC
 	 */
-	if ((bus->primary == pcie->root_bus_nr) && (devfn > 0))
+	if ((bus->primary == pcie->root_bus_nr) && (PCI_SLOT(devfn) > 0))
 		return false;
 
 	return true;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 471/639] PCI: mobiveil: Fix the valid check for inbound and outbound windows
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (469 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.19 470/639] PCI: mobiveil: Fix devfn check in mobiveil_pcie_valid_device() Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.19 472/639] ceph: fix "ceph.dir.rctime" vxattr value Greg Kroah-Hartman
                   ` (171 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hou Zhiqiang, Lorenzo Pieralisi,
	Minghuan Lian, Subrahmanya Lingappa, Sasha Levin

From: Hou Zhiqiang <Zhiqiang.Hou@nxp.com>

[ Upstream commit ccd34dac2ed596b1f26079912bdf638e002a3979 ]

In program_ib/ob_windows() check the window index from the function
parameter instead of the total number of initialized windows to
determine if the specified window is valid.

Fixes: 9af6bcb11e12 ("PCI: mobiveil: Add Mobiveil PCIe Host Bridge IP driver")
Signed-off-by: Hou Zhiqiang <Zhiqiang.Hou@nxp.com>
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Reviewed-by: Minghuan Lian <Minghuan.Lian@nxp.com>
Reviewed-by: Subrahmanya Lingappa <l.subrahmanya@mobiveil.co.in>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/controller/pcie-mobiveil.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/pci/controller/pcie-mobiveil.c b/drivers/pci/controller/pcie-mobiveil.c
index 476be4f3c7f6e..14f816591e844 100644
--- a/drivers/pci/controller/pcie-mobiveil.c
+++ b/drivers/pci/controller/pcie-mobiveil.c
@@ -395,7 +395,7 @@ static void program_ib_windows(struct mobiveil_pcie *pcie, int win_num,
 	int amap_ctrl_dw;
 	u64 size64 = ~(size - 1);
 
-	if ((pcie->ib_wins_configured + 1) > pcie->ppio_wins) {
+	if (win_num >= pcie->ppio_wins) {
 		dev_err(&pcie->pdev->dev,
 			"ERROR: max inbound windows reached !\n");
 		return;
@@ -429,7 +429,7 @@ static void program_ob_windows(struct mobiveil_pcie *pcie, int win_num,
 	u32 value, type;
 	u64 size64 = ~(size - 1);
 
-	if ((pcie->ob_wins_configured + 1) > pcie->apio_wins) {
+	if (win_num >= pcie->apio_wins) {
 		dev_err(&pcie->pdev->dev,
 			"ERROR: max outbound windows reached !\n");
 		return;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 472/639] ceph: fix "ceph.dir.rctime" vxattr value
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (470 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.19 471/639] PCI: mobiveil: Fix the valid check for inbound and outbound windows Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.19 473/639] net: pasemi: fix an use-after-free in pasemi_mac_phy_init() Greg Kroah-Hartman
                   ` (170 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, David Disseldorp, Ilya Dryomov, Sasha Levin

From: David Disseldorp <ddiss@suse.de>

[ Upstream commit 718807289d4130be1fe13f24f018733116958070 ]

The vxattr value incorrectly places a "09" prefix to the nanoseconds
field, instead of providing it as a zero-pad width specifier after '%'.

Fixes: 3489b42a72a4 ("ceph: fix three bugs, two in ceph_vxattrcb_file_layout()")
Link: https://tracker.ceph.com/issues/39943
Signed-off-by: David Disseldorp <ddiss@suse.de>
Reviewed-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ceph/xattr.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/ceph/xattr.c b/fs/ceph/xattr.c
index 5e4f3f833e85e..a09ce27ab2204 100644
--- a/fs/ceph/xattr.c
+++ b/fs/ceph/xattr.c
@@ -221,7 +221,7 @@ static size_t ceph_vxattrcb_dir_rbytes(struct ceph_inode_info *ci, char *val,
 static size_t ceph_vxattrcb_dir_rctime(struct ceph_inode_info *ci, char *val,
 				       size_t size)
 {
-	return snprintf(val, size, "%lld.09%ld", ci->i_rctime.tv_sec,
+	return snprintf(val, size, "%lld.%09ld", ci->i_rctime.tv_sec,
 			ci->i_rctime.tv_nsec);
 }
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 473/639] net: pasemi: fix an use-after-free in pasemi_mac_phy_init()
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (471 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.19 472/639] ceph: fix "ceph.dir.rctime" vxattr value Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.19 474/639] net/tls: fix socket wmem accounting on fallback with netem Greg Kroah-Hartman
                   ` (169 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Wen Yang, David S. Miller,
	Thomas Gleixner, Luis Chamberlain, Michael Ellerman, netdev,
	Sasha Levin

From: Wen Yang <wen.yang99@zte.com.cn>

[ Upstream commit faf5577f2498cea23011b5c785ef853ded22700b ]

The phy_dn variable is still being used in of_phy_connect() after the
of_node_put() call, which may result in use-after-free.

Fixes: 1dd2d06c0459 ("net: Rework pasemi_mac driver to use of_mdio infrastructure")
Signed-off-by: Wen Yang <wen.yang99@zte.com.cn>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Luis Chamberlain <mcgrof@kernel.org>
Cc: Michael Ellerman <mpe@ellerman.id.au>
Cc: netdev@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/pasemi/pasemi_mac.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/pasemi/pasemi_mac.c b/drivers/net/ethernet/pasemi/pasemi_mac.c
index 8a31a02c9f47f..65f69e562618a 100644
--- a/drivers/net/ethernet/pasemi/pasemi_mac.c
+++ b/drivers/net/ethernet/pasemi/pasemi_mac.c
@@ -1053,7 +1053,6 @@ static int pasemi_mac_phy_init(struct net_device *dev)
 
 	dn = pci_device_to_OF_node(mac->pdev);
 	phy_dn = of_parse_phandle(dn, "phy-handle", 0);
-	of_node_put(phy_dn);
 
 	mac->link = 0;
 	mac->speed = 0;
@@ -1062,6 +1061,7 @@ static int pasemi_mac_phy_init(struct net_device *dev)
 	phydev = of_phy_connect(dev, phy_dn, &pasemi_adjust_link, 0,
 				PHY_INTERFACE_MODE_SGMII);
 
+	of_node_put(phy_dn);
 	if (!phydev) {
 		printk(KERN_ERR "%s: Could not attach to phy\n", dev->name);
 		return -ENODEV;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 474/639] net/tls: fix socket wmem accounting on fallback with netem
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (472 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.19 473/639] net: pasemi: fix an use-after-free in pasemi_mac_phy_init() Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.19 475/639] x86/pgtable/32: Fix LOWMEM_PAGES constant Greg Kroah-Hartman
                   ` (168 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jakub Kicinski, Dirk van der Merwe,
	David S. Miller, Sasha Levin

From: Jakub Kicinski <jakub.kicinski@netronome.com>

[ Upstream commit 5c4b4608fe100838c62591877101128467e56c00 ]

netem runs skb_orphan_partial() which "disconnects" the skb
from normal TCP write memory accounting.  We should not adjust
sk->sk_wmem_alloc on the fallback path for such skbs.

Fixes: e8f69799810c ("net/tls: Add generic NIC offload infrastructure")
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Reviewed-by: Dirk van der Merwe <dirk.vandermerwe@netronome.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/tls/tls_device_fallback.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/net/tls/tls_device_fallback.c b/net/tls/tls_device_fallback.c
index 426dd97725e4a..6cf832891b53e 100644
--- a/net/tls/tls_device_fallback.c
+++ b/net/tls/tls_device_fallback.c
@@ -208,6 +208,10 @@ static void complete_skb(struct sk_buff *nskb, struct sk_buff *skb, int headln)
 
 	update_chksum(nskb, headln);
 
+	/* sock_efree means skb must gone through skb_orphan_partial() */
+	if (nskb->destructor == sock_efree)
+		return;
+
 	delta = nskb->truesize - skb->truesize;
 	if (likely(delta < 0))
 		WARN_ON_ONCE(refcount_sub_and_test(-delta, &sk->sk_wmem_alloc));
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 475/639] x86/pgtable/32: Fix LOWMEM_PAGES constant
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (473 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.19 474/639] net/tls: fix socket wmem accounting on fallback with netem Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.19 476/639] xdp: fix possible cq entry leak Greg Kroah-Hartman
                   ` (167 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Arnd Bergmann, Thomas Gleixner, Sasha Levin

From: Arnd Bergmann <arnd@arndb.de>

[ Upstream commit 26515699863d68058e290e18e83f444925920be5 ]

clang points out that the computation of LOWMEM_PAGES causes a signed
integer overflow on 32-bit x86:

arch/x86/kernel/head32.c:83:20: error: signed shift result (0x100000000) requires 34 bits to represent, but 'int' only has 32 bits [-Werror,-Wshift-overflow]
                (PAGE_TABLE_SIZE(LOWMEM_PAGES) << PAGE_SHIFT);
                                 ^~~~~~~~~~~~
arch/x86/include/asm/pgtable_32.h:109:27: note: expanded from macro 'LOWMEM_PAGES'
 #define LOWMEM_PAGES ((((2<<31) - __PAGE_OFFSET) >> PAGE_SHIFT))
                         ~^ ~~
arch/x86/include/asm/pgtable_32.h:98:34: note: expanded from macro 'PAGE_TABLE_SIZE'
 #define PAGE_TABLE_SIZE(pages) ((pages) / PTRS_PER_PGD)

Use the _ULL() macro to make it a 64-bit constant.

Fixes: 1e620f9b23e5 ("x86/boot/32: Convert the 32-bit pgtable setup code from assembly to C")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Link: https://lkml.kernel.org/r/20190710130522.1802800-1-arnd@arndb.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/include/asm/pgtable_32.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/include/asm/pgtable_32.h b/arch/x86/include/asm/pgtable_32.h
index b3ec519e39827..71e1df8601765 100644
--- a/arch/x86/include/asm/pgtable_32.h
+++ b/arch/x86/include/asm/pgtable_32.h
@@ -106,6 +106,6 @@ do {						\
  * with only a host target support using a 32-bit type for internal
  * representation.
  */
-#define LOWMEM_PAGES ((((2<<31) - __PAGE_OFFSET) >> PAGE_SHIFT))
+#define LOWMEM_PAGES ((((_ULL(2)<<31) - __PAGE_OFFSET) >> PAGE_SHIFT))
 
 #endif /* _ASM_X86_PGTABLE_32_H */
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 476/639] xdp: fix possible cq entry leak
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (474 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.19 475/639] x86/pgtable/32: Fix LOWMEM_PAGES constant Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.19 477/639] ARM: stm32: use "depends on" instead of "if" after prompt Greg Kroah-Hartman
                   ` (166 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ilya Maximets, Björn Töpel,
	William Tu, Daniel Borkmann, Sasha Levin

From: Ilya Maximets <i.maximets@samsung.com>

[ Upstream commit 675716400da6f15b9d3db04ef74ee74ca9a00af3 ]

Completion queue address reservation could not be undone.
In case of bad 'queue_id' or skb allocation failure, reserved entry
will be leaked reducing the total capacity of completion queue.

Fix that by moving reservation to the point where failure is not
possible. Additionally, 'queue_id' checking moved out from the loop
since there is no point to check it there.

Fixes: 35fcde7f8deb ("xsk: support for Tx")
Signed-off-by: Ilya Maximets <i.maximets@samsung.com>
Acked-by: Björn Töpel <bjorn.topel@intel.com>
Tested-by: William Tu <u9012063@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/xdp/xsk.c | 11 ++++-------
 1 file changed, 4 insertions(+), 7 deletions(-)

diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c
index 547fc4554b22c..c90854bc3048e 100644
--- a/net/xdp/xsk.c
+++ b/net/xdp/xsk.c
@@ -218,6 +218,9 @@ static int xsk_generic_xmit(struct sock *sk, struct msghdr *m,
 
 	mutex_lock(&xs->mutex);
 
+	if (xs->queue_id >= xs->dev->real_num_tx_queues)
+		goto out;
+
 	while (xskq_peek_desc(xs->tx, &desc)) {
 		char *buffer;
 		u64 addr;
@@ -228,12 +231,6 @@ static int xsk_generic_xmit(struct sock *sk, struct msghdr *m,
 			goto out;
 		}
 
-		if (xskq_reserve_addr(xs->umem->cq))
-			goto out;
-
-		if (xs->queue_id >= xs->dev->real_num_tx_queues)
-			goto out;
-
 		len = desc.len;
 		skb = sock_alloc_send_skb(sk, len, 1, &err);
 		if (unlikely(!skb)) {
@@ -245,7 +242,7 @@ static int xsk_generic_xmit(struct sock *sk, struct msghdr *m,
 		addr = desc.addr;
 		buffer = xdp_umem_get_data(xs->umem, addr);
 		err = skb_store_bits(skb, 0, buffer, len);
-		if (unlikely(err)) {
+		if (unlikely(err) || xskq_reserve_addr(xs->umem->cq)) {
 			kfree_skb(skb);
 			goto out;
 		}
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 477/639] ARM: stm32: use "depends on" instead of "if" after prompt
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (475 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.19 476/639] xdp: fix possible cq entry leak Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.19 478/639] scsi: libfc: fix null pointer dereference on a null lport Greg Kroah-Hartman
                   ` (165 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Masahiro Yamada, Olof Johansson, Sasha Levin

From: Masahiro Yamada <yamada.masahiro@socionext.com>

[ Upstream commit 7e8a0f10899075ac2665c78c4e49dbaf32bf3346 ]

This appeared after the global fixups by commit e32465429490 ("ARM: use
"depends on" for SoC configs instead of "if" after prompt"). Fix it now.

Link: https://lore.kernel.org/r/20190710051320.8738-1-yamada.masahiro@socionext.com
Fixes: e32465429490 ("ARM: use "depends on" for SoC configs instead of "if" after prompt")
Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
Signed-off-by: Olof Johansson <olof@lixom.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/mach-stm32/Kconfig | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/arch/arm/mach-stm32/Kconfig b/arch/arm/mach-stm32/Kconfig
index 713c068b953fb..adca4368d67c4 100644
--- a/arch/arm/mach-stm32/Kconfig
+++ b/arch/arm/mach-stm32/Kconfig
@@ -1,5 +1,6 @@
 menuconfig ARCH_STM32
-	bool "STMicroelectronics STM32 family" if ARM_SINGLE_ARMV7M || ARCH_MULTI_V7
+	bool "STMicroelectronics STM32 family"
+	depends on ARM_SINGLE_ARMV7M || ARCH_MULTI_V7
 	select ARMV7M_SYSTICK if ARM_SINGLE_ARMV7M
 	select HAVE_ARM_ARCH_TIMER if ARCH_MULTI_V7
 	select ARM_GIC if ARCH_MULTI_V7
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 478/639] scsi: libfc: fix null pointer dereference on a null lport
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (476 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.19 477/639] ARM: stm32: use "depends on" instead of "if" after prompt Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.19 479/639] xfrm interface: ifname may be wrong in logs Greg Kroah-Hartman
                   ` (164 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Colin Ian King, Hannes Reinecke,
	Martin K. Petersen, Sasha Levin

From: Colin Ian King <colin.king@canonical.com>

[ Upstream commit 41a6bf6529edd10a6def42e3b2c34a7474bcc2f5 ]

Currently if lport is null then the null lport pointer is dereference when
printing out debug via the FC_LPORT_DB macro. Fix this by using the more
generic FC_LIBFC_DBG debug macro instead that does not use lport.

Addresses-Coverity: ("Dereference after null check")
Fixes: 7414705ea4ae ("libfc: Add runtime debugging with debug_logging module parameter")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/libfc/fc_exch.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/scsi/libfc/fc_exch.c b/drivers/scsi/libfc/fc_exch.c
index 42bcf7f3a0f90..6ba257cbc6d94 100644
--- a/drivers/scsi/libfc/fc_exch.c
+++ b/drivers/scsi/libfc/fc_exch.c
@@ -2603,7 +2603,7 @@ void fc_exch_recv(struct fc_lport *lport, struct fc_frame *fp)
 
 	/* lport lock ? */
 	if (!lport || lport->state == LPORT_ST_DISABLED) {
-		FC_LPORT_DBG(lport, "Receiving frames for an lport that "
+		FC_LIBFC_DBG("Receiving frames for an lport that "
 			     "has not been initialized correctly\n");
 		fc_frame_free(fp);
 		return;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 479/639] xfrm interface: ifname may be wrong in logs
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (477 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.19 478/639] scsi: libfc: fix null pointer dereference on a null lport Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.19 480/639] drm/panel: make drm_panel.h self-contained Greg Kroah-Hartman
                   ` (163 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Nicolas Dichtel, Steffen Klassert,
	Sasha Levin

From: Nicolas Dichtel <nicolas.dichtel@6wind.com>

[ Upstream commit e0aaa332e6a97dae57ad59cdb19e21f83c3d081c ]

The ifname is copied when the interface is created, but is never updated
later. In fact, this property is used only in one error message, where the
netdevice pointer is available, thus let's use it.

Fixes: f203b76d7809 ("xfrm: Add virtual xfrm interfaces")
Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/net/xfrm.h        |  1 -
 net/xfrm/xfrm_interface.c | 10 +---------
 2 files changed, 1 insertion(+), 10 deletions(-)

diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index fb9b19a3b7496..48dc1ce2170d8 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -1054,7 +1054,6 @@ static inline void xfrm_dst_destroy(struct xfrm_dst *xdst)
 void xfrm_dst_ifdown(struct dst_entry *dst, struct net_device *dev);
 
 struct xfrm_if_parms {
-	char name[IFNAMSIZ];	/* name of XFRM device */
 	int link;		/* ifindex of underlying L2 interface */
 	u32 if_id;		/* interface identifyer */
 };
diff --git a/net/xfrm/xfrm_interface.c b/net/xfrm/xfrm_interface.c
index d6a3cdf7885c3..4ee512622e93d 100644
--- a/net/xfrm/xfrm_interface.c
+++ b/net/xfrm/xfrm_interface.c
@@ -145,8 +145,6 @@ static int xfrmi_create(struct net_device *dev)
 	if (err < 0)
 		goto out;
 
-	strcpy(xi->p.name, dev->name);
-
 	dev_hold(dev);
 	xfrmi_link(xfrmn, xi);
 
@@ -293,7 +291,7 @@ xfrmi_xmit2(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)
 	if (tdev == dev) {
 		stats->collisions++;
 		net_warn_ratelimited("%s: Local routing loop detected!\n",
-				     xi->p.name);
+				     dev->name);
 		goto tx_err_dst_release;
 	}
 
@@ -648,12 +646,6 @@ static int xfrmi_newlink(struct net *src_net, struct net_device *dev,
 	int err;
 
 	xfrmi_netlink_parms(data, &p);
-
-	if (!tb[IFLA_IFNAME])
-		return -EINVAL;
-
-	nla_strlcpy(p.name, tb[IFLA_IFNAME], IFNAMSIZ);
-
 	xi = xfrmi_locate(net, &p);
 	if (xi)
 		return -EEXIST;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 480/639] drm/panel: make drm_panel.h self-contained
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (478 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.19 479/639] xfrm interface: ifname may be wrong in logs Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.19 481/639] clk: sunxi-ng: v3s: add the missing PLL_DDR1 Greg Kroah-Hartman
                   ` (162 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jani Nikula, Thierry Reding,
	Sam Ravnborg, Sean Paul, Boris Brezillon, Sasha Levin

From: Jani Nikula <jani.nikula@intel.com>

[ Upstream commit bf3f5e98559360661a3d2af340d46522512c0b00 ]

Fix build warning if drm_panel.h is built with CONFIG_OF=n or
CONFIG_DRM_PANEL=n and included without the prerequisite err.h:

./include/drm/drm_panel.h: In function ‘of_drm_find_panel’:
./include/drm/drm_panel.h:203:9: error: implicit declaration of function ‘ERR_PTR’ [-Werror=implicit-function-declaration]
  return ERR_PTR(-ENODEV);
         ^~~~~~~
./include/drm/drm_panel.h:203:9: error: returning ‘int’ from a function with return type ‘struct drm_panel *’ makes pointer from integer without a cast [-Werror=int-conversion]
  return ERR_PTR(-ENODEV);
         ^~~~~~~~~~~~~~~~

Fixes: 5fa8e4a22182 ("drm/panel: Make of_drm_find_panel() return an ERR_PTR() instead of NULL")
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Acked-by: Thierry Reding <treding@nvidia.com>
Reviewed-by: Sam Ravnborg <sam@ravnborg.org>
Reviewed-by: Sean Paul <sean@poorly.run>
Cc: Boris Brezillon <bbrezillon@kernel.org>
Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20190718161507.2047-2-sam@ravnborg.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/drm/drm_panel.h | 1 +
 1 file changed, 1 insertion(+)

diff --git a/include/drm/drm_panel.h b/include/drm/drm_panel.h
index 777814755fa62..675aa1e876ce6 100644
--- a/include/drm/drm_panel.h
+++ b/include/drm/drm_panel.h
@@ -24,6 +24,7 @@
 #ifndef __DRM_PANEL_H__
 #define __DRM_PANEL_H__
 
+#include <linux/err.h>
 #include <linux/errno.h>
 #include <linux/list.h>
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 481/639] clk: sunxi-ng: v3s: add the missing PLL_DDR1
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (479 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.19 480/639] drm/panel: make drm_panel.h self-contained Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.19 482/639] PM: sleep: Fix possible overflow in pm_system_cancel_wakeup() Greg Kroah-Hartman
                   ` (161 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Icenowy Zheng, Maxime Ripard, Sasha Levin

From: Icenowy Zheng <icenowy@aosc.io>

[ Upstream commit c5ed9475c22c89d5409402055142372e35d26a3f ]

The user manual of V3/V3s/S3 declares a PLL_DDR1, however it's forgot
when developing the V3s CCU driver.

Add back the missing PLL_DDR1.

Fixes: d0f11d14b0bc ("clk: sunxi-ng: add support for V3s CCU")
Signed-off-by: Icenowy Zheng <icenowy@aosc.io>
Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/sunxi-ng/ccu-sun8i-v3s.c | 19 +++++++++++++++----
 drivers/clk/sunxi-ng/ccu-sun8i-v3s.h |  6 ++++--
 2 files changed, 19 insertions(+), 6 deletions(-)

diff --git a/drivers/clk/sunxi-ng/ccu-sun8i-v3s.c b/drivers/clk/sunxi-ng/ccu-sun8i-v3s.c
index 9e3f4088724b4..c7f9d974b10d5 100644
--- a/drivers/clk/sunxi-ng/ccu-sun8i-v3s.c
+++ b/drivers/clk/sunxi-ng/ccu-sun8i-v3s.c
@@ -84,7 +84,7 @@ static SUNXI_CCU_NM_WITH_FRAC_GATE_LOCK(pll_ve_clk, "pll-ve",
 					BIT(28),	/* lock */
 					0);
 
-static SUNXI_CCU_NKM_WITH_GATE_LOCK(pll_ddr_clk, "pll-ddr",
+static SUNXI_CCU_NKM_WITH_GATE_LOCK(pll_ddr0_clk, "pll-ddr0",
 				    "osc24M", 0x020,
 				    8, 5,	/* N */
 				    4, 2,	/* K */
@@ -123,6 +123,14 @@ static SUNXI_CCU_NK_WITH_GATE_LOCK_POSTDIV(pll_periph1_clk, "pll-periph1",
 					   2,		/* post-div */
 					   0);
 
+static SUNXI_CCU_NM_WITH_GATE_LOCK(pll_ddr1_clk, "pll-ddr1",
+				   "osc24M", 0x04c,
+				   8, 7,	/* N */
+				   0, 2,	/* M */
+				   BIT(31),	/* gate */
+				   BIT(28),	/* lock */
+				   0);
+
 static const char * const cpu_parents[] = { "osc32k", "osc24M",
 					     "pll-cpu", "pll-cpu" };
 static SUNXI_CCU_MUX(cpu_clk, "cpu", cpu_parents,
@@ -310,7 +318,8 @@ static SUNXI_CCU_GATE(usb_phy0_clk,	"usb-phy0",	"osc24M",
 static SUNXI_CCU_GATE(usb_ohci0_clk,	"usb-ohci0",	"osc24M",
 		      0x0cc, BIT(16), 0);
 
-static const char * const dram_parents[] = { "pll-ddr", "pll-periph0-2x" };
+static const char * const dram_parents[] = { "pll-ddr0", "pll-ddr1",
+					     "pll-periph0-2x" };
 static SUNXI_CCU_M_WITH_MUX(dram_clk, "dram", dram_parents,
 			    0x0f4, 0, 4, 20, 2, CLK_IS_CRITICAL);
 
@@ -369,10 +378,11 @@ static struct ccu_common *sun8i_v3s_ccu_clks[] = {
 	&pll_audio_base_clk.common,
 	&pll_video_clk.common,
 	&pll_ve_clk.common,
-	&pll_ddr_clk.common,
+	&pll_ddr0_clk.common,
 	&pll_periph0_clk.common,
 	&pll_isp_clk.common,
 	&pll_periph1_clk.common,
+	&pll_ddr1_clk.common,
 	&cpu_clk.common,
 	&axi_clk.common,
 	&ahb1_clk.common,
@@ -457,11 +467,12 @@ static struct clk_hw_onecell_data sun8i_v3s_hw_clks = {
 		[CLK_PLL_AUDIO_8X]	= &pll_audio_8x_clk.hw,
 		[CLK_PLL_VIDEO]		= &pll_video_clk.common.hw,
 		[CLK_PLL_VE]		= &pll_ve_clk.common.hw,
-		[CLK_PLL_DDR]		= &pll_ddr_clk.common.hw,
+		[CLK_PLL_DDR0]		= &pll_ddr0_clk.common.hw,
 		[CLK_PLL_PERIPH0]	= &pll_periph0_clk.common.hw,
 		[CLK_PLL_PERIPH0_2X]	= &pll_periph0_2x_clk.hw,
 		[CLK_PLL_ISP]		= &pll_isp_clk.common.hw,
 		[CLK_PLL_PERIPH1]	= &pll_periph1_clk.common.hw,
+		[CLK_PLL_DDR1]		= &pll_ddr1_clk.common.hw,
 		[CLK_CPU]		= &cpu_clk.common.hw,
 		[CLK_AXI]		= &axi_clk.common.hw,
 		[CLK_AHB1]		= &ahb1_clk.common.hw,
diff --git a/drivers/clk/sunxi-ng/ccu-sun8i-v3s.h b/drivers/clk/sunxi-ng/ccu-sun8i-v3s.h
index 4a4d36fdad960..a091b7217dfd5 100644
--- a/drivers/clk/sunxi-ng/ccu-sun8i-v3s.h
+++ b/drivers/clk/sunxi-ng/ccu-sun8i-v3s.h
@@ -29,7 +29,7 @@
 #define CLK_PLL_AUDIO_8X	5
 #define CLK_PLL_VIDEO		6
 #define CLK_PLL_VE		7
-#define CLK_PLL_DDR		8
+#define CLK_PLL_DDR0		8
 #define CLK_PLL_PERIPH0		9
 #define CLK_PLL_PERIPH0_2X	10
 #define CLK_PLL_ISP		11
@@ -58,6 +58,8 @@
 
 /* And the GPU module clock is exported */
 
-#define CLK_NUMBER		(CLK_MIPI_CSI + 1)
+#define CLK_PLL_DDR1		74
+
+#define CLK_NUMBER		(CLK_PLL_DDR1 + 1)
 
 #endif /* _CCU_SUN8I_H3_H_ */
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 482/639] PM: sleep: Fix possible overflow in pm_system_cancel_wakeup()
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (480 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.19 481/639] clk: sunxi-ng: v3s: add the missing PLL_DDR1 Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.19 483/639] libertas_tf: Use correct channel range in lbtf_geo_init Greg Kroah-Hartman
                   ` (160 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Rafael J. Wysocki, Thomas Gleixner,
	Sasha Levin

From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>

[ Upstream commit 2933954b71f10d392764f95eec0f0aa2d103054b ]

It is not actually guaranteed that pm_abort_suspend will be
nonzero when pm_system_cancel_wakeup() is called which may lead to
subtle issues, so make it use atomic_dec_if_positive() instead of
atomic_dec() for the safety sake.

Fixes: 33e4f80ee69b ("ACPI / PM: Ignore spurious SCI wakeups from suspend-to-idle")
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Acked-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/base/power/wakeup.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/base/power/wakeup.c b/drivers/base/power/wakeup.c
index 7c84f64c74f77..2dfa2e0487451 100644
--- a/drivers/base/power/wakeup.c
+++ b/drivers/base/power/wakeup.c
@@ -875,7 +875,7 @@ EXPORT_SYMBOL_GPL(pm_system_wakeup);
 
 void pm_system_cancel_wakeup(void)
 {
-	atomic_dec(&pm_abort_suspend);
+	atomic_dec_if_positive(&pm_abort_suspend);
 }
 
 void pm_wakeup_clear(bool reset)
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 483/639] libertas_tf: Use correct channel range in lbtf_geo_init
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (481 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.19 482/639] PM: sleep: Fix possible overflow in pm_system_cancel_wakeup() Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.19 484/639] qed: reduce maximum stack frame size Greg Kroah-Hartman
                   ` (159 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, YueHaibing, Kalle Valo,
	Sasha Levin

From: YueHaibing <yuehaibing@huawei.com>

[ Upstream commit 2ec4ad49b98e4a14147d04f914717135eca7c8b1 ]

It seems we should use 'range' instead of 'priv->range'
in lbtf_geo_init(), because 'range' is the corret one
related to current regioncode.

Reported-by: Hulk Robot <hulkci@huawei.com>
Fixes: 691cdb49388b ("libertas_tf: command helper functions for libertas_tf")
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/marvell/libertas_tf/cmd.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/marvell/libertas_tf/cmd.c b/drivers/net/wireless/marvell/libertas_tf/cmd.c
index 909ac3685010f..2b193f1257a5a 100644
--- a/drivers/net/wireless/marvell/libertas_tf/cmd.c
+++ b/drivers/net/wireless/marvell/libertas_tf/cmd.c
@@ -69,7 +69,7 @@ static void lbtf_geo_init(struct lbtf_private *priv)
 			break;
 		}
 
-	for (ch = priv->range.start; ch < priv->range.end; ch++)
+	for (ch = range->start; ch < range->end; ch++)
 		priv->channels[CHAN_TO_IDX(ch)].flags = 0;
 }
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 484/639] qed: reduce maximum stack frame size
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (482 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.19 483/639] libertas_tf: Use correct channel range in lbtf_geo_init Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.19 485/639] usb: host: xhci-hub: fix extra endianness conversion Greg Kroah-Hartman
                   ` (158 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Arnd Bergmann, David S. Miller, Sasha Levin

From: Arnd Bergmann <arnd@arndb.de>

[ Upstream commit 7c116e02a4a7575c8c62bfd2106e3e3ec8fb99dc ]

clang warns about an overly large stack frame in one function
when it decides to inline all __qed_get_vport_*() functions into
__qed_get_vport_stats():

drivers/net/ethernet/qlogic/qed/qed_l2.c:1889:13: error: stack frame size of 1128 bytes in function '_qed_get_vport_stats' [-Werror,-Wframe-larger-than=]

Use a noinline_for_stack annotation to prevent clang from inlining
these, which keeps the maximum stack usage at around half of that
in the worst case, similar to what we get with gcc.

Fixes: 86622ee75312 ("qed: Move statistics to L2 code")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/qlogic/qed/qed_l2.c | 34 +++++++++++-------------
 1 file changed, 15 insertions(+), 19 deletions(-)

diff --git a/drivers/net/ethernet/qlogic/qed/qed_l2.c b/drivers/net/ethernet/qlogic/qed/qed_l2.c
index 64ac95ca4df21..d921b991dbdb5 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_l2.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_l2.c
@@ -1631,10 +1631,9 @@ static void __qed_get_vport_pstats_addrlen(struct qed_hwfn *p_hwfn,
 	}
 }
 
-static void __qed_get_vport_pstats(struct qed_hwfn *p_hwfn,
-				   struct qed_ptt *p_ptt,
-				   struct qed_eth_stats *p_stats,
-				   u16 statistics_bin)
+static noinline_for_stack void
+__qed_get_vport_pstats(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt,
+		       struct qed_eth_stats *p_stats, u16 statistics_bin)
 {
 	struct eth_pstorm_per_queue_stat pstats;
 	u32 pstats_addr = 0, pstats_len = 0;
@@ -1661,10 +1660,9 @@ static void __qed_get_vport_pstats(struct qed_hwfn *p_hwfn,
 	    HILO_64_REGPAIR(pstats.error_drop_pkts);
 }
 
-static void __qed_get_vport_tstats(struct qed_hwfn *p_hwfn,
-				   struct qed_ptt *p_ptt,
-				   struct qed_eth_stats *p_stats,
-				   u16 statistics_bin)
+static noinline_for_stack void
+__qed_get_vport_tstats(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt,
+		       struct qed_eth_stats *p_stats, u16 statistics_bin)
 {
 	struct tstorm_per_port_stat tstats;
 	u32 tstats_addr, tstats_len;
@@ -1709,10 +1707,9 @@ static void __qed_get_vport_ustats_addrlen(struct qed_hwfn *p_hwfn,
 	}
 }
 
-static void __qed_get_vport_ustats(struct qed_hwfn *p_hwfn,
-				   struct qed_ptt *p_ptt,
-				   struct qed_eth_stats *p_stats,
-				   u16 statistics_bin)
+static noinline_for_stack
+void __qed_get_vport_ustats(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt,
+			    struct qed_eth_stats *p_stats, u16 statistics_bin)
 {
 	struct eth_ustorm_per_queue_stat ustats;
 	u32 ustats_addr = 0, ustats_len = 0;
@@ -1751,10 +1748,9 @@ static void __qed_get_vport_mstats_addrlen(struct qed_hwfn *p_hwfn,
 	}
 }
 
-static void __qed_get_vport_mstats(struct qed_hwfn *p_hwfn,
-				   struct qed_ptt *p_ptt,
-				   struct qed_eth_stats *p_stats,
-				   u16 statistics_bin)
+static noinline_for_stack void
+__qed_get_vport_mstats(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt,
+		       struct qed_eth_stats *p_stats, u16 statistics_bin)
 {
 	struct eth_mstorm_per_queue_stat mstats;
 	u32 mstats_addr = 0, mstats_len = 0;
@@ -1780,9 +1776,9 @@ static void __qed_get_vport_mstats(struct qed_hwfn *p_hwfn,
 	    HILO_64_REGPAIR(mstats.tpa_coalesced_bytes);
 }
 
-static void __qed_get_vport_port_stats(struct qed_hwfn *p_hwfn,
-				       struct qed_ptt *p_ptt,
-				       struct qed_eth_stats *p_stats)
+static noinline_for_stack void
+__qed_get_vport_port_stats(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt,
+			   struct qed_eth_stats *p_stats)
 {
 	struct qed_eth_stats_common *p_common = &p_stats->common;
 	struct port_stats port_stats;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 485/639] usb: host: xhci-hub: fix extra endianness conversion
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (483 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.19 484/639] qed: reduce maximum stack frame size Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.19 486/639] media: rcar-vin: Clean up correct notifier in error path Greg Kroah-Hartman
                   ` (157 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Mathias Nyman, Ruslan Bilovol, Sasha Levin

From: Ruslan Bilovol <ruslan.bilovol@gmail.com>

[ Upstream commit 6269e4c76eacabaea0d0099200ae1a455768d208 ]

Don't do extra cpu_to_le32 conversion for
put_unaligned_le32 because it is already implemented
in this function.

Fixes sparse error:
xhci-hub.c:1152:44: warning: incorrect type in argument 1 (different base types)
xhci-hub.c:1152:44:    expected unsigned int [usertype] val
xhci-hub.c:1152:44:    got restricted __le32 [usertype]

Fixes: 395f540 "xhci: support new USB 3.1 hub request to get extended port status"
Cc: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Ruslan Bilovol <ruslan.bilovol@gmail.com>
Link: https://lore.kernel.org/r/1562501839-26522-1-git-send-email-ruslan.bilovol@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/host/xhci-hub.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
index 8f180bf7561a2..9772c0de59b7d 100644
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -1104,7 +1104,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
 			}
 			port_li = readl(ports[wIndex]->addr + PORTLI);
 			status = xhci_get_ext_port_status(temp, port_li);
-			put_unaligned_le32(cpu_to_le32(status), &buf[4]);
+			put_unaligned_le32(status, &buf[4]);
 		}
 		break;
 	case SetPortFeature:
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 486/639] media: rcar-vin: Clean up correct notifier in error path
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (484 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.19 485/639] usb: host: xhci-hub: fix extra endianness conversion Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.19 487/639] mic: avoid statically declaring a struct device Greg Kroah-Hartman
                   ` (156 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Niklas Söderlund, Jacopo Mondi,
	Geert Uytterhoeven, Kieran Bingham, Hans Verkuil,
	Mauro Carvalho Chehab, Sasha Levin

From: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>

[ Upstream commit 0bd465765f8d1300040de627f0a0971a8849d654 ]

The parallel input initialization error path cleans up the wrong
async notifier, fix this by cleaning up the correct notifier.

Fixes: 9863bc8695bc36e3 ("media: rcar-vin: Cleanup notifier in error path")
Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
Reviewed-by: Jacopo Mondi <jacopo+renesas@jmondi.org>
Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/rcar-vin/rcar-core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/platform/rcar-vin/rcar-core.c b/drivers/media/platform/rcar-vin/rcar-core.c
index 485fa3fa8b49a..c389ba9ba74d2 100644
--- a/drivers/media/platform/rcar-vin/rcar-core.c
+++ b/drivers/media/platform/rcar-vin/rcar-core.c
@@ -631,7 +631,7 @@ static int rvin_parallel_init(struct rvin_dev *vin)
 	ret = v4l2_async_notifier_register(&vin->v4l2_dev, &vin->notifier);
 	if (ret < 0) {
 		vin_err(vin, "Notifier registration failed\n");
-		v4l2_async_notifier_cleanup(&vin->group->notifier);
+		v4l2_async_notifier_cleanup(&vin->notifier);
 		return ret;
 	}
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 487/639] mic: avoid statically declaring a struct device.
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (485 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.19 486/639] media: rcar-vin: Clean up correct notifier in error path Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.19 488/639] x86/kgbd: Use NMI_VECTOR not APIC_DM_NMI Greg Kroah-Hartman
                   ` (155 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Arnd Bergmann, Sasha Levin

From: Arnd Bergmann <arnd@arndb.de>

[ Upstream commit bc83f79bd2119230888fb8574639d5a51b38f903 ]

Generally, declaring a platform device as a static variable is
a bad idea and can cause all kinds of problems, in particular
with the DMA configuration and lifetime rules.

A specific problem we hit here is from a bug in clang that warns
about certain (otherwise valid) macros when used in static variables:

drivers/misc/mic/card/mic_x100.c:285:27: warning: shift count >= width of type [-Wshift-count-overflow]
static u64 mic_dma_mask = DMA_BIT_MASK(64);
                          ^~~~~~~~~~~~~~~~
include/linux/dma-mapping.h:141:54: note: expanded from macro 'DMA_BIT_MASK'
 #define DMA_BIT_MASK(n) (((n) == 64) ? ~0ULL : ((1ULL<<(n))-1))
                                                     ^ ~~~

A slightly better way here is to create the platform device dynamically
and set the dma mask in the probe function.
This avoids the warning and some other problems, but is still not ideal
because the device creation should really be separated from the driver,
and the fact that the device has no parent means we have to force
the dma mask rather than having it set up from the bus that the device
is actually on.

Fixes: dd8d8d44df64 ("misc: mic: MIC card driver specific changes to enable SCIF")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Link: https://lore.kernel.org/r/20190712092426.872625-1-arnd@arndb.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/misc/mic/card/mic_x100.c | 28 ++++++++++++----------------
 1 file changed, 12 insertions(+), 16 deletions(-)

diff --git a/drivers/misc/mic/card/mic_x100.c b/drivers/misc/mic/card/mic_x100.c
index b9f0710ffa6b0..4007adc666f37 100644
--- a/drivers/misc/mic/card/mic_x100.c
+++ b/drivers/misc/mic/card/mic_x100.c
@@ -249,6 +249,9 @@ static int __init mic_probe(struct platform_device *pdev)
 	mdrv->dev = &pdev->dev;
 	snprintf(mdrv->name, sizeof(mic_driver_name), mic_driver_name);
 
+	/* FIXME: use dma_set_mask_and_coherent() and check result */
+	dma_coerce_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(64));
+
 	mdev->mmio.pa = MIC_X100_MMIO_BASE;
 	mdev->mmio.len = MIC_X100_MMIO_LEN;
 	mdev->mmio.va = devm_ioremap(&pdev->dev, MIC_X100_MMIO_BASE,
@@ -294,18 +297,6 @@ static void mic_platform_shutdown(struct platform_device *pdev)
 	mic_remove(pdev);
 }
 
-static u64 mic_dma_mask = DMA_BIT_MASK(64);
-
-static struct platform_device mic_platform_dev = {
-	.name = mic_driver_name,
-	.id   = 0,
-	.num_resources = 0,
-	.dev = {
-		.dma_mask = &mic_dma_mask,
-		.coherent_dma_mask = DMA_BIT_MASK(64),
-	},
-};
-
 static struct platform_driver __refdata mic_platform_driver = {
 	.probe = mic_probe,
 	.remove = mic_remove,
@@ -315,6 +306,8 @@ static struct platform_driver __refdata mic_platform_driver = {
 	},
 };
 
+static struct platform_device *mic_platform_dev;
+
 static int __init mic_init(void)
 {
 	int ret;
@@ -328,9 +321,12 @@ static int __init mic_init(void)
 
 	request_module("mic_x100_dma");
 	mic_init_card_debugfs();
-	ret = platform_device_register(&mic_platform_dev);
+
+	mic_platform_dev = platform_device_register_simple(mic_driver_name,
+							   0, NULL, 0);
+	ret = PTR_ERR_OR_ZERO(mic_platform_dev);
 	if (ret) {
-		pr_err("platform_device_register ret %d\n", ret);
+		pr_err("platform_device_register_full ret %d\n", ret);
 		goto cleanup_debugfs;
 	}
 	ret = platform_driver_register(&mic_platform_driver);
@@ -341,7 +337,7 @@ static int __init mic_init(void)
 	return ret;
 
 device_unregister:
-	platform_device_unregister(&mic_platform_dev);
+	platform_device_unregister(mic_platform_dev);
 cleanup_debugfs:
 	mic_exit_card_debugfs();
 done:
@@ -351,7 +347,7 @@ done:
 static void __exit mic_exit(void)
 {
 	platform_driver_unregister(&mic_platform_driver);
-	platform_device_unregister(&mic_platform_dev);
+	platform_device_unregister(mic_platform_dev);
 	mic_exit_card_debugfs();
 }
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 488/639] x86/kgbd: Use NMI_VECTOR not APIC_DM_NMI
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (486 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.19 487/639] mic: avoid statically declaring a struct device Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:30 ` [PATCH 4.19 489/639] crypto: ccp - Reduce maximum stack usage Greg Kroah-Hartman
                   ` (154 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Thomas Gleixner,
	Peter Zijlstra (Intel),
	Sasha Levin

From: Thomas Gleixner <tglx@linutronix.de>

[ Upstream commit 2591bc4e8d70b4e1330d327fb7e3921f4e070a51 ]

apic->send_IPI_allbutself() takes a vector number as argument.

APIC_DM_NMI is clearly not a vector number. It's defined to 0x400 which is
outside the vector space.

Use NMI_VECTOR instead as that's what it is intended to be.

Fixes: 82da3ff89dc2 ("x86: kgdb support")
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/20190722105218.855189979@linutronix.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/kernel/kgdb.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/kernel/kgdb.c b/arch/x86/kernel/kgdb.c
index 8e36f249646e2..904e18bb38c52 100644
--- a/arch/x86/kernel/kgdb.c
+++ b/arch/x86/kernel/kgdb.c
@@ -438,7 +438,7 @@ static void kgdb_disable_hw_debug(struct pt_regs *regs)
  */
 void kgdb_roundup_cpus(unsigned long flags)
 {
-	apic->send_IPI_allbutself(APIC_DM_NMI);
+	apic->send_IPI_allbutself(NMI_VECTOR);
 }
 #endif
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 489/639] crypto: ccp - Reduce maximum stack usage
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (487 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.19 488/639] x86/kgbd: Use NMI_VECTOR not APIC_DM_NMI Greg Kroah-Hartman
@ 2020-01-24  9:30 ` Greg Kroah-Hartman
  2020-01-24  9:31 ` [PATCH 4.19 490/639] ALSA: aoa: onyx: always initialize register read value Greg Kroah-Hartman
                   ` (153 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Arnd Bergmann, Herbert Xu, Sasha Levin

From: Arnd Bergmann <arnd@arndb.de>

[ Upstream commit 72c8117adfced37df101c8c0b3f363e0906f83f0 ]

Each of the operations in ccp_run_cmd() needs several hundred
bytes of kernel stack. Depending on the inlining, these may
need separate stack slots that add up to more than the warning
limit, as shown in this clang based build:

drivers/crypto/ccp/ccp-ops.c:871:12: error: stack frame size of 1164 bytes in function 'ccp_run_aes_cmd' [-Werror,-Wframe-larger-than=]
static int ccp_run_aes_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)

The problem may also happen when there is no warning, e.g. in the
ccp_run_cmd()->ccp_run_aes_cmd()->ccp_run_aes_gcm_cmd() call chain with
over 2000 bytes.

Mark each individual function as 'noinline_for_stack' to prevent
this from happening, and move the calls to the two special cases for aes
into the top-level function. This will keep the actual combined stack
usage to the mimimum: 828 bytes for ccp_run_aes_gcm_cmd() and
at most 524 bytes for each of the other cases.

Fixes: 63b945091a07 ("crypto: ccp - CCP device driver and interface support")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/ccp/ccp-ops.c | 52 +++++++++++++++++++++---------------
 1 file changed, 31 insertions(+), 21 deletions(-)

diff --git a/drivers/crypto/ccp/ccp-ops.c b/drivers/crypto/ccp/ccp-ops.c
index 4b48b8523a40c..330853a2702f0 100644
--- a/drivers/crypto/ccp/ccp-ops.c
+++ b/drivers/crypto/ccp/ccp-ops.c
@@ -458,8 +458,8 @@ static int ccp_copy_from_sb(struct ccp_cmd_queue *cmd_q,
 	return ccp_copy_to_from_sb(cmd_q, wa, jobid, sb, byte_swap, true);
 }
 
-static int ccp_run_aes_cmac_cmd(struct ccp_cmd_queue *cmd_q,
-				struct ccp_cmd *cmd)
+static noinline_for_stack int
+ccp_run_aes_cmac_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
 {
 	struct ccp_aes_engine *aes = &cmd->u.aes;
 	struct ccp_dm_workarea key, ctx;
@@ -614,8 +614,8 @@ e_key:
 	return ret;
 }
 
-static int ccp_run_aes_gcm_cmd(struct ccp_cmd_queue *cmd_q,
-			       struct ccp_cmd *cmd)
+static noinline_for_stack int
+ccp_run_aes_gcm_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
 {
 	struct ccp_aes_engine *aes = &cmd->u.aes;
 	struct ccp_dm_workarea key, ctx, final_wa, tag;
@@ -897,7 +897,8 @@ e_key:
 	return ret;
 }
 
-static int ccp_run_aes_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
+static noinline_for_stack int
+ccp_run_aes_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
 {
 	struct ccp_aes_engine *aes = &cmd->u.aes;
 	struct ccp_dm_workarea key, ctx;
@@ -907,12 +908,6 @@ static int ccp_run_aes_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
 	bool in_place = false;
 	int ret;
 
-	if (aes->mode == CCP_AES_MODE_CMAC)
-		return ccp_run_aes_cmac_cmd(cmd_q, cmd);
-
-	if (aes->mode == CCP_AES_MODE_GCM)
-		return ccp_run_aes_gcm_cmd(cmd_q, cmd);
-
 	if (!((aes->key_len == AES_KEYSIZE_128) ||
 	      (aes->key_len == AES_KEYSIZE_192) ||
 	      (aes->key_len == AES_KEYSIZE_256)))
@@ -1080,8 +1075,8 @@ e_key:
 	return ret;
 }
 
-static int ccp_run_xts_aes_cmd(struct ccp_cmd_queue *cmd_q,
-			       struct ccp_cmd *cmd)
+static noinline_for_stack int
+ccp_run_xts_aes_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
 {
 	struct ccp_xts_aes_engine *xts = &cmd->u.xts;
 	struct ccp_dm_workarea key, ctx;
@@ -1280,7 +1275,8 @@ e_key:
 	return ret;
 }
 
-static int ccp_run_des3_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
+static noinline_for_stack int
+ccp_run_des3_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
 {
 	struct ccp_des3_engine *des3 = &cmd->u.des3;
 
@@ -1476,7 +1472,8 @@ e_key:
 	return ret;
 }
 
-static int ccp_run_sha_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
+static noinline_for_stack int
+ccp_run_sha_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
 {
 	struct ccp_sha_engine *sha = &cmd->u.sha;
 	struct ccp_dm_workarea ctx;
@@ -1820,7 +1817,8 @@ e_ctx:
 	return ret;
 }
 
-static int ccp_run_rsa_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
+static noinline_for_stack int
+ccp_run_rsa_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
 {
 	struct ccp_rsa_engine *rsa = &cmd->u.rsa;
 	struct ccp_dm_workarea exp, src, dst;
@@ -1951,8 +1949,8 @@ e_sb:
 	return ret;
 }
 
-static int ccp_run_passthru_cmd(struct ccp_cmd_queue *cmd_q,
-				struct ccp_cmd *cmd)
+static noinline_for_stack int
+ccp_run_passthru_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
 {
 	struct ccp_passthru_engine *pt = &cmd->u.passthru;
 	struct ccp_dm_workarea mask;
@@ -2083,7 +2081,8 @@ e_mask:
 	return ret;
 }
 
-static int ccp_run_passthru_nomap_cmd(struct ccp_cmd_queue *cmd_q,
+static noinline_for_stack int
+ccp_run_passthru_nomap_cmd(struct ccp_cmd_queue *cmd_q,
 				      struct ccp_cmd *cmd)
 {
 	struct ccp_passthru_nomap_engine *pt = &cmd->u.passthru_nomap;
@@ -2424,7 +2423,8 @@ e_src:
 	return ret;
 }
 
-static int ccp_run_ecc_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
+static noinline_for_stack int
+ccp_run_ecc_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
 {
 	struct ccp_ecc_engine *ecc = &cmd->u.ecc;
 
@@ -2461,7 +2461,17 @@ int ccp_run_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
 
 	switch (cmd->engine) {
 	case CCP_ENGINE_AES:
-		ret = ccp_run_aes_cmd(cmd_q, cmd);
+		switch (cmd->u.aes.mode) {
+		case CCP_AES_MODE_CMAC:
+			ret = ccp_run_aes_cmac_cmd(cmd_q, cmd);
+			break;
+		case CCP_AES_MODE_GCM:
+			ret = ccp_run_aes_gcm_cmd(cmd_q, cmd);
+			break;
+		default:
+			ret = ccp_run_aes_cmd(cmd_q, cmd);
+			break;
+		}
 		break;
 	case CCP_ENGINE_XTS_AES_128:
 		ret = ccp_run_xts_aes_cmd(cmd_q, cmd);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 490/639] ALSA: aoa: onyx: always initialize register read value
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (488 preceding siblings ...)
  2020-01-24  9:30 ` [PATCH 4.19 489/639] crypto: ccp - Reduce maximum stack usage Greg Kroah-Hartman
@ 2020-01-24  9:31 ` Greg Kroah-Hartman
  2020-01-24  9:31 ` [PATCH 4.19 491/639] arm64: dts: renesas: r8a77995: Fix register range of display node Greg Kroah-Hartman
                   ` (152 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Stephen Rothwell, Johannes Berg,
	Takashi Iwai, Sasha Levin

From: Johannes Berg <johannes@sipsolutions.net>

[ Upstream commit f474808acb3c4b30552d9c59b181244e0300d218 ]

A lot of places in the driver use onyx_read_register() without
checking the return value, and it's been working OK for ~10 years
or so, so probably never fails ... Rather than trying to check the
return value everywhere, which would be relatively intrusive, at
least make sure we don't use an uninitialized value.

Fixes: f3d9478b2ce4 ("[ALSA] snd-aoa: add snd-aoa")
Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/aoa/codecs/onyx.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/sound/aoa/codecs/onyx.c b/sound/aoa/codecs/onyx.c
index d2d96ca082b71..6224fd3bbf7cc 100644
--- a/sound/aoa/codecs/onyx.c
+++ b/sound/aoa/codecs/onyx.c
@@ -74,8 +74,10 @@ static int onyx_read_register(struct onyx *onyx, u8 reg, u8 *value)
 		return 0;
 	}
 	v = i2c_smbus_read_byte_data(onyx->i2c, reg);
-	if (v < 0)
+	if (v < 0) {
+		*value = 0;
 		return -1;
+	}
 	*value = (u8)v;
 	onyx->cache[ONYX_REG_CONTROL-FIRSTREGISTER] = *value;
 	return 0;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 491/639] arm64: dts: renesas: r8a77995: Fix register range of display node
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (489 preceding siblings ...)
  2020-01-24  9:31 ` [PATCH 4.19 490/639] ALSA: aoa: onyx: always initialize register read value Greg Kroah-Hartman
@ 2020-01-24  9:31 ` Greg Kroah-Hartman
  2020-01-24  9:31 ` [PATCH 4.19 492/639] tipc: reduce risk of wakeup queue starvation Greg Kroah-Hartman
                   ` (151 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yoshihiro Kaneko, Simon Horman,
	Geert Uytterhoeven, Sasha Levin

From: Yoshihiro Kaneko <ykaneko0929@gmail.com>

[ Upstream commit 56d651e890f3befd616b6962a862f5ffa1a514fa ]

Since the R8A77995 SoC uses DU{0,1}, the range from the base address to
the 0x4000 address is used.
This patch fixed it.

Fixes: 18f1a773e3f9e6d1 ("arm64: dts: renesas: r8a77995: add DU support")
Signed-off-by: Yoshihiro Kaneko <ykaneko0929@gmail.com>
Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/renesas/r8a77995.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/renesas/r8a77995.dtsi b/arch/arm64/boot/dts/renesas/r8a77995.dtsi
index fe77bc43c4474..fb3ecb2c385d1 100644
--- a/arch/arm64/boot/dts/renesas/r8a77995.dtsi
+++ b/arch/arm64/boot/dts/renesas/r8a77995.dtsi
@@ -938,7 +938,7 @@
 
 		du: display@feb00000 {
 			compatible = "renesas,du-r8a77995";
-			reg = <0 0xfeb00000 0 0x80000>;
+			reg = <0 0xfeb00000 0 0x40000>;
 			interrupts = <GIC_SPI 256 IRQ_TYPE_LEVEL_HIGH>,
 				     <GIC_SPI 268 IRQ_TYPE_LEVEL_HIGH>;
 			clocks = <&cpg CPG_MOD 724>,
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 492/639] tipc: reduce risk of wakeup queue starvation
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (490 preceding siblings ...)
  2020-01-24  9:31 ` [PATCH 4.19 491/639] arm64: dts: renesas: r8a77995: Fix register range of display node Greg Kroah-Hartman
@ 2020-01-24  9:31 ` Greg Kroah-Hartman
  2020-01-24  9:31 ` [PATCH 4.19 493/639] ARM: dts: stm32: add missing vdda-supply to adc on stm32h743i-eval Greg Kroah-Hartman
                   ` (150 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Tung Nguyen, Ying Xue, Jon Maloy,
	David S. Miller, Sasha Levin

From: Jon Maloy <jon.maloy@ericsson.com>

[ Upstream commit 7c5b42055964f587e55bd87ef334c3a27e95d144 ]

In commit 365ad353c256 ("tipc: reduce risk of user starvation during
link congestion") we allowed senders to add exactly one list of extra
buffers to the link backlog queues during link congestion (aka
"oversubscription"). However, the criteria for when to stop adding
wakeup messages to the input queue when the overload abates is
inaccurate, and may cause starvation problems during very high load.

Currently, we stop adding wakeup messages after 10 total failed attempts
where we find that there is no space left in the backlog queue for a
certain importance level. The counter for this is accumulated across all
levels, which may lead the algorithm to leave the loop prematurely,
although there may still be plenty of space available at some levels.
The result is sometimes that messages near the wakeup queue tail are not
added to the input queue as they should be.

We now introduce a more exact algorithm, where we keep adding wakeup
messages to a level as long as the backlog queue has free slots for
the corresponding level, and stop at the moment there are no more such
slots or when there are no more wakeup messages to dequeue.

Fixes: 365ad35 ("tipc: reduce risk of user starvation during link congestion")
Reported-by: Tung Nguyen <tung.q.nguyen@dektech.com.au>
Acked-by: Ying Xue <ying.xue@windriver.com>
Signed-off-by: Jon Maloy <jon.maloy@ericsson.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/tipc/link.c | 29 +++++++++++++++++++++--------
 1 file changed, 21 insertions(+), 8 deletions(-)

diff --git a/net/tipc/link.c b/net/tipc/link.c
index 0fbf8ea18ce04..cc9a0485536b3 100644
--- a/net/tipc/link.c
+++ b/net/tipc/link.c
@@ -830,18 +830,31 @@ static int link_schedule_user(struct tipc_link *l, struct tipc_msg *hdr)
  */
 static void link_prepare_wakeup(struct tipc_link *l)
 {
+	struct sk_buff_head *wakeupq = &l->wakeupq;
+	struct sk_buff_head *inputq = l->inputq;
 	struct sk_buff *skb, *tmp;
-	int imp, i = 0;
+	struct sk_buff_head tmpq;
+	int avail[5] = {0,};
+	int imp = 0;
+
+	__skb_queue_head_init(&tmpq);
 
-	skb_queue_walk_safe(&l->wakeupq, skb, tmp) {
+	for (; imp <= TIPC_SYSTEM_IMPORTANCE; imp++)
+		avail[imp] = l->backlog[imp].limit - l->backlog[imp].len;
+
+	skb_queue_walk_safe(wakeupq, skb, tmp) {
 		imp = TIPC_SKB_CB(skb)->chain_imp;
-		if (l->backlog[imp].len < l->backlog[imp].limit) {
-			skb_unlink(skb, &l->wakeupq);
-			skb_queue_tail(l->inputq, skb);
-		} else if (i++ > 10) {
-			break;
-		}
+		if (avail[imp] <= 0)
+			continue;
+		avail[imp]--;
+		__skb_unlink(skb, wakeupq);
+		__skb_queue_tail(&tmpq, skb);
 	}
+
+	spin_lock_bh(&inputq->lock);
+	skb_queue_splice_tail(&tmpq, inputq);
+	spin_unlock_bh(&inputq->lock);
+
 }
 
 void tipc_link_reset(struct tipc_link *l)
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 493/639] ARM: dts: stm32: add missing vdda-supply to adc on stm32h743i-eval
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (491 preceding siblings ...)
  2020-01-24  9:31 ` [PATCH 4.19 492/639] tipc: reduce risk of wakeup queue starvation Greg Kroah-Hartman
@ 2020-01-24  9:31 ` Greg Kroah-Hartman
  2020-01-24  9:31 ` [PATCH 4.19 494/639] net/mlx5: Fix mlx5_ifc_query_lag_out_bits Greg Kroah-Hartman
                   ` (149 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Fabrice Gasnier, Alexandre Torgue,
	Sasha Levin

From: Fabrice Gasnier <fabrice.gasnier@st.com>

[ Upstream commit 493e84c5dc4d703d976b5875f5db22dae08a0782 ]

Add missing vdda-supply required by STM32 ADC.

Fixes: 090992a9ca54 ("ARM: dts: stm32: enable ADC on stm32h743i-eval
board")

Signed-off-by: Fabrice Gasnier <fabrice.gasnier@st.com>
Signed-off-by: Alexandre Torgue <alexandre.torgue@st.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/stm32h743i-eval.dts | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/arm/boot/dts/stm32h743i-eval.dts b/arch/arm/boot/dts/stm32h743i-eval.dts
index 3f8e0c4a998d0..5bf64e63cdf35 100644
--- a/arch/arm/boot/dts/stm32h743i-eval.dts
+++ b/arch/arm/boot/dts/stm32h743i-eval.dts
@@ -79,6 +79,7 @@
 };
 
 &adc_12 {
+	vdda-supply = <&vdda>;
 	vref-supply = <&vdda>;
 	status = "okay";
 	adc1: adc@0 {
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 494/639] net/mlx5: Fix mlx5_ifc_query_lag_out_bits
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (492 preceding siblings ...)
  2020-01-24  9:31 ` [PATCH 4.19 493/639] ARM: dts: stm32: add missing vdda-supply to adc on stm32h743i-eval Greg Kroah-Hartman
@ 2020-01-24  9:31 ` Greg Kroah-Hartman
  2020-01-24  9:31 ` [PATCH 4.19 495/639] cifs: fix rmmod regression in cifs.ko caused by force_sig changes Greg Kroah-Hartman
                   ` (148 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Mark Zhang, Yishai Hadas,
	Leon Romanovsky, Sasha Levin

From: Mark Zhang <markz@mellanox.com>

[ Upstream commit ea77388b02270b0af8dc57f668f311235ea068f0 ]

Remove the "reserved_at_40" field to match the device specification.

Fixes: 84df61ebc69b ("net/mlx5: Add HW interfaces used by LAG")
Signed-off-by: Mark Zhang <markz@mellanox.com>
Reviewed-by: Yishai Hadas <yishaih@mellanox.com>
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/mlx5/mlx5_ifc.h | 2 --
 1 file changed, 2 deletions(-)

diff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h
index 177f11c96187b..76b76b6aa83d0 100644
--- a/include/linux/mlx5/mlx5_ifc.h
+++ b/include/linux/mlx5/mlx5_ifc.h
@@ -9053,8 +9053,6 @@ struct mlx5_ifc_query_lag_out_bits {
 
 	u8         syndrome[0x20];
 
-	u8         reserved_at_40[0x40];
-
 	struct mlx5_ifc_lagc_bits ctx;
 };
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 495/639] cifs: fix rmmod regression in cifs.ko caused by force_sig changes
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (493 preceding siblings ...)
  2020-01-24  9:31 ` [PATCH 4.19 494/639] net/mlx5: Fix mlx5_ifc_query_lag_out_bits Greg Kroah-Hartman
@ 2020-01-24  9:31 ` Greg Kroah-Hartman
  2020-01-24  9:31 ` [PATCH 4.19 496/639] iio: tsl2772: Use devm_add_action_or_reset for tsl2772_chip_off Greg Kroah-Hartman
                   ` (147 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Steve French, Ronnie Sahlberg,
	Eric W. Biederman, Sasha Levin

From: Steve French <stfrench@microsoft.com>

[ Upstream commit 247bc9470b1eeefc7b58cdf2c39f2866ba651509 ]

Fixes: 72abe3bcf091 ("signal/cifs: Fix cifs_put_tcp_session to call send_sig instead of force_sig")

The global change from force_sig caused module unloading of cifs.ko
to fail (since the cifsd process could not be killed, "rmmod cifs"
now would always fail)

Signed-off-by: Steve French <stfrench@microsoft.com>
Reviewed-by: Ronnie Sahlberg <lsahlber@redhat.com>
CC: Eric W. Biederman <ebiederm@xmission.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/cifs/connect.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index a59dcda075343..a8790bf04e95d 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -970,6 +970,7 @@ cifs_demultiplex_thread(void *p)
 		mempool_resize(cifs_req_poolp, length + cifs_min_rcv);
 
 	set_freezable();
+	allow_signal(SIGKILL);
 	while (server->tcpStatus != CifsExiting) {
 		if (try_to_freeze())
 			continue;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 496/639] iio: tsl2772: Use devm_add_action_or_reset for tsl2772_chip_off
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (494 preceding siblings ...)
  2020-01-24  9:31 ` [PATCH 4.19 495/639] cifs: fix rmmod regression in cifs.ko caused by force_sig changes Greg Kroah-Hartman
@ 2020-01-24  9:31 ` Greg Kroah-Hartman
  2020-01-24  9:31 ` [PATCH 4.19 497/639] net: fix bpf_xdp_adjust_head regression for generic-XDP Greg Kroah-Hartman
                   ` (146 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chuhong Yuan, Brian Masney,
	Jonathan Cameron, Sasha Levin

From: Chuhong Yuan <hslester96@gmail.com>

[ Upstream commit 338084135aeddb103624a6841972fb8588295cc6 ]

Use devm_add_action_or_reset to call tsl2772_chip_off
when the device is removed.
This also fixes the issue that the chip is turned off
before the device is unregistered.

Not marked for stable as fairly hard to hit the bug and
this is in the middle of a set making other cleanups
to the driver.  Hence will probably need explicit backporting.

Signed-off-by: Chuhong Yuan <hslester96@gmail.com>
Fixes: c06c4d793584 ("staging: iio: tsl2x7x/tsl2772: move out of staging")
Reviewed-by: Brian Masney <masneyb@onstation.org>
Tested-by: Brian Masney <masneyb@onstation.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iio/light/tsl2772.c | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/drivers/iio/light/tsl2772.c b/drivers/iio/light/tsl2772.c
index df5b2a0da96c4..f2e308c6d6d7b 100644
--- a/drivers/iio/light/tsl2772.c
+++ b/drivers/iio/light/tsl2772.c
@@ -716,6 +716,13 @@ static int tsl2772_chip_off(struct iio_dev *indio_dev)
 	return tsl2772_write_control_reg(chip, 0x00);
 }
 
+static void tsl2772_chip_off_action(void *data)
+{
+	struct iio_dev *indio_dev = data;
+
+	tsl2772_chip_off(indio_dev);
+}
+
 /**
  * tsl2772_invoke_change - power cycle the device to implement the user
  *                         parameters
@@ -1711,9 +1718,14 @@ static int tsl2772_probe(struct i2c_client *clientp,
 	if (ret < 0)
 		return ret;
 
+	ret = devm_add_action_or_reset(&clientp->dev,
+					tsl2772_chip_off_action,
+					indio_dev);
+	if (ret < 0)
+		return ret;
+
 	ret = iio_device_register(indio_dev);
 	if (ret) {
-		tsl2772_chip_off(indio_dev);
 		dev_err(&clientp->dev,
 			"%s: iio registration failed\n", __func__);
 		return ret;
@@ -1740,8 +1752,6 @@ static int tsl2772_remove(struct i2c_client *client)
 {
 	struct iio_dev *indio_dev = i2c_get_clientdata(client);
 
-	tsl2772_chip_off(indio_dev);
-
 	iio_device_unregister(indio_dev);
 
 	return 0;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 497/639] net: fix bpf_xdp_adjust_head regression for generic-XDP
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (495 preceding siblings ...)
  2020-01-24  9:31 ` [PATCH 4.19 496/639] iio: tsl2772: Use devm_add_action_or_reset for tsl2772_chip_off Greg Kroah-Hartman
@ 2020-01-24  9:31 ` Greg Kroah-Hartman
  2020-01-24  9:31 ` [PATCH 4.19 498/639] spi: bcm-qspi: Fix BSPI QUAD and DUAL mode support when using flex mode Greg Kroah-Hartman
                   ` (145 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Brandon Cazander,
	Jesper Dangaard Brouer, David S. Miller, Sasha Levin

From: Jesper Dangaard Brouer <brouer@redhat.com>

[ Upstream commit 065af355470519bd184019a93ac579f22b036045 ]

When generic-XDP was moved to a later processing step by commit
458bf2f224f0 ("net: core: support XDP generic on stacked devices.")
a regression was introduced when using bpf_xdp_adjust_head.

The issue is that after this commit the skb->network_header is now
changed prior to calling generic XDP and not after. Thus, if the header
is changed by XDP (via bpf_xdp_adjust_head), then skb->network_header
also need to be updated again.  Fix by calling skb_reset_network_header().

Fixes: 458bf2f224f0 ("net: core: support XDP generic on stacked devices.")
Reported-by: Brandon Cazander <brandon.cazander@multapplied.net>
Signed-off-by: Jesper Dangaard Brouer <brouer@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/core/dev.c | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/net/core/dev.c b/net/core/dev.c
index 935fe158cfaff..73ebacabfde8d 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -4349,12 +4349,17 @@ static u32 netif_receive_generic_xdp(struct sk_buff *skb,
 
 	act = bpf_prog_run_xdp(xdp_prog, xdp);
 
+	/* check if bpf_xdp_adjust_head was used */
 	off = xdp->data - orig_data;
-	if (off > 0)
-		__skb_pull(skb, off);
-	else if (off < 0)
-		__skb_push(skb, -off);
-	skb->mac_header += off;
+	if (off) {
+		if (off > 0)
+			__skb_pull(skb, off);
+		else if (off < 0)
+			__skb_push(skb, -off);
+
+		skb->mac_header += off;
+		skb_reset_network_header(skb);
+	}
 
 	/* check if bpf_xdp_adjust_tail was used. it can only "shrink"
 	 * pckt.
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 498/639] spi: bcm-qspi: Fix BSPI QUAD and DUAL mode support when using flex mode
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (496 preceding siblings ...)
  2020-01-24  9:31 ` [PATCH 4.19 497/639] net: fix bpf_xdp_adjust_head regression for generic-XDP Greg Kroah-Hartman
@ 2020-01-24  9:31 ` Greg Kroah-Hartman
  2020-01-24  9:31 ` [PATCH 4.19 499/639] cxgb4: smt: Add lock for atomic_dec_and_test Greg Kroah-Hartman
                   ` (144 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Rayagonda Kokatanur, Mark Brown, Sasha Levin

From: Rayagonda Kokatanur <rayagonda.kokatanur@broadcom.com>

[ Upstream commit 79629d0f7ce5b38515c1716911a0181f01b91102 ]

Fix data transfer width settings based on DT field 'spi-rx-bus-width'
to configure BSPI in single, dual or quad mode by using data width
and not the command width.

Fixes: 5f195ee7d830c ("spi: bcm-qspi: Implement the spi_mem interface")

Signed-off-by: Rayagonda Kokatanur <rayagonda.kokatanur@broadcom.com>
Link: https://lore.kernel.org/r/1565086070-28451-1-git-send-email-rayagonda.kokatanur@broadcom.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-bcm-qspi.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/spi/spi-bcm-qspi.c b/drivers/spi/spi-bcm-qspi.c
index 584bcb018a62d..285a6f463013b 100644
--- a/drivers/spi/spi-bcm-qspi.c
+++ b/drivers/spi/spi-bcm-qspi.c
@@ -354,7 +354,7 @@ static int bcm_qspi_bspi_set_flex_mode(struct bcm_qspi *qspi,
 {
 	int bpc = 0, bpp = 0;
 	u8 command = op->cmd.opcode;
-	int width  = op->cmd.buswidth ? op->cmd.buswidth : SPI_NBITS_SINGLE;
+	int width = op->data.buswidth ? op->data.buswidth : SPI_NBITS_SINGLE;
 	int addrlen = op->addr.nbytes;
 	int flex_mode = 1;
 
@@ -992,7 +992,7 @@ static int bcm_qspi_exec_mem_op(struct spi_mem *mem,
 	if (mspi_read)
 		return bcm_qspi_mspi_exec_mem_op(spi, op);
 
-	ret = bcm_qspi_bspi_set_mode(qspi, op, -1);
+	ret = bcm_qspi_bspi_set_mode(qspi, op, 0);
 
 	if (!ret)
 		ret = bcm_qspi_bspi_exec_mem_op(spi, op);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 499/639] cxgb4: smt: Add lock for atomic_dec_and_test
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (497 preceding siblings ...)
  2020-01-24  9:31 ` [PATCH 4.19 498/639] spi: bcm-qspi: Fix BSPI QUAD and DUAL mode support when using flex mode Greg Kroah-Hartman
@ 2020-01-24  9:31 ` Greg Kroah-Hartman
  2020-01-24  9:31 ` [PATCH 4.19 500/639] crypto: caam - free resources in case caam_rng registration failed Greg Kroah-Hartman
                   ` (143 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chuhong Yuan, David S. Miller, Sasha Levin

From: Chuhong Yuan <hslester96@gmail.com>

[ Upstream commit 4a8937b83892cb69524291cae6cdabad4a8be033 ]

The atomic_dec_and_test() is not safe because it is
outside of locks.
Move the locks of t4_smte_free() to its caller,
cxgb4_smt_release() to protect the atomic decrement.

Fixes: 3bdb376e6944 ("cxgb4: introduce SMT ops to prepare for SMAC rewrite support")
Signed-off-by: Chuhong Yuan <hslester96@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/chelsio/cxgb4/smt.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/chelsio/cxgb4/smt.c b/drivers/net/ethernet/chelsio/cxgb4/smt.c
index 7b2207a2a130f..9b3f4205cb4d4 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/smt.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/smt.c
@@ -98,11 +98,9 @@ found_reuse:
 
 static void t4_smte_free(struct smt_entry *e)
 {
-	spin_lock_bh(&e->lock);
 	if (atomic_read(&e->refcnt) == 0) {  /* hasn't been recycled */
 		e->state = SMT_STATE_UNUSED;
 	}
-	spin_unlock_bh(&e->lock);
 }
 
 /**
@@ -112,8 +110,10 @@ static void t4_smte_free(struct smt_entry *e)
  */
 void cxgb4_smt_release(struct smt_entry *e)
 {
+	spin_lock_bh(&e->lock);
 	if (atomic_dec_and_test(&e->refcnt))
 		t4_smte_free(e);
+	spin_unlock_bh(&e->lock);
 }
 EXPORT_SYMBOL(cxgb4_smt_release);
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 500/639] crypto: caam - free resources in case caam_rng registration failed
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (498 preceding siblings ...)
  2020-01-24  9:31 ` [PATCH 4.19 499/639] cxgb4: smt: Add lock for atomic_dec_and_test Greg Kroah-Hartman
@ 2020-01-24  9:31 ` Greg Kroah-Hartman
  2020-01-24  9:31 ` [PATCH 4.19 501/639] ext4: set error return correctly when ext4_htree_store_dirent fails Greg Kroah-Hartman
                   ` (142 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Iuliana Prodan, Horia Geanta,
	Herbert Xu, Sasha Levin

From: Iuliana Prodan <iuliana.prodan@nxp.com>

[ Upstream commit c59a1d41672a89b5cac49db1a472ff889e35a2d2 ]

Check the return value of the hardware registration for caam_rng and free
resources in case of failure.

Fixes: e24f7c9e87d4 ("crypto: caam - hwrng support")
Signed-off-by: Iuliana Prodan <iuliana.prodan@nxp.com>
Reviewed-by: Horia Geanta <horia.geanta@nxp.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/caam/caamrng.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/crypto/caam/caamrng.c b/drivers/crypto/caam/caamrng.c
index fde07d4ff0190..ff6718a11e9ec 100644
--- a/drivers/crypto/caam/caamrng.c
+++ b/drivers/crypto/caam/caamrng.c
@@ -353,7 +353,10 @@ static int __init caam_rng_init(void)
 		goto free_rng_ctx;
 
 	dev_info(dev, "registering rng-caam\n");
-	return hwrng_register(&caam_rng);
+
+	err = hwrng_register(&caam_rng);
+	if (!err)
+		return err;
 
 free_rng_ctx:
 	kfree(rng_ctx);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 501/639] ext4: set error return correctly when ext4_htree_store_dirent fails
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (499 preceding siblings ...)
  2020-01-24  9:31 ` [PATCH 4.19 500/639] crypto: caam - free resources in case caam_rng registration failed Greg Kroah-Hartman
@ 2020-01-24  9:31 ` Greg Kroah-Hartman
  2020-01-24  9:31 ` [PATCH 4.19 502/639] RDMA/hns: Bugfix for slab-out-of-bounds when unloading hip08 driver Greg Kroah-Hartman
                   ` (141 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Colin Ian King, Theodore Tso, Sasha Levin

From: Colin Ian King <colin.king@canonical.com>

[ Upstream commit 7a14826ede1d714f0bb56de8167c0e519041eeda ]

Currently when the call to ext4_htree_store_dirent fails the error return
variable 'ret' is is not being set to the error code and variable count is
instead, hence the error code is not being returned.  Fix this by assigning
ret to the error return code.

Addresses-Coverity: ("Unused value")
Fixes: 8af0f0822797 ("ext4: fix readdir error in the case of inline_data+dir_index")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ext4/inline.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c
index 56f6e1782d5f7..4572cb0579518 100644
--- a/fs/ext4/inline.c
+++ b/fs/ext4/inline.c
@@ -1419,7 +1419,7 @@ int htree_inlinedir_to_tree(struct file *dir_file,
 		err = ext4_htree_store_dirent(dir_file, hinfo->hash,
 					      hinfo->minor_hash, de, &tmp_str);
 		if (err) {
-			count = err;
+			ret = err;
 			goto out;
 		}
 		count++;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 502/639] RDMA/hns: Bugfix for slab-out-of-bounds when unloading hip08 driver
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (500 preceding siblings ...)
  2020-01-24  9:31 ` [PATCH 4.19 501/639] ext4: set error return correctly when ext4_htree_store_dirent fails Greg Kroah-Hartman
@ 2020-01-24  9:31 ` Greg Kroah-Hartman
  2020-01-24  9:31 ` [PATCH 4.19 503/639] RDMA/hns: bugfix for slab-out-of-bounds when loading " Greg Kroah-Hartman
                   ` (140 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Xi Wang, Doug Ledford, Sasha Levin

From: Xi Wang <wangxi11@huawei.com>

[ Upstream commit 9bba3f0cbfc8abf2e1549ea03c0128186081d7a8 ]

kasan will report a BUG when run command 'rmmod hns_roce_hw_v2', the calltrace
is as follows:

==================================================================
BUG: KASAN: slab-out-of-bounds in hns_roce_table_mhop_put+0x584/0x828
[hns_roce]
Read of size 8 at addr ffff802185e08300 by task rmmod/270

Call trace:
dump_backtrace+0x0/0x1e8
show_stack+0x14/0x20
dump_stack+0xc4/0xfc
print_address_description+0x60/0x270
__kasan_report+0x164/0x1b8
kasan_report+0xc/0x18
__asan_load8+0x84/0xa8
hns_roce_table_mhop_put+0x584/0x828 [hns_roce]
hns_roce_table_put+0x174/0x1a0 [hns_roce]
hns_roce_mr_free+0x124/0x210 [hns_roce]
hns_roce_dereg_mr+0x90/0xb8 [hns_roce]
ib_dealloc_pd_user+0x60/0xf0
ib_mad_port_close+0x128/0x1d8
ib_mad_remove_device+0x94/0x118
remove_client_context+0xa0/0xe0
disable_device+0xfc/0x1c0
__ib_unregister_device+0x60/0xe0
ib_unregister_device+0x24/0x38
hns_roce_exit+0x3c/0x138 [hns_roce]
__hns_roce_hw_v2_uninit_instance.isra.30+0x28/0x50 [hns_roce_hw_v2]
hns_roce_hw_v2_uninit_instance+0x44/0x60 [hns_roce_hw_v2]
hclge_uninit_client_instance+0x15c/0x238 [hclge]
hnae3_uninit_client_instance+0x84/0xa8 [hnae3]
hnae3_unregister_client+0x84/0x158 [hnae3]
hns_roce_hw_v2_exit+0x14/0x20 [hns_roce_hw_v2]
__arm64_sys_delete_module+0x20c/0x308
el0_svc_handler+0xbc/0x210
el0_svc+0x8/0xc

Allocated by task 255:
__kasan_kmalloc.isra.0+0xd0/0x180
kasan_kmalloc+0xc/0x18
__kmalloc+0x16c/0x328
hns_roce_init_hem_table+0x20c/0x428 [hns_roce]
hns_roce_init+0x214/0xfe0 [hns_roce]
__hns_roce_hw_v2_init_instance+0x284/0x330 [hns_roce_hw_v2]
hns_roce_hw_v2_init_instance+0xd0/0x1b8 [hns_roce_hw_v2]
hclge_init_roce_client_instance+0x180/0x310 [hclge]
hclge_init_client_instance+0xcc/0x508 [hclge]
hnae3_init_client_instance.part.3+0x3c/0x80 [hnae3]
hnae3_register_client+0x134/0x1a8 [hnae3]
0xffff200009c00014
do_one_initcall+0x9c/0x3e0
do_init_module+0xd4/0x2d8
load_module+0x3284/0x3690
__se_sys_init_module+0x274/0x308
__arm64_sys_init_module+0x40/0x50
el0_svc_handler+0xbc/0x210
el0_svc+0x8/0xc

Freed by task 0:
(stack is not available)

The buggy address belongs to the object at ffff802185e06300
which belongs to the cache kmalloc-8k of size 8192
The buggy address is located 0 bytes to the right of
8192-byte region [ffff802185e06300, ffff802185e08300)
The buggy address belongs to the page:
page:ffff7fe008617800 refcount:1 mapcount:0 mapping:ffff802340020e00 index:0x0
compound_mapcount: 0
flags: 0x5fffe00000010200(slab|head)
raw: 5fffe00000010200 dead000000000100 dead000000000200 ffff802340020e00
raw: 0000000000000000 00000000803e003e 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
ffff802185e08200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff802185e08280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff802185e08300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
^
ffff802185e08380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff802185e08400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
Disabling lock debugging due to kernel taint

Fixes: a25d13cbe816 ("RDMA/hns: Add the interfaces to support multi hop addressing for the contexts in hip08")

Signed-off-by: Xi Wang <wangxi11@huawei.com>
Link: https://lore.kernel.org/r/1565343666-73193-6-git-send-email-oulijun@huawei.com
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/hw/hns/hns_roce_hem.c | 19 +++++++++++++------
 1 file changed, 13 insertions(+), 6 deletions(-)

diff --git a/drivers/infiniband/hw/hns/hns_roce_hem.c b/drivers/infiniband/hw/hns/hns_roce_hem.c
index a73d388b70930..31b9b99f81cb7 100644
--- a/drivers/infiniband/hw/hns/hns_roce_hem.c
+++ b/drivers/infiniband/hw/hns/hns_roce_hem.c
@@ -54,12 +54,13 @@ bool hns_roce_check_whether_mhop(struct hns_roce_dev *hr_dev, u32 type)
 EXPORT_SYMBOL_GPL(hns_roce_check_whether_mhop);
 
 static bool hns_roce_check_hem_null(struct hns_roce_hem **hem, u64 start_idx,
-			    u32 bt_chunk_num)
+			    u32 bt_chunk_num, u64 hem_max_num)
 {
-	int i;
+	u64 check_max_num = start_idx + bt_chunk_num;
+	u64 i;
 
-	for (i = 0; i < bt_chunk_num; i++)
-		if (hem[start_idx + i])
+	for (i = start_idx; (i < check_max_num) && (i < hem_max_num); i++)
+		if (hem[i])
 			return false;
 
 	return true;
@@ -413,6 +414,12 @@ static int hns_roce_table_mhop_get(struct hns_roce_dev *hr_dev,
 		return -EINVAL;
 	}
 
+	if (unlikely(hem_idx >= table->num_hem)) {
+		dev_err(dev, "Table %d exceed hem limt idx = %llu,max = %lu!\n",
+			     table->type, hem_idx, table->num_hem);
+		return -EINVAL;
+	}
+
 	mutex_lock(&table->mutex);
 
 	if (table->hem[hem_idx]) {
@@ -649,7 +656,7 @@ static void hns_roce_table_mhop_put(struct hns_roce_dev *hr_dev,
 	if (check_whether_bt_num_2(table->type, hop_num)) {
 		start_idx = mhop.l0_idx * chunk_ba_num;
 		if (hns_roce_check_hem_null(table->hem, start_idx,
-					    chunk_ba_num)) {
+					    chunk_ba_num, table->num_hem)) {
 			if (table->type < HEM_TYPE_MTT &&
 			    hr_dev->hw->clear_hem(hr_dev, table, obj, 0))
 				dev_warn(dev, "Clear HEM base address failed.\n");
@@ -663,7 +670,7 @@ static void hns_roce_table_mhop_put(struct hns_roce_dev *hr_dev,
 		start_idx = mhop.l0_idx * chunk_ba_num * chunk_ba_num +
 			    mhop.l1_idx * chunk_ba_num;
 		if (hns_roce_check_hem_null(table->hem, start_idx,
-					    chunk_ba_num)) {
+					    chunk_ba_num, table->num_hem)) {
 			if (hr_dev->hw->clear_hem(hr_dev, table, obj, 1))
 				dev_warn(dev, "Clear HEM base address failed.\n");
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 503/639] RDMA/hns: bugfix for slab-out-of-bounds when loading hip08 driver
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (501 preceding siblings ...)
  2020-01-24  9:31 ` [PATCH 4.19 502/639] RDMA/hns: Bugfix for slab-out-of-bounds when unloading hip08 driver Greg Kroah-Hartman
@ 2020-01-24  9:31 ` Greg Kroah-Hartman
  2020-01-24  9:31 ` [PATCH 4.19 504/639] ASoC: es8328: Fix copy-paste error in es8328_right_line_controls Greg Kroah-Hartman
                   ` (139 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Xi Wang, Doug Ledford, Sasha Levin

From: Xi Wang <wangxi11@huawei.com>

[ Upstream commit bf8c02f961c89e5ccae5987b7ab28f5592a35101 ]

kasan will report a BUG when run command 'insmod hns_roce_hw_v2.ko', the
calltrace is as follows:

==================================================================
BUG: KASAN: slab-out-of-bounds in hns_roce_v2_init_eq_table+0x1324/0x1948
[hns_roce_hw_v2]
Read of size 8 at addr ffff8020e7a10608 by task insmod/256

CPU: 0 PID: 256 Comm: insmod Tainted: G           O      5.2.0-rc4 #1
Hardware name: Huawei D06 /D06, BIOS Hisilicon D06 UEFI RC0
Call trace:
dump_backtrace+0x0/0x1e8
show_stack+0x14/0x20
dump_stack+0xc4/0xfc
print_address_description+0x60/0x270
__kasan_report+0x164/0x1b8
kasan_report+0xc/0x18
__asan_load8+0x84/0xa8
hns_roce_v2_init_eq_table+0x1324/0x1948 [hns_roce_hw_v2]
hns_roce_init+0xf8/0xfe0 [hns_roce]
__hns_roce_hw_v2_init_instance+0x284/0x330 [hns_roce_hw_v2]
hns_roce_hw_v2_init_instance+0xd0/0x1b8 [hns_roce_hw_v2]
hclge_init_roce_client_instance+0x180/0x310 [hclge]
hclge_init_client_instance+0xcc/0x508 [hclge]
hnae3_init_client_instance.part.3+0x3c/0x80 [hnae3]
hnae3_register_client+0x134/0x1a8 [hnae3]
hns_roce_hw_v2_init+0x14/0x10000 [hns_roce_hw_v2]
do_one_initcall+0x9c/0x3e0
do_init_module+0xd4/0x2d8
load_module+0x3284/0x3690
__se_sys_init_module+0x274/0x308
__arm64_sys_init_module+0x40/0x50
el0_svc_handler+0xbc/0x210
el0_svc+0x8/0xc

Allocated by task 256:
__kasan_kmalloc.isra.0+0xd0/0x180
kasan_kmalloc+0xc/0x18
__kmalloc+0x16c/0x328
hns_roce_v2_init_eq_table+0x764/0x1948 [hns_roce_hw_v2]
hns_roce_init+0xf8/0xfe0 [hns_roce]
__hns_roce_hw_v2_init_instance+0x284/0x330 [hns_roce_hw_v2]
hns_roce_hw_v2_init_instance+0xd0/0x1b8 [hns_roce_hw_v2]
hclge_init_roce_client_instance+0x180/0x310 [hclge]
hclge_init_client_instance+0xcc/0x508 [hclge]
hnae3_init_client_instance.part.3+0x3c/0x80 [hnae3]
hnae3_register_client+0x134/0x1a8 [hnae3]
hns_roce_hw_v2_init+0x14/0x10000 [hns_roce_hw_v2]
do_one_initcall+0x9c/0x3e0
do_init_module+0xd4/0x2d8
load_module+0x3284/0x3690
__se_sys_init_module+0x274/0x308
__arm64_sys_init_module+0x40/0x50
el0_svc_handler+0xbc/0x210
el0_svc+0x8/0xc

Freed by task 0:
(stack is not available)

The buggy address belongs to the object at ffff8020e7a10600
which belongs to the cache kmalloc-128 of size 128
The buggy address is located 8 bytes inside of
128-byte region [ffff8020e7a10600, ffff8020e7a10680)
The buggy address belongs to the page:
page:ffff7fe00839e840 refcount:1 mapcount:0 mapping:ffff802340020200 index:0x0
flags: 0x5fffe00000000200(slab)
raw: 5fffe00000000200 dead000000000100 dead000000000200 ffff802340020200
raw: 0000000000000000 0000000081000100 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
ffff8020e7a10500: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc
ffff8020e7a10580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff8020e7a10600: 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
^
ffff8020e7a10680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff8020e7a10700: 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
Disabling lock debugging due to kernel taint

Fixes: a5073d6054f7 ("RDMA/hns: Add eq support of hip08")

Signed-off-by: Xi Wang <wangxi11@huawei.com>
Link: https://lore.kernel.org/r/1565343666-73193-7-git-send-email-oulijun@huawei.com
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
index 7021444f18b46..417de7ac0d5e2 100644
--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
@@ -4833,7 +4833,8 @@ static int hns_roce_mhop_alloc_eq(struct hns_roce_dev *hr_dev,
 				break;
 		}
 		eq->cur_eqe_ba = eq->buf_dma[0];
-		eq->nxt_eqe_ba = eq->buf_dma[1];
+		if (ba_num > 1)
+			eq->nxt_eqe_ba = eq->buf_dma[1];
 
 	} else if (mhop_num == 2) {
 		/* alloc L1 BT and buf */
@@ -4875,7 +4876,8 @@ static int hns_roce_mhop_alloc_eq(struct hns_roce_dev *hr_dev,
 				break;
 		}
 		eq->cur_eqe_ba = eq->buf_dma[0];
-		eq->nxt_eqe_ba = eq->buf_dma[1];
+		if (ba_num > 1)
+			eq->nxt_eqe_ba = eq->buf_dma[1];
 	}
 
 	eq->l0_last_num = i + 1;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 504/639] ASoC: es8328: Fix copy-paste error in es8328_right_line_controls
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (502 preceding siblings ...)
  2020-01-24  9:31 ` [PATCH 4.19 503/639] RDMA/hns: bugfix for slab-out-of-bounds when loading " Greg Kroah-Hartman
@ 2020-01-24  9:31 ` Greg Kroah-Hartman
  2020-01-24  9:31 ` [PATCH 4.19 505/639] ASoC: cs4349: Use PM ops cs4349_runtime_pm Greg Kroah-Hartman
                   ` (138 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, YueHaibing, Mark Brown, Sasha Levin

From: YueHaibing <yuehaibing@huawei.com>

[ Upstream commit 630742c296341a8cfe00dfd941392025ba8dd4e8 ]

It seems 'es8328_rline_enum' should be used
in es8328_right_line_controls

Fixes: 567e4f98922c ("ASoC: add es8328 codec driver")
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Link: https://lore.kernel.org/r/20190815092300.68712-1-yuehaibing@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/codecs/es8328.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sound/soc/codecs/es8328.c b/sound/soc/codecs/es8328.c
index e9fc2fd97d2f4..3afa163f7652d 100644
--- a/sound/soc/codecs/es8328.c
+++ b/sound/soc/codecs/es8328.c
@@ -231,7 +231,7 @@ static const struct soc_enum es8328_rline_enum =
 			      ARRAY_SIZE(es8328_line_texts),
 			      es8328_line_texts);
 static const struct snd_kcontrol_new es8328_right_line_controls =
-	SOC_DAPM_ENUM("Route", es8328_lline_enum);
+	SOC_DAPM_ENUM("Route", es8328_rline_enum);
 
 /* Left Mixer */
 static const struct snd_kcontrol_new es8328_left_mixer_controls[] = {
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 505/639] ASoC: cs4349: Use PM ops cs4349_runtime_pm
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (503 preceding siblings ...)
  2020-01-24  9:31 ` [PATCH 4.19 504/639] ASoC: es8328: Fix copy-paste error in es8328_right_line_controls Greg Kroah-Hartman
@ 2020-01-24  9:31 ` Greg Kroah-Hartman
  2020-01-24  9:31 ` [PATCH 4.19 506/639] ASoC: wm8737: Fix copy-paste error in wm8737_snd_controls Greg Kroah-Hartman
                   ` (137 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, YueHaibing, Mark Brown,
	Sasha Levin

From: YueHaibing <yuehaibing@huawei.com>

[ Upstream commit 9b4275c415acca6264a3d7f1182589959c93d530 ]

sound/soc/codecs/cs4349.c:358:32: warning:
 cs4349_runtime_pm defined but not used [-Wunused-const-variable=]

cs4349_runtime_pm ops already defined, it seems
we should enable it.

