LKML Archive on lore.kernel.org
 help / color / Atom feed
* [PATCH 5.3 000/135] 5.3.15-stable review
@ 2019-12-03 22:34 Greg Kroah-Hartman
  2019-12-03 22:34 ` [PATCH 5.3 001/135] io_uring: async workers should inherit the user creds Greg Kroah-Hartman
                   ` (138 more replies)
  0 siblings, 139 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, torvalds, akpm, linux, shuah, patches,
	ben.hutchings, lkft-triage, stable

This is the start of the stable review cycle for the 5.3.15 release.
There are 135 patches in this series, all will be posted as a response
to this one.  If anyone has any issues with these being applied, please
let me know.

Responses should be made by Thu, 05 Dec 2019 21:20:36 +0000.
Anything received after that time might be too late.

The whole patch series can be found in one patch at:
	https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.3.15-rc1.gz
or in the git tree and branch at:
	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.3.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Linux 5.3.15-rc1

Hans de Goede <hdegoede@redhat.com>
    platform/x86: hp-wmi: Fix ACPI errors caused by passing 0 as input size

Hans de Goede <hdegoede@redhat.com>
    platform/x86: hp-wmi: Fix ACPI errors caused by too small buffer

Candle Sun <candle.sun@unisoc.com>
    HID: core: check whether Usage Page item is after Usage ID items

Theodore Ts'o <tytso@mit.edu>
    ext4: add more paranoia checking in ext4_expand_extra_isize handling

Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
    selftests: pmtu: use -oneline for ip route list cache

John Rutherford <john.rutherford@dektech.com.au>
    tipc: fix link name length check

Jakub Kicinski <jakub.kicinski@netronome.com>
    selftests: bpf: correct perror strings

Jakub Kicinski <jakub.kicinski@netronome.com>
    selftests: bpf: test_sockmap: handle file creation failures gracefully

Jakub Kicinski <jakub.kicinski@netronome.com>
    net/tls: use sg_next() to walk sg entries

Jakub Kicinski <jakub.kicinski@netronome.com>
    net/tls: remove the dead inplace_crypto code

Jakub Kicinski <jakub.kicinski@netronome.com>
    selftests/tls: add a test for fragmented messages

Jakub Kicinski <jakub.kicinski@netronome.com>
    net: skmsg: fix TLS 1.3 crash with full sk_msg

Jakub Kicinski <jakub.kicinski@netronome.com>
    net/tls: free the record on encryption error

Jakub Kicinski <jakub.kicinski@netronome.com>
    net/tls: take into account that bpf_exec_tx_verdict() may free the record

Paolo Abeni <pabeni@redhat.com>
    openvswitch: remove another BUG_ON()

Paolo Abeni <pabeni@redhat.com>
    openvswitch: drop unneeded BUG_ON() in ovs_flow_cmd_build_info()

Xin Long <lucien.xin@gmail.com>
    sctp: cache netns in sctp_ep_common

Jouni Hogander <jouni.hogander@unikie.com>
    slip: Fix use-after-free Read in slip_open

Navid Emamdoost <navid.emamdoost@gmail.com>
    sctp: Fix memory leak in sctp_sf_do_5_2_4_dupcook

Paolo Abeni <pabeni@redhat.com>
    openvswitch: fix flow command message size

Dust Li <dust.li@linux.alibaba.com>
    net: sched: fix `tc -s class show` no bstats on class with nolock subqueues

Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
    net: psample: fix skb_over_panic

Chuhong Yuan <hslester96@gmail.com>
    net: macb: add missed tasklet_kill

Oleksij Rempel <linux@rempel-privat.de>
    net: dsa: sja1105: fix sja1105_parse_rgmii_delays()

David Bauer <mail@david-bauer.net>
    mdio_bus: don't use managed reset-controller

Menglong Dong <dong.menglong@zte.com.cn>
    macvlan: schedule bc_work even if error

Jeroen de Borst <jeroendb@google.com>
    gve: Fix the queue page list allocated pages count

Sebastian Andrzej Siewior <bigeasy@linutronix.de>
    x86/fpu: Don't cache access to fpu_fpregs_owner_ctx

Steffen Klassert <steffen.klassert@secunet.com>
    xfrm: Fix memleak on xfrm state destroy

Mika Westerberg <mika.westerberg@linux.intel.com>
    thunderbolt: Power cycle the router if NVM authentication fails

Alexander Usyskin <alexander.usyskin@intel.com>
    mei: me: add comet point V device id

Alexander Usyskin <alexander.usyskin@intel.com>
    mei: bus: prefix device names on bus with the bus name

Fabio D'Urso <fabiodurso@hotmail.it>
    USB: serial: ftdi_sio: add device IDs for U-Blox C099-F9P

Hans de Goede <hdegoede@redhat.com>
    staging: rtl8723bs: Add 024c:0525 to the list of SDIO device-ids

Hans de Goede <hdegoede@redhat.com>
    staging: rtl8723bs: Drop ACPI device ids

Pan Bian <bianpan2016@163.com>
    staging: rtl8192e: fix potential use after free

Ajay Singh <ajay.kathat@microchip.com>
    staging: wilc1000: fix illegal memory access in wilc_parse_join_bss_param()

Mathias Kresin <dev@kresin.me>
    usb: dwc2: use a longer core rest timeout in dwc2_core_reset()

Eugen Hristev <eugen.hristev@microchip.com>
    clk: at91: fix update bit maps on CFG_MOR write

Arkadiusz Kubalewski <arkadiusz.kubalewski@intel.com>
    i40e: Fix for ethtool -m issue on X722 NIC

Nicholas Nunley <nicholas.d.nunley@intel.com>
    iavf: initialize ITRN registers with correct values

Colin Ian King <colin.king@canonical.com>
    ice: fix potential infinite loop because loop counter being too small

Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
    pwm: bcm-iproc: Prevent unloading the driver module while in use

Dan Carpenter <dan.carpenter@oracle.com>
    block: drbd: remove a stray unlock in __drbd_send_protocol()

Ahmed Zaki <anzaki@gmail.com>
    mac80211: fix station inactive_time shortly after boot

Toke Høiland-Jørgensen <toke@redhat.com>
    net/fq_impl: Switch to kvmalloc() for memory allocation

Johannes Berg <johannes.berg@intel.com>
    mac80211: fix ieee80211_txq_setup_flows() failure path

Jeff Layton <jlayton@kernel.org>
    ceph: return -EINVAL if given fsc mount option on kernel w/o support

Jose Abreu <Jose.Abreu@synopsys.com>
    net: stmmac: xgmac: Disable Flow Control when 1 or more queues are in AV

Jose Abreu <Jose.Abreu@synopsys.com>
    net: stmmac: xgmac: Fix TSA selection

Jose Abreu <Jose.Abreu@synopsys.com>
    net: stmmac: xgmac: bitrev32 returns u32

Jose Abreu <Jose.Abreu@synopsys.com>
    net: stmmac: gmac4: bitrev32 returns u32

changzhu <Changfeng.Zhu@amd.com>
    drm/amdgpu: add warning for GRBM 1-cycle delay issue in gfx9

Evan Quan <evan.quan@amd.com>
    drm/amdgpu: register gpu instance before fan boost feature enablment

Kevin Wang <kevin1.wang@amd.com>
    drm/amd/swSMU: fix smu workload bit map error

Vladimir Oltean <olteanv@gmail.com>
    net: mscc: ocelot: fix __ocelot_rmw_ix prototype

Dmytro Linkin <dmitrolin@mellanox.com>
    net/mlx5e: Use correct enum to determine uplink port

Roi Dayan <roid@mellanox.com>
    net/mlx5e: Fix eswitch debug print of max fdb flow

Shirish S <shirish.s@amd.com>
    drm/amdgpu: dont schedule jobs while in reset

Doug Berger <opendmb@gmail.com>
    net: bcmgenet: reapply manual settings to the PHY

Doug Berger <opendmb@gmail.com>
    net: bcmgenet: use RGMII loopback for MAC reset

Ilya Leoshkevich <iii@linux.ibm.com>
    scripts/gdb: fix debugging modules compiled with hot/cold partitioning

John Hubbard <jhubbard@nvidia.com>
    mm/gup_benchmark: fix MAP_HUGETLB case

Dragos Tarcatu <dragos_tarcatu@mentor.com>
    ASoC: SOF: topology: Fix bytes control size checks

Christophe Roullier <christophe.roullier@st.com>
    ARM: dts: stm32: Fix CAN RAM mapping on stm32mp157c

Kai Vehmanen <kai.vehmanen@linux.intel.com>
    ALSA: hda: hdmi - add Tigerlake support

Olivier Moysan <olivier.moysan@st.com>
    ASoC: stm32: sai: add restriction on mmap support

Matti Vaittinen <matti.vaittinen@fi.rohmeurope.com>
    watchdog: bd70528: Add MODULE_ALIAS to allow module auto loading

Anson Huang <Anson.Huang@nxp.com>
    watchdog: imx_sc_wdt: Pretimeout should follow SCU firmware format

Xingyu Chen <xingyu.chen@amlogic.com>
    watchdog: meson: Fix the wrong value of left time

Jorge Ramirez-Ortiz <jorge.ramirez-ortiz@linaro.org>
    watchdog: pm8916_wdt: fix pretimeout registration flow

Anton Eidelman <anton@lightbitslabs.com>
    nvme-multipath: fix crash in nvme_mpath_clear_ctrl_paths

Max Gurtovoy <maxg@mellanox.com>
    nvme-rdma: fix a segmentation fault during module unload

Timo Schlüßler <schluessler@krause.de>
    can: mcp251x: mcp251x_restart_work_handler(): Fix potential force_quit race condition

Steven Rostedt (VMware) <rostedt@goodmis.org>
    perf scripting engines: Iterate on tep event arrays directly

Michael Zhivich <mzhivich@akamai.com>
    x86/tsc: Respect tsc command line paraemeter for clocksource_tsc_early

Marc Kleine-Budde <mkl@pengutronix.de>
    can: flexcan: increase error counters if skb enqueueing via can_rx_offload_queue_sorted() fails

Marc Kleine-Budde <mkl@pengutronix.de>
    can: rx-offload: can_rx_offload_irq_offload_fifo(): continue on error

Jeroen Hofstee <jhofstee@victronenergy.com>
    can: rx-offload: can_rx_offload_irq_offload_timestamp(): continue on error

Marc Kleine-Budde <mkl@pengutronix.de>
    can: rx-offload: can_rx_offload_offload_one(): use ERR_PTR() to propagate error value in case of errors

Marc Kleine-Budde <mkl@pengutronix.de>
    can: rx-offload: can_rx_offload_offload_one(): increment rx_fifo_errors on queue overflow or OOM

Marc Kleine-Budde <mkl@pengutronix.de>
    can: rx-offload: can_rx_offload_offload_one(): do not increase the skb_queue beyond skb_queue_len_max

Marc Kleine-Budde <mkl@pengutronix.de>
    can: rx-offload: can_rx_offload_queue_tail(): fix error handling, avoid skb mem leak

Jeroen Hofstee <jhofstee@victronenergy.com>
    can: c_can: D_CAN: c_can_chip_config(): perform a sofware reset on open

Jeroen Hofstee <jhofstee@victronenergy.com>
    can: peak_usb: report bus recovery as well

Jiri Slaby <jslaby@suse.cz>
    stacktrace: Don't skip first entry on noncurrent tasks

Pablo Neira Ayuso <pablo@netfilter.org>
    netfilter: nf_tables_offload: skip EBUSY on chain update

Pablo Neira Ayuso <pablo@netfilter.org>
    netfilter: nf_tables: bogus EOPNOTSUPP on basechain update

Florian Westphal <fw@strlen.de>
    bridge: ebtables: don't crash when using dnat target in output chains

Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
    netfilter: ipset: Fix nla_policies to fully support NL_VALIDATE_STRICT

Chuhong Yuan <hslester96@gmail.com>
    net: fec: add missed clk_disable_unprepare in remove

Tony Lindgren <tony@atomide.com>
    clk: ti: clkctrl: Fix failed to enable error with double udelay timeout

Peter Ujfalusi <peter.ujfalusi@ti.com>
    clk: ti: dra7-atl-clock: Remove ti_clk_add_alias call

Kai Vehmanen <kai.vehmanen@linux.intel.com>
    ASoC: hdac_hda: fix race in device removal

Geert Uytterhoeven <geert@linux-m68k.org>
    fbdev: c2p: Fix link failure on non-inlining

Lucas Stach <l.stach@pengutronix.de>
    arm64: dts: zii-ultra: fix ARM regulator GPIO handle

Xiaochen Shen <xiaochen.shen@intel.com>
    x86/resctrl: Prevent NULL pointer dereference when reading mondata

Matthew Wilcox (Oracle) <willy@infradead.org>
    idr: Fix idr_alloc_u32 on 32-bit systems

Matthew Wilcox (Oracle) <willy@infradead.org>
    idr: Fix integer overflow in idr_for_each_entry

Matthew Wilcox (Oracle) <willy@infradead.org>
    idr: Fix idr_get_next_ul race with idr_remove

Eric Dumazet <edumazet@google.com>
    powerpc/bpf: Fix tail call implementation

Björn Töpel <bjorn.topel@intel.com>
    bpf: Change size to u64 for bpf_map_{area_alloc, charge_init}()

Björn Töpel <bjorn.topel@intel.com>
    samples/bpf: fix build by setting HAVE_ATTR_TEST to zero

Ilya Leoshkevich <iii@linux.ibm.com>
    bpf: Allow narrow loads of bpf_sysctl fields with offset > 0

Ondrej Jirman <megous@megous.com>
    ARM: dts: sun8i-a83t-tbs-a711: Fix WiFi resume from suspend

Colin Ian King <colin.king@canonical.com>
    clk: sunxi-ng: a80: fix the zero'ing of bits 16 and 18

Nathan Chancellor <natechancellor@gmail.com>
    clk: sunxi: Fix operator precedence in sunxi_divs_clk_setup

Alexandre Belloni <alexandre.belloni@bootlin.com>
    clk: at91: avoid sleeping early

Cheng-Yi Chiang <cychiang@chromium.org>
    ASoC: rockchip: rockchip_max98090: Enable SHDN to fix headset detection

Peter Ujfalusi <peter.ujfalusi@ti.com>
    ASoC: ti: sdma-pcm: Add back the flags parameter for non standard dma names

Navid Emamdoost <navid.emamdoost@gmail.com>
    ASoC: SOF: ipc: Fix memory leak in sof_set_get_large_ctrl_data

Shengjiu Wang <shengjiu.wang@nxp.com>
    arm64: dts: imx8mm: fix compatible string for sdma

Randy Dunlap <rdunlap@infradead.org>
    reset: fix reset_control_ops kerneldoc comment

Ben Dooks <ben.dooks@codethink.co.uk>
    soc: imx: gpc: fix initialiser format

Fabio Estevam <festevam@gmail.com>
    ARM: dts: imx6qdl-sabreauto: Fix storm of accelerometer interrupts

Andy Shevchenko <andriy.shevchenko@linux.intel.com>
    pinctrl: cherryview: Allocate IRQ chip dynamic

Marek Szyprowski <m.szyprowski@samsung.com>
    clk: samsung: exynos5420: Preserve PLL configuration during suspend/resume

Yuantian Tang <andy.tang@nxp.com>
    arm64: dts: ls1028a: fix a compatible issue

Russell King <rmk+kernel@armlinux.org.uk>
    ASoC: kirkwood: fix device remove ordering

Russell King <rmk+kernel@armlinux.org.uk>
    ASoC: kirkwood: fix external clock probe defer

Marek Szyprowski <m.szyprowski@samsung.com>
    clk: samsung: exynos542x: Move G3D subsystem clocks to its sub-CMU

Marek Szyprowski <m.szyprowski@samsung.com>
    clk: samsung: exynos5433: Fix error paths

Kishon Vijay Abraham I <kishon@ti.com>
    reset: Fix memory leak in reset_control_array_put()

Xiaojun Sang <xsang@codeaurora.org>
    ASoC: compress: fix unsigned integer overflow check

Stephan Gerhold <stephan@gerhold.net>
    ASoC: msm8916-wcd-analog: Fix RX1 selection in RDAC2 MUX

Bard Liao <yung-chuan.liao@linux.intel.com>
    soundwire: intel: fix intel_register_dai PDI offsets and numbers

Fabien Parent <fparent@baylibre.com>
    clocksource/drivers/mediatek: Fix error handling

Mika Westerberg <mika.westerberg@linux.intel.com>
    thunderbolt: Fix lockdep circular locking depedency warning

Mika Westerberg <mika.westerberg@linux.intel.com>
    thunderbolt: Read DP IN adapter first two dwords in one go

Eugen Hristev <eugen.hristev@microchip.com>
    clk: at91: sam9x60: fix programmable clock

Martin Blumenstingl <martin.blumenstingl@googlemail.com>
    clk: meson: gxbb: let sar_adc_clk_div set the parent clock rate

Matthew Wilcox (Oracle) <willy@infradead.org>
    XArray: Fix xas_next() with a single entry at 0

Jens Axboe <axboe@kernel.dk>
    net: disallow ancillary data for __sys_{send,recv}msg_file()

Jens Axboe <axboe@kernel.dk>
    net: separate out the msghdr copy from ___sys_{send,recv}msg()

Jens Axboe <axboe@kernel.dk>
    io_uring: async workers should inherit the user creds


-------------

Diffstat:

 Makefile                                           |   4 +-
 arch/arm/boot/dts/imx6qdl-sabreauto.dtsi           |   8 +
 arch/arm/boot/dts/stm32mp157c.dtsi                 |   4 +-
 arch/arm/boot/dts/sun8i-a83t-tbs-a711.dts          |   1 +
 arch/arm64/boot/dts/freescale/fsl-ls1028a-qds.dts  |   2 +-
 arch/arm64/boot/dts/freescale/imx8mm.dtsi          |   6 +-
 .../arm64/boot/dts/freescale/imx8mq-zii-ultra.dtsi |   2 +-
 arch/powerpc/net/bpf_jit_comp64.c                  |  13 ++
 arch/x86/include/asm/fpu/internal.h                |   2 +-
 arch/x86/kernel/cpu/resctrl/ctrlmondata.c          |   4 +
 arch/x86/kernel/tsc.c                              |   3 +
 drivers/block/drbd/drbd_main.c                     |   1 -
 drivers/clk/at91/clk-main.c                        |   7 +-
 drivers/clk/at91/sam9x60.c                         |   1 +
 drivers/clk/at91/sckc.c                            |  20 ++-
 drivers/clk/meson/gxbb.c                           |   1 +
 drivers/clk/samsung/clk-exynos5420.c               |  27 ++-
 drivers/clk/samsung/clk-exynos5433.c               |  14 +-
 drivers/clk/sunxi-ng/ccu-sun9i-a80.c               |   2 +-
 drivers/clk/sunxi/clk-sunxi.c                      |   4 +-
 drivers/clk/ti/clk-dra7-atl.c                      |   6 -
 drivers/clk/ti/clkctrl.c                           |   5 +-
 drivers/clocksource/timer-mediatek.c               |  10 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c            |   5 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_device.c         |   7 +
 drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c            |   1 -
 drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c              |   7 +
 drivers/gpu/drm/amd/powerplay/navi10_ppt.c         |   2 +-
 drivers/gpu/drm/amd/powerplay/vega20_ppt.c         |   2 +-
 drivers/hid/hid-core.c                             |  51 +++++-
 drivers/misc/mei/bus.c                             |   9 +-
 drivers/misc/mei/hw-me-regs.h                      |   1 +
 drivers/misc/mei/pci-me.c                          |   1 +
 drivers/net/can/c_can/c_can.c                      |  26 +++
 drivers/net/can/flexcan.c                          |  10 +-
 drivers/net/can/rx-offload.c                       |  96 +++++++++--
 drivers/net/can/spi/mcp251x.c                      |   2 +-
 drivers/net/can/usb/peak_usb/pcan_usb.c            |  15 +-
 drivers/net/dsa/sja1105/sja1105_main.c             |  10 +-
 drivers/net/ethernet/broadcom/genet/bcmgenet.c     |   7 +-
 drivers/net/ethernet/broadcom/genet/bcmmii.c       |  33 ++++
 drivers/net/ethernet/cadence/macb_main.c           |   1 +
 drivers/net/ethernet/freescale/fec_main.c          |   2 +
 drivers/net/ethernet/google/gve/gve_main.c         |   3 +-
 drivers/net/ethernet/intel/i40e/i40e_common.c      |   3 +-
 drivers/net/ethernet/intel/iavf/iavf_main.c        |   4 +-
 drivers/net/ethernet/intel/ice/ice_sched.c         |   2 +-
 .../ethernet/mellanox/mlx5/core/eswitch_offloads.c |   2 +-
 .../mellanox/mlx5/core/eswitch_offloads_termtbl.c  |   3 +-
 drivers/net/ethernet/mscc/ocelot.h                 |   2 +-
 drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c  |   2 +-
 .../net/ethernet/stmicro/stmmac/dwxgmac2_core.c    |   3 +-
 drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c |   2 +
 drivers/net/macvlan.c                              |   3 +-
 drivers/net/phy/mdio_bus.c                         |   6 +-
 drivers/net/slip/slip.c                            |   1 +
 drivers/nvme/host/multipath.c                      |   2 +
 drivers/nvme/host/rdma.c                           |   8 +
 drivers/pinctrl/intel/pinctrl-cherryview.c         |  24 +--
 drivers/platform/x86/hp-wmi.c                      |  10 +-
 drivers/pwm/pwm-bcm-iproc.c                        |   1 +
 drivers/reset/core.c                               |   1 +
 drivers/soc/imx/gpc.c                              |   8 +-
 drivers/soundwire/intel.c                          |   4 +-
 drivers/staging/rtl8192e/rtl8192e/rtl_core.c       |   5 +-
 drivers/staging/rtl8723bs/os_dep/sdio_intf.c       |   7 +-
 drivers/staging/wilc1000/wilc_hif.c                |  25 +--
 drivers/thunderbolt/switch.c                       |  82 +++++----
 drivers/usb/dwc2/core.c                            |   2 +-
 drivers/usb/serial/ftdi_sio.c                      |   3 +
 drivers/usb/serial/ftdi_sio_ids.h                  |   7 +
 drivers/video/fbdev/c2p_core.h                     |   8 +-
 drivers/watchdog/bd70528_wdt.c                     |   1 +
 drivers/watchdog/imx_sc_wdt.c                      |   8 +-
 drivers/watchdog/meson_gxbb_wdt.c                  |   4 +-
 drivers/watchdog/pm8916_wdt.c                      |  15 +-
 fs/ceph/super.c                                    |  11 +-
 fs/ext4/inode.c                                    |  15 ++
 fs/ext4/super.c                                    |  21 ++-
 fs/io_uring.c                                      |  23 ++-
 include/linux/bpf.h                                |   4 +-
 include/linux/idr.h                                |   2 +-
 include/linux/reset-controller.h                   |   2 +-
 include/linux/skmsg.h                              |  26 +--
 include/net/fq_impl.h                              |   4 +-
 include/net/sctp/structs.h                         |   3 +
 include/net/tls.h                                  |   3 +-
 kernel/bpf/cgroup.c                                |   4 +-
 kernel/bpf/syscall.c                               |   7 +-
 kernel/stacktrace.c                                |   6 +-
 lib/idr.c                                          |  31 ++--
 lib/radix-tree.c                                   |   2 +-
 lib/test_xarray.c                                  |  24 +++
 lib/xarray.c                                       |   4 +
 net/bridge/netfilter/ebt_dnat.c                    |  19 ++-
 net/core/filter.c                                  |   8 +-
 net/core/skmsg.c                                   |   2 +-
 net/ipv4/tcp_bpf.c                                 |   2 +-
 net/mac80211/main.c                                |   2 +-
 net/mac80211/sta_info.c                            |   3 +-
 net/netfilter/ipset/ip_set_core.c                  |  41 +++--
 net/netfilter/ipset/ip_set_hash_net.c              |   1 +
 net/netfilter/ipset/ip_set_hash_netnet.c           |   1 +
 net/netfilter/nf_tables_api.c                      |   1 +
 net/netfilter/nf_tables_offload.c                  |   3 +-
 net/openvswitch/datapath.c                         |  17 +-
 net/psample/psample.c                              |   2 +-
 net/sched/sch_mq.c                                 |   3 +-
 net/sched/sch_mqprio.c                             |   4 +-
 net/sched/sch_multiq.c                             |   2 +-
 net/sched/sch_prio.c                               |   2 +-
 net/sctp/associola.c                               |   1 +
 net/sctp/endpointola.c                             |   1 +
 net/sctp/input.c                                   |   4 +-
 net/sctp/sm_statefuns.c                            |   4 +-
 net/socket.c                                       | 184 +++++++++++++++------
 net/tipc/netlink_compat.c                          |   4 +-
 net/tls/tls_main.c                                 |  13 +-
 net/tls/tls_sw.c                                   |  32 ++--
 net/xfrm/xfrm_state.c                              |   2 +
 samples/bpf/Makefile                               |   1 +
 scripts/gdb/linux/symbols.py                       |   3 +-
 sound/core/compress_offload.c                      |   2 +-
 sound/pci/hda/patch_hdmi.c                         |  13 ++
 sound/soc/codecs/hdac_hda.c                        |   2 +-
 sound/soc/codecs/msm8916-wcd-analog.c              |   4 +-
 sound/soc/kirkwood/kirkwood-i2s.c                  |  11 +-
 sound/soc/rockchip/rockchip_max98090.c             |   7 +-
 sound/soc/sof/ipc.c                                |   4 +-
 sound/soc/sof/topology.c                           |  11 +-
 sound/soc/stm/stm32_sai_sub.c                      |  12 +-
 sound/soc/ti/sdma-pcm.c                            |   2 +-
 .../perf/util/scripting-engines/trace-event-perl.c |   8 +-
 .../util/scripting-engines/trace-event-python.c    |   9 +-
 tools/testing/selftests/bpf/test_sockmap.c         |  47 +++---
 tools/testing/selftests/bpf/test_sysctl.c          |   8 +-
 tools/testing/selftests/bpf/xdping.c               |   2 +-
 tools/testing/selftests/net/pmtu.sh                |   5 +-
 tools/testing/selftests/net/tls.c                  |  60 +++++++
 tools/testing/selftests/vm/gup_benchmark.c         |   2 +-
 140 files changed, 1055 insertions(+), 404 deletions(-)



^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 001/135] io_uring: async workers should inherit the user creds
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
@ 2019-12-03 22:34 ` Greg Kroah-Hartman
  2019-12-03 22:34 ` [PATCH 5.3 002/135] net: separate out the msghdr copy from ___sys_{send,recv}msg() Greg Kroah-Hartman
                   ` (137 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:34 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jens Axboe, Sasha Levin

From: Jens Axboe <axboe@kernel.dk>

[ Upstream commit 181e448d8709e517c9c7b523fcd209f24eb38ca7 ]

If we don't inherit the original task creds, then we can confuse users
like fuse that pass creds in the request header. See link below on
identical aio issue.

Link: https://lore.kernel.org/linux-fsdevel/26f0d78e-99ca-2f1b-78b9-433088053a61@scylladb.com/T/#u
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/io_uring.c | 23 ++++++++++++++++++++++-
 1 file changed, 22 insertions(+), 1 deletion(-)

diff --git a/fs/io_uring.c b/fs/io_uring.c
index 56c23dee98117..f563a581b924c 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -260,6 +260,8 @@ struct io_ring_ctx {
 
 	struct user_struct	*user;
 
+	struct cred		*creds;
+
 	struct completion	ctx_done;
 
 	struct {
@@ -1633,8 +1635,11 @@ static void io_poll_complete_work(struct work_struct *work)
 	struct io_poll_iocb *poll = &req->poll;
 	struct poll_table_struct pt = { ._key = poll->events };
 	struct io_ring_ctx *ctx = req->ctx;
+	const struct cred *old_cred;
 	__poll_t mask = 0;
 
+	old_cred = override_creds(ctx->creds);
+
 	if (!READ_ONCE(poll->canceled))
 		mask = vfs_poll(poll->file, &pt) & poll->events;
 
@@ -1649,7 +1654,7 @@ static void io_poll_complete_work(struct work_struct *work)
 	if (!mask && !READ_ONCE(poll->canceled)) {
 		add_wait_queue(poll->head, &poll->wait);
 		spin_unlock_irq(&ctx->completion_lock);
-		return;
+		goto out;
 	}
 	list_del_init(&req->list);
 	io_poll_complete(ctx, req, mask);
@@ -1657,6 +1662,8 @@ static void io_poll_complete_work(struct work_struct *work)
 
 	io_cqring_ev_posted(ctx);
 	io_put_req(req);
+out:
+	revert_creds(old_cred);
 }
 
 static int io_poll_wake(struct wait_queue_entry *wait, unsigned mode, int sync,
@@ -1906,10 +1913,12 @@ static void io_sq_wq_submit_work(struct work_struct *work)
 	struct io_ring_ctx *ctx = req->ctx;
 	struct mm_struct *cur_mm = NULL;
 	struct async_list *async_list;
+	const struct cred *old_cred;
 	LIST_HEAD(req_list);
 	mm_segment_t old_fs;
 	int ret;
 
+	old_cred = override_creds(ctx->creds);
 	async_list = io_async_list_from_sqe(ctx, req->submit.sqe);
 restart:
 	do {
@@ -2017,6 +2026,7 @@ static void io_sq_wq_submit_work(struct work_struct *work)
 		unuse_mm(cur_mm);
 		mmput(cur_mm);
 	}
+	revert_creds(old_cred);
 }
 
 /*
@@ -2354,6 +2364,7 @@ static int io_sq_thread(void *data)
 {
 	struct io_ring_ctx *ctx = data;
 	struct mm_struct *cur_mm = NULL;
+	const struct cred *old_cred;
 	mm_segment_t old_fs;
 	DEFINE_WAIT(wait);
 	unsigned inflight;
@@ -2363,6 +2374,7 @@ static int io_sq_thread(void *data)
 
 	old_fs = get_fs();
 	set_fs(USER_DS);
+	old_cred = override_creds(ctx->creds);
 
 	timeout = inflight = 0;
 	while (!kthread_should_park()) {
@@ -2473,6 +2485,7 @@ static int io_sq_thread(void *data)
 		unuse_mm(cur_mm);
 		mmput(cur_mm);
 	}
+	revert_creds(old_cred);
 
 	kthread_parkme();
 
@@ -3142,6 +3155,8 @@ static void io_ring_ctx_free(struct io_ring_ctx *ctx)
 		io_unaccount_mem(ctx->user,
 				ring_pages(ctx->sq_entries, ctx->cq_entries));
 	free_uid(ctx->user);
+	if (ctx->creds)
+		put_cred(ctx->creds);
 	kfree(ctx);
 }
 
@@ -3419,6 +3434,12 @@ static int io_uring_create(unsigned entries, struct io_uring_params *p)
 	ctx->account_mem = account_mem;
 	ctx->user = user;
 
+	ctx->creds = prepare_creds();
+	if (!ctx->creds) {
+		ret = -ENOMEM;
+		goto err;
+	}
+
 	ret = io_allocate_scq_urings(ctx, p);
 	if (ret)
 		goto err;
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 002/135] net: separate out the msghdr copy from ___sys_{send,recv}msg()
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
  2019-12-03 22:34 ` [PATCH 5.3 001/135] io_uring: async workers should inherit the user creds Greg Kroah-Hartman
@ 2019-12-03 22:34 ` Greg Kroah-Hartman
  2019-12-03 22:34 ` [PATCH 5.3 003/135] net: disallow ancillary data for __sys_{send,recv}msg_file() Greg Kroah-Hartman
                   ` (136 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, David S. Miller, Jens Axboe, Sasha Levin

From: Jens Axboe <axboe@kernel.dk>

[ Upstream commit 4257c8ca13b084550574b8c9a667d9c90ff746eb ]

This is in preparation for enabling the io_uring helpers for sendmsg
and recvmsg to first copy the header for validation before continuing
with the operation.

There should be no functional changes in this patch.

Acked-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/socket.c | 141 ++++++++++++++++++++++++++++++++++-----------------
 1 file changed, 95 insertions(+), 46 deletions(-)

diff --git a/net/socket.c b/net/socket.c
index 6a9ab7a8b1d2c..fbe08d7df7732 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -2232,15 +2232,10 @@ static int copy_msghdr_from_user(struct msghdr *kmsg,
 	return err < 0 ? err : 0;
 }
 
-static int ___sys_sendmsg(struct socket *sock, struct user_msghdr __user *msg,
-			 struct msghdr *msg_sys, unsigned int flags,
-			 struct used_address *used_address,
-			 unsigned int allowed_msghdr_flags)
+static int ____sys_sendmsg(struct socket *sock, struct msghdr *msg_sys,
+			   unsigned int flags, struct used_address *used_address,
+			   unsigned int allowed_msghdr_flags)
 {
-	struct compat_msghdr __user *msg_compat =
-	    (struct compat_msghdr __user *)msg;
-	struct sockaddr_storage address;
-	struct iovec iovstack[UIO_FASTIOV], *iov = iovstack;
 	unsigned char ctl[sizeof(struct cmsghdr) + 20]
 				__aligned(sizeof(__kernel_size_t));
 	/* 20 is size of ipv6_pktinfo */
@@ -2248,19 +2243,10 @@ static int ___sys_sendmsg(struct socket *sock, struct user_msghdr __user *msg,
 	int ctl_len;
 	ssize_t err;
 
-	msg_sys->msg_name = &address;
-
-	if (MSG_CMSG_COMPAT & flags)
-		err = get_compat_msghdr(msg_sys, msg_compat, NULL, &iov);
-	else
-		err = copy_msghdr_from_user(msg_sys, msg, NULL, &iov);
-	if (err < 0)
-		return err;
-
 	err = -ENOBUFS;
 
 	if (msg_sys->msg_controllen > INT_MAX)
-		goto out_freeiov;
+		goto out;
 	flags |= (msg_sys->msg_flags & allowed_msghdr_flags);
 	ctl_len = msg_sys->msg_controllen;
 	if ((MSG_CMSG_COMPAT & flags) && ctl_len) {
@@ -2268,7 +2254,7 @@ static int ___sys_sendmsg(struct socket *sock, struct user_msghdr __user *msg,
 		    cmsghdr_from_user_compat_to_kern(msg_sys, sock->sk, ctl,
 						     sizeof(ctl));
 		if (err)
-			goto out_freeiov;
+			goto out;
 		ctl_buf = msg_sys->msg_control;
 		ctl_len = msg_sys->msg_controllen;
 	} else if (ctl_len) {
@@ -2277,7 +2263,7 @@ static int ___sys_sendmsg(struct socket *sock, struct user_msghdr __user *msg,
 		if (ctl_len > sizeof(ctl)) {
 			ctl_buf = sock_kmalloc(sock->sk, ctl_len, GFP_KERNEL);
 			if (ctl_buf == NULL)
-				goto out_freeiov;
+				goto out;
 		}
 		err = -EFAULT;
 		/*
@@ -2323,7 +2309,47 @@ static int ___sys_sendmsg(struct socket *sock, struct user_msghdr __user *msg,
 out_freectl:
 	if (ctl_buf != ctl)
 		sock_kfree_s(sock->sk, ctl_buf, ctl_len);
-out_freeiov:
+out:
+	return err;
+}
+
+static int sendmsg_copy_msghdr(struct msghdr *msg,
+			       struct user_msghdr __user *umsg, unsigned flags,
+			       struct iovec **iov)
+{
+	int err;
+
+	if (flags & MSG_CMSG_COMPAT) {
+		struct compat_msghdr __user *msg_compat;
+
+		msg_compat = (struct compat_msghdr __user *) umsg;
+		err = get_compat_msghdr(msg, msg_compat, NULL, iov);
+	} else {
+		err = copy_msghdr_from_user(msg, umsg, NULL, iov);
+	}
+	if (err < 0)
+		return err;
+
+	return 0;
+}
+
+static int ___sys_sendmsg(struct socket *sock, struct user_msghdr __user *msg,
+			 struct msghdr *msg_sys, unsigned int flags,
+			 struct used_address *used_address,
+			 unsigned int allowed_msghdr_flags)
+{
+	struct sockaddr_storage address;
+	struct iovec iovstack[UIO_FASTIOV], *iov = iovstack;
+	ssize_t err;
+
+	msg_sys->msg_name = &address;
+
+	err = sendmsg_copy_msghdr(msg_sys, msg, flags, &iov);
+	if (err < 0)
+		return err;
+
+	err = ____sys_sendmsg(sock, msg_sys, flags, used_address,
+				allowed_msghdr_flags);
 	kfree(iov);
 	return err;
 }
@@ -2442,33 +2468,41 @@ SYSCALL_DEFINE4(sendmmsg, int, fd, struct mmsghdr __user *, mmsg,
 	return __sys_sendmmsg(fd, mmsg, vlen, flags, true);
 }
 
-static int ___sys_recvmsg(struct socket *sock, struct user_msghdr __user *msg,
-			 struct msghdr *msg_sys, unsigned int flags, int nosec)
+static int recvmsg_copy_msghdr(struct msghdr *msg,
+			       struct user_msghdr __user *umsg, unsigned flags,
+			       struct sockaddr __user **uaddr,
+			       struct iovec **iov)
 {
-	struct compat_msghdr __user *msg_compat =
-	    (struct compat_msghdr __user *)msg;
-	struct iovec iovstack[UIO_FASTIOV];
-	struct iovec *iov = iovstack;
-	unsigned long cmsg_ptr;
-	int len;
 	ssize_t err;
 
-	/* kernel mode address */
-	struct sockaddr_storage addr;
-
-	/* user mode address pointers */
-	struct sockaddr __user *uaddr;
-	int __user *uaddr_len = COMPAT_NAMELEN(msg);
-
-	msg_sys->msg_name = &addr;
+	if (MSG_CMSG_COMPAT & flags) {
+		struct compat_msghdr __user *msg_compat;
 
-	if (MSG_CMSG_COMPAT & flags)
-		err = get_compat_msghdr(msg_sys, msg_compat, &uaddr, &iov);
-	else
-		err = copy_msghdr_from_user(msg_sys, msg, &uaddr, &iov);
+		msg_compat = (struct compat_msghdr __user *) umsg;
+		err = get_compat_msghdr(msg, msg_compat, uaddr, iov);
+	} else {
+		err = copy_msghdr_from_user(msg, umsg, uaddr, iov);
+	}
 	if (err < 0)
 		return err;
 
+	return 0;
+}
+
+static int ____sys_recvmsg(struct socket *sock, struct msghdr *msg_sys,
+			   struct user_msghdr __user *msg,
+			   struct sockaddr __user *uaddr,
+			   unsigned int flags, int nosec)
+{
+	struct compat_msghdr __user *msg_compat =
+					(struct compat_msghdr __user *) msg;
+	int __user *uaddr_len = COMPAT_NAMELEN(msg);
+	struct sockaddr_storage addr;
+	unsigned long cmsg_ptr;
+	int len;
+	ssize_t err;
+
+	msg_sys->msg_name = &addr;
 	cmsg_ptr = (unsigned long)msg_sys->msg_control;
 	msg_sys->msg_flags = flags & (MSG_CMSG_CLOEXEC|MSG_CMSG_COMPAT);
 
@@ -2479,7 +2513,7 @@ static int ___sys_recvmsg(struct socket *sock, struct user_msghdr __user *msg,
 		flags |= MSG_DONTWAIT;
 	err = (nosec ? sock_recvmsg_nosec : sock_recvmsg)(sock, msg_sys, flags);
 	if (err < 0)
-		goto out_freeiov;
+		goto out;
 	len = err;
 
 	if (uaddr != NULL) {
@@ -2487,12 +2521,12 @@ static int ___sys_recvmsg(struct socket *sock, struct user_msghdr __user *msg,
 					msg_sys->msg_namelen, uaddr,
 					uaddr_len);
 		if (err < 0)
-			goto out_freeiov;
+			goto out;
 	}
 	err = __put_user((msg_sys->msg_flags & ~MSG_CMSG_COMPAT),
 			 COMPAT_FLAGS(msg));
 	if (err)
-		goto out_freeiov;
+		goto out;
 	if (MSG_CMSG_COMPAT & flags)
 		err = __put_user((unsigned long)msg_sys->msg_control - cmsg_ptr,
 				 &msg_compat->msg_controllen);
@@ -2500,10 +2534,25 @@ static int ___sys_recvmsg(struct socket *sock, struct user_msghdr __user *msg,
 		err = __put_user((unsigned long)msg_sys->msg_control - cmsg_ptr,
 				 &msg->msg_controllen);
 	if (err)
-		goto out_freeiov;
+		goto out;
 	err = len;
+out:
+	return err;
+}
+
+static int ___sys_recvmsg(struct socket *sock, struct user_msghdr __user *msg,
+			 struct msghdr *msg_sys, unsigned int flags, int nosec)
+{
+	struct iovec iovstack[UIO_FASTIOV], *iov = iovstack;
+	/* user mode address pointers */
+	struct sockaddr __user *uaddr;
+	ssize_t err;
+
+	err = recvmsg_copy_msghdr(msg_sys, msg, flags, &uaddr, &iov);
+	if (err < 0)
+		return err;
 
-out_freeiov:
+	err = ____sys_recvmsg(sock, msg_sys, msg, uaddr, flags, nosec);
 	kfree(iov);
 	return err;
 }
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 003/135] net: disallow ancillary data for __sys_{send,recv}msg_file()
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
  2019-12-03 22:34 ` [PATCH 5.3 001/135] io_uring: async workers should inherit the user creds Greg Kroah-Hartman
  2019-12-03 22:34 ` [PATCH 5.3 002/135] net: separate out the msghdr copy from ___sys_{send,recv}msg() Greg Kroah-Hartman
@ 2019-12-03 22:34 ` Greg Kroah-Hartman
  2019-12-03 22:34 ` [PATCH 5.3 004/135] XArray: Fix xas_next() with a single entry at 0 Greg Kroah-Hartman
                   ` (135 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, David S. Miller, Jens Axboe, Sasha Levin

From: Jens Axboe <axboe@kernel.dk>

[ Upstream commit d69e07793f891524c6bbf1e75b9ae69db4450953 ]

Only io_uring uses (and added) these, and we want to disallow the
use of sendmsg/recvmsg for anything but regular data transfers.
Use the newly added prep helper to split the msghdr copy out from
the core function, to check for msg_control and msg_controllen
settings. If either is set, we return -EINVAL.

Acked-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/socket.c | 43 +++++++++++++++++++++++++++++++++++++------
 1 file changed, 37 insertions(+), 6 deletions(-)

diff --git a/net/socket.c b/net/socket.c
index fbe08d7df7732..d7a106028f0e0 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -2357,12 +2357,27 @@ static int ___sys_sendmsg(struct socket *sock, struct user_msghdr __user *msg,
 /*
  *	BSD sendmsg interface
  */
-long __sys_sendmsg_sock(struct socket *sock, struct user_msghdr __user *msg,
+long __sys_sendmsg_sock(struct socket *sock, struct user_msghdr __user *umsg,
 			unsigned int flags)
 {
-	struct msghdr msg_sys;
+	struct iovec iovstack[UIO_FASTIOV], *iov = iovstack;
+	struct sockaddr_storage address;
+	struct msghdr msg = { .msg_name = &address };
+	ssize_t err;
+
+	err = sendmsg_copy_msghdr(&msg, umsg, flags, &iov);
+	if (err)
+		return err;
+	/* disallow ancillary data requests from this path */
+	if (msg.msg_control || msg.msg_controllen) {
+		err = -EINVAL;
+		goto out;
+	}
 
-	return ___sys_sendmsg(sock, msg, &msg_sys, flags, NULL, 0);
+	err = ____sys_sendmsg(sock, &msg, flags, NULL, 0);
+out:
+	kfree(iov);
+	return err;
 }
 
 long __sys_sendmsg(int fd, struct user_msghdr __user *msg, unsigned int flags,
@@ -2561,12 +2576,28 @@ static int ___sys_recvmsg(struct socket *sock, struct user_msghdr __user *msg,
  *	BSD recvmsg interface
  */
 
-long __sys_recvmsg_sock(struct socket *sock, struct user_msghdr __user *msg,
+long __sys_recvmsg_sock(struct socket *sock, struct user_msghdr __user *umsg,
 			unsigned int flags)
 {
-	struct msghdr msg_sys;
+	struct iovec iovstack[UIO_FASTIOV], *iov = iovstack;
+	struct sockaddr_storage address;
+	struct msghdr msg = { .msg_name = &address };
+	struct sockaddr __user *uaddr;
+	ssize_t err;
 
-	return ___sys_recvmsg(sock, msg, &msg_sys, flags, 0);
+	err = recvmsg_copy_msghdr(&msg, umsg, flags, &uaddr, &iov);
+	if (err)
+		return err;
+	/* disallow ancillary data requests from this path */
+	if (msg.msg_control || msg.msg_controllen) {
+		err = -EINVAL;
+		goto out;
+	}
+
+	err = ____sys_recvmsg(sock, &msg, umsg, uaddr, flags, 0);
+out:
+	kfree(iov);
+	return err;
 }
 
 long __sys_recvmsg(int fd, struct user_msghdr __user *msg, unsigned int flags,
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 004/135] XArray: Fix xas_next() with a single entry at 0
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (2 preceding siblings ...)
  2019-12-03 22:34 ` [PATCH 5.3 003/135] net: disallow ancillary data for __sys_{send,recv}msg_file() Greg Kroah-Hartman
@ 2019-12-03 22:34 ` Greg Kroah-Hartman
  2019-12-03 22:34 ` [PATCH 5.3 005/135] clk: meson: gxbb: let sar_adc_clk_div set the parent clock rate Greg Kroah-Hartman
                   ` (134 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Kent Overstreet,
	Matthew Wilcox (Oracle),
	Sasha Levin

From: Matthew Wilcox (Oracle) <willy@infradead.org>

[ Upstream commit 91abab83839aa2eba073e4a63c729832fdb27ea1 ]

If there is only a single entry at 0, the first time we call xas_next(),
we return the entry.  Unfortunately, all subsequent times we call
xas_next(), we also return the entry at 0 instead of noticing that the
xa_index is now greater than zero.  This broke find_get_pages_contig().

Fixes: 64d3e9a9e0cc ("xarray: Step through an XArray")
Reported-by: Kent Overstreet <kent.overstreet@gmail.com>
Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 lib/test_xarray.c | 24 ++++++++++++++++++++++++
 lib/xarray.c      |  4 ++++
 2 files changed, 28 insertions(+)

diff --git a/lib/test_xarray.c b/lib/test_xarray.c
index 9d631a7b6a705..7df4f7f395bf2 100644
--- a/lib/test_xarray.c
+++ b/lib/test_xarray.c
@@ -1110,6 +1110,28 @@ static noinline void check_find_entry(struct xarray *xa)
 	XA_BUG_ON(xa, !xa_empty(xa));
 }
 
+static noinline void check_move_tiny(struct xarray *xa)
+{
+	XA_STATE(xas, xa, 0);
+
+	XA_BUG_ON(xa, !xa_empty(xa));
+	rcu_read_lock();
+	XA_BUG_ON(xa, xas_next(&xas) != NULL);
+	XA_BUG_ON(xa, xas_next(&xas) != NULL);
+	rcu_read_unlock();
+	xa_store_index(xa, 0, GFP_KERNEL);
+	rcu_read_lock();
+	xas_set(&xas, 0);
+	XA_BUG_ON(xa, xas_next(&xas) != xa_mk_index(0));
+	XA_BUG_ON(xa, xas_next(&xas) != NULL);
+	xas_set(&xas, 0);
+	XA_BUG_ON(xa, xas_prev(&xas) != xa_mk_index(0));
+	XA_BUG_ON(xa, xas_prev(&xas) != NULL);
+	rcu_read_unlock();
+	xa_erase_index(xa, 0);
+	XA_BUG_ON(xa, !xa_empty(xa));
+}
+
 static noinline void check_move_small(struct xarray *xa, unsigned long idx)
 {
 	XA_STATE(xas, xa, 0);
@@ -1217,6 +1239,8 @@ static noinline void check_move(struct xarray *xa)
 
 	xa_destroy(xa);
 
+	check_move_tiny(xa);
+
 	for (i = 0; i < 16; i++)
 		check_move_small(xa, 1UL << i);
 
diff --git a/lib/xarray.c b/lib/xarray.c
index 446b956c91888..1237c213f52bc 100644
--- a/lib/xarray.c
+++ b/lib/xarray.c
@@ -994,6 +994,8 @@ void *__xas_prev(struct xa_state *xas)
 
 	if (!xas_frozen(xas->xa_node))
 		xas->xa_index--;
+	if (!xas->xa_node)
+		return set_bounds(xas);
 	if (xas_not_node(xas->xa_node))
 		return xas_load(xas);
 
@@ -1031,6 +1033,8 @@ void *__xas_next(struct xa_state *xas)
 
 	if (!xas_frozen(xas->xa_node))
 		xas->xa_index++;
+	if (!xas->xa_node)
+		return set_bounds(xas);
 	if (xas_not_node(xas->xa_node))
 		return xas_load(xas);
 
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 005/135] clk: meson: gxbb: let sar_adc_clk_div set the parent clock rate
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (3 preceding siblings ...)
  2019-12-03 22:34 ` [PATCH 5.3 004/135] XArray: Fix xas_next() with a single entry at 0 Greg Kroah-Hartman
@ 2019-12-03 22:34 ` Greg Kroah-Hartman
  2019-12-03 22:34 ` [PATCH 5.3 006/135] clk: at91: sam9x60: fix programmable clock Greg Kroah-Hartman
                   ` (133 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Martin Blumenstingl, Jerome Brunet,
	Sasha Levin

From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>

[ Upstream commit 44b09b11b813b8550e6b976ea51593bc23bba8d1 ]

The meson-saradc driver manually sets the input clock for
sar_adc_clk_sel. Update the GXBB clock driver (which is used on GXBB,
GXL and GXM) so the rate settings on sar_adc_clk_div are propagated up
to sar_adc_clk_sel which will let the common clock framework select the
best matching parent clock if we want that.

This makes sar_adc_clk_div consistent with the axg-aoclk and g12a-aoclk
drivers, which both also specify CLK_SET_RATE_PARENT.

Fixes: 33d0fcdfe0e870 ("clk: gxbb: add the SAR ADC clocks and expose them")
Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/meson/gxbb.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/clk/meson/gxbb.c b/drivers/clk/meson/gxbb.c
index dab16d9b1af8b..9834eb2c1b674 100644
--- a/drivers/clk/meson/gxbb.c
+++ b/drivers/clk/meson/gxbb.c
@@ -866,6 +866,7 @@ static struct clk_regmap gxbb_sar_adc_clk_div = {
 		.ops = &clk_regmap_divider_ops,
 		.parent_names = (const char *[]){ "sar_adc_clk_sel" },
 		.num_parents = 1,
+		.flags = CLK_SET_RATE_PARENT,
 	},
 };
 
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 006/135] clk: at91: sam9x60: fix programmable clock
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (4 preceding siblings ...)
  2019-12-03 22:34 ` [PATCH 5.3 005/135] clk: meson: gxbb: let sar_adc_clk_div set the parent clock rate Greg Kroah-Hartman
@ 2019-12-03 22:34 ` Greg Kroah-Hartman
  2019-12-03 22:34 ` [PATCH 5.3 007/135] thunderbolt: Read DP IN adapter first two dwords in one go Greg Kroah-Hartman
                   ` (132 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Eugen Hristev, Nicolas Ferre,
	Alexandre Belloni, Stephen Boyd, Sasha Levin

From: Eugen Hristev <eugen.hristev@microchip.com>

[ Upstream commit 2200ab6a7403f4fcd052c55ca328fc942f9392b6 ]

The prescaler mask for sam9x60 must be 0xff (8 bits).
Being set to 0, means that we cannot set any prescaler, thus the
programmable clocks do not work (except the case with prescaler 0)
Set the mask accordingly in layout struct.

Fixes: 01e2113de9a5 ("clk: at91: add sam9x60 pmc driver")
Signed-off-by: Eugen Hristev <eugen.hristev@microchip.com>
Link: https://lkml.kernel.org/r/1569321191-27606-1-git-send-email-eugen.hristev@microchip.com
Acked-by: Nicolas Ferre <nicolas.ferre@microchip.com>
Acked-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/at91/sam9x60.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/clk/at91/sam9x60.c b/drivers/clk/at91/sam9x60.c
index 9790ddfa5b3cb..86238d5ecb4da 100644
--- a/drivers/clk/at91/sam9x60.c
+++ b/drivers/clk/at91/sam9x60.c
@@ -43,6 +43,7 @@ static const struct clk_pll_characteristics upll_characteristics = {
 };
 
 static const struct clk_programmable_layout sam9x60_programmable_layout = {
+	.pres_mask = 0xff,
 	.pres_shift = 8,
 	.css_mask = 0x1f,
 	.have_slck_mck = 0,
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 007/135] thunderbolt: Read DP IN adapter first two dwords in one go
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (5 preceding siblings ...)
  2019-12-03 22:34 ` [PATCH 5.3 006/135] clk: at91: sam9x60: fix programmable clock Greg Kroah-Hartman
@ 2019-12-03 22:34 ` Greg Kroah-Hartman
  2019-12-03 22:34 ` [PATCH 5.3 008/135] thunderbolt: Fix lockdep circular locking depedency warning Greg Kroah-Hartman
                   ` (131 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Brad Campbell, Mika Westerberg, Sasha Levin

From: Mika Westerberg <mika.westerberg@linux.intel.com>

[ Upstream commit fd5c46b754d4799afda8dcdd6851e0390aa4961a ]

When we discover existing DP tunnels the code checks whether DP IN
adapter port is enabled by calling tb_dp_port_is_enabled() before it
continues the discovery process. On Light Ridge (gen 1) controller
reading only the first dword of the DP IN config space causes subsequent
access to the same DP IN port path config space to fail or return
invalid data as can be seen in the below splat:

  thunderbolt 0000:07:00.0: CFG_ERROR(0:d): Invalid config space or offset
  Call Trace:
   tb_cfg_read+0xb9/0xd0
   __tb_path_deactivate_hop+0x98/0x210
   tb_path_activate+0x228/0x7d0
   tb_tunnel_restart+0x95/0x200
   tb_handle_hotplug+0x30e/0x630
   process_one_work+0x1b4/0x340
   worker_thread+0x44/0x3d0
   kthread+0xeb/0x120
   ? process_one_work+0x340/0x340
   ? kthread_park+0xa0/0xa0
   ret_from_fork+0x1f/0x30

If both DP In adapter config dwords are read in one go the issue does
not reproduce. This is likely firmware bug but we can work it around by
always reading the two dwords in one go. There should be no harm for
other controllers either so can do it unconditionally.

Link: https://lkml.org/lkml/2019/8/28/160
Reported-by: Brad Campbell <lists2009@fnarfbargle.com>
Tested-by: Brad Campbell <lists2009@fnarfbargle.com>
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/thunderbolt/switch.c | 19 +++++++++++--------
 1 file changed, 11 insertions(+), 8 deletions(-)

diff --git a/drivers/thunderbolt/switch.c b/drivers/thunderbolt/switch.c
index 5668a44e0653b..00daf5a7f46a5 100644
--- a/drivers/thunderbolt/switch.c
+++ b/drivers/thunderbolt/switch.c
@@ -887,12 +887,13 @@ int tb_dp_port_set_hops(struct tb_port *port, unsigned int video,
  */
 bool tb_dp_port_is_enabled(struct tb_port *port)
 {
-	u32 data;
+	u32 data[2];
 
-	if (tb_port_read(port, &data, TB_CFG_PORT, port->cap_adap, 1))
+	if (tb_port_read(port, data, TB_CFG_PORT, port->cap_adap,
+			 ARRAY_SIZE(data)))
 		return false;
 
-	return !!(data & (TB_DP_VIDEO_EN | TB_DP_AUX_EN));
+	return !!(data[0] & (TB_DP_VIDEO_EN | TB_DP_AUX_EN));
 }
 
 /**
@@ -905,19 +906,21 @@ bool tb_dp_port_is_enabled(struct tb_port *port)
  */
 int tb_dp_port_enable(struct tb_port *port, bool enable)
 {
-	u32 data;
+	u32 data[2];
 	int ret;
 
-	ret = tb_port_read(port, &data, TB_CFG_PORT, port->cap_adap, 1);
+	ret = tb_port_read(port, data, TB_CFG_PORT, port->cap_adap,
+			   ARRAY_SIZE(data));
 	if (ret)
 		return ret;
 
 	if (enable)
-		data |= TB_DP_VIDEO_EN | TB_DP_AUX_EN;
+		data[0] |= TB_DP_VIDEO_EN | TB_DP_AUX_EN;
 	else
-		data &= ~(TB_DP_VIDEO_EN | TB_DP_AUX_EN);
+		data[0] &= ~(TB_DP_VIDEO_EN | TB_DP_AUX_EN);
 
-	return tb_port_write(port, &data, TB_CFG_PORT, port->cap_adap, 1);
+	return tb_port_write(port, data, TB_CFG_PORT, port->cap_adap,
+			     ARRAY_SIZE(data));
 }
 
 /* switch utility functions */
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 008/135] thunderbolt: Fix lockdep circular locking depedency warning
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (6 preceding siblings ...)
  2019-12-03 22:34 ` [PATCH 5.3 007/135] thunderbolt: Read DP IN adapter first two dwords in one go Greg Kroah-Hartman
@ 2019-12-03 22:34 ` Greg Kroah-Hartman
  2019-12-03 22:34 ` [PATCH 5.3 009/135] clocksource/drivers/mediatek: Fix error handling Greg Kroah-Hartman
                   ` (130 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dominik Brodowski, Mika Westerberg,
	Sasha Levin

From: Mika Westerberg <mika.westerberg@linux.intel.com>

[ Upstream commit 6f6709734274aef75058356e029d5e8f86d0d53b ]

When lockdep is enabled, plugging Thunderbolt dock on Dominik's laptop
triggers following splat:

  ======================================================
  WARNING: possible circular locking dependency detected
  5.3.0-rc6+ #1 Tainted: G                T
  ------------------------------------------------------
  pool-/usr/lib/b/1258 is trying to acquire lock:
  000000005ab0ad43 (pci_rescan_remove_lock){+.+.}, at: authorized_store+0xe8/0x210

  but task is already holding lock:
  00000000bfb796b5 (&tb->lock){+.+.}, at: authorized_store+0x7c/0x210

  which lock already depends on the new lock.

  the existing dependency chain (in reverse order) is:

  -> #1 (&tb->lock){+.+.}:
         __mutex_lock+0xac/0x9a0
         tb_domain_add+0x2d/0x130
         nhi_probe+0x1dd/0x330
         pci_device_probe+0xd2/0x150
         really_probe+0xee/0x280
         driver_probe_device+0x50/0xc0
         bus_for_each_drv+0x84/0xd0
         __device_attach+0xe4/0x150
         pci_bus_add_device+0x4e/0x70
         pci_bus_add_devices+0x2e/0x66
         pci_bus_add_devices+0x59/0x66
         pci_bus_add_devices+0x59/0x66
         enable_slot+0x344/0x450
         acpiphp_check_bridge.part.0+0x119/0x150
         acpiphp_hotplug_notify+0xaa/0x140
         acpi_device_hotplug+0xa2/0x3f0
         acpi_hotplug_work_fn+0x1a/0x30
         process_one_work+0x234/0x580
         worker_thread+0x50/0x3b0
         kthread+0x10a/0x140
         ret_from_fork+0x3a/0x50

  -> #0 (pci_rescan_remove_lock){+.+.}:
         __lock_acquire+0xe54/0x1ac0
         lock_acquire+0xb8/0x1b0
         __mutex_lock+0xac/0x9a0
         authorized_store+0xe8/0x210
         kernfs_fop_write+0x125/0x1b0
         vfs_write+0xc2/0x1d0
         ksys_write+0x6c/0xf0
         do_syscall_64+0x50/0x180
         entry_SYSCALL_64_after_hwframe+0x49/0xbe

  other info that might help us debug this:
   Possible unsafe locking scenario:
         CPU0                    CPU1
         ----                    ----
    lock(&tb->lock);
                                 lock(pci_rescan_remove_lock);
                                 lock(&tb->lock);
    lock(pci_rescan_remove_lock);

   *** DEADLOCK ***
  5 locks held by pool-/usr/lib/b/1258:
   #0: 000000003df1a1ad (&f->f_pos_lock){+.+.}, at: __fdget_pos+0x4d/0x60
   #1: 0000000095a40b02 (sb_writers#6){.+.+}, at: vfs_write+0x185/0x1d0
   #2: 0000000017a7d714 (&of->mutex){+.+.}, at: kernfs_fop_write+0xf2/0x1b0
   #3: 000000004f262981 (kn->count#208){.+.+}, at: kernfs_fop_write+0xfa/0x1b0
   #4: 00000000bfb796b5 (&tb->lock){+.+.}, at: authorized_store+0x7c/0x210

  stack backtrace:
  CPU: 0 PID: 1258 Comm: pool-/usr/lib/b Tainted: G                T 5.3.0-rc6+ #1

On an system using ACPI hotplug the host router gets hotplugged first and then
the firmware starts sending notifications about connected devices so the above
scenario should not happen in reality. However, after taking a second
look at commit a03e828915c0 ("thunderbolt: Serialize PCIe tunnel
creation with PCI rescan") that introduced the locking, I don't think it
is actually correct. It may have cured the symptom but probably the real
root cause was somewhere closer to PCI stack and possibly is already
fixed with recent kernels. I also tried to reproduce the original issue
with the commit reverted but could not.