Reported-by: Hulk Robot <hulkci@huawei.com>
Fixes: e40da86 ("ASoC: cs4349: Add support for Cirrus Logic CS4349")
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Link: https://lore.kernel.org/r/20190815090157.70036-1-yuehaibing@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/codecs/cs4349.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sound/soc/codecs/cs4349.c b/sound/soc/codecs/cs4349.c
index bee0e343723fe..f08d7a296c0cc 100644
--- a/sound/soc/codecs/cs4349.c
+++ b/sound/soc/codecs/cs4349.c
@@ -381,6 +381,7 @@ static struct i2c_driver cs4349_i2c_driver = {
 	.driver = {
 		.name		= "cs4349",
 		.of_match_table	= cs4349_of_match,
+		.pm = &cs4349_runtime_pm,
 	},
 	.id_table	= cs4349_i2c_id,
 	.probe		= cs4349_i2c_probe,
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 506/639] ASoC: wm8737: Fix copy-paste error in wm8737_snd_controls
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (504 preceding siblings ...)
  2020-01-24  9:31 ` [PATCH 4.19 505/639] ASoC: cs4349: Use PM ops cs4349_runtime_pm Greg Kroah-Hartman
@ 2020-01-24  9:31 ` Greg Kroah-Hartman
  2020-01-24  9:31 ` [PATCH 4.19 507/639] net/rds: Add a few missing rds_stat_names entries Greg Kroah-Hartman
                   ` (136 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, YueHaibing,
	Charles Keepax, Mark Brown, Sasha Levin

From: YueHaibing <yuehaibing@huawei.com>

[ Upstream commit 554b75bde64bcad9662530726d1483f7ef012069 ]

sound/soc/codecs/wm8737.c:112:29: warning:
 high_3d defined but not used [-Wunused-const-variable=]

'high_3d' should be used for 3D High Cut-off.

Reported-by: Hulk Robot <hulkci@huawei.com>
Fixes: 2a9ae13a2641 ("ASoC: Add initial WM8737 driver")
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Link: https://lore.kernel.org/r/20190815091920.64480-1-yuehaibing@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/codecs/wm8737.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sound/soc/codecs/wm8737.c b/sound/soc/codecs/wm8737.c
index e9ae821e76098..568b77692f5f0 100644
--- a/sound/soc/codecs/wm8737.c
+++ b/sound/soc/codecs/wm8737.c
@@ -170,7 +170,7 @@ SOC_DOUBLE("Polarity Invert Switch", WM8737_ADC_CONTROL, 5, 6, 1, 0),
 SOC_SINGLE("3D Switch", WM8737_3D_ENHANCE, 0, 1, 0),
 SOC_SINGLE("3D Depth", WM8737_3D_ENHANCE, 1, 15, 0),
 SOC_ENUM("3D Low Cut-off", low_3d),
-SOC_ENUM("3D High Cut-off", low_3d),
+SOC_ENUM("3D High Cut-off", high_3d),
 SOC_SINGLE_TLV("3D ADC Volume", WM8737_3D_ENHANCE, 7, 1, 1, adc_tlv),
 
 SOC_SINGLE("Noise Gate Switch", WM8737_NOISE_GATE, 0, 1, 0),
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 507/639] net/rds: Add a few missing rds_stat_names entries
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (505 preceding siblings ...)
  2020-01-24  9:31 ` [PATCH 4.19 506/639] ASoC: wm8737: Fix copy-paste error in wm8737_snd_controls Greg Kroah-Hartman
@ 2020-01-24  9:31 ` Greg Kroah-Hartman
  2020-01-24  9:31 ` [PATCH 4.19 508/639] tools: bpftool: fix arguments for p_err() in do_event_pipe() Greg Kroah-Hartman
                   ` (135 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Gerd Rausch, Santosh Shilimkar,
	David S. Miller, Sasha Levin

From: Gerd Rausch <gerd.rausch@oracle.com>

[ Upstream commit 55c70ca00c982fbc0df4c4d3e31747fb73f4ddb5 ]

In a previous commit, fields were added to "struct rds_statistics"
but array "rds_stat_names" was not updated accordingly.

Please note the inconsistent naming of the string representations
that is done in the name of compatibility
with the Oracle internal code-base.

s_recv_bytes_added_to_socket     -> "recv_bytes_added_to_sock"
s_recv_bytes_removed_from_socket -> "recv_bytes_freed_fromsock"

Fixes: 192a798f5299 ("RDS: add stat for socket recv memory usage")
Signed-off-by: Gerd Rausch <gerd.rausch@oracle.com>
Acked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/rds/stats.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/rds/stats.c b/net/rds/stats.c
index 73be187d389ed..6bbab4d74c4fe 100644
--- a/net/rds/stats.c
+++ b/net/rds/stats.c
@@ -76,6 +76,8 @@ static const char *const rds_stat_names[] = {
 	"cong_update_received",
 	"cong_send_error",
 	"cong_send_blocked",
+	"recv_bytes_added_to_sock",
+	"recv_bytes_freed_fromsock",
 };
 
 void rds_stats_info_copy(struct rds_info_iterator *iter,
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 508/639] tools: bpftool: fix arguments for p_err() in do_event_pipe()
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (506 preceding siblings ...)
  2020-01-24  9:31 ` [PATCH 4.19 507/639] net/rds: Add a few missing rds_stat_names entries Greg Kroah-Hartman
@ 2020-01-24  9:31 ` Greg Kroah-Hartman
  2020-01-24  9:31 ` [PATCH 4.19 509/639] tools: bpftool: fix format strings and arguments for jsonw_printf() Greg Kroah-Hartman
                   ` (134 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Quentin Monnet, Jakub Kicinski,
	Alexei Starovoitov, Sasha Levin

From: Quentin Monnet <quentin.monnet@netronome.com>

[ Upstream commit 9def249dc8409ffc1f5a1d7195f1c462f2b49c07 ]

The last argument passed to some calls to the p_err() functions is not
correct, it should be "*argv" instead of "**argv". This may lead to a
segmentation fault error if CPU IDs or indices from the command line
cannot be parsed correctly. Let's fix this.

Fixes: f412eed9dfde ("tools: bpftool: add simple perf event output reader")
Signed-off-by: Quentin Monnet <quentin.monnet@netronome.com>
Reviewed-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/bpf/bpftool/map_perf_ring.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tools/bpf/bpftool/map_perf_ring.c b/tools/bpf/bpftool/map_perf_ring.c
index 6d41323be291b..8ec0148d7426d 100644
--- a/tools/bpf/bpftool/map_perf_ring.c
+++ b/tools/bpf/bpftool/map_perf_ring.c
@@ -205,7 +205,7 @@ int do_event_pipe(int argc, char **argv)
 			NEXT_ARG();
 			cpu = strtoul(*argv, &endptr, 0);
 			if (*endptr) {
-				p_err("can't parse %s as CPU ID", **argv);
+				p_err("can't parse %s as CPU ID", *argv);
 				goto err_close_map;
 			}
 
@@ -216,7 +216,7 @@ int do_event_pipe(int argc, char **argv)
 			NEXT_ARG();
 			index = strtoul(*argv, &endptr, 0);
 			if (*endptr) {
-				p_err("can't parse %s as index", **argv);
+				p_err("can't parse %s as index", *argv);
 				goto err_close_map;
 			}
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 509/639] tools: bpftool: fix format strings and arguments for jsonw_printf()
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (507 preceding siblings ...)
  2020-01-24  9:31 ` [PATCH 4.19 508/639] tools: bpftool: fix arguments for p_err() in do_event_pipe() Greg Kroah-Hartman
@ 2020-01-24  9:31 ` Greg Kroah-Hartman
  2020-01-24  9:31 ` [PATCH 4.19 510/639] drm: rcar-du: lvds: Fix bridge_to_rcar_lvds Greg Kroah-Hartman
                   ` (133 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Quentin Monnet, Jakub Kicinski,
	Alexei Starovoitov, Sasha Levin

From: Quentin Monnet <quentin.monnet@netronome.com>

[ Upstream commit 22c349e8db89df86804d3ba23cef037ccd44a8bf ]

There are some mismatches between format strings and arguments passed to
jsonw_printf() in the BTF dumper for bpftool, which seems harmless but
may result in warnings if the "__printf()" attribute is used correctly
for jsonw_printf(). Let's fix relevant format strings and type cast.

Fixes: b12d6ec09730 ("bpf: btf: add btf print functionality")
Signed-off-by: Quentin Monnet <quentin.monnet@netronome.com>
Reviewed-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/bpf/bpftool/btf_dumper.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/tools/bpf/bpftool/btf_dumper.c b/tools/bpf/bpftool/btf_dumper.c
index e4e6e2b3fd847..ff0cc3c171411 100644
--- a/tools/bpf/bpftool/btf_dumper.c
+++ b/tools/bpf/bpftool/btf_dumper.c
@@ -26,9 +26,9 @@ static void btf_dumper_ptr(const void *data, json_writer_t *jw,
 			   bool is_plain_text)
 {
 	if (is_plain_text)
-		jsonw_printf(jw, "%p", *(unsigned long *)data);
+		jsonw_printf(jw, "%p", data);
 	else
-		jsonw_printf(jw, "%u", *(unsigned long *)data);
+		jsonw_printf(jw, "%lu", *(unsigned long *)data);
 }
 
 static int btf_dumper_modifier(const struct btf_dumper *d, __u32 type_id,
@@ -129,7 +129,7 @@ static int btf_dumper_int(const struct btf_type *t, __u8 bit_offset,
 	switch (BTF_INT_ENCODING(*int_type)) {
 	case 0:
 		if (BTF_INT_BITS(*int_type) == 64)
-			jsonw_printf(jw, "%lu", *(__u64 *)data);
+			jsonw_printf(jw, "%llu", *(__u64 *)data);
 		else if (BTF_INT_BITS(*int_type) == 32)
 			jsonw_printf(jw, "%u", *(__u32 *)data);
 		else if (BTF_INT_BITS(*int_type) == 16)
@@ -142,7 +142,7 @@ static int btf_dumper_int(const struct btf_type *t, __u8 bit_offset,
 		break;
 	case BTF_INT_SIGNED:
 		if (BTF_INT_BITS(*int_type) == 64)
-			jsonw_printf(jw, "%ld", *(long long *)data);
+			jsonw_printf(jw, "%lld", *(long long *)data);
 		else if (BTF_INT_BITS(*int_type) == 32)
 			jsonw_printf(jw, "%d", *(int *)data);
 		else if (BTF_INT_BITS(*int_type) == 16)
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 510/639] drm: rcar-du: lvds: Fix bridge_to_rcar_lvds
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (508 preceding siblings ...)
  2020-01-24  9:31 ` [PATCH 4.19 509/639] tools: bpftool: fix format strings and arguments for jsonw_printf() Greg Kroah-Hartman
@ 2020-01-24  9:31 ` Greg Kroah-Hartman
  2020-01-24  9:31 ` [PATCH 4.19 511/639] bnxt_en: Fix handling FRAG_ERR when NVM_INSTALL_UPDATE cmd fails Greg Kroah-Hartman
                   ` (132 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Fabrizio Castro, Laurent Pinchart,
	Sasha Levin

From: Fabrizio Castro <fabrizio.castro@bp.renesas.com>

[ Upstream commit 0b936e6122738f4cf474d1f3ff636cba0edc8b94 ]

Using name "bridge" for macro bridge_to_rcar_lvds argument doesn't
work when the pointer name used by the caller is not "bridge".
Rename the argument to "b" to allow for any pointer name.

While at it, fix the connector_to_rcar_lvds macro similarly.

Fixes: c6a27fa41fab ("drm: rcar-du: Convert LVDS encoder code to bridge driver")
Signed-off-by: Fabrizio Castro <fabrizio.castro@bp.renesas.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
[Fix connector_to_rcar_lvds]
Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/rcar-du/rcar_lvds.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/gpu/drm/rcar-du/rcar_lvds.c b/drivers/gpu/drm/rcar-du/rcar_lvds.c
index 4c39de3f4f0f3..b6dc91cdff68e 100644
--- a/drivers/gpu/drm/rcar-du/rcar_lvds.c
+++ b/drivers/gpu/drm/rcar-du/rcar_lvds.c
@@ -59,11 +59,11 @@ struct rcar_lvds {
 	enum rcar_lvds_mode mode;
 };
 
-#define bridge_to_rcar_lvds(bridge) \
-	container_of(bridge, struct rcar_lvds, bridge)
+#define bridge_to_rcar_lvds(b) \
+	container_of(b, struct rcar_lvds, bridge)
 
-#define connector_to_rcar_lvds(connector) \
-	container_of(connector, struct rcar_lvds, connector)
+#define connector_to_rcar_lvds(c) \
+	container_of(c, struct rcar_lvds, connector)
 
 static void rcar_lvds_write(struct rcar_lvds *lvds, u32 reg, u32 data)
 {
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 511/639] bnxt_en: Fix handling FRAG_ERR when NVM_INSTALL_UPDATE cmd fails
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (509 preceding siblings ...)
  2020-01-24  9:31 ` [PATCH 4.19 510/639] drm: rcar-du: lvds: Fix bridge_to_rcar_lvds Greg Kroah-Hartman
@ 2020-01-24  9:31 ` Greg Kroah-Hartman
  2020-01-24  9:31 ` [PATCH 4.19 512/639] signal: Allow cifs and drbd to receive their terminating signals Greg Kroah-Hartman
                   ` (131 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Vasundhara Volam, Michael Chan,
	David S. Miller, Sasha Levin

From: Vasundhara Volam <vasundhara-v.volam@broadcom.com>

[ Upstream commit dd2ebf3404c7c295014bc025dea23960960ceb1a ]

If FW returns FRAG_ERR in response error code, driver is resending the
command only when HWRM command returns success. Fix the code to resend
NVM_INSTALL_UPDATE command with DEFRAG install flags, if FW returns
FRAG_ERR in its response error code.

Fixes: cb4d1d626145 ("bnxt_en: Retry failed NVM_INSTALL_UPDATE with defragmentation flag enabled.")
Signed-off-by: Vasundhara Volam <vasundhara-v.volam@broadcom.com>
Signed-off-by: Michael Chan <michael.chan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
index dc63d269f01dc..cdbb8940a4ae5 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
@@ -1778,21 +1778,19 @@ static int bnxt_flash_package_from_file(struct net_device *dev,
 	mutex_lock(&bp->hwrm_cmd_lock);
 	hwrm_err = _hwrm_send_message(bp, &install, sizeof(install),
 				      INSTALL_PACKAGE_TIMEOUT);
-	if (hwrm_err)
-		goto flash_pkg_exit;
-
-	if (resp->error_code) {
+	if (hwrm_err) {
 		u8 error_code = ((struct hwrm_err_output *)resp)->cmd_err;
 
-		if (error_code == NVM_INSTALL_UPDATE_CMD_ERR_CODE_FRAG_ERR) {
+		if (resp->error_code && error_code ==
+		    NVM_INSTALL_UPDATE_CMD_ERR_CODE_FRAG_ERR) {
 			install.flags |= cpu_to_le16(
 			       NVM_INSTALL_UPDATE_REQ_FLAGS_ALLOWED_TO_DEFRAG);
 			hwrm_err = _hwrm_send_message(bp, &install,
 						      sizeof(install),
 						      INSTALL_PACKAGE_TIMEOUT);
-			if (hwrm_err)
-				goto flash_pkg_exit;
 		}
+		if (hwrm_err)
+			goto flash_pkg_exit;
 	}
 
 	if (resp->result) {
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 512/639] signal: Allow cifs and drbd to receive their terminating signals
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (510 preceding siblings ...)
  2020-01-24  9:31 ` [PATCH 4.19 511/639] bnxt_en: Fix handling FRAG_ERR when NVM_INSTALL_UPDATE cmd fails Greg Kroah-Hartman
@ 2020-01-24  9:31 ` Greg Kroah-Hartman
  2020-01-24  9:31 ` [PATCH 4.19 513/639] powerpc/64s/radix: Fix memory hot-unplug page table split Greg Kroah-Hartman
                   ` (130 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, ronnie sahlberg,
	Christoph Böhmwalder, Steve French, Philipp Reisner,
	David Laight, Eric W. Biederman, Sasha Levin

From: Eric W. Biederman <ebiederm@xmission.com>

[ Upstream commit 33da8e7c814f77310250bb54a9db36a44c5de784 ]

My recent to change to only use force_sig for a synchronous events
wound up breaking signal reception cifs and drbd.  I had overlooked
the fact that by default kthreads start out with all signals set to
SIG_IGN.  So a change I thought was safe turned out to have made it
impossible for those kernel thread to catch their signals.

Reverting the work on force_sig is a bad idea because what the code
was doing was very much a misuse of force_sig.  As the way force_sig
ultimately allowed the signal to happen was to change the signal
handler to SIG_DFL.  Which after the first signal will allow userspace
to send signals to these kernel threads.  At least for
wake_ack_receiver in drbd that does not appear actively wrong.

So correct this problem by adding allow_kernel_signal that will allow
signals whose siginfo reports they were sent by the kernel through,
but will not allow userspace generated signals, and update cifs and
drbd to call allow_kernel_signal in an appropriate place so that their
thread can receive this signal.

Fixing things this way ensures that userspace won't be able to send
signals and cause problems, that it is clear which signals the
threads are expecting to receive, and it guarantees that nothing
else in the system will be affected.

This change was partly inspired by similar cifs and drbd patches that
added allow_signal.

Reported-by: ronnie sahlberg <ronniesahlberg@gmail.com>
Reported-by: Christoph Böhmwalder <christoph.boehmwalder@linbit.com>
Tested-by: Christoph Böhmwalder <christoph.boehmwalder@linbit.com>
Cc: Steve French <smfrench@gmail.com>
Cc: Philipp Reisner <philipp.reisner@linbit.com>
Cc: David Laight <David.Laight@ACULAB.COM>
Fixes: 247bc9470b1e ("cifs: fix rmmod regression in cifs.ko caused by force_sig changes")
Fixes: 72abe3bcf091 ("signal/cifs: Fix cifs_put_tcp_session to call send_sig instead of force_sig")
Fixes: fee109901f39 ("signal/drbd: Use send_sig not force_sig")
Fixes: 3cf5d076fb4d ("signal: Remove task parameter from force_sig")
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/block/drbd/drbd_main.c |  2 ++
 fs/cifs/connect.c              |  2 +-
 include/linux/signal.h         | 15 ++++++++++++++-
 kernel/signal.c                |  5 +++++
 4 files changed, 22 insertions(+), 2 deletions(-)

diff --git a/drivers/block/drbd/drbd_main.c b/drivers/block/drbd/drbd_main.c
index a49a8d91a5990..5e3885f5729b0 100644
--- a/drivers/block/drbd/drbd_main.c
+++ b/drivers/block/drbd/drbd_main.c
@@ -334,6 +334,8 @@ static int drbd_thread_setup(void *arg)
 		 thi->name[0],
 		 resource->name);
 
+	allow_kernel_signal(DRBD_SIGKILL);
+	allow_kernel_signal(SIGXCPU);
 restart:
 	retval = thi->function(thi);
 
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index a8790bf04e95d..576cf71576da1 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -970,7 +970,7 @@ cifs_demultiplex_thread(void *p)
 		mempool_resize(cifs_req_poolp, length + cifs_min_rcv);
 
 	set_freezable();
-	allow_signal(SIGKILL);
+	allow_kernel_signal(SIGKILL);
 	while (server->tcpStatus != CifsExiting) {
 		if (try_to_freeze())
 			continue;
diff --git a/include/linux/signal.h b/include/linux/signal.h
index e4d01469ed60c..0be5ce2375cb9 100644
--- a/include/linux/signal.h
+++ b/include/linux/signal.h
@@ -272,6 +272,9 @@ extern void signal_setup_done(int failed, struct ksignal *ksig, int stepping);
 extern void exit_signals(struct task_struct *tsk);
 extern void kernel_sigaction(int, __sighandler_t);
 
+#define SIG_KTHREAD ((__force __sighandler_t)2)
+#define SIG_KTHREAD_KERNEL ((__force __sighandler_t)3)
+
 static inline void allow_signal(int sig)
 {
 	/*
@@ -279,7 +282,17 @@ static inline void allow_signal(int sig)
 	 * know it'll be handled, so that they don't get converted to
 	 * SIGKILL or just silently dropped.
 	 */
-	kernel_sigaction(sig, (__force __sighandler_t)2);
+	kernel_sigaction(sig, SIG_KTHREAD);
+}
+
+static inline void allow_kernel_signal(int sig)
+{
+	/*
+	 * Kernel threads handle their own signals. Let the signal code
+	 * know signals sent by the kernel will be handled, so that they
+	 * don't get silently dropped.
+	 */
+	kernel_sigaction(sig, SIG_KTHREAD_KERNEL);
 }
 
 static inline void disallow_signal(int sig)
diff --git a/kernel/signal.c b/kernel/signal.c
index 7278302e34850..08911bb6fe9ab 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -86,6 +86,11 @@ static bool sig_task_ignored(struct task_struct *t, int sig, bool force)
 	    handler == SIG_DFL && !(force && sig_kernel_only(sig)))
 		return true;
 
+	/* Only allow kernel generated signals to this kthread */
+	if (unlikely((t->flags & PF_KTHREAD) &&
+		     (handler == SIG_KTHREAD_KERNEL) && !force))
+		return true;
+
 	return sig_handler_ignored(handler, sig);
 }
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 513/639] powerpc/64s/radix: Fix memory hot-unplug page table split
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (511 preceding siblings ...)
  2020-01-24  9:31 ` [PATCH 4.19 512/639] signal: Allow cifs and drbd to receive their terminating signals Greg Kroah-Hartman
@ 2020-01-24  9:31 ` Greg Kroah-Hartman
  2020-01-24  9:31 ` [PATCH 4.19 514/639] ASoC: sun4i-i2s: RX and TX counter registers are swapped Greg Kroah-Hartman
                   ` (129 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Nicholas Piggin, Aneesh Kumar K.V,
	Michael Ellerman, Sasha Levin

From: Nicholas Piggin <npiggin@gmail.com>

[ Upstream commit 31f210cf42d4b308eacef89b6cb0b1459338b8de ]

create_physical_mapping expects physical addresses, but splitting
these mapping on hot unplug is supplying virtual (effective)
addresses.

Fixes: 4dd5f8a99e791 ("powerpc/mm/radix: Split linear mapping on hot-unplug")
Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20190724084638.24982-2-npiggin@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/mm/pgtable-radix.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/powerpc/mm/pgtable-radix.c b/arch/powerpc/mm/pgtable-radix.c
index 69caeb5bccb21..5404a631d5834 100644
--- a/arch/powerpc/mm/pgtable-radix.c
+++ b/arch/powerpc/mm/pgtable-radix.c
@@ -717,8 +717,8 @@ static int __meminit stop_machine_change_mapping(void *data)
 
 	spin_unlock(&init_mm.page_table_lock);
 	pte_clear(&init_mm, params->aligned_start, params->pte);
-	create_physical_mapping(params->aligned_start, params->start, -1);
-	create_physical_mapping(params->end, params->aligned_end, -1);
+	create_physical_mapping(__pa(params->aligned_start), __pa(params->start), -1);
+	create_physical_mapping(__pa(params->end), __pa(params->aligned_end), -1);
 	spin_lock(&init_mm.page_table_lock);
 	return 0;
 }
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 514/639] ASoC: sun4i-i2s: RX and TX counter registers are swapped
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (512 preceding siblings ...)
  2020-01-24  9:31 ` [PATCH 4.19 513/639] powerpc/64s/radix: Fix memory hot-unplug page table split Greg Kroah-Hartman
@ 2020-01-24  9:31 ` Greg Kroah-Hartman
  2020-01-24  9:31 ` [PATCH 4.19 515/639] dmaengine: dw: platform: Switch to acpi_dma_controller_register() Greg Kroah-Hartman
                   ` (128 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Maxime Ripard, Mark Brown, Sasha Levin

From: Maxime Ripard <maxime.ripard@bootlin.com>

[ Upstream commit cf2c0e1ce9544df42170fb921f12da82dc0cc8d6 ]

The RX and TX counters registers offset have been swapped, fix that.

Fixes: fa7c0d13cb26 ("ASoC: sunxi: Add Allwinner A10 Digital Audio driver")
Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
Link: https://lore.kernel.org/r/8b26477560ad5fd8f69e037b167c5e61de5c26a3.1566242458.git-series.maxime.ripard@bootlin.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/sunxi/sun4i-i2s.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/sound/soc/sunxi/sun4i-i2s.c b/sound/soc/sunxi/sun4i-i2s.c
index 18cf8404d27ca..f248e563986c3 100644
--- a/sound/soc/sunxi/sun4i-i2s.c
+++ b/sound/soc/sunxi/sun4i-i2s.c
@@ -80,8 +80,8 @@
 #define SUN4I_I2S_CLK_DIV_MCLK_MASK		GENMASK(3, 0)
 #define SUN4I_I2S_CLK_DIV_MCLK(mclk)			((mclk) << 0)
 
-#define SUN4I_I2S_RX_CNT_REG		0x28
-#define SUN4I_I2S_TX_CNT_REG		0x2c
+#define SUN4I_I2S_TX_CNT_REG		0x28
+#define SUN4I_I2S_RX_CNT_REG		0x2c
 
 #define SUN4I_I2S_TX_CHAN_SEL_REG	0x30
 #define SUN4I_I2S_CHAN_SEL(num_chan)		(((num_chan) - 1) << 0)
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 515/639] dmaengine: dw: platform: Switch to acpi_dma_controller_register()
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (513 preceding siblings ...)
  2020-01-24  9:31 ` [PATCH 4.19 514/639] ASoC: sun4i-i2s: RX and TX counter registers are swapped Greg Kroah-Hartman
@ 2020-01-24  9:31 ` Greg Kroah-Hartman
  2020-01-24  9:31 ` [PATCH 4.19 516/639] rtc: rv3029: revert error handling patch to rv3029_eeprom_write() Greg Kroah-Hartman
                   ` (127 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Andy Shevchenko, Vinod Koul, Sasha Levin

From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>

[ Upstream commit e7b8514e4d68bec21fc6385fa0a66797ddc34ac9 ]

There is a possibility to have registered ACPI DMA controller
while it has been gone already.

To avoid the potential crash, move to non-managed
acpi_dma_controller_register().

Fixes: 42c91ee71d6d ("dw_dmac: add ACPI support")
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://lore.kernel.org/r/20190820131546.75744-8-andriy.shevchenko@linux.intel.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/dma/dw/platform.c | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/drivers/dma/dw/platform.c b/drivers/dma/dw/platform.c
index c299ff181bb68..62218ea0894c9 100644
--- a/drivers/dma/dw/platform.c
+++ b/drivers/dma/dw/platform.c
@@ -87,13 +87,20 @@ static void dw_dma_acpi_controller_register(struct dw_dma *dw)
 	dma_cap_set(DMA_SLAVE, info->dma_cap);
 	info->filter_fn = dw_dma_acpi_filter;
 
-	ret = devm_acpi_dma_controller_register(dev, acpi_dma_simple_xlate,
-						info);
+	ret = acpi_dma_controller_register(dev, acpi_dma_simple_xlate, info);
 	if (ret)
 		dev_err(dev, "could not register acpi_dma_controller\n");
 }
+
+static void dw_dma_acpi_controller_free(struct dw_dma *dw)
+{
+	struct device *dev = dw->dma.dev;
+
+	acpi_dma_controller_free(dev);
+}
 #else /* !CONFIG_ACPI */
 static inline void dw_dma_acpi_controller_register(struct dw_dma *dw) {}
+static inline void dw_dma_acpi_controller_free(struct dw_dma *dw) {}
 #endif /* !CONFIG_ACPI */
 
 #ifdef CONFIG_OF
@@ -249,6 +256,9 @@ static int dw_remove(struct platform_device *pdev)
 {
 	struct dw_dma_chip *chip = platform_get_drvdata(pdev);
 
+	if (ACPI_HANDLE(&pdev->dev))
+		dw_dma_acpi_controller_free(chip->dw);
+
 	if (pdev->dev.of_node)
 		of_dma_controller_free(pdev->dev.of_node);
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 516/639] rtc: rv3029: revert error handling patch to rv3029_eeprom_write()
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (514 preceding siblings ...)
  2020-01-24  9:31 ` [PATCH 4.19 515/639] dmaengine: dw: platform: Switch to acpi_dma_controller_register() Greg Kroah-Hartman
@ 2020-01-24  9:31 ` Greg Kroah-Hartman
  2020-01-24  9:31 ` [PATCH 4.19 517/639] mac80211: minstrel_ht: fix per-group max throughput rate initialization Greg Kroah-Hartman
                   ` (126 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Tom Evans, Dan Carpenter,
	Alexandre Belloni, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit a6f26606ddd03c5eab8b2132f1bfaa768c06158f ]

My error handling "cleanup" was totally wrong.  Both the "err" and "ret"
variables are required.  The "err" variable holds the error codes for
rv3029_eeprom_enter/exit() and the "ret" variable holds the error codes
for if actual write fails.  In my patch if the write failed, the
function probably still returned success.

Reported-by: Tom Evans <tom.evans@motec.com.au>
Fixes: 97f5b0379c38 ("rtc: rv3029: Clean up error handling in rv3029_eeprom_write()")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/20190817065604.GB29951@mwanda
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/rtc/rtc-rv3029c2.c | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/drivers/rtc/rtc-rv3029c2.c b/drivers/rtc/rtc-rv3029c2.c
index 3d6174eb32f6a..cfe3aece51d17 100644
--- a/drivers/rtc/rtc-rv3029c2.c
+++ b/drivers/rtc/rtc-rv3029c2.c
@@ -282,13 +282,13 @@ static int rv3029_eeprom_read(struct device *dev, u8 reg,
 static int rv3029_eeprom_write(struct device *dev, u8 reg,
 			       u8 const buf[], size_t len)
 {
-	int ret;
+	int ret, err;
 	size_t i;
 	u8 tmp;
 
-	ret = rv3029_eeprom_enter(dev);
-	if (ret < 0)
-		return ret;
+	err = rv3029_eeprom_enter(dev);
+	if (err < 0)
+		return err;
 
 	for (i = 0; i < len; i++, reg++) {
 		ret = rv3029_read_regs(dev, reg, &tmp, 1);
@@ -304,11 +304,11 @@ static int rv3029_eeprom_write(struct device *dev, u8 reg,
 			break;
 	}
 
-	ret = rv3029_eeprom_exit(dev);
-	if (ret < 0)
-		return ret;
+	err = rv3029_eeprom_exit(dev);
+	if (err < 0)
+		return err;
 
-	return 0;
+	return ret;
 }
 
 static int rv3029_eeprom_update_bits(struct device *dev,
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 517/639] mac80211: minstrel_ht: fix per-group max throughput rate initialization
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (515 preceding siblings ...)
  2020-01-24  9:31 ` [PATCH 4.19 516/639] rtc: rv3029: revert error handling patch to rv3029_eeprom_write() Greg Kroah-Hartman
@ 2020-01-24  9:31 ` Greg Kroah-Hartman
  2020-01-24  9:31 ` [PATCH 4.19 518/639] i40e: reduce stack usage in i40e_set_fc Greg Kroah-Hartman
                   ` (125 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Felix Fietkau, Johannes Berg, Sasha Levin

From: Felix Fietkau <nbd@nbd.name>

[ Upstream commit 56dd918ff06e3ee24d8067e93ed12b2a39e71394 ]

The group number needs to be multiplied by the number of rates per group
to get the full rate index

Fixes: 5935839ad735 ("mac80211: improve minstrel_ht rate sorting by throughput & probability")
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Link: https://lore.kernel.org/r/20190820095449.45255-1-nbd@nbd.name
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/mac80211/rc80211_minstrel_ht.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/mac80211/rc80211_minstrel_ht.c b/net/mac80211/rc80211_minstrel_ht.c
index 3d5520776655d..0b60e330c115b 100644
--- a/net/mac80211/rc80211_minstrel_ht.c
+++ b/net/mac80211/rc80211_minstrel_ht.c
@@ -529,7 +529,7 @@ minstrel_ht_update_stats(struct minstrel_priv *mp, struct minstrel_ht_sta *mi)
 
 		/* (re)Initialize group rate indexes */
 		for(j = 0; j < MAX_THR_RATES; j++)
-			tmp_group_tp_rate[j] = group;
+			tmp_group_tp_rate[j] = MCS_GROUP_RATES * group;
 
 		for (i = 0; i < MCS_GROUP_RATES; i++) {
 			if (!(mi->supported[group] & BIT(i)))
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 518/639] i40e: reduce stack usage in i40e_set_fc
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (516 preceding siblings ...)
  2020-01-24  9:31 ` [PATCH 4.19 517/639] mac80211: minstrel_ht: fix per-group max throughput rate initialization Greg Kroah-Hartman
@ 2020-01-24  9:31 ` Greg Kroah-Hartman
  2020-01-24  9:31 ` [PATCH 4.19 519/639] media: atmel: atmel-isi: fix timeout value for stop streaming Greg Kroah-Hartman
                   ` (124 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Arnd Bergmann, Andrew Bowers,
	Jeff Kirsher, Sasha Levin

From: Arnd Bergmann <arnd@arndb.de>

[ Upstream commit 33b165684ab70867d4545643f550a5d48d3ddc57 ]

The functions i40e_aq_get_phy_abilities_resp() and i40e_set_fc() both
have giant structure on the stack, which makes each one use stack frames
larger than 500 bytes.

As clang decides one function into the other, we get a warning for
exceeding the frame size limit on 32-bit architectures:

drivers/net/ethernet/intel/i40e/i40e_common.c:1654:23: error: stack frame size of 1116 bytes in function 'i40e_set_fc' [-Werror,-Wframe-larger-than=]

When building with gcc, the inlining does not happen, but i40e_set_fc()
calls i40e_aq_get_phy_abilities_resp() anyway, so they add up on the
kernel stack just as much.

The parts that actually use large stacks don't overlap, so make sure
each one is a separate function, and mark them as noinline_for_stack to
prevent the compilers from combining them again.

Fixes: 0a862b43acc6 ("i40e/i40evf: Add module_types and update_link_info")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/intel/i40e/i40e_common.c | 91 +++++++++++--------
 1 file changed, 51 insertions(+), 40 deletions(-)

diff --git a/drivers/net/ethernet/intel/i40e/i40e_common.c b/drivers/net/ethernet/intel/i40e/i40e_common.c
index 85f75b5978fca..eb0ae6ab01e26 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_common.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_common.c
@@ -1668,25 +1668,15 @@ enum i40e_status_code i40e_aq_set_phy_config(struct i40e_hw *hw,
 	return status;
 }
 
-/**
- * i40e_set_fc
- * @hw: pointer to the hw struct
- * @aq_failures: buffer to return AdminQ failure information
- * @atomic_restart: whether to enable atomic link restart
- *
- * Set the requested flow control mode using set_phy_config.
- **/
-enum i40e_status_code i40e_set_fc(struct i40e_hw *hw, u8 *aq_failures,
-				  bool atomic_restart)
+static noinline_for_stack enum i40e_status_code
+i40e_set_fc_status(struct i40e_hw *hw,
+		   struct i40e_aq_get_phy_abilities_resp *abilities,
+		   bool atomic_restart)
 {
-	enum i40e_fc_mode fc_mode = hw->fc.requested_mode;
-	struct i40e_aq_get_phy_abilities_resp abilities;
 	struct i40e_aq_set_phy_config config;
-	enum i40e_status_code status;
+	enum i40e_fc_mode fc_mode = hw->fc.requested_mode;
 	u8 pause_mask = 0x0;
 
-	*aq_failures = 0x0;
-
 	switch (fc_mode) {
 	case I40E_FC_FULL:
 		pause_mask |= I40E_AQ_PHY_FLAG_PAUSE_TX;
@@ -1702,6 +1692,48 @@ enum i40e_status_code i40e_set_fc(struct i40e_hw *hw, u8 *aq_failures,
 		break;
 	}
 
+	memset(&config, 0, sizeof(struct i40e_aq_set_phy_config));
+	/* clear the old pause settings */
+	config.abilities = abilities->abilities & ~(I40E_AQ_PHY_FLAG_PAUSE_TX) &
+			   ~(I40E_AQ_PHY_FLAG_PAUSE_RX);
+	/* set the new abilities */
+	config.abilities |= pause_mask;
+	/* If the abilities have changed, then set the new config */
+	if (config.abilities == abilities->abilities)
+		return 0;
+
+	/* Auto restart link so settings take effect */
+	if (atomic_restart)
+		config.abilities |= I40E_AQ_PHY_ENABLE_ATOMIC_LINK;
+	/* Copy over all the old settings */
+	config.phy_type = abilities->phy_type;
+	config.phy_type_ext = abilities->phy_type_ext;
+	config.link_speed = abilities->link_speed;
+	config.eee_capability = abilities->eee_capability;
+	config.eeer = abilities->eeer_val;
+	config.low_power_ctrl = abilities->d3_lpan;
+	config.fec_config = abilities->fec_cfg_curr_mod_ext_info &
+			    I40E_AQ_PHY_FEC_CONFIG_MASK;
+
+	return i40e_aq_set_phy_config(hw, &config, NULL);
+}
+
+/**
+ * i40e_set_fc
+ * @hw: pointer to the hw struct
+ * @aq_failures: buffer to return AdminQ failure information
+ * @atomic_restart: whether to enable atomic link restart
+ *
+ * Set the requested flow control mode using set_phy_config.
+ **/
+enum i40e_status_code i40e_set_fc(struct i40e_hw *hw, u8 *aq_failures,
+				  bool atomic_restart)
+{
+	struct i40e_aq_get_phy_abilities_resp abilities;
+	enum i40e_status_code status;
+
+	*aq_failures = 0x0;
+
 	/* Get the current phy config */
 	status = i40e_aq_get_phy_capabilities(hw, false, false, &abilities,
 					      NULL);
@@ -1710,31 +1742,10 @@ enum i40e_status_code i40e_set_fc(struct i40e_hw *hw, u8 *aq_failures,
 		return status;
 	}
 
-	memset(&config, 0, sizeof(struct i40e_aq_set_phy_config));
-	/* clear the old pause settings */
-	config.abilities = abilities.abilities & ~(I40E_AQ_PHY_FLAG_PAUSE_TX) &
-			   ~(I40E_AQ_PHY_FLAG_PAUSE_RX);
-	/* set the new abilities */
-	config.abilities |= pause_mask;
-	/* If the abilities have changed, then set the new config */
-	if (config.abilities != abilities.abilities) {
-		/* Auto restart link so settings take effect */
-		if (atomic_restart)
-			config.abilities |= I40E_AQ_PHY_ENABLE_ATOMIC_LINK;
-		/* Copy over all the old settings */
-		config.phy_type = abilities.phy_type;
-		config.phy_type_ext = abilities.phy_type_ext;
-		config.link_speed = abilities.link_speed;
-		config.eee_capability = abilities.eee_capability;
-		config.eeer = abilities.eeer_val;
-		config.low_power_ctrl = abilities.d3_lpan;
-		config.fec_config = abilities.fec_cfg_curr_mod_ext_info &
-				    I40E_AQ_PHY_FEC_CONFIG_MASK;
-		status = i40e_aq_set_phy_config(hw, &config, NULL);
+	status = i40e_set_fc_status(hw, &abilities, atomic_restart);
+	if (status)
+		*aq_failures |= I40E_SET_FC_AQ_FAIL_SET;
 
-		if (status)
-			*aq_failures |= I40E_SET_FC_AQ_FAIL_SET;
-	}
 	/* Update the link info */
 	status = i40e_update_link_info(hw);
 	if (status) {
@@ -2563,7 +2574,7 @@ i40e_status i40e_get_link_status(struct i40e_hw *hw, bool *link_up)
  * i40e_updatelink_status - update status of the HW network link
  * @hw: pointer to the hw struct
  **/
-i40e_status i40e_update_link_info(struct i40e_hw *hw)
+noinline_for_stack i40e_status i40e_update_link_info(struct i40e_hw *hw)
 {
 	struct i40e_aq_get_phy_abilities_resp abilities;
 	i40e_status status = 0;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 519/639] media: atmel: atmel-isi: fix timeout value for stop streaming
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (517 preceding siblings ...)
  2020-01-24  9:31 ` [PATCH 4.19 518/639] i40e: reduce stack usage in i40e_set_fc Greg Kroah-Hartman
@ 2020-01-24  9:31 ` Greg Kroah-Hartman
  2020-01-24  9:31 ` [PATCH 4.19 520/639] ARM: 8896/1: VDSO: Dont leak kernel addresses Greg Kroah-Hartman
                   ` (123 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Alexandre Kroupski, Eugen Hristev,
	Sakari Ailus, Mauro Carvalho Chehab, Sasha Levin

From: Alexandre Kroupski <alexandre.kroupski@ingenico.com>

[ Upstream commit 623fd246bb40234fe68dd4e7c1f1f081f9c45a3d ]

In case of sensor malfunction, stop streaming timeout takes much longer
than expected. This is due to conversion of time to jiffies: milliseconds
multiplied with HZ (ticks/second) gives out a value of jiffies with 10^3
greater. We need to also divide by 10^3 to obtain the right jiffies value.
In other words FRAME_INTERVAL_MILLI_SEC must be in seconds in order to
multiply by HZ and get the right jiffies value to add to the current
jiffies for the timeout expire time.

Fixes: 195ebc43bf76 ("[media] V4L: at91: add Atmel Image Sensor Interface (ISI) support")
Signed-off-by: Alexandre Kroupski <alexandre.kroupski@ingenico.com>
Reviewed-by: Eugen Hristev <eugen.hristev@microchip.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/atmel/atmel-isi.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/platform/atmel/atmel-isi.c b/drivers/media/platform/atmel/atmel-isi.c
index e8db4df1e7c41..1a0e5233ae28e 100644
--- a/drivers/media/platform/atmel/atmel-isi.c
+++ b/drivers/media/platform/atmel/atmel-isi.c
@@ -496,7 +496,7 @@ static void stop_streaming(struct vb2_queue *vq)
 	spin_unlock_irq(&isi->irqlock);
 
 	if (!isi->enable_preview_path) {
-		timeout = jiffies + FRAME_INTERVAL_MILLI_SEC * HZ;
+		timeout = jiffies + (FRAME_INTERVAL_MILLI_SEC * HZ) / 1000;
 		/* Wait until the end of the current frame. */
 		while ((isi_readl(isi, ISI_STATUS) & ISI_CTRL_CDC) &&
 				time_before(jiffies, timeout))
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 520/639] ARM: 8896/1: VDSO: Dont leak kernel addresses
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (518 preceding siblings ...)
  2020-01-24  9:31 ` [PATCH 4.19 519/639] media: atmel: atmel-isi: fix timeout value for stop streaming Greg Kroah-Hartman
@ 2020-01-24  9:31 ` Greg Kroah-Hartman
  2020-01-24  9:31 ` [PATCH 4.19 521/639] rtc: pcf2127: bugfix: read rtc disables watchdog Greg Kroah-Hartman
                   ` (122 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Geert Uytterhoeven, Russell King,
	Sasha Levin

From: Geert Uytterhoeven <geert@linux-m68k.org>

[ Upstream commit 3e07590e7248db951fed6a2039403b5a39010be7 ]

Since commit ad67b74d2469d9b8 ("printk: hash addresses printed with
%p"), an obfuscated kernel pointer is printed at every boot if
debugging is enabled:

    vdso: 1 text pages at base (____ptrval____)

Remove the print completely, as it's useless without the address.

Based on commit 0f1bf7e39822476b ("arm64/vdso: don't leak kernel
addresses").

Fixes: ad67b74d2469d9b8 ("printk: hash addresses printed with %p")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/kernel/vdso.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/arch/arm/kernel/vdso.c b/arch/arm/kernel/vdso.c
index f4dd7f9663c10..e8cda5e02b4ea 100644
--- a/arch/arm/kernel/vdso.c
+++ b/arch/arm/kernel/vdso.c
@@ -205,7 +205,6 @@ static int __init vdso_init(void)
 	}
 
 	text_pages = (vdso_end - vdso_start) >> PAGE_SHIFT;
-	pr_debug("vdso: %i text pages at base %p\n", text_pages, vdso_start);
 
 	/* Allocate the VDSO text pagelist */
 	vdso_text_pagelist = kcalloc(text_pages, sizeof(struct page *),
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 521/639] rtc: pcf2127: bugfix: read rtc disables watchdog
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (519 preceding siblings ...)
  2020-01-24  9:31 ` [PATCH 4.19 520/639] ARM: 8896/1: VDSO: Dont leak kernel addresses Greg Kroah-Hartman
@ 2020-01-24  9:31 ` Greg Kroah-Hartman
  2020-01-26 10:26   ` Pavel Machek
  2020-01-24  9:31 ` [PATCH 4.19 522/639] mips: avoid explicit UB in assignment of mips_io_port_base Greg Kroah-Hartman
                   ` (121 subsequent siblings)
  642 siblings, 1 reply; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Bruno Thomsen, Alexandre Belloni,
	Sasha Levin

From: Bruno Thomsen <bruno.thomsen@gmail.com>

[ Upstream commit 7f43020e3bdb63d65661ed377682702f8b34d3ea ]

The previous fix listed bulk read of registers as root cause of
accendential disabling of watchdog, since the watchdog counter
register (WD_VAL) was zeroed.

Fixes: 3769a375ab83 rtc: pcf2127: bulk read only date and time registers.

Tested with the same PCF2127 chip as Sean reveled root cause
of WD_VAL register value zeroing was caused by reading CTRL2
register which is one of the watchdog feature control registers.

So the solution is to not read the first two control registers
(CTRL1 and CTRL2) in pcf2127_rtc_read_time as they are not
needed anyway. Size of local buf variable is kept to allow
easy usage of register defines to improve readability of code.

Debug trace line was updated after CTRL1 and CTRL2 are no longer
read from the chip. Also replaced magic numbers in buf access
with register defines.

Signed-off-by: Bruno Thomsen <bruno.thomsen@gmail.com>
Link: https://lore.kernel.org/r/20190822131936.18772-3-bruno.thomsen@gmail.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/rtc/rtc-pcf2127.c | 32 ++++++++++++--------------------
 1 file changed, 12 insertions(+), 20 deletions(-)

diff --git a/drivers/rtc/rtc-pcf2127.c b/drivers/rtc/rtc-pcf2127.c
index 7cb786d76e3c1..8c62406f92dd1 100644
--- a/drivers/rtc/rtc-pcf2127.c
+++ b/drivers/rtc/rtc-pcf2127.c
@@ -57,20 +57,14 @@ static int pcf2127_rtc_read_time(struct device *dev, struct rtc_time *tm)
 	struct pcf2127 *pcf2127 = dev_get_drvdata(dev);
 	unsigned char buf[10];
 	int ret;
-	int i;
 
-	for (i = 0; i <= PCF2127_REG_CTRL3; i++) {
-		ret = regmap_read(pcf2127->regmap, PCF2127_REG_CTRL1 + i,
-				  (unsigned int *)(buf + i));
-		if (ret) {
-			dev_err(dev, "%s: read error\n", __func__);
-			return ret;
-		}
-	}
-
-	ret = regmap_bulk_read(pcf2127->regmap, PCF2127_REG_SC,
-			       (buf + PCF2127_REG_SC),
-			       ARRAY_SIZE(buf) - PCF2127_REG_SC);
+	/*
+	 * Avoid reading CTRL2 register as it causes WD_VAL register
+	 * value to reset to 0 which means watchdog is stopped.
+	 */
+	ret = regmap_bulk_read(pcf2127->regmap, PCF2127_REG_CTRL3,
+			       (buf + PCF2127_REG_CTRL3),
+			       ARRAY_SIZE(buf) - PCF2127_REG_CTRL3);
 	if (ret) {
 		dev_err(dev, "%s: read error\n", __func__);
 		return ret;
@@ -91,14 +85,12 @@ static int pcf2127_rtc_read_time(struct device *dev, struct rtc_time *tm)
 	}
 
 	dev_dbg(dev,
-		"%s: raw data is cr1=%02x, cr2=%02x, cr3=%02x, "
-		"sec=%02x, min=%02x, hr=%02x, "
+		"%s: raw data is cr3=%02x, sec=%02x, min=%02x, hr=%02x, "
 		"mday=%02x, wday=%02x, mon=%02x, year=%02x\n",
-		__func__,
-		buf[0], buf[1], buf[2],
-		buf[3], buf[4], buf[5],
-		buf[6], buf[7], buf[8], buf[9]);
-
+		__func__, buf[PCF2127_REG_CTRL3], buf[PCF2127_REG_SC],
+		buf[PCF2127_REG_MN], buf[PCF2127_REG_HR],
+		buf[PCF2127_REG_DM], buf[PCF2127_REG_DW],
+		buf[PCF2127_REG_MO], buf[PCF2127_REG_YR]);
 
 	tm->tm_sec = bcd2bin(buf[PCF2127_REG_SC] & 0x7F);
 	tm->tm_min = bcd2bin(buf[PCF2127_REG_MN] & 0x7F);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 522/639] mips: avoid explicit UB in assignment of mips_io_port_base
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (520 preceding siblings ...)
  2020-01-24  9:31 ` [PATCH 4.19 521/639] rtc: pcf2127: bugfix: read rtc disables watchdog Greg Kroah-Hartman
@ 2020-01-24  9:31 ` Greg Kroah-Hartman
  2020-01-24  9:31 ` [PATCH 4.19 523/639] media: em28xx: Fix exception handling in em28xx_alloc_urbs() Greg Kroah-Hartman
                   ` (120 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Nathan Chancellor, Eli Friedman,
	Nick Desaulniers, Paul Burton, ralf, jhogan, Maciej W. Rozycki,
	Hassan Naveed, Stephen Kitt, Serge Semin, Mike Rapoport,
	Andrew Morton, Michal Hocko, linux-mips, clang-built-linux,
	Sasha Levin

From: Nick Desaulniers <ndesaulniers@google.com>

[ Upstream commit 12051b318bc3ce5b42d6d786191008284b067d83 ]

The code in question is modifying a variable declared const through
pointer manipulation.  Such code is explicitly undefined behavior, and
is the lone issue preventing malta_defconfig from booting when built
with Clang:

If an attempt is made to modify an object defined with a const-qualified
type through use of an lvalue with non-const-qualified type, the
behavior is undefined.

LLVM is removing such assignments. A simple fix is to not declare
variables const that you plan on modifying.  Limiting the scope would be
a better method of preventing unwanted writes to such a variable.

Further, the code in question mentions "compiler bugs" without any links
to bug reports, so it is difficult to know if the issue is resolved in
GCC. The patch was authored in 2006, which would have been GCC 4.0.3 or
4.1.1. The minimal supported version of GCC in the Linux kernel is
currently 4.6.

For what its worth, there was UB before the commit in question, it just
added a barrier and got lucky IRT codegen. I don't think there's any
actual compiler bugs related, just runtime bugs due to UB.

Link: https://github.com/ClangBuiltLinux/linux/issues/610
Fixes: 966f4406d903 ("[MIPS] Work around bad code generation for <asm/io.h>.")
Reported-by: Nathan Chancellor <natechancellor@gmail.com>
Debugged-by: Nathan Chancellor <natechancellor@gmail.com>
Suggested-by: Eli Friedman <efriedma@quicinc.com>
Signed-off-by: Nick Desaulniers <ndesaulniers@google.com>
Reviewed-by: Nathan Chancellor <natechancellor@gmail.com>
Tested-by: Nathan Chancellor <natechancellor@gmail.com>
Signed-off-by: Paul Burton <paul.burton@mips.com>
Cc: ralf@linux-mips.org
Cc: jhogan@kernel.org
Cc: Maciej W. Rozycki <macro@linux-mips.org>
Cc: Hassan Naveed <hnaveed@wavecomp.com>
Cc: Stephen Kitt <steve@sk2.org>
Cc: Serge Semin <fancer.lancer@gmail.com>
Cc: Mike Rapoport <rppt@linux.ibm.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Michal Hocko <mhocko@suse.com>
Cc: linux-mips@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Cc: clang-built-linux@googlegroups.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/mips/include/asm/io.h | 14 ++------------
 arch/mips/kernel/setup.c   |  2 +-
 2 files changed, 3 insertions(+), 13 deletions(-)

diff --git a/arch/mips/include/asm/io.h b/arch/mips/include/asm/io.h
index 54c730aed3271..df1eaa3652794 100644
--- a/arch/mips/include/asm/io.h
+++ b/arch/mips/include/asm/io.h
@@ -62,21 +62,11 @@
  * instruction, so the lower 16 bits must be zero.  Should be true on
  * on any sane architecture; generic code does not use this assumption.
  */
-extern const unsigned long mips_io_port_base;
+extern unsigned long mips_io_port_base;
 
-/*
- * Gcc will generate code to load the value of mips_io_port_base after each
- * function call which may be fairly wasteful in some cases.  So we don't
- * play quite by the book.  We tell gcc mips_io_port_base is a long variable
- * which solves the code generation issue.  Now we need to violate the
- * aliasing rules a little to make initialization possible and finally we
- * will need the barrier() to fight side effects of the aliasing chat.
- * This trickery will eventually collapse under gcc's optimizer.  Oh well.
- */
 static inline void set_io_port_base(unsigned long base)
 {
-	* (unsigned long *) &mips_io_port_base = base;
-	barrier();
+	mips_io_port_base = base;
 }
 
 /*
diff --git a/arch/mips/kernel/setup.c b/arch/mips/kernel/setup.c
index 8aaaa42f91ed6..e87c98b8a72c0 100644
--- a/arch/mips/kernel/setup.c
+++ b/arch/mips/kernel/setup.c
@@ -76,7 +76,7 @@ static char __initdata builtin_cmdline[COMMAND_LINE_SIZE] = CONFIG_CMDLINE;
  * mips_io_port_base is the begin of the address space to which x86 style
  * I/O ports are mapped.
  */
-const unsigned long mips_io_port_base = -1;
+unsigned long mips_io_port_base = -1;
 EXPORT_SYMBOL(mips_io_port_base);
 
 static struct resource code_resource = { .name = "Kernel code", };
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 523/639] media: em28xx: Fix exception handling in em28xx_alloc_urbs()
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (521 preceding siblings ...)
  2020-01-24  9:31 ` [PATCH 4.19 522/639] mips: avoid explicit UB in assignment of mips_io_port_base Greg Kroah-Hartman
@ 2020-01-24  9:31 ` Greg Kroah-Hartman
  2020-01-24  9:31 ` [PATCH 4.19 524/639] iommu/mediatek: Fix iova_to_phys PA start for 4GB mode Greg Kroah-Hartman
                   ` (119 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Markus Elfring, Hans Verkuil,
	Mauro Carvalho Chehab, Sasha Levin

From: Markus Elfring <elfring@users.sourceforge.net>

[ Upstream commit ecbce48f1ff2442371ebcd12ec0ecddb431fbd72 ]

A null pointer would be passed to a call of the function "kfree" directly
after a call of the function "kcalloc" failed at one place.
Pass the data structure member "urb" instead for which memory
was allocated before (so that this resource will be properly cleaned up).

This issue was detected by using the Coccinelle software.

Fixes: d571b592c6206d33731f41aa710fa0f69ac8611b ("media: em28xx: don't use coherent buffer for DMA transfers")
Signed-off-by: Markus Elfring <elfring@users.sourceforge.net>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/usb/em28xx/em28xx-core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/usb/em28xx/em28xx-core.c b/drivers/media/usb/em28xx/em28xx-core.c
index 5657f8710ca6b..69445c8e38e28 100644
--- a/drivers/media/usb/em28xx/em28xx-core.c
+++ b/drivers/media/usb/em28xx/em28xx-core.c
@@ -930,7 +930,7 @@ int em28xx_alloc_urbs(struct em28xx *dev, enum em28xx_mode mode, int xfer_bulk,
 
 	usb_bufs->buf = kcalloc(num_bufs, sizeof(void *), GFP_KERNEL);
 	if (!usb_bufs->buf) {
-		kfree(usb_bufs->buf);
+		kfree(usb_bufs->urb);
 		return -ENOMEM;
 	}
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 524/639] iommu/mediatek: Fix iova_to_phys PA start for 4GB mode
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (522 preceding siblings ...)
  2020-01-24  9:31 ` [PATCH 4.19 523/639] media: em28xx: Fix exception handling in em28xx_alloc_urbs() Greg Kroah-Hartman
@ 2020-01-24  9:31 ` Greg Kroah-Hartman
  2020-01-24  9:31 ` [PATCH 4.19 525/639] ahci: Do not export local variable ahci_em_messages Greg Kroah-Hartman
                   ` (118 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yong Wu, Joerg Roedel, Sasha Levin

From: Yong Wu <yong.wu@mediatek.com>

[ Upstream commit 76ce65464fcd2c21db84391572b7938b716aceb0 ]

In M4U 4GB mode, the physical address is remapped as below:

CPU Physical address:

====================

0      1G       2G     3G       4G     5G
|---A---|---B---|---C---|---D---|---E---|
+--I/O--+------------Memory-------------+

IOMMU output physical address:
 =============================

                                4G      5G     6G      7G      8G
                                |---E---|---B---|---C---|---D---|
                                +------------Memory-------------+

The Region 'A'(I/O) can not be mapped by M4U; For Region 'B'/'C'/'D', the
bit32 of the CPU physical address always is needed to set, and for Region
'E', the CPU physical address keep as is. something looks like this:
CPU PA         ->    M4U OUTPUT PA
0x4000_0000          0x1_4000_0000 (Add bit32)
0x8000_0000          0x1_8000_0000 ...
0xc000_0000          0x1_c000_0000 ...
0x1_0000_0000        0x1_0000_0000 (No change)

Additionally, the iommu consumers always use the CPU phyiscal address.

The PA in the iova_to_phys that is got from v7s always is u32, But
from the CPU point of view, PA only need add BIT(32) when PA < 0x4000_0000.

Fixes: 30e2fccf9512 ("iommu/mediatek: Enlarge the validate PA range
for 4GB mode")
Signed-off-by: Yong Wu <yong.wu@mediatek.com>
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iommu/mtk_iommu.c | 26 +++++++++++++++++++++++++-
 1 file changed, 25 insertions(+), 1 deletion(-)

diff --git a/drivers/iommu/mtk_iommu.c b/drivers/iommu/mtk_iommu.c
index 154cf44439cb6..8e75f34ac8868 100644
--- a/drivers/iommu/mtk_iommu.c
+++ b/drivers/iommu/mtk_iommu.c
@@ -115,6 +115,30 @@ struct mtk_iommu_domain {
 
 static struct iommu_ops mtk_iommu_ops;
 
+/*
+ * In M4U 4GB mode, the physical address is remapped as below:
+ *
+ * CPU Physical address:
+ * ====================
+ *
+ * 0      1G       2G     3G       4G     5G
+ * |---A---|---B---|---C---|---D---|---E---|
+ * +--I/O--+------------Memory-------------+
+ *
+ * IOMMU output physical address:
+ *  =============================
+ *
+ *                                 4G      5G     6G      7G      8G
+ *                                 |---E---|---B---|---C---|---D---|
+ *                                 +------------Memory-------------+
+ *
+ * The Region 'A'(I/O) can NOT be mapped by M4U; For Region 'B'/'C'/'D', the
+ * bit32 of the CPU physical address always is needed to set, and for Region
+ * 'E', the CPU physical address keep as is.
+ * Additionally, The iommu consumers always use the CPU phyiscal address.
+ */
+#define MTK_IOMMU_4GB_MODE_REMAP_BASE	 0x40000000
+
 static LIST_HEAD(m4ulist);	/* List all the M4U HWs */
 
 #define for_each_m4u(data)	list_for_each_entry(data, &m4ulist, list)
@@ -409,7 +433,7 @@ static phys_addr_t mtk_iommu_iova_to_phys(struct iommu_domain *domain,
 	pa = dom->iop->iova_to_phys(dom->iop, iova);
 	spin_unlock_irqrestore(&dom->pgtlock, flags);
 
-	if (data->enable_4GB)
+	if (data->enable_4GB && pa < MTK_IOMMU_4GB_MODE_REMAP_BASE)
 		pa |= BIT_ULL(32);
 
 	return pa;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 525/639] ahci: Do not export local variable ahci_em_messages
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (523 preceding siblings ...)
  2020-01-24  9:31 ` [PATCH 4.19 524/639] iommu/mediatek: Fix iova_to_phys PA start for 4GB mode Greg Kroah-Hartman
@ 2020-01-24  9:31 ` Greg Kroah-Hartman
  2020-01-24  9:31 ` [PATCH 4.19 526/639] rxrpc: Fix lack of conn cleanup when local endpoint is cleaned up [ver #2] Greg Kroah-Hartman
                   ` (117 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chuansheng Liu, Andy Shevchenko,
	Jens Axboe, Sasha Levin

From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>

[ Upstream commit 60fc35f327e0a9e60b955c0f3c3ed623608d1baa ]

The commit ed08d40cdec4
  ("ahci: Changing two module params with static and __read_mostly")
moved ahci_em_messages to be static while missing the fact of exporting it.

WARNING: "ahci_em_messages" [vmlinux] is a static EXPORT_SYMBOL_GPL

Drop export for the local variable ahci_em_messages.

Fixes: ed08d40cdec4 ("ahci: Changing two module params with static and __read_mostly")
Cc: Chuansheng Liu <chuansheng.liu@intel.com>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/ata/libahci.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
index b5f57c69c4878..2bdb250a2142c 100644
--- a/drivers/ata/libahci.c
+++ b/drivers/ata/libahci.c
@@ -191,7 +191,6 @@ struct ata_port_operations ahci_pmp_retry_srst_ops = {
 EXPORT_SYMBOL_GPL(ahci_pmp_retry_srst_ops);
 
 static bool ahci_em_messages __read_mostly = true;
-EXPORT_SYMBOL_GPL(ahci_em_messages);
 module_param(ahci_em_messages, bool, 0444);
 /* add other LED protocol types when they become supported */
 MODULE_PARM_DESC(ahci_em_messages,
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 526/639] rxrpc: Fix lack of conn cleanup when local endpoint is cleaned up [ver #2]
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (524 preceding siblings ...)
  2020-01-24  9:31 ` [PATCH 4.19 525/639] ahci: Do not export local variable ahci_em_messages Greg Kroah-Hartman
@ 2020-01-24  9:31 ` Greg Kroah-Hartman
  2020-01-24  9:31 ` [PATCH 4.19 527/639] Partially revert "kfifo: fix kfifo_alloc() and kfifo_init()" Greg Kroah-Hartman
                   ` (116 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, David Howells, Marc Dionne,
	David S. Miller, Sasha Levin

From: David Howells <dhowells@redhat.com>

[ Upstream commit d12040b6933f684a26773afad46dbba9778608d7 ]

When a local endpoint is ceases to be in use, such as when the kafs module
is unloaded, the kernel will emit an assertion failure if there are any
outstanding client connections:

	rxrpc: Assertion failed
	------------[ cut here ]------------
	kernel BUG at net/rxrpc/local_object.c:433!

and even beyond that, will evince other oopses if there are service
connections still present.

Fix this by:

 (1) Removing the triggering of connection reaping when an rxrpc socket is
     released.  These don't actually clean up the connections anyway - and
     further, the local endpoint may still be in use through another
     socket.

 (2) Mark the local endpoint as dead when we start the process of tearing
     it down.

 (3) When destroying a local endpoint, strip all of its client connections
     from the idle list and discard the ref on each that the list was
     holding.

 (4) When destroying a local endpoint, call the service connection reaper
     directly (rather than through a workqueue) to immediately kill off all
     outstanding service connections.

 (5) Make the service connection reaper reap connections for which the
     local endpoint is marked dead.

Only after destroying the connections can we close the socket lest we get
an oops in a workqueue that's looking at a connection or a peer.

Fixes: 3d18cbb7fd0c ("rxrpc: Fix conn expiry timers")
Signed-off-by: David Howells <dhowells@redhat.com>
Tested-by: Marc Dionne <marc.dionne@auristor.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/rxrpc/af_rxrpc.c     |  3 ---
 net/rxrpc/ar-internal.h  |  1 +
 net/rxrpc/conn_client.c  | 44 ++++++++++++++++++++++++++++++++++++++++
 net/rxrpc/conn_object.c  |  2 +-
 net/rxrpc/local_object.c |  5 ++++-
 5 files changed, 50 insertions(+), 5 deletions(-)

diff --git a/net/rxrpc/af_rxrpc.c b/net/rxrpc/af_rxrpc.c
index 7319d3ca30e94..a74edb10cbfc6 100644
--- a/net/rxrpc/af_rxrpc.c
+++ b/net/rxrpc/af_rxrpc.c
@@ -869,7 +869,6 @@ static void rxrpc_sock_destructor(struct sock *sk)
 static int rxrpc_release_sock(struct sock *sk)
 {
 	struct rxrpc_sock *rx = rxrpc_sk(sk);
-	struct rxrpc_net *rxnet = rxrpc_net(sock_net(&rx->sk));
 
 	_enter("%p{%d,%d}", sk, sk->sk_state, refcount_read(&sk->sk_refcnt));
 
@@ -905,8 +904,6 @@ static int rxrpc_release_sock(struct sock *sk)
 	rxrpc_release_calls_on_socket(rx);
 	flush_workqueue(rxrpc_workqueue);
 	rxrpc_purge_queue(&sk->sk_receive_queue);
-	rxrpc_queue_work(&rxnet->service_conn_reaper);
-	rxrpc_queue_work(&rxnet->client_conn_reaper);
 
 	rxrpc_unuse_local(rx->local);
 	rx->local = NULL;
diff --git a/net/rxrpc/ar-internal.h b/net/rxrpc/ar-internal.h
index 37e4c1801a41f..ccef6e40e0020 100644
--- a/net/rxrpc/ar-internal.h
+++ b/net/rxrpc/ar-internal.h
@@ -903,6 +903,7 @@ void rxrpc_disconnect_client_call(struct rxrpc_call *);
 void rxrpc_put_client_conn(struct rxrpc_connection *);
 void rxrpc_discard_expired_client_conns(struct work_struct *);
 void rxrpc_destroy_all_client_connections(struct rxrpc_net *);
+void rxrpc_clean_up_local_conns(struct rxrpc_local *);
 
 /*
  * conn_event.c
diff --git a/net/rxrpc/conn_client.c b/net/rxrpc/conn_client.c
index c979a56faaef0..3dbb126e60608 100644
--- a/net/rxrpc/conn_client.c
+++ b/net/rxrpc/conn_client.c
@@ -1166,3 +1166,47 @@ void rxrpc_destroy_all_client_connections(struct rxrpc_net *rxnet)
 
 	_leave("");
 }
+
+/*
+ * Clean up the client connections on a local endpoint.
+ */
+void rxrpc_clean_up_local_conns(struct rxrpc_local *local)
+{
+	struct rxrpc_connection *conn, *tmp;
+	struct rxrpc_net *rxnet = local->rxnet;
+	unsigned int nr_active;
+	LIST_HEAD(graveyard);
+
+	_enter("");
+
+	spin_lock(&rxnet->client_conn_cache_lock);
+	nr_active = rxnet->nr_active_client_conns;
+
+	list_for_each_entry_safe(conn, tmp, &rxnet->idle_client_conns,
+				 cache_link) {
+		if (conn->params.local == local) {
+			ASSERTCMP(conn->cache_state, ==, RXRPC_CONN_CLIENT_IDLE);
+
+			trace_rxrpc_client(conn, -1, rxrpc_client_discard);
+			if (!test_and_clear_bit(RXRPC_CONN_EXPOSED, &conn->flags))
+				BUG();
+			conn->cache_state = RXRPC_CONN_CLIENT_INACTIVE;
+			list_move(&conn->cache_link, &graveyard);
+			nr_active--;
+		}
+	}
+
+	rxnet->nr_active_client_conns = nr_active;
+	spin_unlock(&rxnet->client_conn_cache_lock);
+	ASSERTCMP(nr_active, >=, 0);
+
+	while (!list_empty(&graveyard)) {
+		conn = list_entry(graveyard.next,
+				  struct rxrpc_connection, cache_link);
+		list_del_init(&conn->cache_link);
+
+		rxrpc_put_connection(conn);
+	}
+
+	_leave(" [culled]");
+}
diff --git a/net/rxrpc/conn_object.c b/net/rxrpc/conn_object.c
index 885dae829f4a1..004a6eb529bc1 100644
--- a/net/rxrpc/conn_object.c
+++ b/net/rxrpc/conn_object.c
@@ -401,7 +401,7 @@ void rxrpc_service_connection_reaper(struct work_struct *work)
 		if (conn->state == RXRPC_CONN_SERVICE_PREALLOC)
 			continue;
 
-		if (rxnet->live) {
+		if (rxnet->live && !conn->params.local->dead) {
 			idle_timestamp = READ_ONCE(conn->idle_timestamp);
 			expire_at = idle_timestamp + rxrpc_connection_expiry * HZ;
 			if (conn->params.local->service_closed)
diff --git a/net/rxrpc/local_object.c b/net/rxrpc/local_object.c
index c752ad4870678..04f0976841a43 100644
--- a/net/rxrpc/local_object.c
+++ b/net/rxrpc/local_object.c
@@ -430,11 +430,14 @@ static void rxrpc_local_destroyer(struct rxrpc_local *local)
 
 	_enter("%d", local->debug_id);
 
+	local->dead = true;
+
 	mutex_lock(&rxnet->local_mutex);
 	list_del_init(&local->link);
 	mutex_unlock(&rxnet->local_mutex);
 
-	ASSERT(RB_EMPTY_ROOT(&local->client_conns));
+	rxrpc_clean_up_local_conns(local);
+	rxrpc_service_connection_reaper(&rxnet->service_conn_reaper);
 	ASSERT(!local->service);
 
 	if (socket) {
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 527/639] Partially revert "kfifo: fix kfifo_alloc() and kfifo_init()"
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (525 preceding siblings ...)
  2020-01-24  9:31 ` [PATCH 4.19 526/639] rxrpc: Fix lack of conn cleanup when local endpoint is cleaned up [ver #2] Greg Kroah-Hartman
@ 2020-01-24  9:31 ` Greg Kroah-Hartman
  2020-01-24  9:31 ` [PATCH 4.19 528/639] hwmon: (lm75) Fix write operations for negative temperatures Greg Kroah-Hartman
                   ` (115 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, laokz, Stefani Seibold,
	Andrew Morton, Dan Carpenter, Greg KH, Kees Cook, Will Deacon,
	Linus Torvalds, Sasha Levin

From: Linus Torvalds <torvalds@linux-foundation.org>

[ Upstream commit ab9bb6318b0967671e0c9b6537c1537d51ca4f45 ]

Commit dfe2a77fd243 ("kfifo: fix kfifo_alloc() and kfifo_init()") made
the kfifo code round the number of elements up.  That was good for
__kfifo_alloc(), but it's actually wrong for __kfifo_init().

The difference? __kfifo_alloc() will allocate the rounded-up number of
elements, but __kfifo_init() uses an allocation done by the caller.  We
can't just say "use more elements than the caller allocated", and have
to round down.

The good news? All the normal cases will be using power-of-two arrays
anyway, and most users of kfifo's don't use kfifo_init() at all, but one
of the helper macros to declare a KFIFO that enforce the proper
power-of-two behavior.  But it looks like at least ibmvscsis might be
affected.

The bad news? Will Deacon refers to an old thread and points points out
that the memory ordering in kfifo's is questionable.  See

  https://lore.kernel.org/lkml/20181211034032.32338-1-yuleixzhang@tencent.com/

for more.

Fixes: dfe2a77fd243 ("kfifo: fix kfifo_alloc() and kfifo_init()")
Reported-by: laokz <laokz@foxmail.com>
Cc: Stefani Seibold <stefani@seibold.net>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Dan Carpenter <dan.carpenter@oracle.com>
Cc: Greg KH <greg@kroah.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Will Deacon <will@kernel.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 lib/kfifo.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/lib/kfifo.c b/lib/kfifo.c
index 015656aa8182d..6320ab91e3431 100644
--- a/lib/kfifo.c
+++ b/lib/kfifo.c
@@ -82,7 +82,8 @@ int __kfifo_init(struct __kfifo *fifo, void *buffer,
 {
 	size /= esize;
 
-	size = roundup_pow_of_two(size);
+	if (!is_power_of_2(size))
+		size = rounddown_pow_of_two(size);
 
 	fifo->in = 0;
 	fifo->out = 0;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 528/639] hwmon: (lm75) Fix write operations for negative temperatures
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (526 preceding siblings ...)
  2020-01-24  9:31 ` [PATCH 4.19 527/639] Partially revert "kfifo: fix kfifo_alloc() and kfifo_init()" Greg Kroah-Hartman
@ 2020-01-24  9:31 ` Greg Kroah-Hartman
  2020-01-24  9:31 ` [PATCH 4.19 529/639] net/sched: cbs: Set default link speed to 10 Mbps in cbs_set_port_rate Greg Kroah-Hartman
                   ` (114 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Iker Perez del Palomar Sustatxa,
	Guenter Roeck, Sasha Levin

From: Guenter Roeck <linux@roeck-us.net>

[ Upstream commit 7d82fcc9d9e81241778aaa22fda7be753e237d86 ]

Writes into limit registers fail if the temperature written is negative.
The regmap write operation checks the value range, regmap_write accepts
an unsigned int as parameter, and the temperature value passed to
regmap_write is kept in a variable declared as long. Negative values
are converted large unsigned integers, which fails the range check.
Fix by type casting the temperature to u16 when calling regmap_write().

Cc: Iker Perez del Palomar Sustatxa <iker.perez@codethink.co.uk>
Fixes: e65365fed87f ("hwmon: (lm75) Convert to use regmap")
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hwmon/lm75.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/hwmon/lm75.c b/drivers/hwmon/lm75.c
index 49f4b33a5685a..7f28912c9abcf 100644
--- a/drivers/hwmon/lm75.c
+++ b/drivers/hwmon/lm75.c
@@ -165,7 +165,7 @@ static int lm75_write(struct device *dev, enum hwmon_sensor_types type,
 	temp = DIV_ROUND_CLOSEST(temp  << (resolution - 8),
 				 1000) << (16 - resolution);
 
-	return regmap_write(data->regmap, reg, temp);
+	return regmap_write(data->regmap, reg, (u16)temp);
 }
 
 static umode_t lm75_is_visible(const void *data, enum hwmon_sensor_types type,
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 529/639] net/sched: cbs: Set default link speed to 10 Mbps in cbs_set_port_rate
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (527 preceding siblings ...)
  2020-01-24  9:31 ` [PATCH 4.19 528/639] hwmon: (lm75) Fix write operations for negative temperatures Greg Kroah-Hartman
@ 2020-01-24  9:31 ` Greg Kroah-Hartman
  2020-01-24  9:31 ` [PATCH 4.19 530/639] power: supply: Init device wakeup after device_add() Greg Kroah-Hartman
                   ` (113 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Leandro Dorileo,
	Vinicius Costa Gomes, Vladimir Oltean, David S. Miller,
	Sasha Levin

From: Vladimir Oltean <olteanv@gmail.com>

[ Upstream commit 1c6c09a0ae62fa3ea8f8ead2ac3920e6fff2de64 ]

The discussion to be made is absolutely the same as in the case of
previous patch ("taprio: Set default link speed to 10 Mbps in
taprio_set_picos_per_byte"). Nothing is lost when setting a default.

Cc: Leandro Dorileo <leandro.maciel.dorileo@intel.com>
Fixes: e0a7683d30e9 ("net/sched: cbs: fix port_rate miscalculation")
Acked-by: Vinicius Costa Gomes <vinicius.gomes@intel.com>
Signed-off-by: Vladimir Oltean <olteanv@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/sched/sch_cbs.c | 19 +++++++++++--------
 1 file changed, 11 insertions(+), 8 deletions(-)

diff --git a/net/sched/sch_cbs.c b/net/sched/sch_cbs.c
index b3c8d04929df2..289f66b9238d3 100644
--- a/net/sched/sch_cbs.c
+++ b/net/sched/sch_cbs.c
@@ -185,11 +185,6 @@ static struct sk_buff *cbs_dequeue_soft(struct Qdisc *sch)
 	s64 credits;
 	int len;
 
-	if (atomic64_read(&q->port_rate) == -1) {
-		WARN_ONCE(1, "cbs: dequeue() called with unknown port rate.");
-		return NULL;
-	}
-
 	if (q->credits < 0) {
 		credits = timediff_to_credits(now - q->last, q->idleslope);
 
@@ -307,11 +302,19 @@ static int cbs_enable_offload(struct net_device *dev, struct cbs_sched_data *q,
 static void cbs_set_port_rate(struct net_device *dev, struct cbs_sched_data *q)
 {
 	struct ethtool_link_ksettings ecmd;
+	int speed = SPEED_10;
 	int port_rate = -1;
+	int err;
+
+	err = __ethtool_get_link_ksettings(dev, &ecmd);
+	if (err < 0)
+		goto skip;
+
+	if (ecmd.base.speed != SPEED_UNKNOWN)
+		speed = ecmd.base.speed;
 
-	if (!__ethtool_get_link_ksettings(dev, &ecmd) &&
-	    ecmd.base.speed != SPEED_UNKNOWN)
-		port_rate = ecmd.base.speed * 1000 * BYTES_PER_KBIT;
+skip:
+	port_rate = speed * 1000 * BYTES_PER_KBIT;
 
 	atomic64_set(&q->port_rate, port_rate);
 	netdev_dbg(dev, "cbs: set %s's port_rate to: %lld, linkspeed: %d\n",
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 530/639] power: supply: Init device wakeup after device_add()
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (528 preceding siblings ...)
  2020-01-24  9:31 ` [PATCH 4.19 529/639] net/sched: cbs: Set default link speed to 10 Mbps in cbs_set_port_rate Greg Kroah-Hartman
@ 2020-01-24  9:31 ` Greg Kroah-Hartman
  2020-01-24  9:31 ` [PATCH 4.19 531/639] x86, perf: Fix the dependency of the x86 insn decoder selftest Greg Kroah-Hartman
                   ` (112 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Tri Vo, Kalesh Singh,
	Ravi Chandra Sadineni, Viresh Kumar, Stephen Boyd,
	Rafael J. Wysocki, Sebastian Reichel, Sasha Levin

From: Stephen Boyd <swboyd@chromium.org>

[ Upstream commit 8288022284859acbcc3cf1a073a1e2692d6c2543 ]

We may want to use the device pointer in device_init_wakeup() with
functions that expect the device to already be added with device_add().
For example, if we were to link the device initializing wakeup to
something in sysfs such as a class for wakeups we'll run into an error.
It looks like this code was written with the assumption that the device
would be added before initializing wakeup due to the order of operations
in power_supply_unregister().

Let's change the order of operations so we don't run into problems here.

Fixes: 948dcf966228 ("power_supply: Prevent suspend until power supply events are processed")
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Tri Vo <trong@android.com>
Cc: Kalesh Singh <kaleshsingh@google.com>
Cc: Ravi Chandra Sadineni <ravisadineni@chromium.org>
Cc: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Stephen Boyd <swboyd@chromium.org>
Acked-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/power/supply/power_supply_core.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/power/supply/power_supply_core.c b/drivers/power/supply/power_supply_core.c
index e85361878450c..e43a7b3b570c4 100644
--- a/drivers/power/supply/power_supply_core.c
+++ b/drivers/power/supply/power_supply_core.c
@@ -902,14 +902,14 @@ __power_supply_register(struct device *parent,
 	}
 
 	spin_lock_init(&psy->changed_lock);
-	rc = device_init_wakeup(dev, ws);
-	if (rc)
-		goto wakeup_init_failed;
-
 	rc = device_add(dev);
 	if (rc)
 		goto device_add_failed;
 
+	rc = device_init_wakeup(dev, ws);
+	if (rc)
+		goto wakeup_init_failed;
+
 	rc = psy_register_thermal(psy);
 	if (rc)
 		goto register_thermal_failed;
@@ -946,8 +946,8 @@ register_cooler_failed:
 	psy_unregister_thermal(psy);
 register_thermal_failed:
 	device_del(dev);
-device_add_failed:
 wakeup_init_failed:
+device_add_failed:
 check_supplies_failed:
 dev_set_name_failed:
 	put_device(dev);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 531/639] x86, perf: Fix the dependency of the x86 insn decoder selftest
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (529 preceding siblings ...)
  2020-01-24  9:31 ` [PATCH 4.19 530/639] power: supply: Init device wakeup after device_add() Greg Kroah-Hartman
@ 2020-01-24  9:31 ` Greg Kroah-Hartman
  2020-01-24  9:31 ` [PATCH 4.19 532/639] staging: greybus: light: fix a couple double frees Greg Kroah-Hartman
                   ` (111 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Masami Hiramatsu, Linus Torvalds,
	Peter Zijlstra, Thomas Gleixner, Ingo Molnar, Sasha Levin

From: Masami Hiramatsu <mhiramat@kernel.org>

[ Upstream commit 7720804a2ae46c90265a32c81c45fb6f8d2f4e8b ]

Since x86 instruction decoder is not only for kprobes,
it should be tested when the insn.c is compiled.
(e.g. perf is enabled but kprobes is disabled)

Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Fixes: cbe5c34c8c1f ("x86: Compile insn.c and inat.c only for KPROBES")
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/Kconfig.debug | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/Kconfig.debug b/arch/x86/Kconfig.debug
index 7d68f0c7cfb1e..687cd1a213d50 100644
--- a/arch/x86/Kconfig.debug
+++ b/arch/x86/Kconfig.debug
@@ -181,7 +181,7 @@ config HAVE_MMIOTRACE_SUPPORT
 
 config X86_DECODER_SELFTEST
 	bool "x86 instruction decoder selftest"
-	depends on DEBUG_KERNEL && KPROBES
+	depends on DEBUG_KERNEL && INSTRUCTION_DECODER
 	depends on !COMPILE_TEST
 	---help---
 	 Perform x86 instruction decoder selftests at build time.
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 532/639] staging: greybus: light: fix a couple double frees
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (530 preceding siblings ...)
  2020-01-24  9:31 ` [PATCH 4.19 531/639] x86, perf: Fix the dependency of the x86 insn decoder selftest Greg Kroah-Hartman
@ 2020-01-24  9:31 ` Greg Kroah-Hartman
  2020-01-24  9:31 ` [PATCH 4.19 533/639] irqdomain: Add the missing assignment of domain->fwnode for named fwnode Greg Kroah-Hartman
                   ` (110 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Rui Miguel Silva, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit 329101244f214952606359d254ae883b7109e1a5 ]

The problem is in gb_lights_request_handler().  If we get a request to
change the config then we release the light with gb_lights_light_release()
and re-allocated it.  However, if the allocation fails part way through
then we call gb_lights_light_release() again.  This can lead to a couple
different double frees where we haven't cleared out the original values:

	gb_lights_light_v4l2_unregister(light);
	...
	kfree(light->channels);
	kfree(light->name);

I also made a small change to how we set "light->channels_count = 0;".
The original code handled this part fine and did not cause a use after
free but it was sort of complicated to read.

Fixes: 2870b52bae4c ("greybus: lights: add lights implementation")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Rui Miguel Silva <rmfrfs@gmail.com>
Link: https://lore.kernel.org/r/20190829122839.GA20116@mwanda
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/staging/greybus/light.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/staging/greybus/light.c b/drivers/staging/greybus/light.c
index 010ae1e9c7fbf..40680eaf3974f 100644
--- a/drivers/staging/greybus/light.c
+++ b/drivers/staging/greybus/light.c
@@ -1098,21 +1098,21 @@ static void gb_lights_channel_release(struct gb_channel *channel)
 static void gb_lights_light_release(struct gb_light *light)
 {
 	int i;
-	int count;
 
 	light->ready = false;
 
-	count = light->channels_count;
-
 	if (light->has_flash)
 		gb_lights_light_v4l2_unregister(light);
+	light->has_flash = false;
 
-	for (i = 0; i < count; i++) {
+	for (i = 0; i < light->channels_count; i++)
 		gb_lights_channel_release(&light->channels[i]);
-		light->channels_count--;
-	}
+	light->channels_count = 0;
+
 	kfree(light->channels);
+	light->channels = NULL;
 	kfree(light->name);
+	light->name = NULL;
 }
 
 static void gb_lights_release(struct gb_lights *glights)
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 533/639] irqdomain: Add the missing assignment of domain->fwnode for named fwnode
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (531 preceding siblings ...)
  2020-01-24  9:31 ` [PATCH 4.19 532/639] staging: greybus: light: fix a couple double frees Greg Kroah-Hartman
@ 2020-01-24  9:31 ` Greg Kroah-Hartman
  2020-01-24  9:31 ` [PATCH 4.19 534/639] bcma: fix incorrect update of BCMA_CORE_PCI_MDIO_DATA Greg Kroah-Hartman
                   ` (109 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lili Deng, Dexuan Cui, Marc Zyngier,
	Sasha Levin

From: Dexuan Cui <decui@microsoft.com>

[ Upstream commit 711419e504ebd68c8f03656616829c8ad7829389 ]

Recently device pass-through stops working for Linux VM running on Hyper-V.

git-bisect shows the regression is caused by the recent commit
467a3bb97432 ("PCI: hv: Allocate a named fwnode ..."), but the root cause
is that the commit d59f6617eef0 forgets to set the domain->fwnode for
IRQCHIP_FWNODE_NAMED*, and as a result:

1. The domain->fwnode remains to be NULL.

2. irq_find_matching_fwspec() returns NULL since "h->fwnode == fwnode" is
false, and pci_set_bus_msi_domain() sets the Hyper-V PCI root bus's
msi_domain to NULL.

3. When the device is added onto the root bus, the device's dev->msi_domain
is set to NULL in pci_set_msi_domain().

4. When a device driver tries to enable MSI-X, pci_msi_setup_msi_irqs()
calls arch_setup_msi_irqs(), which uses the native MSI chip (i.e.
arch/x86/kernel/apic/msi.c: pci_msi_controller) to set up the irqs, but
actually pci_msi_setup_msi_irqs() is supposed to call
msi_domain_alloc_irqs() with the hbus->irq_domain, which is created in
hv_pcie_init_irq_domain() and is associated with the Hyper-V chip
hv_msi_irq_chip. Consequently, the irq line is not properly set up, and
the device driver can not receive any interrupt.

Fixes: d59f6617eef0 ("genirq: Allow fwnode to carry name information only")
Fixes: 467a3bb97432 ("PCI: hv: Allocate a named fwnode instead of an address-based one")
Reported-by: Lili Deng <v-lide@microsoft.com>
Signed-off-by: Dexuan Cui <decui@microsoft.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/PU1P153MB01694D9AF625AC335C600C5FBFBE0@PU1P153MB0169.APCP153.PROD.OUTLOOK.COM
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/irq/irqdomain.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/kernel/irq/irqdomain.c b/kernel/irq/irqdomain.c
index 0b90be3607249..6e8520a81dd86 100644
--- a/kernel/irq/irqdomain.c
+++ b/kernel/irq/irqdomain.c
@@ -148,6 +148,7 @@ struct irq_domain *__irq_domain_add(struct fwnode_handle *fwnode, int size,
 		switch (fwid->type) {
 		case IRQCHIP_FWNODE_NAMED:
 		case IRQCHIP_FWNODE_NAMED_ID:
+			domain->fwnode = fwnode;
 			domain->name = kstrdup(fwid->name, GFP_KERNEL);
 			if (!domain->name) {
 				kfree(domain);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 534/639] bcma: fix incorrect update of BCMA_CORE_PCI_MDIO_DATA
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (532 preceding siblings ...)
  2020-01-24  9:31 ` [PATCH 4.19 533/639] irqdomain: Add the missing assignment of domain->fwnode for named fwnode Greg Kroah-Hartman
@ 2020-01-24  9:31 ` Greg Kroah-Hartman
  2020-01-24  9:31 ` [PATCH 4.19 535/639] usb: typec: tps6598x: Fix build error without CONFIG_REGMAP_I2C Greg Kroah-Hartman
                   ` (108 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Colin Ian King, Kalle Valo, Sasha Levin

From: Colin Ian King <colin.king@canonical.com>

[ Upstream commit 420c20be08a4597404d272ae9793b642401146eb ]

An earlier commit re-worked the setting of the bitmask and is now
assigning v with some bit flags rather than bitwise or-ing them
into v, consequently the earlier bit-settings of v are being lost.
Fix this by replacing an assignment with the bitwise or instead.

Addresses-Coverity: ("Unused value")
Fixes: 2be25cac8402 ("bcma: add constants for PCI and use them")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/bcma/driver_pci.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/bcma/driver_pci.c b/drivers/bcma/driver_pci.c
index f499a469e66d0..12b2cc9a3fbe8 100644
--- a/drivers/bcma/driver_pci.c
+++ b/drivers/bcma/driver_pci.c
@@ -78,7 +78,7 @@ static u16 bcma_pcie_mdio_read(struct bcma_drv_pci *pc, u16 device, u8 address)
 		v |= (address << BCMA_CORE_PCI_MDIODATA_REGADDR_SHF_OLD);
 	}
 
-	v = BCMA_CORE_PCI_MDIODATA_START;
+	v |= BCMA_CORE_PCI_MDIODATA_START;
 	v |= BCMA_CORE_PCI_MDIODATA_READ;
 	v |= BCMA_CORE_PCI_MDIODATA_TA;
 
@@ -121,7 +121,7 @@ static void bcma_pcie_mdio_write(struct bcma_drv_pci *pc, u16 device,
 		v |= (address << BCMA_CORE_PCI_MDIODATA_REGADDR_SHF_OLD);
 	}
 
-	v = BCMA_CORE_PCI_MDIODATA_START;
+	v |= BCMA_CORE_PCI_MDIODATA_START;
 	v |= BCMA_CORE_PCI_MDIODATA_WRITE;
 	v |= BCMA_CORE_PCI_MDIODATA_TA;
 	v |= data;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 535/639] usb: typec: tps6598x: Fix build error without CONFIG_REGMAP_I2C
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (533 preceding siblings ...)
  2020-01-24  9:31 ` [PATCH 4.19 534/639] bcma: fix incorrect update of BCMA_CORE_PCI_MDIO_DATA Greg Kroah-Hartman
@ 2020-01-24  9:31 ` Greg Kroah-Hartman
  2020-01-24  9:31 ` [PATCH 4.19 536/639] bcache: Fix an error code in bch_dump_read() Greg Kroah-Hartman
                   ` (107 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, YueHaibing,
	Heikki Krogerus, Sasha Levin

From: YueHaibing <yuehaibing@huawei.com>

[ Upstream commit 35af2445dc306403254a181507b390ec9eb725d5 ]

If CONFIG_REGMAP_I2C is not set, building fails:

drivers/usb/typec/tps6598x.o: In function `tps6598x_probe':
tps6598x.c:(.text+0x5f0): undefined reference to `__devm_regmap_init_i2c'

Select REGMAP_I2C to fix this.

Reported-by: Hulk Robot <hulkci@huawei.com>
Fixes: 0a4c005bd171 ("usb: typec: driver for TI TPS6598x USB Power Delivery controllers")
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Acked-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Link: https://lore.kernel.org/r/20190903121026.22148-1-yuehaibing@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/typec/Kconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/usb/typec/Kconfig b/drivers/usb/typec/Kconfig
index 00878c386dd09..8445890accdfe 100644
--- a/drivers/usb/typec/Kconfig
+++ b/drivers/usb/typec/Kconfig
@@ -95,6 +95,7 @@ source "drivers/usb/typec/ucsi/Kconfig"
 config TYPEC_TPS6598X
 	tristate "TI TPS6598x USB Power Delivery controller driver"
 	depends on I2C
+	select REGMAP_I2C
 	help
 	  Say Y or M here if your system has TI TPS65982 or TPS65983 USB Power
 	  Delivery controller.
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 536/639] bcache: Fix an error code in bch_dump_read()
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (534 preceding siblings ...)
  2020-01-24  9:31 ` [PATCH 4.19 535/639] usb: typec: tps6598x: Fix build error without CONFIG_REGMAP_I2C Greg Kroah-Hartman
@ 2020-01-24  9:31 ` Greg Kroah-Hartman
  2020-01-24  9:31 ` [PATCH 4.19 537/639] iio: dac: ad5380: fix incorrect assignment to val Greg Kroah-Hartman
                   ` (106 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Coly Li, Jens Axboe,
	Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit d66c9920c0cf984cf99cab5036fd5f3a1b7fba46 ]

The copy_to_user() function returns the number of bytes remaining to be
copied, but the intention here was to return -EFAULT if the copy fails.

Fixes: cafe56359144 ("bcache: A block layer cache")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Coly Li <colyli@suse.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/md/bcache/debug.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/drivers/md/bcache/debug.c b/drivers/md/bcache/debug.c
index 8c53d874ada4a..f6b60d5908f70 100644
--- a/drivers/md/bcache/debug.c
+++ b/drivers/md/bcache/debug.c
@@ -178,10 +178,9 @@ static ssize_t bch_dump_read(struct file *file, char __user *buf,
 	while (size) {
 		struct keybuf_key *w;
 		unsigned int bytes = min(i->bytes, size);
-		int err = copy_to_user(buf, i->buf, bytes);
 
-		if (err)
-			return err;
+		if (copy_to_user(buf, i->buf, bytes))
+			return -EFAULT;
 
 		ret	 += bytes;
 		buf	 += bytes;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 537/639] iio: dac: ad5380: fix incorrect assignment to val
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (535 preceding siblings ...)
  2020-01-24  9:31 ` [PATCH 4.19 536/639] bcache: Fix an error code in bch_dump_read() Greg Kroah-Hartman
@ 2020-01-24  9:31 ` Greg Kroah-Hartman
  2020-01-24  9:31 ` [PATCH 4.19 538/639] netfilter: ctnetlink: honor IPS_OFFLOAD flag Greg Kroah-Hartman
                   ` (105 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Colin Ian King, Alexandru Ardelean,
	Jonathan Cameron, Sasha Levin

From: Colin Ian King <colin.king@canonical.com>

[ Upstream commit b1e18768ef1214c0a8048327918a182cabe09f9d ]

Currently the pointer val is being incorrectly incremented
instead of the value pointed to by val. Fix this by adding
in the missing * indirection operator.

Addresses-Coverity: ("Unused value")
Fixes: c03f2c536818 ("staging:iio:dac: Add AD5380 driver")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Reviewed-by: Alexandru Ardelean <alexandru.ardelean@analog.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iio/dac/ad5380.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/iio/dac/ad5380.c b/drivers/iio/dac/ad5380.c
index 873c2bf637c0c..617c9f7fe59a1 100644
--- a/drivers/iio/dac/ad5380.c
+++ b/drivers/iio/dac/ad5380.c
@@ -221,7 +221,7 @@ static int ad5380_read_raw(struct iio_dev *indio_dev,
 		if (ret)
 			return ret;
 		*val >>= chan->scan_type.shift;
-		val -= (1 << chan->scan_type.realbits) / 2;
+		*val -= (1 << chan->scan_type.realbits) / 2;
 		return IIO_VAL_INT;
 	case IIO_CHAN_INFO_SCALE:
 		*val = 2 * st->vref;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 538/639] netfilter: ctnetlink: honor IPS_OFFLOAD flag
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (536 preceding siblings ...)
  2020-01-24  9:31 ` [PATCH 4.19 537/639] iio: dac: ad5380: fix incorrect assignment to val Greg Kroah-Hartman
@ 2020-01-24  9:31 ` Greg Kroah-Hartman
  2020-01-24  9:31 ` [PATCH 4.19 539/639] ath9k: dynack: fix possible deadlock in ath_dynack_node_{de}init Greg Kroah-Hartman
                   ` (104 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:31 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Pablo Neira Ayuso, Sasha Levin

From: Pablo Neira Ayuso <pablo@netfilter.org>

[ Upstream commit b067fa009c884401d23846251031c1f14d8a9c77 ]

If this flag is set, timeout and state are irrelevant to userspace.

Fixes: 90964016e5d3 ("netfilter: nf_conntrack: add IPS_OFFLOAD status bit")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/netfilter/nf_conntrack_netlink.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 7ba9ea55816a6..31fa94064a620 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -555,10 +555,8 @@ ctnetlink_fill_info(struct sk_buff *skb, u32 portid, u32 seq, u32 type,
 		goto nla_put_failure;
 
 	if (ctnetlink_dump_status(skb, ct) < 0 ||
-	    ctnetlink_dump_timeout(skb, ct) < 0 ||
 	    ctnetlink_dump_acct(skb, ct, type) < 0 ||
 	    ctnetlink_dump_timestamp(skb, ct) < 0 ||
-	    ctnetlink_dump_protoinfo(skb, ct) < 0 ||
 	    ctnetlink_dump_helpinfo(skb, ct) < 0 ||
 	    ctnetlink_dump_mark(skb, ct) < 0 ||
 	    ctnetlink_dump_secctx(skb, ct) < 0 ||
@@ -570,6 +568,11 @@ ctnetlink_fill_info(struct sk_buff *skb, u32 portid, u32 seq, u32 type,
 	    ctnetlink_dump_ct_synproxy(skb, ct) < 0)
 		goto nla_put_failure;
 
+	if (!test_bit(IPS_OFFLOAD_BIT, &ct->status) &&
+	    (ctnetlink_dump_timeout(skb, ct) < 0 ||
+	     ctnetlink_dump_protoinfo(skb, ct) < 0))
+		goto nla_put_failure;
+
 	nlmsg_end(skb, nlh);
 	return skb->len;
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 539/639] ath9k: dynack: fix possible deadlock in ath_dynack_node_{de}init
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (537 preceding siblings ...)
  2020-01-24  9:31 ` [PATCH 4.19 538/639] netfilter: ctnetlink: honor IPS_OFFLOAD flag Greg Kroah-Hartman
@ 2020-01-24  9:31 ` Greg Kroah-Hartman
  2020-01-24  9:31 ` [PATCH 4.19 540/639] wcn36xx: use dynamic allocation for large variables Greg Kroah-Hartman
                   ` (103 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lorenzo Bianconi, Koen Vandeputte,
	Kalle Valo, Sasha Levin

From: Lorenzo Bianconi <lorenzo@kernel.org>

[ Upstream commit e1aa1a1db3b01c9890e82cf065cee99962ba1ed9 ]

Fix following lockdep warning disabling bh in
ath_dynack_node_init/ath_dynack_node_deinit

[   75.955878] --------------------------------
[   75.955880] inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage.
[   75.955884] swapper/0/0 [HC0[0]:SC1[3]:HE1:SE0] takes:
[   75.955888] 00000000792a7ee0 (&(&da->qlock)->rlock){+.?.}, at: ath_dynack_sample_ack_ts+0x4d/0xa0 [ath9k_hw]
[   75.955905] {SOFTIRQ-ON-W} state was registered at:
[   75.955912]   lock_acquire+0x9a/0x160
[   75.955917]   _raw_spin_lock+0x2c/0x70
[   75.955927]   ath_dynack_node_init+0x2a/0x60 [ath9k_hw]
[   75.955934]   ath9k_sta_state+0xec/0x160 [ath9k]
[   75.955976]   drv_sta_state+0xb2/0x740 [mac80211]
[   75.956008]   sta_info_insert_finish+0x21a/0x420 [mac80211]
[   75.956039]   sta_info_insert_rcu+0x12b/0x2c0 [mac80211]
[   75.956069]   sta_info_insert+0x7/0x70 [mac80211]
[   75.956093]   ieee80211_prep_connection+0x42e/0x730 [mac80211]
[   75.956120]   ieee80211_mgd_auth.cold+0xb9/0x15c [mac80211]
[   75.956152]   cfg80211_mlme_auth+0x143/0x350 [cfg80211]
[   75.956169]   nl80211_authenticate+0x25e/0x2b0 [cfg80211]
[   75.956172]   genl_family_rcv_msg+0x198/0x400
[   75.956174]   genl_rcv_msg+0x42/0x90
[   75.956176]   netlink_rcv_skb+0x35/0xf0
[   75.956178]   genl_rcv+0x1f/0x30
[   75.956180]   netlink_unicast+0x154/0x200
[   75.956182]   netlink_sendmsg+0x1bf/0x3d0
[   75.956186]   ___sys_sendmsg+0x2c2/0x2f0
[   75.956187]   __sys_sendmsg+0x44/0x80
[   75.956190]   do_syscall_64+0x55/0x1a0
[   75.956192]   entry_SYSCALL_64_after_hwframe+0x49/0xbe
[   75.956194] irq event stamp: 2357092
[   75.956196] hardirqs last  enabled at (2357092): [<ffffffff818c62de>] _raw_spin_unlock_irqrestore+0x3e/0x50
[   75.956199] hardirqs last disabled at (2357091): [<ffffffff818c60b1>] _raw_spin_lock_irqsave+0x11/0x80
[   75.956202] softirqs last  enabled at (2357072): [<ffffffff8106dc09>] irq_enter+0x59/0x60
[   75.956204] softirqs last disabled at (2357073): [<ffffffff8106dcbe>] irq_exit+0xae/0xc0
[   75.956206]
               other info that might help us debug this:
[   75.956207]  Possible unsafe locking scenario:

[   75.956208]        CPU0
[   75.956209]        ----
[   75.956210]   lock(&(&da->qlock)->rlock);
[   75.956213]   <Interrupt>
[   75.956214]     lock(&(&da->qlock)->rlock);
[   75.956216]
                *** DEADLOCK ***

[   75.956217] 1 lock held by swapper/0/0:
[   75.956219]  #0: 000000003bb5675c (&(&sc->sc_pcu_lock)->rlock){+.-.}, at: ath9k_tasklet+0x55/0x240 [ath9k]
[   75.956225]
               stack backtrace:
[   75.956228] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.3.0-rc1-wdn+ #13
[   75.956229] Hardware name: Dell Inc. Studio XPS 1340/0K183D, BIOS A11 09/08/2009
[   75.956231] Call Trace:
[   75.956233]  <IRQ>
[   75.956236]  dump_stack+0x67/0x90
[   75.956239]  mark_lock+0x4c1/0x640
[   75.956242]  ? check_usage_backwards+0x130/0x130
[   75.956245]  ? sched_clock_local+0x12/0x80
[   75.956247]  __lock_acquire+0x484/0x7a0
[   75.956250]  ? __lock_acquire+0x3b9/0x7a0
[   75.956252]  lock_acquire+0x9a/0x160
[   75.956259]  ? ath_dynack_sample_ack_ts+0x4d/0xa0 [ath9k_hw]
[   75.956262]  _raw_spin_lock_bh+0x34/0x80
[   75.956268]  ? ath_dynack_sample_ack_ts+0x4d/0xa0 [ath9k_hw]
[   75.956275]  ath_dynack_sample_ack_ts+0x4d/0xa0 [ath9k_hw]
[   75.956280]  ath_rx_tasklet+0xd09/0xe90 [ath9k]
[   75.956286]  ath9k_tasklet+0x102/0x240 [ath9k]
[   75.956288]  tasklet_action_common.isra.0+0x6d/0x170
[   75.956291]  __do_softirq+0xcc/0x425
[   75.956294]  irq_exit+0xae/0xc0
[   75.956296]  do_IRQ+0x8a/0x110
[   75.956298]  common_interrupt+0xf/0xf
[   75.956300]  </IRQ>
[   75.956303] RIP: 0010:cpuidle_enter_state+0xb2/0x400
[   75.956308] RSP: 0018:ffffffff82203e70 EFLAGS: 00000202 ORIG_RAX: ffffffffffffffd7
[   75.956310] RAX: ffffffff82219800 RBX: ffffffff822bd0a0 RCX: 0000000000000000
[   75.956312] RDX: 0000000000000046 RSI: 0000000000000006 RDI: ffffffff82219800
[   75.956314] RBP: ffff888155a01c00 R08: 00000011af51aabe R09: 0000000000000000
[   75.956315] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000002
[   75.956317] R13: 00000011af51aabe R14: 0000000000000003 R15: ffffffff82219800
[   75.956321]  cpuidle_enter+0x24/0x40
[   75.956323]  do_idle+0x1ac/0x220
[   75.956326]  cpu_startup_entry+0x14/0x20
[   75.956329]  start_kernel+0x482/0x489
[   75.956332]  secondary_startup_64+0xa4/0xb0

Fixes: c774d57fd47c ("ath9k: add dynamic ACK timeout estimation")
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Tested-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath9k/dynack.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/net/wireless/ath/ath9k/dynack.c b/drivers/net/wireless/ath/ath9k/dynack.c
index 6e236a4854311..71b4888b30e71 100644
--- a/drivers/net/wireless/ath/ath9k/dynack.c
+++ b/drivers/net/wireless/ath/ath9k/dynack.c
@@ -300,9 +300,9 @@ void ath_dynack_node_init(struct ath_hw *ah, struct ath_node *an)
 
 	an->ackto = ackto;
 
-	spin_lock(&da->qlock);
+	spin_lock_bh(&da->qlock);
 	list_add_tail(&an->list, &da->nodes);
-	spin_unlock(&da->qlock);
+	spin_unlock_bh(&da->qlock);
 }
 EXPORT_SYMBOL(ath_dynack_node_init);
 
@@ -316,9 +316,9 @@ void ath_dynack_node_deinit(struct ath_hw *ah, struct ath_node *an)
 {
 	struct ath_dynack *da = &ah->dynack;
 
-	spin_lock(&da->qlock);
+	spin_lock_bh(&da->qlock);
 	list_del(&an->list);
-	spin_unlock(&da->qlock);
+	spin_unlock_bh(&da->qlock);
 }
 EXPORT_SYMBOL(ath_dynack_node_deinit);
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 540/639] wcn36xx: use dynamic allocation for large variables
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (538 preceding siblings ...)
  2020-01-24  9:31 ` [PATCH 4.19 539/639] ath9k: dynack: fix possible deadlock in ath_dynack_node_{de}init Greg Kroah-Hartman
@ 2020-01-24  9:31 ` Greg Kroah-Hartman
  2020-01-26 11:36   ` Pavel Machek
  2020-01-24  9:31 ` [PATCH 4.19 541/639] tty: serial: fsl_lpuart: Use appropriate lpuart32_* I/O funcs Greg Kroah-Hartman
                   ` (102 subsequent siblings)
  642 siblings, 1 reply; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Arnd Bergmann, Kalle Valo, Sasha Levin

From: Arnd Bergmann <arnd@arndb.de>

[ Upstream commit 355cf31912014e6ff1bb1019ae4858cad12c68cf ]

clang triggers a warning about oversized stack frames that gcc does not
notice because of slightly different inlining decisions:

ath/wcn36xx/smd.c:1409:5: error: stack frame size of 1040 bytes in function 'wcn36xx_smd_config_bss' [-Werror,-Wframe-larger-than=]
ath/wcn36xx/smd.c:640:5: error: stack frame size of 1032 bytes in function 'wcn36xx_smd_start_hw_scan' [-Werror,-Wframe-larger-than=]

Basically the wcn36xx_hal_start_scan_offload_req_msg,
wcn36xx_hal_config_bss_req_msg_v1, and wcn36xx_hal_config_bss_req_msg
structures are too large to be put on the kernel stack, but small
enough that gcc does not warn about them.

Use kzalloc() to allocate them all. There are similar structures in other
parts of this driver, but they are all smaller, with the next largest
stack frame at 480 bytes for wcn36xx_smd_send_beacon.

Fixes: 8e84c2582169 ("wcn36xx: mac80211 driver for Qualcomm WCN3660/WCN3680 hardware")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/wcn36xx/smd.c | 186 ++++++++++++++-----------
 1 file changed, 105 insertions(+), 81 deletions(-)

diff --git a/drivers/net/wireless/ath/wcn36xx/smd.c b/drivers/net/wireless/ath/wcn36xx/smd.c
index 00098f24116de..6cd113b3b3e49 100644
--- a/drivers/net/wireless/ath/wcn36xx/smd.c
+++ b/drivers/net/wireless/ath/wcn36xx/smd.c
@@ -641,52 +641,58 @@ int wcn36xx_smd_start_hw_scan(struct wcn36xx *wcn, struct ieee80211_vif *vif,
 			      struct cfg80211_scan_request *req)
 {
 	struct wcn36xx_vif *vif_priv = wcn36xx_vif_to_priv(vif);
-	struct wcn36xx_hal_start_scan_offload_req_msg msg_body;
+	struct wcn36xx_hal_start_scan_offload_req_msg *msg_body;
 	int ret, i;
 
 	if (req->ie_len > WCN36XX_MAX_SCAN_IE_LEN)
 		return -EINVAL;
 
 	mutex_lock(&wcn->hal_mutex);
-	INIT_HAL_MSG(msg_body, WCN36XX_HAL_START_SCAN_OFFLOAD_REQ);
+	msg_body = kzalloc(sizeof(*msg_body), GFP_KERNEL);
+	if (!msg_body) {
+		ret = -ENOMEM;
+		goto out;
+	}
 
-	msg_body.scan_type = WCN36XX_HAL_SCAN_TYPE_ACTIVE;
-	msg_body.min_ch_time = 30;
-	msg_body.max_ch_time = 100;
-	msg_body.scan_hidden = 1;
-	memcpy(msg_body.mac, vif->addr, ETH_ALEN);
-	msg_body.bss_type = vif_priv->bss_type;
-	msg_body.p2p_search = vif->p2p;
+	INIT_HAL_MSG((*msg_body), WCN36XX_HAL_START_SCAN_OFFLOAD_REQ);
 
-	msg_body.num_ssid = min_t(u8, req->n_ssids, ARRAY_SIZE(msg_body.ssids));
-	for (i = 0; i < msg_body.num_ssid; i++) {
-		msg_body.ssids[i].length = min_t(u8, req->ssids[i].ssid_len,
-						sizeof(msg_body.ssids[i].ssid));
-		memcpy(msg_body.ssids[i].ssid, req->ssids[i].ssid,
-		       msg_body.ssids[i].length);
+	msg_body->scan_type = WCN36XX_HAL_SCAN_TYPE_ACTIVE;
+	msg_body->min_ch_time = 30;
+	msg_body->max_ch_time = 100;
+	msg_body->scan_hidden = 1;
+	memcpy(msg_body->mac, vif->addr, ETH_ALEN);
+	msg_body->bss_type = vif_priv->bss_type;
+	msg_body->p2p_search = vif->p2p;
+
+	msg_body->num_ssid = min_t(u8, req->n_ssids, ARRAY_SIZE(msg_body->ssids));
+	for (i = 0; i < msg_body->num_ssid; i++) {
+		msg_body->ssids[i].length = min_t(u8, req->ssids[i].ssid_len,
+						sizeof(msg_body->ssids[i].ssid));
+		memcpy(msg_body->ssids[i].ssid, req->ssids[i].ssid,
+		       msg_body->ssids[i].length);
 	}
 
-	msg_body.num_channel = min_t(u8, req->n_channels,
-				     sizeof(msg_body.channels));
-	for (i = 0; i < msg_body.num_channel; i++)
-		msg_body.channels[i] = req->channels[i]->hw_value;
+	msg_body->num_channel = min_t(u8, req->n_channels,
+				     sizeof(msg_body->channels));
+	for (i = 0; i < msg_body->num_channel; i++)
+		msg_body->channels[i] = req->channels[i]->hw_value;
 
-	msg_body.header.len -= WCN36XX_MAX_SCAN_IE_LEN;
+	msg_body->header.len -= WCN36XX_MAX_SCAN_IE_LEN;
 
 	if (req->ie_len > 0) {
-		msg_body.ie_len = req->ie_len;
-		msg_body.header.len += req->ie_len;
-		memcpy(msg_body.ie, req->ie, req->ie_len);
+		msg_body->ie_len = req->ie_len;
+		msg_body->header.len += req->ie_len;
+		memcpy(msg_body->ie, req->ie, req->ie_len);
 	}
 
-	PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+	PREPARE_HAL_BUF(wcn->hal_buf, (*msg_body));
 
 	wcn36xx_dbg(WCN36XX_DBG_HAL,
 		    "hal start hw-scan (channels: %u; ssids: %u; p2p: %s)\n",
-		    msg_body.num_channel, msg_body.num_ssid,
-		    msg_body.p2p_search ? "yes" : "no");
+		    msg_body->num_channel, msg_body->num_ssid,
+		    msg_body->p2p_search ? "yes" : "no");
 
-	ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+	ret = wcn36xx_smd_send_and_wait(wcn, msg_body->header.len);
 	if (ret) {
 		wcn36xx_err("Sending hal_start_scan_offload failed\n");
 		goto out;
@@ -698,6 +704,7 @@ int wcn36xx_smd_start_hw_scan(struct wcn36xx *wcn, struct ieee80211_vif *vif,
 		goto out;
 	}
 out:
+	kfree(msg_body);
 	mutex_unlock(&wcn->hal_mutex);
 	return ret;
 }
@@ -1257,96 +1264,104 @@ out:
 static int wcn36xx_smd_config_bss_v1(struct wcn36xx *wcn,
 			const struct wcn36xx_hal_config_bss_req_msg *orig)
 {
-	struct wcn36xx_hal_config_bss_req_msg_v1 msg_body;
-	struct wcn36xx_hal_config_bss_params_v1 *bss = &msg_body.bss_params;
-	struct wcn36xx_hal_config_sta_params_v1 *sta = &bss->sta;
+	struct wcn36xx_hal_config_bss_req_msg_v1 *msg_body;
+	struct wcn36xx_hal_config_bss_params_v1 *bss;
+	struct wcn36xx_hal_config_sta_params_v1 *sta;
+	int ret;
+
+	msg_body = kzalloc(sizeof(*msg_body), GFP_KERNEL);
+	if (!msg_body)
+		return -ENOMEM;
+
+	INIT_HAL_MSG((*msg_body), WCN36XX_HAL_CONFIG_BSS_REQ);
 
-	INIT_HAL_MSG(msg_body, WCN36XX_HAL_CONFIG_BSS_REQ);
+	bss = &msg_body->bss_params;
+	sta = &bss->sta;
 
 	/* convert orig to v1 */
-	memcpy(&msg_body.bss_params.bssid,
+	memcpy(&msg_body->bss_params.bssid,
 	       &orig->bss_params.bssid, ETH_ALEN);
-	memcpy(&msg_body.bss_params.self_mac_addr,
+	memcpy(&msg_body->bss_params.self_mac_addr,
 	       &orig->bss_params.self_mac_addr, ETH_ALEN);
 
-	msg_body.bss_params.bss_type = orig->bss_params.bss_type;
-	msg_body.bss_params.oper_mode = orig->bss_params.oper_mode;
-	msg_body.bss_params.nw_type = orig->bss_params.nw_type;
+	msg_body->bss_params.bss_type = orig->bss_params.bss_type;
+	msg_body->bss_params.oper_mode = orig->bss_params.oper_mode;
+	msg_body->bss_params.nw_type = orig->bss_params.nw_type;
 
-	msg_body.bss_params.short_slot_time_supported =
+	msg_body->bss_params.short_slot_time_supported =
 		orig->bss_params.short_slot_time_supported;
-	msg_body.bss_params.lla_coexist = orig->bss_params.lla_coexist;
-	msg_body.bss_params.llb_coexist = orig->bss_params.llb_coexist;
-	msg_body.bss_params.llg_coexist = orig->bss_params.llg_coexist;
-	msg_body.bss_params.ht20_coexist = orig->bss_params.ht20_coexist;
-	msg_body.bss_params.lln_non_gf_coexist =
+	msg_body->bss_params.lla_coexist = orig->bss_params.lla_coexist;
+	msg_body->bss_params.llb_coexist = orig->bss_params.llb_coexist;
+	msg_body->bss_params.llg_coexist = orig->bss_params.llg_coexist;
+	msg_body->bss_params.ht20_coexist = orig->bss_params.ht20_coexist;
+	msg_body->bss_params.lln_non_gf_coexist =
 		orig->bss_params.lln_non_gf_coexist;
 
-	msg_body.bss_params.lsig_tx_op_protection_full_support =
+	msg_body->bss_params.lsig_tx_op_protection_full_support =
 		orig->bss_params.lsig_tx_op_protection_full_support;
-	msg_body.bss_params.rifs_mode = orig->bss_params.rifs_mode;
-	msg_body.bss_params.beacon_interval = orig->bss_params.beacon_interval;
-	msg_body.bss_params.dtim_period = orig->bss_params.dtim_period;
-	msg_body.bss_params.tx_channel_width_set =
+	msg_body->bss_params.rifs_mode = orig->bss_params.rifs_mode;
+	msg_body->bss_params.beacon_interval = orig->bss_params.beacon_interval;
+	msg_body->bss_params.dtim_period = orig->bss_params.dtim_period;
+	msg_body->bss_params.tx_channel_width_set =
 		orig->bss_params.tx_channel_width_set;
-	msg_body.bss_params.oper_channel = orig->bss_params.oper_channel;
-	msg_body.bss_params.ext_channel = orig->bss_params.ext_channel;
+	msg_body->bss_params.oper_channel = orig->bss_params.oper_channel;
+	msg_body->bss_params.ext_channel = orig->bss_params.ext_channel;
 
-	msg_body.bss_params.reserved = orig->bss_params.reserved;
+	msg_body->bss_params.reserved = orig->bss_params.reserved;
 
-	memcpy(&msg_body.bss_params.ssid,
+	memcpy(&msg_body->bss_params.ssid,
 	       &orig->bss_params.ssid,
 	       sizeof(orig->bss_params.ssid));
 
-	msg_body.bss_params.action = orig->bss_params.action;
-	msg_body.bss_params.rateset = orig->bss_params.rateset;
-	msg_body.bss_params.ht = orig->bss_params.ht;
-	msg_body.bss_params.obss_prot_enabled =
+	msg_body->bss_params.action = orig->bss_params.action;
+	msg_body->bss_params.rateset = orig->bss_params.rateset;
+	msg_body->bss_params.ht = orig->bss_params.ht;
+	msg_body->bss_params.obss_prot_enabled =
 		orig->bss_params.obss_prot_enabled;
-	msg_body.bss_params.rmf = orig->bss_params.rmf;
-	msg_body.bss_params.ht_oper_mode = orig->bss_params.ht_oper_mode;
-	msg_body.bss_params.dual_cts_protection =
+	msg_body->bss_params.rmf = orig->bss_params.rmf;
+	msg_body->bss_params.ht_oper_mode = orig->bss_params.ht_oper_mode;
+	msg_body->bss_params.dual_cts_protection =
 		orig->bss_params.dual_cts_protection;
 
-	msg_body.bss_params.max_probe_resp_retry_limit =
+	msg_body->bss_params.max_probe_resp_retry_limit =
 		orig->bss_params.max_probe_resp_retry_limit;
-	msg_body.bss_params.hidden_ssid = orig->bss_params.hidden_ssid;
-	msg_body.bss_params.proxy_probe_resp =
+	msg_body->bss_params.hidden_ssid = orig->bss_params.hidden_ssid;
+	msg_body->bss_params.proxy_probe_resp =
 		orig->bss_params.proxy_probe_resp;
-	msg_body.bss_params.edca_params_valid =
+	msg_body->bss_params.edca_params_valid =
 		orig->bss_params.edca_params_valid;
 
-	memcpy(&msg_body.bss_params.acbe,
+	memcpy(&msg_body->bss_params.acbe,
 	       &orig->bss_params.acbe,
 	       sizeof(orig->bss_params.acbe));
-	memcpy(&msg_body.bss_params.acbk,
+	memcpy(&msg_body->bss_params.acbk,
 	       &orig->bss_params.acbk,
 	       sizeof(orig->bss_params.acbk));
-	memcpy(&msg_body.bss_params.acvi,
+	memcpy(&msg_body->bss_params.acvi,
 	       &orig->bss_params.acvi,
 	       sizeof(orig->bss_params.acvi));
-	memcpy(&msg_body.bss_params.acvo,
+	memcpy(&msg_body->bss_params.acvo,
 	       &orig->bss_params.acvo,
 	       sizeof(orig->bss_params.acvo));
 
-	msg_body.bss_params.ext_set_sta_key_param_valid =
+	msg_body->bss_params.ext_set_sta_key_param_valid =
 		orig->bss_params.ext_set_sta_key_param_valid;
 
-	memcpy(&msg_body.bss_params.ext_set_sta_key_param,
+	memcpy(&msg_body->bss_params.ext_set_sta_key_param,
 	       &orig->bss_params.ext_set_sta_key_param,
 	       sizeof(orig->bss_params.acvo));
 
-	msg_body.bss_params.wcn36xx_hal_persona =
+	msg_body->bss_params.wcn36xx_hal_persona =
 		orig->bss_params.wcn36xx_hal_persona;
-	msg_body.bss_params.spectrum_mgt_enable =
+	msg_body->bss_params.spectrum_mgt_enable =
 		orig->bss_params.spectrum_mgt_enable;
-	msg_body.bss_params.tx_mgmt_power = orig->bss_params.tx_mgmt_power;
-	msg_body.bss_params.max_tx_power = orig->bss_params.max_tx_power;
+	msg_body->bss_params.tx_mgmt_power = orig->bss_params.tx_mgmt_power;
+	msg_body->bss_params.max_tx_power = orig->bss_params.max_tx_power;
 
 	wcn36xx_smd_convert_sta_to_v1(wcn, &orig->bss_params.sta,
-				      &msg_body.bss_params.sta);
+				      &msg_body->bss_params.sta);
 
-	PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
+	PREPARE_HAL_BUF(wcn->hal_buf, (*msg_body));
 
 	wcn36xx_dbg(WCN36XX_DBG_HAL,
 		    "hal config bss v1 bssid %pM self_mac_addr %pM bss_type %d oper_mode %d nw_type %d\n",
@@ -1358,7 +1373,10 @@ static int wcn36xx_smd_config_bss_v1(struct wcn36xx *wcn,
 		    sta->bssid, sta->action, sta->sta_index,
 		    sta->bssid_index, sta->aid, sta->type, sta->mac);
 
-	return wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+	ret = wcn36xx_smd_send_and_wait(wcn, msg_body->header.len);
+	kfree(msg_body);
+
+	return ret;
 }
 
 
@@ -1410,16 +1428,21 @@ int wcn36xx_smd_config_bss(struct wcn36xx *wcn, struct ieee80211_vif *vif,
 			   struct ieee80211_sta *sta, const u8 *bssid,
 			   bool update)
 {
-	struct wcn36xx_hal_config_bss_req_msg msg;
+	struct wcn36xx_hal_config_bss_req_msg *msg;
 	struct wcn36xx_hal_config_bss_params *bss;
 	struct wcn36xx_hal_config_sta_params *sta_params;
 	struct wcn36xx_vif *vif_priv = wcn36xx_vif_to_priv(vif);
 	int ret;
 
 	mutex_lock(&wcn->hal_mutex);
-	INIT_HAL_MSG(msg, WCN36XX_HAL_CONFIG_BSS_REQ);
+	msg = kzalloc(sizeof(*msg), GFP_KERNEL);
+	if (!msg) {
+		ret = -ENOMEM;
+		goto out;
+	}
+	INIT_HAL_MSG((*msg), WCN36XX_HAL_CONFIG_BSS_REQ);
 
-	bss = &msg.bss_params;
+	bss = &msg->bss_params;
 	sta_params = &bss->sta;
 
 	WARN_ON(is_zero_ether_addr(bssid));
@@ -1514,11 +1537,11 @@ int wcn36xx_smd_config_bss(struct wcn36xx *wcn, struct ieee80211_vif *vif,
 		    sta_params->mac);
 
 	if (!wcn36xx_is_fw_version(wcn, 1, 2, 2, 24)) {
-		ret = wcn36xx_smd_config_bss_v1(wcn, &msg);
+		ret = wcn36xx_smd_config_bss_v1(wcn, msg);
 	} else {
-		PREPARE_HAL_BUF(wcn->hal_buf, msg);
+		PREPARE_HAL_BUF(wcn->hal_buf, (*msg));
 
-		ret = wcn36xx_smd_send_and_wait(wcn, msg.header.len);
+		ret = wcn36xx_smd_send_and_wait(wcn, msg->header.len);
 	}
 	if (ret) {
 		wcn36xx_err("Sending hal_config_bss failed\n");
@@ -1534,6 +1557,7 @@ int wcn36xx_smd_config_bss(struct wcn36xx *wcn, struct ieee80211_vif *vif,
 		goto out;
 	}
 out:
+	kfree(msg);
 	mutex_unlock(&wcn->hal_mutex);
 	return ret;
 }
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 541/639] tty: serial: fsl_lpuart: Use appropriate lpuart32_* I/O funcs
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (539 preceding siblings ...)
  2020-01-24  9:31 ` [PATCH 4.19 540/639] wcn36xx: use dynamic allocation for large variables Greg Kroah-Hartman
@ 2020-01-24  9:31 ` Greg Kroah-Hartman
  2020-01-24  9:31 ` [PATCH 4.19 542/639] ARM: dts: aspeed-g5: Fixe gpio-ranges upper limit Greg Kroah-Hartman
                   ` (101 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Andrey Smirnov, Stefan Agner,
	Bhuvanchandra DV, Chris Healy, Cory Tusar, Lucas Stach,
	Jiri Slaby, linux-imx, linux-serial, Sasha Levin

From: Andrey Smirnov <andrew.smirnov@gmail.com>

[ Upstream commit 1da17d7cf8e2c4b60163d54300f72c02f510327c ]

When dealing with 32-bit variant of LPUART IP block appropriate I/O
helpers have to be used to properly deal with endianness
differences. Change all of the offending code to do that.

Fixes: a5fa2660d787 ("tty/serial/fsl_lpuart: Add CONSOLE_POLL support
for lpuart32.")
Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com>
Cc: Stefan Agner <stefan@agner.ch>
Cc: Bhuvanchandra DV <bhuvanchandra.dv@toradex.com>
Cc: Chris Healy <cphealy@gmail.com>
Cc: Cory Tusar <cory.tusar@zii.aero>
Cc: Lucas Stach <l.stach@pengutronix.de>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Jiri Slaby <jslaby@suse.com>
Cc: linux-imx@nxp.com
Cc: linux-serial@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Link: https://lore.kernel.org/r/20190729195226.8862-14-andrew.smirnov@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/serial/fsl_lpuart.c | 28 ++++++++++++++--------------
 1 file changed, 14 insertions(+), 14 deletions(-)

diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c
index ee8a5cb61a5f1..2daccb10ae2f3 100644
--- a/drivers/tty/serial/fsl_lpuart.c
+++ b/drivers/tty/serial/fsl_lpuart.c
@@ -528,26 +528,26 @@ static int lpuart32_poll_init(struct uart_port *port)
 	spin_lock_irqsave(&sport->port.lock, flags);
 
 	/* Disable Rx & Tx */
-	writel(0, sport->port.membase + UARTCTRL);
+	lpuart32_write(&sport->port, UARTCTRL, 0);
 
-	temp = readl(sport->port.membase + UARTFIFO);
+	temp = lpuart32_read(&sport->port, UARTFIFO);
 
 	/* Enable Rx and Tx FIFO */
-	writel(temp | UARTFIFO_RXFE | UARTFIFO_TXFE,
-		   sport->port.membase + UARTFIFO);
+	lpuart32_write(&sport->port, UARTFIFO,
+		       temp | UARTFIFO_RXFE | UARTFIFO_TXFE);
 
 	/* flush Tx and Rx FIFO */
-	writel(UARTFIFO_TXFLUSH | UARTFIFO_RXFLUSH,
-			sport->port.membase + UARTFIFO);
+	lpuart32_write(&sport->port, UARTFIFO,
+		       UARTFIFO_TXFLUSH | UARTFIFO_RXFLUSH);
 
 	/* explicitly clear RDRF */
-	if (readl(sport->port.membase + UARTSTAT) & UARTSTAT_RDRF) {
-		readl(sport->port.membase + UARTDATA);
-		writel(UARTFIFO_RXUF, sport->port.membase + UARTFIFO);
+	if (lpuart32_read(&sport->port, UARTSTAT) & UARTSTAT_RDRF) {
+		lpuart32_read(&sport->port, UARTDATA);
+		lpuart32_write(&sport->port, UARTFIFO, UARTFIFO_RXUF);
 	}
 
 	/* Enable Rx and Tx */
-	writel(UARTCTRL_RE | UARTCTRL_TE, sport->port.membase + UARTCTRL);
+	lpuart32_write(&sport->port, UARTCTRL, UARTCTRL_RE | UARTCTRL_TE);
 	spin_unlock_irqrestore(&sport->port.lock, flags);
 
 	return 0;
@@ -555,18 +555,18 @@ static int lpuart32_poll_init(struct uart_port *port)
 
 static void lpuart32_poll_put_char(struct uart_port *port, unsigned char c)
 {
-	while (!(readl(port->membase + UARTSTAT) & UARTSTAT_TDRE))
+	while (!(lpuart32_read(port, UARTSTAT) & UARTSTAT_TDRE))
 		barrier();
 
-	writel(c, port->membase + UARTDATA);
+	lpuart32_write(port, UARTDATA, c);
 }
 
 static int lpuart32_poll_get_char(struct uart_port *port)
 {
-	if (!(readl(port->membase + UARTSTAT) & UARTSTAT_RDRF))
+	if (!(lpuart32_read(port, UARTSTAT) & UARTSTAT_RDRF))
 		return NO_POLL_CHAR;
 
-	return readl(port->membase + UARTDATA);
+	return lpuart32_read(port, UARTDATA);
 }
 #endif
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 542/639] ARM: dts: aspeed-g5: Fixe gpio-ranges upper limit
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (540 preceding siblings ...)
  2020-01-24  9:31 ` [PATCH 4.19 541/639] tty: serial: fsl_lpuart: Use appropriate lpuart32_* I/O funcs Greg Kroah-Hartman
@ 2020-01-24  9:31 ` Greg Kroah-Hartman
  2020-01-24  9:31 ` [PATCH 4.19 543/639] xsk: avoid store-tearing when assigning queues Greg Kroah-Hartman
                   ` (100 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Oscar A Perez, Andrew Jeffery,
	Joel Stanley, Sasha Levin

From: Oscar A Perez <linux@neuralgames.com>

[ Upstream commit 89b97c429e2e77d695b5133572ca12ec256a4ea4 ]

According to the AST2500/AST2520 specs, these SoCs support up to 228 GPIO
pins. However, 'gpio-ranges' value in 'aspeed-g5.dtsi' file is currently
setting the upper limit to 220 which isn't allowing access to all their
GPIOs. The correct upper limit value is 232 (actual number is 228 plus a
4-GPIO hole in GPIOAB). Without this patch, GPIOs AC5 and AC6 do not work
correctly on a AST2500 BMC running Linux Kernel v4.19

Fixes: 2039f90d136c ("ARM: dts: aspeed-g5: Add gpio controller to devicetree")
Signed-off-by: Oscar A Perez <linux@neuralgames.com>
Reviewed-by: Andrew Jeffery <andrew@aj.id.au>
Signed-off-by: Joel Stanley <joel@jms.id.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/aspeed-g5.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/aspeed-g5.dtsi b/arch/arm/boot/dts/aspeed-g5.dtsi
index d107459fc0f89..f2e1015d75ab4 100644
--- a/arch/arm/boot/dts/aspeed-g5.dtsi
+++ b/arch/arm/boot/dts/aspeed-g5.dtsi
@@ -247,7 +247,7 @@
 				compatible = "aspeed,ast2500-gpio";
 				reg = <0x1e780000 0x1000>;
 				interrupts = <20>;
-				gpio-ranges = <&pinctrl 0 0 220>;
+				gpio-ranges = <&pinctrl 0 0 232>;
 				clocks = <&syscon ASPEED_CLK_APB>;
 				interrupt-controller;
 			};
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 543/639] xsk: avoid store-tearing when assigning queues
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (541 preceding siblings ...)
  2020-01-24  9:31 ` [PATCH 4.19 542/639] ARM: dts: aspeed-g5: Fixe gpio-ranges upper limit Greg Kroah-Hartman
@ 2020-01-24  9:31 ` Greg Kroah-Hartman
  2020-01-24  9:31 ` [PATCH 4.19 544/639] xsk: avoid store-tearing when assigning umem Greg Kroah-Hartman
                   ` (99 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jonathan Lemon,
	Björn Töpel, Daniel Borkmann, Sasha Levin

From: Björn Töpel <bjorn.topel@intel.com>

[ Upstream commit 94a997637c5b562fa0ca44fca1d2cd02ec08236f ]

Use WRITE_ONCE when doing the store of tx, rx, fq, and cq, to avoid
potential store-tearing. These members are read outside of the control
mutex in the mmap implementation.

Acked-by: Jonathan Lemon <jonathan.lemon@gmail.com>
Fixes: 37b076933a8e ("xsk: add missing write- and data-dependency barrier")
Signed-off-by: Björn Töpel <bjorn.topel@intel.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/xdp/xsk.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c
index c90854bc3048e..b580078f04d15 100644
--- a/net/xdp/xsk.c
+++ b/net/xdp/xsk.c
@@ -320,7 +320,7 @@ static int xsk_init_queue(u32 entries, struct xsk_queue **queue,
 
 	/* Make sure queue is ready before it can be seen by others */
 	smp_wmb();
-	*queue = q;
+	WRITE_ONCE(*queue, q);
 	return 0;
 }
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 544/639] xsk: avoid store-tearing when assigning umem
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (542 preceding siblings ...)
  2020-01-24  9:31 ` [PATCH 4.19 543/639] xsk: avoid store-tearing when assigning queues Greg Kroah-Hartman
@ 2020-01-24  9:31 ` Greg Kroah-Hartman
  2020-01-24  9:31 ` [PATCH 4.19 545/639] led: triggers: Fix dereferencing of null pointer Greg Kroah-Hartman
                   ` (98 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jonathan Lemon,
	Björn Töpel, Daniel Borkmann, Sasha Levin

From: Björn Töpel <bjorn.topel@intel.com>

[ Upstream commit 9764f4b301c3e7eb3b75eec85b73cad449cdbb0d ]

The umem member of struct xdp_sock is read outside of the control
mutex, in the mmap implementation, and needs a WRITE_ONCE to avoid
potential store-tearing.

Acked-by: Jonathan Lemon <jonathan.lemon@gmail.com>
Fixes: 423f38329d26 ("xsk: add umem fill queue support and mmap")
Signed-off-by: Björn Töpel <bjorn.topel@intel.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/xdp/xsk.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c
index b580078f04d15..72caa4fb13f47 100644
--- a/net/xdp/xsk.c
+++ b/net/xdp/xsk.c
@@ -454,7 +454,7 @@ static int xsk_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
 		}
 
 		xdp_get_umem(umem_xs->umem);
-		xs->umem = umem_xs->umem;
+		WRITE_ONCE(xs->umem, umem_xs->umem);
 		sockfd_put(sock);
 	} else if (!xs->umem || !xdp_umem_validate_queues(xs->umem)) {
 		err = -EINVAL;
@@ -534,7 +534,7 @@ static int xsk_setsockopt(struct socket *sock, int level, int optname,
 
 		/* Make sure umem is ready before it can be seen by others */
 		smp_wmb();
-		xs->umem = umem;
+		WRITE_ONCE(xs->umem, umem);
 		mutex_unlock(&xs->mutex);
 		return 0;
 	}
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 545/639] led: triggers: Fix dereferencing of null pointer
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (543 preceding siblings ...)
  2020-01-24  9:31 ` [PATCH 4.19 544/639] xsk: avoid store-tearing when assigning umem Greg Kroah-Hartman
@ 2020-01-24  9:31 ` Greg Kroah-Hartman
  2020-01-24  9:31 ` [PATCH 4.19 546/639] net: sonic: return NETDEV_TX_OK if failed to map buffer Greg Kroah-Hartman
                   ` (97 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Oleh Kravchenko,
	Uwe Kleine-König, Jacek Anaszewski, Sasha Levin

From: Oleh Kravchenko <oleg@kaa.org.ua>

[ Upstream commit 4016ba85880b252365d11bc7dc899450f2c73ad7 ]

Error was detected by PVS-Studio:
V522 Dereferencing of the null pointer 'led_cdev->trigger' might take place.

Fixes: 2282e125a406 ("leds: triggers: let struct led_trigger::activate() return an error code")
Signed-off-by: Oleh Kravchenko <oleg@kaa.org.ua>
Reviewed-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Jacek Anaszewski <jacek.anaszewski@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/leds/led-triggers.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/leds/led-triggers.c b/drivers/leds/led-triggers.c
index e4cb3811e82a3..005b839f6eb9e 100644
--- a/drivers/leds/led-triggers.c
+++ b/drivers/leds/led-triggers.c
@@ -171,11 +171,11 @@ err_add_groups:
 		trig->deactivate(led_cdev);
 err_activate:
 
-	led_cdev->trigger = NULL;
-	led_cdev->trigger_data = NULL;
 	write_lock_irqsave(&led_cdev->trigger->leddev_list_lock, flags);
 	list_del(&led_cdev->trig_list);
 	write_unlock_irqrestore(&led_cdev->trigger->leddev_list_lock, flags);
+	led_cdev->trigger = NULL;
+	led_cdev->trigger_data = NULL;
 	led_set_brightness(led_cdev, LED_OFF);
 	kfree(event);
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 546/639] net: sonic: return NETDEV_TX_OK if failed to map buffer
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (544 preceding siblings ...)
  2020-01-24  9:31 ` [PATCH 4.19 545/639] led: triggers: Fix dereferencing of null pointer Greg Kroah-Hartman
@ 2020-01-24  9:31 ` Greg Kroah-Hartman
  2020-01-24  9:31 ` [PATCH 4.19 547/639] net: hns3: fix error VF index when setting VLAN offload Greg Kroah-Hartman
                   ` (96 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Mao Wenan, David S. Miller, Sasha Levin

From: Mao Wenan <maowenan@huawei.com>

[ Upstream commit 6e1cdedcf0362fed3aedfe051d46bd7ee2a85fe1 ]

NETDEV_TX_BUSY really should only be used by drivers that call
netif_tx_stop_queue() at the wrong moment. If dma_map_single() is
failed to map tx DMA buffer, it might trigger an infinite loop.
This patch use NETDEV_TX_OK instead of NETDEV_TX_BUSY, and change
printk to pr_err_ratelimited.

Fixes: d9fb9f384292 ("*sonic/natsemi/ns83829: Move the National Semi-conductor drivers")
Signed-off-by: Mao Wenan <maowenan@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/natsemi/sonic.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/natsemi/sonic.c b/drivers/net/ethernet/natsemi/sonic.c
index c805dcbebd027..be36f7117d484 100644
--- a/drivers/net/ethernet/natsemi/sonic.c
+++ b/drivers/net/ethernet/natsemi/sonic.c
@@ -231,9 +231,9 @@ static int sonic_send_packet(struct sk_buff *skb, struct net_device *dev)
 
 	laddr = dma_map_single(lp->device, skb->data, length, DMA_TO_DEVICE);
 	if (!laddr) {
-		printk(KERN_ERR "%s: failed to map tx DMA buffer.\n", dev->name);
+		pr_err_ratelimited("%s: failed to map tx DMA buffer.\n", dev->name);
 		dev_kfree_skb(skb);
-		return NETDEV_TX_BUSY;
+		return NETDEV_TX_OK;
 	}
 
 	sonic_tda_put(dev, entry, SONIC_TD_STATUS, 0);       /* clear status */
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 547/639] net: hns3: fix error VF index when setting VLAN offload
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (545 preceding siblings ...)
  2020-01-24  9:31 ` [PATCH 4.19 546/639] net: sonic: return NETDEV_TX_OK if failed to map buffer Greg Kroah-Hartman
@ 2020-01-24  9:31 ` Greg Kroah-Hartman
  2020-01-24  9:31 ` [PATCH 4.19 548/639] rtlwifi: Fix file release memory leak Greg Kroah-Hartman
                   ` (95 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jian Shen, Huazhong Tan,
	David S. Miller, Sasha Levin

From: Jian Shen <shenjian15@huawei.com>

[ Upstream commit d9c0f2756a33833b2653f7a3612814fa5f52a568 ]

In original codes, the VF index used incorrectly in function
hclge_set_vlan_rx_offload_cfg() and hclge_set_vlan_rx_offload_cfg().
When VF id is greater than 8, for example 9, it will set the
same bit with VF id 1.

This patch fixes it by using  vport->vport_id % HCLGE_VF_NUM_PER_CMD /
HCLGE_VF_NUM_PER_BYTE as the array index, instead of vport->vport_id /
HCLGE_VF_NUM_PER_CMD.

Fixes: 052ece6dc19c ("net: hns3: add ethtool related offload command")
Signed-off-by: Jian Shen <shenjian15@huawei.com>
Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../ethernet/hisilicon/hns3/hns3pf/hclge_main.c    | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
index 4b9f898a1620c..d575dd9a329d9 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
@@ -4833,6 +4833,7 @@ static int hclge_set_vlan_tx_offload_cfg(struct hclge_vport *vport)
 	struct hclge_vport_vtag_tx_cfg_cmd *req;
 	struct hclge_dev *hdev = vport->back;
 	struct hclge_desc desc;
+	u16 bmap_index;
 	int status;
 
 	hclge_cmd_setup_basic_desc(&desc, HCLGE_OPC_VLAN_PORT_TX_CFG, false);
@@ -4855,8 +4856,10 @@ static int hclge_set_vlan_tx_offload_cfg(struct hclge_vport *vport)
 	hnae3_set_bit(req->vport_vlan_cfg, HCLGE_CFG_NIC_ROCE_SEL_B, 0);
 
 	req->vf_offset = vport->vport_id / HCLGE_VF_NUM_PER_CMD;
-	req->vf_bitmap[req->vf_offset] =
-		1 << (vport->vport_id % HCLGE_VF_NUM_PER_BYTE);
+	bmap_index = vport->vport_id % HCLGE_VF_NUM_PER_CMD /
+			HCLGE_VF_NUM_PER_BYTE;
+	req->vf_bitmap[bmap_index] =
+		1U << (vport->vport_id % HCLGE_VF_NUM_PER_BYTE);
 
 	status = hclge_cmd_send(&hdev->hw, &desc, 1);
 	if (status)
@@ -4873,6 +4876,7 @@ static int hclge_set_vlan_rx_offload_cfg(struct hclge_vport *vport)
 	struct hclge_vport_vtag_rx_cfg_cmd *req;
 	struct hclge_dev *hdev = vport->back;
 	struct hclge_desc desc;
+	u16 bmap_index;
 	int status;
 
 	hclge_cmd_setup_basic_desc(&desc, HCLGE_OPC_VLAN_PORT_RX_CFG, false);
@@ -4888,8 +4892,10 @@ static int hclge_set_vlan_rx_offload_cfg(struct hclge_vport *vport)
 		      vcfg->vlan2_vlan_prionly ? 1 : 0);
 
 	req->vf_offset = vport->vport_id / HCLGE_VF_NUM_PER_CMD;
-	req->vf_bitmap[req->vf_offset] =
-		1 << (vport->vport_id % HCLGE_VF_NUM_PER_BYTE);
+	bmap_index = vport->vport_id % HCLGE_VF_NUM_PER_CMD /
+			HCLGE_VF_NUM_PER_BYTE;
+	req->vf_bitmap[bmap_index] =
+		1U << (vport->vport_id % HCLGE_VF_NUM_PER_BYTE);
 
 	status = hclge_cmd_send(&hdev->hw, &desc, 1);
 	if (status)
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 548/639] rtlwifi: Fix file release memory leak
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (546 preceding siblings ...)
  2020-01-24  9:31 ` [PATCH 4.19 547/639] net: hns3: fix error VF index when setting VLAN offload Greg Kroah-Hartman
@ 2020-01-24  9:31 ` Greg Kroah-Hartman
  2020-01-24  9:31 ` [PATCH 4.19 549/639] ARM: dts: logicpd-som-lv: Fix i2c2 and i2c3 Pin mux Greg Kroah-Hartman
                   ` (94 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Wei Yongjun, Kalle Valo, Sasha Levin

From: Wei Yongjun <weiyongjun1@huawei.com>

[ Upstream commit 4c3e48794dec7cb568974ba3bf2ab62b9c45ca3e ]

When using single_open() for opening, single_release() should be
used instead of seq_release(), otherwise there is a memory leak.

This is detected by Coccinelle semantic patch.

Fixes: 610247f46feb ("rtlwifi: Improve debugging by using debugfs")
Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/realtek/rtlwifi/debug.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/realtek/rtlwifi/debug.c b/drivers/net/wireless/realtek/rtlwifi/debug.c
index d70385be99762..498994041bbcb 100644
--- a/drivers/net/wireless/realtek/rtlwifi/debug.c
+++ b/drivers/net/wireless/realtek/rtlwifi/debug.c
@@ -109,7 +109,7 @@ static const struct file_operations file_ops_common = {
 	.open = dl_debug_open_common,
 	.read = seq_read,
 	.llseek = seq_lseek,
-	.release = seq_release,
+	.release = single_release,
 };
 
 static int rtl_debug_get_mac_page(struct seq_file *m, void *v)
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 549/639] ARM: dts: logicpd-som-lv: Fix i2c2 and i2c3 Pin mux
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (547 preceding siblings ...)
  2020-01-24  9:31 ` [PATCH 4.19 548/639] rtlwifi: Fix file release memory leak Greg Kroah-Hartman
@ 2020-01-24  9:31 ` Greg Kroah-Hartman
  2020-01-24  9:32 ` [PATCH 4.19 550/639] f2fs: fix wrong error injection path in inc_valid_block_count() Greg Kroah-Hartman
                   ` (93 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Adam Ford, Tony Lindgren, Sasha Levin

From: Adam Ford <aford173@gmail.com>

[ Upstream commit a932b77b4d1939ad173f18be87da409427fb705c ]

When the pinmux configuration was added, it was accidentally placed into
the omap3_pmx_wkup node  when it should have been placed into the
omap3_pmx_core.  This error was accidentally propagated to stable by
me when I blindly requested the pull after seeing I2C issues without
actually reviewing the content of the pinout.  Since the bootloader
previously muxed these correctly in the past, was a hidden error.

This patch moves the i2c2_pins and i2c3_pins to the correct node
which should eliminate i2c bus errors and timeouts due to the fact
the bootloader uses the save device tree that no longer properly
assigns these pins.

Fixes: 5fe3c0fa0d54 ("ARM: dts: Add pinmuxing for i2c2 and i2c3
for LogicPD SOM-LV") #4.9+

Signed-off-by: Adam Ford <aford173@gmail.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/logicpd-som-lv.dtsi | 26 ++++++++++++++------------
 1 file changed, 14 insertions(+), 12 deletions(-)

diff --git a/arch/arm/boot/dts/logicpd-som-lv.dtsi b/arch/arm/boot/dts/logicpd-som-lv.dtsi
index 98b682a8080cc..c5d54c4d37476 100644
--- a/arch/arm/boot/dts/logicpd-som-lv.dtsi
+++ b/arch/arm/boot/dts/logicpd-som-lv.dtsi
@@ -232,6 +232,20 @@
 		>;
 	};
 
+	i2c2_pins: pinmux_i2c2_pins {
+		pinctrl-single,pins = <
+			OMAP3_CORE1_IOPAD(0x21be, PIN_INPUT | MUX_MODE0)	/* i2c2_scl */
+			OMAP3_CORE1_IOPAD(0x21c0, PIN_INPUT | MUX_MODE0)	/* i2c2_sda */
+		>;
+	};
+
+	i2c3_pins: pinmux_i2c3_pins {
+		pinctrl-single,pins = <
+			OMAP3_CORE1_IOPAD(0x21c2, PIN_INPUT | MUX_MODE0)	/* i2c3_scl */
+			OMAP3_CORE1_IOPAD(0x21c4, PIN_INPUT | MUX_MODE0)	/* i2c3_sda */
+		>;
+	};
+
 	tsc2004_pins: pinmux_tsc2004_pins {
 		pinctrl-single,pins = <
 			OMAP3_CORE1_IOPAD(0x2186, PIN_INPUT | MUX_MODE4)	/* mcbsp4_dr.gpio_153 */
@@ -253,18 +267,6 @@
 			OMAP3_WKUP_IOPAD(0x2a0c, PIN_OUTPUT | MUX_MODE4)	/* sys_boot1.gpio_3 */
 		>;
 	};
-	i2c2_pins: pinmux_i2c2_pins {
-		pinctrl-single,pins = <
-			OMAP3_CORE1_IOPAD(0x21be, PIN_INPUT | MUX_MODE0)	/* i2c2_scl */
-			OMAP3_CORE1_IOPAD(0x21c0, PIN_INPUT | MUX_MODE0)	/* i2c2_sda */
-		>;
-	};
-	i2c3_pins: pinmux_i2c3_pins {
-		pinctrl-single,pins = <
-			OMAP3_CORE1_IOPAD(0x21c2, PIN_INPUT | MUX_MODE0)	/* i2c3_scl */
-			OMAP3_CORE1_IOPAD(0x21c4, PIN_INPUT | MUX_MODE0)	/* i2c3_sda */
-		>;
-	};
 };
 
 &omap3_pmx_core2 {
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 550/639] f2fs: fix wrong error injection path in inc_valid_block_count()
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (548 preceding siblings ...)
  2020-01-24  9:31 ` [PATCH 4.19 549/639] ARM: dts: logicpd-som-lv: Fix i2c2 and i2c3 Pin mux Greg Kroah-Hartman
@ 2020-01-24  9:32 ` Greg Kroah-Hartman
  2020-01-24  9:32 ` [PATCH 4.19 551/639] f2fs: fix error path of f2fs_convert_inline_page() Greg Kroah-Hartman
                   ` (92 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chao Yu, Jaegeuk Kim, Sasha Levin

From: Chao Yu <yuchao0@huawei.com>

[ Upstream commit 9ea2f0be6ceaebae1518a5f897cff2645830dd95 ]

If FAULT_BLOCK type error injection is on, in inc_valid_block_count()
we may decrease sbi->alloc_valid_block_count percpu stat count
incorrectly, fix it.

Fixes: 36b877af7992 ("f2fs: Keep alloc_valid_block_count in sync")
Signed-off-by: Chao Yu <yuchao0@huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/f2fs/f2fs.h | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
index 72d154e71bb56..6b5b685af5990 100644
--- a/fs/f2fs/f2fs.h
+++ b/fs/f2fs/f2fs.h
@@ -1701,7 +1701,7 @@ static inline int inc_valid_block_count(struct f2fs_sb_info *sbi,
 	if (time_to_inject(sbi, FAULT_BLOCK)) {
 		f2fs_show_injection_info(FAULT_BLOCK);
 		release = *count;
-		goto enospc;
+		goto release_quota;
 	}
 
 	/*
@@ -1741,6 +1741,7 @@ static inline int inc_valid_block_count(struct f2fs_sb_info *sbi,
 
 enospc:
 	percpu_counter_sub(&sbi->alloc_valid_block_count, release);
+release_quota:
 	dquot_release_reservation_block(inode, release);
 	return -ENOSPC;
 }
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 551/639] f2fs: fix error path of f2fs_convert_inline_page()
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (549 preceding siblings ...)
  2020-01-24  9:32 ` [PATCH 4.19 550/639] f2fs: fix wrong error injection path in inc_valid_block_count() Greg Kroah-Hartman
@ 2020-01-24  9:32 ` Greg Kroah-Hartman
  2020-01-24  9:32 ` [PATCH 4.19 552/639] scsi: fnic: fix msix interrupt allocation Greg Kroah-Hartman
                   ` (91 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chao Yu, Jaegeuk Kim, Sasha Levin

From: Chao Yu <yuchao0@huawei.com>

[ Upstream commit e8c82c11c93d586d03d80305959527bcac383555 ]

In error path of f2fs_convert_inline_page(), we missed to truncate newly
reserved block in .i_addrs[0] once we failed in get_node_info(), fix it.

Fixes: 7735730d39d7 ("f2fs: fix to propagate error from __get_meta_page()")
Signed-off-by: Chao Yu <yuchao0@huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/f2fs/inline.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/f2fs/inline.c b/fs/f2fs/inline.c
index 6bbb5f6801e26..3fe0dd5313903 100644
--- a/fs/f2fs/inline.c
+++ b/fs/f2fs/inline.c
@@ -133,6 +133,7 @@ int f2fs_convert_inline_page(struct dnode_of_data *dn, struct page *page)
 
 	err = f2fs_get_node_info(fio.sbi, dn->nid, &ni);
 	if (err) {
+		f2fs_truncate_data_blocks_range(dn, 1);
 		f2fs_put_dnode(dn);
 		return err;
 	}
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 552/639] scsi: fnic: fix msix interrupt allocation
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (550 preceding siblings ...)
  2020-01-24  9:32 ` [PATCH 4.19 551/639] f2fs: fix error path of f2fs_convert_inline_page() Greg Kroah-Hartman
@ 2020-01-24  9:32 ` Greg Kroah-Hartman
  2020-01-24  9:32 ` [PATCH 4.19 553/639] Btrfs: fix hang when loading existing inode cache off disk Greg Kroah-Hartman
                   ` (90 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Govindarajulu Varadarajan,
	Satish Kharat, Martin K. Petersen, Sasha Levin

From: Govindarajulu Varadarajan <gvaradar@cisco.com>

[ Upstream commit 3ec24fb4c035e9cbb2f02a48640a09aa913442a2 ]

pci_alloc_irq_vectors() returns number of vectors allocated.  Fix the check
for error condition.

Fixes: cca678dfbad49 ("scsi: fnic: switch to pci_alloc_irq_vectors")
Link: https://lore.kernel.org/r/20190827211340.1095-1-gvaradar@cisco.com
Signed-off-by: Govindarajulu Varadarajan <gvaradar@cisco.com>
Acked-by: Satish Kharat <satishkh@cisco.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/fnic/fnic_isr.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/scsi/fnic/fnic_isr.c b/drivers/scsi/fnic/fnic_isr.c
index 4e3a50202e8c5..d28088218c364 100644
--- a/drivers/scsi/fnic/fnic_isr.c
+++ b/drivers/scsi/fnic/fnic_isr.c
@@ -254,7 +254,7 @@ int fnic_set_intr_mode(struct fnic *fnic)
 		int vecs = n + m + o + 1;
 
 		if (pci_alloc_irq_vectors(fnic->pdev, vecs, vecs,
-				PCI_IRQ_MSIX) < 0) {
+				PCI_IRQ_MSIX) == vecs) {
 			fnic->rq_count = n;
 			fnic->raw_wq_count = m;
 			fnic->wq_copy_count = o;
@@ -280,7 +280,7 @@ int fnic_set_intr_mode(struct fnic *fnic)
 	    fnic->wq_copy_count >= 1 &&
 	    fnic->cq_count >= 3 &&
 	    fnic->intr_count >= 1 &&
-	    pci_alloc_irq_vectors(fnic->pdev, 1, 1, PCI_IRQ_MSI) < 0) {
+	    pci_alloc_irq_vectors(fnic->pdev, 1, 1, PCI_IRQ_MSI) == 1) {
 		fnic->rq_count = 1;
 		fnic->raw_wq_count = 1;
 		fnic->wq_copy_count = 1;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 553/639] Btrfs: fix hang when loading existing inode cache off disk
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (551 preceding siblings ...)
  2020-01-24  9:32 ` [PATCH 4.19 552/639] scsi: fnic: fix msix interrupt allocation Greg Kroah-Hartman
@ 2020-01-24  9:32 ` Greg Kroah-Hartman
  2020-01-24  9:32 ` [PATCH 4.19 554/639] Btrfs: fix inode cache waiters hanging on failure to start caching thread Greg Kroah-Hartman
                   ` (89 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Nikolay Borisov, Filipe Manana,
	David Sterba, Sasha Levin

From: Filipe Manana <fdmanana@suse.com>

[ Upstream commit 7764d56baa844d7f6206394f21a0e8c1f303c476 ]

If we are able to load an existing inode cache off disk, we set the state
of the cache to BTRFS_CACHE_FINISHED, but we don't wake up any one waiting
for the cache to be available. This means that anyone waiting for the
cache to be available, waiting on the condition that either its state is
BTRFS_CACHE_FINISHED or its available free space is greather than zero,
can hang forever.

This could be observed running fstests with MOUNT_OPTIONS="-o inode_cache",
in particular test case generic/161 triggered it very frequently for me,
producing a trace like the following:

  [63795.739712] BTRFS info (device sdc): enabling inode map caching
  [63795.739714] BTRFS info (device sdc): disk space caching is enabled
  [63795.739716] BTRFS info (device sdc): has skinny extents
  [64036.653886] INFO: task btrfs-transacti:3917 blocked for more than 120 seconds.
  [64036.654079]       Not tainted 5.2.0-rc4-btrfs-next-50 #1
  [64036.654143] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
  [64036.654232] btrfs-transacti D    0  3917      2 0x80004000
  [64036.654239] Call Trace:
  [64036.654258]  ? __schedule+0x3ae/0x7b0
  [64036.654271]  schedule+0x3a/0xb0
  [64036.654325]  btrfs_commit_transaction+0x978/0xae0 [btrfs]
  [64036.654339]  ? remove_wait_queue+0x60/0x60
  [64036.654395]  transaction_kthread+0x146/0x180 [btrfs]
  [64036.654450]  ? btrfs_cleanup_transaction+0x620/0x620 [btrfs]
  [64036.654456]  kthread+0x103/0x140
  [64036.654464]  ? kthread_create_worker_on_cpu+0x70/0x70
  [64036.654476]  ret_from_fork+0x3a/0x50
  [64036.654504] INFO: task xfs_io:3919 blocked for more than 120 seconds.
  [64036.654568]       Not tainted 5.2.0-rc4-btrfs-next-50 #1
  [64036.654617] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
  [64036.654685] xfs_io          D    0  3919   3633 0x00000000
  [64036.654691] Call Trace:
  [64036.654703]  ? __schedule+0x3ae/0x7b0
  [64036.654716]  schedule+0x3a/0xb0
  [64036.654756]  btrfs_find_free_ino+0xa9/0x120 [btrfs]
  [64036.654764]  ? remove_wait_queue+0x60/0x60
  [64036.654809]  btrfs_create+0x72/0x1f0 [btrfs]
  [64036.654822]  lookup_open+0x6bc/0x790
  [64036.654849]  path_openat+0x3bc/0xc00
  [64036.654854]  ? __lock_acquire+0x331/0x1cb0
  [64036.654869]  do_filp_open+0x99/0x110
  [64036.654884]  ? __alloc_fd+0xee/0x200
  [64036.654895]  ? do_raw_spin_unlock+0x49/0xc0
  [64036.654909]  ? do_sys_open+0x132/0x220
  [64036.654913]  do_sys_open+0x132/0x220
  [64036.654926]  do_syscall_64+0x60/0x1d0
  [64036.654933]  entry_SYSCALL_64_after_hwframe+0x49/0xbe

Fix this by adding a wake_up() call right after setting the cache state to
BTRFS_CACHE_FINISHED, at start_caching(), when we are able to load the
cache from disk.

Fixes: 82d5902d9c681b ("Btrfs: Support reading/writing on disk free ino cache")
Reviewed-by: Nikolay Borisov <nborisov@suse.com>
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/btrfs/inode-map.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/btrfs/inode-map.c b/fs/btrfs/inode-map.c
index e1b50c62ba650..b3bd270706176 100644
--- a/fs/btrfs/inode-map.c
+++ b/fs/btrfs/inode-map.c
@@ -145,6 +145,7 @@ static void start_caching(struct btrfs_root *root)
 		spin_lock(&root->ino_cache_lock);
 		root->ino_cache_state = BTRFS_CACHE_FINISHED;
 		spin_unlock(&root->ino_cache_lock);
+		wake_up(&root->ino_cache_wait);
 		return;
 	}
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 554/639] Btrfs: fix inode cache waiters hanging on failure to start caching thread
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (552 preceding siblings ...)
  2020-01-24  9:32 ` [PATCH 4.19 553/639] Btrfs: fix hang when loading existing inode cache off disk Greg Kroah-Hartman
@ 2020-01-24  9:32 ` Greg Kroah-Hartman
  2020-01-24  9:32 ` [PATCH 4.19 555/639] Btrfs: fix inode cache waiters hanging on path allocation failure Greg Kroah-Hartman
                   ` (88 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Nikolay Borisov, Filipe Manana,
	David Sterba, Sasha Levin

From: Filipe Manana <fdmanana@suse.com>

[ Upstream commit a68ebe0790fc88b4314d17984a2cf99ce2361901 ]

If we fail to start the inode caching thread, we print an error message
and disable the inode cache, however we never wake up any waiters, so they
hang forever waiting for the caching to finish. Fix this by waking them
up and have them fallback to a call to btrfs_find_free_objectid().

Fixes: e60efa84252c05 ("Btrfs: avoid triggering bug_on() when we fail to start inode caching task")
Reviewed-by: Nikolay Borisov <nborisov@suse.com>
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/btrfs/inode-map.c | 23 ++++++++++++++++++-----
 1 file changed, 18 insertions(+), 5 deletions(-)

diff --git a/fs/btrfs/inode-map.c b/fs/btrfs/inode-map.c
index b3bd270706176..7c4d0107c6fb9 100644
--- a/fs/btrfs/inode-map.c
+++ b/fs/btrfs/inode-map.c
@@ -12,6 +12,19 @@
 #include "inode-map.h"
 #include "transaction.h"
 
+static void fail_caching_thread(struct btrfs_root *root)
+{
+	struct btrfs_fs_info *fs_info = root->fs_info;
+
+	btrfs_warn(fs_info, "failed to start inode caching task");
+	btrfs_clear_pending_and_info(fs_info, INODE_MAP_CACHE,
+				     "disabling inode map caching");
+	spin_lock(&root->ino_cache_lock);
+	root->ino_cache_state = BTRFS_CACHE_ERROR;
+	spin_unlock(&root->ino_cache_lock);
+	wake_up(&root->ino_cache_wait);
+}
+
 static int caching_kthread(void *data)
 {
 	struct btrfs_root *root = data;
@@ -164,11 +177,8 @@ static void start_caching(struct btrfs_root *root)
 
 	tsk = kthread_run(caching_kthread, root, "btrfs-ino-cache-%llu",
 			  root->root_key.objectid);
-	if (IS_ERR(tsk)) {
-		btrfs_warn(fs_info, "failed to start inode caching task");
-		btrfs_clear_pending_and_info(fs_info, INODE_MAP_CACHE,
-					     "disabling inode map caching");
-	}
+	if (IS_ERR(tsk))
+		fail_caching_thread(root);
 }
 
 int btrfs_find_free_ino(struct btrfs_root *root, u64 *objectid)
@@ -186,11 +196,14 @@ again:
 
 	wait_event(root->ino_cache_wait,
 		   root->ino_cache_state == BTRFS_CACHE_FINISHED ||
+		   root->ino_cache_state == BTRFS_CACHE_ERROR ||
 		   root->free_ino_ctl->free_space > 0);
 
 	if (root->ino_cache_state == BTRFS_CACHE_FINISHED &&
 	    root->free_ino_ctl->free_space == 0)
 		return -ENOSPC;
+	else if (root->ino_cache_state == BTRFS_CACHE_ERROR)
+		return btrfs_find_free_objectid(root, objectid);
 	else
 		goto again;
 }
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 555/639] Btrfs: fix inode cache waiters hanging on path allocation failure
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (553 preceding siblings ...)
  2020-01-24  9:32 ` [PATCH 4.19 554/639] Btrfs: fix inode cache waiters hanging on failure to start caching thread Greg Kroah-Hartman
@ 2020-01-24  9:32 ` Greg Kroah-Hartman
  2020-01-24  9:32 ` [PATCH 4.19 556/639] btrfs: use correct count in btrfs_file_write_iter() Greg Kroah-Hartman
                   ` (87 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Nikolay Borisov, Filipe Manana,
	David Sterba, Sasha Levin

From: Filipe Manana <fdmanana@suse.com>

[ Upstream commit 9d123a35d7e97bb2139747b16127c9b22b6a593e ]

If the caching thread fails to allocate a path, it returns without waking
up any cache waiters, leaving them hang forever. Fix this by following the
same approach as when we fail to start the caching thread: print an error
message, disable inode caching and make the wakers fallback to non-caching
mode behaviour (calling btrfs_find_free_objectid()).

Fixes: 581bb050941b4f ("Btrfs: Cache free inode numbers in memory")
Reviewed-by: Nikolay Borisov <nborisov@suse.com>
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/btrfs/inode-map.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/fs/btrfs/inode-map.c b/fs/btrfs/inode-map.c
index 7c4d0107c6fb9..c7dcb7c521086 100644
--- a/fs/btrfs/inode-map.c
+++ b/fs/btrfs/inode-map.c
@@ -41,8 +41,10 @@ static int caching_kthread(void *data)
 		return 0;
 
 	path = btrfs_alloc_path();
-	if (!path)
+	if (!path) {
+		fail_caching_thread(root);
 		return -ENOMEM;
+	}
 
 	/* Since the commit root is read-only, we can safely skip locking. */
 	path->skip_locking = 1;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 556/639] btrfs: use correct count in btrfs_file_write_iter()
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (554 preceding siblings ...)
  2020-01-24  9:32 ` [PATCH 4.19 555/639] Btrfs: fix inode cache waiters hanging on path allocation failure Greg Kroah-Hartman
@ 2020-01-24  9:32 ` Greg Kroah-Hartman
  2020-01-24  9:32 ` [PATCH 4.19 557/639] ixgbe: sync the first fragment unconditionally Greg Kroah-Hartman
                   ` (86 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Josef Bacik, Omar Sandoval,
	David Sterba, Sasha Levin

From: Omar Sandoval <osandov@fb.com>

[ Upstream commit c09767a8960ca0500fb636bf73686723337debf4 ]

generic_write_checks() may modify iov_iter_count(), so we must get the
count after the call, not before. Using the wrong one has a couple of
consequences:

1. We check a longer range in check_can_nocow() for nowait than we're
   actually writing.
2. We create extra hole extent maps in btrfs_cont_expand(). As far as I
   can tell, this is harmless, but I might be missing something.

These issues are pretty minor, but let's fix it before something more
important trips on it.

Fixes: edf064e7c6fe ("btrfs: nowait aio support")
Reviewed-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Omar Sandoval <osandov@fb.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/btrfs/file.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
index 78490e544c91e..c2c93fe9d7fd5 100644
--- a/fs/btrfs/file.c
+++ b/fs/btrfs/file.c
@@ -1895,7 +1895,7 @@ static ssize_t btrfs_file_write_iter(struct kiocb *iocb,
 	bool sync = (file->f_flags & O_DSYNC) || IS_SYNC(file->f_mapping->host);
 	ssize_t err;
 	loff_t pos;
-	size_t count = iov_iter_count(from);
+	size_t count;
 	loff_t oldsize;
 	int clean_page = 0;
 
@@ -1917,6 +1917,7 @@ static ssize_t btrfs_file_write_iter(struct kiocb *iocb,
 	}
 
 	pos = iocb->ki_pos;
+	count = iov_iter_count(from);
 	if (iocb->ki_flags & IOCB_NOWAIT) {
 		/*
 		 * We will allocate space in case nodatacow is not set,
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 557/639] ixgbe: sync the first fragment unconditionally
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (555 preceding siblings ...)
  2020-01-24  9:32 ` [PATCH 4.19 556/639] btrfs: use correct count in btrfs_file_write_iter() Greg Kroah-Hartman
@ 2020-01-24  9:32 ` Greg Kroah-Hartman
  2020-01-24  9:32 ` [PATCH 4.19 558/639] hwmon: (shtc1) fix shtc1 and shtw1 id mask Greg Kroah-Hartman
                   ` (85 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Firo Yang, Alexander Duyck,
	Andrew Bowers, Jeff Kirsher, Sasha Levin

From: Firo Yang <firo.yang@suse.com>

[ Upstream commit e7ba676c6188d394a0133fc4b9bcd7ee50d54b7f ]

In Xen environment, if Xen-swiotlb is enabled, ixgbe driver
could possibly allocate a page, DMA memory buffer, for the first
fragment which is not suitable for Xen-swiotlb to do DMA operations.
Xen-swiotlb have to internally allocate another page for doing DMA
operations. This mechanism requires syncing the data from the internal
page to the page which ixgbe sends to upper network stack. However,
since commit f3213d932173 ("ixgbe: Update driver to make use of DMA
attributes in Rx path"), the unmap operation is performed with
DMA_ATTR_SKIP_CPU_SYNC. As a result, the sync is not performed.
Since the sync isn't performed, the upper network stack could receive
a incomplete network packet. By incomplete, it means the linear data
on the first fragment(between skb->head and skb->end) is invalid. So
we have to copy the data from the internal xen-swiotlb page to the page
which ixgbe sends to upper network stack through the sync operation.

More details from Alexander Duyck:
Specifically since we are mapping the frame with
DMA_ATTR_SKIP_CPU_SYNC we have to unmap with that as well. As a result
a sync is not performed on an unmap and must be done manually as we
skipped it for the first frag. As such we need to always sync before
possibly performing a page unmap operation.

Fixes: f3213d932173 ("ixgbe: Update driver to make use of DMA attributes in Rx path")
Signed-off-by: Firo Yang <firo.yang@suse.com>
Reviewed-by: Alexander Duyck <alexander.h.duyck@linux.intel.com>
Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
index de65ca1e65580..51cd58fbab695 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
@@ -1822,13 +1822,7 @@ static void ixgbe_pull_tail(struct ixgbe_ring *rx_ring,
 static void ixgbe_dma_sync_frag(struct ixgbe_ring *rx_ring,
 				struct sk_buff *skb)
 {
-	/* if the page was released unmap it, else just sync our portion */
-	if (unlikely(IXGBE_CB(skb)->page_released)) {
-		dma_unmap_page_attrs(rx_ring->dev, IXGBE_CB(skb)->dma,
-				     ixgbe_rx_pg_size(rx_ring),
-				     DMA_FROM_DEVICE,
-				     IXGBE_RX_DMA_ATTR);
-	} else if (ring_uses_build_skb(rx_ring)) {
+	if (ring_uses_build_skb(rx_ring)) {
 		unsigned long offset = (unsigned long)(skb->data) & ~PAGE_MASK;
 
 		dma_sync_single_range_for_cpu(rx_ring->dev,
@@ -1845,6 +1839,14 @@ static void ixgbe_dma_sync_frag(struct ixgbe_ring *rx_ring,
 					      skb_frag_size(frag),
 					      DMA_FROM_DEVICE);
 	}
+
+	/* If the page was released, just unmap it. */
+	if (unlikely(IXGBE_CB(skb)->page_released)) {
+		dma_unmap_page_attrs(rx_ring->dev, IXGBE_CB(skb)->dma,
+				     ixgbe_rx_pg_size(rx_ring),
+				     DMA_FROM_DEVICE,
+				     IXGBE_RX_DMA_ATTR);
+	}
 }
 
 /**
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 558/639] hwmon: (shtc1) fix shtc1 and shtw1 id mask
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (556 preceding siblings ...)
  2020-01-24  9:32 ` [PATCH 4.19 557/639] ixgbe: sync the first fragment unconditionally Greg Kroah-Hartman
@ 2020-01-24  9:32 ` Greg Kroah-Hartman
  2020-01-24  9:32 ` [PATCH 4.19 559/639] net: sonic: replace dev_kfree_skb in sonic_send_packet Greg Kroah-Hartman
                   ` (84 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Robertson, Guenter Roeck, Sasha Levin

From: Dan Robertson <dan@dlrobertson.com>

[ Upstream commit fdc7d8e829ec755c5cfb2f5a8d8c0cdfb664f895 ]

Fix an error in the bitmaskfor the shtc1 and shtw1 bitmask used to
retrieve the chip ID from the ID register. See section 5.7 of the shtw1
or shtc1 datasheet for details.

Fixes: 1a539d372edd9832444e7a3daa710c444c014dc9 ("hwmon: add support for Sensirion SHTC1 sensor")
Signed-off-by: Dan Robertson <dan@dlrobertson.com>
Link: https://lore.kernel.org/r/20190905014554.21658-3-dan@dlrobertson.com
[groeck: Reordered to be first in series and adjusted accordingly]
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hwmon/shtc1.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/hwmon/shtc1.c b/drivers/hwmon/shtc1.c
index decd7df995abf..2a18539591eaf 100644
--- a/drivers/hwmon/shtc1.c
+++ b/drivers/hwmon/shtc1.c
@@ -38,7 +38,7 @@ static const unsigned char shtc1_cmd_read_id_reg[]	       = { 0xef, 0xc8 };
 
 /* constants for reading the ID register */
 #define SHTC1_ID	  0x07
-#define SHTC1_ID_REG_MASK 0x1f
+#define SHTC1_ID_REG_MASK 0x3f
 
 /* delays for non-blocking i2c commands, both in us */
 #define SHTC1_NONBLOCKING_WAIT_TIME_HPM  14400
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 559/639] net: sonic: replace dev_kfree_skb in sonic_send_packet
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (557 preceding siblings ...)
  2020-01-24  9:32 ` [PATCH 4.19 558/639] hwmon: (shtc1) fix shtc1 and shtw1 id mask Greg Kroah-Hartman
@ 2020-01-24  9:32 ` Greg Kroah-Hartman
  2020-01-24  9:32 ` [PATCH 4.19 560/639] pinctrl: iproc-gpio: Fix incorrect pinconf configurations Greg Kroah-Hartman
                   ` (83 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Mao Wenan, David S. Miller, Sasha Levin

From: Mao Wenan <maowenan@huawei.com>

[ Upstream commit 49f6c90bf6805948b597eabb499e500a47cf24be ]

sonic_send_packet will be processed in irq or non-irq
context, so it would better use dev_kfree_skb_any
instead of dev_kfree_skb.

Fixes: d9fb9f384292 ("*sonic/natsemi/ns83829: Move the National Semi-conductor drivers")
Signed-off-by: Mao Wenan <maowenan@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/natsemi/sonic.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/natsemi/sonic.c b/drivers/net/ethernet/natsemi/sonic.c
index be36f7117d484..5f1875fe47cdf 100644
--- a/drivers/net/ethernet/natsemi/sonic.c
+++ b/drivers/net/ethernet/natsemi/sonic.c
@@ -232,7 +232,7 @@ static int sonic_send_packet(struct sk_buff *skb, struct net_device *dev)
 	laddr = dma_map_single(lp->device, skb->data, length, DMA_TO_DEVICE);
 	if (!laddr) {
 		pr_err_ratelimited("%s: failed to map tx DMA buffer.\n", dev->name);
-		dev_kfree_skb(skb);
+		dev_kfree_skb_any(skb);
 		return NETDEV_TX_OK;
 	}
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 560/639] pinctrl: iproc-gpio: Fix incorrect pinconf configurations
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (558 preceding siblings ...)
  2020-01-24  9:32 ` [PATCH 4.19 559/639] net: sonic: replace dev_kfree_skb in sonic_send_packet Greg Kroah-Hartman
@ 2020-01-24  9:32 ` Greg Kroah-Hartman
  2020-01-24  9:32 ` [PATCH 4.19 561/639] gpio/aspeed: Fix incorrect number of banks Greg Kroah-Hartman
                   ` (82 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Li Jin, Linus Walleij, Sasha Levin

From: Li Jin <li.jin@broadcom.com>

[ Upstream commit 398a1f50e3c731586182fd52b834103b0aa2f826 ]

Fix drive strength for AON/CRMU controller; fix pull-up/down setting
for CCM/CDRU controller.