So to keep lockdep happy and the code bit less complex drop calls to
pci_lock_rescan_remove()/pci_unlock_rescan_remove() in
tb_switch_set_authorized() effectively reverting a03e828915c0.

Link: https://lkml.org/lkml/2019/8/30/513
Fixes: a03e828915c0 ("thunderbolt: Serialize PCIe tunnel creation with PCI rescan")
Reported-by: Dominik Brodowski <linux@dominikbrodowski.net>
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/thunderbolt/switch.c | 9 ---------
 1 file changed, 9 deletions(-)

diff --git a/drivers/thunderbolt/switch.c b/drivers/thunderbolt/switch.c
index 00daf5a7f46a5..28395c3dcfed5 100644
--- a/drivers/thunderbolt/switch.c
+++ b/drivers/thunderbolt/switch.c
@@ -1025,13 +1025,6 @@ static int tb_switch_set_authorized(struct tb_switch *sw, unsigned int val)
 	if (sw->authorized)
 		goto unlock;
 
-	/*
-	 * Make sure there is no PCIe rescan ongoing when a new PCIe
-	 * tunnel is created. Otherwise the PCIe rescan code might find
-	 * the new tunnel too early.
-	 */
-	pci_lock_rescan_remove();
-
 	switch (val) {
 	/* Approve switch */
 	case 1:
@@ -1051,8 +1044,6 @@ static int tb_switch_set_authorized(struct tb_switch *sw, unsigned int val)
 		break;
 	}
 
-	pci_unlock_rescan_remove();
-
 	if (!ret) {
 		sw->authorized = val;
 		/* Notify status change to the userspace */
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 009/135] clocksource/drivers/mediatek: Fix error handling
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (7 preceding siblings ...)
  2019-12-03 22:34 ` [PATCH 5.3 008/135] thunderbolt: Fix lockdep circular locking depedency warning Greg Kroah-Hartman
@ 2019-12-03 22:34 ` Greg Kroah-Hartman
  2019-12-03 22:34 ` [PATCH 5.3 010/135] soundwire: intel: fix intel_register_dai PDI offsets and numbers Greg Kroah-Hartman
                   ` (129 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Fabien Parent, Daniel Lezcano, Sasha Levin

From: Fabien Parent <fparent@baylibre.com>

[ Upstream commit 41d49e7939de5ec532d86494185b2ca2e99c848a ]

When timer_of_init fails, it cleans up after itself by undoing
everything it did during the initialization function.

mtk_syst_init and mtk_gpt_init both call timer_of_cleanup if
timer_of_init fails. timer_of_cleanup try to release the resource
taken.  Since these resources have already been cleaned up by
timer_of_init, we end up getting a few warnings printed:

[    0.001935] WARNING: CPU: 0 PID: 0 at __clk_put+0xe8/0x128
[    0.002650] Modules linked in:
[    0.003058] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.19.67+ #1
[    0.003852] Hardware name: MediaTek MT8183 (DT)
[    0.004446] pstate: 20400085 (nzCv daIf +PAN -UAO)
[    0.005073] pc : __clk_put+0xe8/0x128
[    0.005555] lr : clk_put+0xc/0x14
[    0.005988] sp : ffffff80090b3ea0
[    0.006422] x29: ffffff80090b3ea0 x28: 0000000040e20018
[    0.007121] x27: ffffffc07bfff780 x26: 0000000000000001
[    0.007819] x25: ffffff80090bda80 x24: ffffff8008ec5828
[    0.008517] x23: ffffff80090bd000 x22: ffffff8008d8b2e8
[    0.009216] x21: 0000000000000001 x20: fffffffffffffdfb
[    0.009914] x19: ffffff8009166180 x18: 00000000002bffa8
[    0.010612] x17: ffffffc012996980 x16: 0000000000000000
[    0.011311] x15: ffffffbf004a6800 x14: 3536343038393334
[    0.012009] x13: 2079726576652073 x12: 7eb9c62c5c38f100
[    0.012707] x11: ffffff80090b3ba0 x10: ffffff80090b3ba0
[    0.013405] x9 : 0000000000000004 x8 : 0000000000000040
[    0.014103] x7 : ffffffc079400270 x6 : 0000000000000000
[    0.014801] x5 : ffffffc079400248 x4 : 0000000000000000
[    0.015499] x3 : 0000000000000000 x2 : 0000000000000000
[    0.016197] x1 : ffffff80091661c0 x0 : fffffffffffffdfb
[    0.016896] Call trace:
[    0.017218]  __clk_put+0xe8/0x128
[    0.017654]  clk_put+0xc/0x14
[    0.018048]  timer_of_cleanup+0x60/0x7c
[    0.018551]  mtk_syst_init+0x8c/0x9c
[    0.019020]  timer_probe+0x6c/0xe0
[    0.019469]  time_init+0x14/0x44
[    0.019893]  start_kernel+0x2d0/0x46c
[    0.020378] ---[ end trace 8c1efabea1267649 ]---
[    0.020982] ------------[ cut here ]------------
[    0.021586] Trying to vfree() nonexistent vm area ((____ptrval____))
[    0.022427] WARNING: CPU: 0 PID: 0 at __vunmap+0xd0/0xd8
[    0.023119] Modules linked in:
[    0.023524] CPU: 0 PID: 0 Comm: swapper/0 Tainted: G        W         4.19.67+ #1
[    0.024498] Hardware name: MediaTek MT8183 (DT)
[    0.025091] pstate: 60400085 (nZCv daIf +PAN -UAO)
[    0.025718] pc : __vunmap+0xd0/0xd8
[    0.026176] lr : __vunmap+0xd0/0xd8
[    0.026632] sp : ffffff80090b3e90
[    0.027066] x29: ffffff80090b3e90 x28: 0000000040e20018
[    0.027764] x27: ffffffc07bfff780 x26: 0000000000000001
[    0.028462] x25: ffffff80090bda80 x24: ffffff8008ec5828
[    0.029160] x23: ffffff80090bd000 x22: ffffff8008d8b2e8
[    0.029858] x21: 0000000000000000 x20: 0000000000000000
[    0.030556] x19: ffffff800800d000 x18: 00000000002bffa8
[    0.031254] x17: 0000000000000000 x16: 0000000000000000
[    0.031952] x15: ffffffbf004a6800 x14: 3536343038393334
[    0.032651] x13: 2079726576652073 x12: 7eb9c62c5c38f100
[    0.033349] x11: ffffff80090b3b40 x10: ffffff80090b3b40
[    0.034047] x9 : 0000000000000005 x8 : 5f5f6c6176727470
[    0.034745] x7 : 5f5f5f5f28282061 x6 : ffffff80091c86ef
[    0.035443] x5 : ffffff800852b690 x4 : 0000000000000000
[    0.036141] x3 : 0000000000000002 x2 : 0000000000000002
[    0.036839] x1 : 7eb9c62c5c38f100 x0 : 7eb9c62c5c38f100
[    0.037536] Call trace:
[    0.037859]  __vunmap+0xd0/0xd8
[    0.038271]  vunmap+0x24/0x30
[    0.038664]  __iounmap+0x2c/0x34
[    0.039088]  timer_of_cleanup+0x70/0x7c
[    0.039591]  mtk_syst_init+0x8c/0x9c
[    0.040060]  timer_probe+0x6c/0xe0
[    0.040507]  time_init+0x14/0x44
[    0.040932]  start_kernel+0x2d0/0x46c

This commit remove the calls to timer_of_cleanup when timer_of_init
fails since it is unnecessary and actually cause warnings to be printed.

Fixes: a0858f937960 ("mediatek: Convert the driver to timer-of")
Signed-off-by: Fabien Parent <fparent@baylibre.com>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Link: https://lore.kernel.org/linux-arm-kernel/20190919191315.25190-1-fparent@baylibre.com/
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clocksource/timer-mediatek.c | 10 ++--------
 1 file changed, 2 insertions(+), 8 deletions(-)

diff --git a/drivers/clocksource/timer-mediatek.c b/drivers/clocksource/timer-mediatek.c
index a562f491b0f8d..9318edcd89635 100644
--- a/drivers/clocksource/timer-mediatek.c
+++ b/drivers/clocksource/timer-mediatek.c
@@ -268,15 +268,12 @@ static int __init mtk_syst_init(struct device_node *node)
 
 	ret = timer_of_init(node, &to);
 	if (ret)
-		goto err;
+		return ret;
 
 	clockevents_config_and_register(&to.clkevt, timer_of_rate(&to),
 					TIMER_SYNC_TICKS, 0xffffffff);
 
 	return 0;
-err:
-	timer_of_cleanup(&to);
-	return ret;
 }
 
 static int __init mtk_gpt_init(struct device_node *node)
@@ -293,7 +290,7 @@ static int __init mtk_gpt_init(struct device_node *node)
 
 	ret = timer_of_init(node, &to);
 	if (ret)
-		goto err;
+		return ret;
 
 	/* Configure clock source */
 	mtk_gpt_setup(&to, TIMER_CLK_SRC, GPT_CTRL_OP_FREERUN);
@@ -311,9 +308,6 @@ static int __init mtk_gpt_init(struct device_node *node)
 	mtk_gpt_enable_irq(&to, TIMER_CLK_EVT);
 
 	return 0;
-err:
-	timer_of_cleanup(&to);
-	return ret;
 }
 TIMER_OF_DECLARE(mtk_mt6577, "mediatek,mt6577-timer", mtk_gpt_init);
 TIMER_OF_DECLARE(mtk_mt6765, "mediatek,mt6765-timer", mtk_syst_init);
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 010/135] soundwire: intel: fix intel_register_dai PDI offsets and numbers
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (8 preceding siblings ...)
  2019-12-03 22:34 ` [PATCH 5.3 009/135] clocksource/drivers/mediatek: Fix error handling Greg Kroah-Hartman
@ 2019-12-03 22:34 ` Greg Kroah-Hartman
  2019-12-03 22:34 ` [PATCH 5.3 011/135] ASoC: msm8916-wcd-analog: Fix RX1 selection in RDAC2 MUX Greg Kroah-Hartman
                   ` (128 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ranjani Sridharan, Bard Liao,
	Pierre-Louis Bossart, Vinod Koul, Sasha Levin

From: Bard Liao <yung-chuan.liao@linux.intel.com>

[ Upstream commit cf9249626f72878b6d205a4965093cba5cce98df ]

There are two issues, likely copy/paste:

1. Use cdns->pcm.num_in instead of stream_num_in for consistency with
the rest of the code. This was not detected earlier since platforms did
not have input-only PDIs.

2. use the correct offset for bi-dir PDM, based on IN and OUT
PDIs. Again this was not detected since PDM was not supported earlier.

Reported-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Link: https://lore.kernel.org/r/20190916192348.467-2-pierre-louis.bossart@linux.intel.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/soundwire/intel.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/soundwire/intel.c b/drivers/soundwire/intel.c
index ec25a71d08873..db9c138adb1ff 100644
--- a/drivers/soundwire/intel.c
+++ b/drivers/soundwire/intel.c
@@ -765,7 +765,7 @@ static int intel_register_dai(struct sdw_intel *sdw)
 	/* Create PCM DAIs */
 	stream = &cdns->pcm;
 
-	ret = intel_create_dai(cdns, dais, INTEL_PDI_IN, stream->num_in,
+	ret = intel_create_dai(cdns, dais, INTEL_PDI_IN, cdns->pcm.num_in,
 			       off, stream->num_ch_in, true);
 	if (ret)
 		return ret;
@@ -796,7 +796,7 @@ static int intel_register_dai(struct sdw_intel *sdw)
 	if (ret)
 		return ret;
 
-	off += cdns->pdm.num_bd;
+	off += cdns->pdm.num_out;
 	ret = intel_create_dai(cdns, dais, INTEL_PDI_BD, cdns->pdm.num_bd,
 			       off, stream->num_ch_bd, false);
 	if (ret)
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 011/135] ASoC: msm8916-wcd-analog: Fix RX1 selection in RDAC2 MUX
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (9 preceding siblings ...)
  2019-12-03 22:34 ` [PATCH 5.3 010/135] soundwire: intel: fix intel_register_dai PDI offsets and numbers Greg Kroah-Hartman
@ 2019-12-03 22:34 ` Greg Kroah-Hartman
  2019-12-03 22:34 ` [PATCH 5.3 012/135] ASoC: compress: fix unsigned integer overflow check Greg Kroah-Hartman
                   ` (127 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Stephan Gerhold, Srinivas Kandagatla,
	Mark Brown, Sasha Levin

From: Stephan Gerhold <stephan@gerhold.net>

[ Upstream commit 9110d1b0e229cebb1ffce0c04db2b22beffd513d ]

According to the PM8916 Hardware Register Description,
CDC_D_CDC_CONN_HPHR_DAC_CTL has only a single bit (RX_SEL)
to switch between RX1 (0) and RX2 (1). It is not possible to
disable it entirely to achieve the "ZERO" state.

However, at the moment the "RDAC2 MUX" mixer defines three possible
values ("ZERO", "RX2" and "RX1"). Setting the mixer to "ZERO"
actually configures it to RX1. Setting the mixer to "RX1" has
(seemingly) no effect.

Remove "ZERO" and replace it with "RX1" to fix this.

Fixes: 585e881e5b9e ("ASoC: codecs: Add msm8916-wcd analog codec")
Signed-off-by: Stephan Gerhold <stephan@gerhold.net>
Acked-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Link: https://lore.kernel.org/r/20191020153007.206070-1-stephan@gerhold.net
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/codecs/msm8916-wcd-analog.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/sound/soc/codecs/msm8916-wcd-analog.c b/sound/soc/codecs/msm8916-wcd-analog.c
index 368b6c09474bb..aa9a8ac987dc0 100644
--- a/sound/soc/codecs/msm8916-wcd-analog.c
+++ b/sound/soc/codecs/msm8916-wcd-analog.c
@@ -306,7 +306,7 @@ struct pm8916_wcd_analog_priv {
 };
 
 static const char *const adc2_mux_text[] = { "ZERO", "INP2", "INP3" };
-static const char *const rdac2_mux_text[] = { "ZERO", "RX2", "RX1" };
+static const char *const rdac2_mux_text[] = { "RX1", "RX2" };
 static const char *const hph_text[] = { "ZERO", "Switch", };
 
 static const struct soc_enum hph_enum = SOC_ENUM_SINGLE_VIRT(
@@ -321,7 +321,7 @@ static const struct soc_enum adc2_enum = SOC_ENUM_SINGLE_VIRT(
 
 /* RDAC2 MUX */
 static const struct soc_enum rdac2_mux_enum = SOC_ENUM_SINGLE(
-			CDC_D_CDC_CONN_HPHR_DAC_CTL, 0, 3, rdac2_mux_text);
+			CDC_D_CDC_CONN_HPHR_DAC_CTL, 0, 2, rdac2_mux_text);
 
 static const struct snd_kcontrol_new spkr_switch[] = {
 	SOC_DAPM_SINGLE("Switch", CDC_A_SPKR_DAC_CTL, 7, 1, 0)
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 012/135] ASoC: compress: fix unsigned integer overflow check
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (10 preceding siblings ...)
  2019-12-03 22:34 ` [PATCH 5.3 011/135] ASoC: msm8916-wcd-analog: Fix RX1 selection in RDAC2 MUX Greg Kroah-Hartman
@ 2019-12-03 22:34 ` Greg Kroah-Hartman
  2019-12-03 22:34 ` [PATCH 5.3 013/135] reset: Fix memory leak in reset_control_array_put() Greg Kroah-Hartman
                   ` (126 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Xiaojun Sang, Srinivas Kandagatla,
	Vinod Koul, Mark Brown, Sasha Levin

From: Xiaojun Sang <xsang@codeaurora.org>

[ Upstream commit d3645b055399538415586ebaacaedebc1e5899b0 ]

Parameter fragments and fragment_size are type of u32. U32_MAX is
the correct check.

Signed-off-by: Xiaojun Sang <xsang@codeaurora.org>
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Acked-by: Vinod Koul <vkoul@kernel.org>
Link: https://lore.kernel.org/r/20191021095432.5639-1-srinivas.kandagatla@linaro.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/core/compress_offload.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c
index 41905afada63f..f34ce564d92c4 100644
--- a/sound/core/compress_offload.c
+++ b/sound/core/compress_offload.c
@@ -528,7 +528,7 @@ static int snd_compress_check_input(struct snd_compr_params *params)
 {
 	/* first let's check the buffer parameter's */
 	if (params->buffer.fragment_size == 0 ||
-	    params->buffer.fragments > INT_MAX / params->buffer.fragment_size ||
+	    params->buffer.fragments > U32_MAX / params->buffer.fragment_size ||
 	    params->buffer.fragments == 0)
 		return -EINVAL;
 
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 013/135] reset: Fix memory leak in reset_control_array_put()
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (11 preceding siblings ...)
  2019-12-03 22:34 ` [PATCH 5.3 012/135] ASoC: compress: fix unsigned integer overflow check Greg Kroah-Hartman
@ 2019-12-03 22:34 ` Greg Kroah-Hartman
  2019-12-03 22:34 ` [PATCH 5.3 014/135] clk: samsung: exynos5433: Fix error paths Greg Kroah-Hartman
                   ` (125 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Kishon Vijay Abraham I,
	Philipp Zabel, Sasha Levin

From: Kishon Vijay Abraham I <kishon@ti.com>

[ Upstream commit 532f9cd6ee994ed10403e856ca27501428048597 ]

Memory allocated for 'struct reset_control_array' in
of_reset_control_array_get() is never freed in
reset_control_array_put() resulting in kmemleak showing
the following backtrace.

  backtrace:
    [<00000000c5f17595>] __kmalloc+0x1b0/0x2b0
    [<00000000bd499e13>] of_reset_control_array_get+0xa4/0x180
    [<000000004cc02754>] 0xffff800008c669e4
    [<0000000050a83b24>] platform_drv_probe+0x50/0xa0
    [<00000000d3a0b0bc>] really_probe+0x108/0x348
    [<000000005aa458ac>] driver_probe_device+0x58/0x100
    [<000000008853626c>] device_driver_attach+0x6c/0x90
    [<0000000085308d19>] __driver_attach+0x84/0xc8
    [<00000000080d35f2>] bus_for_each_dev+0x74/0xc8
    [<00000000dd7f015b>] driver_attach+0x20/0x28
    [<00000000923ba6e6>] bus_add_driver+0x148/0x1f0
    [<0000000061473b66>] driver_register+0x60/0x110
    [<00000000c5bec167>] __platform_driver_register+0x40/0x48
    [<000000007c764b4f>] 0xffff800008c6c020
    [<0000000047ec2e8c>] do_one_initcall+0x5c/0x1b0
    [<0000000093d4b50d>] do_init_module+0x54/0x1d0

Fixes: 17c82e206d2a ("reset: Add APIs to manage array of resets")
Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/reset/core.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/reset/core.c b/drivers/reset/core.c
index 213ff40dda110..36b1ff69b1e2a 100644
--- a/drivers/reset/core.c
+++ b/drivers/reset/core.c
@@ -748,6 +748,7 @@ static void reset_control_array_put(struct reset_control_array *resets)
 	for (i = 0; i < resets->num_rstcs; i++)
 		__reset_control_put_internal(resets->rstc[i]);
 	mutex_unlock(&reset_list_mutex);
+	kfree(resets);
 }
 
 /**
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 014/135] clk: samsung: exynos5433: Fix error paths
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (12 preceding siblings ...)
  2019-12-03 22:34 ` [PATCH 5.3 013/135] reset: Fix memory leak in reset_control_array_put() Greg Kroah-Hartman
@ 2019-12-03 22:34 ` Greg Kroah-Hartman
  2019-12-03 22:34 ` [PATCH 5.3 015/135] clk: samsung: exynos542x: Move G3D subsystem clocks to its sub-CMU Greg Kroah-Hartman
                   ` (124 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Marek Szyprowski,
	Krzysztof Kozlowski, Chanwoo Choi, kbuild test robot,
	Sylwester Nawrocki, Sasha Levin

From: Marek Szyprowski <m.szyprowski@samsung.com>

[ Upstream commit faac3604d05e8015567124e5ee79edc3f1568a89 ]

Add checking the value returned by samsung_clk_alloc_reg_dump() and
devm_kcalloc(). While fixing this, also release all gathered clocks.