Fixes: 616043d58a89 ("pinctrl: Rename gpio driver from cygnus to iproc")
Signed-off-by: Li Jin <li.jin@broadcom.com>
Link: https://lore.kernel.org/r/1567054348-19685-2-git-send-email-srinath.mannam@broadcom.com
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pinctrl/bcm/pinctrl-iproc-gpio.c | 96 +++++++++++++++++++-----
 1 file changed, 77 insertions(+), 19 deletions(-)

diff --git a/drivers/pinctrl/bcm/pinctrl-iproc-gpio.c b/drivers/pinctrl/bcm/pinctrl-iproc-gpio.c
index b70058caee504..20b9864adce06 100644
--- a/drivers/pinctrl/bcm/pinctrl-iproc-gpio.c
+++ b/drivers/pinctrl/bcm/pinctrl-iproc-gpio.c
@@ -54,8 +54,12 @@
 /* drive strength control for ASIU GPIO */
 #define IPROC_GPIO_ASIU_DRV0_CTRL_OFFSET 0x58
 
-/* drive strength control for CCM/CRMU (AON) GPIO */
-#define IPROC_GPIO_DRV0_CTRL_OFFSET  0x00
+/* pinconf for CCM GPIO */
+#define IPROC_GPIO_PULL_DN_OFFSET   0x10
+#define IPROC_GPIO_PULL_UP_OFFSET   0x14
+
+/* pinconf for CRMU(aon) GPIO and CCM GPIO*/
+#define IPROC_GPIO_DRV_CTRL_OFFSET  0x00
 
 #define GPIO_BANK_SIZE 0x200
 #define NGPIOS_PER_BANK 32
@@ -76,6 +80,12 @@ enum iproc_pinconf_param {
 	IPROC_PINCON_MAX,
 };
 
+enum iproc_pinconf_ctrl_type {
+	IOCTRL_TYPE_AON = 1,
+	IOCTRL_TYPE_CDRU,
+	IOCTRL_TYPE_INVALID,
+};
+
 /*
  * Iproc GPIO core
  *
@@ -100,6 +110,7 @@ struct iproc_gpio {
 
 	void __iomem *base;
 	void __iomem *io_ctrl;
+	enum iproc_pinconf_ctrl_type io_ctrl_type;
 
 	raw_spinlock_t lock;
 
@@ -461,20 +472,44 @@ static const struct pinctrl_ops iproc_pctrl_ops = {
 static int iproc_gpio_set_pull(struct iproc_gpio *chip, unsigned gpio,
 				bool disable, bool pull_up)
 {
+	void __iomem *base;
 	unsigned long flags;
+	unsigned int shift;
+	u32 val_1, val_2;
 
 	raw_spin_lock_irqsave(&chip->lock, flags);
-
-	if (disable) {
-		iproc_set_bit(chip, IPROC_GPIO_RES_EN_OFFSET, gpio, false);
+	if (chip->io_ctrl_type == IOCTRL_TYPE_CDRU) {
+		base = chip->io_ctrl;
+		shift = IPROC_GPIO_SHIFT(gpio);
+
+		val_1 = readl(base + IPROC_GPIO_PULL_UP_OFFSET);
+		val_2 = readl(base + IPROC_GPIO_PULL_DN_OFFSET);
+		if (disable) {
+			/* no pull-up or pull-down */
+			val_1 &= ~BIT(shift);
+			val_2 &= ~BIT(shift);
+		} else if (pull_up) {
+			val_1 |= BIT(shift);
+			val_2 &= ~BIT(shift);
+		} else {
+			val_1 &= ~BIT(shift);
+			val_2 |= BIT(shift);
+		}
+		writel(val_1, base + IPROC_GPIO_PULL_UP_OFFSET);
+		writel(val_2, base + IPROC_GPIO_PULL_DN_OFFSET);
 	} else {
-		iproc_set_bit(chip, IPROC_GPIO_PAD_RES_OFFSET, gpio,
-			       pull_up);
-		iproc_set_bit(chip, IPROC_GPIO_RES_EN_OFFSET, gpio, true);
+		if (disable) {
+			iproc_set_bit(chip, IPROC_GPIO_RES_EN_OFFSET, gpio,
+				      false);
+		} else {
+			iproc_set_bit(chip, IPROC_GPIO_PAD_RES_OFFSET, gpio,
+				      pull_up);
+			iproc_set_bit(chip, IPROC_GPIO_RES_EN_OFFSET, gpio,
+				      true);
+		}
 	}
 
 	raw_spin_unlock_irqrestore(&chip->lock, flags);
-
 	dev_dbg(chip->dev, "gpio:%u set pullup:%d\n", gpio, pull_up);
 
 	return 0;
@@ -483,14 +518,35 @@ static int iproc_gpio_set_pull(struct iproc_gpio *chip, unsigned gpio,
 static void iproc_gpio_get_pull(struct iproc_gpio *chip, unsigned gpio,
 				 bool *disable, bool *pull_up)
 {
+	void __iomem *base;
 	unsigned long flags;
+	unsigned int shift;
+	u32 val_1, val_2;
 
 	raw_spin_lock_irqsave(&chip->lock, flags);
-	*disable = !iproc_get_bit(chip, IPROC_GPIO_RES_EN_OFFSET, gpio);
-	*pull_up = iproc_get_bit(chip, IPROC_GPIO_PAD_RES_OFFSET, gpio);
+	if (chip->io_ctrl_type == IOCTRL_TYPE_CDRU) {
+		base = chip->io_ctrl;
+		shift = IPROC_GPIO_SHIFT(gpio);
+
+		val_1 = readl(base + IPROC_GPIO_PULL_UP_OFFSET) & BIT(shift);
+		val_2 = readl(base + IPROC_GPIO_PULL_DN_OFFSET) & BIT(shift);
+
+		*pull_up = val_1 ? true : false;
+		*disable = (val_1 | val_2) ? false : true;
+
+	} else {
+		*disable = !iproc_get_bit(chip, IPROC_GPIO_RES_EN_OFFSET, gpio);
+		*pull_up = iproc_get_bit(chip, IPROC_GPIO_PAD_RES_OFFSET, gpio);
+	}
 	raw_spin_unlock_irqrestore(&chip->lock, flags);
 }
 
+#define DRV_STRENGTH_OFFSET(gpio, bit, type)  ((type) == IOCTRL_TYPE_AON ? \
+	((2 - (bit)) * 4 + IPROC_GPIO_DRV_CTRL_OFFSET) : \
+	((type) == IOCTRL_TYPE_CDRU) ? \
+	((bit) * 4 + IPROC_GPIO_DRV_CTRL_OFFSET) : \
+	((bit) * 4 + IPROC_GPIO_REG(gpio, IPROC_GPIO_ASIU_DRV0_CTRL_OFFSET)))
+
 static int iproc_gpio_set_strength(struct iproc_gpio *chip, unsigned gpio,
 				    unsigned strength)
 {
@@ -505,11 +561,8 @@ static int iproc_gpio_set_strength(struct iproc_gpio *chip, unsigned gpio,
 
 	if (chip->io_ctrl) {
 		base = chip->io_ctrl;
-		offset = IPROC_GPIO_DRV0_CTRL_OFFSET;
 	} else {
 		base = chip->base;
-		offset = IPROC_GPIO_REG(gpio,
-					 IPROC_GPIO_ASIU_DRV0_CTRL_OFFSET);
 	}
 
 	shift = IPROC_GPIO_SHIFT(gpio);
@@ -520,11 +573,11 @@ static int iproc_gpio_set_strength(struct iproc_gpio *chip, unsigned gpio,
 	raw_spin_lock_irqsave(&chip->lock, flags);
 	strength = (strength / 2) - 1;
 	for (i = 0; i < GPIO_DRV_STRENGTH_BITS; i++) {
+		offset = DRV_STRENGTH_OFFSET(gpio, i, chip->io_ctrl_type);
 		val = readl(base + offset);
 		val &= ~BIT(shift);
 		val |= ((strength >> i) & 0x1) << shift;
 		writel(val, base + offset);
-		offset += 4;
 	}
 	raw_spin_unlock_irqrestore(&chip->lock, flags);
 
@@ -541,11 +594,8 @@ static int iproc_gpio_get_strength(struct iproc_gpio *chip, unsigned gpio,
 
 	if (chip->io_ctrl) {
 		base = chip->io_ctrl;
-		offset = IPROC_GPIO_DRV0_CTRL_OFFSET;
 	} else {
 		base = chip->base;
-		offset = IPROC_GPIO_REG(gpio,
-					 IPROC_GPIO_ASIU_DRV0_CTRL_OFFSET);
 	}
 
 	shift = IPROC_GPIO_SHIFT(gpio);
@@ -553,10 +603,10 @@ static int iproc_gpio_get_strength(struct iproc_gpio *chip, unsigned gpio,
 	raw_spin_lock_irqsave(&chip->lock, flags);
 	*strength = 0;
 	for (i = 0; i < GPIO_DRV_STRENGTH_BITS; i++) {
+		offset = DRV_STRENGTH_OFFSET(gpio, i, chip->io_ctrl_type);
 		val = readl(base + offset) & BIT(shift);
 		val >>= shift;
 		*strength += (val << i);
-		offset += 4;
 	}
 
 	/* convert to mA */
@@ -734,6 +784,7 @@ static int iproc_gpio_probe(struct platform_device *pdev)
 	u32 ngpios, pinconf_disable_mask = 0;
 	int irq, ret;
 	bool no_pinconf = false;
+	enum iproc_pinconf_ctrl_type io_ctrl_type = IOCTRL_TYPE_INVALID;
 
 	/* NSP does not support drive strength config */
 	if (of_device_is_compatible(dev->of_node, "brcm,iproc-nsp-gpio"))
@@ -764,8 +815,15 @@ static int iproc_gpio_probe(struct platform_device *pdev)
 			dev_err(dev, "unable to map I/O memory\n");
 			return PTR_ERR(chip->io_ctrl);
 		}
+		if (of_device_is_compatible(dev->of_node,
+					    "brcm,cygnus-ccm-gpio"))
+			io_ctrl_type = IOCTRL_TYPE_CDRU;
+		else
+			io_ctrl_type = IOCTRL_TYPE_AON;
 	}
 
+	chip->io_ctrl_type = io_ctrl_type;
+
 	if (of_property_read_u32(dev->of_node, "ngpios", &ngpios)) {
 		dev_err(&pdev->dev, "missing ngpios DT property\n");
 		return -ENODEV;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 561/639] gpio/aspeed: Fix incorrect number of banks
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (559 preceding siblings ...)
  2020-01-24  9:32 ` [PATCH 4.19 560/639] pinctrl: iproc-gpio: Fix incorrect pinconf configurations Greg Kroah-Hartman
@ 2020-01-24  9:32 ` Greg Kroah-Hartman
  2020-01-24  9:32 ` [PATCH 4.19 562/639] ath10k: adjust skb length in ath10k_sdio_mbox_rx_packet Greg Kroah-Hartman
                   ` (81 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Rashmica Gupta, Andrew Jeffery,
	Joel Stanley, Linus Walleij, Sasha Levin

From: Rashmica Gupta <rashmica.g@gmail.com>

[ Upstream commit 3c4710ae6f883f9c6e3df5e27e274702a1221c57 ]

The current calculation for the number of GPIO banks is only correct if
the number of GPIOs is a multiple of 32 (if there were 31 GPIOs we would
currently say there are 0 banks, which is incorrect).

Fixes: 361b79119a4b7 ('gpio: Add Aspeed driver')

Signed-off-by: Rashmica Gupta <rashmica.g@gmail.com>
Reviewed-by: Andrew Jeffery <andrew@aj.id.au>
Link: https://lore.kernel.org/r/20190906062623.13354-1-rashmica.g@gmail.com
Reviewed-by: Joel Stanley <joel@jms.d.au>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpio/gpio-aspeed.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpio/gpio-aspeed.c b/drivers/gpio/gpio-aspeed.c
index b696ec35efb38..e627e0e9001ae 100644
--- a/drivers/gpio/gpio-aspeed.c
+++ b/drivers/gpio/gpio-aspeed.c
@@ -1199,7 +1199,7 @@ static int __init aspeed_gpio_probe(struct platform_device *pdev)
 	gpio->chip.irq.need_valid_mask = true;
 
 	/* Allocate a cache of the output registers */
-	banks = gpio->config->nr_gpios >> 5;
+	banks = DIV_ROUND_UP(gpio->config->nr_gpios, 32);
 	gpio->dcache = devm_kcalloc(&pdev->dev,
 				    banks, sizeof(u32), GFP_KERNEL);
 	if (!gpio->dcache)
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 562/639] ath10k: adjust skb length in ath10k_sdio_mbox_rx_packet
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (560 preceding siblings ...)
  2020-01-24  9:32 ` [PATCH 4.19 561/639] gpio/aspeed: Fix incorrect number of banks Greg Kroah-Hartman
@ 2020-01-24  9:32 ` Greg Kroah-Hartman
  2020-01-24  9:32 ` [PATCH 4.19 563/639] RDMA/cma: Fix false error message Greg Kroah-Hartman
                   ` (80 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Nicolas Boichat, Wen Gong,
	Kalle Valo, Sasha Levin

From: Nicolas Boichat <drinkcat@chromium.org>

[ Upstream commit b7139960832eb56fa15d390a4b5c8c5739bd0d1a ]

When the FW bundles multiple packets, pkt->act_len may be incorrect
as it refers to the first packet only (however, the FW will only
bundle packets that fit into the same pkt->alloc_len).

Before this patch, the skb length would be set (incorrectly) to
pkt->act_len in ath10k_sdio_mbox_rx_packet, and then later manually
adjusted in ath10k_sdio_mbox_rx_process_packet.

The first problem is that ath10k_sdio_mbox_rx_process_packet does not
use proper skb_put commands to adjust the length (it directly changes
skb->len), so we end up with a mismatch between skb->head + skb->tail
and skb->data + skb->len. This is quite serious, and causes corruptions
in the TCP stack, as the stack tries to coalesce packets, and relies
on skb->tail being correct (that is, skb_tail_pointer must point to
the first byte_after_ the data).

Instead of re-adjusting the size in ath10k_sdio_mbox_rx_process_packet,
this moves the code to ath10k_sdio_mbox_rx_packet, and also add a
bounds check, as skb_put would crash the kernel if not enough space is
available.

Tested with QCA6174 SDIO with firmware
WLAN.RMH.4.4.1-00007-QCARMSWP-1.

Fixes: 8530b4e7b22bc3b ("ath10k: sdio: set skb len for all rx packets")
Signed-off-by: Nicolas Boichat <drinkcat@chromium.org>
Signed-off-by: Wen Gong <wgong@codeaurora.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath10k/sdio.c | 29 +++++++++++++++++++-------
 1 file changed, 21 insertions(+), 8 deletions(-)

diff --git a/drivers/net/wireless/ath/ath10k/sdio.c b/drivers/net/wireless/ath/ath10k/sdio.c
index 686759b5613f2..0ecaba824fb28 100644
--- a/drivers/net/wireless/ath/ath10k/sdio.c
+++ b/drivers/net/wireless/ath/ath10k/sdio.c
@@ -392,16 +392,11 @@ static int ath10k_sdio_mbox_rx_process_packet(struct ath10k *ar,
 	struct ath10k_htc_hdr *htc_hdr = (struct ath10k_htc_hdr *)skb->data;
 	bool trailer_present = htc_hdr->flags & ATH10K_HTC_FLAG_TRAILER_PRESENT;
 	enum ath10k_htc_ep_id eid;
-	u16 payload_len;
 	u8 *trailer;
 	int ret;
 
-	payload_len = le16_to_cpu(htc_hdr->len);
-	skb->len = payload_len + sizeof(struct ath10k_htc_hdr);
-
 	if (trailer_present) {
-		trailer = skb->data + sizeof(*htc_hdr) +
-			  payload_len - htc_hdr->trailer_len;
+		trailer = skb->data + skb->len - htc_hdr->trailer_len;
 
 		eid = pipe_id_to_eid(htc_hdr->eid);
 
@@ -638,13 +633,31 @@ static int ath10k_sdio_mbox_rx_packet(struct ath10k *ar,
 {
 	struct ath10k_sdio *ar_sdio = ath10k_sdio_priv(ar);
 	struct sk_buff *skb = pkt->skb;
+	struct ath10k_htc_hdr *htc_hdr;
 	int ret;
 
 	ret = ath10k_sdio_readsb(ar, ar_sdio->mbox_info.htc_addr,
 				 skb->data, pkt->alloc_len);
+	if (ret)
+		goto out;
+
+	/* Update actual length. The original length may be incorrect,
+	 * as the FW will bundle multiple packets as long as their sizes
+	 * fit within the same aligned length (pkt->alloc_len).
+	 */
+	htc_hdr = (struct ath10k_htc_hdr *)skb->data;
+	pkt->act_len = le16_to_cpu(htc_hdr->len) + sizeof(*htc_hdr);
+	if (pkt->act_len > pkt->alloc_len) {
+		ath10k_warn(ar, "rx packet too large (%zu > %zu)\n",
+			    pkt->act_len, pkt->alloc_len);
+		ret = -EMSGSIZE;
+		goto out;
+	}
+
+	skb_put(skb, pkt->act_len);
+
+out:
 	pkt->status = ret;
-	if (!ret)
-		skb_put(skb, pkt->act_len);
 
 	return ret;
 }
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 563/639] RDMA/cma: Fix false error message
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (561 preceding siblings ...)
  2020-01-24  9:32 ` [PATCH 4.19 562/639] ath10k: adjust skb length in ath10k_sdio_mbox_rx_packet Greg Kroah-Hartman
@ 2020-01-24  9:32 ` Greg Kroah-Hartman
  2020-01-24  9:32 ` [PATCH 4.19 564/639] net/rds: Fix ib_evt_handler_call element in rds_ib_stat_names Greg Kroah-Hartman
                   ` (79 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Håkon Bugge, Jason Gunthorpe,
	Sasha Levin

From: Håkon Bugge <haakon.bugge@oracle.com>

[ Upstream commit a6e4d254c19b541a58caced322111084b27a7788 ]

In addr_handler(), assuming status == 0 and the device already has been
acquired (id_priv->cma_dev != NULL), we get the following incorrect
"error" message:

RDMA CM: ADDR_ERROR: failed to resolve IP. status 0

Fixes: 498683c6a7ee ("IB/cma: Add debug messages to error flows")
Link: https://lore.kernel.org/r/20190902092731.1055757-1-haakon.bugge@oracle.com
Signed-off-by: Håkon Bugge <haakon.bugge@oracle.com>
Reviewed-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/core/cma.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index 319bfef00a4a8..e16872e0724ff 100644
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -2889,7 +2889,7 @@ static void addr_handler(int status, struct sockaddr *src_addr,
 		if (status)
 			pr_debug_ratelimited("RDMA CM: ADDR_ERROR: failed to acquire device. status %d\n",
 					     status);
-	} else {
+	} else if (status) {
 		pr_debug_ratelimited("RDMA CM: ADDR_ERROR: failed to resolve IP. status %d\n", status);
 	}
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 564/639] net/rds: Fix ib_evt_handler_call element in rds_ib_stat_names
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (562 preceding siblings ...)
  2020-01-24  9:32 ` [PATCH 4.19 563/639] RDMA/cma: Fix false error message Greg Kroah-Hartman
@ 2020-01-24  9:32 ` Greg Kroah-Hartman
  2020-01-24  9:32 ` [PATCH 4.19 565/639] um: Fix off by one error in IRQ enumeration Greg Kroah-Hartman
                   ` (78 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Gerd Rausch, Santosh Shilimkar,
	David S. Miller, Sasha Levin

From: Gerd Rausch <gerd.rausch@oracle.com>

[ Upstream commit 05a82481a3024b94db00b8c816bb3d526b5209e0 ]

All entries in 'rds_ib_stat_names' are stringified versions
of the corresponding "struct rds_ib_statistics" element
without the "s_"-prefix.

Fix entry 'ib_evt_handler_call' to do the same.

Fixes: f4f943c958a2 ("RDS: IB: ack more receive completions to improve performance")
Signed-off-by: Gerd Rausch <gerd.rausch@oracle.com>
Acked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/rds/ib_stats.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/rds/ib_stats.c b/net/rds/ib_stats.c
index 9252ad1263359..ac46d8961b61a 100644
--- a/net/rds/ib_stats.c
+++ b/net/rds/ib_stats.c
@@ -42,7 +42,7 @@ DEFINE_PER_CPU_SHARED_ALIGNED(struct rds_ib_statistics, rds_ib_stats);
 static const char *const rds_ib_stat_names[] = {
 	"ib_connect_raced",
 	"ib_listen_closed_stale",
-	"s_ib_evt_handler_call",
+	"ib_evt_handler_call",
 	"ib_tasklet_call",
 	"ib_tx_cq_event",
 	"ib_tx_ring_full",
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 565/639] um: Fix off by one error in IRQ enumeration
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (563 preceding siblings ...)
  2020-01-24  9:32 ` [PATCH 4.19 564/639] net/rds: Fix ib_evt_handler_call element in rds_ib_stat_names Greg Kroah-Hartman
@ 2020-01-24  9:32 ` Greg Kroah-Hartman
  2020-01-24  9:32 ` [PATCH 4.19 566/639] bnxt_en: Increase timeout for HWRM_DBG_COREDUMP_XX commands Greg Kroah-Hartman
                   ` (77 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Anton Ivanov, Richard Weinberger,
	Sasha Levin

From: Anton Ivanov <anton.ivanov@cambridgegreys.com>

[ Upstream commit 09ccf0364ca3e94aba4093707ef433ea8014e2a4 ]

Fix an off-by-one in IRQ enumeration

Fixes: 49da7e64f33e ("High Performance UML Vector Network Driver")
Reported by: Dana Johnson <djohns042@gmail.com>
Signed-off-by: Anton Ivanov <anton.ivanov@cambridgegreys.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/um/include/asm/irq.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/um/include/asm/irq.h b/arch/um/include/asm/irq.h
index 49ed3e35b35ad..ce7a78c3bcf21 100644
--- a/arch/um/include/asm/irq.h
+++ b/arch/um/include/asm/irq.h
@@ -23,7 +23,7 @@
 #define VECTOR_BASE_IRQ		15
 #define VECTOR_IRQ_SPACE	8
 
-#define LAST_IRQ (VECTOR_IRQ_SPACE + VECTOR_BASE_IRQ)
+#define LAST_IRQ (VECTOR_IRQ_SPACE + VECTOR_BASE_IRQ - 1)
 
 #else
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 566/639] bnxt_en: Increase timeout for HWRM_DBG_COREDUMP_XX commands
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (564 preceding siblings ...)
  2020-01-24  9:32 ` [PATCH 4.19 565/639] um: Fix off by one error in IRQ enumeration Greg Kroah-Hartman
@ 2020-01-24  9:32 ` Greg Kroah-Hartman
  2020-01-24  9:32 ` [PATCH 4.19 567/639] f2fs: fix to avoid accessing uninitialized field of inode page in is_alive() Greg Kroah-Hartman
                   ` (76 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Vasundhara Volam, Michael Chan,
	David S. Miller, Sasha Levin

From: Vasundhara Volam <vasundhara-v.volam@broadcom.com>

[ Upstream commit 57a8730b1f7a0be7bf8a0a0bb665329074ba764f ]

Firmware coredump messages take much longer than standard messages,
so increase the timeout accordingly.

Fixes: 6c5657d085ae ("bnxt_en: Add support for ethtool get dump.")
Signed-off-by: Vasundhara Volam <vasundhara-v.volam@broadcom.com>
Signed-off-by: Michael Chan <michael.chan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/broadcom/bnxt/bnxt.h         | 1 +
 drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.h b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
index f9e253b705ece..585f5aef0a45b 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
@@ -527,6 +527,7 @@ struct rx_tpa_end_cmp_ext {
 #define DFLT_HWRM_CMD_TIMEOUT		500
 #define HWRM_CMD_TIMEOUT		(bp->hwrm_cmd_timeout)
 #define HWRM_RESET_TIMEOUT		((HWRM_CMD_TIMEOUT) * 4)
+#define HWRM_COREDUMP_TIMEOUT		((HWRM_CMD_TIMEOUT) * 12)
 #define HWRM_RESP_ERR_CODE_MASK		0xffff
 #define HWRM_RESP_LEN_OFFSET		4
 #define HWRM_RESP_LEN_MASK		0xffff0000
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
index cdbb8940a4ae5..047024717d654 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
@@ -2833,7 +2833,7 @@ static int bnxt_hwrm_dbg_coredump_initiate(struct bnxt *bp, u16 component_id,
 	req.component_id = cpu_to_le16(component_id);
 	req.segment_id = cpu_to_le16(segment_id);
 
-	return hwrm_send_message(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT);
+	return hwrm_send_message(bp, &req, sizeof(req), HWRM_COREDUMP_TIMEOUT);
 }
 
 static int bnxt_hwrm_dbg_coredump_retrieve(struct bnxt *bp, u16 component_id,
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 567/639] f2fs: fix to avoid accessing uninitialized field of inode page in is_alive()
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (565 preceding siblings ...)
  2020-01-24  9:32 ` [PATCH 4.19 566/639] bnxt_en: Increase timeout for HWRM_DBG_COREDUMP_XX commands Greg Kroah-Hartman
@ 2020-01-24  9:32 ` Greg Kroah-Hartman
  2020-01-24  9:32 ` [PATCH 4.19 568/639] mailbox: qcom-apcs: fix max_register value Greg Kroah-Hartman
                   ` (75 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chao Yu, Jaegeuk Kim, Sasha Levin

From: Chao Yu <yuchao0@huawei.com>

[ Upstream commit 98194030554cd9b10568a9b58f5a135c7e7cba85 ]

If inode is newly created, inode page may not synchronize with inode cache,
so fields like .i_inline or .i_extra_isize could be wrong, in below call
path, we may access such wrong fields, result in failing to migrate valid
target block.

Thread A				Thread B
- f2fs_create
 - f2fs_add_link
  - f2fs_add_dentry
   - f2fs_init_inode_metadata
    - f2fs_add_inline_entry
     - f2fs_new_inode_page
     - f2fs_put_page
     : inode page wasn't updated with inode cache
					- gc_data_segment
					 - is_alive
					  - f2fs_get_node_page
					  - datablock_addr
					   - offset_in_addr
					   : access uninitialized fields

Fixes: 7a2af766af15 ("f2fs: enhance on-disk inode structure scalability")
Signed-off-by: Chao Yu <yuchao0@huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/f2fs/dir.c    | 5 +++++
 fs/f2fs/inline.c | 5 +++++
 2 files changed, 10 insertions(+)

diff --git a/fs/f2fs/dir.c b/fs/f2fs/dir.c
index 0d3d848d186b9..ebe19894884be 100644
--- a/fs/f2fs/dir.c
+++ b/fs/f2fs/dir.c
@@ -572,6 +572,11 @@ add_dentry:
 
 	if (inode) {
 		f2fs_i_pino_write(inode, dir->i_ino);
+
+		/* synchronize inode page's data from inode cache */
+		if (is_inode_flag_set(inode, FI_NEW_INODE))
+			f2fs_update_inode(inode, page);
+
 		f2fs_put_page(page, 1);
 	}
 
diff --git a/fs/f2fs/inline.c b/fs/f2fs/inline.c
index 3fe0dd5313903..c1ba29d10789d 100644
--- a/fs/f2fs/inline.c
+++ b/fs/f2fs/inline.c
@@ -578,6 +578,11 @@ int f2fs_add_inline_entry(struct inode *dir, const struct qstr *new_name,
 	/* we don't need to mark_inode_dirty now */
 	if (inode) {
 		f2fs_i_pino_write(inode, dir->i_ino);
+
+		/* synchronize inode page's data from inode cache */
+		if (is_inode_flag_set(inode, FI_NEW_INODE))
+			f2fs_update_inode(inode, page);
+
 		f2fs_put_page(page, 1);
 	}
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 568/639] mailbox: qcom-apcs: fix max_register value
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (566 preceding siblings ...)
  2020-01-24  9:32 ` [PATCH 4.19 567/639] f2fs: fix to avoid accessing uninitialized field of inode page in is_alive() Greg Kroah-Hartman
@ 2020-01-24  9:32 ` Greg Kroah-Hartman
  2020-01-24  9:32 ` [PATCH 4.19 569/639] clk: actions: Fix factor clk struct member access Greg Kroah-Hartman
                   ` (74 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jorge Ramirez-Ortiz, Jassi Brar, Sasha Levin

From: Jorge Ramirez-Ortiz <jorge.ramirez-ortiz@linaro.org>

[ Upstream commit 556a0964e28c4441dcdd50fb07596fd042246bd5 ]

The mailbox length is 0x1000 hence the max_register value is 0xFFC.

Fixes: c6a8b171ca8e ("mailbox: qcom: Convert APCS IPC driver to use
regmap")
Signed-off-by: Jorge Ramirez-Ortiz <jorge.ramirez-ortiz@linaro.org>
Signed-off-by: Jassi Brar <jaswinder.singh@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mailbox/qcom-apcs-ipc-mailbox.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/mailbox/qcom-apcs-ipc-mailbox.c b/drivers/mailbox/qcom-apcs-ipc-mailbox.c
index 5255dcb551a78..d8b4f08f613b2 100644
--- a/drivers/mailbox/qcom-apcs-ipc-mailbox.c
+++ b/drivers/mailbox/qcom-apcs-ipc-mailbox.c
@@ -36,7 +36,7 @@ static const struct regmap_config apcs_regmap_config = {
 	.reg_bits = 32,
 	.reg_stride = 4,
 	.val_bits = 32,
-	.max_register = 0x1000,
+	.max_register = 0xFFC,
 	.fast_io = true,
 };
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 569/639] clk: actions: Fix factor clk struct member access
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (567 preceding siblings ...)
  2020-01-24  9:32 ` [PATCH 4.19 568/639] mailbox: qcom-apcs: fix max_register value Greg Kroah-Hartman
@ 2020-01-24  9:32 ` Greg Kroah-Hartman
  2020-01-24  9:32 ` [PATCH 4.19 570/639] powerpc/mm/mce: Keep irqs disabled during lockless page table walk Greg Kroah-Hartman
                   ` (73 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Manivannan Sadhasivam, Stephen Boyd,
	Sasha Levin

From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>

[ Upstream commit ed309bfb4812e8b31a3eb877e157b8028a49e50c ]

Since the helper "owl_factor_helper_round_rate" is shared between factor
and composite clocks, using the factor clk specific helper function
like "hw_to_owl_factor" to access its members will create issues when
called from composite clk specific code. Hence, pass the "factor_hw"
struct pointer directly instead of fetching it using factor clk specific
helpers.

This issue has been observed when a composite clock like "sd0_clk" tried
to call "owl_factor_helper_round_rate" resulting in pointer dereferencing
error.

While we are at it, let's rename the "clk_val_best" function to
"owl_clk_val_best" since this is an owl SoCs specific helper.

Fixes: 4bb78fc9744a ("clk: actions: Add factor clock support")
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Reviewed-by: Stephen Boyd <sboyd@kernel.org>
Link: https://lkml.kernel.org/r/20190916154546.24982-2-manivannan.sadhasivam@linaro.org
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/actions/owl-factor.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/drivers/clk/actions/owl-factor.c b/drivers/clk/actions/owl-factor.c
index 317d4a9e112ee..f15e2621fa185 100644
--- a/drivers/clk/actions/owl-factor.c
+++ b/drivers/clk/actions/owl-factor.c
@@ -64,11 +64,10 @@ static unsigned int _get_table_val(const struct clk_factor_table *table,
 	return val;
 }
 
-static int clk_val_best(struct clk_hw *hw, unsigned long rate,
+static int owl_clk_val_best(const struct owl_factor_hw *factor_hw,
+			struct clk_hw *hw, unsigned long rate,
 			unsigned long *best_parent_rate)
 {
-	struct owl_factor *factor = hw_to_owl_factor(hw);
-	struct owl_factor_hw *factor_hw = &factor->factor_hw;
 	const struct clk_factor_table *clkt = factor_hw->table;
 	unsigned long parent_rate, try_parent_rate, best = 0, cur_rate;
 	unsigned long parent_rate_saved = *best_parent_rate;
@@ -126,7 +125,7 @@ long owl_factor_helper_round_rate(struct owl_clk_common *common,
 	const struct clk_factor_table *clkt = factor_hw->table;
 	unsigned int val, mul = 0, div = 1;
 
-	val = clk_val_best(&common->hw, rate, parent_rate);
+	val = owl_clk_val_best(factor_hw, &common->hw, rate, parent_rate);
 	_get_table_div_mul(clkt, val, &mul, &div);
 
 	return *parent_rate * mul / div;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 570/639] powerpc/mm/mce: Keep irqs disabled during lockless page table walk
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (568 preceding siblings ...)
  2020-01-24  9:32 ` [PATCH 4.19 569/639] clk: actions: Fix factor clk struct member access Greg Kroah-Hartman
@ 2020-01-24  9:32 ` Greg Kroah-Hartman
  2020-01-24  9:32 ` [PATCH 4.19 571/639] bpf: fix BTF limits Greg Kroah-Hartman
                   ` (72 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Aneesh Kumar K.V, Michael Ellerman,
	Sasha Levin

From: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>

[ Upstream commit d9101bfa6adc831bda8836c4d774820553c14942 ]

__find_linux_mm_pte() returns a page table entry pointer after walking
the page table without holding locks. To make it safe against a THP
split and/or collapse, we disable interrupts around the lockless page
table walk. However we need to keep interrupts disabled as long as we
use the page table entry pointer that is returned.

Fix addr_to_pfn() to do that.

Fixes: ba41e1e1ccb9 ("powerpc/mce: Hookup derror (load/store) UE errors")
Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
[mpe: Rearrange code slightly and tweak change log wording]
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20190918145328.28602-1-aneesh.kumar@linux.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/kernel/mce_power.c | 20 ++++++++++++--------
 1 file changed, 12 insertions(+), 8 deletions(-)

diff --git a/arch/powerpc/kernel/mce_power.c b/arch/powerpc/kernel/mce_power.c
index 37a110b8e7e17..ecb3750406378 100644
--- a/arch/powerpc/kernel/mce_power.c
+++ b/arch/powerpc/kernel/mce_power.c
@@ -40,7 +40,7 @@ static unsigned long addr_to_pfn(struct pt_regs *regs, unsigned long addr)
 {
 	pte_t *ptep;
 	unsigned int shift;
-	unsigned long flags;
+	unsigned long pfn, flags;
 	struct mm_struct *mm;
 
 	if (user_mode(regs))
@@ -50,18 +50,22 @@ static unsigned long addr_to_pfn(struct pt_regs *regs, unsigned long addr)
 
 	local_irq_save(flags);
 	ptep = __find_linux_pte(mm->pgd, addr, NULL, &shift);
-	local_irq_restore(flags);
 
-	if (!ptep || pte_special(*ptep))
-		return ULONG_MAX;
+	if (!ptep || pte_special(*ptep)) {
+		pfn = ULONG_MAX;
+		goto out;
+	}
 
-	if (shift > PAGE_SHIFT) {
+	if (shift <= PAGE_SHIFT)
+		pfn = pte_pfn(*ptep);
+	else {
 		unsigned long rpnmask = (1ul << shift) - PAGE_SIZE;
-
-		return pte_pfn(__pte(pte_val(*ptep) | (addr & rpnmask)));
+		pfn = pte_pfn(__pte(pte_val(*ptep) | (addr & rpnmask)));
 	}
 
-	return pte_pfn(*ptep);
+out:
+	local_irq_restore(flags);
+	return pfn;
 }
 
 /* flush SLBs and reload */
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 571/639] bpf: fix BTF limits
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (569 preceding siblings ...)
  2020-01-24  9:32 ` [PATCH 4.19 570/639] powerpc/mm/mce: Keep irqs disabled during lockless page table walk Greg Kroah-Hartman
@ 2020-01-24  9:32 ` Greg Kroah-Hartman
  2020-01-24  9:32 ` [PATCH 4.19 572/639] crypto: hisilicon - Matching the dma address for dma_pool_free() Greg Kroah-Hartman
                   ` (71 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Alexei Starovoitov, Martin KaFai Lau,
	Daniel Borkmann, Sasha Levin

From: Alexei Starovoitov <ast@kernel.org>

[ Upstream commit a0791f0df7d212c245761538b17a9ea93607b667 ]

vmlinux BTF has more than 64k types.
Its string section is also at the offset larger than 64k.
Adjust both limits to make in-kernel BTF verifier successfully parse in-kernel BTF.

Fixes: 69b693f0aefa ("bpf: btf: Introduce BPF Type Format (BTF)")
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Martin KaFai Lau <kafai@fb.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/uapi/linux/btf.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/uapi/linux/btf.h b/include/uapi/linux/btf.h
index 972265f328717..1e2662ff05291 100644
--- a/include/uapi/linux/btf.h
+++ b/include/uapi/linux/btf.h
@@ -22,9 +22,9 @@ struct btf_header {
 };
 
 /* Max # of type identifier */
-#define BTF_MAX_TYPE	0x0000ffff
+#define BTF_MAX_TYPE	0x000fffff
 /* Max offset into the string section */
-#define BTF_MAX_NAME_OFFSET	0x0000ffff
+#define BTF_MAX_NAME_OFFSET	0x00ffffff
 /* Max # of struct/union/enum members or func args */
 #define BTF_MAX_VLEN	0xffff
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 572/639] crypto: hisilicon - Matching the dma address for dma_pool_free()
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (570 preceding siblings ...)
  2020-01-24  9:32 ` [PATCH 4.19 571/639] bpf: fix BTF limits Greg Kroah-Hartman
@ 2020-01-24  9:32 ` Greg Kroah-Hartman
  2020-01-24  9:32 ` [PATCH 4.19 573/639] iommu/amd: Wait for completion of IOTLB flush in attach_device Greg Kroah-Hartman
                   ` (70 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yunfeng Ye, Herbert Xu, Sasha Levin

From: Yunfeng Ye <yeyunfeng@huawei.com>

[ Upstream commit e00371af1d4ce73d527d8ee69fda2febaf5a42c2 ]

When dma_pool_zalloc() fail in sec_alloc_and_fill_hw_sgl(),
dma_pool_free() is invoked, but the parameters that sgl_current and
sgl_current->next_sgl is not match.

Using sec_free_hw_sgl() instead of the original free routine.

Fixes: 915e4e8413da ("crypto: hisilicon - SEC security accelerator driver")
Signed-off-by: Yunfeng Ye <yeyunfeng@huawei.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/hisilicon/sec/sec_algs.c | 44 +++++++++++--------------
 1 file changed, 19 insertions(+), 25 deletions(-)

diff --git a/drivers/crypto/hisilicon/sec/sec_algs.c b/drivers/crypto/hisilicon/sec/sec_algs.c
index db2983c51f1e6..bf9658800bda5 100644
--- a/drivers/crypto/hisilicon/sec/sec_algs.c
+++ b/drivers/crypto/hisilicon/sec/sec_algs.c
@@ -153,6 +153,24 @@ static void sec_alg_skcipher_init_context(struct crypto_skcipher *atfm,
 				       ctx->cipher_alg);
 }
 
+static void sec_free_hw_sgl(struct sec_hw_sgl *hw_sgl,
+			    dma_addr_t psec_sgl, struct sec_dev_info *info)
+{
+	struct sec_hw_sgl *sgl_current, *sgl_next;
+	dma_addr_t sgl_next_dma;
+
+	sgl_current = hw_sgl;
+	while (sgl_current) {
+		sgl_next = sgl_current->next;
+		sgl_next_dma = sgl_current->next_sgl;
+
+		dma_pool_free(info->hw_sgl_pool, sgl_current, psec_sgl);
+
+		sgl_current = sgl_next;
+		psec_sgl = sgl_next_dma;
+	}
+}
+
 static int sec_alloc_and_fill_hw_sgl(struct sec_hw_sgl **sec_sgl,
 				     dma_addr_t *psec_sgl,
 				     struct scatterlist *sgl,
@@ -199,36 +217,12 @@ static int sec_alloc_and_fill_hw_sgl(struct sec_hw_sgl **sec_sgl,
 	return 0;
 
 err_free_hw_sgls:
-	sgl_current = *sec_sgl;
-	while (sgl_current) {
-		sgl_next = sgl_current->next;
-		dma_pool_free(info->hw_sgl_pool, sgl_current,
-			      sgl_current->next_sgl);
-		sgl_current = sgl_next;
-	}
+	sec_free_hw_sgl(*sec_sgl, *psec_sgl, info);
 	*psec_sgl = 0;
 
 	return ret;
 }
 
-static void sec_free_hw_sgl(struct sec_hw_sgl *hw_sgl,
-			    dma_addr_t psec_sgl, struct sec_dev_info *info)
-{
-	struct sec_hw_sgl *sgl_current, *sgl_next;
-	dma_addr_t sgl_next_dma;
-
-	sgl_current = hw_sgl;
-	while (sgl_current) {
-		sgl_next = sgl_current->next;
-		sgl_next_dma = sgl_current->next_sgl;
-
-		dma_pool_free(info->hw_sgl_pool, sgl_current, psec_sgl);
-
-		sgl_current = sgl_next;
-		psec_sgl = sgl_next_dma;
-	}
-}
-
 static int sec_alg_skcipher_setkey(struct crypto_skcipher *tfm,
 				   const u8 *key, unsigned int keylen,
 				   enum sec_cipher_alg alg)
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 573/639] iommu/amd: Wait for completion of IOTLB flush in attach_device
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (571 preceding siblings ...)
  2020-01-24  9:32 ` [PATCH 4.19 572/639] crypto: hisilicon - Matching the dma address for dma_pool_free() Greg Kroah-Hartman
@ 2020-01-24  9:32 ` Greg Kroah-Hartman
  2020-01-24  9:32 ` [PATCH 4.19 574/639] net: aquantia: Fix aq_vec_isr_legacy() return value Greg Kroah-Hartman
                   ` (69 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Filippo Sironi, Joerg Roedel, Sasha Levin

From: Filippo Sironi <sironi@amazon.de>

[ Upstream commit 0b15e02f0cc4fb34a9160de7ba6db3a4013dc1b7 ]

To make sure the domain tlb flush completes before the
function returns, explicitly wait for its completion.

Signed-off-by: Filippo Sironi <sironi@amazon.de>
Fixes: 42a49f965a8d ("amd-iommu: flush domain tlb when attaching a new device")
[joro: Added commit message and fixes tag]
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iommu/amd_iommu.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
index 9991386fb7000..bea19aa337587 100644
--- a/drivers/iommu/amd_iommu.c
+++ b/drivers/iommu/amd_iommu.c
@@ -2153,6 +2153,8 @@ skip_ats_check:
 	 */
 	domain_flush_tlb_pde(domain);
 
+	domain_flush_complete(domain);
+
 	return ret;
 }
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 574/639] net: aquantia: Fix aq_vec_isr_legacy() return value
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (572 preceding siblings ...)
  2020-01-24  9:32 ` [PATCH 4.19 573/639] iommu/amd: Wait for completion of IOTLB flush in attach_device Greg Kroah-Hartman
@ 2020-01-24  9:32 ` Greg Kroah-Hartman
  2020-01-24  9:32 ` [PATCH 4.19 575/639] cxgb4: Signedness bug in init_one() Greg Kroah-Hartman
                   ` (68 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Igor Russkikh,
	David S. Miller, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit 31aefe14bc9f56566041303d733fda511d3a1c3e ]

The irqreturn_t type is an enum or an unsigned int in GCC.  That
creates to problems because it can't detect if the
self->aq_hw_ops->hw_irq_read() call fails and at the end the function
always returns IRQ_HANDLED.

drivers/net/ethernet/aquantia/atlantic/aq_vec.c:316 aq_vec_isr_legacy() warn: unsigned 'err' is never less than zero.
drivers/net/ethernet/aquantia/atlantic/aq_vec.c:329 aq_vec_isr_legacy() warn: always true condition '(err >= 0) => (0-u32max >= 0)'

Fixes: 970a2e9864b0 ("net: ethernet: aquantia: Vector operations")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Igor Russkikh <igor.russkikh@aquantia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/aquantia/atlantic/aq_vec.c | 15 ++++++---------
 1 file changed, 6 insertions(+), 9 deletions(-)

diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_vec.c b/drivers/net/ethernet/aquantia/atlantic/aq_vec.c
index 82582fa54d5d2..72aa2a4c4d666 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_vec.c
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_vec.c
@@ -309,15 +309,13 @@ irqreturn_t aq_vec_isr_legacy(int irq, void *private)
 {
 	struct aq_vec_s *self = private;
 	u64 irq_mask = 0U;
-	irqreturn_t err = 0;
+	int err;
 
-	if (!self) {
-		err = -EINVAL;
-		goto err_exit;
-	}
+	if (!self)
+		return IRQ_NONE;
 	err = self->aq_hw_ops->hw_irq_read(self->aq_hw, &irq_mask);
 	if (err < 0)
-		goto err_exit;
+		return IRQ_NONE;
 
 	if (irq_mask) {
 		self->aq_hw_ops->hw_irq_disable(self->aq_hw,
@@ -325,11 +323,10 @@ irqreturn_t aq_vec_isr_legacy(int irq, void *private)
 		napi_schedule(&self->napi);
 	} else {
 		self->aq_hw_ops->hw_irq_enable(self->aq_hw, 1U);
-		err = IRQ_NONE;
+		return IRQ_NONE;
 	}
 
-err_exit:
-	return err >= 0 ? IRQ_HANDLED : IRQ_NONE;
+	return IRQ_HANDLED;
 }
 
 cpumask_t *aq_vec_get_affinity_mask(struct aq_vec_s *self)
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 575/639] cxgb4: Signedness bug in init_one()
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (573 preceding siblings ...)
  2020-01-24  9:32 ` [PATCH 4.19 574/639] net: aquantia: Fix aq_vec_isr_legacy() return value Greg Kroah-Hartman
@ 2020-01-24  9:32 ` Greg Kroah-Hartman
  2020-01-24  9:32 ` [PATCH 4.19 576/639] net: hisilicon: Fix signedness bug in hix5hd2_dev_probe() Greg Kroah-Hartman
                   ` (67 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, David S. Miller, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit 286183147666fb76c057836c57d86e9e6f508bca ]

The "chip" variable is an enum, and it's treated as unsigned int by GCC
in this context so the error handling isn't triggered.

Fixes: e8d452923ae6 ("cxgb4: clean up init_one")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
index bb04c695ab9fd..c81d6c330548d 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
@@ -5452,7 +5452,7 @@ static int init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
 	whoami = t4_read_reg(adapter, PL_WHOAMI_A);
 	pci_read_config_word(pdev, PCI_DEVICE_ID, &device_id);
 	chip = t4_get_chip_type(adapter, CHELSIO_PCI_ID_VER(device_id));
-	if (chip < 0) {
+	if ((int)chip < 0) {
 		dev_err(&pdev->dev, "Device %d is not supported\n", device_id);
 		err = chip;
 		goto out_free_adapter;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 576/639] net: hisilicon: Fix signedness bug in hix5hd2_dev_probe()
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (574 preceding siblings ...)
  2020-01-24  9:32 ` [PATCH 4.19 575/639] cxgb4: Signedness bug in init_one() Greg Kroah-Hartman
@ 2020-01-24  9:32 ` Greg Kroah-Hartman
  2020-01-24  9:32 ` [PATCH 4.19 577/639] net: broadcom/bcmsysport: Fix signedness in bcm_sysport_probe() Greg Kroah-Hartman
                   ` (66 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, David S. Miller, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit 002dfe8085255b7bf1e0758c3d195c5412d35be9 ]

The "priv->phy_mode" variable is an enum and in this context GCC will
treat it as unsigned to the error handling will never trigger.

Fixes: 57c5bc9ad7d7 ("net: hisilicon: add hix5hd2 mac driver")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/hisilicon/hix5hd2_gmac.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/hisilicon/hix5hd2_gmac.c b/drivers/net/ethernet/hisilicon/hix5hd2_gmac.c
index 471805ea363b6..b63871ef8a403 100644
--- a/drivers/net/ethernet/hisilicon/hix5hd2_gmac.c
+++ b/drivers/net/ethernet/hisilicon/hix5hd2_gmac.c
@@ -1201,7 +1201,7 @@ static int hix5hd2_dev_probe(struct platform_device *pdev)
 		goto err_free_mdio;
 
 	priv->phy_mode = of_get_phy_mode(node);
-	if (priv->phy_mode < 0) {
+	if ((int)priv->phy_mode < 0) {
 		netdev_err(ndev, "not find phy-mode\n");
 		ret = -EINVAL;
 		goto err_mdiobus;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 577/639] net: broadcom/bcmsysport: Fix signedness in bcm_sysport_probe()
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (575 preceding siblings ...)
  2020-01-24  9:32 ` [PATCH 4.19 576/639] net: hisilicon: Fix signedness bug in hix5hd2_dev_probe() Greg Kroah-Hartman
@ 2020-01-24  9:32 ` Greg Kroah-Hartman
  2020-01-24  9:32 ` [PATCH 4.19 578/639] net: netsec: Fix signedness bug in netsec_probe() Greg Kroah-Hartman
                   ` (65 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Florian Fainelli,
	David S. Miller, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit 25a584955f020d6ec499c513923fb220f3112d2b ]

The "priv->phy_interface" variable is an enum and in this context GCC
will treat it as unsigned so the error handling will never be
triggered.

Fixes: 80105befdb4b ("net: systemport: add Broadcom SYSTEMPORT Ethernet MAC driver")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/broadcom/bcmsysport.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
index 0bdbc72605e1f..49aa3b5ea57cc 100644
--- a/drivers/net/ethernet/broadcom/bcmsysport.c
+++ b/drivers/net/ethernet/broadcom/bcmsysport.c
@@ -2470,7 +2470,7 @@ static int bcm_sysport_probe(struct platform_device *pdev)
 
 	priv->phy_interface = of_get_phy_mode(dn);
 	/* Default to GMII interface mode */
-	if (priv->phy_interface < 0)
+	if ((int)priv->phy_interface < 0)
 		priv->phy_interface = PHY_INTERFACE_MODE_GMII;
 
 	/* In the case of a fixed PHY, the DT node associated
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 578/639] net: netsec: Fix signedness bug in netsec_probe()
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (576 preceding siblings ...)
  2020-01-24  9:32 ` [PATCH 4.19 577/639] net: broadcom/bcmsysport: Fix signedness in bcm_sysport_probe() Greg Kroah-Hartman
@ 2020-01-24  9:32 ` Greg Kroah-Hartman
  2020-01-24  9:32 ` [PATCH 4.19 579/639] net: socionext: Fix a signedness bug in ave_probe() Greg Kroah-Hartman
                   ` (64 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, David S. Miller, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit bd55f8ddbc437c225391ca8f487e7ec10243c4cc ]

The "priv->phy_interface" variable is an enum and in this context GCC
will treat it as an unsigned int so the error handling is never
triggered.

Fixes: 533dd11a12f6 ("net: socionext: Add Synquacer NetSec driver")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/socionext/netsec.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/socionext/netsec.c b/drivers/net/ethernet/socionext/netsec.c
index d9d0d03e4ce79..027367b9cc480 100644
--- a/drivers/net/ethernet/socionext/netsec.c
+++ b/drivers/net/ethernet/socionext/netsec.c
@@ -1604,7 +1604,7 @@ static int netsec_probe(struct platform_device *pdev)
 			   NETIF_MSG_LINK | NETIF_MSG_PROBE;
 
 	priv->phy_interface = device_get_phy_mode(&pdev->dev);
-	if (priv->phy_interface < 0) {
+	if ((int)priv->phy_interface < 0) {
 		dev_err(&pdev->dev, "missing required property 'phy-mode'\n");
 		ret = -ENODEV;
 		goto free_ndev;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 579/639] net: socionext: Fix a signedness bug in ave_probe()
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (577 preceding siblings ...)
  2020-01-24  9:32 ` [PATCH 4.19 578/639] net: netsec: Fix signedness bug in netsec_probe() Greg Kroah-Hartman
@ 2020-01-24  9:32 ` Greg Kroah-Hartman
  2020-01-24  9:32 ` [PATCH 4.19 580/639] net: stmmac: dwmac-meson8b: Fix signedness bug in probe Greg Kroah-Hartman
                   ` (63 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Kunihiko Hayashi,
	David S. Miller, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit 7f9e88e6ef8c971f2c638b5ff7044c59b5d0f58d ]

The "phy_mode" variable is an enum and in this context GCC treats it as
an unsigned int so the error handling is never triggered.

Fixes: 4c270b55a5af ("net: ethernet: socionext: add AVE ethernet driver")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/socionext/sni_ave.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/socionext/sni_ave.c b/drivers/net/ethernet/socionext/sni_ave.c
index 09d25b87cf7c0..c309accc6797e 100644
--- a/drivers/net/ethernet/socionext/sni_ave.c
+++ b/drivers/net/ethernet/socionext/sni_ave.c
@@ -1575,7 +1575,7 @@ static int ave_probe(struct platform_device *pdev)
 
 	np = dev->of_node;
 	phy_mode = of_get_phy_mode(np);
-	if (phy_mode < 0) {
+	if ((int)phy_mode < 0) {
 		dev_err(dev, "phy-mode not found\n");
 		return -EINVAL;
 	}
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 580/639] net: stmmac: dwmac-meson8b: Fix signedness bug in probe
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (578 preceding siblings ...)
  2020-01-24  9:32 ` [PATCH 4.19 579/639] net: socionext: Fix a signedness bug in ave_probe() Greg Kroah-Hartman
@ 2020-01-24  9:32 ` Greg Kroah-Hartman
  2020-01-24  9:32 ` [PATCH 4.19 581/639] net: axienet: fix a " Greg Kroah-Hartman
                   ` (62 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Martin Blumenstingl,
	David S. Miller, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit f10210517a2f37feea2edf85eb34c98977265c16 ]

The "dwmac->phy_mode" is an enum and in this context GCC treats it as
an unsigned int so the error handling is never triggered.

Fixes: 566e82516253 ("net: stmmac: add a glue driver for the Amlogic Meson 8b / GXBB DWMAC")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c
index 94b46258e8ff8..0a17535f13ae4 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c
@@ -355,7 +355,7 @@ static int meson8b_dwmac_probe(struct platform_device *pdev)
 
 	dwmac->dev = &pdev->dev;
 	dwmac->phy_mode = of_get_phy_mode(pdev->dev.of_node);
-	if (dwmac->phy_mode < 0) {
+	if ((int)dwmac->phy_mode < 0) {
 		dev_err(&pdev->dev, "missing phy-mode property\n");
 		ret = -EINVAL;
 		goto err_remove_config_dt;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 581/639] net: axienet: fix a signedness bug in probe
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (579 preceding siblings ...)
  2020-01-24  9:32 ` [PATCH 4.19 580/639] net: stmmac: dwmac-meson8b: Fix signedness bug in probe Greg Kroah-Hartman
@ 2020-01-24  9:32 ` Greg Kroah-Hartman
  2020-01-24  9:32 ` [PATCH 4.19 582/639] of: mdio: Fix a signedness bug in of_phy_get_and_connect() Greg Kroah-Hartman
                   ` (61 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Radhey Shyam Pandey,
	David S. Miller, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit 73e211e11be86715d66bd3c9d38b3c34b05fca9a ]

The "lp->phy_mode" is an enum but in this context GCC treats it as an
unsigned int so the error handling is never triggered.

Fixes: ee06b1728b95 ("net: axienet: add support for standard phy-mode binding")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Radhey Shyam Pandey <radhey.shyam.pandey@xilinx.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
index 28764268a44f8..b093f14eeec39 100644
--- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
+++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
@@ -1573,7 +1573,7 @@ static int axienet_probe(struct platform_device *pdev)
 		}
 	} else {
 		lp->phy_mode = of_get_phy_mode(pdev->dev.of_node);
-		if (lp->phy_mode < 0) {
+		if ((int)lp->phy_mode < 0) {
 			ret = -EINVAL;
 			goto free_netdev;
 		}
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 582/639] of: mdio: Fix a signedness bug in of_phy_get_and_connect()
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (580 preceding siblings ...)
  2020-01-24  9:32 ` [PATCH 4.19 581/639] net: axienet: fix a " Greg Kroah-Hartman
@ 2020-01-24  9:32 ` Greg Kroah-Hartman
  2020-01-24  9:32 ` [PATCH 4.19 583/639] net: nixge: Fix a signedness bug in nixge_probe() Greg Kroah-Hartman
                   ` (60 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, David S. Miller, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit d7eb651212fdbafa82d485d8e76095ac3b14c193 ]

The "iface" variable is an enum and in this context GCC treats it as
an unsigned int so the error handling is never triggered.

Fixes: b78624125304 ("of_mdio: Abstract a general interface for phy connect")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/of/of_mdio.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/of/of_mdio.c b/drivers/of/of_mdio.c
index 5ad1342f56825..7d2bc22680d90 100644
--- a/drivers/of/of_mdio.c
+++ b/drivers/of/of_mdio.c
@@ -370,7 +370,7 @@ struct phy_device *of_phy_get_and_connect(struct net_device *dev,
 	int ret;
 
 	iface = of_get_phy_mode(np);
-	if (iface < 0)
+	if ((int)iface < 0)
 		return NULL;
 	if (of_phy_is_fixed_link(np)) {
 		ret = of_phy_register_fixed_link(np);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 583/639] net: nixge: Fix a signedness bug in nixge_probe()
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (581 preceding siblings ...)
  2020-01-24  9:32 ` [PATCH 4.19 582/639] of: mdio: Fix a signedness bug in of_phy_get_and_connect() Greg Kroah-Hartman
@ 2020-01-24  9:32 ` Greg Kroah-Hartman
  2020-01-24  9:32 ` [PATCH 4.19 584/639] net: ethernet: stmmac: Fix signedness bug in ipq806x_gmac_of_parse() Greg Kroah-Hartman
                   ` (59 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, David S. Miller, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit 1a4b62a0b8a3b81eca24366f63e214a7144b9f02 ]

The "priv->phy_mode" is an enum and in this context GCC will treat it
as an unsigned int so it can never be less than zero.

Fixes: 492caffa8a1a ("net: ethernet: nixge: Add support for National Instruments XGE netdev")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/ni/nixge.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/ni/nixge.c b/drivers/net/ethernet/ni/nixge.c
index 76efed058f334..a791d7932b0ef 100644
--- a/drivers/net/ethernet/ni/nixge.c
+++ b/drivers/net/ethernet/ni/nixge.c
@@ -1233,7 +1233,7 @@ static int nixge_probe(struct platform_device *pdev)
 	}
 
 	priv->phy_mode = of_get_phy_mode(pdev->dev.of_node);
-	if (priv->phy_mode < 0) {
+	if ((int)priv->phy_mode < 0) {
 		netdev_err(ndev, "not find \"phy-mode\" property\n");
 		err = -EINVAL;
 		goto unregister_mdio;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 584/639] net: ethernet: stmmac: Fix signedness bug in ipq806x_gmac_of_parse()
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (582 preceding siblings ...)
  2020-01-24  9:32 ` [PATCH 4.19 583/639] net: nixge: Fix a signedness bug in nixge_probe() Greg Kroah-Hartman
@ 2020-01-24  9:32 ` Greg Kroah-Hartman
  2020-01-24  9:32 ` [PATCH 4.19 585/639] net: sched: cbs: Avoid division by zero when calculating the port rate Greg Kroah-Hartman
                   ` (58 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, David S. Miller, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit 231042181dc9d6122c6faba64e99ccb25f13cc6c ]

The "gmac->phy_mode" variable is an enum and in this context GCC will
treat it as an unsigned int so the error handling will never be
triggered.

Fixes: b1c17215d718 ("stmmac: add ipq806x glue layer")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c
index 2c6d7c69c8f74..0d21082ceb93d 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c
@@ -191,7 +191,7 @@ static int ipq806x_gmac_of_parse(struct ipq806x_gmac *gmac)
 	struct device *dev = &gmac->pdev->dev;
 
 	gmac->phy_mode = of_get_phy_mode(dev->of_node);
-	if (gmac->phy_mode < 0) {
+	if ((int)gmac->phy_mode < 0) {
 		dev_err(dev, "missing phy mode property\n");
 		return -EINVAL;
 	}
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 585/639] net: sched: cbs: Avoid division by zero when calculating the port rate
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (583 preceding siblings ...)
  2020-01-24  9:32 ` [PATCH 4.19 584/639] net: ethernet: stmmac: Fix signedness bug in ipq806x_gmac_of_parse() Greg Kroah-Hartman
@ 2020-01-24  9:32 ` Greg Kroah-Hartman
  2020-01-24  9:32 ` [PATCH 4.19 586/639] nvme: retain split access workaround for capability reads Greg Kroah-Hartman
                   ` (57 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Vladimir Oltean,
	Vinicius Costa Gomes, David S. Miller, Sasha Levin

From: Vladimir Oltean <olteanv@gmail.com>

[ Upstream commit 83c8c3cf45163f0c823db37be6ab04dfcf8ac751 ]

As explained in the "net: sched: taprio: Avoid division by zero on
invalid link speed" commit, it is legal for the ethtool API to return
zero as a link speed. So guard against it to ensure we don't perform a
division by zero in kernel.

Fixes: e0a7683d30e9 ("net/sched: cbs: fix port_rate miscalculation")
Signed-off-by: Vladimir Oltean <olteanv@gmail.com>
Acked-by: Vinicius Costa Gomes <vinicius.gomes@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/sched/sch_cbs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/sched/sch_cbs.c b/net/sched/sch_cbs.c
index 289f66b9238d3..940e72d6db185 100644
--- a/net/sched/sch_cbs.c
+++ b/net/sched/sch_cbs.c
@@ -310,7 +310,7 @@ static void cbs_set_port_rate(struct net_device *dev, struct cbs_sched_data *q)
 	if (err < 0)
 		goto skip;
 
-	if (ecmd.base.speed != SPEED_UNKNOWN)
+	if (ecmd.base.speed && ecmd.base.speed != SPEED_UNKNOWN)
 		speed = ecmd.base.speed;
 
 skip:
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 586/639] nvme: retain split access workaround for capability reads
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (584 preceding siblings ...)
  2020-01-24  9:32 ` [PATCH 4.19 585/639] net: sched: cbs: Avoid division by zero when calculating the port rate Greg Kroah-Hartman
@ 2020-01-24  9:32 ` Greg Kroah-Hartman
  2020-01-24  9:32 ` [PATCH 4.19 587/639] net: stmmac: gmac4+: Not all Unicast addresses may be available Greg Kroah-Hartman
                   ` (56 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ard Biesheuvel, Sagi Grimberg, Sasha Levin

From: Ard Biesheuvel <ard.biesheuvel@linaro.org>

[ Upstream commit 3a8ecc935efabdad106b5e06d07b150c394b4465 ]

Commit 7fd8930f26be4

  "nvme: add a common helper to read Identify Controller data"

has re-introduced an issue that we have attempted to work around in the
past, in commit a310acd7a7ea ("NVMe: use split lo_hi_{read,write}q").

The problem is that some PCIe NVMe controllers do not implement 64-bit
outbound accesses correctly, which is why the commit above switched
to using lo_hi_[read|write]q for all 64-bit BAR accesses occuring in
the code.

In the mean time, the NVMe subsystem has been refactored, and now calls
into the PCIe support layer for NVMe via a .reg_read64() method, which
fails to use lo_hi_readq(), and thus reintroduces the problem that the
workaround above aimed to address.

Given that, at the moment, .reg_read64() is only used to read the
capability register [which is known to tolerate split reads], let's
switch .reg_read64() to lo_hi_readq() as well.

This fixes a boot issue on some ARM boxes with NVMe behind a Synopsys
DesignWare PCIe host controller.

Fixes: 7fd8930f26be4 ("nvme: add a common helper to read Identify Controller data")
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nvme/host/pci.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index 124f41157173e..3c68a5b35ec1b 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -2396,7 +2396,7 @@ static int nvme_pci_reg_write32(struct nvme_ctrl *ctrl, u32 off, u32 val)
 
 static int nvme_pci_reg_read64(struct nvme_ctrl *ctrl, u32 off, u64 *val)
 {
-	*val = readq(to_nvme_dev(ctrl)->bar + off);
+	*val = lo_hi_readq(to_nvme_dev(ctrl)->bar + off);
 	return 0;
 }
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 587/639] net: stmmac: gmac4+: Not all Unicast addresses may be available
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (585 preceding siblings ...)
  2020-01-24  9:32 ` [PATCH 4.19 586/639] nvme: retain split access workaround for capability reads Greg Kroah-Hartman
@ 2020-01-24  9:32 ` Greg Kroah-Hartman
  2020-01-26 16:50   ` Pavel Machek
  2020-01-24  9:32 ` [PATCH 4.19 588/639] rxrpc: Fix trace-after-put looking at the put connection record Greg Kroah-Hartman
                   ` (55 subsequent siblings)
  642 siblings, 1 reply; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jose Abreu, David S. Miller, Sasha Levin

From: Jose Abreu <Jose.Abreu@synopsys.com>

[ Upstream commit 25683bab09a70542b9f8e3e28f79b3369e56701f ]

Some setups may not have all Unicast addresses filters available. Check
the number of available filters before trying to setup it.

Fixes: 477286b53f55 ("stmmac: add GMAC4 core support")
Signed-off-by: Jose Abreu <Jose.Abreu@synopsys.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
index 48cf5e2b24417..bc8871e7351f2 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
@@ -443,7 +443,7 @@ static void dwmac4_set_filter(struct mac_device_info *hw,
 	}
 
 	/* Handle multiple unicast addresses */
-	if (netdev_uc_count(dev) > GMAC_MAX_PERFECT_ADDRESSES) {
+	if (netdev_uc_count(dev) > hw->unicast_filter_entries) {
 		/* Switch to promiscuous mode if more than 128 addrs
 		 * are required
 		 */
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 588/639] rxrpc: Fix trace-after-put looking at the put connection record
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (586 preceding siblings ...)
  2020-01-24  9:32 ` [PATCH 4.19 587/639] net: stmmac: gmac4+: Not all Unicast addresses may be available Greg Kroah-Hartman
@ 2020-01-24  9:32 ` Greg Kroah-Hartman
  2020-01-24  9:32 ` [PATCH 4.19 589/639] mac80211: accept deauth frames in IBSS mode Greg Kroah-Hartman
                   ` (54 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:32 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, David Howells, Sasha Levin

From: David Howells <dhowells@redhat.com>

[ Upstream commit 4c1295dccc0afe0905b6ca4c62ade7f2406f2cfb ]

rxrpc_put_*conn() calls trace_rxrpc_conn() after they have done the
decrement of the refcount - which looks at the debug_id in the connection
record.  But unless the refcount was reduced to zero, we no longer have the
right to look in the record and, indeed, it may be deleted by some other
thread.

Fix this by getting the debug_id out before decrementing the refcount and
then passing that into the tracepoint.

Fixes: 363deeab6d0f ("rxrpc: Add connection tracepoint and client conn state tracepoint")
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/trace/events/rxrpc.h |  6 +++---
 net/rxrpc/call_accept.c      |  2 +-
 net/rxrpc/conn_client.c      |  6 ++++--
 net/rxrpc/conn_object.c      | 13 +++++++------
 net/rxrpc/conn_service.c     |  2 +-
 5 files changed, 16 insertions(+), 13 deletions(-)

diff --git a/include/trace/events/rxrpc.h b/include/trace/events/rxrpc.h
index a08916eb76152..0924119bcfa40 100644
--- a/include/trace/events/rxrpc.h
+++ b/include/trace/events/rxrpc.h
@@ -554,10 +554,10 @@ TRACE_EVENT(rxrpc_peer,
 	    );
 
 TRACE_EVENT(rxrpc_conn,
-	    TP_PROTO(struct rxrpc_connection *conn, enum rxrpc_conn_trace op,
+	    TP_PROTO(unsigned int conn_debug_id, enum rxrpc_conn_trace op,
 		     int usage, const void *where),
 
-	    TP_ARGS(conn, op, usage, where),
+	    TP_ARGS(conn_debug_id, op, usage, where),
 
 	    TP_STRUCT__entry(
 		    __field(unsigned int,	conn		)
@@ -567,7 +567,7 @@ TRACE_EVENT(rxrpc_conn,
 			     ),
 
 	    TP_fast_assign(
-		    __entry->conn = conn->debug_id;
+		    __entry->conn = conn_debug_id;
 		    __entry->op = op;
 		    __entry->usage = usage;
 		    __entry->where = where;
diff --git a/net/rxrpc/call_accept.c b/net/rxrpc/call_accept.c
index 8079aacaecace..c5566bc4aaca3 100644
--- a/net/rxrpc/call_accept.c
+++ b/net/rxrpc/call_accept.c
@@ -88,7 +88,7 @@ static int rxrpc_service_prealloc_one(struct rxrpc_sock *rx,
 		smp_store_release(&b->conn_backlog_head,
 				  (head + 1) & (size - 1));
 
-		trace_rxrpc_conn(conn, rxrpc_conn_new_service,
+		trace_rxrpc_conn(conn->debug_id, rxrpc_conn_new_service,
 				 atomic_read(&conn->usage), here);
 	}
 
diff --git a/net/rxrpc/conn_client.c b/net/rxrpc/conn_client.c
index 3dbb126e60608..38d5485320242 100644
--- a/net/rxrpc/conn_client.c
+++ b/net/rxrpc/conn_client.c
@@ -217,7 +217,8 @@ rxrpc_alloc_client_connection(struct rxrpc_conn_parameters *cp, gfp_t gfp)
 	rxrpc_get_local(conn->params.local);
 	key_get(conn->params.key);
 
-	trace_rxrpc_conn(conn, rxrpc_conn_new_client, atomic_read(&conn->usage),
+	trace_rxrpc_conn(conn->debug_id, rxrpc_conn_new_client,
+			 atomic_read(&conn->usage),
 			 __builtin_return_address(0));
 	trace_rxrpc_client(conn, -1, rxrpc_client_alloc);
 	_leave(" = %p", conn);
@@ -989,11 +990,12 @@ rxrpc_put_one_client_conn(struct rxrpc_connection *conn)
 void rxrpc_put_client_conn(struct rxrpc_connection *conn)
 {
 	const void *here = __builtin_return_address(0);
+	unsigned int debug_id = conn->debug_id;
 	int n;
 
 	do {
 		n = atomic_dec_return(&conn->usage);
-		trace_rxrpc_conn(conn, rxrpc_conn_put_client, n, here);
+		trace_rxrpc_conn(debug_id, rxrpc_conn_put_client, n, here);
 		if (n > 0)
 			return;
 		ASSERTCMP(n, >=, 0);
diff --git a/net/rxrpc/conn_object.c b/net/rxrpc/conn_object.c
index 004a6eb529bc1..f338efd2880aa 100644
--- a/net/rxrpc/conn_object.c
+++ b/net/rxrpc/conn_object.c
@@ -272,7 +272,7 @@ bool rxrpc_queue_conn(struct rxrpc_connection *conn)
 	if (n == 0)
 		return false;
 	if (rxrpc_queue_work(&conn->processor))
-		trace_rxrpc_conn(conn, rxrpc_conn_queued, n + 1, here);
+		trace_rxrpc_conn(conn->debug_id, rxrpc_conn_queued, n + 1, here);
 	else
 		rxrpc_put_connection(conn);
 	return true;
@@ -287,7 +287,7 @@ void rxrpc_see_connection(struct rxrpc_connection *conn)
 	if (conn) {
 		int n = atomic_read(&conn->usage);
 
-		trace_rxrpc_conn(conn, rxrpc_conn_seen, n, here);
+		trace_rxrpc_conn(conn->debug_id, rxrpc_conn_seen, n, here);
 	}
 }
 
@@ -299,7 +299,7 @@ void rxrpc_get_connection(struct rxrpc_connection *conn)
 	const void *here = __builtin_return_address(0);
 	int n = atomic_inc_return(&conn->usage);
 
-	trace_rxrpc_conn(conn, rxrpc_conn_got, n, here);
+	trace_rxrpc_conn(conn->debug_id, rxrpc_conn_got, n, here);
 }
 
 /*
@@ -313,7 +313,7 @@ rxrpc_get_connection_maybe(struct rxrpc_connection *conn)
 	if (conn) {
 		int n = atomic_fetch_add_unless(&conn->usage, 1, 0);
 		if (n > 0)
-			trace_rxrpc_conn(conn, rxrpc_conn_got, n + 1, here);
+			trace_rxrpc_conn(conn->debug_id, rxrpc_conn_got, n + 1, here);
 		else
 			conn = NULL;
 	}
@@ -336,10 +336,11 @@ static void rxrpc_set_service_reap_timer(struct rxrpc_net *rxnet,
 void rxrpc_put_service_conn(struct rxrpc_connection *conn)
 {
 	const void *here = __builtin_return_address(0);
+	unsigned int debug_id = conn->debug_id;
 	int n;
 
 	n = atomic_dec_return(&conn->usage);
-	trace_rxrpc_conn(conn, rxrpc_conn_put_service, n, here);
+	trace_rxrpc_conn(debug_id, rxrpc_conn_put_service, n, here);
 	ASSERTCMP(n, >=, 0);
 	if (n == 1)
 		rxrpc_set_service_reap_timer(conn->params.local->rxnet,
@@ -423,7 +424,7 @@ void rxrpc_service_connection_reaper(struct work_struct *work)
 		 */
 		if (atomic_cmpxchg(&conn->usage, 1, 0) != 1)
 			continue;
-		trace_rxrpc_conn(conn, rxrpc_conn_reap_service, 0, NULL);
+		trace_rxrpc_conn(conn->debug_id, rxrpc_conn_reap_service, 0, NULL);
 
 		if (rxrpc_conn_is_client(conn))
 			BUG();
diff --git a/net/rxrpc/conn_service.c b/net/rxrpc/conn_service.c
index 80773a50c7551..6da7c4bf15e88 100644
--- a/net/rxrpc/conn_service.c
+++ b/net/rxrpc/conn_service.c
@@ -138,7 +138,7 @@ struct rxrpc_connection *rxrpc_prealloc_service_connection(struct rxrpc_net *rxn
 		list_add_tail(&conn->proc_link, &rxnet->conn_proc_list);
 		write_unlock(&rxnet->conn_lock);
 
-		trace_rxrpc_conn(conn, rxrpc_conn_new_service,
+		trace_rxrpc_conn(conn->debug_id, rxrpc_conn_new_service,
 				 atomic_read(&conn->usage),
 				 __builtin_return_address(0));
 	}
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 589/639] mac80211: accept deauth frames in IBSS mode
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (587 preceding siblings ...)
  2020-01-24  9:32 ` [PATCH 4.19 588/639] rxrpc: Fix trace-after-put looking at the put connection record Greg Kroah-Hartman
@ 2020-01-24  9:32 ` Greg Kroah-Hartman
  2020-01-24  9:32 ` [PATCH 4.19 590/639] llc: fix another potential sk_buff leak in llc_ui_sendmsg() Greg Kroah-Hartman
                   ` (53 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Johannes Berg, Luca Coelho, Sasha Levin

From: Johannes Berg <johannes.berg@intel.com>

[ Upstream commit 95697f9907bfe3eab0ef20265a766b22e27dde64 ]

We can process deauth frames and all, but we drop them very
early in the RX path today - this could never have worked.

Fixes: 2cc59e784b54 ("mac80211: reply to AUTH with DEAUTH if sta allocation fails in IBSS")
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/20191004123706.15768-2-luca@coelho.fi
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/mac80211/rx.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index b12f23c996f4e..02d0b22d01141 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -3391,9 +3391,18 @@ ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx)
 	case cpu_to_le16(IEEE80211_STYPE_PROBE_RESP):
 		/* process for all: mesh, mlme, ibss */
 		break;
+	case cpu_to_le16(IEEE80211_STYPE_DEAUTH):
+		if (is_multicast_ether_addr(mgmt->da) &&
+		    !is_broadcast_ether_addr(mgmt->da))
+			return RX_DROP_MONITOR;
+
+		/* process only for station/IBSS */
+		if (sdata->vif.type != NL80211_IFTYPE_STATION &&
+		    sdata->vif.type != NL80211_IFTYPE_ADHOC)
+			return RX_DROP_MONITOR;
+		break;
 	case cpu_to_le16(IEEE80211_STYPE_ASSOC_RESP):
 	case cpu_to_le16(IEEE80211_STYPE_REASSOC_RESP):
-	case cpu_to_le16(IEEE80211_STYPE_DEAUTH):
 	case cpu_to_le16(IEEE80211_STYPE_DISASSOC):
 		if (is_multicast_ether_addr(mgmt->da) &&
 		    !is_broadcast_ether_addr(mgmt->da))
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 590/639] llc: fix another potential sk_buff leak in llc_ui_sendmsg()
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (588 preceding siblings ...)
  2020-01-24  9:32 ` [PATCH 4.19 589/639] mac80211: accept deauth frames in IBSS mode Greg Kroah-Hartman
@ 2020-01-24  9:32 ` Greg Kroah-Hartman
  2020-01-24  9:32 ` [PATCH 4.19 591/639] llc: fix sk_buff refcounting in llc_conn_state_process() Greg Kroah-Hartman
                   ` (52 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Eric Biggers, Jakub Kicinski, Sasha Levin

From: Eric Biggers <ebiggers@google.com>

[ Upstream commit fc8d5db10cbe1338a52ebc74e7feab9276721774 ]

All callers of llc_conn_state_process() except llc_build_and_send_pkt()
(via llc_ui_sendmsg() -> llc_ui_send_data()) assume that it always
consumes a reference to the skb.  Fix this caller to do the same.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/llc/af_llc.c   | 34 ++++++++++++++++++++--------------
 net/llc/llc_conn.c |  2 ++
 net/llc/llc_if.c   | 12 ++++++++----
 3 files changed, 30 insertions(+), 18 deletions(-)

diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
index b99e73a7e7e0f..ce841d59bc72a 100644
--- a/net/llc/af_llc.c
+++ b/net/llc/af_llc.c
@@ -113,22 +113,26 @@ static inline u8 llc_ui_header_len(struct sock *sk, struct sockaddr_llc *addr)
  *
  *	Send data via reliable llc2 connection.
  *	Returns 0 upon success, non-zero if action did not succeed.
+ *
+ *	This function always consumes a reference to the skb.
  */
 static int llc_ui_send_data(struct sock* sk, struct sk_buff *skb, int noblock)
 {
 	struct llc_sock* llc = llc_sk(sk);
-	int rc = 0;
 
 	if (unlikely(llc_data_accept_state(llc->state) ||
 		     llc->remote_busy_flag ||
 		     llc->p_flag)) {
 		long timeout = sock_sndtimeo(sk, noblock);
+		int rc;
 
 		rc = llc_ui_wait_for_busy_core(sk, timeout);
+		if (rc) {
+			kfree_skb(skb);
+			return rc;
+		}
 	}
-	if (unlikely(!rc))
-		rc = llc_build_and_send_pkt(sk, skb);
-	return rc;
+	return llc_build_and_send_pkt(sk, skb);
 }
 
 static void llc_ui_sk_init(struct socket *sock, struct sock *sk)
@@ -900,7 +904,7 @@ static int llc_ui_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
 	DECLARE_SOCKADDR(struct sockaddr_llc *, addr, msg->msg_name);
 	int flags = msg->msg_flags;
 	int noblock = flags & MSG_DONTWAIT;
-	struct sk_buff *skb;
+	struct sk_buff *skb = NULL;
 	size_t size = 0;
 	int rc = -EINVAL, copied = 0, hdrlen;
 
@@ -909,10 +913,10 @@ static int llc_ui_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
 	lock_sock(sk);
 	if (addr) {
 		if (msg->msg_namelen < sizeof(*addr))
-			goto release;
+			goto out;
 	} else {
 		if (llc_ui_addr_null(&llc->addr))
-			goto release;
+			goto out;
 		addr = &llc->addr;
 	}
 	/* must bind connection to sap if user hasn't done it. */
@@ -920,7 +924,7 @@ static int llc_ui_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
 		/* bind to sap with null dev, exclusive. */
 		rc = llc_ui_autobind(sock, addr);
 		if (rc)
-			goto release;
+			goto out;
 	}
 	hdrlen = llc->dev->hard_header_len + llc_ui_header_len(sk, addr);
 	size = hdrlen + len;
@@ -929,12 +933,12 @@ static int llc_ui_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
 	copied = size - hdrlen;
 	rc = -EINVAL;
 	if (copied < 0)
-		goto release;
+		goto out;
 	release_sock(sk);
 	skb = sock_alloc_send_skb(sk, size, noblock, &rc);
 	lock_sock(sk);
 	if (!skb)
-		goto release;
+		goto out;
 	skb->dev      = llc->dev;
 	skb->protocol = llc_proto_type(addr->sllc_arphrd);
 	skb_reserve(skb, hdrlen);
@@ -944,29 +948,31 @@ static int llc_ui_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
 	if (sk->sk_type == SOCK_DGRAM || addr->sllc_ua) {
 		llc_build_and_send_ui_pkt(llc->sap, skb, addr->sllc_mac,
 					  addr->sllc_sap);
+		skb = NULL;
 		goto out;
 	}
 	if (addr->sllc_test) {
 		llc_build_and_send_test_pkt(llc->sap, skb, addr->sllc_mac,
 					    addr->sllc_sap);
+		skb = NULL;
 		goto out;
 	}
 	if (addr->sllc_xid) {
 		llc_build_and_send_xid_pkt(llc->sap, skb, addr->sllc_mac,
 					   addr->sllc_sap);
+		skb = NULL;
 		goto out;
 	}
 	rc = -ENOPROTOOPT;
 	if (!(sk->sk_type == SOCK_STREAM && !addr->sllc_ua))
 		goto out;
 	rc = llc_ui_send_data(sk, skb, noblock);
+	skb = NULL;
 out:
-	if (rc) {
-		kfree_skb(skb);
-release:
+	kfree_skb(skb);
+	if (rc)
 		dprintk("%s: failed sending from %02X to %02X: %d\n",
 			__func__, llc->laddr.lsap, llc->daddr.lsap, rc);
-	}
 	release_sock(sk);
 	return rc ? : copied;
 }
diff --git a/net/llc/llc_conn.c b/net/llc/llc_conn.c
index ed2aca12460ca..0b0c6f12153b0 100644
--- a/net/llc/llc_conn.c
+++ b/net/llc/llc_conn.c
@@ -55,6 +55,8 @@ int sysctl_llc2_busy_timeout = LLC2_BUSY_TIME * HZ;
  *	(executing it's actions and changing state), upper layer will be
  *	indicated or confirmed, if needed. Returns 0 for success, 1 for
  *	failure. The socket lock has to be held before calling this function.
+ *
+ *	This function always consumes a reference to the skb.
  */
 int llc_conn_state_process(struct sock *sk, struct sk_buff *skb)
 {
diff --git a/net/llc/llc_if.c b/net/llc/llc_if.c
index 8db03c2d5440b..ad6547736c219 100644
--- a/net/llc/llc_if.c
+++ b/net/llc/llc_if.c
@@ -38,6 +38,8 @@
  *	closed and -EBUSY when sending data is not permitted in this state or
  *	LLC has send an I pdu with p bit set to 1 and is waiting for it's
  *	response.
+ *
+ *	This function always consumes a reference to the skb.
  */
 int llc_build_and_send_pkt(struct sock *sk, struct sk_buff *skb)
 {
@@ -46,20 +48,22 @@ int llc_build_and_send_pkt(struct sock *sk, struct sk_buff *skb)
 	struct llc_sock *llc = llc_sk(sk);
 
 	if (unlikely(llc->state == LLC_CONN_STATE_ADM))
-		goto out;
+		goto out_free;
 	rc = -EBUSY;
 	if (unlikely(llc_data_accept_state(llc->state) || /* data_conn_refuse */
 		     llc->p_flag)) {
 		llc->failed_data_req = 1;
-		goto out;
+		goto out_free;
 	}
 	ev = llc_conn_ev(skb);
 	ev->type      = LLC_CONN_EV_TYPE_PRIM;
 	ev->prim      = LLC_DATA_PRIM;
 	ev->prim_type = LLC_PRIM_TYPE_REQ;
 	skb->dev      = llc->dev;
-	rc = llc_conn_state_process(sk, skb);
-out:
+	return llc_conn_state_process(sk, skb);
+
+out_free:
+	kfree_skb(skb);
 	return rc;
 }
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 591/639] llc: fix sk_buff refcounting in llc_conn_state_process()
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (589 preceding siblings ...)
  2020-01-24  9:32 ` [PATCH 4.19 590/639] llc: fix another potential sk_buff leak in llc_ui_sendmsg() Greg Kroah-Hartman
@ 2020-01-24  9:32 ` Greg Kroah-Hartman
  2020-01-24  9:32 ` [PATCH 4.19 592/639] ip6erspan: remove the incorrect mtu limit for ip6erspan Greg Kroah-Hartman
                   ` (51 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Eric Biggers, Jakub Kicinski, Sasha Levin

From: Eric Biggers <ebiggers@google.com>

[ Upstream commit 36453c852816f19947ca482a595dffdd2efa4965 ]

If llc_conn_state_process() sees that llc_conn_service() put the skb on
a list, it will drop one fewer references to it.  This is wrong because
the current behavior is that llc_conn_service() never consumes a
reference to the skb.

The code also makes the number of skb references being dropped
conditional on which of ind_prim and cfm_prim are nonzero, yet neither
of these affects how many references are *acquired*.  So there is extra
code that tries to fix this up by sometimes taking another reference.

Remove the unnecessary/broken refcounting logic and instead just add an
skb_get() before the only two places where an extra reference is
actually consumed.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/llc/llc_conn.c | 33 ++++++---------------------------
 1 file changed, 6 insertions(+), 27 deletions(-)

diff --git a/net/llc/llc_conn.c b/net/llc/llc_conn.c
index 0b0c6f12153b0..a79b739eb2236 100644
--- a/net/llc/llc_conn.c
+++ b/net/llc/llc_conn.c
@@ -64,12 +64,6 @@ int llc_conn_state_process(struct sock *sk, struct sk_buff *skb)
 	struct llc_sock *llc = llc_sk(skb->sk);
 	struct llc_conn_state_ev *ev = llc_conn_ev(skb);
 
-	/*
-	 * We have to hold the skb, because llc_conn_service will kfree it in
-	 * the sending path and we need to look at the skb->cb, where we encode
-	 * llc_conn_state_ev.
-	 */
-	skb_get(skb);
 	ev->ind_prim = ev->cfm_prim = 0;
 	/*
 	 * Send event to state machine
@@ -77,21 +71,12 @@ int llc_conn_state_process(struct sock *sk, struct sk_buff *skb)
 	rc = llc_conn_service(skb->sk, skb);
 	if (unlikely(rc != 0)) {
 		printk(KERN_ERR "%s: llc_conn_service failed\n", __func__);
-		goto out_kfree_skb;
-	}
-
-	if (unlikely(!ev->ind_prim && !ev->cfm_prim)) {
-		/* indicate or confirm not required */
-		if (!skb->next)
-			goto out_kfree_skb;
 		goto out_skb_put;
 	}
 
-	if (unlikely(ev->ind_prim && ev->cfm_prim)) /* Paranoia */
-		skb_get(skb);
-
 	switch (ev->ind_prim) {
 	case LLC_DATA_PRIM:
+		skb_get(skb);
 		llc_save_primitive(sk, skb, LLC_DATA_PRIM);
 		if (unlikely(sock_queue_rcv_skb(sk, skb))) {
 			/*
@@ -108,6 +93,7 @@ int llc_conn_state_process(struct sock *sk, struct sk_buff *skb)
 		 * skb->sk pointing to the newly created struct sock in
 		 * llc_conn_handler. -acme
 		 */
+		skb_get(skb);
 		skb_queue_tail(&sk->sk_receive_queue, skb);
 		sk->sk_state_change(sk);
 		break;
@@ -123,7 +109,6 @@ int llc_conn_state_process(struct sock *sk, struct sk_buff *skb)
 				sk->sk_state_change(sk);
 			}
 		}
-		kfree_skb(skb);
 		sock_put(sk);
 		break;
 	case LLC_RESET_PRIM:
@@ -132,14 +117,11 @@ int llc_conn_state_process(struct sock *sk, struct sk_buff *skb)
 		 * RESET is not being notified to upper layers for now
 		 */
 		printk(KERN_INFO "%s: received a reset ind!\n", __func__);
-		kfree_skb(skb);
 		break;
 	default:
-		if (ev->ind_prim) {
+		if (ev->ind_prim)
 			printk(KERN_INFO "%s: received unknown %d prim!\n",
 				__func__, ev->ind_prim);
-			kfree_skb(skb);
-		}
 		/* No indication */
 		break;
 	}
@@ -181,15 +163,12 @@ int llc_conn_state_process(struct sock *sk, struct sk_buff *skb)
 		printk(KERN_INFO "%s: received a reset conf!\n", __func__);
 		break;
 	default:
-		if (ev->cfm_prim) {
+		if (ev->cfm_prim)
 			printk(KERN_INFO "%s: received unknown %d prim!\n",
 					__func__, ev->cfm_prim);
-			break;
-		}
-		goto out_skb_put; /* No confirmation */
+		/* No confirmation */
+		break;
 	}
-out_kfree_skb:
-	kfree_skb(skb);
 out_skb_put:
 	kfree_skb(skb);
 	return rc;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 592/639] ip6erspan: remove the incorrect mtu limit for ip6erspan
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (590 preceding siblings ...)
  2020-01-24  9:32 ` [PATCH 4.19 591/639] llc: fix sk_buff refcounting in llc_conn_state_process() Greg Kroah-Hartman
@ 2020-01-24  9:32 ` Greg Kroah-Hartman
  2020-01-24  9:32 ` [PATCH 4.19 593/639] net: stmmac: fix length of PTP clocks name string Greg Kroah-Hartman
                   ` (50 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Haishuang Yan, William Tu,
	Jakub Kicinski, Sasha Levin

From: Haishuang Yan <yanhaishuang@cmss.chinamobile.com>

[ Upstream commit 4123f637a5129470ff9d3cb00a5a4e213f2e15cc ]

ip6erspan driver calls ether_setup(), after commit 61e84623ace3
("net: centralize net_device min/max MTU checking"), the range
of mtu is [min_mtu, max_mtu], which is [68, 1500] by default.

It causes the dev mtu of the erspan device to not be greater
than 1500, this limit value is not correct for ip6erspan tap
device.

Fixes: 61e84623ace3 ("net: centralize net_device min/max MTU checking")
Signed-off-by: Haishuang Yan <yanhaishuang@cmss.chinamobile.com>
Acked-by: William Tu <u9012063@gmail.com>
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ipv6/ip6_gre.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index b3515a4f13039..1f2d0022ba6fd 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -2218,6 +2218,7 @@ static void ip6erspan_tap_setup(struct net_device *dev)
 {
 	ether_setup(dev);
 
+	dev->max_mtu = 0;
 	dev->netdev_ops = &ip6erspan_netdev_ops;
 	dev->needs_free_netdev = true;
 	dev->priv_destructor = ip6gre_dev_free;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 593/639] net: stmmac: fix length of PTP clocks name string
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (591 preceding siblings ...)
  2020-01-24  9:32 ` [PATCH 4.19 592/639] ip6erspan: remove the incorrect mtu limit for ip6erspan Greg Kroah-Hartman
@ 2020-01-24  9:32 ` Greg Kroah-Hartman
  2020-01-24  9:32 ` [PATCH 4.19 594/639] net: stmmac: fix disabling flexible PPS output Greg Kroah-Hartman
                   ` (49 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Antonio Borneo, Jakub Kicinski, Sasha Levin

From: Antonio Borneo <antonio.borneo@st.com>

[ Upstream commit 5da202c88f8c355ad79bc2e8eb582e6d433060e7 ]

The field "name" in struct ptp_clock_info has a fixed size of 16
chars and is used as zero terminated string by clock_name_show()
in drivers/ptp/ptp_sysfs.c
The current initialization value requires 17 chars to fit also the
null termination, and this causes overflow to the next bytes in
the struct when the string is read as null terminated:
	hexdump -C /sys/class/ptp/ptp0/clock_name
	00000000  73 74 6d 6d 61 63 5f 70  74 70 5f 63 6c 6f 63 6b  |stmmac_ptp_clock|
	00000010  a0 ac b9 03 0a                                    |.....|
where the extra 4 bytes (excluding the newline) after the string
represent the integer 0x03b9aca0 = 62500000 assigned to the field
"max_adj" that follows "name" in the same struct.