Fixes: 523d3de41f02 ("clk: samsung: exynos5433: Add support for runtime PM")
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Reviewed-by: Krzysztof Kozlowski <krzk@kernel.org>
Acked-by: Chanwoo Choi <cw00.choi@samsung.com>
[s.nawrocki: squashed patch from K. Kozlowski adding missing slab.h header]
Reported-by: kbuild test robot <lkp@intel.com>
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/samsung/clk-exynos5433.c | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/drivers/clk/samsung/clk-exynos5433.c b/drivers/clk/samsung/clk-exynos5433.c
index 7824c2ba3d8e6..4b1aa9382ad28 100644
--- a/drivers/clk/samsung/clk-exynos5433.c
+++ b/drivers/clk/samsung/clk-exynos5433.c
@@ -13,6 +13,7 @@
 #include <linux/of_device.h>
 #include <linux/platform_device.h>
 #include <linux/pm_runtime.h>
+#include <linux/slab.h>
 
 #include <dt-bindings/clock/exynos5433.h>
 
@@ -5584,6 +5585,8 @@ static int __init exynos5433_cmu_probe(struct platform_device *pdev)
 
 	data->clk_save = samsung_clk_alloc_reg_dump(info->clk_regs,
 						    info->nr_clk_regs);
+	if (!data->clk_save)
+		return -ENOMEM;
 	data->nr_clk_save = info->nr_clk_regs;
 	data->clk_suspend = info->suspend_regs;
 	data->nr_clk_suspend = info->nr_suspend_regs;
@@ -5592,12 +5595,19 @@ static int __init exynos5433_cmu_probe(struct platform_device *pdev)
 	if (data->nr_pclks > 0) {
 		data->pclks = devm_kcalloc(dev, sizeof(struct clk *),
 					   data->nr_pclks, GFP_KERNEL);
-
+		if (!data->pclks) {
+			kfree(data->clk_save);
+			return -ENOMEM;
+		}
 		for (i = 0; i < data->nr_pclks; i++) {
 			struct clk *clk = of_clk_get(dev->of_node, i);
 
-			if (IS_ERR(clk))
+			if (IS_ERR(clk)) {
+				kfree(data->clk_save);
+				while (--i >= 0)
+					clk_put(data->pclks[i]);
 				return PTR_ERR(clk);
+			}
 			data->pclks[i] = clk;
 		}
 	}
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 015/135] clk: samsung: exynos542x: Move G3D subsystem clocks to its sub-CMU
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (13 preceding siblings ...)
  2019-12-03 22:34 ` [PATCH 5.3 014/135] clk: samsung: exynos5433: Fix error paths Greg Kroah-Hartman
@ 2019-12-03 22:34 ` Greg Kroah-Hartman
  2019-12-03 22:34 ` [PATCH 5.3 016/135] ASoC: kirkwood: fix external clock probe defer Greg Kroah-Hartman
                   ` (123 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Marian Mihailescu, Marek Szyprowski,
	Krzysztof Kozlowski, Sylwester Nawrocki, Sasha Levin

From: Marek Szyprowski <m.szyprowski@samsung.com>

[ Upstream commit c9f7567aff31348a3dcf54845f7e389f5df0c0c1 ]

G3D clocks require special handling of their parent bus clock during power
domain on/off sequences. Those clocks were not initially added to the
sub-CMU handler, because that time there was no open-source driver for the
G3D (MALI Panfrost) hardware module and it was not possible to test it.

This patch fixes this issue. Parent clock for G3D hardware block is now
properly preserved during G3D power domain on/off sequence. This restores
proper MALI Panfrost performance broken by commit 8686764fc071
("ARM: dts: exynos: Add G3D power domain to Exynos542x").

Reported-by: Marian Mihailescu <mihailescu2m@gmail.com>
Fixes: b06a532bf1fa ("clk: samsung: Add Exynos5 sub-CMU clock driver")
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Tested-by: Marian Mihailescu <mihailescu2m@gmail.com>
Acked-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/samsung/clk-exynos5420.c | 21 +++++++++++++++++++--
 1 file changed, 19 insertions(+), 2 deletions(-)

diff --git a/drivers/clk/samsung/clk-exynos5420.c b/drivers/clk/samsung/clk-exynos5420.c
index 7670cc596c742..dfa862d55246e 100644
--- a/drivers/clk/samsung/clk-exynos5420.c
+++ b/drivers/clk/samsung/clk-exynos5420.c
@@ -1172,8 +1172,6 @@ static const struct samsung_gate_clock exynos5x_gate_clks[] __initconst = {
 	GATE(CLK_SCLK_ISP_SENSOR2, "sclk_isp_sensor2", "dout_isp_sensor2",
 			GATE_TOP_SCLK_ISP, 12, CLK_SET_RATE_PARENT, 0),
 
-	GATE(CLK_G3D, "g3d", "mout_user_aclk_g3d", GATE_IP_G3D, 9, 0, 0),
-
 	/* CDREX */
 	GATE(CLK_CLKM_PHY0, "clkm_phy0", "dout_sclk_cdrex",
 			GATE_BUS_CDREX0, 0, 0, 0),
@@ -1248,6 +1246,15 @@ static struct exynos5_subcmu_reg_dump exynos5x_gsc_suspend_regs[] = {
 	{ DIV2_RATIO0, 0, 0x30 },	/* DIV dout_gscl_blk_300 */
 };
 
+static const struct samsung_gate_clock exynos5x_g3d_gate_clks[] __initconst = {
+	GATE(CLK_G3D, "g3d", "mout_user_aclk_g3d", GATE_IP_G3D, 9, 0, 0),
+};
+
+static struct exynos5_subcmu_reg_dump exynos5x_g3d_suspend_regs[] = {
+	{ GATE_IP_G3D, 0x3ff, 0x3ff },	/* G3D gates */
+	{ SRC_TOP5, 0, BIT(16) },	/* MUX mout_user_aclk_g3d */
+};
+
 static const struct samsung_div_clock exynos5x_mfc_div_clks[] __initconst = {
 	DIV(0, "dout_mfc_blk", "mout_user_aclk333", DIV4_RATIO, 0, 2),
 };
@@ -1320,6 +1327,14 @@ static const struct exynos5_subcmu_info exynos5x_gsc_subcmu = {
 	.pd_name	= "GSC",
 };
 
+static const struct exynos5_subcmu_info exynos5x_g3d_subcmu = {
+	.gate_clks	= exynos5x_g3d_gate_clks,
+	.nr_gate_clks	= ARRAY_SIZE(exynos5x_g3d_gate_clks),
+	.suspend_regs	= exynos5x_g3d_suspend_regs,
+	.nr_suspend_regs = ARRAY_SIZE(exynos5x_g3d_suspend_regs),
+	.pd_name	= "G3D",
+};
+
 static const struct exynos5_subcmu_info exynos5x_mfc_subcmu = {
 	.div_clks	= exynos5x_mfc_div_clks,
 	.nr_div_clks	= ARRAY_SIZE(exynos5x_mfc_div_clks),
@@ -1351,6 +1366,7 @@ static const struct exynos5_subcmu_info exynos5800_mau_subcmu = {
 static const struct exynos5_subcmu_info *exynos5x_subcmus[] = {
 	&exynos5x_disp_subcmu,
 	&exynos5x_gsc_subcmu,
+	&exynos5x_g3d_subcmu,
 	&exynos5x_mfc_subcmu,
 	&exynos5x_mscl_subcmu,
 };
@@ -1358,6 +1374,7 @@ static const struct exynos5_subcmu_info *exynos5x_subcmus[] = {
 static const struct exynos5_subcmu_info *exynos5800_subcmus[] = {
 	&exynos5x_disp_subcmu,
 	&exynos5x_gsc_subcmu,
+	&exynos5x_g3d_subcmu,
 	&exynos5x_mfc_subcmu,
 	&exynos5x_mscl_subcmu,
 	&exynos5800_mau_subcmu,
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 016/135] ASoC: kirkwood: fix external clock probe defer
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (14 preceding siblings ...)
  2019-12-03 22:34 ` [PATCH 5.3 015/135] clk: samsung: exynos542x: Move G3D subsystem clocks to its sub-CMU Greg Kroah-Hartman
@ 2019-12-03 22:34 ` Greg Kroah-Hartman
  2019-12-03 22:34 ` [PATCH 5.3 017/135] ASoC: kirkwood: fix device remove ordering Greg Kroah-Hartman
                   ` (122 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Russell King, Mark Brown, Sasha Levin

From: Russell King <rmk+kernel@armlinux.org.uk>

[ Upstream commit 4523817d51bc3b2ef38da768d004fda2c8bc41de ]

When our call to get the external clock fails, we forget to clean up
the enabled internal clock correctly.  Enable the clock after we have
obtained all our resources.

Fixes: 84aac6c79bfd ("ASoC: kirkwood: fix loss of external clock at probe time")
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Link: https://lore.kernel.org/r/E1iNGyK-0004oF-6A@rmk-PC.armlinux.org.uk
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/kirkwood/kirkwood-i2s.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/sound/soc/kirkwood/kirkwood-i2s.c b/sound/soc/kirkwood/kirkwood-i2s.c
index 3446a113f482e..c323ae314b554 100644
--- a/sound/soc/kirkwood/kirkwood-i2s.c
+++ b/sound/soc/kirkwood/kirkwood-i2s.c
@@ -559,10 +559,6 @@ static int kirkwood_i2s_dev_probe(struct platform_device *pdev)
 		return PTR_ERR(priv->clk);
 	}
 
-	err = clk_prepare_enable(priv->clk);
-	if (err < 0)
-		return err;
-
 	priv->extclk = devm_clk_get(&pdev->dev, "extclk");
 	if (IS_ERR(priv->extclk)) {
 		if (PTR_ERR(priv->extclk) == -EPROBE_DEFER)
@@ -578,6 +574,10 @@ static int kirkwood_i2s_dev_probe(struct platform_device *pdev)
 		}
 	}
 
+	err = clk_prepare_enable(priv->clk);
+	if (err < 0)
+		return err;
+
 	/* Some sensible defaults - this reflects the powerup values */
 	priv->ctl_play = KIRKWOOD_PLAYCTL_SIZE_24;
 	priv->ctl_rec = KIRKWOOD_RECCTL_SIZE_24;
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 017/135] ASoC: kirkwood: fix device remove ordering
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (15 preceding siblings ...)
  2019-12-03 22:34 ` [PATCH 5.3 016/135] ASoC: kirkwood: fix external clock probe defer Greg Kroah-Hartman
@ 2019-12-03 22:34 ` Greg Kroah-Hartman
  2019-12-03 22:34 ` [PATCH 5.3 018/135] arm64: dts: ls1028a: fix a compatible issue Greg Kroah-Hartman
                   ` (121 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Russell King, Mark Brown, Sasha Levin

From: Russell King <rmk+kernel@armlinux.org.uk>

[ Upstream commit dc39596a906d5b604f4e64597b6e904fc14625e8 ]

The devm conversion of kirkwood was incorrect; on removal, devm takes
effect after the "remove" function has returned.  So, the effect of
the conversion was to change the order during remove from:

  - snd_soc_unregister_component() (unpublishes interfaces)
  - clk_disable_unprepare()
  - cleanup resources

After the conversion, this became:

  - clk_disable_unprepare() - while the device may still be active
  - snd_soc_unregister_component()
  - cleanup resources

Hence, it introduces a bug, where the internal clock for the device
may be shut down before the device itself has been shut down.  It is
known that Marvell SoCs, including Dove, locks up if registers for a
peripheral that has its clocks disabled are accessed.

Fixes: f98fc0f8154e ("ASoC: kirkwood: replace platform to component")
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Link: https://lore.kernel.org/r/E1iNGyP-0004oN-BA@rmk-PC.armlinux.org.uk
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/kirkwood/kirkwood-i2s.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/sound/soc/kirkwood/kirkwood-i2s.c b/sound/soc/kirkwood/kirkwood-i2s.c
index c323ae314b554..eb38cdb37f0ea 100644
--- a/sound/soc/kirkwood/kirkwood-i2s.c
+++ b/sound/soc/kirkwood/kirkwood-i2s.c
@@ -591,7 +591,7 @@ static int kirkwood_i2s_dev_probe(struct platform_device *pdev)
 		priv->ctl_rec |= KIRKWOOD_RECCTL_BURST_128;
 	}
 
-	err = devm_snd_soc_register_component(&pdev->dev, &kirkwood_soc_component,
+	err = snd_soc_register_component(&pdev->dev, &kirkwood_soc_component,
 					 soc_dai, 2);
 	if (err) {
 		dev_err(&pdev->dev, "snd_soc_register_component failed\n");
@@ -614,6 +614,7 @@ static int kirkwood_i2s_dev_remove(struct platform_device *pdev)
 {
 	struct kirkwood_dma_data *priv = dev_get_drvdata(&pdev->dev);
 
+	snd_soc_unregister_component(&pdev->dev);
 	if (!IS_ERR(priv->extclk))
 		clk_disable_unprepare(priv->extclk);
 	clk_disable_unprepare(priv->clk);
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 018/135] arm64: dts: ls1028a: fix a compatible issue
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (16 preceding siblings ...)
  2019-12-03 22:34 ` [PATCH 5.3 017/135] ASoC: kirkwood: fix device remove ordering Greg Kroah-Hartman
@ 2019-12-03 22:34 ` Greg Kroah-Hartman
  2019-12-03 22:34 ` [PATCH 5.3 019/135] clk: samsung: exynos5420: Preserve PLL configuration during suspend/resume Greg Kroah-Hartman
                   ` (120 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yuantian Tang, Li Yang, Shawn Guo,
	Sasha Levin

From: Yuantian Tang <andy.tang@nxp.com>

[ Upstream commit 7eb3894b2fac978f811684e3ccb3cb0ad7820bef ]

The I2C multiplexer used on ls1028aqds is PCA9547, not PCA9847.
If the wrong compatible was used, this chip will not be able to
be probed correctly and hence fail to work.

Signed-off-by: Yuantian Tang <andy.tang@nxp.com>
Acked-by: Li Yang <leoyang.li@nxp.com>
Fixes: 8897f3255c9c ("arm64: dts: Add support for NXP LS1028A SoC")
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/freescale/fsl-ls1028a-qds.dts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1028a-qds.dts b/arch/arm64/boot/dts/freescale/fsl-ls1028a-qds.dts
index de6ef39f3118a..fce9343dc017a 100644
--- a/arch/arm64/boot/dts/freescale/fsl-ls1028a-qds.dts
+++ b/arch/arm64/boot/dts/freescale/fsl-ls1028a-qds.dts
@@ -99,7 +99,7 @@
 	status = "okay";
 
 	i2c-mux@77 {
-		compatible = "nxp,pca9847";
+		compatible = "nxp,pca9547";
 		reg = <0x77>;
 		#address-cells = <1>;
 		#size-cells = <0>;
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 019/135] clk: samsung: exynos5420: Preserve PLL configuration during suspend/resume
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (17 preceding siblings ...)
  2019-12-03 22:34 ` [PATCH 5.3 018/135] arm64: dts: ls1028a: fix a compatible issue Greg Kroah-Hartman
@ 2019-12-03 22:34 ` Greg Kroah-Hartman
  2019-12-03 22:34 ` [PATCH 5.3 020/135] pinctrl: cherryview: Allocate IRQ chip dynamic Greg Kroah-Hartman
                   ` (119 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Reported-by: Marian Mihailescu,
	Marek Szyprowski, Sylwester Nawrocki, Sasha Levin

From: Marek Szyprowski <m.szyprowski@samsung.com>

[ Upstream commit e9323b664ce29547d996195e8a6129a351c39108 ]

Properly save and restore all top PLL related configuration registers
during suspend/resume cycle. So far driver only handled EPLL and RPLL
clocks, all other were reset to default values after suspend/resume cycle.
This caused for example lower G3D (MALI Panfrost) performance after system
resume, even if performance governor has been selected.

Reported-by: Reported-by: Marian Mihailescu <mihailescu2m@gmail.com>
Fixes: 773424326b51 ("clk: samsung: exynos5420: add more registers to restore list")
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/samsung/clk-exynos5420.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/clk/samsung/clk-exynos5420.c b/drivers/clk/samsung/clk-exynos5420.c
index dfa862d55246e..31466cd1842f8 100644
--- a/drivers/clk/samsung/clk-exynos5420.c
+++ b/drivers/clk/samsung/clk-exynos5420.c
@@ -165,12 +165,18 @@ static const unsigned long exynos5x_clk_regs[] __initconst = {
 	GATE_BUS_CPU,
 	GATE_SCLK_CPU,
 	CLKOUT_CMU_CPU,
+	CPLL_CON0,
+	DPLL_CON0,
 	EPLL_CON0,
 	EPLL_CON1,
 	EPLL_CON2,
 	RPLL_CON0,
 	RPLL_CON1,
 	RPLL_CON2,
+	IPLL_CON0,
+	SPLL_CON0,
+	VPLL_CON0,
+	MPLL_CON0,
 	SRC_TOP0,
 	SRC_TOP1,
 	SRC_TOP2,
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 020/135] pinctrl: cherryview: Allocate IRQ chip dynamic
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (18 preceding siblings ...)
  2019-12-03 22:34 ` [PATCH 5.3 019/135] clk: samsung: exynos5420: Preserve PLL configuration during suspend/resume Greg Kroah-Hartman
@ 2019-12-03 22:34 ` Greg Kroah-Hartman
  2019-12-03 22:34 ` [PATCH 5.3 021/135] ARM: dts: imx6qdl-sabreauto: Fix storm of accelerometer interrupts Greg Kroah-Hartman
                   ` (118 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Andy Shevchenko, Mika Westerberg,
	Sasha Levin

From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>

[ Upstream commit 67d33aecd030226f0a577eb683aaa6853ecf8f91 ]

Keeping the IRQ chip definition static shares it with multiple instances
of the GPIO chip in the system. This is bad and now we get this warning
from GPIO library:

"detected irqchip that is shared with multiple gpiochips: please fix the driver."

Hence, move the IRQ chip definition from being driver static into the struct
intel_pinctrl. So a unique IRQ chip is used for each GPIO chip instance.

This patch is heavily based on the attachment to the bug by Christoph Marz.

BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=202543
Fixes: 6e08d6bbebeb ("pinctrl: Add Intel Cherryview/Braswell pin controller support")
Depends-on: 83b9dc11312f ("pinctrl: cherryview: Associate IRQ descriptors to irqdomain")
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pinctrl/intel/pinctrl-cherryview.c | 24 +++++++++++-----------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/drivers/pinctrl/intel/pinctrl-cherryview.c b/drivers/pinctrl/intel/pinctrl-cherryview.c
index 17a248b723b9b..8dfaf8e8c3a09 100644
--- a/drivers/pinctrl/intel/pinctrl-cherryview.c
+++ b/drivers/pinctrl/intel/pinctrl-cherryview.c
@@ -147,6 +147,7 @@ struct chv_pin_context {
  * @pctldesc: Pin controller description
  * @pctldev: Pointer to the pin controller device
  * @chip: GPIO chip in this pin controller
+ * @irqchip: IRQ chip in this pin controller
  * @regs: MMIO registers
  * @intr_lines: Stores mapping between 16 HW interrupt wires and GPIO
  *		offset (in GPIO number space)
@@ -162,6 +163,7 @@ struct chv_pinctrl {
 	struct pinctrl_desc pctldesc;
 	struct pinctrl_dev *pctldev;
 	struct gpio_chip chip;
+	struct irq_chip irqchip;
 	void __iomem *regs;
 	unsigned intr_lines[16];
 	const struct chv_community *community;
@@ -1466,16 +1468,6 @@ static int chv_gpio_irq_type(struct irq_data *d, unsigned int type)
 	return 0;
 }
 
-static struct irq_chip chv_gpio_irqchip = {
-	.name = "chv-gpio",
-	.irq_startup = chv_gpio_irq_startup,
-	.irq_ack = chv_gpio_irq_ack,
-	.irq_mask = chv_gpio_irq_mask,
-	.irq_unmask = chv_gpio_irq_unmask,
-	.irq_set_type = chv_gpio_irq_type,
-	.flags = IRQCHIP_SKIP_SET_WAKE,
-};
-
 static void chv_gpio_irq_handler(struct irq_desc *desc)
 {
 	struct gpio_chip *gc = irq_desc_get_handler_data(desc);
@@ -1615,7 +1607,15 @@ static int chv_gpio_probe(struct chv_pinctrl *pctrl, int irq)
 		}
 	}
 
-	ret = gpiochip_irqchip_add(chip, &chv_gpio_irqchip, 0,
+	pctrl->irqchip.name = "chv-gpio";
+	pctrl->irqchip.irq_startup = chv_gpio_irq_startup;
+	pctrl->irqchip.irq_ack = chv_gpio_irq_ack;
+	pctrl->irqchip.irq_mask = chv_gpio_irq_mask;
+	pctrl->irqchip.irq_unmask = chv_gpio_irq_unmask;
+	pctrl->irqchip.irq_set_type = chv_gpio_irq_type;
+	pctrl->irqchip.flags = IRQCHIP_SKIP_SET_WAKE;
+
+	ret = gpiochip_irqchip_add(chip, &pctrl->irqchip, 0,
 				   handle_bad_irq, IRQ_TYPE_NONE);
 	if (ret) {
 		dev_err(pctrl->dev, "failed to add IRQ chip\n");
@@ -1632,7 +1632,7 @@ static int chv_gpio_probe(struct chv_pinctrl *pctrl, int irq)
 		}
 	}
 