There is no strict requirement for the "name" content and in the
comment in ptp_clock_kernel.h it's reported it should just be 'A
short "friendly name" to identify the clock'.
Replace it with "stmmac ptp".

Signed-off-by: Antonio Borneo <antonio.borneo@st.com>
Fixes: 92ba6888510c ("stmmac: add the support for PTP hw clock driver")
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c
index cc60b3fb08927..8f8b8f381ffd4 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c
@@ -174,7 +174,7 @@ static int stmmac_enable(struct ptp_clock_info *ptp,
 /* structure describing a PTP hardware clock */
 static struct ptp_clock_info stmmac_ptp_clock_ops = {
 	.owner = THIS_MODULE,
-	.name = "stmmac_ptp_clock",
+	.name = "stmmac ptp",
 	.max_adj = 62500000,
 	.n_alarm = 0,
 	.n_ext_ts = 0,
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 594/639] net: stmmac: fix disabling flexible PPS output
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (592 preceding siblings ...)
  2020-01-24  9:32 ` [PATCH 4.19 593/639] net: stmmac: fix length of PTP clocks name string Greg Kroah-Hartman
@ 2020-01-24  9:32 ` Greg Kroah-Hartman
  2020-01-24  9:32 ` [PATCH 4.19 595/639] sctp: add chunks to sk_backlog when the newsk sk_socket is not set Greg Kroah-Hartman
                   ` (48 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Antonio Borneo, Jakub Kicinski, Sasha Levin

From: Antonio Borneo <antonio.borneo@st.com>

[ Upstream commit 520cf6002147281d1e7b522bb338416b623dcb93 ]

Accordingly to Synopsys documentation [1] and [2], when bit PPSEN0
in register MAC_PPS_CONTROL is set it selects the functionality
command in the same register, otherwise selects the functionality
control.
Command functionality is required to either enable (command 0x2)
and disable (command 0x5) the flexible PPS output, but the bit
PPSEN0 is currently set only for enabling.

Set the bit PPSEN0 to properly disable flexible PPS output.

Tested on STM32MP15x, based on dwmac 4.10a.

[1] DWC Ethernet QoS Databook 4.10a October 2014
[2] DWC Ethernet QoS Databook 5.00a September 2017

Signed-off-by: Antonio Borneo <antonio.borneo@st.com>
Fixes: 9a8a02c9d46d ("net: stmmac: Add Flexible PPS support")
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/stmicro/stmmac/dwmac5.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac5.c b/drivers/net/ethernet/stmicro/stmmac/dwmac5.c
index 3f4f3132e16b3..e436fa160c7d6 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac5.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac5.c
@@ -515,6 +515,7 @@ int dwmac5_flex_pps_config(void __iomem *ioaddr, int index,
 
 	if (!enable) {
 		val |= PPSCMDx(index, 0x5);
+		val |= PPSEN0;
 		writel(val, ioaddr + MAC_PPS_CONTROL);
 		return 0;
 	}
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 595/639] sctp: add chunks to sk_backlog when the newsk sk_socket is not set
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (593 preceding siblings ...)
  2020-01-24  9:32 ` [PATCH 4.19 594/639] net: stmmac: fix disabling flexible PPS output Greg Kroah-Hartman
@ 2020-01-24  9:32 ` Greg Kroah-Hartman
  2020-01-24  9:32 ` [PATCH 4.19 596/639] s390/qeth: Fix error handling during VNICC initialization Greg Kroah-Hartman
                   ` (47 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ying Xu, Marcelo Ricardo Leitner,
	Xin Long, Neil Horman, Jakub Kicinski, Sasha Levin

From: Xin Long <lucien.xin@gmail.com>

[ Upstream commit 819be8108fded0b9e710bbbf81193e52f7bab2f7 ]

This patch is to fix a NULL-ptr deref in selinux_socket_connect_helper:

  [...] kasan: GPF could be caused by NULL-ptr deref or user memory access
  [...] RIP: 0010:selinux_socket_connect_helper+0x94/0x460
  [...] Call Trace:
  [...]  selinux_sctp_bind_connect+0x16a/0x1d0
  [...]  security_sctp_bind_connect+0x58/0x90
  [...]  sctp_process_asconf+0xa52/0xfd0 [sctp]
  [...]  sctp_sf_do_asconf+0x785/0x980 [sctp]
  [...]  sctp_do_sm+0x175/0x5a0 [sctp]
  [...]  sctp_assoc_bh_rcv+0x285/0x5b0 [sctp]
  [...]  sctp_backlog_rcv+0x482/0x910 [sctp]
  [...]  __release_sock+0x11e/0x310
  [...]  release_sock+0x4f/0x180
  [...]  sctp_accept+0x3f9/0x5a0 [sctp]
  [...]  inet_accept+0xe7/0x720

It was caused by that the 'newsk' sk_socket was not set before going to
security sctp hook when processing asconf chunk with SCTP_PARAM_ADD_IP
or SCTP_PARAM_SET_PRIMARY:

  inet_accept()->
    sctp_accept():
      lock_sock():
          lock listening 'sk'
                                          do_softirq():
                                            sctp_rcv():  <-- [1]
                                                asconf chunk arrives and
                                                enqueued in 'sk' backlog
      sctp_sock_migrate():
          set asoc's sk to 'newsk'
      release_sock():
          sctp_backlog_rcv():
            lock 'newsk'
            sctp_process_asconf()  <-- [2]
            unlock 'newsk'
    sock_graft():
        set sk_socket  <-- [3]

As it shows, at [1] the asconf chunk would be put into the listening 'sk'
backlog, as accept() was holding its sock lock. Then at [2] asconf would
get processed with 'newsk' as asoc's sk had been set to 'newsk'. However,
'newsk' sk_socket is not set until [3], while selinux_sctp_bind_connect()
would deref it, then kernel crashed.

Here to fix it by adding the chunk to sk_backlog until newsk sk_socket is
set when .accept() is done.

Note that sk->sk_socket can be NULL when the sock is closed, so SOCK_DEAD
flag is also needed to check in sctp_newsk_ready().

Thanks to Ondrej for reviewing the code.

Fixes: d452930fd3b9 ("selinux: Add SCTP support")
Reported-by: Ying Xu <yinxu@redhat.com>
Suggested-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Acked-by: Neil Horman <nhorman@tuxdriver.com>
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/net/sctp/sctp.h |  5 +++++
 net/sctp/input.c        | 12 +++++++++---
 2 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h
index 2abbc15824af9..2c6570e6fcfec 100644
--- a/include/net/sctp/sctp.h
+++ b/include/net/sctp/sctp.h
@@ -625,4 +625,9 @@ static inline __u32 sctp_min_frag_point(struct sctp_sock *sp, __u16 datasize)
 	return sctp_mtu_payload(sp, SCTP_DEFAULT_MINSEGMENT, datasize);
 }
 
+static inline bool sctp_newsk_ready(const struct sock *sk)
+{
+	return sock_flag(sk, SOCK_DEAD) || sk->sk_socket;
+}
+
 #endif /* __net_sctp_h__ */
diff --git a/net/sctp/input.c b/net/sctp/input.c
index bfe29158afccb..f64d882c86985 100644
--- a/net/sctp/input.c
+++ b/net/sctp/input.c
@@ -255,7 +255,7 @@ int sctp_rcv(struct sk_buff *skb)
 		bh_lock_sock(sk);
 	}
 
-	if (sock_owned_by_user(sk)) {
+	if (sock_owned_by_user(sk) || !sctp_newsk_ready(sk)) {
 		if (sctp_add_backlog(sk, skb)) {
 			bh_unlock_sock(sk);
 			sctp_chunk_free(chunk);
@@ -333,7 +333,7 @@ int sctp_backlog_rcv(struct sock *sk, struct sk_buff *skb)
 		local_bh_disable();
 		bh_lock_sock(sk);
 
-		if (sock_owned_by_user(sk)) {
+		if (sock_owned_by_user(sk) || !sctp_newsk_ready(sk)) {
 			if (sk_add_backlog(sk, skb, sk->sk_rcvbuf))
 				sctp_chunk_free(chunk);
 			else
@@ -348,7 +348,13 @@ int sctp_backlog_rcv(struct sock *sk, struct sk_buff *skb)
 		if (backloged)
 			return 0;
 	} else {
-		sctp_inq_push(inqueue, chunk);
+		if (!sctp_newsk_ready(sk)) {
+			if (!sk_add_backlog(sk, skb, sk->sk_rcvbuf))
+				return 0;
+			sctp_chunk_free(chunk);
+		} else {
+			sctp_inq_push(inqueue, chunk);
+		}
 	}
 
 done:
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 596/639] s390/qeth: Fix error handling during VNICC initialization
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (594 preceding siblings ...)
  2020-01-24  9:32 ` [PATCH 4.19 595/639] sctp: add chunks to sk_backlog when the newsk sk_socket is not set Greg Kroah-Hartman
@ 2020-01-24  9:32 ` Greg Kroah-Hartman
  2020-01-24  9:32 ` [PATCH 4.19 597/639] s390/qeth: Fix initialization of vnicc cmd masks during set online Greg Kroah-Hartman
                   ` (46 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Alexandra Winter, Julian Wiedmann,
	Jakub Kicinski, Sasha Levin

From: Alexandra Winter <wintera@linux.ibm.com>

[ Upstream commit b528965bcc827dad32a8d21745feaacfc76c9703 ]

Smatch discovered the use of uninitialized variable sup_cmds
in error paths.

Fixes: caa1f0b10d18 ("s390/qeth: add VNICC enable/disable support")
Signed-off-by: Alexandra Winter <wintera@linux.ibm.com>
Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com>
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/s390/net/qeth_l2_main.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c
index c238b190b3c93..b9be2c08e8dfa 100644
--- a/drivers/s390/net/qeth_l2_main.c
+++ b/drivers/s390/net/qeth_l2_main.c
@@ -2330,10 +2330,10 @@ static bool qeth_l2_vnicc_recover_char(struct qeth_card *card, u32 vnicc,
 static void qeth_l2_vnicc_init(struct qeth_card *card)
 {
 	u32 *timeout = &card->options.vnicc.learning_timeout;
+	bool enable, error = false;
 	unsigned int chars_len, i;
 	unsigned long chars_tmp;
 	u32 sup_cmds, vnicc;
-	bool enable, error;
 
 	QETH_CARD_TEXT(card, 2, "vniccini");
 	/* reset rx_bcast */
@@ -2354,7 +2354,10 @@ static void qeth_l2_vnicc_init(struct qeth_card *card)
 	chars_len = sizeof(card->options.vnicc.sup_chars) * BITS_PER_BYTE;
 	for_each_set_bit(i, &chars_tmp, chars_len) {
 		vnicc = BIT(i);
-		qeth_l2_vnicc_query_cmds(card, vnicc, &sup_cmds);
+		if (qeth_l2_vnicc_query_cmds(card, vnicc, &sup_cmds)) {
+			sup_cmds = 0;
+			error = true;
+		}
 		if (!(sup_cmds & IPA_VNICC_SET_TIMEOUT) ||
 		    !(sup_cmds & IPA_VNICC_GET_TIMEOUT))
 			card->options.vnicc.getset_timeout_sup &= ~vnicc;
@@ -2363,8 +2366,8 @@ static void qeth_l2_vnicc_init(struct qeth_card *card)
 			card->options.vnicc.set_char_sup &= ~vnicc;
 	}
 	/* enforce assumed default values and recover settings, if changed  */
-	error = qeth_l2_vnicc_recover_timeout(card, QETH_VNICC_LEARNING,
-					      timeout);
+	error |= qeth_l2_vnicc_recover_timeout(card, QETH_VNICC_LEARNING,
+					       timeout);
 	chars_tmp = card->options.vnicc.wanted_chars ^ QETH_VNICC_DEFAULT;
 	chars_len = sizeof(card->options.vnicc.wanted_chars) * BITS_PER_BYTE;
 	for_each_set_bit(i, &chars_tmp, chars_len) {
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 597/639] s390/qeth: Fix initialization of vnicc cmd masks during set online
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (595 preceding siblings ...)
  2020-01-24  9:32 ` [PATCH 4.19 596/639] s390/qeth: Fix error handling during VNICC initialization Greg Kroah-Hartman
@ 2020-01-24  9:32 ` Greg Kroah-Hartman
  2020-01-24  9:32 ` [PATCH 4.19 598/639] act_mirred: Fix mirred_init_module error handling Greg Kroah-Hartman
                   ` (45 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Alexandra Winter, Julian Wiedmann,
	Jakub Kicinski, Sasha Levin

From: Alexandra Winter <wintera@linux.ibm.com>

[ Upstream commit be40a86c319706f90caca144343c64743c32b953 ]

Without this patch, a command bit in the supported commands mask is only
ever set to unsupported during set online. If a command is ever marked as
unsupported (e.g. because of error during qeth_l2_vnicc_query_cmds),
subsequent successful initialization (offline/online) would not bring it
back.

Fixes: caa1f0b10d18 ("s390/qeth: add VNICC enable/disable support")
Signed-off-by: Alexandra Winter <wintera@linux.ibm.com>
Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com>
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/s390/net/qeth_l2_main.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c
index b9be2c08e8dfa..aa90004f49e28 100644
--- a/drivers/s390/net/qeth_l2_main.c
+++ b/drivers/s390/net/qeth_l2_main.c
@@ -2358,11 +2358,15 @@ static void qeth_l2_vnicc_init(struct qeth_card *card)
 			sup_cmds = 0;
 			error = true;
 		}
-		if (!(sup_cmds & IPA_VNICC_SET_TIMEOUT) ||
-		    !(sup_cmds & IPA_VNICC_GET_TIMEOUT))
+		if ((sup_cmds & IPA_VNICC_SET_TIMEOUT) &&
+		    (sup_cmds & IPA_VNICC_GET_TIMEOUT))
+			card->options.vnicc.getset_timeout_sup |= vnicc;
+		else
 			card->options.vnicc.getset_timeout_sup &= ~vnicc;
-		if (!(sup_cmds & IPA_VNICC_ENABLE) ||
-		    !(sup_cmds & IPA_VNICC_DISABLE))
+		if ((sup_cmds & IPA_VNICC_ENABLE) &&
+		    (sup_cmds & IPA_VNICC_DISABLE))
+			card->options.vnicc.set_char_sup |= vnicc;
+		else
 			card->options.vnicc.set_char_sup &= ~vnicc;
 	}
 	/* enforce assumed default values and recover settings, if changed  */
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 598/639] act_mirred: Fix mirred_init_module error handling
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (596 preceding siblings ...)
  2020-01-24  9:32 ` [PATCH 4.19 597/639] s390/qeth: Fix initialization of vnicc cmd masks during set online Greg Kroah-Hartman
@ 2020-01-24  9:32 ` Greg Kroah-Hartman
  2020-01-24  9:32 ` [PATCH 4.19 599/639] net: avoid possible false sharing in sk_leave_memory_pressure() Greg Kroah-Hartman
                   ` (44 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, YueHaibing, Jakub Kicinski, Sasha Levin

From: YueHaibing <yuehaibing@huawei.com>

[ Upstream commit 11c9a7d38af524217efb7a176ad322b97ac2f163 ]

If tcf_register_action failed, mirred_device_notifier
should be unregistered.

Fixes: 3b87956ea645 ("net sched: fix race in mirred device removal")
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/sched/act_mirred.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c
index 399e3beae6cf4..a30c17a282819 100644
--- a/net/sched/act_mirred.c
+++ b/net/sched/act_mirred.c
@@ -445,7 +445,11 @@ static int __init mirred_init_module(void)
 		return err;
 
 	pr_info("Mirror/redirect action on\n");
-	return tcf_register_action(&act_mirred_ops, &mirred_net_ops);
+	err = tcf_register_action(&act_mirred_ops, &mirred_net_ops);
+	if (err)
+		unregister_netdevice_notifier(&mirred_device_notifier);
+
+	return err;
 }
 
 static void __exit mirred_cleanup_module(void)
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 599/639] net: avoid possible false sharing in sk_leave_memory_pressure()
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (597 preceding siblings ...)
  2020-01-24  9:32 ` [PATCH 4.19 598/639] act_mirred: Fix mirred_init_module error handling Greg Kroah-Hartman
@ 2020-01-24  9:32 ` Greg Kroah-Hartman
  2020-01-26 17:15   ` Pavel Machek
  2020-01-24  9:32 ` [PATCH 4.19 600/639] net: add {READ|WRITE}_ONCE() annotations on ->rskq_accept_head Greg Kroah-Hartman
                   ` (43 subsequent siblings)
  642 siblings, 1 reply; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Eric Dumazet, Jakub Kicinski, Sasha Levin

From: Eric Dumazet <edumazet@google.com>

[ Upstream commit 503978aca46124cd714703e180b9c8292ba50ba7 ]

As mentioned in https://github.com/google/ktsan/wiki/READ_ONCE-and-WRITE_ONCE#it-may-improve-performance
a C compiler can legally transform :

if (memory_pressure && *memory_pressure)
        *memory_pressure = 0;

to :

if (memory_pressure)
        *memory_pressure = 0;

Fixes: 0604475119de ("tcp: add TCPMemoryPressuresChrono counter")
Fixes: 180d8cd942ce ("foundations of per-cgroup memory pressure controlling.")
Fixes: 3ab224be6d69 ("[NET] CORE: Introducing new memory accounting interface.")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/core/sock.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/core/sock.c b/net/core/sock.c
index bbde5f6a7dc91..b9ec14f2c729a 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -2179,8 +2179,8 @@ static void sk_leave_memory_pressure(struct sock *sk)
 	} else {
 		unsigned long *memory_pressure = sk->sk_prot->memory_pressure;
 
-		if (memory_pressure && *memory_pressure)
-			*memory_pressure = 0;
+		if (memory_pressure && READ_ONCE(*memory_pressure))
+			WRITE_ONCE(*memory_pressure, 0);
 	}
 }
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 600/639] net: add {READ|WRITE}_ONCE() annotations on ->rskq_accept_head
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (598 preceding siblings ...)
  2020-01-24  9:32 ` [PATCH 4.19 599/639] net: avoid possible false sharing in sk_leave_memory_pressure() Greg Kroah-Hartman
@ 2020-01-24  9:32 ` Greg Kroah-Hartman
  2020-01-24  9:32 ` [PATCH 4.19 601/639] tcp: annotate lockless access to tcp_memory_pressure Greg Kroah-Hartman
                   ` (42 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Eric Dumazet, Jakub Kicinski, Sasha Levin

From: Eric Dumazet <edumazet@google.com>

[ Upstream commit 60b173ca3d1cd1782bd0096dc17298ec242f6fb1 ]

reqsk_queue_empty() is called from inet_csk_listen_poll() while
other cpus might write ->rskq_accept_head value.

Use {READ|WRITE}_ONCE() to avoid compiler tricks
and potential KCSAN splats.

Fixes: fff1f3001cc5 ("tcp: add a spinlock to protect struct request_sock_queue")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/xen/pvcalls-back.c      | 2 +-
 include/net/request_sock.h      | 4 ++--
 net/ipv4/inet_connection_sock.c | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/xen/pvcalls-back.c b/drivers/xen/pvcalls-back.c
index d4ea33581ac26..b3fbfed28682f 100644
--- a/drivers/xen/pvcalls-back.c
+++ b/drivers/xen/pvcalls-back.c
@@ -784,7 +784,7 @@ static int pvcalls_back_poll(struct xenbus_device *dev,
 	mappass->reqcopy = *req;
 	icsk = inet_csk(mappass->sock->sk);
 	queue = &icsk->icsk_accept_queue;
-	data = queue->rskq_accept_head != NULL;
+	data = READ_ONCE(queue->rskq_accept_head) != NULL;
 	if (data) {
 		mappass->reqcopy.cmd = 0;
 		ret = 0;
diff --git a/include/net/request_sock.h b/include/net/request_sock.h
index 347015515a7de..1653435f18f5c 100644
--- a/include/net/request_sock.h
+++ b/include/net/request_sock.h
@@ -183,7 +183,7 @@ void reqsk_fastopen_remove(struct sock *sk, struct request_sock *req,
 
 static inline bool reqsk_queue_empty(const struct request_sock_queue *queue)
 {
-	return queue->rskq_accept_head == NULL;
+	return READ_ONCE(queue->rskq_accept_head) == NULL;
 }
 
 static inline struct request_sock *reqsk_queue_remove(struct request_sock_queue *queue,
@@ -195,7 +195,7 @@ static inline struct request_sock *reqsk_queue_remove(struct request_sock_queue
 	req = queue->rskq_accept_head;
 	if (req) {
 		sk_acceptq_removed(parent);
-		queue->rskq_accept_head = req->dl_next;
+		WRITE_ONCE(queue->rskq_accept_head, req->dl_next);
 		if (queue->rskq_accept_head == NULL)
 			queue->rskq_accept_tail = NULL;
 	}
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index 636a11c56cf5a..79320858e7196 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -937,7 +937,7 @@ struct sock *inet_csk_reqsk_queue_add(struct sock *sk,
 		req->sk = child;
 		req->dl_next = NULL;
 		if (queue->rskq_accept_head == NULL)
-			queue->rskq_accept_head = req;
+			WRITE_ONCE(queue->rskq_accept_head, req);
 		else
 			queue->rskq_accept_tail->dl_next = req;
 		queue->rskq_accept_tail = req;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 601/639] tcp: annotate lockless access to tcp_memory_pressure
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (599 preceding siblings ...)
  2020-01-24  9:32 ` [PATCH 4.19 600/639] net: add {READ|WRITE}_ONCE() annotations on ->rskq_accept_head Greg Kroah-Hartman
@ 2020-01-24  9:32 ` Greg Kroah-Hartman
  2020-01-24  9:32 ` [PATCH 4.19 602/639] net/smc: receive returns without data Greg Kroah-Hartman
                   ` (41 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Eric Dumazet, Jakub Kicinski, Sasha Levin

From: Eric Dumazet <edumazet@google.com>

[ Upstream commit 1f142c17d19a5618d5a633195a46f2c8be9bf232 ]

tcp_memory_pressure is read without holding any lock,
and its value could be changed on other cpus.

Use READ_ONCE() to annotate these lockless reads.

The write side is already using atomic ops.

Fixes: b8da51ebb1aa ("tcp: introduce tcp_under_memory_pressure()")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/net/tcp.h | 2 +-
 net/ipv4/tcp.c    | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/include/net/tcp.h b/include/net/tcp.h
index ac4ffe8013d8a..918bfd0d7d1f9 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -261,7 +261,7 @@ static inline bool tcp_under_memory_pressure(const struct sock *sk)
 	    mem_cgroup_under_socket_pressure(sk->sk_memcg))
 		return true;
 
-	return tcp_memory_pressure;
+	return READ_ONCE(tcp_memory_pressure);
 }
 /*
  * The next routines deal with comparing 32 bit unsigned ints
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index cd8a92e7a39eb..af9361eba64a6 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -325,7 +325,7 @@ void tcp_enter_memory_pressure(struct sock *sk)
 {
 	unsigned long val;
 
-	if (tcp_memory_pressure)
+	if (READ_ONCE(tcp_memory_pressure))
 		return;
 	val = jiffies;
 
@@ -340,7 +340,7 @@ void tcp_leave_memory_pressure(struct sock *sk)
 {
 	unsigned long val;
 
-	if (!tcp_memory_pressure)
+	if (!READ_ONCE(tcp_memory_pressure))
 		return;
 	val = xchg(&tcp_memory_pressure, 0);
 	if (val)
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 602/639] net/smc: receive returns without data
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (600 preceding siblings ...)
  2020-01-24  9:32 ` [PATCH 4.19 601/639] tcp: annotate lockless access to tcp_memory_pressure Greg Kroah-Hartman
@ 2020-01-24  9:32 ` Greg Kroah-Hartman
  2020-01-24  9:32 ` [PATCH 4.19 603/639] net/smc: receive pending data after RCV_SHUTDOWN Greg Kroah-Hartman
                   ` (40 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ursula Braun, Karsten Graul,
	Jakub Kicinski, Sasha Levin

From: Karsten Graul <kgraul@linux.ibm.com>

[ Upstream commit 882dcfe5a1785c20f45820cbe6fec4b8b647c946 ]

smc_cdc_rxed_any_close_or_senddone() is used as an end condition for the
receive loop. This conflicts with smc_cdc_msg_recv_action() which could
run in parallel and set the bits checked by
smc_cdc_rxed_any_close_or_senddone() before the receive is processed.
In that case we could return from receive with no data, although data is
available. The same applies to smc_rx_wait().
Fix this by checking for RCV_SHUTDOWN only, which is set in
smc_cdc_msg_recv_action() after the receive was actually processed.

Fixes: 952310ccf2d8 ("smc: receive data from RMBE")
Reviewed-by: Ursula Braun <ubraun@linux.ibm.com>
Signed-off-by: Karsten Graul <kgraul@linux.ibm.com>
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/smc/smc_rx.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/net/smc/smc_rx.c b/net/smc/smc_rx.c
index bbcf0fe4ae10f..1ee5fdbf8284e 100644
--- a/net/smc/smc_rx.c
+++ b/net/smc/smc_rx.c
@@ -212,8 +212,7 @@ int smc_rx_wait(struct smc_sock *smc, long *timeo,
 	rc = sk_wait_event(sk, timeo,
 			   sk->sk_err ||
 			   sk->sk_shutdown & RCV_SHUTDOWN ||
-			   fcrit(conn) ||
-			   smc_cdc_rxed_any_close_or_senddone(conn),
+			   fcrit(conn),
 			   &wait);
 	remove_wait_queue(sk_sleep(sk), &wait);
 	sk_clear_bit(SOCKWQ_ASYNC_WAITDATA, sk);
@@ -311,7 +310,6 @@ int smc_rx_recvmsg(struct smc_sock *smc, struct msghdr *msg,
 			smc_rx_update_cons(smc, 0);
 
 		if (sk->sk_shutdown & RCV_SHUTDOWN ||
-		    smc_cdc_rxed_any_close_or_senddone(conn) ||
 		    conn->local_tx_ctrl.conn_state_flags.peer_conn_abort)
 			break;
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 603/639] net/smc: receive pending data after RCV_SHUTDOWN
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (601 preceding siblings ...)
  2020-01-24  9:32 ` [PATCH 4.19 602/639] net/smc: receive returns without data Greg Kroah-Hartman
@ 2020-01-24  9:32 ` Greg Kroah-Hartman
  2020-01-24  9:32 ` [PATCH 4.19 604/639] drm/msm/dsi: Implement reset correctly Greg Kroah-Hartman
                   ` (39 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ursula Braun, Karsten Graul,
	Jakub Kicinski, Sasha Levin

From: Karsten Graul <kgraul@linux.ibm.com>

[ Upstream commit 107529e31a87acd475ff6a0f82745821b8f70fec ]

smc_rx_recvmsg() first checks if data is available, and then if
RCV_SHUTDOWN is set. There is a race when smc_cdc_msg_recv_action() runs
in between these 2 checks, receives data and sets RCV_SHUTDOWN.
In that case smc_rx_recvmsg() would return from receive without to
process the available data.
Fix that with a final check for data available if RCV_SHUTDOWN is set.
Move the check for data into a function and call it twice.
And use the existing helper smc_rx_data_available().

Fixes: 952310ccf2d8 ("smc: receive data from RMBE")
Reviewed-by: Ursula Braun <ubraun@linux.ibm.com>
Signed-off-by: Karsten Graul <kgraul@linux.ibm.com>
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/smc/smc_rx.c | 25 ++++++++++++++++++++-----
 1 file changed, 20 insertions(+), 5 deletions(-)

diff --git a/net/smc/smc_rx.c b/net/smc/smc_rx.c
index 1ee5fdbf8284e..36340912df48a 100644
--- a/net/smc/smc_rx.c
+++ b/net/smc/smc_rx.c
@@ -262,6 +262,18 @@ static int smc_rx_recv_urg(struct smc_sock *smc, struct msghdr *msg, int len,
 	return -EAGAIN;
 }
 
+static bool smc_rx_recvmsg_data_available(struct smc_sock *smc)
+{
+	struct smc_connection *conn = &smc->conn;
+
+	if (smc_rx_data_available(conn))
+		return true;
+	else if (conn->urg_state == SMC_URG_VALID)
+		/* we received a single urgent Byte - skip */
+		smc_rx_update_cons(smc, 0);
+	return false;
+}
+
 /* smc_rx_recvmsg - receive data from RMBE
  * @msg:	copy data to receive buffer
  * @pipe:	copy data to pipe if set - indicates splice() call
@@ -303,15 +315,18 @@ int smc_rx_recvmsg(struct smc_sock *smc, struct msghdr *msg,
 		if (read_done >= target || (pipe && read_done))
 			break;
 
-		if (atomic_read(&conn->bytes_to_rcv))
+		if (smc_rx_recvmsg_data_available(smc))
 			goto copy;
-		else if (conn->urg_state == SMC_URG_VALID)
-			/* we received a single urgent Byte - skip */
-			smc_rx_update_cons(smc, 0);
 
 		if (sk->sk_shutdown & RCV_SHUTDOWN ||
-		    conn->local_tx_ctrl.conn_state_flags.peer_conn_abort)
+		    conn->local_tx_ctrl.conn_state_flags.peer_conn_abort) {
+			/* smc_cdc_msg_recv_action() could have run after
+			 * above smc_rx_recvmsg_data_available()
+			 */
+			if (smc_rx_recvmsg_data_available(smc))
+				goto copy;
 			break;
+		}
 
 		if (read_done) {
 			if (sk->sk_err ||
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 604/639] drm/msm/dsi: Implement reset correctly
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (602 preceding siblings ...)
  2020-01-24  9:32 ` [PATCH 4.19 603/639] net/smc: receive pending data after RCV_SHUTDOWN Greg Kroah-Hartman
@ 2020-01-24  9:32 ` Greg Kroah-Hartman
  2020-01-24  9:32 ` [PATCH 4.19 605/639] vhost/test: stop device before reset Greg Kroah-Hartman
                   ` (38 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hai Li, Rob Clark, Jeffrey Hugo,
	Sean Paul, Sean Paul, Sasha Levin

From: Jeffrey Hugo <jeffrey.l.hugo@gmail.com>

[ Upstream commit 78e31c42261779a01bc73472d0f65f15378e9de3 ]

On msm8998, vblank timeouts are observed because the DSI controller is not
reset properly, which ends up stalling the MDP.  This is because the reset
logic is not correct per the hardware documentation.

The documentation states that after asserting reset, software should wait
some time (no indication of how long), or poll the status register until it
returns 0 before deasserting reset.

wmb() is insufficient for this purpose since it just ensures ordering, not
timing between writes.  Since asserting and deasserting reset occurs on the
same register, ordering is already guaranteed by the architecture, making
the wmb extraneous.

Since we would define a timeout for polling the status register to avoid a
possible infinite loop, lets just use a static delay of 20 ms, since 16.666
ms is the time available to process one frame at 60 fps.

Fixes: a689554ba6ed ("drm/msm: Initial add DSI connector support")
Cc: Hai Li <hali@codeaurora.org>
Cc: Rob Clark <robdclark@gmail.com>
Signed-off-by: Jeffrey Hugo <jeffrey.l.hugo@gmail.com>
Reviewed-by: Sean Paul <sean@poorly.run>
[seanpaul renamed RESET_DELAY to DSI_RESET_TOGGLE_DELAY_MS]
Signed-off-by: Sean Paul <seanpaul@chromium.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20191011133939.16551-1-jeffrey.l.hugo@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/msm/dsi/dsi_host.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/msm/dsi/dsi_host.c b/drivers/gpu/drm/msm/dsi/dsi_host.c
index cc4ea5502d6c3..3b78bca0bb4d4 100644
--- a/drivers/gpu/drm/msm/dsi/dsi_host.c
+++ b/drivers/gpu/drm/msm/dsi/dsi_host.c
@@ -34,6 +34,8 @@
 #include "dsi_cfg.h"
 #include "msm_kms.h"
 
+#define DSI_RESET_TOGGLE_DELAY_MS 20
+
 static int dsi_get_version(const void __iomem *base, u32 *major, u32 *minor)
 {
 	u32 ver;
@@ -994,7 +996,7 @@ static void dsi_sw_reset(struct msm_dsi_host *msm_host)
 	wmb(); /* clocks need to be enabled before reset */
 
 	dsi_write(msm_host, REG_DSI_RESET, 1);
-	wmb(); /* make sure reset happen */
+	msleep(DSI_RESET_TOGGLE_DELAY_MS); /* make sure reset happen */
 	dsi_write(msm_host, REG_DSI_RESET, 0);
 }
 
@@ -1402,7 +1404,7 @@ static void dsi_sw_reset_restore(struct msm_dsi_host *msm_host)
 
 	/* dsi controller can only be reset while clocks are running */
 	dsi_write(msm_host, REG_DSI_RESET, 1);
-	wmb();	/* make sure reset happen */
+	msleep(DSI_RESET_TOGGLE_DELAY_MS); /* make sure reset happen */
 	dsi_write(msm_host, REG_DSI_RESET, 0);
 	wmb();	/* controller out of reset */
 	dsi_write(msm_host, REG_DSI_CTRL, data0);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 605/639] vhost/test: stop device before reset
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (603 preceding siblings ...)
  2020-01-24  9:32 ` [PATCH 4.19 604/639] drm/msm/dsi: Implement reset correctly Greg Kroah-Hartman
@ 2020-01-24  9:32 ` Greg Kroah-Hartman
  2020-01-24  9:32 ` [PATCH 4.19 606/639] dmaengine: imx-sdma: fix size check for sdma script_number Greg Kroah-Hartman
                   ` (37 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:32 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Michael S. Tsirkin, Sasha Levin

From: Michael S. Tsirkin <mst@redhat.com>

[ Upstream commit 245cdd9fbd396483d501db83047116e2530f245f ]

When device stop was moved out of reset, test device wasn't updated to
stop before reset, this resulted in a use after free.  Fix by invoking
stop appropriately.

Fixes: b211616d7125 ("vhost: move -net specific code out")
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/vhost/test.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/vhost/test.c b/drivers/vhost/test.c
index a9be2d8e98df7..55090d9f9de0d 100644
--- a/drivers/vhost/test.c
+++ b/drivers/vhost/test.c
@@ -162,6 +162,7 @@ static int vhost_test_release(struct inode *inode, struct file *f)
 
 	vhost_test_stop(n, &private);
 	vhost_test_flush(n);
+	vhost_dev_stop(&n->dev);
 	vhost_dev_cleanup(&n->dev);
 	/* We do an extra flush before freeing memory,
 	 * since jobs can re-queue themselves. */
@@ -238,6 +239,7 @@ static long vhost_test_reset_owner(struct vhost_test *n)
 	}
 	vhost_test_stop(n, &priv);
 	vhost_test_flush(n);
+	vhost_dev_stop(&n->dev);
 	vhost_dev_reset_owner(&n->dev, umem);
 done:
 	mutex_unlock(&n->dev.mutex);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 606/639] dmaengine: imx-sdma: fix size check for sdma script_number
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (604 preceding siblings ...)
  2020-01-24  9:32 ` [PATCH 4.19 605/639] vhost/test: stop device before reset Greg Kroah-Hartman
@ 2020-01-24  9:32 ` Greg Kroah-Hartman
  2020-01-24  9:32 ` [PATCH 4.19 607/639] firmware: dmi: Fix unlikely out-of-bounds read in save_mem_devices Greg Kroah-Hartman
                   ` (36 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, stable, Robin Gong, Jurgen Lambrecht,
	Vinod Koul, Sasha Levin

From: Robin Gong <yibin.gong@nxp.com>

[ Upstream commit bd73dfabdda280fc5f05bdec79b6721b4b2f035f ]

Illegal memory will be touch if SDMA_SCRIPT_ADDRS_ARRAY_SIZE_V3
(41) exceed the size of structure sdma_script_start_addrs(40),
thus cause memory corrupt such as slob block header so that kernel
trap into while() loop forever in slob_free(). Please refer to below
code piece in imx-sdma.c:
for (i = 0; i < sdma->script_number; i++)
	if (addr_arr[i] > 0)
		saddr_arr[i] = addr_arr[i]; /* memory corrupt here */
That issue was brought by commit a572460be9cf ("dmaengine: imx-sdma: Add
support for version 3 firmware") because SDMA_SCRIPT_ADDRS_ARRAY_SIZE_V3
(38->41 3 scripts added) not align with script number added in
sdma_script_start_addrs(2 scripts).

Fixes: a572460be9cf ("dmaengine: imx-sdma: Add support for version 3 firmware")
Cc: stable@vger.kernel
Link: https://www.spinics.net/lists/arm-kernel/msg754895.html
Signed-off-by: Robin Gong <yibin.gong@nxp.com>
Reported-by: Jurgen Lambrecht <J.Lambrecht@TELEVIC.com>
Link: https://lore.kernel.org/r/1569347584-3478-1-git-send-email-yibin.gong@nxp.com
[vkoul: update the patch title]
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/dma/imx-sdma.c                     | 8 ++++++++
 include/linux/platform_data/dma-imx-sdma.h | 3 +++
 2 files changed, 11 insertions(+)

diff --git a/drivers/dma/imx-sdma.c b/drivers/dma/imx-sdma.c
index 3f5a01cb4ab45..ceb82e74f5b4e 100644
--- a/drivers/dma/imx-sdma.c
+++ b/drivers/dma/imx-sdma.c
@@ -1662,6 +1662,14 @@ static void sdma_add_scripts(struct sdma_engine *sdma,
 	if (!sdma->script_number)
 		sdma->script_number = SDMA_SCRIPT_ADDRS_ARRAY_SIZE_V1;
 
+	if (sdma->script_number > sizeof(struct sdma_script_start_addrs)
+				  / sizeof(s32)) {
+		dev_err(sdma->dev,
+			"SDMA script number %d not match with firmware.\n",
+			sdma->script_number);
+		return;
+	}
+
 	for (i = 0; i < sdma->script_number; i++)
 		if (addr_arr[i] > 0)
 			saddr_arr[i] = addr_arr[i];
diff --git a/include/linux/platform_data/dma-imx-sdma.h b/include/linux/platform_data/dma-imx-sdma.h
index 6eaa53cef0bd2..30e676b36b247 100644
--- a/include/linux/platform_data/dma-imx-sdma.h
+++ b/include/linux/platform_data/dma-imx-sdma.h
@@ -51,7 +51,10 @@ struct sdma_script_start_addrs {
 	/* End of v2 array */
 	s32 zcanfd_2_mcu_addr;
 	s32 zqspi_2_mcu_addr;
+	s32 mcu_2_ecspi_addr;
 	/* End of v3 array */
+	s32 mcu_2_zqspi_addr;
+	/* End of v4 array */
 };
 
 /**
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 607/639] firmware: dmi: Fix unlikely out-of-bounds read in save_mem_devices
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (605 preceding siblings ...)
  2020-01-24  9:32 ` [PATCH 4.19 606/639] dmaengine: imx-sdma: fix size check for sdma script_number Greg Kroah-Hartman
@ 2020-01-24  9:32 ` Greg Kroah-Hartman
  2020-01-24  9:32 ` [PATCH 4.19 608/639] arm64: hibernate: check pgd table allocation Greg Kroah-Hartman
                   ` (35 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jean Delvare, Tony Luck,
	Borislav Petkov, Sasha Levin

From: Jean Delvare <jdelvare@suse.de>

[ Upstream commit 81dde26de9c08bb04c4962a15608778aaffb3cf9 ]

Before reading the Extended Size field, we should ensure it fits in
the DMI record. There is already a record length check but it does
not cover that field.

It would take a seriously corrupted DMI table to hit that bug, so no
need to worry, but we should still fix it.

Signed-off-by: Jean Delvare <jdelvare@suse.de>
Fixes: 6deae96b42eb ("firmware, DMI: Add function to look up a handle and return DIMM size")
Cc: Tony Luck <tony.luck@intel.com>
Cc: Borislav Petkov <bp@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/firmware/dmi_scan.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/firmware/dmi_scan.c b/drivers/firmware/dmi_scan.c
index f2483548cde92..0dc0c78f1fdb2 100644
--- a/drivers/firmware/dmi_scan.c
+++ b/drivers/firmware/dmi_scan.c
@@ -407,7 +407,7 @@ static void __init save_mem_devices(const struct dmi_header *dm, void *v)
 		bytes = ~0ull;
 	else if (size & 0x8000)
 		bytes = (u64)(size & 0x7fff) << 10;
-	else if (size != 0x7fff)
+	else if (size != 0x7fff || dm->length < 0x20)
 		bytes = (u64)size << 20;
 	else
 		bytes = (u64)get_unaligned((u32 *)&d[0x1C]) << 20;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 608/639] arm64: hibernate: check pgd table allocation
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (606 preceding siblings ...)
  2020-01-24  9:32 ` [PATCH 4.19 607/639] firmware: dmi: Fix unlikely out-of-bounds read in save_mem_devices Greg Kroah-Hartman
@ 2020-01-24  9:32 ` Greg Kroah-Hartman
  2020-01-24  9:32 ` [PATCH 4.19 609/639] net: netem: fix error path for corrupted GSO frames Greg Kroah-Hartman
                   ` (34 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, James Morse, Pavel Tatashin,
	Will Deacon, Sasha Levin

From: Pavel Tatashin <pasha.tatashin@soleen.com>

[ Upstream commit 8c551f919a73c1dfa690a70a691be1da394145e8 ]

There is a bug in create_safe_exec_page(), when page table is allocated
it is not checked that table is allocated successfully:

But it is dereferenced in: pgd_none(READ_ONCE(*pgdp)).  Check that
allocation was successful.

Fixes: 82869ac57b5d ("arm64: kernel: Add support for hibernate/suspend-to-disk")
Reviewed-by: James Morse <james.morse@arm.com>
Signed-off-by: Pavel Tatashin <pasha.tatashin@soleen.com>
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/kernel/hibernate.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/arch/arm64/kernel/hibernate.c b/arch/arm64/kernel/hibernate.c
index 9859e1178e6be..dbeeeffdb9c9e 100644
--- a/arch/arm64/kernel/hibernate.c
+++ b/arch/arm64/kernel/hibernate.c
@@ -202,6 +202,7 @@ static int create_safe_exec_page(void *src_start, size_t length,
 				 gfp_t mask)
 {
 	int rc = 0;
+	pgd_t *trans_pgd;
 	pgd_t *pgdp;
 	pud_t *pudp;
 	pmd_t *pmdp;
@@ -216,7 +217,13 @@ static int create_safe_exec_page(void *src_start, size_t length,
 	memcpy((void *)dst, src_start, length);
 	__flush_icache_range(dst, dst + length);
 
-	pgdp = pgd_offset_raw(allocator(mask), dst_addr);
+	trans_pgd = allocator(mask);
+	if (!trans_pgd) {
+		rc = -ENOMEM;
+		goto out;
+	}
+
+	pgdp = pgd_offset_raw(trans_pgd, dst_addr);
 	if (pgd_none(READ_ONCE(*pgdp))) {
 		pudp = allocator(mask);
 		if (!pudp) {
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 609/639] net: netem: fix error path for corrupted GSO frames
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (607 preceding siblings ...)
  2020-01-24  9:32 ` [PATCH 4.19 608/639] arm64: hibernate: check pgd table allocation Greg Kroah-Hartman
@ 2020-01-24  9:32 ` Greg Kroah-Hartman
  2020-01-24  9:33 ` [PATCH 4.19 610/639] net: netem: correct the parents backlog when corrupted packet was dropped Greg Kroah-Hartman
                   ` (33 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, kbuild test robot, Dan Carpenter,
	Ben Hutchings, Jakub Kicinski, Simon Horman, David S. Miller,
	Sasha Levin

From: Jakub Kicinski <jakub.kicinski@netronome.com>

[ Upstream commit a7fa12d15855904aff1716e1fc723c03ba38c5cc ]

To corrupt a GSO frame we first perform segmentation.  We then
proceed using the first segment instead of the full GSO skb and
requeue the rest of the segments as separate packets.

If there are any issues with processing the first segment we
still want to process the rest, therefore we jump to the
finish_segs label.

Commit 177b8007463c ("net: netem: fix backlog accounting for
corrupted GSO frames") started using the pointer to the first
segment in the "rest of segments processing", but as mentioned
above the first segment may had already been freed at this point.

Backlog corrections for parent qdiscs have to be adjusted.

Fixes: 177b8007463c ("net: netem: fix backlog accounting for corrupted GSO frames")
Reported-by: kbuild test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Reported-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Reviewed-by: Simon Horman <simon.horman@netronome.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/sched/sch_netem.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
index 1cd7266140e6a..7660aa5b80da8 100644
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -509,6 +509,7 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch,
 		if (skb->ip_summed == CHECKSUM_PARTIAL &&
 		    skb_checksum_help(skb)) {
 			qdisc_drop(skb, sch, to_free);
+			skb = NULL;
 			goto finish_segs;
 		}
 
@@ -584,9 +585,10 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch,
 finish_segs:
 	if (segs) {
 		unsigned int len, last_len;
-		int nb = 0;
+		int nb;
 
-		len = skb->len;
+		len = skb ? skb->len : 0;
+		nb = skb ? 1 : 0;
 
 		while (segs) {
 			skb2 = segs->next;
@@ -603,7 +605,8 @@ finish_segs:
 			}
 			segs = skb2;
 		}
-		qdisc_tree_reduce_backlog(sch, -nb, prev_len - len);
+		/* Parent qdiscs accounted for 1 skb of size @prev_len */
+		qdisc_tree_reduce_backlog(sch, -(nb - 1), -(len - prev_len));
 	}
 	return NET_XMIT_SUCCESS;
 }
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 610/639] net: netem: correct the parents backlog when corrupted packet was dropped
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (608 preceding siblings ...)
  2020-01-24  9:32 ` [PATCH 4.19 609/639] net: netem: fix error path for corrupted GSO frames Greg Kroah-Hartman
@ 2020-01-24  9:33 ` Greg Kroah-Hartman
  2020-01-24  9:33 ` [PATCH 4.19 611/639] xsk: Fix registration of Rx-only sockets Greg Kroah-Hartman
                   ` (32 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:33 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jakub Kicinski, Simon Horman,
	David S. Miller, Sasha Levin

From: Jakub Kicinski <jakub.kicinski@netronome.com>

[ Upstream commit e0ad032e144731a5928f2d75e91c2064ba1a764c ]

If packet corruption failed we jump to finish_segs and return
NET_XMIT_SUCCESS. Seeing success will make the parent qdisc
increment its backlog, that's incorrect - we need to return
NET_XMIT_DROP.

Fixes: 6071bd1aa13e ("netem: Segment GSO packets on enqueue")
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Reviewed-by: Simon Horman <simon.horman@netronome.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/sched/sch_netem.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
index 7660aa5b80da8..014a28d8dd4fa 100644
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -607,6 +607,8 @@ finish_segs:
 		}
 		/* Parent qdiscs accounted for 1 skb of size @prev_len */
 		qdisc_tree_reduce_backlog(sch, -(nb - 1), -(len - prev_len));
+	} else if (!skb) {
+		return NET_XMIT_DROP;
 	}
 	return NET_XMIT_SUCCESS;
 }
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 611/639] xsk: Fix registration of Rx-only sockets
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (609 preceding siblings ...)
  2020-01-24  9:33 ` [PATCH 4.19 610/639] net: netem: correct the parents backlog when corrupted packet was dropped Greg Kroah-Hartman
@ 2020-01-24  9:33 ` Greg Kroah-Hartman
  2020-01-24  9:33 ` [PATCH 4.19 612/639] bpf, offload: Unlock on error in bpf_offload_dev_create() Greg Kroah-Hartman
                   ` (31 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:33 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Kal Cutter Conley, Magnus Karlsson,
	Alexei Starovoitov, Jonathan Lemon, Sasha Levin

From: Magnus Karlsson <magnus.karlsson@intel.com>

[ Upstream commit 2afd23f78f39da84937006ecd24aa664a4ab052b ]

Having Rx-only AF_XDP sockets can potentially lead to a crash in the
system by a NULL pointer dereference in xsk_umem_consume_tx(). This
function iterates through a list of all sockets tied to a umem and
checks if there are any packets to send on the Tx ring. Rx-only
sockets do not have a Tx ring, so this will cause a NULL pointer
dereference. This will happen if you have registered one or more
Rx-only sockets to a umem and the driver is checking the Tx ring even
on Rx, or if the XDP_SHARED_UMEM mode is used and there is a mix of
Rx-only and other sockets tied to the same umem.

Fixed by only putting sockets with a Tx component on the list that
xsk_umem_consume_tx() iterates over.

Fixes: ac98d8aab61b ("xsk: wire upp Tx zero-copy functions")
Reported-by: Kal Cutter Conley <kal.conley@dectris.com>
Signed-off-by: Magnus Karlsson <magnus.karlsson@intel.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Jonathan Lemon <jonathan.lemon@gmail.com>
Link: https://lore.kernel.org/bpf/1571645818-16244-1-git-send-email-magnus.karlsson@intel.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/xdp/xdp_umem.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/net/xdp/xdp_umem.c b/net/xdp/xdp_umem.c
index d9117ab035f7c..556a649512b60 100644
--- a/net/xdp/xdp_umem.c
+++ b/net/xdp/xdp_umem.c
@@ -23,6 +23,9 @@ void xdp_add_sk_umem(struct xdp_umem *umem, struct xdp_sock *xs)
 {
 	unsigned long flags;
 
+	if (!xs->tx)
+		return;
+
 	spin_lock_irqsave(&umem->xsk_list_lock, flags);
 	list_add_rcu(&xs->list, &umem->xsk_list);
 	spin_unlock_irqrestore(&umem->xsk_list_lock, flags);
@@ -32,6 +35,9 @@ void xdp_del_sk_umem(struct xdp_umem *umem, struct xdp_sock *xs)
 {
 	unsigned long flags;
 
+	if (!xs->tx)
+		return;
+
 	spin_lock_irqsave(&umem->xsk_list_lock, flags);
 	list_del_rcu(&xs->list);
 	spin_unlock_irqrestore(&umem->xsk_list_lock, flags);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 612/639] bpf, offload: Unlock on error in bpf_offload_dev_create()
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (610 preceding siblings ...)
  2020-01-24  9:33 ` [PATCH 4.19 611/639] xsk: Fix registration of Rx-only sockets Greg Kroah-Hartman
@ 2020-01-24  9:33 ` Greg Kroah-Hartman
  2020-01-24  9:33 ` [PATCH 4.19 613/639] afs: Fix missing timeout reset Greg Kroah-Hartman
                   ` (30 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:33 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Daniel Borkmann,
	Jakub Kicinski, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit d0fbb51dfaa612f960519b798387be436e8f83c5 ]

We need to drop the bpf_devs_lock on error before returning.

Fixes: 9fd7c5559165 ("bpf: offload: aggregate offloads per-device")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Link: https://lore.kernel.org/bpf/20191104091536.GB31509@mwanda
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/bpf/offload.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/kernel/bpf/offload.c b/kernel/bpf/offload.c
index 177a524363942..86477f3894e52 100644
--- a/kernel/bpf/offload.c
+++ b/kernel/bpf/offload.c
@@ -645,8 +645,10 @@ struct bpf_offload_dev *bpf_offload_dev_create(void)
 	down_write(&bpf_devs_lock);
 	if (!offdevs_inited) {
 		err = rhashtable_init(&offdevs, &offdevs_params);
-		if (err)
+		if (err) {
+			up_write(&bpf_devs_lock);
 			return ERR_PTR(err);
+		}
 		offdevs_inited = true;
 	}
 	up_write(&bpf_devs_lock);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 613/639] afs: Fix missing timeout reset
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (611 preceding siblings ...)
  2020-01-24  9:33 ` [PATCH 4.19 612/639] bpf, offload: Unlock on error in bpf_offload_dev_create() Greg Kroah-Hartman
@ 2020-01-24  9:33 ` Greg Kroah-Hartman
  2020-01-24  9:33 ` [PATCH 4.19 614/639] net: qca_spi: Move reset_count to struct qcaspi Greg Kroah-Hartman
                   ` (29 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:33 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, David Howells, Marc Dionne,
	Linus Torvalds, Sasha Levin

From: David Howells <dhowells@redhat.com>

[ Upstream commit c74386d50fbaf4a54fd3fe560f1abc709c0cff4b ]

In afs_wait_for_call_to_complete(), rather than immediately aborting an
operation if a signal occurs, the code attempts to wait for it to
complete, using a schedule timeout of 2*RTT (or min 2 jiffies) and a
check that we're still receiving relevant packets from the server before
we consider aborting the call.  We may even ping the server to check on
the status of the call.

However, there's a missing timeout reset in the event that we do
actually get a packet to process, such that if we then get a couple of
short stalls, we then time out when progress is actually being made.

Fix this by resetting the timeout any time we get something to process.
If it's the failure of the call then the call state will get changed and
we'll exit the loop shortly thereafter.

A symptom of this is data fetches and stores failing with EINTR when
they really shouldn't.

Fixes: bc5e3a546d55 ("rxrpc: Use MSG_WAITALL to tell sendmsg() to temporarily ignore signals")
Signed-off-by: David Howells <dhowells@redhat.com>
Reviewed-by: Marc Dionne <marc.dionne@auristor.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/afs/rxrpc.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/afs/rxrpc.c b/fs/afs/rxrpc.c
index 2543f24d23f8d..560dd5ff5a151 100644
--- a/fs/afs/rxrpc.c
+++ b/fs/afs/rxrpc.c
@@ -573,6 +573,7 @@ static long afs_wait_for_call_to_complete(struct afs_call *call,
 			call->need_attention = false;
 			__set_current_state(TASK_RUNNING);
 			afs_deliver_to_call(call);
+			timeout = rtt2;
 			continue;
 		}
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 614/639] net: qca_spi: Move reset_count to struct qcaspi
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (612 preceding siblings ...)
  2020-01-24  9:33 ` [PATCH 4.19 613/639] afs: Fix missing timeout reset Greg Kroah-Hartman
@ 2020-01-24  9:33 ` Greg Kroah-Hartman
  2020-01-24  9:33 ` [PATCH 4.19 615/639] hv_netvsc: Fix offset usage in netvsc_send_table() Greg Kroah-Hartman
                   ` (28 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:33 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Stefan Wahren, Stefan Wahren,
	David S. Miller, Sasha Levin

From: Stefan Wahren <stefan.wahren@in-tech.com>

[ Upstream commit bc19c32904e36548335b35fdce6ce734e20afc0a ]

The reset counter is specific for every QCA700x chip. So move this
into the private driver struct. Otherwise we get unpredictable reset
behavior in setups with multiple QCA700x chips.

Fixes: 291ab06ecf67 (net: qualcomm: new Ethernet over SPI driver for QCA7000)
Signed-off-by: Stefan Wahren <stefan.wahren@in-tech.com>
Signed-off-by: Stefan Wahren <wahrenst@gmx.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/qualcomm/qca_spi.c | 9 ++++-----
 drivers/net/ethernet/qualcomm/qca_spi.h | 1 +
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/net/ethernet/qualcomm/qca_spi.c b/drivers/net/ethernet/qualcomm/qca_spi.c
index 66b775d462fd8..9d188931bc09e 100644
--- a/drivers/net/ethernet/qualcomm/qca_spi.c
+++ b/drivers/net/ethernet/qualcomm/qca_spi.c
@@ -475,7 +475,6 @@ qcaspi_qca7k_sync(struct qcaspi *qca, int event)
 	u16 signature = 0;
 	u16 spi_config;
 	u16 wrbuf_space = 0;
-	static u16 reset_count;
 
 	if (event == QCASPI_EVENT_CPUON) {
 		/* Read signature twice, if not valid
@@ -528,13 +527,13 @@ qcaspi_qca7k_sync(struct qcaspi *qca, int event)
 
 		qca->sync = QCASPI_SYNC_RESET;
 		qca->stats.trig_reset++;
-		reset_count = 0;
+		qca->reset_count = 0;
 		break;
 	case QCASPI_SYNC_RESET:
-		reset_count++;
+		qca->reset_count++;
 		netdev_dbg(qca->net_dev, "sync: waiting for CPU on, count %u.\n",
-			   reset_count);
-		if (reset_count >= QCASPI_RESET_TIMEOUT) {
+			   qca->reset_count);
+		if (qca->reset_count >= QCASPI_RESET_TIMEOUT) {
 			/* reset did not seem to take place, try again */
 			qca->sync = QCASPI_SYNC_UNKNOWN;
 			qca->stats.reset_timeout++;
diff --git a/drivers/net/ethernet/qualcomm/qca_spi.h b/drivers/net/ethernet/qualcomm/qca_spi.h
index fc0e98726b361..719c41227f221 100644
--- a/drivers/net/ethernet/qualcomm/qca_spi.h
+++ b/drivers/net/ethernet/qualcomm/qca_spi.h
@@ -92,6 +92,7 @@ struct qcaspi {
 
 	unsigned int intr_req;
 	unsigned int intr_svc;
+	u16 reset_count;
 
 #ifdef CONFIG_DEBUG_FS
 	struct dentry *device_root;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 615/639] hv_netvsc: Fix offset usage in netvsc_send_table()
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (613 preceding siblings ...)
  2020-01-24  9:33 ` [PATCH 4.19 614/639] net: qca_spi: Move reset_count to struct qcaspi Greg Kroah-Hartman
@ 2020-01-24  9:33 ` Greg Kroah-Hartman
  2020-01-24  9:33 ` [PATCH 4.19 616/639] hv_netvsc: Fix send_table offset in case of a host bug Greg Kroah-Hartman
                   ` (27 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:33 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Haiyang Zhang, David S. Miller, Sasha Levin

From: Haiyang Zhang <haiyangz@microsoft.com>

[ Upstream commit 71f21959dd5516031db4f011e15e9a9508b93a7d ]

To reach the data region, the existing code adds offset in struct
nvsp_5_send_indirect_table on the beginning of this struct. But the
offset should be based on the beginning of its container,
struct nvsp_message. This bug causes the first table entry missing,
and adds an extra zero from the zero pad after the data region.
This can put extra burden on the channel 0.

So, correct the offset usage. Also add a boundary check to ensure
not reading beyond data region.

Fixes: 5b54dac856cb ("hyperv: Add support for virtual Receive Side Scaling (vRSS)")
Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/hyperv/hyperv_net.h |  3 ++-
 drivers/net/hyperv/netvsc.c     | 26 ++++++++++++++++++--------
 2 files changed, 20 insertions(+), 9 deletions(-)

diff --git a/drivers/net/hyperv/hyperv_net.h b/drivers/net/hyperv/hyperv_net.h
index 50709c76b6725..dfa801315da6b 100644
--- a/drivers/net/hyperv/hyperv_net.h
+++ b/drivers/net/hyperv/hyperv_net.h
@@ -616,7 +616,8 @@ struct nvsp_5_send_indirect_table {
 	/* The number of entries in the send indirection table */
 	u32 count;
 
-	/* The offset of the send indirection table from top of this struct.
+	/* The offset of the send indirection table from the beginning of
+	 * struct nvsp_message.
 	 * The send indirection table tells which channel to put the send
 	 * traffic on. Each entry is a channel number.
 	 */
diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c
index 35413041dcf81..68c23a64e565f 100644
--- a/drivers/net/hyperv/netvsc.c
+++ b/drivers/net/hyperv/netvsc.c
@@ -1182,20 +1182,28 @@ static int netvsc_receive(struct net_device *ndev,
 }
 
 static void netvsc_send_table(struct net_device *ndev,
-			      const struct nvsp_message *nvmsg)
+			      const struct nvsp_message *nvmsg,
+			      u32 msglen)
 {
 	struct net_device_context *net_device_ctx = netdev_priv(ndev);
-	u32 count, *tab;
+	u32 count, offset, *tab;
 	int i;
 
 	count = nvmsg->msg.v5_msg.send_table.count;
+	offset = nvmsg->msg.v5_msg.send_table.offset;
+
 	if (count != VRSS_SEND_TAB_SIZE) {
 		netdev_err(ndev, "Received wrong send-table size:%u\n", count);
 		return;
 	}
 
-	tab = (u32 *)((unsigned long)&nvmsg->msg.v5_msg.send_table +
-		      nvmsg->msg.v5_msg.send_table.offset);
+	if (offset > msglen - count * sizeof(u32)) {
+		netdev_err(ndev, "Received send-table offset too big:%u\n",
+			   offset);
+		return;
+	}
+
+	tab = (void *)nvmsg + offset;
 
 	for (i = 0; i < count; i++)
 		net_device_ctx->tx_table[i] = tab[i];
@@ -1213,12 +1221,13 @@ static void netvsc_send_vf(struct net_device *ndev,
 		    net_device_ctx->vf_alloc ? "added" : "removed");
 }
 
-static  void netvsc_receive_inband(struct net_device *ndev,
-				   const struct nvsp_message *nvmsg)
+static void netvsc_receive_inband(struct net_device *ndev,
+				  const struct nvsp_message *nvmsg,
+				  u32 msglen)
 {
 	switch (nvmsg->hdr.msg_type) {
 	case NVSP_MSG5_TYPE_SEND_INDIRECTION_TABLE:
-		netvsc_send_table(ndev, nvmsg);
+		netvsc_send_table(ndev, nvmsg, msglen);
 		break;
 
 	case NVSP_MSG4_TYPE_SEND_VF_ASSOCIATION:
@@ -1235,6 +1244,7 @@ static int netvsc_process_raw_pkt(struct hv_device *device,
 				  int budget)
 {
 	const struct nvsp_message *nvmsg = hv_pkt_data(desc);
+	u32 msglen = hv_pkt_datalen(desc);
 
 	trace_nvsp_recv(ndev, channel, nvmsg);
 
@@ -1250,7 +1260,7 @@ static int netvsc_process_raw_pkt(struct hv_device *device,
 		break;
 
 	case VM_PKT_DATA_INBAND:
-		netvsc_receive_inband(ndev, nvmsg);
+		netvsc_receive_inband(ndev, nvmsg, msglen);
 		break;
 
 	default:
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 616/639] hv_netvsc: Fix send_table offset in case of a host bug
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (614 preceding siblings ...)
  2020-01-24  9:33 ` [PATCH 4.19 615/639] hv_netvsc: Fix offset usage in netvsc_send_table() Greg Kroah-Hartman
@ 2020-01-24  9:33 ` Greg Kroah-Hartman
  2020-01-24  9:33 ` [PATCH 4.19 617/639] afs: Fix large file support Greg Kroah-Hartman
                   ` (26 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:33 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Haiyang Zhang, David S. Miller, Sasha Levin

From: Haiyang Zhang <haiyangz@microsoft.com>

[ Upstream commit 171c1fd98df3d5948d9a9eb755274850fa5e59c6 ]

If negotiated NVSP version <= NVSP_PROTOCOL_VERSION_6, the offset may
be wrong (too small) due to a host bug. This can cause missing the
end of the send indirection table, and add multiple zero entries from
leading zeros before the data region. This bug adds extra burden on
channel 0.

So fix the offset by computing it from the data structure sizes. This
will ensure netvsc driver runs normally on unfixed hosts, and future
fixed hosts.

Fixes: 5b54dac856cb ("hyperv: Add support for virtual Receive Side Scaling (vRSS)")
Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/hyperv/netvsc.c | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c
index 68c23a64e565f..dbfd3a0c97d3b 100644
--- a/drivers/net/hyperv/netvsc.c
+++ b/drivers/net/hyperv/netvsc.c
@@ -1182,6 +1182,7 @@ static int netvsc_receive(struct net_device *ndev,
 }
 
 static void netvsc_send_table(struct net_device *ndev,
+			      struct netvsc_device *nvscdev,
 			      const struct nvsp_message *nvmsg,
 			      u32 msglen)
 {
@@ -1197,6 +1198,16 @@ static void netvsc_send_table(struct net_device *ndev,
 		return;
 	}
 
+	/* If negotiated version <= NVSP_PROTOCOL_VERSION_6, the offset may be
+	 * wrong due to a host bug. So fix the offset here.
+	 */
+	if (nvscdev->nvsp_version <= NVSP_PROTOCOL_VERSION_6 &&
+	    msglen >= sizeof(struct nvsp_message_header) +
+	    sizeof(union nvsp_6_message_uber) + count * sizeof(u32))
+		offset = sizeof(struct nvsp_message_header) +
+			 sizeof(union nvsp_6_message_uber);
+
+	/* Boundary check for all versions */
 	if (offset > msglen - count * sizeof(u32)) {
 		netdev_err(ndev, "Received send-table offset too big:%u\n",
 			   offset);
@@ -1222,12 +1233,13 @@ static void netvsc_send_vf(struct net_device *ndev,
 }
 
 static void netvsc_receive_inband(struct net_device *ndev,
+				  struct netvsc_device *nvscdev,
 				  const struct nvsp_message *nvmsg,
 				  u32 msglen)
 {
 	switch (nvmsg->hdr.msg_type) {
 	case NVSP_MSG5_TYPE_SEND_INDIRECTION_TABLE:
-		netvsc_send_table(ndev, nvmsg, msglen);
+		netvsc_send_table(ndev, nvscdev, nvmsg, msglen);
 		break;
 
 	case NVSP_MSG4_TYPE_SEND_VF_ASSOCIATION:
@@ -1260,7 +1272,7 @@ static int netvsc_process_raw_pkt(struct hv_device *device,
 		break;
 
 	case VM_PKT_DATA_INBAND:
-		netvsc_receive_inband(ndev, nvmsg, msglen);
+		netvsc_receive_inband(ndev, net_device, nvmsg, msglen);
 		break;
 
 	default:
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 617/639] afs: Fix large file support
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (615 preceding siblings ...)
  2020-01-24  9:33 ` [PATCH 4.19 616/639] hv_netvsc: Fix send_table offset in case of a host bug Greg Kroah-Hartman
@ 2020-01-24  9:33 ` Greg Kroah-Hartman
  2020-01-24  9:33 ` [PATCH 4.19 618/639] drm: panel-lvds: Potential Oops in probe error handling Greg Kroah-Hartman
                   ` (25 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:33 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Marc Dionne, David Howells,
	Linus Torvalds, Sasha Levin

From: Marc Dionne <marc.dionne@auristor.com>

[ Upstream commit b485275f1aca8a9da37fd35e4fad673935e827da ]

By default s_maxbytes is set to MAX_NON_LFS, which limits the usable
file size to 2GB, enforced by the vfs.

Commit b9b1f8d5930a ("AFS: write support fixes") added support for the
64-bit fetch and store server operations, but did not change this value.
As a result, attempts to write past the 2G mark result in EFBIG errors:

 $ dd if=/dev/zero of=foo bs=1M count=1 seek=2048
 dd: error writing 'foo': File too large

Set s_maxbytes to MAX_LFS_FILESIZE.

Fixes: b9b1f8d5930a ("AFS: write support fixes")
Signed-off-by: Marc Dionne <marc.dionne@auristor.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/afs/super.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/afs/super.c b/fs/afs/super.c
index 18b9b7ca20c92..4961d32ccd1e0 100644
--- a/fs/afs/super.c
+++ b/fs/afs/super.c
@@ -393,6 +393,7 @@ static int afs_fill_super(struct super_block *sb,
 	/* fill in the superblock */
 	sb->s_blocksize		= PAGE_SIZE;
 	sb->s_blocksize_bits	= PAGE_SHIFT;
+	sb->s_maxbytes		= MAX_LFS_FILESIZE;
 	sb->s_magic		= AFS_FS_MAGIC;
 	sb->s_op		= &afs_super_ops;
 	if (!as->dyn_root)
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 618/639] drm: panel-lvds: Potential Oops in probe error handling
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (616 preceding siblings ...)
  2020-01-24  9:33 ` [PATCH 4.19 617/639] afs: Fix large file support Greg Kroah-Hartman
@ 2020-01-24  9:33 ` Greg Kroah-Hartman
  2020-01-24  9:33 ` [PATCH 4.19 619/639] hwrng: omap3-rom - Fix missing clock by probing with device tree Greg Kroah-Hartman
                   ` (24 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:33 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Sam Ravnborg, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit fb2ee9bf084bcaeff1e5be100decc0eacb4af2d5 ]

The "lvds->backlight" pointer could be NULL in situations where
of_parse_phandle() returns NULL.  This code is cleaner if we use the
managed devm_of_find_backlight() so the clean up is automatic.

Fixes: 7c9dff5bd643 ("drm: panels: Add LVDS panel driver")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20190911104928.GA15930@mwanda
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/panel/panel-lvds.c | 21 ++++-----------------
 1 file changed, 4 insertions(+), 17 deletions(-)

diff --git a/drivers/gpu/drm/panel/panel-lvds.c b/drivers/gpu/drm/panel/panel-lvds.c
index 8a1687887ae91..bd704a36c5d0e 100644
--- a/drivers/gpu/drm/panel/panel-lvds.c
+++ b/drivers/gpu/drm/panel/panel-lvds.c
@@ -199,7 +199,6 @@ static int panel_lvds_parse_dt(struct panel_lvds *lvds)
 static int panel_lvds_probe(struct platform_device *pdev)
 {
 	struct panel_lvds *lvds;
-	struct device_node *np;
 	int ret;
 
 	lvds = devm_kzalloc(&pdev->dev, sizeof(*lvds), GFP_KERNEL);
@@ -245,14 +244,9 @@ static int panel_lvds_probe(struct platform_device *pdev)
 		return ret;
 	}
 
-	np = of_parse_phandle(lvds->dev->of_node, "backlight", 0);
-	if (np) {
-		lvds->backlight = of_find_backlight_by_node(np);
-		of_node_put(np);
-
-		if (!lvds->backlight)
-			return -EPROBE_DEFER;
-	}
+	lvds->backlight = devm_of_find_backlight(lvds->dev);
+	if (IS_ERR(lvds->backlight))
+		return PTR_ERR(lvds->backlight);
 
 	/*
 	 * TODO: Handle all power supplies specified in the DT node in a generic
@@ -268,14 +262,10 @@ static int panel_lvds_probe(struct platform_device *pdev)
 
 	ret = drm_panel_add(&lvds->panel);
 	if (ret < 0)
-		goto error;
+		return ret;
 
 	dev_set_drvdata(lvds->dev, lvds);
 	return 0;
-
-error:
-	put_device(&lvds->backlight->dev);
-	return ret;
 }
 
 static int panel_lvds_remove(struct platform_device *pdev)
@@ -286,9 +276,6 @@ static int panel_lvds_remove(struct platform_device *pdev)
 
 	panel_lvds_disable(&lvds->panel);
 
-	if (lvds->backlight)
-		put_device(&lvds->backlight->dev);
-
 	return 0;
 }
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 619/639] hwrng: omap3-rom - Fix missing clock by probing with device tree
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (617 preceding siblings ...)
  2020-01-24  9:33 ` [PATCH 4.19 618/639] drm: panel-lvds: Potential Oops in probe error handling Greg Kroah-Hartman
@ 2020-01-24  9:33 ` Greg Kroah-Hartman
  2020-01-24  9:33 ` [PATCH 4.19 620/639] dpaa_eth: perform DMA unmapping before read Greg Kroah-Hartman
                   ` (23 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:33 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, devicetree, Aaro Koskinen, Adam Ford,
	Pali Rohár, Rob Herring, Sebastian Reichel, Tero Kristo,
	Tony Lindgren, Rob Herring, Herbert Xu, Sasha Levin

From: Tony Lindgren <tony@atomide.com>

[ Upstream commit 0c0ef9ea6f3f0d5979dc7b094b0a184c1a94716b ]

Commit 0ed266d7ae5e ("clk: ti: omap3: cleanup unnecessary clock aliases")
removed old omap3 clock framework aliases but caused omap3-rom-rng to
stop working with clock not found error.

Based on discussions on the mailing list it was requested by Tero Kristo
that it would be best to fix this issue by probing omap3-rom-rng using
device tree to provide a proper clk property. The other option would be
to add back the missing clock alias, but that does not help moving things
forward with removing old legacy platform_data.

Let's also add a proper device tree binding and keep it together with
the fix.

Cc: devicetree@vger.kernel.org
Cc: Aaro Koskinen <aaro.koskinen@iki.fi>
Cc: Adam Ford <aford173@gmail.com>
Cc: Pali Rohár <pali.rohar@gmail.com>
Cc: Rob Herring <robh+dt@kernel.org>
Cc: Sebastian Reichel <sre@kernel.org>
Cc: Tero Kristo <t-kristo@ti.com>
Fixes: 0ed266d7ae5e ("clk: ti: omap3: cleanup unnecessary clock aliases")
Reported-by: Aaro Koskinen <aaro.koskinen@iki.fi>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Acked-by: Rob Herring <robh@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../devicetree/bindings/rng/omap3_rom_rng.txt | 27 +++++++++++++++++++
 arch/arm/boot/dts/omap3-n900.dts              |  6 +++++
 arch/arm/mach-omap2/pdata-quirks.c            | 12 +--------
 drivers/char/hw_random/omap3-rom-rng.c        | 17 ++++++++++--
 4 files changed, 49 insertions(+), 13 deletions(-)
 create mode 100644 Documentation/devicetree/bindings/rng/omap3_rom_rng.txt

diff --git a/Documentation/devicetree/bindings/rng/omap3_rom_rng.txt b/Documentation/devicetree/bindings/rng/omap3_rom_rng.txt
new file mode 100644
index 0000000000000..f315c9723bd2a
--- /dev/null
+++ b/Documentation/devicetree/bindings/rng/omap3_rom_rng.txt
@@ -0,0 +1,27 @@
+OMAP ROM RNG driver binding
+
+Secure SoCs may provide RNG via secure ROM calls like Nokia N900 does. The
+implementation can depend on the SoC secure ROM used.
+
+- compatible:
+	Usage: required
+	Value type: <string>
+	Definition: must be "nokia,n900-rom-rng"
+
+- clocks:
+	Usage: required
+	Value type: <prop-encoded-array>
+	Definition: reference to the the RNG interface clock
+
+- clock-names:
+	Usage: required
+	Value type: <stringlist>
+	Definition: must be "ick"
+
+Example:
+
+	rom_rng: rng {
+		compatible = "nokia,n900-rom-rng";
+		clocks = <&rng_ick>;
+		clock-names = "ick";
+	};
diff --git a/arch/arm/boot/dts/omap3-n900.dts b/arch/arm/boot/dts/omap3-n900.dts
index 182a53991c901..37785e7d1238c 100644
--- a/arch/arm/boot/dts/omap3-n900.dts
+++ b/arch/arm/boot/dts/omap3-n900.dts
@@ -158,6 +158,12 @@
 		pwms = <&pwm9 0 26316 0>; /* 38000 Hz */
 	};
 
+	rom_rng: rng {
+		compatible = "nokia,n900-rom-rng";
+		clocks = <&rng_ick>;
+		clock-names = "ick";
+	};
+
 	/* controlled (enabled/disabled) directly by bcm2048 and wl1251 */
 	vctcxo: vctcxo {
 		compatible = "fixed-clock";
diff --git a/arch/arm/mach-omap2/pdata-quirks.c b/arch/arm/mach-omap2/pdata-quirks.c
index dae7262287704..b57faa2310a2e 100644
--- a/arch/arm/mach-omap2/pdata-quirks.c
+++ b/arch/arm/mach-omap2/pdata-quirks.c
@@ -263,14 +263,6 @@ static void __init am3517_evm_legacy_init(void)
 	am35xx_emac_reset();
 }
 
-static struct platform_device omap3_rom_rng_device = {
-	.name		= "omap3-rom-rng",
-	.id		= -1,
-	.dev	= {
-		.platform_data	= rx51_secure_rng_call,
-	},
-};
-
 static void __init nokia_n900_legacy_init(void)
 {
 	hsmmc2_internal_input_clk();
@@ -286,9 +278,6 @@ static void __init nokia_n900_legacy_init(void)
 			pr_warn("RX-51: Not enabling ARM errata 430973 workaround\n");
 			pr_warn("Thumb binaries may crash randomly without this workaround\n");
 		}
-
-		pr_info("RX-51: Registering OMAP3 HWRNG device\n");
-		platform_device_register(&omap3_rom_rng_device);
 	}
 }
 
@@ -466,6 +455,7 @@ static struct of_dev_auxdata omap_auxdata_lookup[] = {
 	OF_DEV_AUXDATA("ti,davinci_mdio", 0x5c030000, "davinci_mdio.0", NULL),
 	OF_DEV_AUXDATA("ti,am3517-emac", 0x5c000000, "davinci_emac.0",
 		       &am35xx_emac_pdata),
+	OF_DEV_AUXDATA("nokia,n900-rom-rng", 0, NULL, rx51_secure_rng_call),
 	/* McBSP modules with sidetone core */
 #if IS_ENABLED(CONFIG_SND_OMAP_SOC_MCBSP)
 	OF_DEV_AUXDATA("ti,omap3-mcbsp", 0x49022000, "49022000.mcbsp", &mcbsp_pdata),
diff --git a/drivers/char/hw_random/omap3-rom-rng.c b/drivers/char/hw_random/omap3-rom-rng.c
index 648e39ce6bd95..8df3cad7c97ae 100644
--- a/drivers/char/hw_random/omap3-rom-rng.c
+++ b/drivers/char/hw_random/omap3-rom-rng.c
@@ -20,6 +20,8 @@
 #include <linux/workqueue.h>
 #include <linux/clk.h>
 #include <linux/err.h>
+#include <linux/of.h>
+#include <linux/of_device.h>
 #include <linux/platform_device.h>
 
 #define RNG_RESET			0x01
@@ -86,14 +88,18 @@ static int omap3_rom_rng_read(struct hwrng *rng, void *data, size_t max, bool w)
 
 static struct hwrng omap3_rom_rng_ops = {
 	.name		= "omap3-rom",
-	.read		= omap3_rom_rng_read,
 };
 
 static int omap3_rom_rng_probe(struct platform_device *pdev)
 {
 	int ret = 0;
 
-	pr_info("initializing\n");
+	omap3_rom_rng_ops.read = of_device_get_match_data(&pdev->dev);
+	if (!omap3_rom_rng_ops.read) {
+		dev_err(&pdev->dev, "missing rom code handler\n");
+
+		return -ENODEV;
+	}
 
 	omap3_rom_rng_call = pdev->dev.platform_data;
 	if (!omap3_rom_rng_call) {
@@ -126,9 +132,16 @@ static int omap3_rom_rng_remove(struct platform_device *pdev)
 	return 0;
 }
 
+static const struct of_device_id omap_rom_rng_match[] = {
+	{ .compatible = "nokia,n900-rom-rng", .data = omap3_rom_rng_read, },
+	{ /* sentinel */ },
+};
+MODULE_DEVICE_TABLE(of, omap_rom_rng_match);
+
 static struct platform_driver omap3_rom_rng_driver = {
 	.driver = {
 		.name		= "omap3-rom-rng",
+		.of_match_table = omap_rom_rng_match,
 	},
 	.probe		= omap3_rom_rng_probe,
 	.remove		= omap3_rom_rng_remove,
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 620/639] dpaa_eth: perform DMA unmapping before read
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (618 preceding siblings ...)
  2020-01-24  9:33 ` [PATCH 4.19 619/639] hwrng: omap3-rom - Fix missing clock by probing with device tree Greg Kroah-Hartman
@ 2020-01-24  9:33 ` Greg Kroah-Hartman
  2020-01-24  9:33 ` [PATCH 4.19 621/639] dpaa_eth: avoid timestamp read on error paths Greg Kroah-Hartman
                   ` (22 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:33 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Madalin Bucur, David S. Miller, Sasha Levin

From: Madalin Bucur <madalin.bucur@nxp.com>

[ Upstream commit c70fd3182caef014e6c628b412f81aa57a3ef9e4 ]

DMA unmapping is required before accessing the HW provided timestamping
information.

Fixes: 4664856e9ca2 ("dpaa_eth: add support for hardware timestamping")
Signed-off-by: Madalin Bucur <madalin.bucur@nxp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../net/ethernet/freescale/dpaa/dpaa_eth.c    | 32 ++++++++++---------
 1 file changed, 17 insertions(+), 15 deletions(-)

diff --git a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
index 462bb8c4f80c9..3cd62a71ddea8 100644
--- a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
+++ b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
@@ -1620,18 +1620,6 @@ static struct sk_buff *dpaa_cleanup_tx_fd(const struct dpaa_priv *priv,
 	skbh = (struct sk_buff **)phys_to_virt(addr);
 	skb = *skbh;
 
-	if (priv->tx_tstamp && skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP) {
-		memset(&shhwtstamps, 0, sizeof(shhwtstamps));
-
-		if (!fman_port_get_tstamp(priv->mac_dev->port[TX], (void *)skbh,
-					  &ns)) {
-			shhwtstamps.hwtstamp = ns_to_ktime(ns);
-			skb_tstamp_tx(skb, &shhwtstamps);
-		} else {
-			dev_warn(dev, "fman_port_get_tstamp failed!\n");
-		}
-	}
-
 	if (unlikely(qm_fd_get_format(fd) == qm_fd_sg)) {
 		nr_frags = skb_shinfo(skb)->nr_frags;
 		dma_unmap_single(dev, addr,
@@ -1654,14 +1642,28 @@ static struct sk_buff *dpaa_cleanup_tx_fd(const struct dpaa_priv *priv,
 			dma_unmap_page(dev, qm_sg_addr(&sgt[i]),
 				       qm_sg_entry_get_len(&sgt[i]), dma_dir);
 		}
-
-		/* Free the page frag that we allocated on Tx */
-		skb_free_frag(phys_to_virt(addr));
 	} else {
 		dma_unmap_single(dev, addr,
 				 skb_tail_pointer(skb) - (u8 *)skbh, dma_dir);
 	}
 
+	/* DMA unmapping is required before accessing the HW provided info */
+	if (priv->tx_tstamp && skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP) {
+		memset(&shhwtstamps, 0, sizeof(shhwtstamps));
+
+		if (!fman_port_get_tstamp(priv->mac_dev->port[TX], (void *)skbh,
+					  &ns)) {
+			shhwtstamps.hwtstamp = ns_to_ktime(ns);
+			skb_tstamp_tx(skb, &shhwtstamps);
+		} else {
+			dev_warn(dev, "fman_port_get_tstamp failed!\n");
+		}
+	}
+
+	if (qm_fd_get_format(fd) == qm_fd_sg)
+		/* Free the page frag that we allocated on Tx */
+		skb_free_frag(phys_to_virt(addr));
+
 	return skb;
 }
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 621/639] dpaa_eth: avoid timestamp read on error paths
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (619 preceding siblings ...)
  2020-01-24  9:33 ` [PATCH 4.19 620/639] dpaa_eth: perform DMA unmapping before read Greg Kroah-Hartman
@ 2020-01-24  9:33 ` Greg Kroah-Hartman
  2020-01-24  9:33 ` [PATCH 4.19 622/639] MIPS: Loongson: Fix return value of loongson_hwmon_init Greg Kroah-Hartman
                   ` (21 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:33 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Madalin Bucur, David S. Miller, Sasha Levin

From: Madalin Bucur <madalin.bucur@nxp.com>

[ Upstream commit 9a4f4f3a894ff4487f5597b7aabba9432b238292 ]

The dpaa_cleanup_tx_fd() function is called by the frame transmit
confirmation callback but also on several error paths. This function
is reading the transmit timestamp value. Avoid reading an invalid
timestamp value on the error paths.

Fixes: 4664856e9ca2 ("dpaa_eth: add support for hardware timestamping")
Signed-off-by: Madalin Bucur <madalin.bucur@nxp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/freescale/dpaa/dpaa_eth.c | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
index 3cd62a71ddea8..d7736c9c6339a 100644
--- a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
+++ b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
@@ -1600,13 +1600,15 @@ static int dpaa_eth_refill_bpools(struct dpaa_priv *priv)
  * Skb freeing is not handled here.
  *
  * This function may be called on error paths in the Tx function, so guard
- * against cases when not all fd relevant fields were filled in.
+ * against cases when not all fd relevant fields were filled in. To avoid
+ * reading the invalid transmission timestamp for the error paths set ts to
+ * false.
  *
  * Return the skb backpointer, since for S/G frames the buffer containing it
  * gets freed here.
  */
 static struct sk_buff *dpaa_cleanup_tx_fd(const struct dpaa_priv *priv,
-					  const struct qm_fd *fd)
+					  const struct qm_fd *fd, bool ts)
 {
 	const enum dma_data_direction dma_dir = DMA_TO_DEVICE;
 	struct device *dev = priv->net_dev->dev.parent;
@@ -1648,7 +1650,8 @@ static struct sk_buff *dpaa_cleanup_tx_fd(const struct dpaa_priv *priv,
 	}
 
 	/* DMA unmapping is required before accessing the HW provided info */
-	if (priv->tx_tstamp && skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP) {
+	if (ts && priv->tx_tstamp &&
+	    skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP) {
 		memset(&shhwtstamps, 0, sizeof(shhwtstamps));
 
 		if (!fman_port_get_tstamp(priv->mac_dev->port[TX], (void *)skbh,
@@ -2118,7 +2121,7 @@ dpaa_start_xmit(struct sk_buff *skb, struct net_device *net_dev)
 	if (likely(dpaa_xmit(priv, percpu_stats, queue_mapping, &fd) == 0))
 		return NETDEV_TX_OK;
 
-	dpaa_cleanup_tx_fd(priv, &fd);
+	dpaa_cleanup_tx_fd(priv, &fd, false);
 skb_to_fd_failed:
 enomem:
 	percpu_stats->tx_errors++;
@@ -2164,7 +2167,7 @@ static void dpaa_tx_error(struct net_device *net_dev,
 
 	percpu_priv->stats.tx_errors++;
 
-	skb = dpaa_cleanup_tx_fd(priv, fd);
+	skb = dpaa_cleanup_tx_fd(priv, fd, false);
 	dev_kfree_skb(skb);
 }
 
@@ -2205,7 +2208,7 @@ static void dpaa_tx_conf(struct net_device *net_dev,
 
 	percpu_priv->tx_confirm++;
 
-	skb = dpaa_cleanup_tx_fd(priv, fd);
+	skb = dpaa_cleanup_tx_fd(priv, fd, true);
 
 	consume_skb(skb);
 }
@@ -2435,7 +2438,7 @@ static void egress_ern(struct qman_portal *portal,
 	percpu_priv->stats.tx_fifo_errors++;
 	count_ern(percpu_priv, msg);
 
-	skb = dpaa_cleanup_tx_fd(priv, fd);
+	skb = dpaa_cleanup_tx_fd(priv, fd, false);
 	dev_kfree_skb_any(skb);
 }
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 622/639] MIPS: Loongson: Fix return value of loongson_hwmon_init
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (620 preceding siblings ...)
  2020-01-24  9:33 ` [PATCH 4.19 621/639] dpaa_eth: avoid timestamp read on error paths Greg Kroah-Hartman
@ 2020-01-24  9:33 ` Greg Kroah-Hartman
  2020-01-24  9:33 ` [PATCH 4.19 623/639] hv_netvsc: flag software created hash value Greg Kroah-Hartman
                   ` (20 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:33 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Tiezhu Yang, Paul Burton,
	Ralf Baechle, James Hogan, Huacai Chen, Jiaxun Yang, linux-mips,
	Sasha Levin

From: Tiezhu Yang <yangtiezhu@loongson.cn>

[ Upstream commit dece3c2a320b0a6d891da6ff774ab763969b6860 ]

When call function hwmon_device_register failed, use the actual
return value instead of always -ENOMEM.

Fixes: 64f09aa967e1 ("MIPS: Loongson-3: Add CPU Hwmon platform driver")
Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
Signed-off-by: Paul Burton <paulburton@kernel.org>
Cc: Ralf Baechle <ralf@linux-mips.org>
Cc: James Hogan <jhogan@kernel.org>
Cc: Huacai Chen <chenhc@lemote.com>
Cc: Jiaxun Yang <jiaxun.yang@flygoat.com>
Cc: linux-mips@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/mips/cpu_hwmon.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/platform/mips/cpu_hwmon.c b/drivers/platform/mips/cpu_hwmon.c
index f66521c7f8462..98128374d710a 100644
--- a/drivers/platform/mips/cpu_hwmon.c
+++ b/drivers/platform/mips/cpu_hwmon.c
@@ -159,7 +159,7 @@ static int __init loongson_hwmon_init(void)
 
 	cpu_hwmon_dev = hwmon_device_register(NULL);
 	if (IS_ERR(cpu_hwmon_dev)) {
-		ret = -ENOMEM;
+		ret = PTR_ERR(cpu_hwmon_dev);
 		pr_err("hwmon_device_register fail!\n");
 		goto fail_hwmon_device_register;
 	}
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 623/639] hv_netvsc: flag software created hash value
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (621 preceding siblings ...)
  2020-01-24  9:33 ` [PATCH 4.19 622/639] MIPS: Loongson: Fix return value of loongson_hwmon_init Greg Kroah-Hartman
@ 2020-01-24  9:33 ` Greg Kroah-Hartman
  2020-01-24  9:33 ` [PATCH 4.19 624/639] net: neigh: use long type to store jiffies delta Greg Kroah-Hartman
                   ` (19 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:33 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Stephen Hemminger, David S. Miller,
	Sasha Levin

From: Stephen Hemminger <sthemmin@microsoft.com>

[ Upstream commit df9f540ca74297a84bafacfa197e9347b20beea5 ]

When the driver needs to create a hash value because it
was not done at higher level, then the hash should be marked
as a software not hardware hash.

Fixes: f72860afa2e3 ("hv_netvsc: Exclude non-TCP port numbers from vRSS hashing")
Signed-off-by: Stephen Hemminger <sthemmin@microsoft.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/hyperv/netvsc_drv.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
index 54670c9905c79..7ab576d8b6227 100644
--- a/drivers/net/hyperv/netvsc_drv.c
+++ b/drivers/net/hyperv/netvsc_drv.c
@@ -295,9 +295,9 @@ static inline u32 netvsc_get_hash(
 		else if (flow.basic.n_proto == htons(ETH_P_IPV6))
 			hash = jhash2((u32 *)&flow.addrs.v6addrs, 8, hashrnd);
 		else
-			hash = 0;
+			return 0;
 
-		skb_set_hash(skb, hash, PKT_HASH_TYPE_L3);
+		__skb_set_sw_hash(skb, hash, false);
 	}
 
 	return hash;
@@ -804,8 +804,7 @@ static struct sk_buff *netvsc_alloc_recv_skb(struct net_device *net,
 	    skb->protocol == htons(ETH_P_IP))
 		netvsc_comp_ipcsum(skb);
 
-	/* Do L4 checksum offload if enabled and present.
-	 */
+	/* Do L4 checksum offload if enabled and present. */
 	if (csum_info && (net->features & NETIF_F_RXCSUM)) {
 		if (csum_info->receive.tcp_checksum_succeeded ||
 		    csum_info->receive.udp_checksum_succeeded)
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 624/639] net: neigh: use long type to store jiffies delta
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (622 preceding siblings ...)
  2020-01-24  9:33 ` [PATCH 4.19 623/639] hv_netvsc: flag software created hash value Greg Kroah-Hartman
@ 2020-01-24  9:33 ` Greg Kroah-Hartman
  2020-01-24  9:33 ` [PATCH 4.19 625/639] packet: fix data-race in fanout_flow_is_huge() Greg Kroah-Hartman
                   ` (18 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:33 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Eric Dumazet, David S. Miller, Sasha Levin

From: Eric Dumazet <edumazet@google.com>

[ Upstream commit 9d027e3a83f39b819e908e4e09084277a2e45e95 ]

A difference of two unsigned long needs long storage.

Fixes: c7fb64db001f ("[NETLINK]: Neighbour table configuration and statistics via rtnetlink")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/core/neighbour.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index e260d44ebdca0..bf738ec68cb53 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -1885,8 +1885,8 @@ static int neightbl_fill_info(struct sk_buff *skb, struct neigh_table *tbl,
 		goto nla_put_failure;
 	{
 		unsigned long now = jiffies;
-		unsigned int flush_delta = now - tbl->last_flush;
-		unsigned int rand_delta = now - tbl->last_rand;
+		long flush_delta = now - tbl->last_flush;
+		long rand_delta = now - tbl->last_rand;
 		struct neigh_hash_table *nht;
 		struct ndt_config ndc = {
 			.ndtc_key_len		= tbl->key_len,
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 625/639] packet: fix data-race in fanout_flow_is_huge()
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (623 preceding siblings ...)
  2020-01-24  9:33 ` [PATCH 4.19 624/639] net: neigh: use long type to store jiffies delta Greg Kroah-Hartman
@ 2020-01-24  9:33 ` Greg Kroah-Hartman
  2020-01-26 18:29   ` Pavel Machek
  2020-01-24  9:33 ` [PATCH 4.19 626/639] i2c: stm32f7: report dma error during probe Greg Kroah-Hartman
                   ` (17 subsequent siblings)
  642 siblings, 1 reply; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:33 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Eric Dumazet, Willem de Bruijn,
	David S. Miller, Sasha Levin

From: Eric Dumazet <edumazet@google.com>

[ Upstream commit b756ad928d98e5ef0b74af7546a6a31a8dadde00 ]

KCSAN reported the following data-race [1]

Adding a couple of READ_ONCE()/WRITE_ONCE() should silence it.

Since the report hinted about multiple cpus using the history
concurrently, I added a test avoiding writing on it if the
victim slot already contains the desired value.

[1]

BUG: KCSAN: data-race in fanout_demux_rollover / fanout_demux_rollover

read to 0xffff8880b01786cc of 4 bytes by task 18921 on cpu 1:
 fanout_flow_is_huge net/packet/af_packet.c:1303 [inline]
 fanout_demux_rollover+0x33e/0x3f0 net/packet/af_packet.c:1353
 packet_rcv_fanout+0x34e/0x490 net/packet/af_packet.c:1453
 deliver_skb net/core/dev.c:1888 [inline]
 dev_queue_xmit_nit+0x15b/0x540 net/core/dev.c:1958
 xmit_one net/core/dev.c:3195 [inline]
 dev_hard_start_xmit+0x3f5/0x430 net/core/dev.c:3215
 __dev_queue_xmit+0x14ab/0x1b40 net/core/dev.c:3792
 dev_queue_xmit+0x21/0x30 net/core/dev.c:3825
 neigh_direct_output+0x1f/0x30 net/core/neighbour.c:1530
 neigh_output include/net/neighbour.h:511 [inline]
 ip6_finish_output2+0x7a2/0xec0 net/ipv6/ip6_output.c:116
 __ip6_finish_output net/ipv6/ip6_output.c:142 [inline]
 __ip6_finish_output+0x2d7/0x330 net/ipv6/ip6_output.c:127
 ip6_finish_output+0x41/0x160 net/ipv6/ip6_output.c:152
 NF_HOOK_COND include/linux/netfilter.h:294 [inline]
 ip6_output+0xf2/0x280 net/ipv6/ip6_output.c:175
 dst_output include/net/dst.h:436 [inline]
 ip6_local_out+0x74/0x90 net/ipv6/output_core.c:179
 ip6_send_skb+0x53/0x110 net/ipv6/ip6_output.c:1795
 udp_v6_send_skb.isra.0+0x3ec/0xa70 net/ipv6/udp.c:1173
 udpv6_sendmsg+0x1906/0x1c20 net/ipv6/udp.c:1471
 inet6_sendmsg+0x6d/0x90 net/ipv6/af_inet6.c:576
 sock_sendmsg_nosec net/socket.c:637 [inline]
 sock_sendmsg+0x9f/0xc0 net/socket.c:657
 ___sys_sendmsg+0x2b7/0x5d0 net/socket.c:2311
 __sys_sendmmsg+0x123/0x350 net/socket.c:2413
 __do_sys_sendmmsg net/socket.c:2442 [inline]
 __se_sys_sendmmsg net/socket.c:2439 [inline]
 __x64_sys_sendmmsg+0x64/0x80 net/socket.c:2439
 do_syscall_64+0xcc/0x370 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

write to 0xffff8880b01786cc of 4 bytes by task 18922 on cpu 0:
 fanout_flow_is_huge net/packet/af_packet.c:1306 [inline]
 fanout_demux_rollover+0x3a4/0x3f0 net/packet/af_packet.c:1353
 packet_rcv_fanout+0x34e/0x490 net/packet/af_packet.c:1453
 deliver_skb net/core/dev.c:1888 [inline]
 dev_queue_xmit_nit+0x15b/0x540 net/core/dev.c:1958
 xmit_one net/core/dev.c:3195 [inline]
 dev_hard_start_xmit+0x3f5/0x430 net/core/dev.c:3215
 __dev_queue_xmit+0x14ab/0x1b40 net/core/dev.c:3792
 dev_queue_xmit+0x21/0x30 net/core/dev.c:3825
 neigh_direct_output+0x1f/0x30 net/core/neighbour.c:1530
 neigh_output include/net/neighbour.h:511 [inline]
 ip6_finish_output2+0x7a2/0xec0 net/ipv6/ip6_output.c:116
 __ip6_finish_output net/ipv6/ip6_output.c:142 [inline]
 __ip6_finish_output+0x2d7/0x330 net/ipv6/ip6_output.c:127
 ip6_finish_output+0x41/0x160 net/ipv6/ip6_output.c:152
 NF_HOOK_COND include/linux/netfilter.h:294 [inline]
 ip6_output+0xf2/0x280 net/ipv6/ip6_output.c:175
 dst_output include/net/dst.h:436 [inline]
 ip6_local_out+0x74/0x90 net/ipv6/output_core.c:179
 ip6_send_skb+0x53/0x110 net/ipv6/ip6_output.c:1795
 udp_v6_send_skb.isra.0+0x3ec/0xa70 net/ipv6/udp.c:1173
 udpv6_sendmsg+0x1906/0x1c20 net/ipv6/udp.c:1471
 inet6_sendmsg+0x6d/0x90 net/ipv6/af_inet6.c:576
 sock_sendmsg_nosec net/socket.c:637 [inline]
 sock_sendmsg+0x9f/0xc0 net/socket.c:657
 ___sys_sendmsg+0x2b7/0x5d0 net/socket.c:2311
 __sys_sendmmsg+0x123/0x350 net/socket.c:2413
 __do_sys_sendmmsg net/socket.c:2442 [inline]
 __se_sys_sendmmsg net/socket.c:2439 [inline]
 __x64_sys_sendmmsg+0x64/0x80 net/socket.c:2439
 do_syscall_64+0xcc/0x370 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 18922 Comm: syz-executor.3 Not tainted 5.4.0-rc6+ #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011

Fixes: 3b3a5b0aab5b ("packet: rollover huge flows before small flows")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/packet/af_packet.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 60ba18a4bb0ff..ddf90e6fac514 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -1297,15 +1297,21 @@ static void packet_sock_destruct(struct sock *sk)
 
 static bool fanout_flow_is_huge(struct packet_sock *po, struct sk_buff *skb)
 {
-	u32 rxhash;
+	u32 *history = po->rollover->history;
+	u32 victim, rxhash;
 	int i, count = 0;
 
 	rxhash = skb_get_hash(skb);
 	for (i = 0; i < ROLLOVER_HLEN; i++)
-		if (po->rollover->history[i] == rxhash)
+		if (READ_ONCE(history[i]) == rxhash)
 			count++;
 
-	po->rollover->history[prandom_u32() % ROLLOVER_HLEN] = rxhash;
+	victim = prandom_u32() % ROLLOVER_HLEN;
+
+	/* Avoid dirtying the cache line if possible */
+	if (READ_ONCE(history[victim]) != rxhash)
+		WRITE_ONCE(history[victim], rxhash);
+
 	return count > (ROLLOVER_HLEN >> 1);
 }
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 626/639] i2c: stm32f7: report dma error during probe
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (624 preceding siblings ...)
  2020-01-24  9:33 ` [PATCH 4.19 625/639] packet: fix data-race in fanout_flow_is_huge() Greg Kroah-Hartman
@ 2020-01-24  9:33 ` Greg Kroah-Hartman
  2020-01-24  9:33 ` [PATCH 4.19 627/639] mmc: sdio: fix wl1251 vendor id Greg Kroah-Hartman
                   ` (16 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:33 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Alain Volmat, Pierre-Yves MORDRET,
	Wolfram Sang, Sasha Levin

From: Alain Volmat <alain.volmat@st.com>

[ Upstream commit d77eceb2de99f5d7e0c645bad15511fe1af59e09 ]

Distinguish between the case where dma information is not provided
within the DT and the case of an error during the dma init.
Exit the probe with error in case of an error during dma init.

Fixes: bb8822cbbc53 ("i2c: i2c-stm32: Add generic DMA API")
Signed-off-by: Alain Volmat <alain.volmat@st.com>
Reviewed-by: Pierre-Yves MORDRET <pierre-yves.mordret@st.com>
Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/i2c/busses/i2c-stm32.c   | 16 ++++++++--------
 drivers/i2c/busses/i2c-stm32f7.c |  9 +++++++++
 2 files changed, 17 insertions(+), 8 deletions(-)

diff --git a/drivers/i2c/busses/i2c-stm32.c b/drivers/i2c/busses/i2c-stm32.c
index d75fbcbf02ef3..667f8032f8ef6 100644
--- a/drivers/i2c/busses/i2c-stm32.c
+++ b/drivers/i2c/busses/i2c-stm32.c
@@ -21,13 +21,13 @@ struct stm32_i2c_dma *stm32_i2c_dma_request(struct device *dev,
 
 	dma = devm_kzalloc(dev, sizeof(*dma), GFP_KERNEL);
 	if (!dma)
-		return NULL;
+		return ERR_PTR(-ENOMEM);
 
 	/* Request and configure I2C TX dma channel */
-	dma->chan_tx = dma_request_slave_channel(dev, "tx");
-	if (!dma->chan_tx) {
+	dma->chan_tx = dma_request_chan(dev, "tx");
+	if (IS_ERR(dma->chan_tx)) {
 		dev_dbg(dev, "can't request DMA tx channel\n");
-		ret = -EINVAL;
+		ret = PTR_ERR(dma->chan_tx);
 		goto fail_al;
 	}
 
@@ -43,10 +43,10 @@ struct stm32_i2c_dma *stm32_i2c_dma_request(struct device *dev,
 	}
 
 	/* Request and configure I2C RX dma channel */
-	dma->chan_rx = dma_request_slave_channel(dev, "rx");
-	if (!dma->chan_rx) {
+	dma->chan_rx = dma_request_chan(dev, "rx");
+	if (IS_ERR(dma->chan_rx)) {
 		dev_err(dev, "can't request DMA rx channel\n");
-		ret = -EINVAL;
+		ret = PTR_ERR(dma->chan_rx);
 		goto fail_tx;
 	}
 
@@ -76,7 +76,7 @@ fail_al:
 	devm_kfree(dev, dma);
 	dev_info(dev, "can't use DMA\n");
 
-	return NULL;
+	return ERR_PTR(ret);
 }
 
 void stm32_i2c_dma_free(struct stm32_i2c_dma *dma)
diff --git a/drivers/i2c/busses/i2c-stm32f7.c b/drivers/i2c/busses/i2c-stm32f7.c
index e6bbb8ca70905..eb7e533b0dd47 100644
--- a/drivers/i2c/busses/i2c-stm32f7.c
+++ b/drivers/i2c/busses/i2c-stm32f7.c
@@ -1914,6 +1914,15 @@ static int stm32f7_i2c_probe(struct platform_device *pdev)
 	i2c_dev->dma = stm32_i2c_dma_request(i2c_dev->dev, phy_addr,
 					     STM32F7_I2C_TXDR,
 					     STM32F7_I2C_RXDR);
+	if (PTR_ERR(i2c_dev->dma) == -ENODEV)
+		i2c_dev->dma = NULL;
+	else if (IS_ERR(i2c_dev->dma)) {
+		ret = PTR_ERR(i2c_dev->dma);
+		if (ret != -EPROBE_DEFER)
+			dev_err(&pdev->dev,
+				"Failed to request dma error %i\n", ret);
+		goto clk_free;
+	}
 
 	ret = i2c_add_adapter(adap);
 	if (ret)
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 627/639] mmc: sdio: fix wl1251 vendor id
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (625 preceding siblings ...)
  2020-01-24  9:33 ` [PATCH 4.19 626/639] i2c: stm32f7: report dma error during probe Greg Kroah-Hartman
@ 2020-01-24  9:33 ` Greg Kroah-Hartman
  2020-01-24  9:33 ` [PATCH 4.19 628/639] mmc: core: fix wl1251 sdio quirks Greg Kroah-Hartman
                   ` (15 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:33 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, H. Nikolaus Schaller, Ulf Hansson,
	Sasha Levin

From: H. Nikolaus Schaller <hns@goldelico.com>

[ Upstream commit e5db673e7fe2f971ec82039a28dc0811c2100e87 ]

v4.11-rc1 did introduce a patch series that rearranged the
sdio quirks into a header file. Unfortunately this did forget
to handle SDIO_VENDOR_ID_TI differently between wl1251 and
wl1271 with the result that although the wl1251 was found on
the sdio bus, the firmware did not load any more and there was
no interface registration.

This patch defines separate constants to be used by sdio quirks
and drivers.

Fixes: 884f38607897 ("mmc: core: move some sdio IDs out of quirks file")
Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
Cc: <stable@vger.kernel.org> # v4.11+
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/mmc/sdio_ids.h | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/include/linux/mmc/sdio_ids.h b/include/linux/mmc/sdio_ids.h
index 4224902a8e22a..358d6be357eda 100644
--- a/include/linux/mmc/sdio_ids.h
+++ b/include/linux/mmc/sdio_ids.h
@@ -68,6 +68,8 @@
 
 #define SDIO_VENDOR_ID_TI			0x0097
 #define SDIO_DEVICE_ID_TI_WL1271		0x4076
+#define SDIO_VENDOR_ID_TI_WL1251		0x104c
+#define SDIO_DEVICE_ID_TI_WL1251		0x9066
 
 #define SDIO_VENDOR_ID_STE			0x0020
 #define SDIO_DEVICE_ID_STE_CW1200		0x2280
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 628/639] mmc: core: fix wl1251 sdio quirks
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (626 preceding siblings ...)
  2020-01-24  9:33 ` [PATCH 4.19 627/639] mmc: sdio: fix wl1251 vendor id Greg Kroah-Hartman
@ 2020-01-24  9:33 ` Greg Kroah-Hartman
  2020-01-24  9:33 ` [PATCH 4.19 629/639] affs: fix a memory leak in affs_remount Greg Kroah-Hartman
                   ` (14 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:33 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, H. Nikolaus Schaller, Ulf Hansson,
	Sasha Levin

From: H. Nikolaus Schaller <hns@goldelico.com>

[ Upstream commit 16568b4a4f0c34bd35cfadac63303c7af7812764 ]

wl1251 and wl1271 have different vendor id and device id.
So we need to handle both with sdio quirks.

Fixes: 884f38607897 ("mmc: core: move some sdio IDs out of quirks file")
Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
Cc: <stable@vger.kernel.org> # v4.11+
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mmc/core/quirks.h | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/mmc/core/quirks.h b/drivers/mmc/core/quirks.h
index dd2f73af8f2c0..d5bbe8e544de7 100644
--- a/drivers/mmc/core/quirks.h
+++ b/drivers/mmc/core/quirks.h
@@ -119,7 +119,14 @@ static const struct mmc_fixup mmc_ext_csd_fixups[] = {
 	END_FIXUP
 };
 
+
 static const struct mmc_fixup sdio_fixup_methods[] = {
+	SDIO_FIXUP(SDIO_VENDOR_ID_TI_WL1251, SDIO_DEVICE_ID_TI_WL1251,
+		   add_quirk, MMC_QUIRK_NONSTD_FUNC_IF),
+
+	SDIO_FIXUP(SDIO_VENDOR_ID_TI_WL1251, SDIO_DEVICE_ID_TI_WL1251,
+		   add_quirk, MMC_QUIRK_DISABLE_CD),
+
 	SDIO_FIXUP(SDIO_VENDOR_ID_TI, SDIO_DEVICE_ID_TI_WL1271,
 		   add_quirk, MMC_QUIRK_NONSTD_FUNC_IF),
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 629/639] affs: fix a memory leak in affs_remount
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (627 preceding siblings ...)
  2020-01-24  9:33 ` [PATCH 4.19 628/639] mmc: core: fix wl1251 sdio quirks Greg Kroah-Hartman
@ 2020-01-24  9:33 ` Greg Kroah-Hartman
  2020-01-24  9:33 ` [PATCH 4.19 630/639] afs: Remove set but not used variables before, after Greg Kroah-Hartman
                   ` (13 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:33 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Navid Emamdoost, David Sterba, Sasha Levin

From: Navid Emamdoost <navid.emamdoost@gmail.com>

[ Upstream commit 450c3d4166837c496ebce03650c08800991f2150 ]

In affs_remount if data is provided it is duplicated into new_opts.  The
allocated memory for new_opts is only released if parse_options fails.

There's a bit of history behind new_options, originally there was
save/replace options on the VFS layer so the 'data' passed must not
change (thus strdup), this got cleaned up in later patches. But not
completely.

There's no reason to do the strdup in cases where the filesystem does
not need to reuse the 'data' again, because strsep would modify it
directly.

Fixes: c8f33d0bec99 ("affs: kstrdup() memory handling")
Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
[ update changelog ]
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/affs/super.c | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/fs/affs/super.c b/fs/affs/super.c
index d1ad11a8a4a59..b6ce0c36029bd 100644
--- a/fs/affs/super.c
+++ b/fs/affs/super.c
@@ -561,14 +561,9 @@ affs_remount(struct super_block *sb, int *flags, char *data)
 	int			 root_block;
 	unsigned long		 mount_flags;
 	int			 res = 0;
-	char			*new_opts;
 	char			 volume[32];
 	char			*prefix = NULL;
 
-	new_opts = kstrdup(data, GFP_KERNEL);
-	if (data && !new_opts)
-		return -ENOMEM;
-
 	pr_debug("%s(flags=0x%x,opts=\"%s\")\n", __func__, *flags, data);
 
 	sync_filesystem(sb);
@@ -579,7 +574,6 @@ affs_remount(struct super_block *sb, int *flags, char *data)
 			   &blocksize, &prefix, volume,
 			   &mount_flags)) {
 		kfree(prefix);
-		kfree(new_opts);
 		return -EINVAL;
 	}
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 630/639] afs: Remove set but not used variables before, after
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (628 preceding siblings ...)
  2020-01-24  9:33 ` [PATCH 4.19 629/639] affs: fix a memory leak in affs_remount Greg Kroah-Hartman
@ 2020-01-24  9:33 ` Greg Kroah-Hartman
  2020-01-24  9:33 ` [PATCH 4.19 631/639] dmaengine: ti: edma: fix missed failure handling Greg Kroah-Hartman
                   ` (12 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:33 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, zhengbin, David Howells,
	Sasha Levin

From: zhengbin <zhengbin13@huawei.com>

[ Upstream commit 51590df4f3306cb1f43dca54e3ccdd121ab89594 ]

Fixes gcc '-Wunused-but-set-variable' warning:

fs/afs/dir_edit.c: In function afs_set_contig_bits:
fs/afs/dir_edit.c:75:20: warning: variable after set but not used [-Wunused-but-set-variable]
fs/afs/dir_edit.c: In function afs_set_contig_bits:
fs/afs/dir_edit.c:75:12: warning: variable before set but not used [-Wunused-but-set-variable]
fs/afs/dir_edit.c: In function afs_clear_contig_bits:
fs/afs/dir_edit.c:100:20: warning: variable after set but not used [-Wunused-but-set-variable]
fs/afs/dir_edit.c: In function afs_clear_contig_bits:
fs/afs/dir_edit.c:100:12: warning: variable before set but not used [-Wunused-but-set-variable]

They are never used since commit 63a4681ff39c.

Fixes: 63a4681ff39c ("afs: Locally edit directory data for mkdir/create/unlink/...")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: zhengbin <zhengbin13@huawei.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/afs/dir_edit.c | 12 ++----------
 1 file changed, 2 insertions(+), 10 deletions(-)

diff --git a/fs/afs/dir_edit.c b/fs/afs/dir_edit.c
index 8b400f5aead58..0e7162527db8c 100644
--- a/fs/afs/dir_edit.c
+++ b/fs/afs/dir_edit.c
@@ -72,13 +72,11 @@ static int afs_find_contig_bits(union afs_xdr_dir_block *block, unsigned int nr_
 static void afs_set_contig_bits(union afs_xdr_dir_block *block,
 				int bit, unsigned int nr_slots)
 {
-	u64 mask, before, after;
+	u64 mask;
 
 	mask = (1 << nr_slots) - 1;
 	mask <<= bit;
 
-	before = *(u64 *)block->hdr.bitmap;
-
 	block->hdr.bitmap[0] |= (u8)(mask >> 0 * 8);
 	block->hdr.bitmap[1] |= (u8)(mask >> 1 * 8);
 	block->hdr.bitmap[2] |= (u8)(mask >> 2 * 8);
@@ -87,8 +85,6 @@ static void afs_set_contig_bits(union afs_xdr_dir_block *block,
 	block->hdr.bitmap[5] |= (u8)(mask >> 5 * 8);
 	block->hdr.bitmap[6] |= (u8)(mask >> 6 * 8);
 	block->hdr.bitmap[7] |= (u8)(mask >> 7 * 8);
-
-	after = *(u64 *)block->hdr.bitmap;
 }
 
 /*
@@ -97,13 +93,11 @@ static void afs_set_contig_bits(union afs_xdr_dir_block *block,
 static void afs_clear_contig_bits(union afs_xdr_dir_block *block,
 				  int bit, unsigned int nr_slots)
 {
-	u64 mask, before, after;
+	u64 mask;
 
 	mask = (1 << nr_slots) - 1;
 	mask <<= bit;
 
-	before = *(u64 *)block->hdr.bitmap;
-
 	block->hdr.bitmap[0] &= ~(u8)(mask >> 0 * 8);
 	block->hdr.bitmap[1] &= ~(u8)(mask >> 1 * 8);
 	block->hdr.bitmap[2] &= ~(u8)(mask >> 2 * 8);
@@ -112,8 +106,6 @@ static void afs_clear_contig_bits(union afs_xdr_dir_block *block,
 	block->hdr.bitmap[5] &= ~(u8)(mask >> 5 * 8);
 	block->hdr.bitmap[6] &= ~(u8)(mask >> 6 * 8);
 	block->hdr.bitmap[7] &= ~(u8)(mask >> 7 * 8);
-
-	after = *(u64 *)block->hdr.bitmap;
 }
 
 /*
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 631/639] dmaengine: ti: edma: fix missed failure handling
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (629 preceding siblings ...)
  2020-01-24  9:33 ` [PATCH 4.19 630/639] afs: Remove set but not used variables before, after Greg Kroah-Hartman
@ 2020-01-24  9:33 ` Greg Kroah-Hartman
  2020-01-24  9:33 ` [PATCH 4.19 632/639] drm/radeon: fix bad DMA from INTERRUPT_CNTL2 Greg Kroah-Hartman
                   ` (11 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:33 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chuhong Yuan, Vinod Koul, Sasha Levin

From: Chuhong Yuan <hslester96@gmail.com>

[ Upstream commit 340049d453682a9fe8d91fe794dd091730f4bb25 ]

When devm_kcalloc fails, it forgets to call edma_free_slot.
Replace direct return with failure handler to fix it.

Fixes: 1be5336bc7ba ("dmaengine: edma: New device tree binding")
Signed-off-by: Chuhong Yuan <hslester96@gmail.com>
Link: https://lore.kernel.org/r/20191118073802.28424-1-hslester96@gmail.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/dma/ti/edma.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/dma/ti/edma.c b/drivers/dma/ti/edma.c
index 982631d4e1f8a..44158fa859737 100644
--- a/drivers/dma/ti/edma.c
+++ b/drivers/dma/ti/edma.c
@@ -2345,8 +2345,10 @@ static int edma_probe(struct platform_device *pdev)
 
 		ecc->tc_list = devm_kcalloc(dev, ecc->num_tc,
 					    sizeof(*ecc->tc_list), GFP_KERNEL);
-		if (!ecc->tc_list)
-			return -ENOMEM;
+		if (!ecc->tc_list) {
+			ret = -ENOMEM;
+			goto err_reg1;
+		}
 
 		for (i = 0;; i++) {
 			ret = of_parse_phandle_with_fixed_args(node, "ti,tptcs",
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 632/639] drm/radeon: fix bad DMA from INTERRUPT_CNTL2
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (630 preceding siblings ...)
  2020-01-24  9:33 ` [PATCH 4.19 631/639] dmaengine: ti: edma: fix missed failure handling Greg Kroah-Hartman
@ 2020-01-24  9:33 ` Greg Kroah-Hartman
  2020-01-24  9:33 ` [PATCH 4.19 633/639] arm64: dts: juno: Fix UART frequency Greg Kroah-Hartman
                   ` (10 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:33 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sam Bobroff, Alex Deucher, Sasha Levin

From: Sam Bobroff <sbobroff@linux.ibm.com>

[ Upstream commit 62d91dd2851e8ae2ca552f1b090a3575a4edf759 ]

The INTERRUPT_CNTL2 register expects a valid DMA address, but is
currently set with a GPU MC address.  This can cause problems on
systems that detect the resulting DMA read from an invalid address
(found on a Power8 guest).

Instead, use the DMA address of the dummy page because it will always
be safe.

Fixes: d8f60cfc9345 ("drm/radeon/kms: Add support for interrupts on r6xx/r7xx chips (v3)")
Fixes: 25a857fbe973 ("drm/radeon/kms: add support for interrupts on SI")
Fixes: a59781bbe528 ("drm/radeon: add support for interrupts on CIK (v5)")
Signed-off-by: Sam Bobroff <sbobroff@linux.ibm.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/radeon/cik.c  | 4 ++--
 drivers/gpu/drm/radeon/r600.c | 4 ++--
 drivers/gpu/drm/radeon/si.c   | 4 ++--
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c
index ebce4601a3056..827d551962d98 100644
--- a/drivers/gpu/drm/radeon/cik.c
+++ b/drivers/gpu/drm/radeon/cik.c
@@ -6965,8 +6965,8 @@ static int cik_irq_init(struct radeon_device *rdev)
 	}
 
 	/* setup interrupt control */
-	/* XXX this should actually be a bus address, not an MC address. same on older asics */
-	WREG32(INTERRUPT_CNTL2, rdev->ih.gpu_addr >> 8);
+	/* set dummy read address to dummy page address */
+	WREG32(INTERRUPT_CNTL2, rdev->dummy_page.addr >> 8);
 	interrupt_cntl = RREG32(INTERRUPT_CNTL);
 	/* IH_DUMMY_RD_OVERRIDE=0 - dummy read disabled with msi, enabled without msi
 	 * IH_DUMMY_RD_OVERRIDE=1 - dummy read controlled by IH_DUMMY_RD_EN
diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
index e06e2d8feab39..a724bb87cfad7 100644
--- a/drivers/gpu/drm/radeon/r600.c
+++ b/drivers/gpu/drm/radeon/r600.c
@@ -3690,8 +3690,8 @@ int r600_irq_init(struct radeon_device *rdev)
 	}
 
 	/* setup interrupt control */
-	/* set dummy read address to ring address */
-	WREG32(INTERRUPT_CNTL2, rdev->ih.gpu_addr >> 8);
+	/* set dummy read address to dummy page address */
+	WREG32(INTERRUPT_CNTL2, rdev->dummy_page.addr >> 8);
 	interrupt_cntl = RREG32(INTERRUPT_CNTL);
 	/* IH_DUMMY_RD_OVERRIDE=0 - dummy read disabled with msi, enabled without msi
 	 * IH_DUMMY_RD_OVERRIDE=1 - dummy read controlled by IH_DUMMY_RD_EN
diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
index 85c604d292358..639f0698f961c 100644
--- a/drivers/gpu/drm/radeon/si.c
+++ b/drivers/gpu/drm/radeon/si.c
@@ -5993,8 +5993,8 @@ static int si_irq_init(struct radeon_device *rdev)
 	}
 
 	/* setup interrupt control */
-	/* set dummy read address to ring address */
-	WREG32(INTERRUPT_CNTL2, rdev->ih.gpu_addr >> 8);
+	/* set dummy read address to dummy page address */
+	WREG32(INTERRUPT_CNTL2, rdev->dummy_page.addr >> 8);
 	interrupt_cntl = RREG32(INTERRUPT_CNTL);
 	/* IH_DUMMY_RD_OVERRIDE=0 - dummy read disabled with msi, enabled without msi
 	 * IH_DUMMY_RD_OVERRIDE=1 - dummy read controlled by IH_DUMMY_RD_EN
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 633/639] arm64: dts: juno: Fix UART frequency
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (631 preceding siblings ...)
  2020-01-24  9:33 ` [PATCH 4.19 632/639] drm/radeon: fix bad DMA from INTERRUPT_CNTL2 Greg Kroah-Hartman
@ 2020-01-24  9:33 ` Greg Kroah-Hartman
  2020-01-24  9:33 ` [PATCH 4.19 634/639] samples/bpf: Fix broken xdp_rxq_info due to map order assumptions Greg Kroah-Hartman
                   ` (9 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:33 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Andre Przywara, Liviu Dudau,
	Sudeep Holla, Sasha Levin

From: Andre Przywara <andre.przywara@arm.com>

[ Upstream commit 39a1a8941b27c37f79508426e27a2ec29829d66c ]

Older versions of the Juno *SoC* TRM [1] recommended that the UART clock
source should be 7.2738 MHz, whereas the *system* TRM [2] stated a more
correct value of 7.3728 MHz. Somehow the wrong value managed to end up in
our DT.

Doing a prime factorisation, a modulo divide by 115200 and trying
to buy a 7.2738 MHz crystal at your favourite electronics dealer suggest
that the old value was actually a typo. The actual UART clock is driven
by a PLL, configured via a parameter in some board.txt file in the
firmware, which reads 7.37 MHz (sic!).

Fix this to correct the baud rate divisor calculation on the Juno board.

[1] http://infocenter.arm.com/help/topic/com.arm.doc.ddi0515b.b/DDI0515B_b_juno_arm_development_platform_soc_trm.pdf
[2] http://infocenter.arm.com/help/topic/com.arm.doc.100113_0000_07_en/arm_versatile_express_juno_development_platform_(v2m_juno)_technical_reference_manual_100113_0000_07_en.pdf

Fixes: 71f867ec130e ("arm64: Add Juno board device tree.")
Signed-off-by: Andre Przywara <andre.przywara@arm.com>
Acked-by: Liviu Dudau <liviu.dudau@arm.com>
Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/arm/juno-clocks.dtsi | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm64/boot/dts/arm/juno-clocks.dtsi b/arch/arm64/boot/dts/arm/juno-clocks.dtsi
index e5e265dfa9025..2870b5eeb1984 100644
--- a/arch/arm64/boot/dts/arm/juno-clocks.dtsi
+++ b/arch/arm64/boot/dts/arm/juno-clocks.dtsi
@@ -8,10 +8,10 @@
  */
 / {
 	/* SoC fixed clocks */
-	soc_uartclk: refclk7273800hz {
+	soc_uartclk: refclk7372800hz {
 		compatible = "fixed-clock";
 		#clock-cells = <0>;
-		clock-frequency = <7273800>;
+		clock-frequency = <7372800>;
 		clock-output-names = "juno:uartclk";
 	};
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 634/639] samples/bpf: Fix broken xdp_rxq_info due to map order assumptions
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (632 preceding siblings ...)
  2020-01-24  9:33 ` [PATCH 4.19 633/639] arm64: dts: juno: Fix UART frequency Greg Kroah-Hartman
@ 2020-01-24  9:33 ` Greg Kroah-Hartman
  2020-01-24  9:33 ` [PATCH 4.19 635/639] usb: dwc3: Allow building USB_DWC3_QCOM without EXTCON Greg Kroah-Hartman
                   ` (8 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:33 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jesper Dangaard Brouer,
	Alexei Starovoitov, Toke Høiland-Jørgensen,
	Andrii Nakryiko, Sasha Levin

From: Jesper Dangaard Brouer <brouer@redhat.com>

[ Upstream commit edbca120a8cdfa5a5793707e33497aa5185875ca ]

In the days of using bpf_load.c the order in which the 'maps' sections
were defines in BPF side (*_kern.c) file, were used by userspace side
to identify the map via using the map order as an index. In effect the
order-index is created based on the order the maps sections are stored
in the ELF-object file, by the LLVM compiler.

This have also carried over in libbpf via API bpf_map__next(NULL, obj)
to extract maps in the order libbpf parsed the ELF-object file.

When BTF based maps were introduced a new section type ".maps" were
created. I found that the LLVM compiler doesn't create the ".maps"
sections in the order they are defined in the C-file. The order in the
ELF file is based on the order the map pointer is referenced in the code.

This combination of changes lead to xdp_rxq_info mixing up the map
file-descriptors in userspace, resulting in very broken behaviour, but
without warning the user.

This patch fix issue by instead using bpf_object__find_map_by_name()
to find maps via their names. (Note, this is the ELF name, which can
be longer than the name the kernel retains).

Fixes: be5bca44aa6b ("samples: bpf: convert some XDP samples from bpf_load to libbpf")
Fixes: 451d1dc886b5 ("samples: bpf: update map definition to new syntax BTF-defined map")
Signed-off-by: Jesper Dangaard Brouer <brouer@redhat.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Toke Høiland-Jørgensen <toke@redhat.com>
Acked-by: Andrii Nakryiko <andriin@fb.com>
Link: https://lore.kernel.org/bpf/157529025128.29832.5953245340679936909.stgit@firesoul
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 samples/bpf/xdp_rxq_info_user.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/samples/bpf/xdp_rxq_info_user.c b/samples/bpf/xdp_rxq_info_user.c
index ef26f882f92f4..a55c81301c1a9 100644
--- a/samples/bpf/xdp_rxq_info_user.c
+++ b/samples/bpf/xdp_rxq_info_user.c
@@ -472,9 +472,9 @@ int main(int argc, char **argv)
 	if (bpf_prog_load_xattr(&prog_load_attr, &obj, &prog_fd))
 		return EXIT_FAIL;
 
-	map = bpf_map__next(NULL, obj);
-	stats_global_map = bpf_map__next(map, obj);
-	rx_queue_index_map = bpf_map__next(stats_global_map, obj);
+	map =  bpf_object__find_map_by_name(obj, "config_map");
+	stats_global_map = bpf_object__find_map_by_name(obj, "stats_global_map");
+	rx_queue_index_map = bpf_object__find_map_by_name(obj, "rx_queue_index_map");
 	if (!map || !stats_global_map || !rx_queue_index_map) {
 		printf("finding a map in obj file failed\n");
 		return EXIT_FAIL;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 635/639] usb: dwc3: Allow building USB_DWC3_QCOM without EXTCON
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (633 preceding siblings ...)
  2020-01-24  9:33 ` [PATCH 4.19 634/639] samples/bpf: Fix broken xdp_rxq_info due to map order assumptions Greg Kroah-Hartman
@ 2020-01-24  9:33 ` Greg Kroah-Hartman
  2020-01-24  9:33 ` [PATCH 4.19 636/639] IB/iser: Fix dma_nents type definition Greg Kroah-Hartman
                   ` (7 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:33 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Marc Gonzalez, Sasha Levin

From: Marc Gonzalez <marc.w.gonzalez@free.fr>

[ Upstream commit 77a4946516fe488b6a33390de6d749f934a243ba ]

Keep EXTCON support optional, as some platforms do not need it.

Do the same for USB_DWC3_OMAP while we're at it.

Fixes: 3def4031b3e3f ("usb: dwc3: add EXTCON dependency for qcom")
Signed-off-by: Marc Gonzalez <marc.w.gonzalez@free.fr>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/dwc3/Kconfig | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/dwc3/Kconfig b/drivers/usb/dwc3/Kconfig
index 1a0404fda596b..5d22f4bf2a9fa 100644
--- a/drivers/usb/dwc3/Kconfig
+++ b/drivers/usb/dwc3/Kconfig
@@ -52,7 +52,8 @@ comment "Platform Glue Driver Support"
 
 config USB_DWC3_OMAP
 	tristate "Texas Instruments OMAP5 and similar Platforms"
-	depends on EXTCON && (ARCH_OMAP2PLUS || COMPILE_TEST)
+	depends on ARCH_OMAP2PLUS || COMPILE_TEST
+	depends on EXTCON || !EXTCON
 	depends on OF
 	default USB_DWC3
 	help
@@ -113,7 +114,8 @@ config USB_DWC3_ST
 
 config USB_DWC3_QCOM
 	tristate "Qualcomm Platform"
-	depends on EXTCON && (ARCH_QCOM || COMPILE_TEST)
+	depends on ARCH_QCOM || COMPILE_TEST
+	depends on EXTCON || !EXTCON
 	depends on OF
 	default USB_DWC3
 	help
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 636/639] IB/iser: Fix dma_nents type definition
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (634 preceding siblings ...)
  2020-01-24  9:33 ` [PATCH 4.19 635/639] usb: dwc3: Allow building USB_DWC3_QCOM without EXTCON Greg Kroah-Hartman
@ 2020-01-24  9:33 ` Greg Kroah-Hartman
  2020-01-24  9:33 ` [PATCH 4.19 637/639] serial: stm32: fix clearing interrupt error flags Greg Kroah-Hartman
                   ` (6 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:33 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Israel Rukshin,
	Max Gurtovoy, Sagi Grimberg, Jason Gunthorpe, Sasha Levin

From: Max Gurtovoy <maxg@mellanox.com>

[ Upstream commit c1545f1a200f4adc4ef8dd534bf33e2f1aa22c2f ]

The retured value from ib_dma_map_sg saved in dma_nents variable. To avoid
future mismatch between types, define dma_nents as an integer instead of
unsigned.

Fixes: 57b26497fabe ("IB/iser: Pass the correct number of entries for dma mapped SGL")
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Israel Rukshin <israelr@mellanox.com>
Signed-off-by: Max Gurtovoy <maxg@mellanox.com>
Acked-by: Sagi Grimberg <sagi@grimberg.me>
Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/ulp/iser/iscsi_iser.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/infiniband/ulp/iser/iscsi_iser.h b/drivers/infiniband/ulp/iser/iscsi_iser.h
index 120b408295603..a7aeaa0c6fbc9 100644
--- a/drivers/infiniband/ulp/iser/iscsi_iser.h
+++ b/drivers/infiniband/ulp/iser/iscsi_iser.h
@@ -197,7 +197,7 @@ struct iser_data_buf {
 	struct scatterlist *sg;
 	int                size;
 	unsigned long      data_len;
-	unsigned int       dma_nents;
+	int                dma_nents;
 };
 
 /* fwd declarations */
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 637/639] serial: stm32: fix clearing interrupt error flags
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (635 preceding siblings ...)
  2020-01-24  9:33 ` [PATCH 4.19 636/639] IB/iser: Fix dma_nents type definition Greg Kroah-Hartman
@ 2020-01-24  9:33 ` Greg Kroah-Hartman
  2020-01-24  9:33 ` [PATCH 4.19 638/639] arm64: dts: meson-gxm-khadas-vim2: fix uart_A bluetooth node Greg Kroah-Hartman
                   ` (5 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:33 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Fabrice Gasnier, Sasha Levin

From: Fabrice Gasnier <fabrice.gasnier@st.com>

[ Upstream commit 1250ed7114a977cdc2a67a0c09d6cdda63970eb9 ]

The interrupt clear flag register is a "write 1 to clear" register.
So, only writing ones allows to clear flags:
- Replace buggy stm32_clr_bits() by a simple write to clear error flags
- Replace useless read/modify/write stm32_set_bits() routine by a
  simple write to clear TC (transfer complete) flag.

Fixes: 4f01d833fdcd ("serial: stm32: fix rx error handling")
Signed-off-by: Fabrice Gasnier <fabrice.gasnier@st.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/1574323849-1909-1-git-send-email-fabrice.gasnier@st.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/serial/stm32-usart.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c
index d096e552176cc..bce4ac1787add 100644
--- a/drivers/tty/serial/stm32-usart.c
+++ b/drivers/tty/serial/stm32-usart.c
@@ -239,8 +239,8 @@ static void stm32_receive_chars(struct uart_port *port, bool threaded)
 		 * cleared by the sequence [read SR - read DR].
 		 */
 		if ((sr & USART_SR_ERR_MASK) && ofs->icr != UNDEF_REG)
-			stm32_clr_bits(port, ofs->icr, USART_ICR_ORECF |
-				       USART_ICR_PECF | USART_ICR_FECF);
+			writel_relaxed(sr & USART_SR_ERR_MASK,
+				       port->membase + ofs->icr);
 
 		c = stm32_get_char(port, &sr, &stm32_port->last_res);
 		port->icount.rx++;
@@ -409,7 +409,7 @@ static void stm32_transmit_chars(struct uart_port *port)
 	if (ofs->icr == UNDEF_REG)
 		stm32_clr_bits(port, ofs->isr, USART_SR_TC);
 	else
-		stm32_set_bits(port, ofs->icr, USART_ICR_TCCF);
+		writel_relaxed(USART_ICR_TCCF, port->membase + ofs->icr);
 
 	if (stm32_port->tx_ch)
 		stm32_transmit_chars_dma(port);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 638/639] arm64: dts: meson-gxm-khadas-vim2: fix uart_A bluetooth node
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (636 preceding siblings ...)
  2020-01-24  9:33 ` [PATCH 4.19 637/639] serial: stm32: fix clearing interrupt error flags Greg Kroah-Hartman
@ 2020-01-24  9:33 ` Greg Kroah-Hartman
  2020-01-24  9:33 ` [PATCH 4.19 639/639] m68k: Call timer_interrupt() with interrupts disabled Greg Kroah-Hartman
                   ` (4 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:33 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christian Hewitt, Kevin Hilman, Sasha Levin

From: Christian Hewitt <christianshewitt@gmail.com>

[ Upstream commit 388a2772979b625042524d8b91280616ab4ff5ee ]

Fixes: 33344e2111a3 ("arm64: dts: meson-gxm-khadas-vim2: fix Bluetooth support")
Signed-off-by: Christian Hewitt <christianshewitt@gmail.com>
Reviewed-by: Kevin Hilman <khilman@baylibre.com>
Signed-off-by: Kevin Hilman <khilman@baylibre.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts b/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts
index 785240733d946..bdf7c6c5983ce 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts
@@ -413,6 +413,9 @@
 	bluetooth {
 		compatible = "brcm,bcm43438-bt";
 		shutdown-gpios = <&gpio GPIOX_17 GPIO_ACTIVE_HIGH>;
+		max-speed = <2000000>;
+		clocks = <&wifi32k>;
+		clock-names = "lpo";
 	};
 };
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* [PATCH 4.19 639/639] m68k: Call timer_interrupt() with interrupts disabled
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (637 preceding siblings ...)
  2020-01-24  9:33 ` [PATCH 4.19 638/639] arm64: dts: meson-gxm-khadas-vim2: fix uart_A bluetooth node Greg Kroah-Hartman
@ 2020-01-24  9:33 ` Greg Kroah-Hartman
  2020-01-24 14:50   ` Jon Hunter
                   ` (3 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24  9:33 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Thomas Gleixner, Finn Thain,
	Geert Uytterhoeven, Sasha Levin

From: Finn Thain <fthain@telegraphics.com.au>

[ Upstream commit 1efdd4bd254311498123a15fa0acd565f454da97 ]

Some platforms execute their timer handler with the interrupt priority
level set below 6. That means the handler could be interrupted by another
driver and this could lead to re-entry of the timer core.

Avoid this by use of local_irq_save/restore for timer interrupt dispatch.
This provides mutual exclusion around the timer interrupt flag access
which is needed later in this series for the clocksource conversion.

Reported-by: Thomas Gleixner <tglx@linutronix.de>
Link: http://lkml.kernel.org/r/alpine.DEB.2.21.1811131407120.2697@nanos.tec.linutronix.de
Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/m68k/amiga/cia.c       |  9 +++++++++
 arch/m68k/atari/ataints.c   |  4 ++--
 arch/m68k/atari/time.c      | 15 ++++++++++++++-
 arch/m68k/bvme6000/config.c | 20 ++++++++++----------
 arch/m68k/hp300/time.c      | 10 ++++++++--
 arch/m68k/mac/via.c         | 17 +++++++++++++++++
 arch/m68k/mvme147/config.c  | 18 ++++++++++--------
 arch/m68k/mvme16x/config.c  | 21 +++++++++++----------
 arch/m68k/q40/q40ints.c     | 19 +++++++++++--------
 arch/m68k/sun3/sun3ints.c   |  3 +++
 arch/m68k/sun3x/time.c      | 16 ++++++++++------
 11 files changed, 105 insertions(+), 47 deletions(-)

diff --git a/arch/m68k/amiga/cia.c b/arch/m68k/amiga/cia.c
index 2081b8cd5591c..b9aee983e6f4c 100644
--- a/arch/m68k/amiga/cia.c
+++ b/arch/m68k/amiga/cia.c
@@ -88,10 +88,19 @@ static irqreturn_t cia_handler(int irq, void *dev_id)
 	struct ciabase *base = dev_id;
 	int mach_irq;
 	unsigned char ints;
+	unsigned long flags;
 
+	/* Interrupts get disabled while the timer irq flag is cleared and
+	 * the timer interrupt serviced.
+	 */
 	mach_irq = base->cia_irq;
+	local_irq_save(flags);
 	ints = cia_set_irq(base, CIA_ICR_ALL);
 	amiga_custom.intreq = base->int_mask;
+	if (ints & 1)
+		generic_handle_irq(mach_irq);
+	local_irq_restore(flags);
+	mach_irq++, ints >>= 1;
 	for (; ints; mach_irq++, ints >>= 1) {
 		if (ints & 1)
 			generic_handle_irq(mach_irq);
diff --git a/arch/m68k/atari/ataints.c b/arch/m68k/atari/ataints.c
index 3d2b63bedf058..56f02ea2c248d 100644
--- a/arch/m68k/atari/ataints.c
+++ b/arch/m68k/atari/ataints.c
@@ -142,7 +142,7 @@ struct mfptimerbase {
 	.name		= "MFP Timer D"
 };
 
-static irqreturn_t mfptimer_handler(int irq, void *dev_id)
+static irqreturn_t mfp_timer_d_handler(int irq, void *dev_id)
 {
 	struct mfptimerbase *base = dev_id;
 	int mach_irq;
@@ -344,7 +344,7 @@ void __init atari_init_IRQ(void)
 	st_mfp.tim_ct_cd = (st_mfp.tim_ct_cd & 0xf0) | 0x6;
 
 	/* request timer D dispatch handler */
-	if (request_irq(IRQ_MFP_TIMD, mfptimer_handler, IRQF_SHARED,
+	if (request_irq(IRQ_MFP_TIMD, mfp_timer_d_handler, IRQF_SHARED,
 			stmfp_base.name, &stmfp_base))
 		pr_err("Couldn't register %s interrupt\n", stmfp_base.name);
 
diff --git a/arch/m68k/atari/time.c b/arch/m68k/atari/time.c
index 9cca64286464c..fafa20f75ab9a 100644
--- a/arch/m68k/atari/time.c
+++ b/arch/m68k/atari/time.c
@@ -24,6 +24,18 @@
 DEFINE_SPINLOCK(rtc_lock);
 EXPORT_SYMBOL_GPL(rtc_lock);
 
+static irqreturn_t mfp_timer_c_handler(int irq, void *dev_id)
+{
+	irq_handler_t timer_routine = dev_id;
+	unsigned long flags;
+
+	local_irq_save(flags);
+	timer_routine(0, NULL);
+	local_irq_restore(flags);
+
+	return IRQ_HANDLED;
+}
+
 void __init
 atari_sched_init(irq_handler_t timer_routine)
 {
@@ -32,7 +44,8 @@ atari_sched_init(irq_handler_t timer_routine)
     /* start timer C, div = 1:100 */
     st_mfp.tim_ct_cd = (st_mfp.tim_ct_cd & 15) | 0x60;
     /* install interrupt service routine for MFP Timer C */
-    if (request_irq(IRQ_MFP_TIMC, timer_routine, 0, "timer", timer_routine))
+    if (request_irq(IRQ_MFP_TIMC, mfp_timer_c_handler, 0, "timer",
+                    timer_routine))
 	pr_err("Couldn't register timer interrupt\n");
 }
 
diff --git a/arch/m68k/bvme6000/config.c b/arch/m68k/bvme6000/config.c
index 143ee9fa3893e..0e5efed4da865 100644
--- a/arch/m68k/bvme6000/config.c
+++ b/arch/m68k/bvme6000/config.c
@@ -44,11 +44,6 @@ extern int bvme6000_hwclk (int, struct rtc_time *);
 extern void bvme6000_reset (void);
 void bvme6000_set_vectors (void);
 
-/* Save tick handler routine pointer, will point to xtime_update() in
- * kernel/timer/timekeeping.c, called via bvme6000_process_int() */
-
-static irq_handler_t tick_handler;
-
 
 int __init bvme6000_parse_bootinfo(const struct bi_record *bi)
 {
@@ -157,12 +152,18 @@ irqreturn_t bvme6000_abort_int (int irq, void *dev_id)
 
 static irqreturn_t bvme6000_timer_int (int irq, void *dev_id)
 {
+    irq_handler_t timer_routine = dev_id;
+    unsigned long flags;
     volatile RtcPtr_t rtc = (RtcPtr_t)BVME_RTC_BASE;
-    unsigned char msr = rtc->msr & 0xc0;
+    unsigned char msr;
 
+    local_irq_save(flags);
+    msr = rtc->msr & 0xc0;
     rtc->msr = msr | 0x20;		/* Ack the interrupt */
+    timer_routine(0, NULL);
+    local_irq_restore(flags);
 
-    return tick_handler(irq, dev_id);
+    return IRQ_HANDLED;
 }
 
 /*
@@ -181,9 +182,8 @@ void bvme6000_sched_init (irq_handler_t timer_routine)
 
     rtc->msr = 0;	/* Ensure timer registers accessible */
 
-    tick_handler = timer_routine;
-    if (request_irq(BVME_IRQ_RTC, bvme6000_timer_int, 0,
-				"timer", bvme6000_timer_int))
+    if (request_irq(BVME_IRQ_RTC, bvme6000_timer_int, 0, "timer",
+                    timer_routine))
 	panic ("Couldn't register timer int");
 
     rtc->t1cr_omr = 0x04;	/* Mode 2, ext clk */
diff --git a/arch/m68k/hp300/time.c b/arch/m68k/hp300/time.c
index 289d928a46cbe..d30b03ea93a27 100644
--- a/arch/m68k/hp300/time.c
+++ b/arch/m68k/hp300/time.c
@@ -38,13 +38,19 @@
 
 static irqreturn_t hp300_tick(int irq, void *dev_id)
 {
+	irq_handler_t timer_routine = dev_id;
+	unsigned long flags;
 	unsigned long tmp;
-	irq_handler_t vector = dev_id;
+
+	local_irq_save(flags);
 	in_8(CLOCKBASE + CLKSR);
 	asm volatile ("movpw %1@(5),%0" : "=d" (tmp) : "a" (CLOCKBASE));
+	timer_routine(0, NULL);
+	local_irq_restore(flags);
+
 	/* Turn off the network and SCSI leds */
 	blinken_leds(0, 0xe0);
-	return vector(irq, NULL);
+	return IRQ_HANDLED;
 }
 
 u32 hp300_gettimeoffset(void)
diff --git a/arch/m68k/mac/via.c b/arch/m68k/mac/via.c
index 288ec3aa5b575..038d5a1c4d484 100644
--- a/arch/m68k/mac/via.c
+++ b/arch/m68k/mac/via.c
@@ -387,6 +387,8 @@ void via_nubus_irq_shutdown(int irq)
  * via6522.c :-), disable/pending masks added.
  */
 
+#define VIA_TIMER_1_INT BIT(6)
+
 void via1_irq(struct irq_desc *desc)
 {
 	int irq_num;
@@ -396,6 +398,21 @@ void via1_irq(struct irq_desc *desc)
 	if (!events)
 		return;
 
+	irq_num = IRQ_MAC_TIMER_1;
+	irq_bit = VIA_TIMER_1_INT;
+	if (events & irq_bit) {
+		unsigned long flags;
+
+		local_irq_save(flags);
+		via1[vIFR] = irq_bit;
+		generic_handle_irq(irq_num);
+		local_irq_restore(flags);
+
+		events &= ~irq_bit;
+		if (!events)
+			return;
+	}
+
 	irq_num = VIA1_SOURCE_BASE;
 	irq_bit = 1;
 	do {
diff --git a/arch/m68k/mvme147/config.c b/arch/m68k/mvme147/config.c
index adea549d240e9..93c68d2b8e0ea 100644
--- a/arch/m68k/mvme147/config.c
+++ b/arch/m68k/mvme147/config.c
@@ -45,11 +45,6 @@ extern void mvme147_reset (void);
 
 static int bcd2int (unsigned char b);
 
-/* Save tick handler routine pointer, will point to xtime_update() in
- * kernel/time/timekeeping.c, called via mvme147_process_int() */
-
-irq_handler_t tick_handler;
-
 
 int __init mvme147_parse_bootinfo(const struct bi_record *bi)
 {
@@ -104,16 +99,23 @@ void __init config_mvme147(void)
 
 static irqreturn_t mvme147_timer_int (int irq, void *dev_id)
 {
+	irq_handler_t timer_routine = dev_id;
+	unsigned long flags;
+
+	local_irq_save(flags);
 	m147_pcc->t1_int_cntrl = PCC_TIMER_INT_CLR;
 	m147_pcc->t1_int_cntrl = PCC_INT_ENAB|PCC_LEVEL_TIMER1;
-	return tick_handler(irq, dev_id);
+	timer_routine(0, NULL);
+	local_irq_restore(flags);
+
+	return IRQ_HANDLED;
 }
 
 
 void mvme147_sched_init (irq_handler_t timer_routine)
 {
-	tick_handler = timer_routine;
-	if (request_irq(PCC_IRQ_TIMER1, mvme147_timer_int, 0, "timer 1", NULL))
+	if (request_irq(PCC_IRQ_TIMER1, mvme147_timer_int, 0, "timer 1",
+			timer_routine))
 		pr_err("Couldn't register timer interrupt\n");
 
 	/* Init the clock with a value */
diff --git a/arch/m68k/mvme16x/config.c b/arch/m68k/mvme16x/config.c
index 6ee36a5b528d8..5feb3ab484d08 100644
--- a/arch/m68k/mvme16x/config.c
+++ b/arch/m68k/mvme16x/config.c
@@ -50,11 +50,6 @@ extern void mvme16x_reset (void);
 
 int bcd2int (unsigned char b);
 
-/* Save tick handler routine pointer, will point to xtime_update() in
- * kernel/time/timekeeping.c, called via mvme16x_process_int() */
-
-static irq_handler_t tick_handler;
-
 
 unsigned short mvme16x_config;
 EXPORT_SYMBOL(mvme16x_config);
@@ -352,8 +347,15 @@ static irqreturn_t mvme16x_abort_int (int irq, void *dev_id)
 
 static irqreturn_t mvme16x_timer_int (int irq, void *dev_id)
 {
-    *(volatile unsigned char *)0xfff4201b |= 8;
-    return tick_handler(irq, dev_id);
+	irq_handler_t timer_routine = dev_id;
+	unsigned long flags;
+
+	local_irq_save(flags);
+	*(volatile unsigned char *)0xfff4201b |= 8;
+	timer_routine(0, NULL);
+	local_irq_restore(flags);
+
+	return IRQ_HANDLED;
 }
 
 void mvme16x_sched_init (irq_handler_t timer_routine)
@@ -361,14 +363,13 @@ void mvme16x_sched_init (irq_handler_t timer_routine)
     uint16_t brdno = be16_to_cpu(mvme_bdid.brdno);
     int irq;
 
-    tick_handler = timer_routine;
     /* Using PCCchip2 or MC2 chip tick timer 1 */
     *(volatile unsigned long *)0xfff42008 = 0;
     *(volatile unsigned long *)0xfff42004 = 10000;	/* 10ms */
     *(volatile unsigned char *)0xfff42017 |= 3;
     *(volatile unsigned char *)0xfff4201b = 0x16;
-    if (request_irq(MVME16x_IRQ_TIMER, mvme16x_timer_int, 0,
-				"timer", mvme16x_timer_int))
+    if (request_irq(MVME16x_IRQ_TIMER, mvme16x_timer_int, 0, "timer",
+                    timer_routine))
 	panic ("Couldn't register timer int");
 
     if (brdno == 0x0162 || brdno == 0x172)
diff --git a/arch/m68k/q40/q40ints.c b/arch/m68k/q40/q40ints.c
index 3e7603202977e..1c696906c159f 100644
--- a/arch/m68k/q40/q40ints.c
+++ b/arch/m68k/q40/q40ints.c
@@ -127,10 +127,10 @@ void q40_mksound(unsigned int hz, unsigned int ticks)
 	sound_ticks = ticks << 1;
 }
 
-static irq_handler_t q40_timer_routine;
-
-static irqreturn_t q40_timer_int (int irq, void * dev)
+static irqreturn_t q40_timer_int(int irq, void *dev_id)
 {
+	irq_handler_t timer_routine = dev_id;
+
 	ql_ticks = ql_ticks ? 0 : 1;
 	if (sound_ticks) {
 		unsigned char sval=(sound_ticks & 1) ? 128-SVOL : 128+SVOL;
@@ -139,8 +139,13 @@ static irqreturn_t q40_timer_int (int irq, void * dev)
 		*DAC_RIGHT=sval;
 	}
 
-	if (!ql_ticks)
-		q40_timer_routine(irq, dev);
+	if (!ql_ticks) {
+		unsigned long flags;
+
+		local_irq_save(flags);
+		timer_routine(0, NULL);
+		local_irq_restore(flags);
+	}
 	return IRQ_HANDLED;
 }
 
@@ -148,11 +153,9 @@ void q40_sched_init (irq_handler_t timer_routine)
 {
 	int timer_irq;
 
-	q40_timer_routine = timer_routine;
 	timer_irq = Q40_IRQ_FRAME;
 
-	if (request_irq(timer_irq, q40_timer_int, 0,
-				"timer", q40_timer_int))
+	if (request_irq(timer_irq, q40_timer_int, 0, "timer", timer_routine))
 		panic("Couldn't register timer int");
 
 	master_outb(-1, FRAME_CLEAR_REG);
diff --git a/arch/m68k/sun3/sun3ints.c b/arch/m68k/sun3/sun3ints.c
index 6bbca30c91884..a5824abb4a39c 100644
--- a/arch/m68k/sun3/sun3ints.c
+++ b/arch/m68k/sun3/sun3ints.c
@@ -61,8 +61,10 @@ static irqreturn_t sun3_int7(int irq, void *dev_id)
 
 static irqreturn_t sun3_int5(int irq, void *dev_id)
 {
+	unsigned long flags;
 	unsigned int cnt;
 
+	local_irq_save(flags);
 #ifdef CONFIG_SUN3
 	intersil_clear();
 #endif
@@ -76,6 +78,7 @@ static irqreturn_t sun3_int5(int irq, void *dev_id)
 	cnt = kstat_irqs_cpu(irq, 0);
 	if (!(cnt % 20))
 		sun3_leds(led_pattern[cnt % 160 / 20]);
+	local_irq_restore(flags);
 	return IRQ_HANDLED;
 }
 
diff --git a/arch/m68k/sun3x/time.c b/arch/m68k/sun3x/time.c
index 047e2bcee3d7a..3c8a86d085084 100644
--- a/arch/m68k/sun3x/time.c
+++ b/arch/m68k/sun3x/time.c
@@ -80,15 +80,19 @@ u32 sun3x_gettimeoffset(void)
 }
 
 #if 0
-static void sun3x_timer_tick(int irq, void *dev_id, struct pt_regs *regs)
+static irqreturn_t sun3x_timer_tick(int irq, void *dev_id)
 {
-    void (*vector)(int, void *, struct pt_regs *) = dev_id;
+	irq_handler_t timer_routine = dev_id;
+	unsigned long flags;
 
-    /* Clear the pending interrupt - pulse the enable line low */
-    disable_irq(5);
-    enable_irq(5);
+	local_irq_save(flags);
+	/* Clear the pending interrupt - pulse the enable line low */
+	disable_irq(5);
+	enable_irq(5);
+	timer_routine(0, NULL);
+	local_irq_restore(flags);
 
-    vector(irq, NULL, regs);
+	return IRQ_HANDLED;
 }
 #endif
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 685+ messages in thread

* Re: [PATCH 4.19 000/639] 4.19.99-stable review
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
@ 2020-01-24 14:50   ` Jon Hunter
  2020-01-24  9:22 ` [PATCH 4.19 002/639] xfs: Sanity check flags of Q_XQUOTARM call Greg Kroah-Hartman
                     ` (641 subsequent siblings)
  642 siblings, 0 replies; 685+ messages in thread
From: Jon Hunter @ 2020-01-24 14:50 UTC (permalink / raw)
  To: Greg Kroah-Hartman, linux-kernel
  Cc: torvalds, akpm, linux, shuah, patches, ben.hutchings,
	lkft-triage, stable, linux-tegra

Hi Greg,

On 24/01/2020 09:22, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 4.19.99 release.
> There are 639 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.
> 
> Responses should be made by Sun, 26 Jan 2020 09:26:29 +0000.
> Anything received after that time might be too late.
> 
> The whole patch series can be found in one patch at:
> 	https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.99-rc1.gz
> or in the git tree and branch at:
> 	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
> and the diffstat can be found below.
> 
> thanks,
> 
> greg k-h
> 
> -------------
> Pseudo-Shortlog of commits:

...

> Rafael J. Wysocki <rafael.j.wysocki@intel.com>
>     PCI: PM: Skip devices in D0 for suspend-to-idle

The above commit is causing a suspend regression on Tegra124 Jetson-TK1.
Reverting this on top of v4.19.99-rc1 fixes the issue.

Cheers
Jon

-- 
nvpublic

^ permalink raw reply	[flat|nested] 685+ messages in thread

* Re: [PATCH 4.19 000/639] 4.19.99-stable review
@ 2020-01-24 14:50   ` Jon Hunter
  0 siblings, 0 replies; 685+ messages in thread
From: Jon Hunter @ 2020-01-24 14:50 UTC (permalink / raw)
  To: Greg Kroah-Hartman, linux-kernel
  Cc: torvalds, akpm, linux, shuah, patches, ben.hutchings,
	lkft-triage, stable, linux-tegra

Hi Greg,

On 24/01/2020 09:22, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 4.19.99 release.
> There are 639 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.
> 
> Responses should be made by Sun, 26 Jan 2020 09:26:29 +0000.
> Anything received after that time might be too late.
> 
> The whole patch series can be found in one patch at:
> 	https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.99-rc1.gz
> or in the git tree and branch at:
> 	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
> and the diffstat can be found below.
> 
> thanks,
> 
> greg k-h
> 
> -------------
> Pseudo-Shortlog of commits:

...

> Rafael J. Wysocki <rafael.j.wysocki@intel.com>
>     PCI: PM: Skip devices in D0 for suspend-to-idle

The above commit is causing a suspend regression on Tegra124 Jetson-TK1.
Reverting this on top of v4.19.99-rc1 fixes the issue.

Cheers
Jon

-- 
nvpublic

^ permalink raw reply	[flat|nested] 685+ messages in thread

* Re: [PATCH 4.19 000/639] 4.19.99-stable review
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (639 preceding siblings ...)
  2020-01-24 14:50   ` Jon Hunter
@ 2020-01-24 17:27 ` Naresh Kamboju
  2020-01-24 21:48 ` shuah
  2020-01-24 23:55 ` Guenter Roeck
  642 siblings, 0 replies; 685+ messages in thread
From: Naresh Kamboju @ 2020-01-24 17:27 UTC (permalink / raw)
  To: Greg Kroah-Hartman
  Cc: open list, Linus Torvalds, Andrew Morton, Guenter Roeck,
	Shuah Khan, patches, Ben Hutchings, lkft-triage, linux- stable

On Fri, 24 Jan 2020 at 15:08, Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
>
> This is the start of the stable review cycle for the 4.19.99 release.
> There are 639 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sun, 26 Jan 2020 09:26:29 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
>         https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.99-rc1.gz
> or in the git tree and branch at:
>         git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>
> Petr Machata <petrm@mellanox.com>
>    vxlan: changelink: Fix handling of default remotes

Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.

selftest / net / test_vxlan_fdb_changelink.sh fixed.

Summary
------------------------------------------------------------------------

kernel: 4.19.99-rc1
git repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
git branch: linux-4.19.y
git commit: d521598bed2464511b7d1f1dd553132c7b658394
git describe: v4.19.98-640-gd521598bed24
Test details: https://qa-reports.linaro.org/lkft/linux-stable-rc-4.19-oe/build/v4.19.98-640-gd521598bed24

No regressions (compared to build v4.19.98)

Fixes (compared to build v4.19.98)
------------------------------------------------------------------------
  kselftest:
    * net_test_vxlan_fdb_changelink.sh


Ran 24093 total tests in the following environments and test suites.

Environments
--------------
- dragonboard-410c - arm64
- hi6220-hikey - arm64
- i386
- juno-r2 - arm64
- nxp-ls2088
- qemu_arm
- qemu_arm64
- qemu_i386
- qemu_x86_64
- x15 - arm
- x86_64

Test Suites
-----------
* build
* install-android-platform-tools-r2600
* libhugetlbfs
* linux-log-parser
* ltp-containers-tests
* ltp-ipc-tests
* ltp-hugetlb-tests
* ltp-mm-tests
* kselftest
* kvm-unit-tests
* ltp-cap_bounds-tests
* ltp-commands-tests
* ltp-cpuhotplug-tests
* ltp-cve-tests
* ltp-dio-tests
* ltp-fcntl-locktests-tests
* ltp-filecaps-tests
* ltp-fs-tests
* ltp-fs_bind-tests
* ltp-fs_perms_simple-tests
* ltp-fsx-tests
* ltp-io-tests
* ltp-math-tests
* ltp-nptl-tests
* ltp-open-posix-tests
* ltp-pty-tests
* ltp-sched-tests
* ltp-securebits-tests
* ltp-syscalls-tests
* network-basic-tests
* spectre-meltdown-checker-test
* v4l2-compliance
* perf
* kselftest-vsyscall-mode-native
* kselftest-vsyscall-mode-none

-- 
Linaro LKFT
https://lkft.linaro.org

^ permalink raw reply	[flat|nested] 685+ messages in thread

* Re: [PATCH 4.19 402/639] media: Staging: media: Release the correct resource in an error handling path
       [not found]   ` <1578497930.3188.1579867610896.JavaMail.www@wwinf1n19>
@ 2020-01-24 17:33     ` Greg Kroah-Hartman
  0 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24 17:33 UTC (permalink / raw)
  To: Marion et Christophe JAILLET
  Cc: linux-kernel, stable, Mauro Carvalho Chehab, Sasha Levin

On Fri, Jan 24, 2020 at 01:06:50PM +0100, Marion et Christophe JAILLET wrote:
> Hi,
> 
>  
> 
> Apparently is patch is no more needed in 4.19.98+.
> 
> 'res' is not used anymore in the error handling path (or its use depends on another patch which has not been backported). 'res' can safely be overriden.
> 
> There is no need to add extra variable 

Ok, now dropped, thanks.

greg k-h

^ permalink raw reply	[flat|nested] 685+ messages in thread

* Re: [PATCH 4.19 000/639] 4.19.99-stable review
  2020-01-24 14:50   ` Jon Hunter
  (?)
@ 2020-01-24 17:36   ` Greg Kroah-Hartman
  2020-01-24 18:07       ` Jon Hunter
  -1 siblings, 1 reply; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-24 17:36 UTC (permalink / raw)
  To: Jon Hunter
  Cc: linux-kernel, torvalds, akpm, linux, shuah, patches,
	ben.hutchings, lkft-triage, stable, linux-tegra

On Fri, Jan 24, 2020 at 02:50:05PM +0000, Jon Hunter wrote:
> Hi Greg,
> 
> On 24/01/2020 09:22, Greg Kroah-Hartman wrote:
> > This is the start of the stable review cycle for the 4.19.99 release.
> > There are 639 patches in this series, all will be posted as a response
> > to this one.  If anyone has any issues with these being applied, please
> > let me know.
> > 
> > Responses should be made by Sun, 26 Jan 2020 09:26:29 +0000.
> > Anything received after that time might be too late.
> > 
> > The whole patch series can be found in one patch at:
> > 	https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.99-rc1.gz
> > or in the git tree and branch at:
> > 	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
> > and the diffstat can be found below.
> > 
> > thanks,
> > 
> > greg k-h
> > 
> > -------------
> > Pseudo-Shortlog of commits:
> 
> ...
> 
> > Rafael J. Wysocki <rafael.j.wysocki@intel.com>
> >     PCI: PM: Skip devices in D0 for suspend-to-idle
> 
> The above commit is causing a suspend regression on Tegra124 Jetson-TK1.
> Reverting this on top of v4.19.99-rc1 fixes the issue.

This is also in the 4.14 queue, so should I drop it there too?

thanks,

greg k-h

^ permalink raw reply	[flat|nested] 685+ messages in thread

* Re: [PATCH 4.19 000/639] 4.19.99-stable review
  2020-01-24 17:36   ` Greg Kroah-Hartman
@ 2020-01-24 18:07       ` Jon Hunter
  0 siblings, 0 replies; 685+ messages in thread
From: Jon Hunter @ 2020-01-24 18:07 UTC (permalink / raw)
  To: Greg Kroah-Hartman
  Cc: linux-kernel, torvalds, akpm, linux, shuah, patches,
	ben.hutchings, lkft-triage, stable, linux-tegra


On 24/01/2020 17:36, Greg Kroah-Hartman wrote:
> On Fri, Jan 24, 2020 at 02:50:05PM +0000, Jon Hunter wrote:
>> Hi Greg,
>>
>> On 24/01/2020 09:22, Greg Kroah-Hartman wrote:
>>> This is the start of the stable review cycle for the 4.19.99 release.
>>> There are 639 patches in this series, all will be posted as a response
>>> to this one.  If anyone has any issues with these being applied, please
>>> let me know.
>>>
>>> Responses should be made by Sun, 26 Jan 2020 09:26:29 +0000.
>>> Anything received after that time might be too late.
>>>
>>> The whole patch series can be found in one patch at:
>>> 	https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.99-rc1.gz
>>> or in the git tree and branch at:
>>> 	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
>>> and the diffstat can be found below.
>>>
>>> thanks,
>>>
>>> greg k-h
>>>
>>> -------------
>>> Pseudo-Shortlog of commits:
>>
>> ...
>>
>>> Rafael J. Wysocki <rafael.j.wysocki@intel.com>
>>>     PCI: PM: Skip devices in D0 for suspend-to-idle
>>
>> The above commit is causing a suspend regression on Tegra124 Jetson-TK1.
>> Reverting this on top of v4.19.99-rc1 fixes the issue.
> 
> This is also in the 4.14 queue, so should I drop it there too?

I did not see any failures with the same board on that branch, so I
would say no, but odd that it only fails here. It was failing for me
100% so I would have expected to see if there too if it was a problem.

Jon

-- 
nvpublic

^ permalink raw reply	[flat|nested] 685+ messages in thread

* Re: [PATCH 4.19 000/639] 4.19.99-stable review
@ 2020-01-24 18:07       ` Jon Hunter
  0 siblings, 0 replies; 685+ messages in thread
From: Jon Hunter @ 2020-01-24 18:07 UTC (permalink / raw)
  To: Greg Kroah-Hartman
  Cc: linux-kernel, torvalds, akpm, linux, shuah, patches,
	ben.hutchings, lkft-triage, stable, linux-tegra


On 24/01/2020 17:36, Greg Kroah-Hartman wrote:
> On Fri, Jan 24, 2020 at 02:50:05PM +0000, Jon Hunter wrote:
>> Hi Greg,
>>
>> On 24/01/2020 09:22, Greg Kroah-Hartman wrote:
>>> This is the start of the stable review cycle for the 4.19.99 release.
>>> There are 639 patches in this series, all will be posted as a response
>>> to this one.  If anyone has any issues with these being applied, please
>>> let me know.
>>>
>>> Responses should be made by Sun, 26 Jan 2020 09:26:29 +0000.
>>> Anything received after that time might be too late.
>>>
>>> The whole patch series can be found in one patch at:
>>> 	https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.99-rc1.gz
>>> or in the git tree and branch at:
>>> 	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
>>> and the diffstat can be found below.
>>>
>>> thanks,
>>>
>>> greg k-h
>>>
>>> -------------
>>> Pseudo-Shortlog of commits:
>>
>> ...
>>
>>> Rafael J. Wysocki <rafael.j.wysocki@intel.com>
>>>     PCI: PM: Skip devices in D0 for suspend-to-idle
>>
>> The above commit is causing a suspend regression on Tegra124 Jetson-TK1.
>> Reverting this on top of v4.19.99-rc1 fixes the issue.
> 
> This is also in the 4.14 queue, so should I drop it there too?

I did not see any failures with the same board on that branch, so I
would say no, but odd that it only fails here. It was failing for me
100% so I would have expected to see if there too if it was a problem.

Jon

-- 
nvpublic

^ permalink raw reply	[flat|nested] 685+ messages in thread

* Re: [PATCH 4.19 000/639] 4.19.99-stable review
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (640 preceding siblings ...)
  2020-01-24 17:27 ` Naresh Kamboju
@ 2020-01-24 21:48 ` shuah
  2020-01-24 23:55 ` Guenter Roeck
  642 siblings, 0 replies; 685+ messages in thread
From: shuah @ 2020-01-24 21:48 UTC (permalink / raw)
  To: Greg Kroah-Hartman, linux-kernel
  Cc: torvalds, akpm, linux, patches, ben.hutchings, lkft-triage,
	stable, shuah

On 1/24/20 2:22 AM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 4.19.99 release.
> There are 639 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.
> 
> Responses should be made by Sun, 26 Jan 2020 09:26:29 +0000.
> Anything received after that time might be too late.
> 
> The whole patch series can be found in one patch at:
> 	https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.99-rc1.gz
> or in the git tree and branch at:
> 	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
> and the diffstat can be found below.
> 
> thanks,
> 
> greg k-h
> 
Compiled and booted on my test system. No dmesg regressions.

thanks,
-- Shuah

^ permalink raw reply	[flat|nested] 685+ messages in thread

* Re: [PATCH 4.19 014/639] leds: tlc591xx: update the maximum brightness
  2020-01-24  9:23 ` [PATCH 4.19 014/639] leds: tlc591xx: update the maximum brightness Greg Kroah-Hartman
@ 2020-01-24 23:18   ` Pavel Machek
  2020-01-26  9:18     ` Greg Kroah-Hartman
  0 siblings, 1 reply; 685+ messages in thread
From: Pavel Machek @ 2020-01-24 23:18 UTC (permalink / raw)
  To: Greg Kroah-Hartman; +Cc: linux-kernel, stable, Jean-Jacques Hiblot

[-- Attachment #1: Type: text/plain, Size: 949 bytes --]

On Fri 2020-01-24 10:23:04, Greg Kroah-Hartman wrote:
> From: Jean-Jacques Hiblot <jjhiblot@ti.com>
> 
> commit a2cafdfd8cf5ad8adda6c0ce44a59f46431edf02 upstream.
> 
> The TLC chips actually offer 257 levels:
> - 0: led OFF
> - 1-255: Led dimmed is using a PWM. The duty cycle range from 0.4% to 99.6%
> - 256: led fully ON
> 
> Fixes: e370d010a5fe ("leds: tlc591xx: Driver for the TI 8/16 Channel i2c LED driver")
> Signed-off-by: Jean-Jacques Hiblot <jjhiblot@ti.com>
> Signed-off-by: Pavel Machek <pavel@ucw.cz>
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Its a new feature, really and quite unusual one: 257 brightness levels
is not usual. It is theoretically safe, but...

Lets not do that for -stable.

(I'm a LED maintainer).

Best regards,
								Pavel

-- 
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

^ permalink raw reply	[flat|nested] 685+ messages in thread

* Re: [PATCH 4.19 000/639] 4.19.99-stable review
  2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
                   ` (641 preceding siblings ...)
  2020-01-24 21:48 ` shuah
@ 2020-01-24 23:55 ` Guenter Roeck
  2020-01-25  8:24   ` Jon Hunter
  642 siblings, 1 reply; 685+ messages in thread
From: Guenter Roeck @ 2020-01-24 23:55 UTC (permalink / raw)
  To: Greg Kroah-Hartman
  Cc: linux-kernel, torvalds, akpm, shuah, patches, ben.hutchings,
	lkft-triage, stable

On Fri, Jan 24, 2020 at 10:22:50AM +0100, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 4.19.99 release.
> There are 639 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.
> 
> Responses should be made by Sun, 26 Jan 2020 09:26:29 +0000.
> Anything received after that time might be too late.
> 

For v4.19.98-638-g24832ad2c623:

Build results:
	total: 156 pass: 156 fail: 0
Qemu test results:
	total: 383 pass: 383 fail: 0

Guenter

^ permalink raw reply	[flat|nested] 685+ messages in thread

* Re: [PATCH 4.19 000/639] 4.19.99-stable review
  2020-01-24 23:55 ` Guenter Roeck
@ 2020-01-25  8:24   ` Jon Hunter
  2020-01-25  9:25     ` Guenter Roeck
  0 siblings, 1 reply; 685+ messages in thread
From: Jon Hunter @ 2020-01-25  8:24 UTC (permalink / raw)
  To: Guenter Roeck, Greg Kroah-Hartman
  Cc: linux-kernel, torvalds, akpm, shuah, patches, ben.hutchings,
	lkft-triage, stable

Hi Guenter,

On 24/01/2020 23:55, Guenter Roeck wrote:
> On Fri, Jan 24, 2020 at 10:22:50AM +0100, Greg Kroah-Hartman wrote:
>> This is the start of the stable review cycle for the 4.19.99 release.
>> There are 639 patches in this series, all will be posted as a response
>> to this one.  If anyone has any issues with these being applied, please
>> let me know.
>>
>> Responses should be made by Sun, 26 Jan 2020 09:26:29 +0000.
>> Anything received after that time might be too late.
>>
> 
> For v4.19.98-638-g24832ad2c623:

This does not appear to be the correct tag/version for this review.

Cheers
Jon

-- 
nvpublic

^ permalink raw reply	[flat|nested] 685+ messages in thread

* Re: [PATCH 4.19 000/639] 4.19.99-stable review
  2020-01-25  8:24   ` Jon Hunter
@ 2020-01-25  9:25     ` Guenter Roeck
  2020-01-25 11:27       ` Jon Hunter
  0 siblings, 1 reply; 685+ messages in thread
From: Guenter Roeck @ 2020-01-25  9:25 UTC (permalink / raw)
  To: Jon Hunter, Greg Kroah-Hartman
  Cc: linux-kernel, torvalds, akpm, shuah, patches, ben.hutchings,
	lkft-triage, stable

On 1/25/20 12:24 AM, Jon Hunter wrote:
> Hi Guenter,
> 
> On 24/01/2020 23:55, Guenter Roeck wrote:
>> On Fri, Jan 24, 2020 at 10:22:50AM +0100, Greg Kroah-Hartman wrote:
>>> This is the start of the stable review cycle for the 4.19.99 release.
>>> There are 639 patches in this series, all will be posted as a response
>>> to this one.  If anyone has any issues with these being applied, please
>>> let me know.
>>>
>>> Responses should be made by Sun, 26 Jan 2020 09:26:29 +0000.
>>> Anything received after that time might be too late.
>>>
>>
>> For v4.19.98-638-g24832ad2c623:
> 
> This does not appear to be the correct tag/version for this review.
> 

It is the tip of v4.19.y.queue in my test system.

$ git describe local-stable/linux-4.19.y.queue
v4.19.98-638-g24832ad2c623

and the tip of the stable-queue repository as of right now.

$ git describe stable-queue/linux-4.19.y
v4.19.98-638-g24832ad2c623
$ git remote -v | grep stable-queue
stable-queue	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git (fetch)
stable-queue	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git (push)

What is wrong with it ?

Guenter

^ permalink raw reply	[flat|nested] 685+ messages in thread

* Re: [PATCH 4.19 000/639] 4.19.99-stable review
  2020-01-25  9:25     ` Guenter Roeck
@ 2020-01-25 11:27       ` Jon Hunter
  0 siblings, 0 replies; 685+ messages in thread
From: Jon Hunter @ 2020-01-25 11:27 UTC (permalink / raw)
  To: Guenter Roeck, Greg Kroah-Hartman
  Cc: linux-kernel, torvalds, akpm, shuah, patches, ben.hutchings,
	lkft-triage, stable


On 25/01/2020 09:25, Guenter Roeck wrote:
> On 1/25/20 12:24 AM, Jon Hunter wrote:
>> Hi Guenter,
>>
>> On 24/01/2020 23:55, Guenter Roeck wrote:
>>> On Fri, Jan 24, 2020 at 10:22:50AM +0100, Greg Kroah-Hartman wrote:
>>>> This is the start of the stable review cycle for the 4.19.99 release.
>>>> There are 639 patches in this series, all will be posted as a response
>>>> to this one.  If anyone has any issues with these being applied, please
>>>> let me know.
>>>>
>>>> Responses should be made by Sun, 26 Jan 2020 09:26:29 +0000.
>>>> Anything received after that time might be too late.
>>>>
>>>
>>> For v4.19.98-638-g24832ad2c623:
>>
>> This does not appear to be the correct tag/version for this review.
>>
> 
> It is the tip of v4.19.y.queue in my test system.
> 
> $ git describe local-stable/linux-4.19.y.queue
> v4.19.98-638-g24832ad2c623
> 
> and the tip of the stable-queue repository as of right now.
> 
> $ git describe stable-queue/linux-4.19.y
> v4.19.98-638-g24832ad2c623
> $ git remote -v | grep stable-queue
> stable-queue   
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
> (fetch)
> stable-queue   
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
> (push)
> 
> What is wrong with it ?

Ah you are right, there is nothing wrong now I look at the git describe
output. At first glance I thought the tag was not correct.

Sorry for the noise.

Jon

-- 
nvpublic

^ permalink raw reply	[flat|nested] 685+ messages in thread

* Re: [PATCH 4.19 000/639] 4.19.99-stable review
  2020-01-24 18:07       ` Jon Hunter
@ 2020-01-25 11:32           ` Jon Hunter
  -1 siblings, 0 replies; 685+ messages in thread
From: Jon Hunter @ 2020-01-25 11:32 UTC (permalink / raw)
  To: Greg Kroah-Hartman
  Cc: linux-kernel-u79uwXL29TY76Z2rM5mHXA,
	torvalds-de/tnXTf+JLsfHDXvbKv3WD2FQJk+8+b,
	akpm-de/tnXTf+JLsfHDXvbKv3WD2FQJk+8+b,
	linux-0h96xk9xTtrk1uMJSBkQmQ, shuah-DgEjT+Ai2ygdnm+yROfE0A,
	patches-ssFOTAMYnuFg9hUCZPvPmw,
	ben.hutchings-4yDnlxn2s6sWdaTGBSpHTA,
	lkft-triage-cunTk1MwBs8s++Sfvej+rw,
	stable-u79uwXL29TY76Z2rM5mHXA, linux-tegra


On 24/01/2020 18:07, Jon Hunter wrote:
> 
> On 24/01/2020 17:36, Greg Kroah-Hartman wrote:
>> On Fri, Jan 24, 2020 at 02:50:05PM +0000, Jon Hunter wrote:
>>> Hi Greg,
>>>
>>> On 24/01/2020 09:22, Greg Kroah-Hartman wrote:
>>>> This is the start of the stable review cycle for the 4.19.99 release.
>>>> There are 639 patches in this series, all will be posted as a response
>>>> to this one.  If anyone has any issues with these being applied, please
>>>> let me know.
>>>>
>>>> Responses should be made by Sun, 26 Jan 2020 09:26:29 +0000.
>>>> Anything received after that time might be too late.
>>>>
>>>> The whole patch series can be found in one patch at:
>>>> 	https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.99-rc1.gz
>>>> or in the git tree and branch at:
>>>> 	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
>>>> and the diffstat can be found below.
>>>>
>>>> thanks,
>>>>
>>>> greg k-h
>>>>
>>>> -------------
>>>> Pseudo-Shortlog of commits:
>>>
>>> ...
>>>
>>>> Rafael J. Wysocki <rafael.j.wysocki-ral2JQCrhuEAvxtiuMwx3w@public.gmane.org>
>>>>     PCI: PM: Skip devices in D0 for suspend-to-idle
>>>
>>> The above commit is causing a suspend regression on Tegra124 Jetson-TK1.
>>> Reverting this on top of v4.19.99-rc1 fixes the issue.
>>
>> This is also in the 4.14 queue, so should I drop it there too?
> 
> I did not see any failures with the same board on that branch, so I
> would say no, but odd that it only fails here. It was failing for me
> 100% so I would have expected to see if there too if it was a problem.

Hmmm, rc2 still not working for me ...

Test results for stable-v4.19:
    11 builds:	11 pass, 0 fail
    22 boots:	22 pass, 0 fail
    32 tests:	30 pass, 2 fail

Linux version:	4.19.99-rc2-g24832ad2c623
Boards tested:	tegra124-jetson-tk1, tegra186-p2771-0000,
                tegra194-p2972-0000, tegra20-ventana,
                tegra210-p2371-2180, tegra30-cardhu-a04

I still see the following commit in rc2 ...

commit bb52152abe85f971278a7a4f033b29483f64bfdb
Author: Rafael J. Wysocki <rafael.j.wysocki-ral2JQCrhuEAvxtiuMwx3w@public.gmane.org>
Date:   Thu Jun 13 23:59:45 2019 +0200

    PCI: PM: Skip devices in D0 for suspend-to-idle

BTW, I checked the 4.14. queue and I do not see the above change in
there, however, there is similar change ...