-	gpiochip_set_chained_irqchip(chip, &chv_gpio_irqchip, irq,
+	gpiochip_set_chained_irqchip(chip, &pctrl->irqchip, irq,
 				     chv_gpio_irq_handler);
 	return 0;
 }
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 021/135] ARM: dts: imx6qdl-sabreauto: Fix storm of accelerometer interrupts
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (19 preceding siblings ...)
  2019-12-03 22:34 ` [PATCH 5.3 020/135] pinctrl: cherryview: Allocate IRQ chip dynamic Greg Kroah-Hartman
@ 2019-12-03 22:34 ` Greg Kroah-Hartman
  2019-12-03 22:34 ` [PATCH 5.3 022/135] soc: imx: gpc: fix initialiser format Greg Kroah-Hartman
                   ` (117 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Fabio Estevam, Leonard Crestez,
	Shawn Guo, Sasha Levin

From: Fabio Estevam <festevam@gmail.com>

[ Upstream commit 7e5d0bf6afcc7bd72f78e7f33570e2e0945624f0 ]

Since commit a211b8c55f3c ("ARM: dts: imx6qdl-sabreauto: Add sensors")
a storm of accelerometer interrupts is seen:

[  114.211283] irq 260: nobody cared (try booting with the "irqpoll" option)
[  114.218108] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.3.4 #1
[  114.223960] Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree)
[  114.230531] [<c0112858>] (unwind_backtrace) from [<c010cdc8>] (show_stack+0x10/0x14)
[  114.238301] [<c010cdc8>] (show_stack) from [<c0c1aa1c>] (dump_stack+0xd8/0x110)
[  114.245644] [<c0c1aa1c>] (dump_stack) from [<c0193594>] (__report_bad_irq+0x30/0xc0)
[  114.253417] [<c0193594>] (__report_bad_irq) from [<c01933ac>] (note_interrupt+0x108/0x298)
[  114.261707] [<c01933ac>] (note_interrupt) from [<c018ffe4>] (handle_irq_event_percpu+0x70/0x80)
[  114.270433] [<c018ffe4>] (handle_irq_event_percpu) from [<c019002c>] (handle_irq_event+0x38/0x5c)
[  114.279326] [<c019002c>] (handle_irq_event) from [<c019438c>] (handle_level_irq+0xc8/0x154)
[  114.287701] [<c019438c>] (handle_level_irq) from [<c018eda0>] (generic_handle_irq+0x20/0x34)
[  114.296166] [<c018eda0>] (generic_handle_irq) from [<c0534214>] (mxc_gpio_irq_handler+0x30/0xf0)
[  114.304975] [<c0534214>] (mxc_gpio_irq_handler) from [<c0534334>] (mx3_gpio_irq_handler+0x60/0xb0)
[  114.313955] [<c0534334>] (mx3_gpio_irq_handler) from [<c018eda0>] (generic_handle_irq+0x20/0x34)
[  114.322762] [<c018eda0>] (generic_handle_irq) from [<c018f3ac>] (__handle_domain_irq+0x64/0xe0)
[  114.331485] [<c018f3ac>] (__handle_domain_irq) from [<c05215a8>] (gic_handle_irq+0x4c/0xa8)
[  114.339862] [<c05215a8>] (gic_handle_irq) from [<c0101a70>] (__irq_svc+0x70/0x98)
[  114.347361] Exception stack(0xc1301ec0 to 0xc1301f08)
[  114.352435] 1ec0: 00000001 00000006 00000000 c130c340 00000001 c130f688 9785636d c13ea2e8
[  114.360635] 1ee0: 9784907d 0000001a eaf99d78 0000001a 00000000 c1301f10 c0182b00 c0878de4
[  114.368830] 1f00: 20000013 ffffffff
[  114.372349] [<c0101a70>] (__irq_svc) from [<c0878de4>] (cpuidle_enter_state+0x168/0x5f4)
[  114.380464] [<c0878de4>] (cpuidle_enter_state) from [<c08792ac>] (cpuidle_enter+0x28/0x38)
[  114.388751] [<c08792ac>] (cpuidle_enter) from [<c015ef9c>] (do_idle+0x224/0x2a8)
[  114.396168] [<c015ef9c>] (do_idle) from [<c015f3b8>] (cpu_startup_entry+0x18/0x20)
[  114.403765] [<c015f3b8>] (cpu_startup_entry) from [<c1200e54>] (start_kernel+0x43c/0x500)
[  114.411958] handlers:
[  114.414302] [<a01028b8>] irq_default_primary_handler threaded [<fd7a3b08>] mma8452_interrupt
[  114.422974] Disabling IRQ #260

           CPU0       CPU1
....
260:     100001          0  gpio-mxc  31 Level     mma8451

The MMA8451 interrupt triggers as low level, so the GPIO6_IO31 pin
needs to activate its pull up, otherwise it will stay always at low level
generating multiple interrupts.

The current device tree does not configure the IOMUX for this pin, so
it uses whathever comes configured from the bootloader.

The IOMUXC_SW_PAD_CTL_PAD_EIM_BCLK register value comes as 0x8000 from
the bootloader, which has PKE bit cleared, hence disabling the
pull-up.

Instead of relying on a previous configuration from the bootloader,
configure the GPIO6_IO31 pin with pull-up enabled in order to fix
this problem.

Fixes: a211b8c55f3c ("ARM: dts: imx6qdl-sabreauto: Add sensors")
Signed-off-by: Fabio Estevam <festevam@gmail.com>
Reviewed-By: Leonard Crestez <leonard.crestez@nxp.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/imx6qdl-sabreauto.dtsi | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/arch/arm/boot/dts/imx6qdl-sabreauto.dtsi b/arch/arm/boot/dts/imx6qdl-sabreauto.dtsi
index f3404dd105377..cf628465cd0a3 100644
--- a/arch/arm/boot/dts/imx6qdl-sabreauto.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-sabreauto.dtsi
@@ -230,6 +230,8 @@
 			accelerometer@1c {
 				compatible = "fsl,mma8451";
 				reg = <0x1c>;
+				pinctrl-names = "default";
+				pinctrl-0 = <&pinctrl_mma8451_int>;
 				interrupt-parent = <&gpio6>;
 				interrupts = <31 IRQ_TYPE_LEVEL_LOW>;
 			};
@@ -628,6 +630,12 @@
 			>;
 		};
 
+		pinctrl_mma8451_int: mma8451intgrp {
+			fsl,pins = <
+				MX6QDL_PAD_EIM_BCLK__GPIO6_IO31		0xb0b1
+			>;
+		};
+
 		pinctrl_pwm3: pwm1grp {
 			fsl,pins = <
 				MX6QDL_PAD_SD4_DAT1__PWM3_OUT		0x1b0b1
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 022/135] soc: imx: gpc: fix initialiser format
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (20 preceding siblings ...)
  2019-12-03 22:34 ` [PATCH 5.3 021/135] ARM: dts: imx6qdl-sabreauto: Fix storm of accelerometer interrupts Greg Kroah-Hartman
@ 2019-12-03 22:34 ` Greg Kroah-Hartman
  2019-12-03 22:34 ` [PATCH 5.3 023/135] reset: fix reset_control_ops kerneldoc comment Greg Kroah-Hartman
                   ` (116 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ben Dooks, Lucas Stach, Shawn Guo,
	Sasha Levin

From: Ben Dooks <ben.dooks@codethink.co.uk>

[ Upstream commit 96ed1044fa98ea9e164fc1e679cad61575bf4f32 ]

Make the initialiers in imx_gpc_domains C99 format to fix the
following sparse warnings:

drivers/soc/imx/gpc.c:252:30: warning: obsolete array initializer, use C99 syntax
drivers/soc/imx/gpc.c:258:29: warning: obsolete array initializer, use C99 syntax
drivers/soc/imx/gpc.c:269:34: warning: obsolete array initializer, use C99 syntax
drivers/soc/imx/gpc.c:278:30: warning: obsolete array initializer, use C99 syntax

Signed-off-by: Ben Dooks <ben.dooks@codethink.co.uk>
Reviewed-by: Lucas Stach <l.stach@pengutronix.de>
Fixes: b0682d485f12 ("soc: imx: gpc: use GPC_PGC_DOMAIN_* indexes")
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/soc/imx/gpc.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/soc/imx/gpc.c b/drivers/soc/imx/gpc.c
index d9231bd3c691a..98b9d9a902ae3 100644
--- a/drivers/soc/imx/gpc.c
+++ b/drivers/soc/imx/gpc.c
@@ -249,13 +249,13 @@ static struct genpd_power_state imx6_pm_domain_pu_state = {
 };
 
 static struct imx_pm_domain imx_gpc_domains[] = {
-	[GPC_PGC_DOMAIN_ARM] {
+	[GPC_PGC_DOMAIN_ARM] = {
 		.base = {
 			.name = "ARM",
 			.flags = GENPD_FLAG_ALWAYS_ON,
 		},
 	},
-	[GPC_PGC_DOMAIN_PU] {
+	[GPC_PGC_DOMAIN_PU] = {
 		.base = {
 			.name = "PU",
 			.power_off = imx6_pm_domain_power_off,
@@ -266,7 +266,7 @@ static struct imx_pm_domain imx_gpc_domains[] = {
 		.reg_offs = 0x260,
 		.cntr_pdn_bit = 0,
 	},
-	[GPC_PGC_DOMAIN_DISPLAY] {
+	[GPC_PGC_DOMAIN_DISPLAY] = {
 		.base = {
 			.name = "DISPLAY",
 			.power_off = imx6_pm_domain_power_off,
@@ -275,7 +275,7 @@ static struct imx_pm_domain imx_gpc_domains[] = {
 		.reg_offs = 0x240,
 		.cntr_pdn_bit = 4,
 	},
-	[GPC_PGC_DOMAIN_PCI] {
+	[GPC_PGC_DOMAIN_PCI] = {
 		.base = {
 			.name = "PCI",
 			.power_off = imx6_pm_domain_power_off,
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 023/135] reset: fix reset_control_ops kerneldoc comment
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (21 preceding siblings ...)
  2019-12-03 22:34 ` [PATCH 5.3 022/135] soc: imx: gpc: fix initialiser format Greg Kroah-Hartman
@ 2019-12-03 22:34 ` Greg Kroah-Hartman
  2019-12-03 22:34 ` [PATCH 5.3 024/135] arm64: dts: imx8mm: fix compatible string for sdma Greg Kroah-Hartman
                   ` (115 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Randy Dunlap, Philipp Zabel, Sasha Levin

From: Randy Dunlap <rdunlap@infradead.org>

[ Upstream commit f430c7ed8bc22992ed528b518da465b060b9223f ]

Add a missing short description to the reset_control_ops documentation.

Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
[p.zabel@pengutronix.de: rebased and updated commit message]
Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/reset-controller.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/linux/reset-controller.h b/include/linux/reset-controller.h
index 9326d671b6e6c..8675ec64987bb 100644
--- a/include/linux/reset-controller.h
+++ b/include/linux/reset-controller.h
@@ -7,7 +7,7 @@
 struct reset_controller_dev;
 
 /**
- * struct reset_control_ops
+ * struct reset_control_ops - reset controller driver callbacks
  *
  * @reset: for self-deasserting resets, does all necessary
  *         things to reset the device
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 024/135] arm64: dts: imx8mm: fix compatible string for sdma
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (22 preceding siblings ...)
  2019-12-03 22:34 ` [PATCH 5.3 023/135] reset: fix reset_control_ops kerneldoc comment Greg Kroah-Hartman
@ 2019-12-03 22:34 ` Greg Kroah-Hartman
  2019-12-03 22:34 ` [PATCH 5.3 025/135] ASoC: SOF: ipc: Fix memory leak in sof_set_get_large_ctrl_data Greg Kroah-Hartman
                   ` (114 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Shengjiu Wang, Shawn Guo, Sasha Levin

From: Shengjiu Wang <shengjiu.wang@nxp.com>

[ Upstream commit e346ff93f02b1ba81e976d4e67ec56582dbdf7f1 ]

SDMA in i.MX8MM should use same configuration as i.MX8MQ
So need to change compatible string to be "fsl,imx8mq-sdma".

Fixes: a05ea40eb384 ("arm64: dts: imx: Add i.mx8mm dtsi support")
Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/freescale/imx8mm.dtsi | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/arch/arm64/boot/dts/freescale/imx8mm.dtsi b/arch/arm64/boot/dts/freescale/imx8mm.dtsi
index 0d0a6543e5db2..a9824b862c419 100644
--- a/arch/arm64/boot/dts/freescale/imx8mm.dtsi
+++ b/arch/arm64/boot/dts/freescale/imx8mm.dtsi
@@ -370,7 +370,7 @@
 			};
 
 			sdma2: dma-controller@302c0000 {
-				compatible = "fsl,imx8mm-sdma", "fsl,imx7d-sdma";
+				compatible = "fsl,imx8mm-sdma", "fsl,imx8mq-sdma";
 				reg = <0x302c0000 0x10000>;
 				interrupts = <GIC_SPI 103 IRQ_TYPE_LEVEL_HIGH>;
 				clocks = <&clk IMX8MM_CLK_SDMA2_ROOT>,
@@ -381,7 +381,7 @@
 			};
 
 			sdma3: dma-controller@302b0000 {
-				compatible = "fsl,imx8mm-sdma", "fsl,imx7d-sdma";
+				compatible = "fsl,imx8mm-sdma", "fsl,imx8mq-sdma";
 				reg = <0x302b0000 0x10000>;
 				interrupts = <GIC_SPI 34 IRQ_TYPE_LEVEL_HIGH>;
 				clocks = <&clk IMX8MM_CLK_SDMA3_ROOT>,
@@ -693,7 +693,7 @@
 			};
 
 			sdma1: dma-controller@30bd0000 {
-				compatible = "fsl,imx8mm-sdma", "fsl,imx7d-sdma";
+				compatible = "fsl,imx8mm-sdma", "fsl,imx8mq-sdma";
 				reg = <0x30bd0000 0x10000>;
 				interrupts = <GIC_SPI 2 IRQ_TYPE_LEVEL_HIGH>;
 				clocks = <&clk IMX8MM_CLK_SDMA1_ROOT>,
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 025/135] ASoC: SOF: ipc: Fix memory leak in sof_set_get_large_ctrl_data
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (23 preceding siblings ...)
  2019-12-03 22:34 ` [PATCH 5.3 024/135] arm64: dts: imx8mm: fix compatible string for sdma Greg Kroah-Hartman
@ 2019-12-03 22:34 ` Greg Kroah-Hartman
  2019-12-03 22:34 ` [PATCH 5.3 026/135] ASoC: ti: sdma-pcm: Add back the flags parameter for non standard dma names Greg Kroah-Hartman
                   ` (113 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Navid Emamdoost, Mark Brown, Sasha Levin

From: Navid Emamdoost <navid.emamdoost@gmail.com>

[ Upstream commit 45c1380358b12bf2d1db20a5874e9544f56b34ab ]

In the implementation of sof_set_get_large_ctrl_data() there is a memory
leak in case an error. Release partdata if sof_get_ctrl_copy_params()
fails.

Fixes: 54d198d5019d ("ASoC: SOF: Propagate sof_get_ctrl_copy_params() error properly")
Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Link: https://lore.kernel.org/r/20191027215330.12729-1-navid.emamdoost@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/sof/ipc.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/sound/soc/sof/ipc.c b/sound/soc/sof/ipc.c
index 20dfca9c93b76..c4086186722f3 100644
--- a/sound/soc/sof/ipc.c
+++ b/sound/soc/sof/ipc.c
@@ -578,8 +578,10 @@ static int sof_set_get_large_ctrl_data(struct snd_sof_dev *sdev,
 	else
 		err = sof_get_ctrl_copy_params(cdata->type, partdata, cdata,
 					       sparams);
-	if (err < 0)
+	if (err < 0) {
+		kfree(partdata);
 		return err;
+	}
 
 	msg_bytes = sparams->msg_bytes;
 	pl_size = sparams->pl_size;
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 026/135] ASoC: ti: sdma-pcm: Add back the flags parameter for non standard dma names
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (24 preceding siblings ...)
  2019-12-03 22:34 ` [PATCH 5.3 025/135] ASoC: SOF: ipc: Fix memory leak in sof_set_get_large_ctrl_data Greg Kroah-Hartman
@ 2019-12-03 22:34 ` Greg Kroah-Hartman
  2019-12-03 22:34 ` [PATCH 5.3 027/135] ASoC: rockchip: rockchip_max98090: Enable SHDN to fix headset detection Greg Kroah-Hartman
                   ` (112 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Peter Ujfalusi, Mark Brown, Sasha Levin

From: Peter Ujfalusi <peter.ujfalusi@ti.com>

[ Upstream commit dd7e8d903e1eef5a9234a2d69663dcbfeab79571 ]

When non standard names are used it is possible that one of the directions
are not provided, thus the flags needs to be present to tell the core that
we have half duplex setup.

Fixes: 642aafea8889 ("ASoC: ti: remove compat dma probing")
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
Link: https://lore.kernel.org/r/20191028115207.5142-1-peter.ujfalusi@ti.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/ti/sdma-pcm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sound/soc/ti/sdma-pcm.c b/sound/soc/ti/sdma-pcm.c
index a236350beb102..2b0bc234e1b69 100644
--- a/sound/soc/ti/sdma-pcm.c
+++ b/sound/soc/ti/sdma-pcm.c
@@ -62,7 +62,7 @@ int sdma_pcm_platform_register(struct device *dev,
 	config->chan_names[0] = txdmachan;
 	config->chan_names[1] = rxdmachan;
 
-	return devm_snd_dmaengine_pcm_register(dev, config, 0);
+	return devm_snd_dmaengine_pcm_register(dev, config, flags);
 }
 EXPORT_SYMBOL_GPL(sdma_pcm_platform_register);
 
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 027/135] ASoC: rockchip: rockchip_max98090: Enable SHDN to fix headset detection
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (25 preceding siblings ...)
  2019-12-03 22:34 ` [PATCH 5.3 026/135] ASoC: ti: sdma-pcm: Add back the flags parameter for non standard dma names Greg Kroah-Hartman
@ 2019-12-03 22:34 ` Greg Kroah-Hartman
  2019-12-03 22:34 ` [PATCH 5.3 028/135] clk: at91: avoid sleeping early Greg Kroah-Hartman
                   ` (111 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Cheng-Yi Chiang, Mark Brown, Sasha Levin

From: Cheng-Yi Chiang <cychiang@chromium.org>

[ Upstream commit 07c1b73e2a027ea9a52677beeb6a943a3e357139 ]

max98090 spec states that chip needs to be in turned-on state to supply
mic bias. Enable SHDN dapm widget along with MICBIAS widget to
actually turn on mic bias for proper headset button detection.
This is similar to cht_ti_jack_event in
sound/soc/intel/boards/cht_bsw_max98090_ti.c.

Note that due to ts3a227e reports the jack event right away before the
notifier is registered, if headset is plugged on boot, headset button
will not get detected until headset is unplugged and plugged. This is
still an issue to be fixed.

Signed-off-by: Cheng-Yi Chiang <cychiang@chromium.org>
Link: https://lore.kernel.org/r/20191028095229.99438-1-cychiang@chromium.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/rockchip/rockchip_max98090.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/sound/soc/rockchip/rockchip_max98090.c b/sound/soc/rockchip/rockchip_max98090.c
index 782e534d4c0dd..f2add1fe2e79d 100644
--- a/sound/soc/rockchip/rockchip_max98090.c
+++ b/sound/soc/rockchip/rockchip_max98090.c
@@ -67,10 +67,13 @@ static int rk_jack_event(struct notifier_block *nb, unsigned long event,
 	struct snd_soc_jack *jack = (struct snd_soc_jack *)data;
 	struct snd_soc_dapm_context *dapm = &jack->card->dapm;
 
-	if (event & SND_JACK_MICROPHONE)
+	if (event & SND_JACK_MICROPHONE) {
 		snd_soc_dapm_force_enable_pin(dapm, "MICBIAS");
-	else
+		snd_soc_dapm_force_enable_pin(dapm, "SHDN");
+	} else {
 		snd_soc_dapm_disable_pin(dapm, "MICBIAS");
+		snd_soc_dapm_disable_pin(dapm, "SHDN");
+	}
 
 	snd_soc_dapm_sync(dapm);
 
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 028/135] clk: at91: avoid sleeping early
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (26 preceding siblings ...)
  2019-12-03 22:34 ` [PATCH 5.3 027/135] ASoC: rockchip: rockchip_max98090: Enable SHDN to fix headset detection Greg Kroah-Hartman
@ 2019-12-03 22:34 ` Greg Kroah-Hartman
  2019-12-03 22:34 ` [PATCH 5.3 029/135] clk: sunxi: Fix operator precedence in sunxi_divs_clk_setup Greg Kroah-Hartman
                   ` (110 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Uwe Kleine-König,
	Alexandre Belloni, Stephen Boyd, Sasha Levin

From: Alexandre Belloni <alexandre.belloni@bootlin.com>

[ Upstream commit 658fd65cf0b0d511de1718e48d9a28844c385ae0 ]

It is not allowed to sleep to early in the boot process and this may lead
to kernel issues if the bootloader didn't prepare the slow clock and main
clock.

This results in the following error and dump stack on the AriettaG25:
   bad: scheduling from the idle thread!

Ensure it is possible to sleep, else simply have a delay.

Reported-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Link: https://lkml.kernel.org/r/20190920153906.20887-1-alexandre.belloni@bootlin.com
Fixes: 80eded6ce8bb ("clk: at91: add slow clks driver")
Tested-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/at91/clk-main.c |  5 ++++-
 drivers/clk/at91/sckc.c     | 20 ++++++++++++++++----
 2 files changed, 20 insertions(+), 5 deletions(-)

diff --git a/drivers/clk/at91/clk-main.c b/drivers/clk/at91/clk-main.c
index 311cea0c3ae2b..54b2b2dd2bb57 100644
--- a/drivers/clk/at91/clk-main.c
+++ b/drivers/clk/at91/clk-main.c
@@ -297,7 +297,10 @@ static int clk_main_probe_frequency(struct regmap *regmap)
 		regmap_read(regmap, AT91_CKGR_MCFR, &mcfr);
 		if (mcfr & AT91_PMC_MAINRDY)
 			return 0;
-		usleep_range(MAINF_LOOP_MIN_WAIT, MAINF_LOOP_MAX_WAIT);
+		if (system_state < SYSTEM_RUNNING)
+			udelay(MAINF_LOOP_MIN_WAIT);
+		else
+			usleep_range(MAINF_LOOP_MIN_WAIT, MAINF_LOOP_MAX_WAIT);
 	} while (time_before(prep_time, timeout));
 
 	return -ETIMEDOUT;
diff --git a/drivers/clk/at91/sckc.c b/drivers/clk/at91/sckc.c
index 9bfe9a28294a7..fac0ca56d42d9 100644
--- a/drivers/clk/at91/sckc.c
+++ b/drivers/clk/at91/sckc.c
@@ -76,7 +76,10 @@ static int clk_slow_osc_prepare(struct clk_hw *hw)
 
 	writel(tmp | osc->bits->cr_osc32en, sckcr);
 
-	usleep_range(osc->startup_usec, osc->startup_usec + 1);
+	if (system_state < SYSTEM_RUNNING)
+		udelay(osc->startup_usec);
+	else
+		usleep_range(osc->startup_usec, osc->startup_usec + 1);
 
 	return 0;
 }
@@ -187,7 +190,10 @@ static int clk_slow_rc_osc_prepare(struct clk_hw *hw)
 
 	writel(readl(sckcr) | osc->bits->cr_rcen, sckcr);
 
-	usleep_range(osc->startup_usec, osc->startup_usec + 1);
+	if (system_state < SYSTEM_RUNNING)
+		udelay(osc->startup_usec);
+	else
+		usleep_range(osc->startup_usec, osc->startup_usec + 1);
 
 	return 0;
 }
@@ -288,7 +294,10 @@ static int clk_sam9x5_slow_set_parent(struct clk_hw *hw, u8 index)
 
 	writel(tmp, sckcr);
 
-	usleep_range(SLOWCK_SW_TIME_USEC, SLOWCK_SW_TIME_USEC + 1);
+	if (system_state < SYSTEM_RUNNING)
+		udelay(SLOWCK_SW_TIME_USEC);
+	else
+		usleep_range(SLOWCK_SW_TIME_USEC, SLOWCK_SW_TIME_USEC + 1);
 
 	return 0;
 }
@@ -533,7 +542,10 @@ static int clk_sama5d4_slow_osc_prepare(struct clk_hw *hw)
 		return 0;
 	}
 
-	usleep_range(osc->startup_usec, osc->startup_usec + 1);
+	if (system_state < SYSTEM_RUNNING)
+		udelay(osc->startup_usec);
+	else
+		usleep_range(osc->startup_usec, osc->startup_usec + 1);
 	osc->prepared = true;
 
 	return 0;
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 029/135] clk: sunxi: Fix operator precedence in sunxi_divs_clk_setup
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (27 preceding siblings ...)
  2019-12-03 22:34 ` [PATCH 5.3 028/135] clk: at91: avoid sleeping early Greg Kroah-Hartman
@ 2019-12-03 22:34 ` Greg Kroah-Hartman
  2019-12-03 22:34 ` [PATCH 5.3 030/135] clk: sunxi-ng: a80: fix the zeroing of bits 16 and 18 Greg Kroah-Hartman
                   ` (109 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Nathan Chancellor, Maxime Ripard,
	Sasha Levin

From: Nathan Chancellor <natechancellor@gmail.com>

[ Upstream commit afdc74ed2d57e86c10b1d6831339770a802bab9a ]

r375326 in Clang exposes an issue with operator precedence in
sunxi_div_clk_setup:

drivers/clk/sunxi/clk-sunxi.c:1083:30: warning: operator '?:' has lower
precedence than '|'; '|' will be evaluated first
[-Wbitwise-conditional-parentheses]
                                                 data->div[i].critical ?
                                                 ~~~~~~~~~~~~~~~~~~~~~ ^
drivers/clk/sunxi/clk-sunxi.c:1083:30: note: place parentheses around
the '|' expression to silence this warning
                                                 data->div[i].critical ?
                                                                       ^
                                                                      )
drivers/clk/sunxi/clk-sunxi.c:1083:30: note: place parentheses around
the '?:' expression to evaluate it first
                                                 data->div[i].critical ?
                                                                       ^
                                                 (
1 warning generated.

It appears that the intention was for ?: to be evaluated first so that
CLK_IS_CRITICAL could be added to clkflags if the critical boolean was
set; right now, | is being evaluated first. Add parentheses around the
?: block to have it be evaluated first.

Fixes: 9919d44ff297 ("clk: sunxi: Use CLK_IS_CRITICAL flag for critical clks")
Link: https://github.com/ClangBuiltLinux/linux/issues/745
Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
Signed-off-by: Maxime Ripard <mripard@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/sunxi/clk-sunxi.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/clk/sunxi/clk-sunxi.c b/drivers/clk/sunxi/clk-sunxi.c
index d3a43381a7927..27201fd26e442 100644
--- a/drivers/clk/sunxi/clk-sunxi.c
+++ b/drivers/clk/sunxi/clk-sunxi.c
@@ -1080,8 +1080,8 @@ static struct clk ** __init sunxi_divs_clk_setup(struct device_node *node,
 						 rate_hw, rate_ops,
 						 gate_hw, &clk_gate_ops,
 						 clkflags |
-						 data->div[i].critical ?
-							CLK_IS_CRITICAL : 0);
+						 (data->div[i].critical ?
+							CLK_IS_CRITICAL : 0));
 
 		WARN_ON(IS_ERR(clk_data->clks[i]));
 	}
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 030/135] clk: sunxi-ng: a80: fix the zeroing of bits 16 and 18
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (28 preceding siblings ...)
  2019-12-03 22:34 ` [PATCH 5.3 029/135] clk: sunxi: Fix operator precedence in sunxi_divs_clk_setup Greg Kroah-Hartman
@ 2019-12-03 22:34 ` Greg Kroah-Hartman
  2019-12-03 22:34 ` [PATCH 5.3 031/135] ARM: dts: sun8i-a83t-tbs-a711: Fix WiFi resume from suspend Greg Kroah-Hartman
                   ` (108 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Colin Ian King, Maxime Ripard, Sasha Levin

From: Colin Ian King <colin.king@canonical.com>

[ Upstream commit cdfc2e2086bf9c465f44e2db25561373b084a113 ]

The zero'ing of bits 16 and 18 is incorrect. Currently the code
is masking with the bitwise-and of BIT(16) & BIT(18) which is
0, so the updated value for val is always zero. Fix this by bitwise
and-ing value with the correct mask that will zero bits 16 and 18.

Addresses-Coverity: (" Suspicious &= or |= constant expression")
Fixes: b8eb71dcdd08 ("clk: sunxi-ng: Add A80 CCU")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Maxime Ripard <mripard@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/sunxi-ng/ccu-sun9i-a80.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/clk/sunxi-ng/ccu-sun9i-a80.c b/drivers/clk/sunxi-ng/ccu-sun9i-a80.c
index dcac1391767f6..ef29582676f6e 100644
--- a/drivers/clk/sunxi-ng/ccu-sun9i-a80.c
+++ b/drivers/clk/sunxi-ng/ccu-sun9i-a80.c
@@ -1224,7 +1224,7 @@ static int sun9i_a80_ccu_probe(struct platform_device *pdev)
 
 	/* Enforce d1 = 0, d2 = 0 for Audio PLL */
 	val = readl(reg + SUN9I_A80_PLL_AUDIO_REG);
-	val &= (BIT(16) & BIT(18));
+	val &= ~(BIT(16) | BIT(18));
 	writel(val, reg + SUN9I_A80_PLL_AUDIO_REG);
 
 	/* Enforce P = 1 for both CPU cluster PLLs */
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 031/135] ARM: dts: sun8i-a83t-tbs-a711: Fix WiFi resume from suspend
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (29 preceding siblings ...)
  2019-12-03 22:34 ` [PATCH 5.3 030/135] clk: sunxi-ng: a80: fix the zeroing of bits 16 and 18 Greg Kroah-Hartman
@ 2019-12-03 22:34 ` Greg Kroah-Hartman
  2019-12-03 22:34 ` [PATCH 5.3 032/135] bpf: Allow narrow loads of bpf_sysctl fields with offset > 0 Greg Kroah-Hartman
                   ` (107 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ondrej Jirman, Maxime Ripard, Sasha Levin

From: Ondrej Jirman <megous@megous.com>

[ Upstream commit e614f341253f8541baf0230a8dc6a016b544b1e2 ]

Without enabling keep-power-in-suspend, we can't wake the device
up using WOL packet, and the log is flooded with these messages
on resume:

sunxi-mmc 1c10000.mmc: send stop command failed
sunxi-mmc 1c10000.mmc: data error, sending stop command
sunxi-mmc 1c10000.mmc: send stop command failed
sunxi-mmc 1c10000.mmc: data error, sending stop command

So to make the WiFi really a wakeup-source, we need to keep it powered
during suspend.

Fixes: 0e23372080def7 ("arm: dts: sun8i: Add the TBS A711 tablet devicetree")
Signed-off-by: Ondrej Jirman <megous@megous.com>
Signed-off-by: Maxime Ripard <mripard@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/sun8i-a83t-tbs-a711.dts | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/arm/boot/dts/sun8i-a83t-tbs-a711.dts b/arch/arm/boot/dts/sun8i-a83t-tbs-a711.dts
index 568b90ece3427..3bec3e0a81b2c 100644
--- a/arch/arm/boot/dts/sun8i-a83t-tbs-a711.dts
+++ b/arch/arm/boot/dts/sun8i-a83t-tbs-a711.dts
@@ -192,6 +192,7 @@
 	vqmmc-supply = <&reg_dldo1>;
 	non-removable;
 	wakeup-source;
+	keep-power-in-suspend;
 	status = "okay";
 
 	brcmf: wifi@1 {
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 032/135] bpf: Allow narrow loads of bpf_sysctl fields with offset > 0
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (30 preceding siblings ...)
  2019-12-03 22:34 ` [PATCH 5.3 031/135] ARM: dts: sun8i-a83t-tbs-a711: Fix WiFi resume from suspend Greg Kroah-Hartman
@ 2019-12-03 22:34 ` Greg Kroah-Hartman
  2019-12-03 22:34 ` [PATCH 5.3 033/135] samples/bpf: fix build by setting HAVE_ATTR_TEST to zero Greg Kroah-Hartman
                   ` (106 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ilya Leoshkevich, Alexei Starovoitov,
	Andrey Ignatov, Andrii Nakryiko, Sasha Levin

From: Ilya Leoshkevich <iii@linux.ibm.com>

[ Upstream commit 7541c87c9b7a7e07c84481f37f2c19063b44469b ]

"ctx:file_pos sysctl:read read ok narrow" works on s390 by accident: it
reads the wrong byte, which happens to have the expected value of 0.
Improve the test by seeking to the 4th byte and expecting 4 instead of
0.

This makes the latent problem apparent: the test attempts to read the
first byte of bpf_sysctl.file_pos, assuming this is the least-significant
byte, which is not the case on big-endian machines: a non-zero offset is
needed.

The point of the test is to verify narrow loads, so we cannot cheat our
way out by simply using BPF_W. The existence of the test means that such
loads have to be supported, most likely because llvm can generate them.
Fix the test by adding a big-endian variant, which uses an offset to
access the least-significant byte of bpf_sysctl.file_pos.

This reveals the final problem: verifier rejects accesses to bpf_sysctl
fields with offset > 0. Such accesses are already allowed for a wide
range of structs: __sk_buff, bpf_sock_addr and sk_msg_md to name a few.
Extend this support to bpf_sysctl by using bpf_ctx_range instead of
offsetof when matching field offsets.

Fixes: 7b146cebe30c ("bpf: Sysctl hook")
Fixes: e1550bfe0de4 ("bpf: Add file_pos field to bpf_sysctl ctx")
Fixes: 9a1027e52535 ("selftests/bpf: Test file_pos field in bpf_sysctl ctx")
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Andrey Ignatov <rdna@fb.com>
Acked-by: Andrii Nakryiko <andriin@fb.com>
Link: https://lore.kernel.org/bpf/20191028122902.9763-1-iii@linux.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/bpf/cgroup.c                       | 4 ++--
 tools/testing/selftests/bpf/test_sysctl.c | 8 +++++++-
 2 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/kernel/bpf/cgroup.c b/kernel/bpf/cgroup.c
index 0a00eaca6fae6..9ad7cd3267f52 100644
--- a/kernel/bpf/cgroup.c
+++ b/kernel/bpf/cgroup.c
@@ -1302,12 +1302,12 @@ static bool sysctl_is_valid_access(int off, int size, enum bpf_access_type type,
 		return false;
 
 	switch (off) {
-	case offsetof(struct bpf_sysctl, write):
+	case bpf_ctx_range(struct bpf_sysctl, write):
 		if (type != BPF_READ)
 			return false;
 		bpf_ctx_record_field_size(info, size_default);
 		return bpf_ctx_narrow_access_ok(off, size, size_default);
-	case offsetof(struct bpf_sysctl, file_pos):
+	case bpf_ctx_range(struct bpf_sysctl, file_pos):
 		if (type == BPF_READ) {
 			bpf_ctx_record_field_size(info, size_default);
 			return bpf_ctx_narrow_access_ok(off, size, size_default);
diff --git a/tools/testing/selftests/bpf/test_sysctl.c b/tools/testing/selftests/bpf/test_sysctl.c
index a3bebd7c68ddc..c938f1767ca72 100644
--- a/tools/testing/selftests/bpf/test_sysctl.c
+++ b/tools/testing/selftests/bpf/test_sysctl.c
@@ -158,9 +158,14 @@ static struct sysctl_test tests[] = {
 		.descr = "ctx:file_pos sysctl:read read ok narrow",
 		.insns = {
 			/* If (file_pos == X) */
+#if __BYTE_ORDER == __LITTLE_ENDIAN
 			BPF_LDX_MEM(BPF_B, BPF_REG_7, BPF_REG_1,
 				    offsetof(struct bpf_sysctl, file_pos)),
-			BPF_JMP_IMM(BPF_JNE, BPF_REG_7, 0, 2),
+#else
+			BPF_LDX_MEM(BPF_B, BPF_REG_7, BPF_REG_1,
+				    offsetof(struct bpf_sysctl, file_pos) + 3),
+#endif
+			BPF_JMP_IMM(BPF_JNE, BPF_REG_7, 4, 2),
 
 			/* return ALLOW; */
 			BPF_MOV64_IMM(BPF_REG_0, 1),
@@ -173,6 +178,7 @@ static struct sysctl_test tests[] = {
 		.attach_type = BPF_CGROUP_SYSCTL,
 		.sysctl = "kernel/ostype",
 		.open_flags = O_RDONLY,
+		.seek = 4,
 		.result = SUCCESS,
 	},
 	{
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 033/135] samples/bpf: fix build by setting HAVE_ATTR_TEST to zero
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (31 preceding siblings ...)
  2019-12-03 22:34 ` [PATCH 5.3 032/135] bpf: Allow narrow loads of bpf_sysctl fields with offset > 0 Greg Kroah-Hartman
@ 2019-12-03 22:34 ` Greg Kroah-Hartman
  2019-12-03 22:34 ` [PATCH 5.3 034/135] bpf: Change size to u64 for bpf_map_{area_alloc, charge_init}() Greg Kroah-Hartman
                   ` (105 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Björn Töpel, KP Singh,
	Song Liu, Adrian Hunter, Alexei Starovoitov, Jiri Olsa,
	Namhyung Kim, bpf, netdev, Arnaldo Carvalho de Melo,
	Daniel Borkmann, Sasha Levin

From: Björn Töpel <bjorn.topel@intel.com>

[ Upstream commit 04ec044b7d30800296824783df7d9728d16d7567 ]

To remove that test_attr__{enabled/open} are used by perf-sys.h, we
set HAVE_ATTR_TEST to zero.

Signed-off-by: Björn Töpel <bjorn.topel@intel.com>
Tested-by: KP Singh <kpsingh@google.com>
Acked-by: Song Liu <songliubraving@fb.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Alexei Starovoitov <ast@kernel.org>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: bpf@vger.kernel.org
Cc: netdev@vger.kernel.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: http://lore.kernel.org/bpf/20191001113307.27796-3-bjorn.topel@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 samples/bpf/Makefile | 1 +
 1 file changed, 1 insertion(+)

diff --git a/samples/bpf/Makefile b/samples/bpf/Makefile
index 1d9be26b4edd7..42b571cde1778 100644
--- a/samples/bpf/Makefile
+++ b/samples/bpf/Makefile
@@ -176,6 +176,7 @@ KBUILD_HOSTCFLAGS += -I$(srctree)/tools/lib/bpf/
 KBUILD_HOSTCFLAGS += -I$(srctree)/tools/testing/selftests/bpf/
 KBUILD_HOSTCFLAGS += -I$(srctree)/tools/lib/ -I$(srctree)/tools/include
 KBUILD_HOSTCFLAGS += -I$(srctree)/tools/perf
+KBUILD_HOSTCFLAGS += -DHAVE_ATTR_TEST=0
 
 HOSTCFLAGS_bpf_load.o += -I$(objtree)/usr/include -Wno-unused-variable
 
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 034/135] bpf: Change size to u64 for bpf_map_{area_alloc, charge_init}()
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (32 preceding siblings ...)
  2019-12-03 22:34 ` [PATCH 5.3 033/135] samples/bpf: fix build by setting HAVE_ATTR_TEST to zero Greg Kroah-Hartman
@ 2019-12-03 22:34 ` Greg Kroah-Hartman
  2019-12-03 22:34 ` [PATCH 5.3 035/135] powerpc/bpf: Fix tail call implementation Greg Kroah-Hartman
                   ` (104 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Björn Töpel,
	Daniel Borkmann, Jakub Kicinski, Sasha Levin

From: Björn Töpel <bjorn.topel@intel.com>

[ Upstream commit ff1c08e1f74b6864854c39be48aa799a6a2e4d2b ]

The functions bpf_map_area_alloc() and bpf_map_charge_init() prior
this commit passed the size parameter as size_t. In this commit this
is changed to u64.

All users of these functions avoid size_t overflows on 32-bit systems,
by explicitly using u64 when calculating the allocation size and
memory charge cost. However, since the result was narrowed by the
size_t when passing size and cost to the functions, the overflow
handling was in vain.

Instead of changing all call sites to size_t and handle overflow at
the call site, the parameter is changed to u64 and checked in the
functions above.