Rafael J. Wysocki <rafael.j.wysocki-ral2JQCrhuEAvxtiuMwx3w@public.gmane.org>
    PCI: PM: Avoid possible suspend-to-idle issue

Cheers
Jon

-- 
nvpublic

^ permalink raw reply	[flat|nested] 685+ messages in thread

* Re: [PATCH 4.19 000/639] 4.19.99-stable review
@ 2020-01-25 11:32           ` Jon Hunter
  0 siblings, 0 replies; 685+ messages in thread
From: Jon Hunter @ 2020-01-25 11:32 UTC (permalink / raw)
  To: Greg Kroah-Hartman
  Cc: linux-kernel, torvalds, akpm, linux, shuah, patches,
	ben.hutchings, lkft-triage, stable, linux-tegra


On 24/01/2020 18:07, Jon Hunter wrote:
> 
> On 24/01/2020 17:36, Greg Kroah-Hartman wrote:
>> On Fri, Jan 24, 2020 at 02:50:05PM +0000, Jon Hunter wrote:
>>> Hi Greg,
>>>
>>> On 24/01/2020 09:22, Greg Kroah-Hartman wrote:
>>>> This is the start of the stable review cycle for the 4.19.99 release.
>>>> There are 639 patches in this series, all will be posted as a response
>>>> to this one.  If anyone has any issues with these being applied, please
>>>> let me know.
>>>>
>>>> Responses should be made by Sun, 26 Jan 2020 09:26:29 +0000.
>>>> Anything received after that time might be too late.
>>>>
>>>> The whole patch series can be found in one patch at:
>>>> 	https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.99-rc1.gz
>>>> or in the git tree and branch at:
>>>> 	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
>>>> and the diffstat can be found below.
>>>>
>>>> thanks,
>>>>
>>>> greg k-h
>>>>
>>>> -------------
>>>> Pseudo-Shortlog of commits:
>>>
>>> ...
>>>
>>>> Rafael J. Wysocki <rafael.j.wysocki@intel.com>
>>>>     PCI: PM: Skip devices in D0 for suspend-to-idle
>>>
>>> The above commit is causing a suspend regression on Tegra124 Jetson-TK1.
>>> Reverting this on top of v4.19.99-rc1 fixes the issue.
>>
>> This is also in the 4.14 queue, so should I drop it there too?
> 
> I did not see any failures with the same board on that branch, so I
> would say no, but odd that it only fails here. It was failing for me
> 100% so I would have expected to see if there too if it was a problem.

Hmmm, rc2 still not working for me ...

Test results for stable-v4.19:
    11 builds:	11 pass, 0 fail
    22 boots:	22 pass, 0 fail
    32 tests:	30 pass, 2 fail

Linux version:	4.19.99-rc2-g24832ad2c623
Boards tested:	tegra124-jetson-tk1, tegra186-p2771-0000,
                tegra194-p2972-0000, tegra20-ventana,
                tegra210-p2371-2180, tegra30-cardhu-a04

I still see the following commit in rc2 ...

commit bb52152abe85f971278a7a4f033b29483f64bfdb
Author: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Date:   Thu Jun 13 23:59:45 2019 +0200

    PCI: PM: Skip devices in D0 for suspend-to-idle

BTW, I checked the 4.14. queue and I do not see the above change in
there, however, there is similar change ...

Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    PCI: PM: Avoid possible suspend-to-idle issue

Cheers
Jon

-- 
nvpublic

^ permalink raw reply	[flat|nested] 685+ messages in thread

* Re: [PATCH 4.19 143/639] rtc: cmos: ignore bogus century byte
  2020-01-24  9:25 ` [PATCH 4.19 143/639] rtc: cmos: ignore bogus century byte Greg Kroah-Hartman
@ 2020-01-25 12:04   ` Pavel Machek
  0 siblings, 0 replies; 685+ messages in thread
From: Pavel Machek @ 2020-01-25 12:04 UTC (permalink / raw)
  To: Greg Kroah-Hartman
  Cc: linux-kernel, stable, Alexandre Belloni, Alessandro Zummo,
	Sylvain Chouleur, Patrick McDermott, linux-rtc, Eric Wong,
	Sasha Levin

[-- Attachment #1: Type: text/plain, Size: 669 bytes --]

Hi!

> From: Eric Wong <e@80x24.org>
> 
> [ Upstream commit 2a4daadd4d3e507138f8937926e6a4df49c6bfdc ]
> 
> Older versions of Libreboot and Coreboot had an invalid value
> (`3' in my case) in the century byte affecting the GM45 in
> the Thinkpad X200.  Not everybody's updated their firmwares,
> and Linux <= 4.2 was able to read the RTC without problems,
> so workaround this by ignoring invalid values.

Should it print a warning so that wrong BIOSes are eventually fixed?

Best regards,
								Pavel
								
-- 
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

^ permalink raw reply	[flat|nested] 685+ messages in thread

* Re: [PATCH 4.19 151/639] arm64: dts: allwinner: h6: Move GIC device node fix base address ordering
  2020-01-24  9:25 ` [PATCH 4.19 151/639] arm64: dts: allwinner: h6: Move GIC device node fix base address ordering Greg Kroah-Hartman
@ 2020-01-25 12:50   ` Pavel Machek
  0 siblings, 0 replies; 685+ messages in thread
From: Pavel Machek @ 2020-01-25 12:50 UTC (permalink / raw)
  To: Greg Kroah-Hartman
  Cc: linux-kernel, stable, Chen-Yu Tsai, Maxime Ripard, Sasha Levin

[-- Attachment #1: Type: text/plain, Size: 808 bytes --]

On Fri 2020-01-24 10:25:21, Greg Kroah-Hartman wrote:
> From: Chen-Yu Tsai <wens@csie.org>
> 
> [ Upstream commit 52d9bcb3d0de3fa1e07aff3800f857836d30410d ]
> 
> The GIC device node was placed out of order in the initial device tree
> submission. Move it so the nodes are correctly sorted by base address
> again.

I don't think this and 146/ is suitable -stable material.

It fixes style problem, not a real bug.

> Fixes: e54be32d0273 ("arm64: allwinner: h6: add the basical
>  Allwinner H6 DTSI file")

Maybe everything with Fixes: tag should not automatically go to
-stable? Not all such patches fix serious bugs.

Best regards,
									Pavel
-- 
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

^ permalink raw reply	[flat|nested] 685+ messages in thread

* Re: [PATCH 4.19 177/639] rtc: ds1307: rx8130: Fix alarm handling
  2020-01-24  9:25 ` [PATCH 4.19 177/639] rtc: ds1307: rx8130: Fix alarm handling Greg Kroah-Hartman
@ 2020-01-25 13:30   ` Pavel Machek
  2020-01-26 21:28     ` Uwe Kleine-König
  0 siblings, 1 reply; 685+ messages in thread
From: Pavel Machek @ 2020-01-25 13:30 UTC (permalink / raw)
  To: Greg Kroah-Hartman
  Cc: linux-kernel, stable, Uwe Kleine-König, Alexandre Belloni,
	Sasha Levin

[-- Attachment #1: Type: text/plain, Size: 948 bytes --]

Hi!

> When the EXTENSION.WADA bit is set, register 0x19 contains a bitmap of
> week days, not a day of month. As Linux only handles a single alarm
> without repetition using day of month is more flexible, so clear this
> bit. (Otherwise a value depending on time.tm_wday would have to be
> written to register 0x19.)

So the comment explains why WADA bit needs to be clear.

> @@ -749,8 +749,8 @@ static int rx8130_set_alarm(struct device *dev, struct rtc_wkalrm *t)
>  	if (ret < 0)
>  		return ret;
>  
> -	ctl[0] &= ~RX8130_REG_EXTENSION_WADA;
> +	ctl[0] &= RX8130_REG_EXTENSION_WADA;

But then code is changed to preserve WADA bit while it was clearing it
before.

What is going on here?

Given WADA bit is already clear, is it -stable material?

Best regards,
									Pavel

-- 
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

^ permalink raw reply	[flat|nested] 685+ messages in thread

* Re: [PATCH 4.19 000/639] 4.19.99-stable review
  2020-01-25 11:32           ` Jon Hunter
@ 2020-01-25 15:46               ` Guenter Roeck
  -1 siblings, 0 replies; 685+ messages in thread
From: Guenter Roeck @ 2020-01-25 15:46 UTC (permalink / raw)
  To: Jon Hunter, Greg Kroah-Hartman
  Cc: linux-kernel-u79uwXL29TY76Z2rM5mHXA,
	torvalds-de/tnXTf+JLsfHDXvbKv3WD2FQJk+8+b,
	akpm-de/tnXTf+JLsfHDXvbKv3WD2FQJk+8+b,
	shuah-DgEjT+Ai2ygdnm+yROfE0A, patches-ssFOTAMYnuFg9hUCZPvPmw,
	ben.hutchings-4yDnlxn2s6sWdaTGBSpHTA,
	lkft-triage-cunTk1MwBs8s++Sfvej+rw,
	stable-u79uwXL29TY76Z2rM5mHXA, linux-tegra

On 1/25/20 3:32 AM, Jon Hunter wrote:
> 
> On 24/01/2020 18:07, Jon Hunter wrote:
>>
>> On 24/01/2020 17:36, Greg Kroah-Hartman wrote:
>>> On Fri, Jan 24, 2020 at 02:50:05PM +0000, Jon Hunter wrote:
>>>> Hi Greg,
>>>>
>>>> On 24/01/2020 09:22, Greg Kroah-Hartman wrote:
>>>>> This is the start of the stable review cycle for the 4.19.99 release.
>>>>> There are 639 patches in this series, all will be posted as a response
>>>>> to this one.  If anyone has any issues with these being applied, please
>>>>> let me know.
>>>>>
>>>>> Responses should be made by Sun, 26 Jan 2020 09:26:29 +0000.
>>>>> Anything received after that time might be too late.
>>>>>
>>>>> The whole patch series can be found in one patch at:
>>>>> 	https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.99-rc1.gz
>>>>> or in the git tree and branch at:
>>>>> 	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
>>>>> and the diffstat can be found below.
>>>>>
>>>>> thanks,
>>>>>
>>>>> greg k-h
>>>>>
>>>>> -------------
>>>>> Pseudo-Shortlog of commits:
>>>>
>>>> ...
>>>>
>>>>> Rafael J. Wysocki <rafael.j.wysocki-ral2JQCrhuEAvxtiuMwx3w@public.gmane.org>
>>>>>      PCI: PM: Skip devices in D0 for suspend-to-idle
>>>>
>>>> The above commit is causing a suspend regression on Tegra124 Jetson-TK1.
>>>> Reverting this on top of v4.19.99-rc1 fixes the issue.
>>>
>>> This is also in the 4.14 queue, so should I drop it there too?
>>
>> I did not see any failures with the same board on that branch, so I
>> would say no, but odd that it only fails here. It was failing for me
>> 100% so I would have expected to see if there too if it was a problem.
> 
> Hmmm, rc2 still not working for me ...
> 
> Test results for stable-v4.19:
>      11 builds:	11 pass, 0 fail
>      22 boots:	22 pass, 0 fail
>      32 tests:	30 pass, 2 fail
> 
> Linux version:	4.19.99-rc2-g24832ad2c623
> Boards tested:	tegra124-jetson-tk1, tegra186-p2771-0000,
>                  tegra194-p2972-0000, tegra20-ventana,
>                  tegra210-p2371-2180, tegra30-cardhu-a04
> 
> I still see the following commit in rc2 ...
> 
> commit bb52152abe85f971278a7a4f033b29483f64bfdb
> Author: Rafael J. Wysocki <rafael.j.wysocki-ral2JQCrhuEAvxtiuMwx3w@public.gmane.org>
> Date:   Thu Jun 13 23:59:45 2019 +0200
> 
>      PCI: PM: Skip devices in D0 for suspend-to-idle
> 
> BTW, I checked the 4.14. queue and I do not see the above change in
> there, however, there is similar change ...
> 
> Rafael J. Wysocki <rafael.j.wysocki-ral2JQCrhuEAvxtiuMwx3w@public.gmane.org>
>      PCI: PM: Avoid possible suspend-to-idle issue
> 
bb52152abe85 fixes this one, which in turn fixes 33e4f80ee69b.
The above in 4.14 but not its fixes is spelling a bit of trouble.

Maybe commit 471a739a47aa7 ("PCI: PM: Avoid skipping bus-level
PM on platforms without ACPI") was added to -rc2, since it is
supposed to fix bb52152abe85.

Guenter

^ permalink raw reply	[flat|nested] 685+ messages in thread

* Re: [PATCH 4.19 000/639] 4.19.99-stable review
@ 2020-01-25 15:46               ` Guenter Roeck
  0 siblings, 0 replies; 685+ messages in thread
From: Guenter Roeck @ 2020-01-25 15:46 UTC (permalink / raw)
  To: Jon Hunter, Greg Kroah-Hartman
  Cc: linux-kernel, torvalds, akpm, shuah, patches, ben.hutchings,
	lkft-triage, stable, linux-tegra

On 1/25/20 3:32 AM, Jon Hunter wrote:
> 
> On 24/01/2020 18:07, Jon Hunter wrote:
>>
>> On 24/01/2020 17:36, Greg Kroah-Hartman wrote:
>>> On Fri, Jan 24, 2020 at 02:50:05PM +0000, Jon Hunter wrote:
>>>> Hi Greg,
>>>>
>>>> On 24/01/2020 09:22, Greg Kroah-Hartman wrote:
>>>>> This is the start of the stable review cycle for the 4.19.99 release.
>>>>> There are 639 patches in this series, all will be posted as a response
>>>>> to this one.  If anyone has any issues with these being applied, please
>>>>> let me know.
>>>>>
>>>>> Responses should be made by Sun, 26 Jan 2020 09:26:29 +0000.
>>>>> Anything received after that time might be too late.
>>>>>
>>>>> The whole patch series can be found in one patch at:
>>>>> 	https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.99-rc1.gz
>>>>> or in the git tree and branch at:
>>>>> 	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
>>>>> and the diffstat can be found below.
>>>>>
>>>>> thanks,
>>>>>
>>>>> greg k-h
>>>>>
>>>>> -------------
>>>>> Pseudo-Shortlog of commits:
>>>>
>>>> ...
>>>>
>>>>> Rafael J. Wysocki <rafael.j.wysocki@intel.com>
>>>>>      PCI: PM: Skip devices in D0 for suspend-to-idle
>>>>
>>>> The above commit is causing a suspend regression on Tegra124 Jetson-TK1.
>>>> Reverting this on top of v4.19.99-rc1 fixes the issue.
>>>
>>> This is also in the 4.14 queue, so should I drop it there too?
>>
>> I did not see any failures with the same board on that branch, so I
>> would say no, but odd that it only fails here. It was failing for me
>> 100% so I would have expected to see if there too if it was a problem.
> 
> Hmmm, rc2 still not working for me ...
> 
> Test results for stable-v4.19:
>      11 builds:	11 pass, 0 fail
>      22 boots:	22 pass, 0 fail
>      32 tests:	30 pass, 2 fail
> 
> Linux version:	4.19.99-rc2-g24832ad2c623
> Boards tested:	tegra124-jetson-tk1, tegra186-p2771-0000,
>                  tegra194-p2972-0000, tegra20-ventana,
>                  tegra210-p2371-2180, tegra30-cardhu-a04
> 
> I still see the following commit in rc2 ...
> 
> commit bb52152abe85f971278a7a4f033b29483f64bfdb
> Author: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
> Date:   Thu Jun 13 23:59:45 2019 +0200
> 
>      PCI: PM: Skip devices in D0 for suspend-to-idle
> 
> BTW, I checked the 4.14. queue and I do not see the above change in
> there, however, there is similar change ...
> 
> Rafael J. Wysocki <rafael.j.wysocki@intel.com>
>      PCI: PM: Avoid possible suspend-to-idle issue
> 
bb52152abe85 fixes this one, which in turn fixes 33e4f80ee69b.
The above in 4.14 but not its fixes is spelling a bit of trouble.

Maybe commit 471a739a47aa7 ("PCI: PM: Avoid skipping bus-level
PM on platforms without ACPI") was added to -rc2, since it is
supposed to fix bb52152abe85.

Guenter

^ permalink raw reply	[flat|nested] 685+ messages in thread

* Re: [PATCH 4.19 255/639] scsi: megaraid_sas: reduce module load time
  2020-01-24  9:27 ` [PATCH 4.19 255/639] scsi: megaraid_sas: reduce module load time Greg Kroah-Hartman
@ 2020-01-25 16:52   ` Pavel Machek
  0 siblings, 0 replies; 685+ messages in thread
From: Pavel Machek @ 2020-01-25 16:52 UTC (permalink / raw)
  To: Greg Kroah-Hartman
  Cc: linux-kernel, stable, Steve Sistare, Sumit Saxena,
	Martin K. Petersen, Sasha Levin

[-- Attachment #1: Type: text/plain, Size: 1545 bytes --]

Hi!

> [ Upstream commit 31b6a05f86e690e1818116fd23c3be915cc9d9ed ]
> 
> megaraid_sas takes 1+ seconds to load while waiting for firmware:
> 
> [2.822603] megaraid_sas 0000:03:00.0: Waiting for FW to come to ready state
> [3.871003] megaraid_sas 0000:03:00.0: FW now in Ready state
> 
> This is due to the following loop in megasas_transition_to_ready(), which
> waits a minimum of 1 second, even though the FW becomes ready in tens of
> millisecs:
> 
>         /*
>          * The cur_state should not last for more than max_wait secs
>          */
>         for (i = 0; i < max_wait; i++) {
>                 ...
>                 msleep(1000);
>         ...
>         dev_info(&instance->pdev->dev, "FW now in Ready state\n");
> 
> This is a regression, caused by a change of the msleep granularity from 1
> to 1000 due to concern about waiting too long on systems with coarse
> jiffies.
> 
> To fix, increase iterations and use msleep(20), which results in:
> 
> [2.670627] megaraid_sas 0000:03:00.0: Waiting for FW to come to ready state
> [2.739386] megaraid_sas 0000:03:00.0: FW now in Ready state
> 
> Fixes: fb2f3e96d80f ("scsi: megaraid_sas: Fix msleep granularity")


That commit does not exist, it seems this fixes:

commit 9155cf30a3c4ef97e225d6daddf9bd4b173267e8
    scsi: megaraid_sas: Fix msleep granularity

Best regards,
									Pavel
									
-- 
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

^ permalink raw reply	[flat|nested] 685+ messages in thread

* Re: [PATCH 4.19 309/639] hwmon: (w83627hf) Use request_muxed_region for Super-IO accesses
  2020-01-24  9:27 ` [PATCH 4.19 309/639] hwmon: (w83627hf) Use request_muxed_region for Super-IO accesses Greg Kroah-Hartman
@ 2020-01-25 18:59   ` Pavel Machek
  2020-01-25 19:14     ` Guenter Roeck
  0 siblings, 1 reply; 685+ messages in thread
From: Pavel Machek @ 2020-01-25 18:59 UTC (permalink / raw)
  To: Greg Kroah-Hartman; +Cc: linux-kernel, stable, Guenter Roeck, Sasha Levin

[-- Attachment #1: Type: text/plain, Size: 2097 bytes --]

Hi!
> [ Upstream commit e95fd518d05bfc087da6fcdea4900a57cfb083bd ]
> 
> Super-IO accesses may fail on a system with no or unmapped LPC bus.
> 
> Also, other drivers may attempt to access the LPC bus at the same time,
> resulting in undefined behavior.
> 
> Use request_muxed_region() to ensure that IO access on the requested
> address space is supported, and to ensure that access by multiple drivers
> is synchronized.
> 

> @@ -1644,9 +1654,21 @@ static int w83627thf_read_gpio5(struct platform_device *pdev)
>  	struct w83627hf_sio_data *sio_data = dev_get_platdata(&pdev->dev);
>  	int res = 0xff, sel;
>  
> -	superio_enter(sio_data);
> +	if (superio_enter(sio_data)) {
> +		/*
> +		 * Some other driver reserved the address space for itself.
> +		 * We don't want to fail driver instantiation because of that,
> +		 * so display a warning and keep going.
> +		 */
> +		dev_warn(&pdev->dev,
> +			 "Can not read VID data: Failed to enable SuperIO access\n");
> +		return res;
> +	}
> +
>  	superio_select(sio_data, W83627HF_LD_GPIO5);
>  
> +	res = 0xff;
> +

This is strange. res is not actually assigned in the code above, so we
have res = 0xff twice. Can we remove one of the initializations and do
'return 0xff' directly to make code more clear?


> @@ -1677,7 +1699,17 @@ static int w83687thf_read_vid(struct platform_device *pdev)
>  	struct w83627hf_sio_data *sio_data = dev_get_platdata(&pdev->dev);
>  	int res = 0xff;
>  
> -	superio_enter(sio_data);
> +	if (superio_enter(sio_data)) {
> +		/*
> +		 * Some other driver reserved the address space for itself.
> +		 * We don't want to fail driver instantiation because of that,
> +		 * so display a warning and keep going.
> +		 */
> +		dev_warn(&pdev->dev,
> +			 "Can not read VID data: Failed to enable SuperIO access\n");
> +		return res;
> +	}

Direct "return 0xff" would make more sense here, too.

Best regards,
									Pavel
-- 
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

^ permalink raw reply	[flat|nested] 685+ messages in thread

* Re: [PATCH 4.19 320/639] ARM: dts: ls1021: Fix SGMII PCS link remaining down after PHY disconnect
  2020-01-24  9:28 ` [PATCH 4.19 320/639] ARM: dts: ls1021: Fix SGMII PCS link remaining down after PHY disconnect Greg Kroah-Hartman
@ 2020-01-25 19:13   ` Pavel Machek
  2020-01-25 20:27     ` Vladimir Oltean
  0 siblings, 1 reply; 685+ messages in thread
From: Pavel Machek @ 2020-01-25 19:13 UTC (permalink / raw)
  To: Greg Kroah-Hartman
  Cc: linux-kernel, stable, Vladimir Oltean, Claudiu Manoil, Li Yang,
	Shawn Guo, Sasha Levin

[-- Attachment #1: Type: text/plain, Size: 2020 bytes --]

Hi!

> [ Upstream commit c7861adbe37f576931650ad8ef805e0c47564b9a ]
> 
> Each eTSEC MAC has its own TBI (SGMII) PCS and private MDIO bus.
> But due to a DTS oversight, both SGMII-compatible MACs of the LS1021 SoC
> are pointing towards the same internal PCS. Therefore nobody is
> controlling the internal PCS of eTSEC0.
> 
> Upon initial ndo_open, the SGMII link is ok by virtue of U-boot
> initialization. But upon an ifdown/ifup sequence, the code path from
> ndo_open -> init_phy -> gfar_configure_serdes does not get executed for
> the PCS of eTSEC0 (and is executed twice for MAC eTSEC1). So the SGMII
> link remains down for eTSEC0. On the LS1021A-TWR board, to signal this
> failure condition, the PHY driver keeps printing
> '803x_aneg_done: SGMII link is not ok'.
> 
> Also, it changes compatible of mdio0 to "fsl,etsec2-mdio" to match
> mdio1 device.

It actually changes compatible of both devices.

> +++ b/arch/arm/boot/dts/ls1021a.dtsi
> @@ -584,7 +584,7 @@
>  		};
>  
>  		mdio0: mdio@2d24000 {
> -			compatible = "gianfar";
> +			compatible = "fsl,etsec2-mdio";
>  			device_type = "mdio";
>  			#address-cells = <1>;
>  			#size-cells = <0>;
> @@ -592,6 +592,15 @@
>  			      <0x0 0x2d10030 0x0 0x4>;
>  		};
>  
> +		mdio1: mdio@2d64000 {
> +			compatible = "fsl,etsec2-mdio";


And they trigger different code in the driver:

                .type = "mdio",
                .compatible = "gianfar",
                .data = &(struct fsl_pq_mdio_data) {
		...
                        .get_tbipa = get_gfar_tbipa_from_mdio,
                },

		.compatible = "fsl,etsec2-mdio",
                .data = &(struct fsl_pq_mdio_data) {
		...
                        .get_tbipa = get_etsec_tbipa,
                },

Are you sure that is good idea for both mainline and stable?

Best regards,
									Pavel
-- 
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

^ permalink raw reply	[flat|nested] 685+ messages in thread

* Re: [PATCH 4.19 309/639] hwmon: (w83627hf) Use request_muxed_region for Super-IO accesses
  2020-01-25 18:59   ` Pavel Machek
@ 2020-01-25 19:14     ` Guenter Roeck
  0 siblings, 0 replies; 685+ messages in thread
From: Guenter Roeck @ 2020-01-25 19:14 UTC (permalink / raw)
  To: Pavel Machek, Greg Kroah-Hartman; +Cc: linux-kernel, stable, Sasha Levin

On 1/25/20 10:59 AM, Pavel Machek wrote:
> Hi!
>> [ Upstream commit e95fd518d05bfc087da6fcdea4900a57cfb083bd ]
>>
>> Super-IO accesses may fail on a system with no or unmapped LPC bus.
>>
>> Also, other drivers may attempt to access the LPC bus at the same time,
>> resulting in undefined behavior.
>>
>> Use request_muxed_region() to ensure that IO access on the requested
>> address space is supported, and to ensure that access by multiple drivers
>> is synchronized.
>>
> 
>> @@ -1644,9 +1654,21 @@ static int w83627thf_read_gpio5(struct platform_device *pdev)
>>   	struct w83627hf_sio_data *sio_data = dev_get_platdata(&pdev->dev);
>>   	int res = 0xff, sel;
>>   
>> -	superio_enter(sio_data);
>> +	if (superio_enter(sio_data)) {
>> +		/*
>> +		 * Some other driver reserved the address space for itself.
>> +		 * We don't want to fail driver instantiation because of that,
>> +		 * so display a warning and keep going.
>> +		 */
>> +		dev_warn(&pdev->dev,
>> +			 "Can not read VID data: Failed to enable SuperIO access\n");
>> +		return res;
>> +	}
>> +
>>   	superio_select(sio_data, W83627HF_LD_GPIO5);
>>   
>> +	res = 0xff;
>> +
> 
> This is strange. res is not actually assigned in the code above, so we
> have res = 0xff twice. Can we remove one of the initializations and do
> 'return 0xff' directly to make code more clear?
> 
> 
>> @@ -1677,7 +1699,17 @@ static int w83687thf_read_vid(struct platform_device *pdev)
>>   	struct w83627hf_sio_data *sio_data = dev_get_platdata(&pdev->dev);
>>   	int res = 0xff;
>>   
>> -	superio_enter(sio_data);
>> +	if (superio_enter(sio_data)) {
>> +		/*
>> +		 * Some other driver reserved the address space for itself.
>> +		 * We don't want to fail driver instantiation because of that,
>> +		 * so display a warning and keep going.
>> +		 */
>> +		dev_warn(&pdev->dev,
>> +			 "Can not read VID data: Failed to enable SuperIO access\n");
>> +		return res;
>> +	}
> 
> Direct "return 0xff" would make more sense here, too.
> 

Please feel free to submit a patch to improve the upstream code.

Thanks,
Guenter


^ permalink raw reply	[flat|nested] 685+ messages in thread

* Re: [PATCH 4.19 320/639] ARM: dts: ls1021: Fix SGMII PCS link remaining down after PHY disconnect
  2020-01-25 19:13   ` Pavel Machek
@ 2020-01-25 20:27     ` Vladimir Oltean
  0 siblings, 0 replies; 685+ messages in thread
From: Vladimir Oltean @ 2020-01-25 20:27 UTC (permalink / raw)
  To: Pavel Machek
  Cc: Greg Kroah-Hartman, lkml, stable, Claudiu Manoil, Li Yang,
	Shawn Guo, Sasha Levin

Hi Pavel,

On Sat, 25 Jan 2020 at 21:13, Pavel Machek <pavel@denx.de> wrote:
>
> Hi!
>
> > [ Upstream commit c7861adbe37f576931650ad8ef805e0c47564b9a ]
> >
> > Each eTSEC MAC has its own TBI (SGMII) PCS and private MDIO bus.
> > But due to a DTS oversight, both SGMII-compatible MACs of the LS1021 SoC
> > are pointing towards the same internal PCS. Therefore nobody is
> > controlling the internal PCS of eTSEC0.
> >
> > Upon initial ndo_open, the SGMII link is ok by virtue of U-boot
> > initialization. But upon an ifdown/ifup sequence, the code path from
> > ndo_open -> init_phy -> gfar_configure_serdes does not get executed for
> > the PCS of eTSEC0 (and is executed twice for MAC eTSEC1). So the SGMII
> > link remains down for eTSEC0. On the LS1021A-TWR board, to signal this
> > failure condition, the PHY driver keeps printing
> > '803x_aneg_done: SGMII link is not ok'.
> >
> > Also, it changes compatible of mdio0 to "fsl,etsec2-mdio" to match
> > mdio1 device.
>
> It actually changes compatible of both devices.
>
> > +++ b/arch/arm/boot/dts/ls1021a.dtsi
> > @@ -584,7 +584,7 @@
> >               };
> >
> >               mdio0: mdio@2d24000 {
> > -                     compatible = "gianfar";
> > +                     compatible = "fsl,etsec2-mdio";
> >                       device_type = "mdio";
> >                       #address-cells = <1>;
> >                       #size-cells = <0>;
> > @@ -592,6 +592,15 @@
> >                             <0x0 0x2d10030 0x0 0x4>;
> >               };
> >
> > +             mdio1: mdio@2d64000 {
> > +                     compatible = "fsl,etsec2-mdio";
>
>
> And they trigger different code in the driver:
>
>                 .type = "mdio",
>                 .compatible = "gianfar",
>                 .data = &(struct fsl_pq_mdio_data) {
>                 ...
>                         .get_tbipa = get_gfar_tbipa_from_mdio,
>                 },
>
>                 .compatible = "fsl,etsec2-mdio",
>                 .data = &(struct fsl_pq_mdio_data) {
>                 ...
>                         .get_tbipa = get_etsec_tbipa,
>                 },
>
> Are you sure that is good idea for both mainline and stable?
>

Thanks for spotting this.

What has happened is that [ Leo ] Li Yang suggested me to change the
compatible in v1 of this patch here:
https://patchwork.ozlabs.org/patch/1064015/

Not having any argument to oppose (and not much experience, to be
frank) I complied and sent out a 2-patch v2 series:
https://patchwork.ozlabs.org/patch/1084366/
https://patchwork.ozlabs.org/patch/1084365/

And Shawn squashed them when merging them, "to get it land as fix a bit easier".

Judging the code in more detail, you are indeed correct that the
"gianfar" compatible was the right one for this hardware. The
difference being the "get_tbipa" function which calculates the address
of the TBIPA register automatically, if not explicitly specified.
However, for ls1021a.dtsi, the TBIPA register _is_ explicitly
specified via the second "reg" (<0x0 0x2d10030 0x0 0x4>), so the
"get_tbipa" function is dead code for LS1021A. Therefore, luckily no
harm was done.

I would suggest that this patch continues to be applied as-is to the
stable kernels, just for the sake of not having divergent patches
across branches, and I'll send a new one that turns the compatible
back into "gianfar".

> Best regards,
>                                                                         Pavel
> --
> (english) http://www.livejournal.com/~pavelmachek
> (cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html

Thanks,
-Vladimir

^ permalink raw reply	[flat|nested] 685+ messages in thread

* Re: [PATCH 4.19 000/639] 4.19.99-stable review
  2020-01-25 15:46               ` Guenter Roeck
  (?)
@ 2020-01-26  9:13               ` Greg Kroah-Hartman
  2020-01-27  9:38                   ` Jon Hunter
  -1 siblings, 1 reply; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-26  9:13 UTC (permalink / raw)
  To: Guenter Roeck
  Cc: Jon Hunter, linux-kernel, torvalds, akpm, shuah, patches,
	ben.hutchings, lkft-triage, stable, linux-tegra

On Sat, Jan 25, 2020 at 07:46:47AM -0800, Guenter Roeck wrote:
> On 1/25/20 3:32 AM, Jon Hunter wrote:
> > 
> > On 24/01/2020 18:07, Jon Hunter wrote:
> > > 
> > > On 24/01/2020 17:36, Greg Kroah-Hartman wrote:
> > > > On Fri, Jan 24, 2020 at 02:50:05PM +0000, Jon Hunter wrote:
> > > > > Hi Greg,
> > > > > 
> > > > > On 24/01/2020 09:22, Greg Kroah-Hartman wrote:
> > > > > > This is the start of the stable review cycle for the 4.19.99 release.
> > > > > > There are 639 patches in this series, all will be posted as a response
> > > > > > to this one.  If anyone has any issues with these being applied, please
> > > > > > let me know.
> > > > > > 
> > > > > > Responses should be made by Sun, 26 Jan 2020 09:26:29 +0000.
> > > > > > Anything received after that time might be too late.
> > > > > > 
> > > > > > The whole patch series can be found in one patch at:
> > > > > > 	https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.99-rc1.gz
> > > > > > or in the git tree and branch at:
> > > > > > 	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
> > > > > > and the diffstat can be found below.
> > > > > > 
> > > > > > thanks,
> > > > > > 
> > > > > > greg k-h
> > > > > > 
> > > > > > -------------
> > > > > > Pseudo-Shortlog of commits:
> > > > > 
> > > > > ...
> > > > > 
> > > > > > Rafael J. Wysocki <rafael.j.wysocki@intel.com>
> > > > > >      PCI: PM: Skip devices in D0 for suspend-to-idle
> > > > > 
> > > > > The above commit is causing a suspend regression on Tegra124 Jetson-TK1.
> > > > > Reverting this on top of v4.19.99-rc1 fixes the issue.
> > > > 
> > > > This is also in the 4.14 queue, so should I drop it there too?
> > > 
> > > I did not see any failures with the same board on that branch, so I
> > > would say no, but odd that it only fails here. It was failing for me
> > > 100% so I would have expected to see if there too if it was a problem.
> > 
> > Hmmm, rc2 still not working for me ...
> > 
> > Test results for stable-v4.19:
> >      11 builds:	11 pass, 0 fail
> >      22 boots:	22 pass, 0 fail
> >      32 tests:	30 pass, 2 fail
> > 
> > Linux version:	4.19.99-rc2-g24832ad2c623
> > Boards tested:	tegra124-jetson-tk1, tegra186-p2771-0000,
> >                  tegra194-p2972-0000, tegra20-ventana,
> >                  tegra210-p2371-2180, tegra30-cardhu-a04
> > 
> > I still see the following commit in rc2 ...
> > 
> > commit bb52152abe85f971278a7a4f033b29483f64bfdb
> > Author: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
> > Date:   Thu Jun 13 23:59:45 2019 +0200
> > 
> >      PCI: PM: Skip devices in D0 for suspend-to-idle

Yes, I did not change anything in -rc2 for you, sorry.

> > BTW, I checked the 4.14. queue and I do not see the above change in
> > there, however, there is similar change ...
> > 
> > Rafael J. Wysocki <rafael.j.wysocki@intel.com>
> >      PCI: PM: Avoid possible suspend-to-idle issue
> > 
> bb52152abe85 fixes this one, which in turn fixes 33e4f80ee69b.
> The above in 4.14 but not its fixes is spelling a bit of trouble.
> 
> Maybe commit 471a739a47aa7 ("PCI: PM: Avoid skipping bus-level
> PM on platforms without ACPI") was added to -rc2, since it is
> supposed to fix bb52152abe85.

I have added that fix to 4.14 now, and will go push out a -rc3 for both
4.19.y and 4.14.y to try to sync up on this and figure it out.

Jon, if you could retest 4.14.y, that would be great, to see if it has
the same issue that 4.19.y has.  And if so, that means I should probably
just drop both patches from both trees, right?

thanks,

greg k-h

^ permalink raw reply	[flat|nested] 685+ messages in thread

* Re: [PATCH 4.19 014/639] leds: tlc591xx: update the maximum brightness
  2020-01-24 23:18   ` Pavel Machek
@ 2020-01-26  9:18     ` Greg Kroah-Hartman
  2020-01-27 12:40       ` Pavel Machek
  0 siblings, 1 reply; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-26  9:18 UTC (permalink / raw)
  To: Pavel Machek; +Cc: linux-kernel, stable, Jean-Jacques Hiblot

On Sat, Jan 25, 2020 at 12:18:26AM +0100, Pavel Machek wrote:
> On Fri 2020-01-24 10:23:04, Greg Kroah-Hartman wrote:
> > From: Jean-Jacques Hiblot <jjhiblot@ti.com>
> > 
> > commit a2cafdfd8cf5ad8adda6c0ce44a59f46431edf02 upstream.
> > 
> > The TLC chips actually offer 257 levels:
> > - 0: led OFF
> > - 1-255: Led dimmed is using a PWM. The duty cycle range from 0.4% to 99.6%
> > - 256: led fully ON
> > 
> > Fixes: e370d010a5fe ("leds: tlc591xx: Driver for the TI 8/16 Channel i2c LED driver")
> > Signed-off-by: Jean-Jacques Hiblot <jjhiblot@ti.com>
> > Signed-off-by: Pavel Machek <pavel@ucw.cz>
> > Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> 
> Its a new feature, really and quite unusual one: 257 brightness levels
> is not usual. It is theoretically safe, but...
> 
> Lets not do that for -stable.
> 
> (I'm a LED maintainer).

Ok, now dropped from 4.19 and older, thanks!

greg k-h

^ permalink raw reply	[flat|nested] 685+ messages in thread

* Re: [PATCH 4.19 521/639] rtc: pcf2127: bugfix: read rtc disables watchdog
  2020-01-24  9:31 ` [PATCH 4.19 521/639] rtc: pcf2127: bugfix: read rtc disables watchdog Greg Kroah-Hartman
@ 2020-01-26 10:26   ` Pavel Machek
  2020-01-26 13:19     ` Greg Kroah-Hartman
  0 siblings, 1 reply; 685+ messages in thread
From: Pavel Machek @ 2020-01-26 10:26 UTC (permalink / raw)
  To: Greg Kroah-Hartman
  Cc: linux-kernel, stable, Bruno Thomsen, Alexandre Belloni, Sasha Levin

[-- Attachment #1: Type: text/plain, Size: 2258 bytes --]

On Fri 2020-01-24 10:31:31, Greg Kroah-Hartman wrote:
> From: Bruno Thomsen <bruno.thomsen@gmail.com>
> 
> [ Upstream commit 7f43020e3bdb63d65661ed377682702f8b34d3ea ]
> 
> The previous fix listed bulk read of registers as root cause of
> accendential disabling of watchdog, since the watchdog counter
> register (WD_VAL) was zeroed.
> 
> Fixes: 3769a375ab83 rtc: pcf2127: bulk read only date and time registers.
> 
> Tested with the same PCF2127 chip as Sean reveled root cause
> of WD_VAL register value zeroing was caused by reading CTRL2
> register which is one of the watchdog feature control registers.
> 
> So the solution is to not read the first two control registers
> (CTRL1 and CTRL2) in pcf2127_rtc_read_time as they are not
> needed anyway. Size of local buf variable is kept to allow
> easy usage of register defines to improve readability of code.

Should the array be zeroed before or something? This way, one array
contains both undefined values and valid data...

> Debug trace line was updated after CTRL1 and CTRL2 are no longer
> read from the chip. Also replaced magic numbers in buf access
> with register defines.

That part is not an improvement. Previously the code was formatted so
that you could parse what is being printed.

Best regards,							Pavel

> @@ -91,14 +85,12 @@ static int pcf2127_rtc_read_time(struct device *dev, struct rtc_time *tm)
>  	}
>  
>  	dev_dbg(dev,
> -		"%s: raw data is cr1=%02x, cr2=%02x, cr3=%02x, "
> -		"sec=%02x, min=%02x, hr=%02x, "
> +		"%s: raw data is cr3=%02x, sec=%02x, min=%02x, hr=%02x, "
>  		"mday=%02x, wday=%02x, mon=%02x, year=%02x\n",
> -		__func__,
> -		buf[0], buf[1], buf[2],
> -		buf[3], buf[4], buf[5],
> -		buf[6], buf[7], buf[8], buf[9]);
> -
> +		__func__, buf[PCF2127_REG_CTRL3], buf[PCF2127_REG_SC],
> +		buf[PCF2127_REG_MN], buf[PCF2127_REG_HR],
> +		buf[PCF2127_REG_DM], buf[PCF2127_REG_DW],
> +		buf[PCF2127_REG_MO], buf[PCF2127_REG_YR]);
>  
>  	tm->tm_sec = bcd2bin(buf[PCF2127_REG_SC] & 0x7F);
>  	tm->tm_min = bcd2bin(buf[PCF2127_REG_MN] & 0x7F);
> -- 
> 2.20.1
> 
> 

-- 
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

^ permalink raw reply	[flat|nested] 685+ messages in thread

* Re: [PATCH 4.19 540/639] wcn36xx: use dynamic allocation for large variables
  2020-01-24  9:31 ` [PATCH 4.19 540/639] wcn36xx: use dynamic allocation for large variables Greg Kroah-Hartman
@ 2020-01-26 11:36   ` Pavel Machek
  0 siblings, 0 replies; 685+ messages in thread
From: Pavel Machek @ 2020-01-26 11:36 UTC (permalink / raw)
  To: Greg Kroah-Hartman
  Cc: linux-kernel, stable, Arnd Bergmann, Kalle Valo, Sasha Levin

[-- Attachment #1: Type: text/plain, Size: 2258 bytes --]

Hi!

> From: Arnd Bergmann <arnd@arndb.de>
> 
> [ Upstream commit 355cf31912014e6ff1bb1019ae4858cad12c68cf ]
> 
> clang triggers a warning about oversized stack frames that gcc does not
> notice because of slightly different inlining decisions:
> 
> ath/wcn36xx/smd.c:1409:5: error: stack frame size of 1040 bytes in function 'wcn36xx_smd_config_bss' [-Werror,-Wframe-larger-than=]
> ath/wcn36xx/smd.c:640:5: error: stack frame size of 1032 bytes in function 'wcn36xx_smd_start_hw_scan' [-Werror,-Wframe-larger-than=]
> 
> Basically the wcn36xx_hal_start_scan_offload_req_msg,
> wcn36xx_hal_config_bss_req_msg_v1, and wcn36xx_hal_config_bss_req_msg
> structures are too large to be put on the kernel stack, but small
> enough that gcc does not warn about them.
> 
> Use kzalloc() to allocate them all. There are similar structures in other
> parts of this driver, but they are all smaller, with the next largest
> stack frame at 480 bytes for wcn36xx_smd_send_beacon.

>  	int ret, i;
>  
>  	if (req->ie_len > WCN36XX_MAX_SCAN_IE_LEN)
>  		return -EINVAL;
>  
>  	mutex_lock(&wcn->hal_mutex);
> -	INIT_HAL_MSG(msg_body, WCN36XX_HAL_START_SCAN_OFFLOAD_REQ);
> +	msg_body = kzalloc(sizeof(*msg_body), GFP_KERNEL);
> +	if (!msg_body) {
> +		ret = -ENOMEM;
> +		goto out;
> +	}

The allocation can be done outside the lock.

> @@ -1410,16 +1428,21 @@ int wcn36xx_smd_config_bss(struct wcn36xx *wcn, struct ieee80211_vif *vif,
>  			   struct ieee80211_sta *sta, const u8 *bssid,
>  			   bool update)
>  {
> -	struct wcn36xx_hal_config_bss_req_msg msg;
> +	struct wcn36xx_hal_config_bss_req_msg *msg;
>  	struct wcn36xx_hal_config_bss_params *bss;
>  	struct wcn36xx_hal_config_sta_params *sta_params;
>  	struct wcn36xx_vif *vif_priv = wcn36xx_vif_to_priv(vif);
>  	int ret;
>  
>  	mutex_lock(&wcn->hal_mutex);
> -	INIT_HAL_MSG(msg, WCN36XX_HAL_CONFIG_BSS_REQ);
> +	msg = kzalloc(sizeof(*msg), GFP_KERNEL);
> +	if (!msg) {
> +		ret = -ENOMEM;
> +		goto out;
> +	}
> +	INIT_HAL_MSG((*msg), WCN36XX_HAL_CONFIG_BSS_REQ);

Same here.

Best regards,
									Pavel
-- 
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

^ permalink raw reply	[flat|nested] 685+ messages in thread

* Re: [PATCH 4.19 521/639] rtc: pcf2127: bugfix: read rtc disables watchdog
  2020-01-26 10:26   ` Pavel Machek
@ 2020-01-26 13:19     ` Greg Kroah-Hartman
  0 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-26 13:19 UTC (permalink / raw)
  To: Pavel Machek
  Cc: linux-kernel, stable, Bruno Thomsen, Alexandre Belloni, Sasha Levin

On Sun, Jan 26, 2020 at 11:26:35AM +0100, Pavel Machek wrote:
> On Fri 2020-01-24 10:31:31, Greg Kroah-Hartman wrote:
> > From: Bruno Thomsen <bruno.thomsen@gmail.com>
> > 
> > [ Upstream commit 7f43020e3bdb63d65661ed377682702f8b34d3ea ]
> > 
> > The previous fix listed bulk read of registers as root cause of
> > accendential disabling of watchdog, since the watchdog counter
> > register (WD_VAL) was zeroed.
> > 
> > Fixes: 3769a375ab83 rtc: pcf2127: bulk read only date and time registers.
> > 
> > Tested with the same PCF2127 chip as Sean reveled root cause
> > of WD_VAL register value zeroing was caused by reading CTRL2
> > register which is one of the watchdog feature control registers.
> > 
> > So the solution is to not read the first two control registers
> > (CTRL1 and CTRL2) in pcf2127_rtc_read_time as they are not
> > needed anyway. Size of local buf variable is kept to allow
> > easy usage of register defines to improve readability of code.
> 
> Should the array be zeroed before or something? This way, one array
> contains both undefined values and valid data...
> 
> > Debug trace line was updated after CTRL1 and CTRL2 are no longer
> > read from the chip. Also replaced magic numbers in buf access
> > with register defines.
> 
> That part is not an improvement. Previously the code was formatted so
> that you could parse what is being printed.

Meta-comment: Making review comments on patches that are already in
Linus's tree, is fine, but making them here seems a bit odd.  Please
just go find the original patch and respond there, as there's not much
you can do here _way_ after the fact, as the change is already
committed.

thanks,

greg k-h

^ permalink raw reply	[flat|nested] 685+ messages in thread

* Re: [PATCH 4.19 587/639] net: stmmac: gmac4+: Not all Unicast addresses may be available
  2020-01-24  9:32 ` [PATCH 4.19 587/639] net: stmmac: gmac4+: Not all Unicast addresses may be available Greg Kroah-Hartman
@ 2020-01-26 16:50   ` Pavel Machek
  0 siblings, 0 replies; 685+ messages in thread
From: Pavel Machek @ 2020-01-26 16:50 UTC (permalink / raw)
  To: Greg Kroah-Hartman
  Cc: linux-kernel, stable, Jose Abreu, David S. Miller, Sasha Levin

[-- Attachment #1: Type: text/plain, Size: 751 bytes --]

Hi!

> Some setups may not have all Unicast addresses filters available. Check
> the number of available filters before trying to setup it.
...
> @@ -443,7 +443,7 @@ static void dwmac4_set_filter(struct mac_device_info *hw,
>  	}
>  
>  	/* Handle multiple unicast addresses */
> -	if (netdev_uc_count(dev) > GMAC_MAX_PERFECT_ADDRESSES) {
> +	if (netdev_uc_count(dev) > hw->unicast_filter_entries) {
>  		/* Switch to promiscuous mode if more than 128 addrs
>  		 * are required
>  		 */

Do I understand correctly that 128 in the comment is no longer
accurate?

Best regards,
									Pavel
-- 
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

^ permalink raw reply	[flat|nested] 685+ messages in thread

* Re: [PATCH 4.19 599/639] net: avoid possible false sharing in sk_leave_memory_pressure()
  2020-01-24  9:32 ` [PATCH 4.19 599/639] net: avoid possible false sharing in sk_leave_memory_pressure() Greg Kroah-Hartman
@ 2020-01-26 17:15   ` Pavel Machek
  2020-01-26 19:03     ` Eric Dumazet
  0 siblings, 1 reply; 685+ messages in thread
From: Pavel Machek @ 2020-01-26 17:15 UTC (permalink / raw)
  To: Greg Kroah-Hartman
  Cc: linux-kernel, stable, Eric Dumazet, Jakub Kicinski, Sasha Levin

[-- Attachment #1: Type: text/plain, Size: 1319 bytes --]

On Fri 2020-01-24 10:32:49, Greg Kroah-Hartman wrote:
> From: Eric Dumazet <edumazet@google.com>
> 
> [ Upstream commit 503978aca46124cd714703e180b9c8292ba50ba7 ]
> 
> As mentioned in https://github.com/google/ktsan/wiki/READ_ONCE-and-WRITE_ONCE#it-may-improve-performance
> a C compiler can legally transform :
> 
> if (memory_pressure && *memory_pressure)
>         *memory_pressure = 0;
> 
> to :
> 
> if (memory_pressure)
>         *memory_pressure = 0;

Well, C compiler can do a lot of stuff, and we rely on C compiler
being "sane" -- that is gcc.

Even if compiler did the transformation, that will only result in
slightly slower performance, right?

Is there any evidence this is problem in practice? Should this be in
stable?

Best regards,
								Pavel


> +++ b/net/core/sock.c
> @@ -2179,8 +2179,8 @@ static void sk_leave_memory_pressure(struct sock *sk)
>  	} else {
>  		unsigned long *memory_pressure = sk->sk_prot->memory_pressure;
>  
> -		if (memory_pressure && *memory_pressure)
> -			*memory_pressure = 0;
> +		if (memory_pressure && READ_ONCE(*memory_pressure))
> +			WRITE_ONCE(*memory_pressure, 0);
>  	}
>  }



-- 
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

^ permalink raw reply	[flat|nested] 685+ messages in thread

* Re: [PATCH 4.19 625/639] packet: fix data-race in fanout_flow_is_huge()
  2020-01-24  9:33 ` [PATCH 4.19 625/639] packet: fix data-race in fanout_flow_is_huge() Greg Kroah-Hartman
@ 2020-01-26 18:29   ` Pavel Machek
  2020-01-26 18:38     ` Eric Dumazet
  0 siblings, 1 reply; 685+ messages in thread
From: Pavel Machek @ 2020-01-26 18:29 UTC (permalink / raw)
  To: Greg Kroah-Hartman
  Cc: linux-kernel, stable, Eric Dumazet, Willem de Bruijn,
	David S. Miller, Sasha Levin

[-- Attachment #1: Type: text/plain, Size: 1626 bytes --]

Hi!

> From: Eric Dumazet <edumazet@google.com>
> 
> [ Upstream commit b756ad928d98e5ef0b74af7546a6a31a8dadde00 ]
> 
> KCSAN reported the following data-race [1]
> 
> Adding a couple of READ_ONCE()/WRITE_ONCE() should silence it.
> 
> Since the report hinted about multiple cpus using the history
> concurrently, I added a test avoiding writing on it if the
> victim slot already contains the desired value.

>  static bool fanout_flow_is_huge(struct packet_sock *po, struct sk_buff *skb)
>  {
> -	u32 rxhash;
> +	u32 *history = po->rollover->history;
> +	u32 victim, rxhash;
>  	int i, count = 0;
>  
>  	rxhash = skb_get_hash(skb);
>  	for (i = 0; i < ROLLOVER_HLEN; i++)
> -		if (po->rollover->history[i] == rxhash)
> +		if (READ_ONCE(history[i]) == rxhash)
>  			count++;
>  
> -	po->rollover->history[prandom_u32() % ROLLOVER_HLEN] = rxhash;
> +	victim = prandom_u32() % ROLLOVER_HLEN;
> +
> +	/* Avoid dirtying the cache line if possible */
> +	if (READ_ONCE(history[victim]) != rxhash)
> +		WRITE_ONCE(history[victim], rxhash);
> +

Replacing simple asignment with if() is ... not nice and with all the
"volatile" magic in _ONCE macros may not be win for
everyone. [Actually, I don't think this is win here. This is not
exactly hot path, is it? Is it likely that array aready contains
required value?]

If this is going to get more common, should we get
WRITE_ONCE_NONDIRTY() macro hiding the uglyness?

Best regards,
								Pavel

-- 
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 181 bytes --]

^ permalink raw reply	[flat|nested] 685+ messages in thread

* Re: [PATCH 4.19 625/639] packet: fix data-race in fanout_flow_is_huge()
  2020-01-26 18:29   ` Pavel Machek
@ 2020-01-26 18:38     ` Eric Dumazet
  0 siblings, 0 replies; 685+ messages in thread
From: Eric Dumazet @ 2020-01-26 18:38 UTC (permalink / raw)
  To: Pavel Machek
  Cc: Greg Kroah-Hartman, LKML, stable, Willem de Bruijn,
	David S. Miller, Sasha Levin

On Sun, Jan 26, 2020 at 10:29 AM Pavel Machek <pavel@denx.de> wrote:
>
>
> > -     po->rollover->history[prandom_u32() % ROLLOVER_HLEN] = rxhash;
> > +     victim = prandom_u32() % ROLLOVER_HLEN;
> > +
> > +     /* Avoid dirtying the cache line if possible */
> > +     if (READ_ONCE(history[victim]) != rxhash)
> > +             WRITE_ONCE(history[victim], rxhash);
> > +
>
> Replacing simple asignment with if() is ... not nice and with all the
> "volatile" magic in _ONCE macros may not be win for
> everyone. [Actually, I don't think this is win here. This is not
> exactly hot path, is it?


This is a critical hot path, eg under DDOS attack.

>
> If this is going to get more common, should we get
> WRITE_ONCE_NONDIRTY() macro hiding the uglyness?
>

Sure, but we do not add macros for stable patches, usually.

Honestly, WRITE_ONCE_NONDIRTY() looks ugly to me.

Note that the KCSAN race might be solved in another way when
data_race() is available.

^ permalink raw reply	[flat|nested] 685+ messages in thread

* Re: [PATCH 4.19 325/639] afs: Fix AFS file locking to allow fine grained locks
  2020-01-24  9:28 ` [PATCH 4.19 325/639] afs: Fix AFS file locking to allow fine grained locks Greg Kroah-Hartman
@ 2020-01-26 18:57   ` Pavel Machek
  2020-01-26 19:05     ` Greg Kroah-Hartman
  0 siblings, 1 reply; 685+ messages in thread
From: Pavel Machek @ 2020-01-26 18:57 UTC (permalink / raw)
  To: Greg Kroah-Hartman
  Cc: linux-kernel, stable, Jonathan Billings, David Howells, Sasha Levin

[-- Attachment #1: Type: text/plain, Size: 998 bytes --]

On Fri 2020-01-24 10:28:15, Greg Kroah-Hartman wrote:
> From: David Howells <dhowells@redhat.com>
> 
> [ Upstream commit 68ce801ffd82e72d5005ab5458e8b9e59f24d9cc ]
> 
> Fix AFS file locking to allow fine grained locks as some applications, such
> as firefox, won't work if they can't take such locks on certain state files
> - thereby preventing the use of kAFS to distribute a home directory.
> 
> Note that this cannot be made completely functional as the protocol only
> has provision for whole-file locks, so there exists the possibility

Is this suitable for -stable?

"AFS does not support fine-grained locks" is fine and easy to
understand. "AFS pretends it supports locks and hopes for the best for
benefit of firefox"... may be good idea for mainline, but I don't
think it matches -stable criteria.

Best regards,
									Pavel
-- 
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 181 bytes --]

^ permalink raw reply	[flat|nested] 685+ messages in thread

* Re: [PATCH 4.19 599/639] net: avoid possible false sharing in sk_leave_memory_pressure()
  2020-01-26 17:15   ` Pavel Machek
@ 2020-01-26 19:03     ` Eric Dumazet
  0 siblings, 0 replies; 685+ messages in thread
From: Eric Dumazet @ 2020-01-26 19:03 UTC (permalink / raw)
  To: Pavel Machek
  Cc: Greg Kroah-Hartman, LKML, stable, Jakub Kicinski, Sasha Levin

On Sun, Jan 26, 2020 at 9:15 AM Pavel Machek <pavel@denx.de> wrote:
>
> On Fri 2020-01-24 10:32:49, Greg Kroah-Hartman wrote:
> > From: Eric Dumazet <edumazet@google.com>
> >
> > [ Upstream commit 503978aca46124cd714703e180b9c8292ba50ba7 ]
> >
> > As mentioned in https://github.com/google/ktsan/wiki/READ_ONCE-and-WRITE_ONCE#it-may-improve-performance
> > a C compiler can legally transform :
> >
> > if (memory_pressure && *memory_pressure)
> >         *memory_pressure = 0;
> >
> > to :
> >
> > if (memory_pressure)
> >         *memory_pressure = 0;
>
> Well, C compiler can do a lot of stuff, and we rely on C compiler
> being "sane" -- that is gcc.
>
> Even if compiler did the transformation, that will only result in
> slightly slower performance, right?
>
> Is there any evidence this is problem in practice? Should this be in
> stable?

There is evidence of this problem in practice yes.

Should it be in stable I do not know.
Should stable kernels only be compiled by old compilers, I do not know.

^ permalink raw reply	[flat|nested] 685+ messages in thread

* Re: [PATCH 4.19 325/639] afs: Fix AFS file locking to allow fine grained locks
  2020-01-26 18:57   ` Pavel Machek
@ 2020-01-26 19:05     ` Greg Kroah-Hartman
  0 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-26 19:05 UTC (permalink / raw)
  To: Pavel Machek
  Cc: linux-kernel, stable, Jonathan Billings, David Howells, Sasha Levin

On Sun, Jan 26, 2020 at 07:57:03PM +0100, Pavel Machek wrote:
> On Fri 2020-01-24 10:28:15, Greg Kroah-Hartman wrote:
> > From: David Howells <dhowells@redhat.com>
> > 
> > [ Upstream commit 68ce801ffd82e72d5005ab5458e8b9e59f24d9cc ]
> > 
> > Fix AFS file locking to allow fine grained locks as some applications, such
> > as firefox, won't work if they can't take such locks on certain state files
> > - thereby preventing the use of kAFS to distribute a home directory.
> > 
> > Note that this cannot be made completely functional as the protocol only
> > has provision for whole-file locks, so there exists the possibility
> 
> Is this suitable for -stable?

Yes, it fixes a bug.

^ permalink raw reply	[flat|nested] 685+ messages in thread

* Re: [PATCH 4.19 177/639] rtc: ds1307: rx8130: Fix alarm handling
  2020-01-25 13:30   ` Pavel Machek
@ 2020-01-26 21:28     ` Uwe Kleine-König
  0 siblings, 0 replies; 685+ messages in thread
From: Uwe Kleine-König @ 2020-01-26 21:28 UTC (permalink / raw)
  To: Pavel Machek
  Cc: Greg Kroah-Hartman, linux-kernel, stable, Alexandre Belloni, Sasha Levin

On Sat, Jan 25, 2020 at 02:30:36PM +0100, Pavel Machek wrote:
> Hi!
> 
> > When the EXTENSION.WADA bit is set, register 0x19 contains a bitmap of
> > week days, not a day of month. As Linux only handles a single alarm
> > without repetition using day of month is more flexible, so clear this
> > bit. (Otherwise a value depending on time.tm_wday would have to be
> > written to register 0x19.)
> 
> So the comment explains why WADA bit needs to be clear.
> 
> > @@ -749,8 +749,8 @@ static int rx8130_set_alarm(struct device *dev, struct rtc_wkalrm *t)
> >  	if (ret < 0)
> >  		return ret;
> >  
> > -	ctl[0] &= ~RX8130_REG_EXTENSION_WADA;
> > +	ctl[0] &= RX8130_REG_EXTENSION_WADA;
> 
> But then code is changed to preserve WADA bit while it was clearing it
> before.

This looks broken indeed. The new code clears all flags but WADA. Will
take a look tomorrow.
 
Best regards
Uwe



-- 
Pengutronix e.K.                           | Uwe Kleine-König            |
Industrial Linux Solutions                 | https://www.pengutronix.de/ |

^ permalink raw reply	[flat|nested] 685+ messages in thread

* Re: [PATCH 4.19 000/639] 4.19.99-stable review
  2020-01-26  9:13               ` Greg Kroah-Hartman
@ 2020-01-27  9:38                   ` Jon Hunter
  0 siblings, 0 replies; 685+ messages in thread
From: Jon Hunter @ 2020-01-27  9:38 UTC (permalink / raw)
  To: Greg Kroah-Hartman, Guenter Roeck
  Cc: linux-kernel, torvalds, akpm, shuah, patches, ben.hutchings,
	lkft-triage, stable, linux-tegra


On 26/01/2020 09:13, Greg Kroah-Hartman wrote:
> On Sat, Jan 25, 2020 at 07:46:47AM -0800, Guenter Roeck wrote:
>> On 1/25/20 3:32 AM, Jon Hunter wrote:
>>>
>>> On 24/01/2020 18:07, Jon Hunter wrote:
>>>>
>>>> On 24/01/2020 17:36, Greg Kroah-Hartman wrote:
>>>>> On Fri, Jan 24, 2020 at 02:50:05PM +0000, Jon Hunter wrote:
>>>>>> Hi Greg,
>>>>>>
>>>>>> On 24/01/2020 09:22, Greg Kroah-Hartman wrote:
>>>>>>> This is the start of the stable review cycle for the 4.19.99 release.
>>>>>>> There are 639 patches in this series, all will be posted as a response
>>>>>>> to this one.  If anyone has any issues with these being applied, please
>>>>>>> let me know.
>>>>>>>
>>>>>>> Responses should be made by Sun, 26 Jan 2020 09:26:29 +0000.
>>>>>>> Anything received after that time might be too late.
>>>>>>>
>>>>>>> The whole patch series can be found in one patch at:
>>>>>>> 	https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.99-rc1.gz
>>>>>>> or in the git tree and branch at:
>>>>>>> 	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
>>>>>>> and the diffstat can be found below.
>>>>>>>
>>>>>>> thanks,
>>>>>>>
>>>>>>> greg k-h
>>>>>>>
>>>>>>> -------------
>>>>>>> Pseudo-Shortlog of commits:
>>>>>>
>>>>>> ...
>>>>>>
>>>>>>> Rafael J. Wysocki <rafael.j.wysocki@intel.com>
>>>>>>>      PCI: PM: Skip devices in D0 for suspend-to-idle
>>>>>>
>>>>>> The above commit is causing a suspend regression on Tegra124 Jetson-TK1.
>>>>>> Reverting this on top of v4.19.99-rc1 fixes the issue.
>>>>>
>>>>> This is also in the 4.14 queue, so should I drop it there too?
>>>>
>>>> I did not see any failures with the same board on that branch, so I
>>>> would say no, but odd that it only fails here. It was failing for me
>>>> 100% so I would have expected to see if there too if it was a problem.
>>>
>>> Hmmm, rc2 still not working for me ...
>>>
>>> Test results for stable-v4.19:
>>>      11 builds:	11 pass, 0 fail
>>>      22 boots:	22 pass, 0 fail
>>>      32 tests:	30 pass, 2 fail
>>>
>>> Linux version:	4.19.99-rc2-g24832ad2c623
>>> Boards tested:	tegra124-jetson-tk1, tegra186-p2771-0000,
>>>                  tegra194-p2972-0000, tegra20-ventana,
>>>                  tegra210-p2371-2180, tegra30-cardhu-a04
>>>
>>> I still see the following commit in rc2 ...
>>>
>>> commit bb52152abe85f971278a7a4f033b29483f64bfdb
>>> Author: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
>>> Date:   Thu Jun 13 23:59:45 2019 +0200
>>>
>>>      PCI: PM: Skip devices in D0 for suspend-to-idle
> 
> Yes, I did not change anything in -rc2 for you, sorry.
> 
>>> BTW, I checked the 4.14. queue and I do not see the above change in
>>> there, however, there is similar change ...
>>>
>>> Rafael J. Wysocki <rafael.j.wysocki@intel.com>
>>>      PCI: PM: Avoid possible suspend-to-idle issue
>>>
>> bb52152abe85 fixes this one, which in turn fixes 33e4f80ee69b.
>> The above in 4.14 but not its fixes is spelling a bit of trouble.
>>
>> Maybe commit 471a739a47aa7 ("PCI: PM: Avoid skipping bus-level
>> PM on platforms without ACPI") was added to -rc2, since it is
>> supposed to fix bb52152abe85.
> 
> I have added that fix to 4.14 now, and will go push out a -rc3 for both
> 4.19.y and 4.14.y to try to sync up on this and figure it out.
> 
> Jon, if you could retest 4.14.y, that would be great, to see if it has
> the same issue that 4.19.y has.  And if so, that means I should probably
> just drop both patches from both trees, right?


So v4.19 is still failing for me ...

Test results for stable-v4.19:
    11 builds:  11 pass, 0 fail
    22 boots:   22 pass, 0 fail
    32 tests:   30 pass, 2 fail

Linux version:  4.19.99-rc3-g041f280e6a1a
Boards tested:  tegra124-jetson-tk1, tegra186-p2771-0000,
                tegra194-p2972-0000, tegra20-ventana,
                tegra210-p2371-2180, tegra30-cardhu-a04

However, I am not seeing any issues with v4.14, so still not clear what
is going on here.

Cheers
Jon

-- 
nvpublic

^ permalink raw reply	[flat|nested] 685+ messages in thread

* Re: [PATCH 4.19 000/639] 4.19.99-stable review
@ 2020-01-27  9:38                   ` Jon Hunter
  0 siblings, 0 replies; 685+ messages in thread
From: Jon Hunter @ 2020-01-27  9:38 UTC (permalink / raw)
  To: Greg Kroah-Hartman, Guenter Roeck
  Cc: linux-kernel, torvalds, akpm, shuah, patches, ben.hutchings,
	lkft-triage, stable, linux-tegra


On 26/01/2020 09:13, Greg Kroah-Hartman wrote:
> On Sat, Jan 25, 2020 at 07:46:47AM -0800, Guenter Roeck wrote:
>> On 1/25/20 3:32 AM, Jon Hunter wrote:
>>>
>>> On 24/01/2020 18:07, Jon Hunter wrote:
>>>>
>>>> On 24/01/2020 17:36, Greg Kroah-Hartman wrote:
>>>>> On Fri, Jan 24, 2020 at 02:50:05PM +0000, Jon Hunter wrote:
>>>>>> Hi Greg,
>>>>>>
>>>>>> On 24/01/2020 09:22, Greg Kroah-Hartman wrote:
>>>>>>> This is the start of the stable review cycle for the 4.19.99 release.
>>>>>>> There are 639 patches in this series, all will be posted as a response
>>>>>>> to this one.  If anyone has any issues with these being applied, please
>>>>>>> let me know.
>>>>>>>
>>>>>>> Responses should be made by Sun, 26 Jan 2020 09:26:29 +0000.
>>>>>>> Anything received after that time might be too late.
>>>>>>>
>>>>>>> The whole patch series can be found in one patch at:
>>>>>>> 	https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.99-rc1.gz
>>>>>>> or in the git tree and branch at:
>>>>>>> 	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
>>>>>>> and the diffstat can be found below.
>>>>>>>
>>>>>>> thanks,
>>>>>>>
>>>>>>> greg k-h
>>>>>>>
>>>>>>> -------------
>>>>>>> Pseudo-Shortlog of commits:
>>>>>>
>>>>>> ...
>>>>>>
>>>>>>> Rafael J. Wysocki <rafael.j.wysocki@intel.com>
>>>>>>>      PCI: PM: Skip devices in D0 for suspend-to-idle
>>>>>>
>>>>>> The above commit is causing a suspend regression on Tegra124 Jetson-TK1.
>>>>>> Reverting this on top of v4.19.99-rc1 fixes the issue.
>>>>>
>>>>> This is also in the 4.14 queue, so should I drop it there too?
>>>>
>>>> I did not see any failures with the same board on that branch, so I
>>>> would say no, but odd that it only fails here. It was failing for me
>>>> 100% so I would have expected to see if there too if it was a problem.
>>>
>>> Hmmm, rc2 still not working for me ...
>>>
>>> Test results for stable-v4.19:
>>>      11 builds:	11 pass, 0 fail
>>>      22 boots:	22 pass, 0 fail
>>>      32 tests:	30 pass, 2 fail
>>>
>>> Linux version:	4.19.99-rc2-g24832ad2c623
>>> Boards tested:	tegra124-jetson-tk1, tegra186-p2771-0000,
>>>                  tegra194-p2972-0000, tegra20-ventana,
>>>                  tegra210-p2371-2180, tegra30-cardhu-a04
>>>
>>> I still see the following commit in rc2 ...
>>>
>>> commit bb52152abe85f971278a7a4f033b29483f64bfdb
>>> Author: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
>>> Date:   Thu Jun 13 23:59:45 2019 +0200
>>>
>>>      PCI: PM: Skip devices in D0 for suspend-to-idle
> 
> Yes, I did not change anything in -rc2 for you, sorry.
> 
>>> BTW, I checked the 4.14. queue and I do not see the above change in
>>> there, however, there is similar change ...
>>>
>>> Rafael J. Wysocki <rafael.j.wysocki@intel.com>
>>>      PCI: PM: Avoid possible suspend-to-idle issue
>>>
>> bb52152abe85 fixes this one, which in turn fixes 33e4f80ee69b.
>> The above in 4.14 but not its fixes is spelling a bit of trouble.
>>
>> Maybe commit 471a739a47aa7 ("PCI: PM: Avoid skipping bus-level
>> PM on platforms without ACPI") was added to -rc2, since it is
>> supposed to fix bb52152abe85.
> 
> I have added that fix to 4.14 now, and will go push out a -rc3 for both
> 4.19.y and 4.14.y to try to sync up on this and figure it out.
> 
> Jon, if you could retest 4.14.y, that would be great, to see if it has
> the same issue that 4.19.y has.  And if so, that means I should probably
> just drop both patches from both trees, right?


So v4.19 is still failing for me ...

Test results for stable-v4.19:
    11 builds:  11 pass, 0 fail
    22 boots:   22 pass, 0 fail
    32 tests:   30 pass, 2 fail

Linux version:  4.19.99-rc3-g041f280e6a1a
Boards tested:  tegra124-jetson-tk1, tegra186-p2771-0000,
                tegra194-p2972-0000, tegra20-ventana,
                tegra210-p2371-2180, tegra30-cardhu-a04

However, I am not seeing any issues with v4.14, so still not clear what
is going on here.

Cheers
Jon

-- 
nvpublic

^ permalink raw reply	[flat|nested] 685+ messages in thread

* Re: [PATCH 4.19 000/639] 4.19.99-stable review
  2020-01-27  9:38                   ` Jon Hunter
  (?)
@ 2020-01-27  9:41                   ` Greg Kroah-Hartman
  -1 siblings, 0 replies; 685+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-27  9:41 UTC (permalink / raw)
  To: Jon Hunter
  Cc: Guenter Roeck, linux-kernel, torvalds, akpm, shuah, patches,
	ben.hutchings, lkft-triage, stable, linux-tegra

On Mon, Jan 27, 2020 at 09:38:17AM +0000, Jon Hunter wrote:
> 
> On 26/01/2020 09:13, Greg Kroah-Hartman wrote:
> > On Sat, Jan 25, 2020 at 07:46:47AM -0800, Guenter Roeck wrote:
> >> On 1/25/20 3:32 AM, Jon Hunter wrote:
> >>>
> >>> On 24/01/2020 18:07, Jon Hunter wrote:
> >>>>
> >>>> On 24/01/2020 17:36, Greg Kroah-Hartman wrote:
> >>>>> On Fri, Jan 24, 2020 at 02:50:05PM +0000, Jon Hunter wrote:
> >>>>>> Hi Greg,
> >>>>>>
> >>>>>> On 24/01/2020 09:22, Greg Kroah-Hartman wrote:
> >>>>>>> This is the start of the stable review cycle for the 4.19.99 release.
> >>>>>>> There are 639 patches in this series, all will be posted as a response
> >>>>>>> to this one.  If anyone has any issues with these being applied, please
> >>>>>>> let me know.
> >>>>>>>
> >>>>>>> Responses should be made by Sun, 26 Jan 2020 09:26:29 +0000.
> >>>>>>> Anything received after that time might be too late.
> >>>>>>>
> >>>>>>> The whole patch series can be found in one patch at:
> >>>>>>> 	https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.99-rc1.gz
> >>>>>>> or in the git tree and branch at:
> >>>>>>> 	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
> >>>>>>> and the diffstat can be found below.
> >>>>>>>
> >>>>>>> thanks,
> >>>>>>>
> >>>>>>> greg k-h
> >>>>>>>
> >>>>>>> -------------
> >>>>>>> Pseudo-Shortlog of commits:
> >>>>>>
> >>>>>> ...
> >>>>>>
> >>>>>>> Rafael J. Wysocki <rafael.j.wysocki@intel.com>
> >>>>>>>      PCI: PM: Skip devices in D0 for suspend-to-idle
> >>>>>>
> >>>>>> The above commit is causing a suspend regression on Tegra124 Jetson-TK1.
> >>>>>> Reverting this on top of v4.19.99-rc1 fixes the issue.
> >>>>>
> >>>>> This is also in the 4.14 queue, so should I drop it there too?
> >>>>
> >>>> I did not see any failures with the same board on that branch, so I
> >>>> would say no, but odd that it only fails here. It was failing for me
> >>>> 100% so I would have expected to see if there too if it was a problem.
> >>>
> >>> Hmmm, rc2 still not working for me ...
> >>>
> >>> Test results for stable-v4.19:
> >>>      11 builds:	11 pass, 0 fail
> >>>      22 boots:	22 pass, 0 fail
> >>>      32 tests:	30 pass, 2 fail
> >>>
> >>> Linux version:	4.19.99-rc2-g24832ad2c623
> >>> Boards tested:	tegra124-jetson-tk1, tegra186-p2771-0000,
> >>>                  tegra194-p2972-0000, tegra20-ventana,
> >>>                  tegra210-p2371-2180, tegra30-cardhu-a04
> >>>
> >>> I still see the following commit in rc2 ...
> >>>
> >>> commit bb52152abe85f971278a7a4f033b29483f64bfdb
> >>> Author: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
> >>> Date:   Thu Jun 13 23:59:45 2019 +0200
> >>>
> >>>      PCI: PM: Skip devices in D0 for suspend-to-idle
> > 
> > Yes, I did not change anything in -rc2 for you, sorry.
> > 
> >>> BTW, I checked the 4.14. queue and I do not see the above change in
> >>> there, however, there is similar change ...
> >>>
> >>> Rafael J. Wysocki <rafael.j.wysocki@intel.com>
> >>>      PCI: PM: Avoid possible suspend-to-idle issue
> >>>
> >> bb52152abe85 fixes this one, which in turn fixes 33e4f80ee69b.
> >> The above in 4.14 but not its fixes is spelling a bit of trouble.
> >>
> >> Maybe commit 471a739a47aa7 ("PCI: PM: Avoid skipping bus-level
> >> PM on platforms without ACPI") was added to -rc2, since it is
> >> supposed to fix bb52152abe85.
> > 
> > I have added that fix to 4.14 now, and will go push out a -rc3 for both
> > 4.19.y and 4.14.y to try to sync up on this and figure it out.
> > 
> > Jon, if you could retest 4.14.y, that would be great, to see if it has
> > the same issue that 4.19.y has.  And if so, that means I should probably
> > just drop both patches from both trees, right?
> 
> 
> So v4.19 is still failing for me ...
> 
> Test results for stable-v4.19:
>     11 builds:  11 pass, 0 fail
>     22 boots:   22 pass, 0 fail
>     32 tests:   30 pass, 2 fail
> 
> Linux version:  4.19.99-rc3-g041f280e6a1a
> Boards tested:  tegra124-jetson-tk1, tegra186-p2771-0000,
>                 tegra194-p2972-0000, tegra20-ventana,
>                 tegra210-p2371-2180, tegra30-cardhu-a04
> 
> However, I am not seeing any issues with v4.14, so still not clear what
> is going on here.

Ugh, odd.  Ok, I'll go drop both patches from both trees and do some
releases in a few hours and then try adding them back so we can do a bit
more debugging without the deadline of the release being on us.

thanks so much for letting me know!

greg k-h

^ permalink raw reply	[flat|nested] 685+ messages in thread

* Re: [PATCH 4.19 014/639] leds: tlc591xx: update the maximum brightness
  2020-01-26  9:18     ` Greg Kroah-Hartman
@ 2020-01-27 12:40       ` Pavel Machek
  0 siblings, 0 replies; 685+ messages in thread
From: Pavel Machek @ 2020-01-27 12:40 UTC (permalink / raw)
  To: Greg Kroah-Hartman
  Cc: Pavel Machek, linux-kernel, stable, Jean-Jacques Hiblot

[-- Attachment #1: Type: text/plain, Size: 1208 bytes --]

On Sun 2020-01-26 10:18:11, Greg Kroah-Hartman wrote:
> On Sat, Jan 25, 2020 at 12:18:26AM +0100, Pavel Machek wrote:
> > On Fri 2020-01-24 10:23:04, Greg Kroah-Hartman wrote:
> > > From: Jean-Jacques Hiblot <jjhiblot@ti.com>
> > > 
> > > commit a2cafdfd8cf5ad8adda6c0ce44a59f46431edf02 upstream.
> > > 
> > > The TLC chips actually offer 257 levels:
> > > - 0: led OFF
> > > - 1-255: Led dimmed is using a PWM. The duty cycle range from 0.4% to 99.6%
> > > - 256: led fully ON
> > > 
> > > Fixes: e370d010a5fe ("leds: tlc591xx: Driver for the TI 8/16 Channel i2c LED driver")
> > > Signed-off-by: Jean-Jacques Hiblot <jjhiblot@ti.com>
> > > Signed-off-by: Pavel Machek <pavel@ucw.cz>
> > > Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> > 
> > Its a new feature, really and quite unusual one: 257 brightness levels
> > is not usual. It is theoretically safe, but...
> > 
> > Lets not do that for -stable.
> > 
> > (I'm a LED maintainer).
> 
> Ok, now dropped from 4.19 and older, thanks!

Thank you!
								Pavel
-- 
DENX Software Engineering GmbH,      Managing Director: Wolfgang Denk
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

^ permalink raw reply	[flat|nested] 685+ messages in thread

end of thread, other threads:[~2020-01-27 12:40 UTC | newest]

Thread overview: 685+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-01-24  9:22 [PATCH 4.19 000/639] 4.19.99-stable review Greg Kroah-Hartman
2020-01-24  9:22 ` [PATCH 4.19 001/639] Revert "efi: Fix debugobjects warning on efi_rts_work" Greg Kroah-Hartman
2020-01-24  9:22 ` [PATCH 4.19 002/639] xfs: Sanity check flags of Q_XQUOTARM call Greg Kroah-Hartman
2020-01-24  9:22 ` [PATCH 4.19 003/639] i2c: stm32f7: rework slave_id allocation Greg Kroah-Hartman
2020-01-24  9:22 ` [PATCH 4.19 004/639] i2c: i2c-stm32f7: fix 10-bits check in slave free id search loop Greg Kroah-Hartman
2020-01-24  9:22 ` [PATCH 4.19 005/639] mfd: intel-lpss: Add default I2C device properties for Gemini Lake Greg Kroah-Hartman
2020-01-24  9:22 ` [PATCH 4.19 006/639] SUNRPC: Fix svcauth_gss_proxy_init() Greg Kroah-Hartman
2020-01-24  9:22 ` [PATCH 4.19 007/639] powerpc/pseries: Enable support for ibm,drc-info property Greg Kroah-Hartman
2020-01-24  9:22 ` [PATCH 4.19 008/639] powerpc/archrandom: fix arch_get_random_seed_int() Greg Kroah-Hartman
2020-01-24  9:22 ` [PATCH 4.19 009/639] tipc: update mons self addr when node addr generated Greg Kroah-Hartman
2020-01-24  9:23 ` [PATCH 4.19 010/639] tipc: fix wrong timeout input for tipc_wait_for_cond() Greg Kroah-Hartman
2020-01-24  9:23 ` [PATCH 4.19 011/639] mt7601u: fix bbp version check in mt7601u_wait_bbp_ready Greg Kroah-Hartman
2020-01-24  9:23 ` [PATCH 4.19 012/639] crypto: sun4i-ss - fix big endian issues Greg Kroah-Hartman
2020-01-24  9:23 ` [PATCH 4.19 013/639] perf map: No need to adjust the long name of modules Greg Kroah-Hartman
2020-01-24  9:23 ` [PATCH 4.19 014/639] leds: tlc591xx: update the maximum brightness Greg Kroah-Hartman
2020-01-24 23:18   ` Pavel Machek
2020-01-26  9:18     ` Greg Kroah-Hartman
2020-01-27 12:40       ` Pavel Machek
2020-01-24  9:23 ` [PATCH 4.19 015/639] soc: aspeed: Fix snoop_file_poll()s return type Greg Kroah-Hartman
2020-01-24  9:23 ` [PATCH 4.19 016/639] watchdog: sprd: Fix the incorrect pointer getting from driver data Greg Kroah-Hartman
2020-01-24  9:23 ` [PATCH 4.19 017/639] ipmi: Fix memory leak in __ipmi_bmc_register Greg Kroah-Hartman
2020-01-24  9:23 ` [PATCH 4.19 018/639] drm/sti: do not remove the drm_bridge that was never added Greg Kroah-Hartman
2020-01-24  9:23 ` [PATCH 4.19 019/639] ARM: dts: at91: nattis: set the PRLUD and HIPOW signals low Greg Kroah-Hartman
2020-01-24  9:23 ` [PATCH 4.19 020/639] ARM: dts: at91: nattis: make the SD-card slot work Greg Kroah-Hartman
2020-01-24  9:23 ` [PATCH 4.19 021/639] ixgbe: dont clear IPsec sa counters on HW clearing Greg Kroah-Hartman
2020-01-24  9:23 ` [PATCH 4.19 022/639] drm/virtio: fix bounds check in virtio_gpu_cmd_get_capset() Greg Kroah-Hartman
2020-01-24  9:23 ` [PATCH 4.19 023/639] iio: fix position relative kernel version Greg Kroah-Hartman
2020-01-24  9:23 ` [PATCH 4.19 024/639] apparmor: Fix network performance issue in aa_label_sk_perm Greg Kroah-Hartman
2020-01-24  9:23 ` [PATCH 4.19 025/639] ALSA: hda: fix unused variable warning Greg Kroah-Hartman
2020-01-24  9:23 ` [PATCH 4.19 026/639] apparmor: dont try to replace stale label in ptrace access check Greg Kroah-Hartman
2020-01-24  9:23 ` [PATCH 4.19 027/639] ARM: qcom_defconfig: Enable MAILBOX Greg Kroah-Hartman
2020-01-24  9:23 ` [PATCH 4.19 028/639] firmware: coreboot: Let OF core populate platform device Greg Kroah-Hartman
2020-01-24  9:23 ` [PATCH 4.19 029/639] PCI: iproc: Remove PAXC slot check to allow VF support Greg Kroah-Hartman
2020-01-24  9:23 ` [PATCH 4.19 030/639] bridge: br_arp_nd_proxy: set icmp6_router if neigh has NTF_ROUTER Greg Kroah-Hartman
2020-01-24  9:23 ` [PATCH 4.19 031/639] drm/hisilicon: hibmc: Dont overwrite fb helper surface depth Greg Kroah-Hartman
2020-01-24  9:23 ` [PATCH 4.19 032/639] signal/ia64: Use the generic force_sigsegv in setup_frame Greg Kroah-Hartman
2020-01-24  9:23   ` Greg Kroah-Hartman
2020-01-24  9:23 ` [PATCH 4.19 033/639] signal/ia64: Use the force_sig(SIGSEGV,...) in ia64_rt_sigreturn Greg Kroah-Hartman
2020-01-24  9:23   ` Greg Kroah-Hartman
2020-01-24  9:23 ` [PATCH 4.19 034/639] ASoC: wm9712: fix unused variable warning Greg Kroah-Hartman
2020-01-24  9:23 ` [PATCH 4.19 035/639] mailbox: mediatek: Add check for possible failure of kzalloc Greg Kroah-Hartman
2020-01-24  9:23 ` [PATCH 4.19 036/639] IB/rxe: replace kvfree with vfree Greg Kroah-Hartman
2020-01-24  9:23 ` [PATCH 4.19 037/639] IB/hfi1: Add mtu check for operational data VLs Greg Kroah-Hartman
2020-01-24  9:23 ` [PATCH 4.19 038/639] genirq/debugfs: Reinstate full OF path for domain name Greg Kroah-Hartman
2020-01-24  9:23 ` [PATCH 4.19 039/639] usb: dwc3: add EXTCON dependency for qcom Greg Kroah-Hartman
2020-01-24  9:23 ` [PATCH 4.19 040/639] usb: gadget: fsl_udc_core: check allocation return value and cleanup on failure Greg Kroah-Hartman
2020-01-24  9:23 ` [PATCH 4.19 041/639] cfg80211: regulatory: make initialization more robust Greg Kroah-Hartman
2020-01-24  9:23 ` [PATCH 4.19 042/639] regulator: fixed: Default enable high on DT regulators Greg Kroah-Hartman
2020-01-24  9:23 ` [PATCH 4.19 043/639] mei: replace POLL* with EPOLL* for write queues Greg Kroah-Hartman
2020-01-24  9:23 ` [PATCH 4.19 044/639] drm/msm: fix unsigned comparison with less than zero Greg Kroah-Hartman
2020-01-24  9:23 ` [PATCH 4.19 045/639] of: Fix property name in of_node_get_device_type Greg Kroah-Hartman
2020-01-24  9:23 ` [PATCH 4.19 046/639] ALSA: usb-audio: update quirk for B&W PX to remove microphone Greg Kroah-Hartman
2020-01-24  9:23 ` [PATCH 4.19 047/639] iwlwifi: nvm: get num of hw addresses from firmware Greg Kroah-Hartman
2020-01-24  9:23 ` [PATCH 4.19 048/639] staging: comedi: ni_mio_common: protect register write overflow Greg Kroah-Hartman
2020-01-24  9:23 ` [PATCH 4.19 049/639] netfilter: nft_osf: usage from output path is not valid Greg Kroah-Hartman
2020-01-24  9:23 ` [PATCH 4.19 050/639] pwm: lpss: Release runtime-pm reference from the drivers remove callback Greg Kroah-Hartman
2020-01-24  9:23 ` [PATCH 4.19 051/639] powerpc/pseries/memory-hotplug: Fix return value type of find_aa_index Greg Kroah-Hartman
2020-01-24  9:23 ` [PATCH 4.19 052/639] rtlwifi: rtl8821ae: replace _rtl8821ae_mrate_idx_to_arfr_id with generic version Greg Kroah-Hartman
2020-01-24  9:23 ` [PATCH 4.19 053/639] RDMA/bnxt_re: Add missing spin lock initialization Greg Kroah-Hartman
2020-01-24  9:23 ` [PATCH 4.19 054/639] netfilter: nf_flow_table: do not remove offload when other netnss interface is down Greg Kroah-Hartman
2020-01-24  9:23 ` [PATCH 4.19 055/639] powerpc/kgdb: add kgdb_arch_set/remove_breakpoint() Greg Kroah-Hartman
2020-01-24  9:23 ` [PATCH 4.19 056/639] tipc: eliminate message disordering during binding table update Greg Kroah-Hartman
2020-01-24  9:23 ` [PATCH 4.19 057/639] net: socionext: Add dummy PHY register read in phy_write() Greg Kroah-Hartman
2020-01-24  9:23 ` [PATCH 4.19 058/639] drm/sun4i: hdmi: Fix double flag assignation Greg Kroah-Hartman
2020-01-24  9:23 ` [PATCH 4.19 059/639] net: hns3: add error handler for hns3_nic_init_vector_data() Greg Kroah-Hartman
2020-01-24  9:23 ` [PATCH 4.19 060/639] mlxsw: reg: QEEC: Add minimum shaper fields Greg Kroah-Hartman
2020-01-24  9:23 ` [PATCH 4.19 061/639] mlxsw: spectrum: Set minimum shaper on MC TCs Greg Kroah-Hartman
2020-01-24  9:23 ` [PATCH 4.19 062/639] NTB: ntb_hw_idt: replace IS_ERR_OR_NULL with regular NULL checks Greg Kroah-Hartman
2020-01-24  9:23 ` [PATCH 4.19 063/639] ASoC: wm97xx: fix uninitialized regmap pointer problem Greg Kroah-Hartman
2020-01-24  9:23 ` [PATCH 4.19 064/639] ARM: dts: bcm283x: Correct mailbox register sizes Greg Kroah-Hartman
2020-01-24  9:23 ` [PATCH 4.19 065/639] pcrypt: use format specifier in kobject_add Greg Kroah-Hartman
2020-01-24  9:23 ` [PATCH 4.19 066/639] ASoC: sun8i-codec: add missing route for ADC Greg Kroah-Hartman
2020-01-24  9:23 ` [PATCH 4.19 067/639] pinctrl: meson-gxl: remove invalid GPIOX tsin_a pins Greg Kroah-Hartman
2020-01-24  9:23 ` [PATCH 4.19 068/639] bus: ti-sysc: Add mcasp optional clocks flag Greg Kroah-Hartman
2020-01-24  9:23 ` [PATCH 4.19 069/639] exportfs: fix passing zero to ERR_PTR() warning Greg Kroah-Hartman
2020-01-24  9:24 ` [PATCH 4.19 070/639] drm: rcar-du: Fix the return value in case of error in rcar_du_crtc_set_crc_source() Greg Kroah-Hartman
2020-01-24  9:24 ` [PATCH 4.19 071/639] drm: rcar-du: Fix vblank initialization Greg Kroah-Hartman
2020-01-24  9:24 ` [PATCH 4.19 072/639] net: always initialize pagedlen Greg Kroah-Hartman
2020-01-24  9:24 ` [PATCH 4.19 073/639] drm/dp_mst: Skip validating ports during destruction, just ref Greg Kroah-Hartman
2020-01-24  9:24 ` [PATCH 4.19 074/639] arm64: dts: meson-gx: Add hdmi_5v regulator as hdmi tx supply Greg Kroah-Hartman
2020-01-24  9:24 ` [PATCH 4.19 075/639] arm64: dts: renesas: r8a7795-es1: Add missing power domains to IPMMU nodes Greg Kroah-Hartman
2020-01-24  9:24 ` [PATCH 4.19 076/639] net: phy: Fix not to call phy_resume() if PHY is not attached Greg Kroah-Hartman
2020-01-24  9:24 ` [PATCH 4.19 077/639] IB/hfi1: Correctly process FECN and BECN in packets Greg Kroah-Hartman
2020-01-24  9:24 ` [PATCH 4.19 078/639] OPP: Fix missing debugfs supply directory for OPPs Greg Kroah-Hartman
2020-01-24  9:24 ` [PATCH 4.19 079/639] IB/rxe: Fix incorrect cache cleanup in error flow Greg Kroah-Hartman
2020-01-24  9:24 ` [PATCH 4.19 080/639] mailbox: ti-msgmgr: Off by one in ti_msgmgr_of_xlate() Greg Kroah-Hartman
2020-01-24  9:24 ` [PATCH 4.19 081/639] staging: bcm2835-camera: Abort probe if there is no camera Greg Kroah-Hartman
2020-01-24  9:24 ` [PATCH 4.19 082/639] staging: bcm2835-camera: fix module autoloading Greg Kroah-Hartman
2020-01-24  9:24 ` [PATCH 4.19 083/639] switchtec: Remove immediate status check after submitting MRPC command Greg Kroah-Hartman
2020-01-24  9:24 ` [PATCH 4.19 084/639] ipv6: add missing tx timestamping on IPPROTO_RAW Greg Kroah-Hartman
2020-01-24  9:24 ` [PATCH 4.19 085/639] pinctrl: sh-pfc: r8a7740: Add missing REF125CK pin to gether_gmii group Greg Kroah-Hartman
2020-01-24  9:24 ` [PATCH 4.19 086/639] pinctrl: sh-pfc: r8a7740: Add missing LCD0 marks to lcd0_data24_1 group Greg Kroah-Hartman
2020-01-24  9:24 ` [PATCH 4.19 087/639] pinctrl: sh-pfc: r8a7791: Remove bogus ctrl marks from qspi_data4_b group Greg Kroah-Hartman
2020-01-24  9:24 ` [PATCH 4.19 088/639] pinctrl: sh-pfc: r8a7791: Remove bogus marks from vin1_b_data18 group Greg Kroah-Hartman
2020-01-24  9:24 ` [PATCH 4.19 089/639] pinctrl: sh-pfc: sh73a0: Add missing TO pin to tpu4_to3 group Greg Kroah-Hartman
2020-01-24  9:24 ` [PATCH 4.19 090/639] pinctrl: sh-pfc: r8a7794: Remove bogus IPSR9 field Greg Kroah-Hartman
2020-01-24  9:24 ` [PATCH 4.19 091/639] pinctrl: sh-pfc: r8a77970: Add missing MOD_SEL0 field Greg Kroah-Hartman
2020-01-24  9:24 ` [PATCH 4.19 092/639] pinctrl: sh-pfc: r8a77980: " Greg Kroah-Hartman
2020-01-24  9:24 ` [PATCH 4.19 093/639] pinctrl: sh-pfc: sh7734: Add missing IPSR11 field Greg Kroah-Hartman
2020-01-24  9:24 ` [PATCH 4.19 094/639] pinctrl: sh-pfc: r8a77995: Remove bogus SEL_PWM[0-3]_3 configurations Greg Kroah-Hartman
2020-01-24  9:24 ` [PATCH 4.19 095/639] pinctrl: sh-pfc: sh7269: Add missing PCIOR0 field Greg Kroah-Hartman
2020-01-24  9:24 ` [PATCH 4.19 096/639] pinctrl: sh-pfc: sh7734: Remove bogus IPSR10 value Greg Kroah-Hartman
2020-01-24  9:24 ` [PATCH 4.19 097/639] net: hns3: fix error handling int the hns3_get_vector_ring_chain Greg Kroah-Hartman
2020-01-24  9:24 ` [PATCH 4.19 098/639] vxlan: changelink: Fix handling of default remotes Greg Kroah-Hartman
2020-01-24  9:24 ` [PATCH 4.19 099/639] Input: nomadik-ske-keypad - fix a loop timeout test Greg Kroah-Hartman
2020-01-24  9:24 ` [PATCH 4.19 100/639] fork,memcg: fix crash in free_thread_stack on memcg charge fail Greg Kroah-Hartman
2020-01-24  9:24 ` [PATCH 4.19 101/639] clk: highbank: fix refcount leak in hb_clk_init() Greg Kroah-Hartman
2020-01-24  9:24 ` [PATCH 4.19 102/639] clk: qoriq: fix refcount leak in clockgen_init() Greg Kroah-Hartman
2020-01-24  9:24 ` [PATCH 4.19 103/639] clk: ti: fix refcount leak in ti_dt_clocks_register() Greg Kroah-Hartman
2020-01-24  9:24 ` [PATCH 4.19 104/639] clk: socfpga: fix refcount leak Greg Kroah-Hartman
2020-01-24  9:24 ` [PATCH 4.19 105/639] clk: samsung: exynos4: fix refcount leak in exynos4_get_xom() Greg Kroah-Hartman
2020-01-24  9:24 ` [PATCH 4.19 106/639] clk: imx6q: fix refcount leak in imx6q_clocks_init() Greg Kroah-Hartman
2020-01-24  9:24 ` [PATCH 4.19 107/639] clk: imx6sx: fix refcount leak in imx6sx_clocks_init() Greg Kroah-Hartman
2020-01-24  9:24 ` [PATCH 4.19 108/639] clk: imx7d: fix refcount leak in imx7d_clocks_init() Greg Kroah-Hartman
2020-01-24  9:24 ` [PATCH 4.19 109/639] clk: vf610: fix refcount leak in vf610_clocks_init() Greg Kroah-Hartman
2020-01-24  9:24 ` [PATCH 4.19 110/639] clk: armada-370: fix refcount leak in a370_clk_init() Greg Kroah-Hartman
2020-01-24  9:24 ` [PATCH 4.19 111/639] clk: kirkwood: fix refcount leak in kirkwood_clk_init() Greg Kroah-Hartman
2020-01-24  9:24 ` [PATCH 4.19 112/639] clk: armada-xp: fix refcount leak in axp_clk_init() Greg Kroah-Hartman
2020-01-24  9:24 ` [PATCH 4.19 113/639] clk: mv98dx3236: fix refcount leak in mv98dx3236_clk_init() Greg Kroah-Hartman
2020-01-24  9:24 ` [PATCH 4.19 114/639] clk: dove: fix refcount leak in dove_clk_init() Greg Kroah-Hartman
2020-01-24  9:24 ` [PATCH 4.19 115/639] MIPS: BCM63XX: drop unused and broken DSP platform device Greg Kroah-Hartman
2020-01-24  9:24 ` [PATCH 4.19 116/639] arm64: defconfig: Re-enable bcm2835-thermal driver Greg Kroah-Hartman
2020-01-24  9:24 ` [PATCH 4.19 117/639] remoteproc: qcom: q6v5-mss: Add missing clocks for MSM8996 Greg Kroah-Hartman
2020-01-24  9:24 ` [PATCH 4.19 118/639] remoteproc: qcom: q6v5-mss: Add missing regulator " Greg Kroah-Hartman
2020-01-24  9:24 ` [PATCH 4.19 119/639] drm: Fix error handling in drm_legacy_addctx Greg Kroah-Hartman
2020-01-24  9:24 ` [PATCH 4.19 120/639] ARM: dts: r8a7743: Remove generic compatible string from iic3 Greg Kroah-Hartman
2020-01-24  9:24 ` [PATCH 4.19 121/639] drm/etnaviv: fix some off by one bugs Greg Kroah-Hartman
2020-01-24  9:24 ` [PATCH 4.19 122/639] drm/fb-helper: generic: Fix setup error path Greg Kroah-Hartman
2020-01-24  9:24 ` [PATCH 4.19 123/639] fork, memcg: fix cached_stacks case Greg Kroah-Hartman
2020-01-24  9:24 ` [PATCH 4.19 124/639] IB/usnic: Fix out of bounds index check in query pkey Greg Kroah-Hartman
2020-01-24  9:24 ` [PATCH 4.19 125/639] RDMA/ocrdma: " Greg Kroah-Hartman
2020-01-24  9:24 ` [PATCH 4.19 126/639] RDMA/qedr: " Greg Kroah-Hartman
2020-01-24  9:24 ` [PATCH 4.19 127/639] drm/shmob: Fix return value check in shmob_drm_probe Greg Kroah-Hartman
2020-01-24  9:24 ` [PATCH 4.19 128/639] arm64: dts: apq8016-sbc: Increase load on l11 for SDCARD Greg Kroah-Hartman
2020-01-24  9:24 ` [PATCH 4.19 129/639] spi: cadence: Correct initialisation of runtime PM Greg Kroah-Hartman
2020-01-24  9:25 ` [PATCH 4.19 130/639] RDMA/iw_cxgb4: Fix the unchecked ep dereference Greg Kroah-Hartman
2020-01-24  9:25 ` [PATCH 4.19 131/639] net: phy: micrel: set soft_reset callback to genphy_soft_reset for KSZ9031 Greg Kroah-Hartman
2020-01-24  9:25 ` [PATCH 4.19 132/639] memory: tegra: Dont invoke Tegra30+ specific memory timing setup on Tegra20 Greg Kroah-Hartman
2020-01-24  9:25 ` [PATCH 4.19 133/639] drm/etnaviv: NULL vs IS_ERR() buf in etnaviv_core_dump() Greg Kroah-Hartman
2020-01-24  9:25 ` [PATCH 4.19 134/639] media: s5p-jpeg: Correct step and max values for V4L2_CID_JPEG_RESTART_INTERVAL Greg Kroah-Hartman
2020-01-24  9:25 ` [PATCH 4.19 135/639] kbuild: mark prepare0 as PHONY to fix external module build Greg Kroah-Hartman
2020-01-24  9:25 ` [PATCH 4.19 136/639] crypto: brcm - Fix some set-but-not-used warning Greg Kroah-Hartman
2020-01-24  9:25 ` [PATCH 4.19 137/639] crypto: tgr192 - fix unaligned memory access Greg Kroah-Hartman
2020-01-24  9:25 ` [PATCH 4.19 138/639] ASoC: imx-sgtl5000: put of nodes if finding codec fails Greg Kroah-Hartman
2020-01-24  9:25 ` [PATCH 4.19 139/639] IB/iser: Pass the correct number of entries for dma mapped SGL Greg Kroah-Hartman
2020-01-24  9:25 ` [PATCH 4.19 140/639] net: hns3: fix wrong combined count returned by ethtool -l Greg Kroah-Hartman
2020-01-24  9:25 ` [PATCH 4.19 141/639] media: tw9910: Unregister subdevice with v4l2-async Greg Kroah-Hartman
2020-01-24  9:25 ` [PATCH 4.19 142/639] IB/mlx5: Dont override existing ip_protocol Greg Kroah-Hartman
2020-01-24  9:25 ` [PATCH 4.19 143/639] rtc: cmos: ignore bogus century byte Greg Kroah-Hartman
2020-01-25 12:04   ` Pavel Machek
2020-01-24  9:25 ` [PATCH 4.19 144/639] spi/topcliff_pch: Fix potential NULL dereference on allocation error Greg Kroah-Hartman
2020-01-24  9:25 ` [PATCH 4.19 145/639] net: hns3: fix bug of ethtool_ops.get_channels for VF Greg Kroah-Hartman
2020-01-24  9:25 ` [PATCH 4.19 146/639] ARM: dts: sun8i-a23-a33: Move NAND controller device node to sort by address Greg Kroah-Hartman
2020-01-24  9:25 ` [PATCH 4.19 147/639] clk: sunxi-ng: sun8i-a23: Enable PLL-MIPI LDOs when ungating it Greg Kroah-Hartman
2020-01-24  9:25 ` [PATCH 4.19 148/639] iwlwifi: mvm: avoid possible access out of array Greg Kroah-Hartman
2020-01-24  9:25 ` [PATCH 4.19 149/639] net/mlx5: Take lock with IRQs disabled to avoid deadlock Greg Kroah-Hartman
2020-01-24  9:25 ` [PATCH 4.19 150/639] ip_tunnel: Fix route fl4 init in ip_md_tunnel_xmit Greg Kroah-Hartman
2020-01-24  9:25 ` [PATCH 4.19 151/639] arm64: dts: allwinner: h6: Move GIC device node fix base address ordering Greg Kroah-Hartman
2020-01-25 12:50   ` Pavel Machek
2020-01-24  9:25 ` [PATCH 4.19 152/639] iwlwifi: mvm: fix A-MPDU reference assignment Greg Kroah-Hartman
2020-01-24  9:25 ` [PATCH 4.19 153/639] bus: ti-sysc: Fix timer handling with drop pm_runtime_irq_safe() Greg Kroah-Hartman
2020-01-24  9:25 ` [PATCH 4.19 154/639] tty: ipwireless: Fix potential NULL pointer dereference Greg Kroah-Hartman
2020-01-24  9:25 ` [PATCH 4.19 155/639] driver: uio: fix possible memory leak in __uio_register_device Greg Kroah-Hartman
2020-01-24  9:25 ` [PATCH 4.19 156/639] driver: uio: fix possible use-after-free " Greg Kroah-Hartman
2020-01-24  9:25 ` [PATCH 4.19 157/639] crypto: crypto4xx - Fix wrong ppc4xx_trng_probe()/ppc4xx_trng_remove() arguments Greg Kroah-Hartman
2020-01-24  9:25 ` [PATCH 4.19 158/639] driver core: Fix DL_FLAG_AUTOREMOVE_SUPPLIER device link flag handling Greg Kroah-Hartman
2020-01-24  9:25 ` [PATCH 4.19 159/639] driver core: Avoid careless re-use of existing device links Greg Kroah-Hartman
2020-01-24  9:25 ` [PATCH 4.19 160/639] driver core: Do not resume suppliers under device_links_write_lock() Greg Kroah-Hartman
2020-01-24  9:25 ` [PATCH 4.19 161/639] driver core: Fix handling of runtime PM flags in device_link_add() Greg Kroah-Hartman
2020-01-24  9:25 ` [PATCH 4.19 162/639] driver core: Do not call rpm_put_suppliers() in pm_runtime_drop_link() Greg Kroah-Hartman
2020-01-24  9:25 ` [PATCH 4.19 163/639] ARM: dts: lpc32xx: add required clocks property to keypad device node Greg Kroah-Hartman
2020-01-24  9:25 ` [PATCH 4.19 164/639] ARM: dts: lpc32xx: reparent keypad controller to SIC1 Greg Kroah-Hartman
2020-01-24  9:25 ` [PATCH 4.19 165/639] ARM: dts: lpc32xx: fix ARM PrimeCell LCD controller variant Greg Kroah-Hartman
2020-01-24  9:25 ` [PATCH 4.19 166/639] ARM: dts: lpc32xx: fix ARM PrimeCell LCD controller clocks property Greg Kroah-Hartman
2020-01-24  9:25 ` [PATCH 4.19 167/639] ARM: dts: lpc32xx: phy3250: fix SD card regulator voltage Greg Kroah-Hartman
2020-01-24  9:25 ` [PATCH 4.19 168/639] drm/xen-front: Fix mmap attributes for display buffers Greg Kroah-Hartman
2020-01-24  9:25 ` [PATCH 4.19 169/639] iwlwifi: mvm: fix RSS config command Greg Kroah-Hartman
2020-01-24  9:25 ` [PATCH 4.19 170/639] staging: most: cdev: add missing check for cdev_add failure Greg Kroah-Hartman
2020-01-24  9:25 ` [PATCH 4.19 171/639] clk: ingenic: jz4740: Fix gating of UDC clock Greg Kroah-Hartman
2020-01-24  9:25 ` [PATCH 4.19 172/639] rtc: ds1672: fix unintended sign extension Greg Kroah-Hartman
2020-01-24  9:25 ` [PATCH 4.19 173/639] thermal: mediatek: fix register index error Greg Kroah-Hartman
2020-01-24  9:25 ` [PATCH 4.19 174/639] arm64: dts: msm8916: remove bogus argument to the cpu clock Greg Kroah-Hartman
2020-01-24  9:25 ` [PATCH 4.19 175/639] ath10k: fix dma unmap direction for management frames Greg Kroah-Hartman
2020-01-24  9:25 ` [PATCH 4.19 176/639] net: phy: fixed_phy: Fix fixed_phy not checking GPIO Greg Kroah-Hartman
2020-01-24  9:25 ` [PATCH 4.19 177/639] rtc: ds1307: rx8130: Fix alarm handling Greg Kroah-Hartman
2020-01-25 13:30   ` Pavel Machek
2020-01-26 21:28     ` Uwe Kleine-König
2020-01-24  9:25 ` [PATCH 4.19 178/639] net/smc: original socket family in inet_sock_diag Greg Kroah-Hartman
2020-01-24  9:25 ` [PATCH 4.19 179/639] rtc: 88pm860x: fix unintended sign extension Greg Kroah-Hartman
2020-01-24  9:25 ` [PATCH 4.19 180/639] rtc: 88pm80x: " Greg Kroah-Hartman
2020-01-24  9:25 ` [PATCH 4.19 181/639] rtc: pm8xxx: " Greg Kroah-Hartman
2020-01-24  9:25 ` [PATCH 4.19 182/639] fbdev: chipsfb: remove set but not used variable size Greg Kroah-Hartman
2020-01-24  9:25 ` [PATCH 4.19 183/639] iw_cxgb4: use tos when importing the endpoint Greg Kroah-Hartman
2020-01-24  9:25 ` [PATCH 4.19 184/639] iw_cxgb4: use tos when finding ipv6 routes Greg Kroah-Hartman
2020-01-24  9:25 ` [PATCH 4.19 185/639] ipmi: kcs_bmc: handle devm_kasprintf() failure case Greg Kroah-Hartman
2020-01-24  9:25 ` [PATCH 4.19 186/639] xsk: add missing smp_rmb() in xsk_mmap Greg Kroah-Hartman
2020-01-24  9:25 ` [PATCH 4.19 187/639] drm/etnaviv: potential NULL dereference Greg Kroah-Hartman
2020-01-24  9:25 ` [PATCH 4.19 188/639] ntb_hw_switchtec: debug print 64bit aligned crosslink BAR Numbers Greg Kroah-Hartman
2020-01-24  9:25 ` [PATCH 4.19 189/639] ntb_hw_switchtec: NT req id mapping table register entry number should be 512 Greg Kroah-Hartman
2020-01-24  9:26 ` [PATCH 4.19 190/639] pinctrl: sh-pfc: emev2: Add missing pinmux functions Greg Kroah-Hartman
2020-01-24  9:26 ` [PATCH 4.19 191/639] pinctrl: sh-pfc: r8a7791: Fix scifb2_data_c pin group Greg Kroah-Hartman
2020-01-24  9:26 ` [PATCH 4.19 192/639] pinctrl: sh-pfc: r8a7792: Fix vin1_data18_b " Greg Kroah-Hartman
2020-01-24  9:26 ` [PATCH 4.19 193/639] pinctrl: sh-pfc: sh73a0: Fix fsic_spdif pin groups Greg Kroah-Hartman
2020-01-24  9:26 ` [PATCH 4.19 194/639] RDMA/mlx5: Fix memory leak in case we fail to add an IB device Greg Kroah-Hartman
2020-01-24  9:26 ` [PATCH 4.19 195/639] driver core: Fix possible supplier PM-usage counter imbalance Greg Kroah-Hartman
2020-01-24  9:26 ` [PATCH 4.19 196/639] PCI: endpoint: functions: Use memcpy_fromio()/memcpy_toio() Greg Kroah-Hartman
2020-01-24  9:26 ` [PATCH 4.19 197/639] usb: phy: twl6030-usb: fix possible use-after-free on remove Greg Kroah-Hartman
2020-01-24  9:26 ` [PATCH 4.19 198/639] block: dont use bio->bi_vcnt to figure out segment number Greg Kroah-Hartman
2020-01-24  9:26 ` [PATCH 4.19 199/639] keys: Timestamp new keys Greg Kroah-Hartman
2020-01-24  9:26 ` [PATCH 4.19 200/639] net: dsa: b53: Fix default VLAN ID Greg Kroah-Hartman
2020-01-24  9:26 ` [PATCH 4.19 201/639] net: dsa: b53: Properly account for VLAN filtering Greg Kroah-Hartman
2020-01-24  9:26 ` [PATCH 4.19 202/639] net: dsa: b53: Do not program CPU ports PVID Greg Kroah-Hartman
2020-01-24  9:26 ` [PATCH 4.19 203/639] mt76: usb: fix possible memory leak in mt76u_buf_free Greg Kroah-Hartman
2020-01-24  9:26 ` [PATCH 4.19 204/639] media: sh: migor: Include missing dma-mapping header Greg Kroah-Hartman
2020-01-24  9:26 ` [PATCH 4.19 205/639] vfio_pci: Enable memory accesses before calling pci_map_rom Greg Kroah-Hartman
2020-01-24  9:26 ` [PATCH 4.19 206/639] hwmon: (pmbus/tps53679) Fix driver info initialization in probe routine Greg Kroah-Hartman
2020-01-24  9:26 ` [PATCH 4.19 207/639] mdio_bus: Fix PTR_ERR() usage after initialization to constant Greg Kroah-Hartman
2020-01-24  9:26 ` [PATCH 4.19 208/639] KVM: PPC: Release all hardware TCE tables attached to a group Greg Kroah-Hartman
2020-01-24  9:26 ` [PATCH 4.19 209/639] staging: r8822be: check kzalloc return or bail Greg Kroah-Hartman
2020-01-24  9:26 ` [PATCH 4.19 210/639] dmaengine: mv_xor: Use correct device for DMA API Greg Kroah-Hartman
2020-01-24  9:26 ` [PATCH 4.19 211/639] cdc-wdm: pass return value of recover_from_urb_loss Greg Kroah-Hartman
2020-01-24  9:26 ` [PATCH 4.19 212/639] brcmfmac: create debugfs files for bus-specific layer Greg Kroah-Hartman
2020-01-24  9:26 ` [PATCH 4.19 213/639] regulator: pv88060: Fix array out-of-bounds access Greg Kroah-Hartman
2020-01-24  9:26 ` [PATCH 4.19 214/639] regulator: pv88080: " Greg Kroah-Hartman
2020-01-24  9:26 ` [PATCH 4.19 215/639] regulator: pv88090: " Greg Kroah-Hartman
2020-01-24  9:26 ` [PATCH 4.19 216/639] net: dsa: qca8k: Enable delay for RGMII_ID mode Greg Kroah-Hartman
2020-01-24  9:26 ` [PATCH 4.19 217/639] net/mlx5: Delete unused FPGA QPN variable Greg Kroah-Hartman
2020-01-24  9:26 ` [PATCH 4.19 218/639] drm/nouveau/bios/ramcfg: fix missing parentheses when calculating RON Greg Kroah-Hartman
2020-01-24  9:26 ` [PATCH 4.19 219/639] drm/nouveau/pmu: dont print reply values if exec is false Greg Kroah-Hartman
2020-01-24  9:26 ` [PATCH 4.19 220/639] drm/nouveau: fix missing break in switch statement Greg Kroah-Hartman
2020-01-24  9:26 ` [PATCH 4.19 221/639] driver core: Fix PM-runtime for links added during consumer probe Greg Kroah-Hartman
2020-01-24  9:26 ` [PATCH 4.19 222/639] ASoC: qcom: Fix of-node refcount unbalance in apq8016_sbc_parse_of() Greg Kroah-Hartman
2020-01-24  9:26 ` [PATCH 4.19 223/639] net: dsa: fix unintended change of bridge interface STP state Greg Kroah-Hartman
2020-01-24  9:26 ` [PATCH 4.19 224/639] fs/nfs: Fix nfs_parse_devname to not modify its argument Greg Kroah-Hartman
2020-01-24  9:26 ` [PATCH 4.19 225/639] staging: rtlwifi: Use proper enum for return in halmac_parse_psd_data_88xx Greg Kroah-Hartman
2020-01-24  9:26 ` [PATCH 4.19 226/639] powerpc/64s: Fix logic when handling unknown CPU features Greg Kroah-Hartman
2020-01-24  9:26 ` [PATCH 4.19 227/639] NFS: Fix a soft lockup in the delegation recovery code Greg Kroah-Hartman
2020-01-24  9:26 ` [PATCH 4.19 228/639] perf: Copy parents address filter offsets on clone Greg Kroah-Hartman
2020-01-24  9:26 ` [PATCH 4.19 229/639] perf, pt, coresight: Fix address filters for vmas with non-zero offset Greg Kroah-Hartman
2020-01-24  9:26 ` [PATCH 4.19 230/639] clocksource/drivers/sun5i: Fail gracefully when clock rate is unavailable Greg Kroah-Hartman
2020-01-24  9:26 ` [PATCH 4.19 231/639] clocksource/drivers/exynos_mct: Fix error path in timer resources initialization Greg Kroah-Hartman
2020-01-24  9:26 ` [PATCH 4.19 232/639] platform/x86: wmi: fix potential null pointer dereference Greg Kroah-Hartman
2020-01-24  9:26 ` [PATCH 4.19 233/639] NFS/pnfs: Bulk destroy of layouts needs to be safe w.r.t. umount Greg Kroah-Hartman
2020-01-24  9:26 ` [PATCH 4.19 234/639] mmc: sdhci-brcmstb: handle mmc_of_parse() errors during probe Greg Kroah-Hartman
2020-01-24  9:26 ` [PATCH 4.19 235/639] iommu: Fix IOMMU debugfs fallout Greg Kroah-Hartman
2020-01-24  9:26 ` [PATCH 4.19 236/639] ARM: 8847/1: pm: fix HYP/SVC mode mismatch when MCPM is used Greg Kroah-Hartman
2020-01-24  9:26 ` [PATCH 4.19 237/639] ARM: 8848/1: virt: Align GIC version check with arm64 counterpart Greg Kroah-Hartman
2020-01-24  9:26 ` [PATCH 4.19 238/639] ARM: 8849/1: NOMMU: Fix encodings for PMSAv8s PRBAR4/PRLAR4 Greg Kroah-Hartman
2020-01-24  9:26 ` [PATCH 4.19 239/639] regulator: wm831x-dcdc: Fix list of wm831x_dcdc_ilim from mA to uA Greg Kroah-Hartman
2020-01-24  9:26 ` [PATCH 4.19 240/639] ath10k: Fix length of wmi tlv command for protected mgmt frames Greg Kroah-Hartman
2020-01-24  9:26 ` [PATCH 4.19 241/639] netfilter: nft_set_hash: fix lookups with fixed size hash on big endian Greg Kroah-Hartman
2020-01-24  9:26 ` [PATCH 4.19 242/639] netfilter: nft_set_hash: bogus element self comparison from deactivation path Greg Kroah-Hartman
2020-01-24  9:26 ` [PATCH 4.19 243/639] net: sched: act_csum: Fix csum calc for tagged packets Greg Kroah-Hartman
2020-01-24  9:26 ` [PATCH 4.19 244/639] hwrng: bcm2835 - fix probe as platform device Greg Kroah-Hartman
2020-01-24  9:26 ` [PATCH 4.19 245/639] iommu/vt-d: Fix NULL pointer reference in intel_svm_bind_mm() Greg Kroah-Hartman
2020-01-24  9:26 ` [PATCH 4.19 246/639] NFS: Add missing encode / decode sequence_maxsz to v4.2 operations Greg Kroah-Hartman
2020-01-24  9:26 ` [PATCH 4.19 247/639] NFSv4/flexfiles: Fix invalid deref in FF_LAYOUT_DEVID_NODE() Greg Kroah-Hartman
2020-01-24  9:26 ` [PATCH 4.19 248/639] net: aquantia: fixed instack structure overflow Greg Kroah-Hartman
2020-01-24  9:26 ` [PATCH 4.19 249/639] powerpc/mm: Check secondary hash page table Greg Kroah-Hartman
2020-01-24  9:27 ` [PATCH 4.19 250/639] media: dvb/earth-pt1: fix wrong initialization for demod blocks Greg Kroah-Hartman
2020-01-24  9:27 ` [PATCH 4.19 251/639] rbd: clear ->xferred on error from rbd_obj_issue_copyup() Greg Kroah-Hartman
2020-01-24  9:27 ` [PATCH 4.19 252/639] PCI: Fix "try" semantics of bus and slot reset Greg Kroah-Hartman
2020-01-24  9:27 ` [PATCH 4.19 253/639] nios2: ksyms: Add missing symbol exports Greg Kroah-Hartman
2020-01-24  9:27 ` [PATCH 4.19 254/639] x86/mm: Remove unused variable cpu Greg Kroah-Hartman
2020-01-24  9:27 ` [PATCH 4.19 255/639] scsi: megaraid_sas: reduce module load time Greg Kroah-Hartman
2020-01-25 16:52   ` Pavel Machek
2020-01-24  9:27 ` [PATCH 4.19 256/639] nfp: fix simple vNIC mailbox length Greg Kroah-Hartman
2020-01-24  9:27 ` [PATCH 4.19 257/639] drivers/rapidio/rio_cm.c: fix potential oops in riocm_ch_listen() Greg Kroah-Hartman
2020-01-24  9:27 ` [PATCH 4.19 258/639] xen, cpu_hotplug: Prevent an out of bounds access Greg Kroah-Hartman
2020-01-24  9:27 ` [PATCH 4.19 259/639] net/mlx5: Fix multiple updates of steering rules in parallel Greg Kroah-Hartman
2020-01-24  9:27 ` [PATCH 4.19 260/639] net/mlx5e: IPoIB, Fix RX checksum statistics update Greg Kroah-Hartman
2020-01-24  9:27 ` [PATCH 4.19 261/639] net: sh_eth: fix a missing check of of_get_phy_mode Greg Kroah-Hartman
2020-01-24  9:27 ` [PATCH 4.19 262/639] regulator: lp87565: Fix missing register for LP87565_BUCK_0 Greg Kroah-Hartman
2020-01-24  9:27 ` [PATCH 4.19 263/639] soc: amlogic: gx-socinfo: Add mask for each SoC packages Greg Kroah-Hartman
2020-01-24  9:27 ` [PATCH 4.19 264/639] media: ivtv: update *pos correctly in ivtv_read_pos() Greg Kroah-Hartman
2020-01-24  9:27 ` [PATCH 4.19 265/639] media: cx18: update *pos correctly in cx18_read_pos() Greg Kroah-Hartman
2020-01-24  9:27 ` [PATCH 4.19 266/639] media: wl128x: Fix an error code in fm_download_firmware() Greg Kroah-Hartman
2020-01-24  9:27 ` [PATCH 4.19 267/639] media: cx23885: check allocation return Greg Kroah-Hartman
2020-01-24  9:27 ` [PATCH 4.19 268/639] regulator: tps65086: Fix tps65086_ldoa1_ranges for selector 0xB Greg Kroah-Hartman
2020-01-24  9:27 ` [PATCH 4.19 269/639] crypto: ccree - reduce kernel stack usage with clang Greg Kroah-Hartman
2020-01-24  9:27 ` [PATCH 4.19 270/639] jfs: fix bogus variable self-initialization Greg Kroah-Hartman
2020-01-24  9:27 ` [PATCH 4.19 271/639] tipc: tipc clang warning Greg Kroah-Hartman
2020-01-24  9:27 ` [PATCH 4.19 272/639] m68k: mac: Fix VIA timer counter accesses Greg Kroah-Hartman
2020-01-24  9:27 ` [PATCH 4.19 273/639] ARM: dts: sun8i: a33: Reintroduce default pinctrl muxing Greg Kroah-Hartman
2020-01-24  9:27 ` [PATCH 4.19 274/639] arm64: dts: allwinner: a64: Add missing PIO clocks Greg Kroah-Hartman
2020-01-24  9:27 ` [PATCH 4.19 275/639] ARM: dts: sun9i: optimus: Fix fixed-regulators Greg Kroah-Hartman
2020-01-24  9:27 ` [PATCH 4.19 276/639] net: phy: dont clear BMCR in genphy_soft_reset Greg Kroah-Hartman
2020-01-24  9:27 ` [PATCH 4.19 277/639] ARM: OMAP2+: Fix potentially uninitialized return value for _setup_reset() Greg Kroah-Hartman
2020-01-24  9:27 ` [PATCH 4.19 278/639] net: dsa: Avoid null pointer when failing to connect to PHY Greg Kroah-Hartman
2020-01-24  9:27 ` [PATCH 4.19 279/639] soc: qcom: cmd-db: Fix an error code in cmd_db_dev_probe() Greg Kroah-Hartman
2020-01-24  9:27 ` [PATCH 4.19 280/639] media: davinci-isif: avoid uninitialized variable use Greg Kroah-Hartman
2020-01-24  9:27 ` [PATCH 4.19 281/639] media: tw5864: Fix possible NULL pointer dereference in tw5864_handle_frame Greg Kroah-Hartman
2020-01-24  9:27 ` [PATCH 4.19 282/639] spi: tegra114: clear packed bit for unpacked mode Greg Kroah-Hartman
2020-01-24  9:27 ` [PATCH 4.19 283/639] spi: tegra114: fix for unpacked mode transfers Greg Kroah-Hartman
2020-01-24  9:27 ` [PATCH 4.19 284/639] spi: tegra114: terminate dma and reset on transfer timeout Greg Kroah-Hartman
2020-01-24  9:27 ` [PATCH 4.19 285/639] spi: tegra114: flush fifos Greg Kroah-Hartman
2020-01-24  9:27 ` [PATCH 4.19 286/639] spi: tegra114: configure dma burst size to fifo trig level Greg Kroah-Hartman
2020-01-24  9:27 ` [PATCH 4.19 287/639] bus: ti-sysc: Fix sysc_unprepare() when no clocks have been allocated Greg Kroah-Hartman
2020-01-24  9:27 ` [PATCH 4.19 288/639] soc/fsl/qe: Fix an error code in qe_pin_request() Greg Kroah-Hartman
2020-01-24  9:27 ` [PATCH 4.19 289/639] spi: bcm2835aux: fix driver to not allow 65535 (=-1) cs-gpios Greg Kroah-Hartman
2020-01-24  9:27 ` [PATCH 4.19 290/639] drm/fb-helper: generic: Call drm_client_add() after setup is done Greg Kroah-Hartman
2020-01-24  9:27 ` [PATCH 4.19 291/639] arm64/vdso: dont leak kernel addresses Greg Kroah-Hartman
2020-01-24  9:27 ` [PATCH 4.19 292/639] rtc: Fix timestamp value for RTC_TIMESTAMP_BEGIN_1900 Greg Kroah-Hartman
2020-01-24  9:27 ` [PATCH 4.19 293/639] rtc: mt6397: Dont call irq_dispose_mapping Greg Kroah-Hartman
2020-01-24  9:27 ` [PATCH 4.19 294/639] ehea: Fix a copy-paste err in ehea_init_port_res Greg Kroah-Hartman
2020-01-24  9:27 ` [PATCH 4.19 295/639] bpf: Add missed newline in verifier verbose log Greg Kroah-Hartman
2020-01-24  9:27 ` [PATCH 4.19 296/639] drm/vmwgfx: Remove set but not used variable restart Greg Kroah-Hartman
2020-01-24  9:27 ` [PATCH 4.19 297/639] scsi: qla2xxx: Unregister chrdev if module initialization fails Greg Kroah-Hartman
2020-01-24  9:27 ` [PATCH 4.19 298/639] of: use correct function prototype for of_overlay_fdt_apply() Greg Kroah-Hartman
2020-01-24  9:27 ` [PATCH 4.19 299/639] net/sched: cbs: fix port_rate miscalculation Greg Kroah-Hartman
2020-01-24  9:27 ` [PATCH 4.19 300/639] clk: qcom: Skip halt checks on gcc_pcie_0_pipe_clk for 8998 Greg Kroah-Hartman
2020-01-24  9:27 ` [PATCH 4.19 301/639] ACPI: button: reinitialize button state upon resume Greg Kroah-Hartman
2020-01-24  9:27 ` [PATCH 4.19 302/639] firmware: arm_scmi: fix of_node leak in scmi_mailbox_check Greg Kroah-Hartman
2020-01-24  9:27 ` [PATCH 4.19 303/639] rxrpc: Fix detection of out of order acks Greg Kroah-Hartman
2020-01-24  9:27 ` [PATCH 4.19 304/639] scsi: target/core: Fix a race condition in the LUN lookup code Greg Kroah-Hartman
2020-01-24  9:27 ` [PATCH 4.19 305/639] brcmfmac: fix leak of mypkt on error return path Greg Kroah-Hartman
2020-01-24  9:27 ` [PATCH 4.19 306/639] ARM: pxa: ssp: Fix "WARNING: invalid free of devm_ allocated data" Greg Kroah-Hartman
2020-01-24  9:27 ` [PATCH 4.19 307/639] PCI: rockchip: Fix rockchip_pcie_ep_assert_intx() bitwise operations Greg Kroah-Hartman
2020-01-24  9:27 ` [PATCH 4.19 308/639] net: hns3: fix for vport->bw_limit overflow problem Greg Kroah-Hartman
2020-01-24  9:27 ` [PATCH 4.19 309/639] hwmon: (w83627hf) Use request_muxed_region for Super-IO accesses Greg Kroah-Hartman
2020-01-25 18:59   ` Pavel Machek
2020-01-25 19:14     ` Guenter Roeck
2020-01-24  9:28 ` [PATCH 4.19 310/639] perf/core: Fix the address filtering fix Greg Kroah-Hartman
2020-01-24  9:28 ` [PATCH 4.19 311/639] staging: android: vsoc: fix copy_from_user overrun Greg Kroah-Hartman
2020-01-24  9:28 ` [PATCH 4.19 312/639] PCI: dwc: Fix dw_pcie_ep_find_capability() to return correct capability offset Greg Kroah-Hartman
2020-01-24  9:28 ` [PATCH 4.19 313/639] soc: amlogic: meson-gx-pwrc-vpu: Fix power on/off register bitmask Greg Kroah-Hartman
2020-01-24  9:28 ` [PATCH 4.19 314/639] platform/x86: alienware-wmi: fix kfree on potentially uninitialized pointer Greg Kroah-Hartman
2020-01-24  9:28 ` [PATCH 4.19 315/639] tipc: set sysctl_tipc_rmem and named_timeout right range Greg Kroah-Hartman
2020-01-24  9:28 ` [PATCH 4.19 316/639] usb: typec: tcpm: Notify the tcpc to start connection-detection for SRPs Greg Kroah-Hartman
2020-01-24  9:28 ` [PATCH 4.19 317/639] selftests/ipc: Fix msgque compiler warnings Greg Kroah-Hartman
2020-01-24  9:28 ` [PATCH 4.19 318/639] net: hns3: fix loop condition of hns3_get_tx_timeo_queue_info() Greg Kroah-Hartman
2020-01-24  9:28 ` [PATCH 4.19 319/639] powerpc: vdso: Make vdso32 installation conditional in vdso_install Greg Kroah-Hartman
2020-01-24  9:28 ` [PATCH 4.19 320/639] ARM: dts: ls1021: Fix SGMII PCS link remaining down after PHY disconnect Greg Kroah-Hartman
2020-01-25 19:13   ` Pavel Machek
2020-01-25 20:27     ` Vladimir Oltean
2020-01-24  9:28 ` [PATCH 4.19 321/639] media: ov2659: fix unbalanced mutex_lock/unlock Greg Kroah-Hartman
2020-01-24  9:28 ` [PATCH 4.19 322/639] 6lowpan: Off by one handling ->nexthdr Greg Kroah-Hartman
2020-01-24  9:28 ` [PATCH 4.19 323/639] dmaengine: axi-dmac: Dont check the number of frames for alignment Greg Kroah-Hartman
2020-01-24  9:28 ` [PATCH 4.19 324/639] ALSA: usb-audio: Handle the error from snd_usb_mixer_apply_create_quirk() Greg Kroah-Hartman
2020-01-24  9:28 ` [PATCH 4.19 325/639] afs: Fix AFS file locking to allow fine grained locks Greg Kroah-Hartman
2020-01-26 18:57   ` Pavel Machek
2020-01-26 19:05     ` Greg Kroah-Hartman
2020-01-24  9:28 ` [PATCH 4.19 326/639] afs: Further fix file locking Greg Kroah-Hartman
2020-01-24  9:28 ` [PATCH 4.19 327/639] NFS: Dont interrupt file writeout due to fatal errors Greg Kroah-Hartman
2020-01-24  9:28 ` [PATCH 4.19 328/639] coresight: catu: fix clang build warning Greg Kroah-Hartman
2020-01-24  9:28 ` [PATCH 4.19 329/639] s390/kexec_file: Fix potential segment overlap in ELF loader Greg Kroah-Hartman
2020-01-24  9:28 ` [PATCH 4.19 330/639] irqchip/gic-v3-its: fix some definitions of inner cacheability attributes Greg Kroah-Hartman
2020-01-24  9:28 ` [PATCH 4.19 331/639] scsi: qla2xxx: Fix a format specifier Greg Kroah-Hartman
2020-01-24  9:28 ` [PATCH 4.19 332/639] scsi: qla2xxx: Fix error handling in qlt_alloc_qfull_cmd() Greg Kroah-Hartman
2020-01-24  9:28 ` [PATCH 4.19 333/639] scsi: qla2xxx: Avoid that qlt_send_resp_ctio() corrupts memory Greg Kroah-Hartman
2020-01-24  9:28 ` [PATCH 4.19 334/639] KVM: PPC: Book3S HV: Fix lockdep warning when entering the guest Greg Kroah-Hartman
2020-01-24  9:28 ` [PATCH 4.19 335/639] netfilter: nft_flow_offload: add entry to flowtable after confirmation Greg Kroah-Hartman
2020-01-24  9:28 ` [PATCH 4.19 336/639] PCI: iproc: Enable iProc config read for PAXBv2 Greg Kroah-Hartman
2020-01-24  9:28 ` [PATCH 4.19 337/639] ARM: dts: logicpd-som-lv: Fix MMC1 card detect Greg Kroah-Hartman
2020-01-24  9:28 ` [PATCH 4.19 338/639] packet: in recvmsg msg_name return at least sizeof sockaddr_ll Greg Kroah-Hartman
2020-01-24  9:28 ` [PATCH 4.19 339/639] ASoC: fix valid stream condition Greg Kroah-Hartman
2020-01-24  9:28 ` [PATCH 4.19 340/639] usb: gadget: fsl: fix link error against usb-gadget module Greg Kroah-Hartman
2020-01-24  9:28 ` [PATCH 4.19 341/639] dwc2: gadget: Fix completed transfer size calculation in DDMA Greg Kroah-Hartman
2020-01-24  9:28 ` [PATCH 4.19 342/639] IB/mlx5: Add missing XRC options to QP optional params mask Greg Kroah-Hartman
2020-01-24  9:28 ` [PATCH 4.19 343/639] RDMA/rxe: Consider skb reserve space based on netdev of GID Greg Kroah-Hartman
2020-01-24  9:28 ` [PATCH 4.19 344/639] iommu/vt-d: Make kernel parameter igfx_off work with vIOMMU Greg Kroah-Hartman
2020-01-24  9:28 ` [PATCH 4.19 345/639] net: ena: fix swapped parameters when calling ena_com_indirect_table_fill_entry Greg Kroah-Hartman
2020-01-24  9:28 ` [PATCH 4.19 346/639] net: ena: fix: Free napi resources when ena_up() fails Greg Kroah-Hartman
2020-01-24  9:28 ` [PATCH 4.19 347/639] net: ena: fix incorrect test of supported hash function Greg Kroah-Hartman
2020-01-24  9:28 ` [PATCH 4.19 348/639] net: ena: fix ena_com_fill_hash_function() implementation Greg Kroah-Hartman
2020-01-24  9:28 ` [PATCH 4.19 349/639] dmaengine: tegra210-adma: restore channel status Greg Kroah-Hartman
2020-01-24  9:28 ` [PATCH 4.19 350/639] watchdog: rtd119x_wdt: Fix remove function Greg Kroah-Hartman
2020-01-24  9:28 ` [PATCH 4.19 351/639] mmc: core: fix possible use after free of host Greg Kroah-Hartman
2020-01-24  9:28 ` [PATCH 4.19 352/639] lightnvm: pblk: fix lock order in pblk_rb_tear_down_check Greg Kroah-Hartman
2020-01-24  9:28 ` [PATCH 4.19 353/639] ath10k: Fix encoding for protected management frames Greg Kroah-Hartman
2020-01-24  9:28 ` [PATCH 4.19 354/639] afs: Fix the afs.cell and afs.volume xattr handlers Greg Kroah-Hartman
2020-01-24  9:28 ` [PATCH 4.19 355/639] vfio/mdev: Avoid release parent reference during error path Greg Kroah-Hartman
2020-01-24  9:28 ` [PATCH 4.19 356/639] vfio/mdev: Follow correct remove sequence Greg Kroah-Hartman
2020-01-24  9:28 ` [PATCH 4.19 357/639] vfio/mdev: Fix aborting mdev child device removal if one fails Greg Kroah-Hartman
2020-01-24  9:28 ` [PATCH 4.19 358/639] l2tp: Fix possible NULL pointer dereference Greg Kroah-Hartman
2020-01-24  9:28 ` [PATCH 4.19 359/639] ALSA: aica: Fix a long-time build breakage Greg Kroah-Hartman
2020-01-24  9:28 ` [PATCH 4.19 360/639] media: omap_vout: potential buffer overflow in vidioc_dqbuf() Greg Kroah-Hartman
2020-01-24  9:28 ` [PATCH 4.19 361/639] media: davinci/vpbe: array underflow in vpbe_enum_outputs() Greg Kroah-Hartman
2020-01-24  9:28 ` [PATCH 4.19 362/639] platform/x86: alienware-wmi: printing the wrong error code Greg Kroah-Hartman
2020-01-24  9:28 ` [PATCH 4.19 363/639] crypto: caam - fix caam_dump_sg that iterates through scatterlist Greg Kroah-Hartman
2020-01-24  9:28 ` [PATCH 4.19 364/639] netfilter: ebtables: CONFIG_COMPAT: reject trailing data after last rule Greg Kroah-Hartman
2020-01-24  9:28 ` [PATCH 4.19 365/639] pwm: meson: Consider 128 a valid pre-divider Greg Kroah-Hartman
2020-01-24  9:28 ` [PATCH 4.19 366/639] pwm: meson: Dont disable PWM when setting duty repeatedly Greg Kroah-Hartman
2020-01-24  9:28 ` [PATCH 4.19 367/639] ARM: riscpc: fix lack of keyboard interrupts after irq conversion Greg Kroah-Hartman
2020-01-24  9:28 ` [PATCH 4.19 368/639] nfp: bpf: fix static check error through tightening shift amount adjustment Greg Kroah-Hartman
2020-01-24  9:28 ` [PATCH 4.19 369/639] kdb: do a sanity check on the cpu in kdb_per_cpu() Greg Kroah-Hartman
2020-01-24  9:29 ` [PATCH 4.19 370/639] netfilter: nf_tables: correct NFT_LOGLEVEL_MAX value Greg Kroah-Hartman
2020-01-24  9:29 ` [PATCH 4.19 371/639] backlight: lm3630a: Return 0 on success in update_status functions Greg Kroah-Hartman
2020-01-24  9:29 ` [PATCH 4.19 372/639] thermal: rcar_gen3_thermal: fix interrupt type Greg Kroah-Hartman
2020-01-24  9:29 ` [PATCH 4.19 373/639] thermal: cpu_cooling: Actually trace CPU load in thermal_power_cpu_get_power Greg Kroah-Hartman
2020-01-24  9:29 ` [PATCH 4.19 374/639] EDAC/mc: Fix edac_mc_find() in case no device is found Greg Kroah-Hartman
2020-01-24  9:29 ` [PATCH 4.19 375/639] afs: Fix key leak in afs_release() and afs_evict_inode() Greg Kroah-Hartman
2020-01-24  9:29 ` [PATCH 4.19 376/639] afs: Dont invalidate callback if AFS_VNODE_DIR_VALID not set Greg Kroah-Hartman
2020-01-24  9:29 ` [PATCH 4.19 377/639] afs: Fix lock-wait/callback-break double locking Greg Kroah-Hartman
2020-01-24  9:29 ` [PATCH 4.19 378/639] afs: Fix double inc of vnode->cb_break Greg Kroah-Hartman
2020-01-24  9:29 ` [PATCH 4.19 379/639] ARM: dts: sun8i-h3: Fix wifi in Beelink X2 DT Greg Kroah-Hartman
2020-01-24  9:29 ` [PATCH 4.19 380/639] clk: meson: gxbb: no spread spectrum on mpll0 Greg Kroah-Hartman
2020-01-24  9:29 ` [PATCH 4.19 381/639] clk: meson: axg: spread spectrum is on mpll2 Greg Kroah-Hartman
2020-01-24  9:29 ` [PATCH 4.19 382/639] dmaengine: tegra210-adma: Fix crash during probe Greg Kroah-Hartman
2020-01-24  9:29 ` [PATCH 4.19 383/639] arm64: dts: meson: libretech-cc: set eMMC as removable Greg Kroah-Hartman
2020-01-24  9:29 ` [PATCH 4.19 384/639] RDMA/qedr: Fix incorrect device rate Greg Kroah-Hartman
2020-01-24  9:29 ` [PATCH 4.19 385/639] spi: spi-fsl-spi: call spi_finalize_current_message() at the end Greg Kroah-Hartman
2020-01-24  9:29 ` [PATCH 4.19 386/639] crypto: ccp - fix AES CFB error exposed by new test vectors Greg Kroah-Hartman
2020-01-24  9:29 ` [PATCH 4.19 387/639] crypto: ccp - Fix 3DES complaint from ccp-crypto module Greg Kroah-Hartman
2020-01-24  9:29 ` [PATCH 4.19 388/639] serial: stm32: fix word length configuration Greg Kroah-Hartman
2020-01-24  9:29 ` [PATCH 4.19 389/639] serial: stm32: fix rx error handling Greg Kroah-Hartman
2020-01-24  9:29 ` [PATCH 4.19 390/639] serial: stm32: fix rx data length when parity enabled Greg Kroah-Hartman
2020-01-24  9:29 ` [PATCH 4.19 391/639] serial: stm32: fix transmit_chars when tx is stopped Greg Kroah-Hartman
2020-01-24  9:29 ` [PATCH 4.19 392/639] serial: stm32: Add support of TC bit status check Greg Kroah-Hartman
2020-01-24  9:29 ` [PATCH 4.19 393/639] serial: stm32: fix wakeup source initialization Greg Kroah-Hartman
2020-01-24  9:29 ` [PATCH 4.19 394/639] misc: sgi-xp: Properly initialize buf in xpc_get_rsvd_page_pa Greg Kroah-Hartman
2020-01-24  9:29 ` [PATCH 4.19 395/639] PCI: PM: Avoid possible suspend-to-idle issue Greg Kroah-Hartman
2020-01-24  9:29 ` [PATCH 4.19 396/639] iommu: Add missing new line for dma type Greg Kroah-Hartman
2020-01-24  9:29 ` [PATCH 4.19 397/639] iommu: Use right function to get group for device Greg Kroah-Hartman
2020-01-24  9:29 ` [PATCH 4.19 398/639] signal/bpfilter: Fix bpfilter_kernl to use send_sig not force_sig Greg Kroah-Hartman
2020-01-24  9:29 ` [PATCH 4.19 399/639] signal/cifs: Fix cifs_put_tcp_session to call send_sig instead of force_sig Greg Kroah-Hartman
2020-01-24  9:29 ` [PATCH 4.19 400/639] inet: frags: call inet_frags_fini() after unregister_pernet_subsys() Greg Kroah-Hartman
2020-01-24  9:29 ` [PATCH 4.19 401/639] net: hns3: fix a memory leak issue for hclge_map_unmap_ring_to_vf_vector Greg Kroah-Hartman
2020-01-24  9:29 ` [PATCH 4.19 402/639] media: Staging: media: Release the correct resource in an error handling path Greg Kroah-Hartman
     [not found]   ` <1578497930.3188.1579867610896.JavaMail.www@wwinf1n19>
2020-01-24 17:33     ` Greg Kroah-Hartman
2020-01-24  9:29 ` [PATCH 4.19 403/639] crypto: talitos - fix AEAD processing Greg Kroah-Hartman
2020-01-24  9:29 ` [PATCH 4.19 404/639] netvsc: unshare skb in VF rx handler Greg Kroah-Hartman
2020-01-24  9:29 ` [PATCH 4.19 405/639] net: core: support XDP generic on stacked devices Greg Kroah-Hartman
2020-01-24  9:29 ` [PATCH 4.19 406/639] RDMA/uverbs: check for allocation failure in uapi_add_elm() Greg Kroah-Hartman
2020-01-24  9:29 ` [PATCH 4.19 407/639] net: dont clear sock->sk early to avoid trouble in strparser Greg Kroah-Hartman
2020-01-24  9:29 ` [PATCH 4.19 408/639] phy: qcom-qusb2: fix missing assignment of ret when calling clk_prepare_enable Greg Kroah-Hartman
2020-01-24  9:29 ` [PATCH 4.19 409/639] cpufreq: brcmstb-avs-cpufreq: Fix initial command check Greg Kroah-Hartman
2020-01-24  9:29 ` [PATCH 4.19 410/639] cpufreq: brcmstb-avs-cpufreq: Fix types for voltage/frequency Greg Kroah-Hartman
2020-01-24  9:29 ` [PATCH 4.19 411/639] clk: sunxi-ng: sun50i-h6-r: Fix incorrect W1 clock gate register Greg Kroah-Hartman
2020-01-24  9:29 ` [PATCH 4.19 412/639] media: vivid: fix incorrect assignment operation when setting video mode Greg Kroah-Hartman
2020-01-24  9:29 ` [PATCH 4.19 413/639] crypto: inside-secure - fix zeroing of the request in ahash_exit_inv Greg Kroah-Hartman
2020-01-24  9:29 ` [PATCH 4.19 414/639] crypto: inside-secure - fix queued len computation Greg Kroah-Hartman
2020-01-24  9:29 ` [PATCH 4.19 415/639] arm64: dts: renesas: ebisu: Remove renesas, no-ether-link property Greg Kroah-Hartman
2020-01-24  9:29 ` [PATCH 4.19 416/639] mpls: fix warning with multi-label encap Greg Kroah-Hartman
2020-01-24  9:29 ` [PATCH 4.19 417/639] serial: stm32: fix a recursive locking in stm32_config_rs485 Greg Kroah-Hartman
2020-01-24  9:29 ` [PATCH 4.19 418/639] arm64: dts: meson-gxm-khadas-vim2: fix gpio-keys-polled node Greg Kroah-Hartman
2020-01-24  9:29 ` [PATCH 4.19 419/639] arm64: dts: meson-gxm-khadas-vim2: fix Bluetooth support Greg Kroah-Hartman
2020-01-24  9:29 ` [PATCH 4.19 420/639] iommu/vt-d: Duplicate iommu_resv_region objects per device list Greg Kroah-Hartman
2020-01-24  9:29 ` [PATCH 4.19 421/639] phy: usb: phy-brcm-usb: Remove sysfs attributes upon driver removal Greg Kroah-Hartman
2020-01-24  9:29 ` [PATCH 4.19 422/639] firmware: arm_scmi: fix bitfield definitions for SENSOR_DESC attributes Greg Kroah-Hartman
2020-01-24  9:29 ` [PATCH 4.19 423/639] firmware: arm_scmi: update rate_discrete in clock_describe_rates_get Greg Kroah-Hartman
2020-01-24  9:29 ` [PATCH 4.19 424/639] ntb_hw_switchtec: potential shift wrapping bug in switchtec_ntb_init_sndev() Greg Kroah-Hartman
2020-01-24  9:29 ` [PATCH 4.19 425/639] ASoC: meson: axg-tdmin: right_j is not supported Greg Kroah-Hartman
2020-01-24  9:29 ` [PATCH 4.19 426/639] ASoC: meson: axg-tdmout: " Greg Kroah-Hartman
2020-01-24  9:29 ` [PATCH 4.19 427/639] PCI: PM: Skip devices in D0 for suspend-to-idle Greg Kroah-Hartman
2020-01-24  9:29 ` [PATCH 4.19 428/639] qed: iWARP - Use READ_ONCE and smp_store_release to access ep->state Greg Kroah-Hartman
2020-01-24  9:29 ` [PATCH 4.19 429/639] qed: iWARP - fix uninitialized callback Greg Kroah-Hartman
2020-01-24  9:30 ` [PATCH 4.19 430/639] powerpc/cacheinfo: add cacheinfo_teardown, cacheinfo_rebuild Greg Kroah-Hartman
2020-01-24  9:30 ` [PATCH 4.19 431/639] powerpc/pseries/mobility: rebuild cacheinfo hierarchy post-migration Greg Kroah-Hartman
2020-01-24  9:30 ` [PATCH 4.19 432/639] bpf: fix the check that forwarding is enabled in bpf_ipv6_fib_lookup Greg Kroah-Hartman
2020-01-24  9:30 ` [PATCH 4.19 433/639] IB/hfi1: Handle port down properly in pio Greg Kroah-Hartman
2020-01-24  9:30 ` [PATCH 4.19 434/639] drm/msm/mdp5: Fix mdp5_cfg_init error return Greg Kroah-Hartman
2020-01-24  9:30 ` [PATCH 4.19 435/639] net: netem: fix backlog accounting for corrupted GSO frames Greg Kroah-Hartman
2020-01-24  9:30 ` [PATCH 4.19 436/639] net/udp_gso: Allow TX timestamp with UDP GSO Greg Kroah-Hartman
2020-01-24  9:30 ` [PATCH 4.19 437/639] net/af_iucv: build proper skbs for HiperTransport Greg Kroah-Hartman
2020-01-24  9:30 ` [PATCH 4.19 438/639] net/af_iucv: always register net_device notifier Greg Kroah-Hartman
2020-01-24  9:30 ` [PATCH 4.19 439/639] ASoC: ti: davinci-mcasp: Fix slot mask settings when using multiple AXRs Greg Kroah-Hartman
2020-01-24  9:30 ` [PATCH 4.19 440/639] rtc: pcf8563: Fix interrupt trigger method Greg Kroah-Hartman
2020-01-24  9:30 ` [PATCH 4.19 441/639] rtc: pcf8563: Clear event flags and disable interrupts before requesting irq Greg Kroah-Hartman
2020-01-24  9:30 ` [PATCH 4.19 442/639] ARM: dts: iwg20d-q7-common: Fix SDHI1 VccQ regularor Greg Kroah-Hartman
2020-01-24  9:30 ` [PATCH 4.19 443/639] net/sched: cbs: Fix error path of cbs_module_init Greg Kroah-Hartman
2020-01-24  9:30 ` [PATCH 4.19 444/639] arm64: dts: allwinner: h6: Pine H64: Add interrupt line for RTC Greg Kroah-Hartman
2020-01-24  9:30 ` [PATCH 4.19 445/639] drm/msm/a3xx: remove TPL1 regs from snapshot Greg Kroah-Hartman
2020-01-24  9:30 ` [PATCH 4.19 446/639] ip6_fib: Dont discard nodes with valid routing information in fib6_locate_1() Greg Kroah-Hartman
2020-01-24  9:30 ` [PATCH 4.19 447/639] perf/ioctl: Add check for the sample_period value Greg Kroah-Hartman
2020-01-24  9:30   ` Greg Kroah-Hartman
2020-01-24  9:30 ` [PATCH 4.19 448/639] dmaengine: hsu: Revert "set HSU_CH_MTSR to memory width" Greg Kroah-Hartman
2020-01-24  9:30 ` [PATCH 4.19 449/639] clk: qcom: Fix -Wunused-const-variable Greg Kroah-Hartman
2020-01-24  9:30 ` [PATCH 4.19 450/639] nvmem: imx-ocotp: Ensure WAIT bits are preserved when setting timing Greg Kroah-Hartman
2020-01-24  9:30 ` [PATCH 4.19 451/639] nvmem: imx-ocotp: Change TIMING calculation to u-boot algorithm Greg Kroah-Hartman
2020-01-24  9:30 ` [PATCH 4.19 452/639] tools: bpftool: use correct argument in cgroup errors Greg Kroah-Hartman
2020-01-24  9:30 ` [PATCH 4.19 453/639] backlight: pwm_bl: Fix heuristic to determine number of brightness levels Greg Kroah-Hartman
2020-01-24  9:30 ` [PATCH 4.19 454/639] fork,memcg: alloc_thread_stack_node needs to set tsk->stack Greg Kroah-Hartman
2020-01-24  9:30 ` [PATCH 4.19 455/639] bnxt_en: Fix ethtool selftest crash under error conditions Greg Kroah-Hartman
2020-01-24  9:30 ` [PATCH 4.19 456/639] bnxt_en: Suppress error messages when querying DSCP DCB capabilities Greg Kroah-Hartman
2020-01-24  9:30 ` [PATCH 4.19 457/639] iommu/amd: Make iommu_disable safer Greg Kroah-Hartman
2020-01-24  9:30 ` [PATCH 4.19 458/639] mfd: intel-lpss: Release IDA resources Greg Kroah-Hartman
2020-01-24  9:30 ` [PATCH 4.19 459/639] rxrpc: Fix uninitialized error code in rxrpc_send_data_packet() Greg Kroah-Hartman
2020-01-24  9:30 ` [PATCH 4.19 460/639] xprtrdma: Fix use-after-free in rpcrdma_post_recvs Greg Kroah-Hartman
2020-01-24  9:30 ` [PATCH 4.19 461/639] um: Fix IRQ controller regression on console read Greg Kroah-Hartman
2020-01-24  9:30 ` [PATCH 4.19 462/639] PM: ACPI/PCI: Resume all devices during hibernation Greg Kroah-Hartman
2020-01-24  9:30 ` [PATCH 4.19 463/639] ACPI: PM: Simplify and fix PM domain hibernation callbacks Greg Kroah-Hartman
2020-01-24  9:30 ` [PATCH 4.19 464/639] ACPI: PM: Introduce "poweroff" callbacks for ACPI PM domain and LPSS Greg Kroah-Hartman
2020-01-24  9:30 ` [PATCH 4.19 465/639] fsi/core: Fix error paths on CFAM init Greg Kroah-Hartman
2020-01-24  9:30 ` [PATCH 4.19 466/639] devres: allow const resource arguments Greg Kroah-Hartman
2020-01-24  9:30 ` [PATCH 4.19 467/639] fsi: sbefifo: Dont fail operations when in SBE IPL state Greg Kroah-Hartman
2020-01-24  9:30 ` [PATCH 4.19 468/639] RDMA/hns: Fixs hw access invalid dma memory error Greg Kroah-Hartman
2020-01-24  9:30 ` [PATCH 4.19 469/639] PCI: mobiveil: Remove the flag MSI_FLAG_MULTI_PCI_MSI Greg Kroah-Hartman
2020-01-24  9:30 ` [PATCH 4.19 470/639] PCI: mobiveil: Fix devfn check in mobiveil_pcie_valid_device() Greg Kroah-Hartman
2020-01-24  9:30 ` [PATCH 4.19 471/639] PCI: mobiveil: Fix the valid check for inbound and outbound windows Greg Kroah-Hartman
2020-01-24  9:30 ` [PATCH 4.19 472/639] ceph: fix "ceph.dir.rctime" vxattr value Greg Kroah-Hartman
2020-01-24  9:30 ` [PATCH 4.19 473/639] net: pasemi: fix an use-after-free in pasemi_mac_phy_init() Greg Kroah-Hartman
2020-01-24  9:30 ` [PATCH 4.19 474/639] net/tls: fix socket wmem accounting on fallback with netem Greg Kroah-Hartman
2020-01-24  9:30 ` [PATCH 4.19 475/639] x86/pgtable/32: Fix LOWMEM_PAGES constant Greg Kroah-Hartman
2020-01-24  9:30 ` [PATCH 4.19 476/639] xdp: fix possible cq entry leak Greg Kroah-Hartman
2020-01-24  9:30 ` [PATCH 4.19 477/639] ARM: stm32: use "depends on" instead of "if" after prompt Greg Kroah-Hartman
2020-01-24  9:30 ` [PATCH 4.19 478/639] scsi: libfc: fix null pointer dereference on a null lport Greg Kroah-Hartman
2020-01-24  9:30 ` [PATCH 4.19 479/639] xfrm interface: ifname may be wrong in logs Greg Kroah-Hartman
2020-01-24  9:30 ` [PATCH 4.19 480/639] drm/panel: make drm_panel.h self-contained Greg Kroah-Hartman
2020-01-24  9:30 ` [PATCH 4.19 481/639] clk: sunxi-ng: v3s: add the missing PLL_DDR1 Greg Kroah-Hartman
2020-01-24  9:30 ` [PATCH 4.19 482/639] PM: sleep: Fix possible overflow in pm_system_cancel_wakeup() Greg Kroah-Hartman
2020-01-24  9:30 ` [PATCH 4.19 483/639] libertas_tf: Use correct channel range in lbtf_geo_init Greg Kroah-Hartman
2020-01-24  9:30 ` [PATCH 4.19 484/639] qed: reduce maximum stack frame size Greg Kroah-Hartman
2020-01-24  9:30 ` [PATCH 4.19 485/639] usb: host: xhci-hub: fix extra endianness conversion Greg Kroah-Hartman
2020-01-24  9:30 ` [PATCH 4.19 486/639] media: rcar-vin: Clean up correct notifier in error path Greg Kroah-Hartman
2020-01-24  9:30 ` [PATCH 4.19 487/639] mic: avoid statically declaring a struct device Greg Kroah-Hartman
2020-01-24  9:30 ` [PATCH 4.19 488/639] x86/kgbd: Use NMI_VECTOR not APIC_DM_NMI Greg Kroah-Hartman
2020-01-24  9:30 ` [PATCH 4.19 489/639] crypto: ccp - Reduce maximum stack usage Greg Kroah-Hartman
2020-01-24  9:31 ` [PATCH 4.19 490/639] ALSA: aoa: onyx: always initialize register read value Greg Kroah-Hartman
2020-01-24  9:31 ` [PATCH 4.19 491/639] arm64: dts: renesas: r8a77995: Fix register range of display node Greg Kroah-Hartman
2020-01-24  9:31 ` [PATCH 4.19 492/639] tipc: reduce risk of wakeup queue starvation Greg Kroah-Hartman
2020-01-24  9:31 ` [PATCH 4.19 493/639] ARM: dts: stm32: add missing vdda-supply to adc on stm32h743i-eval Greg Kroah-Hartman
2020-01-24  9:31 ` [PATCH 4.19 494/639] net/mlx5: Fix mlx5_ifc_query_lag_out_bits Greg Kroah-Hartman
2020-01-24  9:31 ` [PATCH 4.19 495/639] cifs: fix rmmod regression in cifs.ko caused by force_sig changes Greg Kroah-Hartman
2020-01-24  9:31 ` [PATCH 4.19 496/639] iio: tsl2772: Use devm_add_action_or_reset for tsl2772_chip_off Greg Kroah-Hartman
2020-01-24  9:31 ` [PATCH 4.19 497/639] net: fix bpf_xdp_adjust_head regression for generic-XDP Greg Kroah-Hartman
2020-01-24  9:31 ` [PATCH 4.19 498/639] spi: bcm-qspi: Fix BSPI QUAD and DUAL mode support when using flex mode Greg Kroah-Hartman
2020-01-24  9:31 ` [PATCH 4.19 499/639] cxgb4: smt: Add lock for atomic_dec_and_test Greg Kroah-Hartman
2020-01-24  9:31 ` [PATCH 4.19 500/639] crypto: caam - free resources in case caam_rng registration failed Greg Kroah-Hartman
2020-01-24  9:31 ` [PATCH 4.19 501/639] ext4: set error return correctly when ext4_htree_store_dirent fails Greg Kroah-Hartman
2020-01-24  9:31 ` [PATCH 4.19 502/639] RDMA/hns: Bugfix for slab-out-of-bounds when unloading hip08 driver Greg Kroah-Hartman
2020-01-24  9:31 ` [PATCH 4.19 503/639] RDMA/hns: bugfix for slab-out-of-bounds when loading " Greg Kroah-Hartman
2020-01-24  9:31 ` [PATCH 4.19 504/639] ASoC: es8328: Fix copy-paste error in es8328_right_line_controls Greg Kroah-Hartman
2020-01-24  9:31 ` [PATCH 4.19 505/639] ASoC: cs4349: Use PM ops cs4349_runtime_pm Greg Kroah-Hartman
2020-01-24  9:31 ` [PATCH 4.19 506/639] ASoC: wm8737: Fix copy-paste error in wm8737_snd_controls Greg Kroah-Hartman
2020-01-24  9:31 ` [PATCH 4.19 507/639] net/rds: Add a few missing rds_stat_names entries Greg Kroah-Hartman
2020-01-24  9:31 ` [PATCH 4.19 508/639] tools: bpftool: fix arguments for p_err() in do_event_pipe() Greg Kroah-Hartman
2020-01-24  9:31 ` [PATCH 4.19 509/639] tools: bpftool: fix format strings and arguments for jsonw_printf() Greg Kroah-Hartman
2020-01-24  9:31 ` [PATCH 4.19 510/639] drm: rcar-du: lvds: Fix bridge_to_rcar_lvds Greg Kroah-Hartman
2020-01-24  9:31 ` [PATCH 4.19 511/639] bnxt_en: Fix handling FRAG_ERR when NVM_INSTALL_UPDATE cmd fails Greg Kroah-Hartman
2020-01-24  9:31 ` [PATCH 4.19 512/639] signal: Allow cifs and drbd to receive their terminating signals Greg Kroah-Hartman
2020-01-24  9:31 ` [PATCH 4.19 513/639] powerpc/64s/radix: Fix memory hot-unplug page table split Greg Kroah-Hartman
2020-01-24  9:31 ` [PATCH 4.19 514/639] ASoC: sun4i-i2s: RX and TX counter registers are swapped Greg Kroah-Hartman
2020-01-24  9:31 ` [PATCH 4.19 515/639] dmaengine: dw: platform: Switch to acpi_dma_controller_register() Greg Kroah-Hartman
2020-01-24  9:31 ` [PATCH 4.19 516/639] rtc: rv3029: revert error handling patch to rv3029_eeprom_write() Greg Kroah-Hartman
2020-01-24  9:31 ` [PATCH 4.19 517/639] mac80211: minstrel_ht: fix per-group max throughput rate initialization Greg Kroah-Hartman
2020-01-24  9:31 ` [PATCH 4.19 518/639] i40e: reduce stack usage in i40e_set_fc Greg Kroah-Hartman
2020-01-24  9:31 ` [PATCH 4.19 519/639] media: atmel: atmel-isi: fix timeout value for stop streaming Greg Kroah-Hartman
2020-01-24  9:31 ` [PATCH 4.19 520/639] ARM: 8896/1: VDSO: Dont leak kernel addresses Greg Kroah-Hartman
2020-01-24  9:31 ` [PATCH 4.19 521/639] rtc: pcf2127: bugfix: read rtc disables watchdog Greg Kroah-Hartman
2020-01-26 10:26   ` Pavel Machek
2020-01-26 13:19     ` Greg Kroah-Hartman
2020-01-24  9:31 ` [PATCH 4.19 522/639] mips: avoid explicit UB in assignment of mips_io_port_base Greg Kroah-Hartman
2020-01-24  9:31 ` [PATCH 4.19 523/639] media: em28xx: Fix exception handling in em28xx_alloc_urbs() Greg Kroah-Hartman
2020-01-24  9:31 ` [PATCH 4.19 524/639] iommu/mediatek: Fix iova_to_phys PA start for 4GB mode Greg Kroah-Hartman
2020-01-24  9:31 ` [PATCH 4.19 525/639] ahci: Do not export local variable ahci_em_messages Greg Kroah-Hartman
2020-01-24  9:31 ` [PATCH 4.19 526/639] rxrpc: Fix lack of conn cleanup when local endpoint is cleaned up [ver #2] Greg Kroah-Hartman
2020-01-24  9:31 ` [PATCH 4.19 527/639] Partially revert "kfifo: fix kfifo_alloc() and kfifo_init()" Greg Kroah-Hartman
2020-01-24  9:31 ` [PATCH 4.19 528/639] hwmon: (lm75) Fix write operations for negative temperatures Greg Kroah-Hartman
2020-01-24  9:31 ` [PATCH 4.19 529/639] net/sched: cbs: Set default link speed to 10 Mbps in cbs_set_port_rate Greg Kroah-Hartman
2020-01-24  9:31 ` [PATCH 4.19 530/639] power: supply: Init device wakeup after device_add() Greg Kroah-Hartman
2020-01-24  9:31 ` [PATCH 4.19 531/639] x86, perf: Fix the dependency of the x86 insn decoder selftest Greg Kroah-Hartman
2020-01-24  9:31 ` [PATCH 4.19 532/639] staging: greybus: light: fix a couple double frees Greg Kroah-Hartman
2020-01-24  9:31 ` [PATCH 4.19 533/639] irqdomain: Add the missing assignment of domain->fwnode for named fwnode Greg Kroah-Hartman
2020-01-24  9:31 ` [PATCH 4.19 534/639] bcma: fix incorrect update of BCMA_CORE_PCI_MDIO_DATA Greg Kroah-Hartman
2020-01-24  9:31 ` [PATCH 4.19 535/639] usb: typec: tps6598x: Fix build error without CONFIG_REGMAP_I2C Greg Kroah-Hartman
2020-01-24  9:31 ` [PATCH 4.19 536/639] bcache: Fix an error code in bch_dump_read() Greg Kroah-Hartman
2020-01-24  9:31 ` [PATCH 4.19 537/639] iio: dac: ad5380: fix incorrect assignment to val Greg Kroah-Hartman
2020-01-24  9:31 ` [PATCH 4.19 538/639] netfilter: ctnetlink: honor IPS_OFFLOAD flag Greg Kroah-Hartman
2020-01-24  9:31 ` [PATCH 4.19 539/639] ath9k: dynack: fix possible deadlock in ath_dynack_node_{de}init Greg Kroah-Hartman
2020-01-24  9:31 ` [PATCH 4.19 540/639] wcn36xx: use dynamic allocation for large variables Greg Kroah-Hartman
2020-01-26 11:36   ` Pavel Machek
2020-01-24  9:31 ` [PATCH 4.19 541/639] tty: serial: fsl_lpuart: Use appropriate lpuart32_* I/O funcs Greg Kroah-Hartman
2020-01-24  9:31 ` [PATCH 4.19 542/639] ARM: dts: aspeed-g5: Fixe gpio-ranges upper limit Greg Kroah-Hartman
2020-01-24  9:31 ` [PATCH 4.19 543/639] xsk: avoid store-tearing when assigning queues Greg Kroah-Hartman
2020-01-24  9:31 ` [PATCH 4.19 544/639] xsk: avoid store-tearing when assigning umem Greg Kroah-Hartman
2020-01-24  9:31 ` [PATCH 4.19 545/639] led: triggers: Fix dereferencing of null pointer Greg Kroah-Hartman
2020-01-24  9:31 ` [PATCH 4.19 546/639] net: sonic: return NETDEV_TX_OK if failed to map buffer Greg Kroah-Hartman
2020-01-24  9:31 ` [PATCH 4.19 547/639] net: hns3: fix error VF index when setting VLAN offload Greg Kroah-Hartman
2020-01-24  9:31 ` [PATCH 4.19 548/639] rtlwifi: Fix file release memory leak Greg Kroah-Hartman
2020-01-24  9:31 ` [PATCH 4.19 549/639] ARM: dts: logicpd-som-lv: Fix i2c2 and i2c3 Pin mux Greg Kroah-Hartman
2020-01-24  9:32 ` [PATCH 4.19 550/639] f2fs: fix wrong error injection path in inc_valid_block_count() Greg Kroah-Hartman
2020-01-24  9:32 ` [PATCH 4.19 551/639] f2fs: fix error path of f2fs_convert_inline_page() Greg Kroah-Hartman
2020-01-24  9:32 ` [PATCH 4.19 552/639] scsi: fnic: fix msix interrupt allocation Greg Kroah-Hartman
2020-01-24  9:32 ` [PATCH 4.19 553/639] Btrfs: fix hang when loading existing inode cache off disk Greg Kroah-Hartman
2020-01-24  9:32 ` [PATCH 4.19 554/639] Btrfs: fix inode cache waiters hanging on failure to start caching thread Greg Kroah-Hartman
2020-01-24  9:32 ` [PATCH 4.19 555/639] Btrfs: fix inode cache waiters hanging on path allocation failure Greg Kroah-Hartman
2020-01-24  9:32 ` [PATCH 4.19 556/639] btrfs: use correct count in btrfs_file_write_iter() Greg Kroah-Hartman
2020-01-24  9:32 ` [PATCH 4.19 557/639] ixgbe: sync the first fragment unconditionally Greg Kroah-Hartman
2020-01-24  9:32 ` [PATCH 4.19 558/639] hwmon: (shtc1) fix shtc1 and shtw1 id mask Greg Kroah-Hartman
2020-01-24  9:32 ` [PATCH 4.19 559/639] net: sonic: replace dev_kfree_skb in sonic_send_packet Greg Kroah-Hartman
2020-01-24  9:32 ` [PATCH 4.19 560/639] pinctrl: iproc-gpio: Fix incorrect pinconf configurations Greg Kroah-Hartman
2020-01-24  9:32 ` [PATCH 4.19 561/639] gpio/aspeed: Fix incorrect number of banks Greg Kroah-Hartman
2020-01-24  9:32 ` [PATCH 4.19 562/639] ath10k: adjust skb length in ath10k_sdio_mbox_rx_packet Greg Kroah-Hartman
2020-01-24  9:32 ` [PATCH 4.19 563/639] RDMA/cma: Fix false error message Greg Kroah-Hartman
2020-01-24  9:32 ` [PATCH 4.19 564/639] net/rds: Fix ib_evt_handler_call element in rds_ib_stat_names Greg Kroah-Hartman
2020-01-24  9:32 ` [PATCH 4.19 565/639] um: Fix off by one error in IRQ enumeration Greg Kroah-Hartman
2020-01-24  9:32 ` [PATCH 4.19 566/639] bnxt_en: Increase timeout for HWRM_DBG_COREDUMP_XX commands Greg Kroah-Hartman
2020-01-24  9:32 ` [PATCH 4.19 567/639] f2fs: fix to avoid accessing uninitialized field of inode page in is_alive() Greg Kroah-Hartman
2020-01-24  9:32 ` [PATCH 4.19 568/639] mailbox: qcom-apcs: fix max_register value Greg Kroah-Hartman
2020-01-24  9:32 ` [PATCH 4.19 569/639] clk: actions: Fix factor clk struct member access Greg Kroah-Hartman
2020-01-24  9:32 ` [PATCH 4.19 570/639] powerpc/mm/mce: Keep irqs disabled during lockless page table walk Greg Kroah-Hartman
2020-01-24  9:32 ` [PATCH 4.19 571/639] bpf: fix BTF limits Greg Kroah-Hartman
2020-01-24  9:32 ` [PATCH 4.19 572/639] crypto: hisilicon - Matching the dma address for dma_pool_free() Greg Kroah-Hartman
2020-01-24  9:32 ` [PATCH 4.19 573/639] iommu/amd: Wait for completion of IOTLB flush in attach_device Greg Kroah-Hartman
2020-01-24  9:32 ` [PATCH 4.19 574/639] net: aquantia: Fix aq_vec_isr_legacy() return value Greg Kroah-Hartman
2020-01-24  9:32 ` [PATCH 4.19 575/639] cxgb4: Signedness bug in init_one() Greg Kroah-Hartman
2020-01-24  9:32 ` [PATCH 4.19 576/639] net: hisilicon: Fix signedness bug in hix5hd2_dev_probe() Greg Kroah-Hartman
2020-01-24  9:32 ` [PATCH 4.19 577/639] net: broadcom/bcmsysport: Fix signedness in bcm_sysport_probe() Greg Kroah-Hartman
2020-01-24  9:32 ` [PATCH 4.19 578/639] net: netsec: Fix signedness bug in netsec_probe() Greg Kroah-Hartman
2020-01-24  9:32 ` [PATCH 4.19 579/639] net: socionext: Fix a signedness bug in ave_probe() Greg Kroah-Hartman
2020-01-24  9:32 ` [PATCH 4.19 580/639] net: stmmac: dwmac-meson8b: Fix signedness bug in probe Greg Kroah-Hartman
2020-01-24  9:32 ` [PATCH 4.19 581/639] net: axienet: fix a " Greg Kroah-Hartman
2020-01-24  9:32 ` [PATCH 4.19 582/639] of: mdio: Fix a signedness bug in of_phy_get_and_connect() Greg Kroah-Hartman
2020-01-24  9:32 ` [PATCH 4.19 583/639] net: nixge: Fix a signedness bug in nixge_probe() Greg Kroah-Hartman
2020-01-24  9:32 ` [PATCH 4.19 584/639] net: ethernet: stmmac: Fix signedness bug in ipq806x_gmac_of_parse() Greg Kroah-Hartman
2020-01-24  9:32 ` [PATCH 4.19 585/639] net: sched: cbs: Avoid division by zero when calculating the port rate Greg Kroah-Hartman
2020-01-24  9:32 ` [PATCH 4.19 586/639] nvme: retain split access workaround for capability reads Greg Kroah-Hartman
2020-01-24  9:32 ` [PATCH 4.19 587/639] net: stmmac: gmac4+: Not all Unicast addresses may be available Greg Kroah-Hartman
2020-01-26 16:50   ` Pavel Machek
2020-01-24  9:32 ` [PATCH 4.19 588/639] rxrpc: Fix trace-after-put looking at the put connection record Greg Kroah-Hartman
2020-01-24  9:32 ` [PATCH 4.19 589/639] mac80211: accept deauth frames in IBSS mode Greg Kroah-Hartman
2020-01-24  9:32 ` [PATCH 4.19 590/639] llc: fix another potential sk_buff leak in llc_ui_sendmsg() Greg Kroah-Hartman
2020-01-24  9:32 ` [PATCH 4.19 591/639] llc: fix sk_buff refcounting in llc_conn_state_process() Greg Kroah-Hartman
2020-01-24  9:32 ` [PATCH 4.19 592/639] ip6erspan: remove the incorrect mtu limit for ip6erspan Greg Kroah-Hartman
2020-01-24  9:32 ` [PATCH 4.19 593/639] net: stmmac: fix length of PTP clocks name string Greg Kroah-Hartman
2020-01-24  9:32 ` [PATCH 4.19 594/639] net: stmmac: fix disabling flexible PPS output Greg Kroah-Hartman
2020-01-24  9:32 ` [PATCH 4.19 595/639] sctp: add chunks to sk_backlog when the newsk sk_socket is not set Greg Kroah-Hartman
2020-01-24  9:32 ` [PATCH 4.19 596/639] s390/qeth: Fix error handling during VNICC initialization Greg Kroah-Hartman
2020-01-24  9:32 ` [PATCH 4.19 597/639] s390/qeth: Fix initialization of vnicc cmd masks during set online Greg Kroah-Hartman
2020-01-24  9:32 ` [PATCH 4.19 598/639] act_mirred: Fix mirred_init_module error handling Greg Kroah-Hartman
2020-01-24  9:32 ` [PATCH 4.19 599/639] net: avoid possible false sharing in sk_leave_memory_pressure() Greg Kroah-Hartman
2020-01-26 17:15   ` Pavel Machek
2020-01-26 19:03     ` Eric Dumazet
2020-01-24  9:32 ` [PATCH 4.19 600/639] net: add {READ|WRITE}_ONCE() annotations on ->rskq_accept_head Greg Kroah-Hartman
2020-01-24  9:32 ` [PATCH 4.19 601/639] tcp: annotate lockless access to tcp_memory_pressure Greg Kroah-Hartman
2020-01-24  9:32 ` [PATCH 4.19 602/639] net/smc: receive returns without data Greg Kroah-Hartman
2020-01-24  9:32 ` [PATCH 4.19 603/639] net/smc: receive pending data after RCV_SHUTDOWN Greg Kroah-Hartman
2020-01-24  9:32 ` [PATCH 4.19 604/639] drm/msm/dsi: Implement reset correctly Greg Kroah-Hartman
2020-01-24  9:32 ` [PATCH 4.19 605/639] vhost/test: stop device before reset Greg Kroah-Hartman
2020-01-24  9:32 ` [PATCH 4.19 606/639] dmaengine: imx-sdma: fix size check for sdma script_number Greg Kroah-Hartman
2020-01-24  9:32 ` [PATCH 4.19 607/639] firmware: dmi: Fix unlikely out-of-bounds read in save_mem_devices Greg Kroah-Hartman
2020-01-24  9:32 ` [PATCH 4.19 608/639] arm64: hibernate: check pgd table allocation Greg Kroah-Hartman
2020-01-24  9:32 ` [PATCH 4.19 609/639] net: netem: fix error path for corrupted GSO frames Greg Kroah-Hartman
2020-01-24  9:33 ` [PATCH 4.19 610/639] net: netem: correct the parents backlog when corrupted packet was dropped Greg Kroah-Hartman
2020-01-24  9:33 ` [PATCH 4.19 611/639] xsk: Fix registration of Rx-only sockets Greg Kroah-Hartman
2020-01-24  9:33 ` [PATCH 4.19 612/639] bpf, offload: Unlock on error in bpf_offload_dev_create() Greg Kroah-Hartman
2020-01-24  9:33 ` [PATCH 4.19 613/639] afs: Fix missing timeout reset Greg Kroah-Hartman
2020-01-24  9:33 ` [PATCH 4.19 614/639] net: qca_spi: Move reset_count to struct qcaspi Greg Kroah-Hartman
2020-01-24  9:33 ` [PATCH 4.19 615/639] hv_netvsc: Fix offset usage in netvsc_send_table() Greg Kroah-Hartman
2020-01-24  9:33 ` [PATCH 4.19 616/639] hv_netvsc: Fix send_table offset in case of a host bug Greg Kroah-Hartman
2020-01-24  9:33 ` [PATCH 4.19 617/639] afs: Fix large file support Greg Kroah-Hartman
2020-01-24  9:33 ` [PATCH 4.19 618/639] drm: panel-lvds: Potential Oops in probe error handling Greg Kroah-Hartman
2020-01-24  9:33 ` [PATCH 4.19 619/639] hwrng: omap3-rom - Fix missing clock by probing with device tree Greg Kroah-Hartman
2020-01-24  9:33 ` [PATCH 4.19 620/639] dpaa_eth: perform DMA unmapping before read Greg Kroah-Hartman
2020-01-24  9:33 ` [PATCH 4.19 621/639] dpaa_eth: avoid timestamp read on error paths Greg Kroah-Hartman
2020-01-24  9:33 ` [PATCH 4.19 622/639] MIPS: Loongson: Fix return value of loongson_hwmon_init Greg Kroah-Hartman
2020-01-24  9:33 ` [PATCH 4.19 623/639] hv_netvsc: flag software created hash value Greg Kroah-Hartman
2020-01-24  9:33 ` [PATCH 4.19 624/639] net: neigh: use long type to store jiffies delta Greg Kroah-Hartman
2020-01-24  9:33 ` [PATCH 4.19 625/639] packet: fix data-race in fanout_flow_is_huge() Greg Kroah-Hartman
2020-01-26 18:29   ` Pavel Machek
2020-01-26 18:38     ` Eric Dumazet
2020-01-24  9:33 ` [PATCH 4.19 626/639] i2c: stm32f7: report dma error during probe Greg Kroah-Hartman
2020-01-24  9:33 ` [PATCH 4.19 627/639] mmc: sdio: fix wl1251 vendor id Greg Kroah-Hartman
2020-01-24  9:33 ` [PATCH 4.19 628/639] mmc: core: fix wl1251 sdio quirks Greg Kroah-Hartman
2020-01-24  9:33 ` [PATCH 4.19 629/639] affs: fix a memory leak in affs_remount Greg Kroah-Hartman
2020-01-24  9:33 ` [PATCH 4.19 630/639] afs: Remove set but not used variables before, after Greg Kroah-Hartman
2020-01-24  9:33 ` [PATCH 4.19 631/639] dmaengine: ti: edma: fix missed failure handling Greg Kroah-Hartman
2020-01-24  9:33 ` [PATCH 4.19 632/639] drm/radeon: fix bad DMA from INTERRUPT_CNTL2 Greg Kroah-Hartman
2020-01-24  9:33 ` [PATCH 4.19 633/639] arm64: dts: juno: Fix UART frequency Greg Kroah-Hartman
2020-01-24  9:33 ` [PATCH 4.19 634/639] samples/bpf: Fix broken xdp_rxq_info due to map order assumptions Greg Kroah-Hartman
2020-01-24  9:33 ` [PATCH 4.19 635/639] usb: dwc3: Allow building USB_DWC3_QCOM without EXTCON Greg Kroah-Hartman
2020-01-24  9:33 ` [PATCH 4.19 636/639] IB/iser: Fix dma_nents type definition Greg Kroah-Hartman
2020-01-24  9:33 ` [PATCH 4.19 637/639] serial: stm32: fix clearing interrupt error flags Greg Kroah-Hartman
2020-01-24  9:33 ` [PATCH 4.19 638/639] arm64: dts: meson-gxm-khadas-vim2: fix uart_A bluetooth node Greg Kroah-Hartman
2020-01-24  9:33 ` [PATCH 4.19 639/639] m68k: Call timer_interrupt() with interrupts disabled Greg Kroah-Hartman
2020-01-24 14:50 ` [PATCH 4.19 000/639] 4.19.99-stable review Jon Hunter
2020-01-24 14:50   ` Jon Hunter
2020-01-24 17:36   ` Greg Kroah-Hartman
2020-01-24 18:07     ` Jon Hunter
2020-01-24 18:07       ` Jon Hunter
     [not found]       ` <8a782263-aca3-3846-12a0-4eb21f015894-DDmLM1+adcrQT0dZR+AlfA@public.gmane.org>
2020-01-25 11:32         ` Jon Hunter
2020-01-25 11:32           ` Jon Hunter
     [not found]           ` <87fcb1f0-b1b8-a6e2-b8f6-b95a07f67919-DDmLM1+adcrQT0dZR+AlfA@public.gmane.org>
2020-01-25 15:46             ` Guenter Roeck
2020-01-25 15:46               ` Guenter Roeck
2020-01-26  9:13               ` Greg Kroah-Hartman
2020-01-27  9:38                 ` Jon Hunter
2020-01-27  9:38                   ` Jon Hunter
2020-01-27  9:41                   ` Greg Kroah-Hartman
2020-01-24 17:27 ` Naresh Kamboju
2020-01-24 21:48 ` shuah
2020-01-24 23:55 ` Guenter Roeck
2020-01-25  8:24   ` Jon Hunter
2020-01-25  9:25     ` Guenter Roeck
2020-01-25 11:27       ` Jon Hunter

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.