Fixes: d407bd25a204 ("bpf: don't trigger OOM killer under pressure with map alloc")
Fixes: c85d69135a91 ("bpf: move memory size checks to bpf_map_charge_init()")
Signed-off-by: Björn Töpel <bjorn.topel@intel.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Reviewed-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Link: https://lore.kernel.org/bpf/20191029154307.23053-1-bjorn.topel@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/bpf.h  | 4 ++--
 kernel/bpf/syscall.c | 7 +++++--
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index 18f4cc2c6acd4..5d177c0c7fe37 100644
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -651,11 +651,11 @@ void bpf_map_put_with_uref(struct bpf_map *map);
 void bpf_map_put(struct bpf_map *map);
 int bpf_map_charge_memlock(struct bpf_map *map, u32 pages);
 void bpf_map_uncharge_memlock(struct bpf_map *map, u32 pages);
-int bpf_map_charge_init(struct bpf_map_memory *mem, size_t size);
+int bpf_map_charge_init(struct bpf_map_memory *mem, u64 size);
 void bpf_map_charge_finish(struct bpf_map_memory *mem);
 void bpf_map_charge_move(struct bpf_map_memory *dst,
 			 struct bpf_map_memory *src);
-void *bpf_map_area_alloc(size_t size, int numa_node);
+void *bpf_map_area_alloc(u64 size, int numa_node);
 void bpf_map_area_free(void *base);
 void bpf_map_init_from_attr(struct bpf_map *map, union bpf_attr *attr);
 
diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index aac966b32c42e..ee3087462bc97 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -126,7 +126,7 @@ static struct bpf_map *find_and_alloc_map(union bpf_attr *attr)
 	return map;
 }
 
-void *bpf_map_area_alloc(size_t size, int numa_node)
+void *bpf_map_area_alloc(u64 size, int numa_node)
 {
 	/* We really just want to fail instead of triggering OOM killer
 	 * under memory pressure, therefore we set __GFP_NORETRY to kmalloc,
@@ -141,6 +141,9 @@ void *bpf_map_area_alloc(size_t size, int numa_node)
 	const gfp_t flags = __GFP_NOWARN | __GFP_ZERO;
 	void *area;
 
+	if (size >= SIZE_MAX)
+		return NULL;
+
 	if (size <= (PAGE_SIZE << PAGE_ALLOC_COSTLY_ORDER)) {
 		area = kmalloc_node(size, GFP_USER | __GFP_NORETRY | flags,
 				    numa_node);
@@ -197,7 +200,7 @@ static void bpf_uncharge_memlock(struct user_struct *user, u32 pages)
 		atomic_long_sub(pages, &user->locked_vm);
 }
 
-int bpf_map_charge_init(struct bpf_map_memory *mem, size_t size)
+int bpf_map_charge_init(struct bpf_map_memory *mem, u64 size)
 {
 	u32 pages = round_up(size, PAGE_SIZE) >> PAGE_SHIFT;
 	struct user_struct *user;
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 035/135] powerpc/bpf: Fix tail call implementation
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (33 preceding siblings ...)
  2019-12-03 22:34 ` [PATCH 5.3 034/135] bpf: Change size to u64 for bpf_map_{area_alloc, charge_init}() Greg Kroah-Hartman
@ 2019-12-03 22:34 ` Greg Kroah-Hartman
  2019-12-03 22:34 ` [PATCH 5.3 036/135] idr: Fix idr_get_next_ul race with idr_remove Greg Kroah-Hartman
                   ` (103 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Eric Dumazet, Daniel Borkmann,
	Naveen N. Rao, Sandipan Das, Benjamin Herrenschmidt,
	Paul Mackerras, Michael Ellerman, Martin KaFai Lau, Song Liu,
	Yonghong Song, Sasha Levin

From: Eric Dumazet <edumazet@google.com>

[ Upstream commit 7de086909365cd60a5619a45af3f4152516fd75c ]

We have seen many crashes on powerpc hosts while loading bpf programs.

The problem here is that bpf_int_jit_compile() does a first pass
to compute the program length.

Then it allocates memory to store the generated program and
calls bpf_jit_build_body() a second time (and a third time
later)

What I have observed is that the second bpf_jit_build_body()
could end up using few more words than expected.

If bpf_jit_binary_alloc() put the space for the program
at the end of the allocated page, we then write on
a non mapped memory.

It appears that bpf_jit_emit_tail_call() calls
bpf_jit_emit_common_epilogue() while ctx->seen might not
be stable.

Only after the second pass we can be sure ctx->seen wont be changed.

Trying to avoid a second pass seems quite complex and probably
not worth it.

Fixes: ce0761419faef ("powerpc/bpf: Implement support for tail calls")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Cc: Naveen N. Rao <naveen.n.rao@linux.ibm.com>
Cc: Sandipan Das <sandipan@linux.ibm.com>
Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Cc: Paul Mackerras <paulus@samba.org>
Cc: Michael Ellerman <mpe@ellerman.id.au>
Cc: Martin KaFai Lau <kafai@fb.com>
Cc: Song Liu <songliubraving@fb.com>
Cc: Yonghong Song <yhs@fb.com>
Link: https://lore.kernel.org/bpf/20191101033444.143741-1-edumazet@google.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/net/bpf_jit_comp64.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/arch/powerpc/net/bpf_jit_comp64.c b/arch/powerpc/net/bpf_jit_comp64.c
index 02a59946a78af..be3517ef0574d 100644
--- a/arch/powerpc/net/bpf_jit_comp64.c
+++ b/arch/powerpc/net/bpf_jit_comp64.c
@@ -1141,6 +1141,19 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *fp)
 		goto out_addrs;
 	}
 
+	/*
+	 * If we have seen a tail call, we need a second pass.
+	 * This is because bpf_jit_emit_common_epilogue() is called
+	 * from bpf_jit_emit_tail_call() with a not yet stable ctx->seen.
+	 */
+	if (cgctx.seen & SEEN_TAILCALL) {
+		cgctx.idx = 0;
+		if (bpf_jit_build_body(fp, 0, &cgctx, addrs, false)) {
+			fp = org_fp;
+			goto out_addrs;
+		}
+	}
+
 	/*
 	 * Pretend to build prologue, given the features we've seen.  This will
 	 * update ctgtx.idx as it pretends to output instructions, then we can
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 036/135] idr: Fix idr_get_next_ul race with idr_remove
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (34 preceding siblings ...)
  2019-12-03 22:34 ` [PATCH 5.3 035/135] powerpc/bpf: Fix tail call implementation Greg Kroah-Hartman
@ 2019-12-03 22:34 ` Greg Kroah-Hartman
  2019-12-03 22:34 ` [PATCH 5.3 037/135] idr: Fix integer overflow in idr_for_each_entry Greg Kroah-Hartman
                   ` (102 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Matthew Wilcox (Oracle), Sasha Levin

From: Matthew Wilcox (Oracle) <willy@infradead.org>

[ Upstream commit 5a74ac4c4a97bd8b7dba054304d598e2a882fea6 ]

Commit 5c089fd0c734 ("idr: Fix idr_get_next race with idr_remove")
neglected to fix idr_get_next_ul().  As far as I can tell, nobody's
actually using this interface under the RCU read lock, but fix it now
before anybody decides to use it.

Fixes: 5c089fd0c734 ("idr: Fix idr_get_next race with idr_remove")
Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 lib/idr.c | 31 +++++++++++--------------------
 1 file changed, 11 insertions(+), 20 deletions(-)

diff --git a/lib/idr.c b/lib/idr.c
index 66a3748924828..c2cf2c52bbde5 100644
--- a/lib/idr.c
+++ b/lib/idr.c
@@ -215,7 +215,7 @@ int idr_for_each(const struct idr *idr,
 EXPORT_SYMBOL(idr_for_each);
 
 /**
- * idr_get_next() - Find next populated entry.
+ * idr_get_next_ul() - Find next populated entry.
  * @idr: IDR handle.
  * @nextid: Pointer to an ID.
  *
@@ -224,7 +224,7 @@ EXPORT_SYMBOL(idr_for_each);
  * to the ID of the found value.  To use in a loop, the value pointed to by
  * nextid must be incremented by the user.
  */
-void *idr_get_next(struct idr *idr, int *nextid)
+void *idr_get_next_ul(struct idr *idr, unsigned long *nextid)
 {
 	struct radix_tree_iter iter;
 	void __rcu **slot;
@@ -245,18 +245,14 @@ void *idr_get_next(struct idr *idr, int *nextid)
 	}
 	if (!slot)
 		return NULL;
-	id = iter.index + base;
-
-	if (WARN_ON_ONCE(id > INT_MAX))
-		return NULL;
 
-	*nextid = id;
+	*nextid = iter.index + base;
 	return entry;
 }
-EXPORT_SYMBOL(idr_get_next);
+EXPORT_SYMBOL(idr_get_next_ul);
 
 /**
- * idr_get_next_ul() - Find next populated entry.
+ * idr_get_next() - Find next populated entry.
  * @idr: IDR handle.
  * @nextid: Pointer to an ID.
  *
@@ -265,22 +261,17 @@ EXPORT_SYMBOL(idr_get_next);
  * to the ID of the found value.  To use in a loop, the value pointed to by
  * nextid must be incremented by the user.
  */
-void *idr_get_next_ul(struct idr *idr, unsigned long *nextid)
+void *idr_get_next(struct idr *idr, int *nextid)
 {
-	struct radix_tree_iter iter;
-	void __rcu **slot;
-	unsigned long base = idr->idr_base;
 	unsigned long id = *nextid;
+	void *entry = idr_get_next_ul(idr, &id);
 
-	id = (id < base) ? 0 : id - base;
-	slot = radix_tree_iter_find(&idr->idr_rt, &iter, id);
-	if (!slot)
+	if (WARN_ON_ONCE(id > INT_MAX))
 		return NULL;
-
-	*nextid = iter.index + base;
-	return rcu_dereference_raw(*slot);
+	*nextid = id;
+	return entry;
 }
-EXPORT_SYMBOL(idr_get_next_ul);
+EXPORT_SYMBOL(idr_get_next);
 
 /**
  * idr_replace() - replace pointer for given ID.
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 037/135] idr: Fix integer overflow in idr_for_each_entry
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (35 preceding siblings ...)
  2019-12-03 22:34 ` [PATCH 5.3 036/135] idr: Fix idr_get_next_ul race with idr_remove Greg Kroah-Hartman
@ 2019-12-03 22:34 ` Greg Kroah-Hartman
  2019-12-03 22:34 ` [PATCH 5.3 038/135] idr: Fix idr_alloc_u32 on 32-bit systems Greg Kroah-Hartman
                   ` (101 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Matthew Wilcox (Oracle), Sasha Levin

From: Matthew Wilcox (Oracle) <willy@infradead.org>

[ Upstream commit f6341c5af4e6e15041be39976d16deca789555fa ]

If there is an entry at INT_MAX then idr_for_each_entry() will increment
id after handling it.  This is undefined behaviour, and is caught by
UBSAN.  Adding 1U to id forces the operation to be carried out as an
unsigned addition which (when assigned to id) will result in INT_MIN.
Since there is never an entry stored at INT_MIN, idr_get_next() will
return NULL, ending the loop as expected.

Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/idr.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/linux/idr.h b/include/linux/idr.h
index 4ec8986e5dfb6..ac6e946b6767b 100644
--- a/include/linux/idr.h
+++ b/include/linux/idr.h
@@ -185,7 +185,7 @@ static inline void idr_preload_end(void)
  * is convenient for a "not found" value.
  */
 #define idr_for_each_entry(idr, entry, id)			\
-	for (id = 0; ((entry) = idr_get_next(idr, &(id))) != NULL; ++id)
+	for (id = 0; ((entry) = idr_get_next(idr, &(id))) != NULL; id += 1U)
 
 /**
  * idr_for_each_entry_ul() - Iterate over an IDR's elements of a given type.
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 038/135] idr: Fix idr_alloc_u32 on 32-bit systems
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (36 preceding siblings ...)
  2019-12-03 22:34 ` [PATCH 5.3 037/135] idr: Fix integer overflow in idr_for_each_entry Greg Kroah-Hartman
@ 2019-12-03 22:34 ` Greg Kroah-Hartman
  2019-12-03 22:34 ` [PATCH 5.3 039/135] x86/resctrl: Prevent NULL pointer dereference when reading mondata Greg Kroah-Hartman
                   ` (100 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Matthew Wilcox (Oracle), Sasha Levin

From: Matthew Wilcox (Oracle) <willy@infradead.org>

[ Upstream commit b7e9728f3d7fc5c5c8508d99f1675212af5cfd49 ]

Attempting to allocate an entry at 0xffffffff when one is already
present would succeed in allocating one at 2^32, which would confuse
everything.  Return -ENOSPC in this case, as expected.

Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 lib/radix-tree.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/radix-tree.c b/lib/radix-tree.c
index 18c1dfbb17654..c8fa1d2745302 100644
--- a/lib/radix-tree.c
+++ b/lib/radix-tree.c
@@ -1529,7 +1529,7 @@ void __rcu **idr_get_free(struct radix_tree_root *root,
 			offset = radix_tree_find_next_bit(node, IDR_FREE,
 							offset + 1);
 			start = next_index(start, node, offset);
-			if (start > max)
+			if (start > max || start == 0)
 				return ERR_PTR(-ENOSPC);
 			while (offset == RADIX_TREE_MAP_SIZE) {
 				offset = node->offset + 1;
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 039/135] x86/resctrl: Prevent NULL pointer dereference when reading mondata
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (37 preceding siblings ...)
  2019-12-03 22:34 ` [PATCH 5.3 038/135] idr: Fix idr_alloc_u32 on 32-bit systems Greg Kroah-Hartman
@ 2019-12-03 22:34 ` Greg Kroah-Hartman
  2019-12-03 22:34 ` [PATCH 5.3 040/135] arm64: dts: zii-ultra: fix ARM regulator GPIO handle Greg Kroah-Hartman
                   ` (99 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Xiaochen Shen, Borislav Petkov,
	Fenghua Yu, Tony Luck, H. Peter Anvin, Ingo Molnar, pei.p.jia,
	Reinette Chatre, Thomas Gleixner, x86-ml, Sasha Levin

From: Xiaochen Shen <xiaochen.shen@intel.com>

[ Upstream commit 26467b0f8407cbd628fa5b7bcfd156e772004155 ]

When a mon group is being deleted, rdtgrp->flags is set to RDT_DELETED
in rdtgroup_rmdir_mon() firstly. The structure of rdtgrp will be freed
until rdtgrp->waitcount is dropped to 0 in rdtgroup_kn_unlock() later.

During the window of deleting a mon group, if an application calls
rdtgroup_mondata_show() to read mondata under this mon group,
'rdtgrp' returned from rdtgroup_kn_lock_live() is a NULL pointer when
rdtgrp->flags is RDT_DELETED. And then 'rdtgrp' is passed in this path:
rdtgroup_mondata_show() --> mon_event_read() --> mon_event_count().
Thus it results in NULL pointer dereference in mon_event_count().

Check 'rdtgrp' in rdtgroup_mondata_show(), and return -ENOENT
immediately when reading mondata during the window of deleting a mon
group.

Fixes: d89b7379015f ("x86/intel_rdt/cqm: Add mon_data")
Signed-off-by: Xiaochen Shen <xiaochen.shen@intel.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Reviewed-by: Fenghua Yu <fenghua.yu@intel.com>
Reviewed-by: Tony Luck <tony.luck@intel.com>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: pei.p.jia@intel.com
Cc: Reinette Chatre <reinette.chatre@intel.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: x86-ml <x86@kernel.org>
Link: https://lkml.kernel.org/r/1572326702-27577-1-git-send-email-xiaochen.shen@intel.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/kernel/cpu/resctrl/ctrlmondata.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/arch/x86/kernel/cpu/resctrl/ctrlmondata.c b/arch/x86/kernel/cpu/resctrl/ctrlmondata.c
index efbd54cc4e696..055c8613b5317 100644
--- a/arch/x86/kernel/cpu/resctrl/ctrlmondata.c
+++ b/arch/x86/kernel/cpu/resctrl/ctrlmondata.c
@@ -522,6 +522,10 @@ int rdtgroup_mondata_show(struct seq_file *m, void *arg)
 	int ret = 0;
 
 	rdtgrp = rdtgroup_kn_lock_live(of->kn);
+	if (!rdtgrp) {
+		ret = -ENOENT;
+		goto out;
+	}
 
 	md.priv = of->kn->priv;
 	resid = md.u.rid;
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 040/135] arm64: dts: zii-ultra: fix ARM regulator GPIO handle
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (38 preceding siblings ...)
  2019-12-03 22:34 ` [PATCH 5.3 039/135] x86/resctrl: Prevent NULL pointer dereference when reading mondata Greg Kroah-Hartman
@ 2019-12-03 22:34 ` Greg Kroah-Hartman
  2019-12-03 22:34 ` [PATCH 5.3 041/135] fbdev: c2p: Fix link failure on non-inlining Greg Kroah-Hartman
                   ` (98 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lucas Stach, Shawn Guo, Sasha Levin

From: Lucas Stach <l.stach@pengutronix.de>

[ Upstream commit f852497c9a07ec9913bb3f3db5f096a8e2ab7e03 ]

The GPIO handle is referencing the wrong GPIO, so the voltage did not
actually change as intended. The pinmux is already correct, so just
correct the GPIO number.

Fixes: 4a13b3bec3b4 (arm64: dts: imx: add Zii Ultra board support)
Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/freescale/imx8mq-zii-ultra.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/freescale/imx8mq-zii-ultra.dtsi b/arch/arm64/boot/dts/freescale/imx8mq-zii-ultra.dtsi
index 3faa652fdf20d..c25be32ba37e4 100644
--- a/arch/arm64/boot/dts/freescale/imx8mq-zii-ultra.dtsi
+++ b/arch/arm64/boot/dts/freescale/imx8mq-zii-ultra.dtsi
@@ -100,7 +100,7 @@
 		regulator-name = "0V9_ARM";
 		regulator-min-microvolt = <900000>;
 		regulator-max-microvolt = <1000000>;
-		gpios = <&gpio3 19 GPIO_ACTIVE_HIGH>;
+		gpios = <&gpio3 16 GPIO_ACTIVE_HIGH>;
 		states = <1000000 0x1
 		           900000 0x0>;
 		regulator-always-on;
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 041/135] fbdev: c2p: Fix link failure on non-inlining
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (39 preceding siblings ...)
  2019-12-03 22:34 ` [PATCH 5.3 040/135] arm64: dts: zii-ultra: fix ARM regulator GPIO handle Greg Kroah-Hartman
@ 2019-12-03 22:34 ` Greg Kroah-Hartman
  2019-12-03 22:34 ` [PATCH 5.3 042/135] ASoC: hdac_hda: fix race in device removal Greg Kroah-Hartman
                   ` (97 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, noreply, Geert Uytterhoeven,
	Masahiro Yamada, Daniel Vetter, Sasha Levin

From: Geert Uytterhoeven <geert@linux-m68k.org>

[ Upstream commit b330f3972f4f2a829d41fb9e9b552bec7d73a840 ]

When the compiler decides not to inline the Chunky-to-Planar core
functions, the build fails with:

    c2p_planar.c:(.text+0xd6): undefined reference to `c2p_unsupported'
    c2p_planar.c:(.text+0x1dc): undefined reference to `c2p_unsupported'
    c2p_iplan2.c:(.text+0xc4): undefined reference to `c2p_unsupported'
    c2p_iplan2.c:(.text+0x150): undefined reference to `c2p_unsupported'

Fix this by marking the functions __always_inline.

While this could be triggered before by manually enabling both
CONFIG_OPTIMIZE_INLINING and CONFIG_CC_OPTIMIZE_FOR_SIZE, it was exposed
in the m68k defconfig by commit ac7c3e4ff401b304 ("compiler: enable
CONFIG_OPTIMIZE_INLINING forcibly").

Fixes: 9012d011660ea5cf ("compiler: allow all arches to enable CONFIG_OPTIMIZE_INLINING")
Reported-by: noreply@ellerman.id.au
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Reviewed-by: Masahiro Yamada <yamada.masahiro@socionext.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20190927094708.11563-1-geert@linux-m68k.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/video/fbdev/c2p_core.h | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/video/fbdev/c2p_core.h b/drivers/video/fbdev/c2p_core.h
index e1035a865fb94..45a6d895a7d72 100644
--- a/drivers/video/fbdev/c2p_core.h
+++ b/drivers/video/fbdev/c2p_core.h
@@ -29,7 +29,7 @@ static inline void _transp(u32 d[], unsigned int i1, unsigned int i2,
 
 extern void c2p_unsupported(void);
 
-static inline u32 get_mask(unsigned int n)
+static __always_inline u32 get_mask(unsigned int n)
 {
 	switch (n) {
 	case 1:
@@ -57,7 +57,7 @@ static inline u32 get_mask(unsigned int n)
      *  Transpose operations on 8 32-bit words
      */
 
-static inline void transp8(u32 d[], unsigned int n, unsigned int m)
+static __always_inline void transp8(u32 d[], unsigned int n, unsigned int m)
 {
 	u32 mask = get_mask(n);
 
@@ -99,7 +99,7 @@ static inline void transp8(u32 d[], unsigned int n, unsigned int m)
      *  Transpose operations on 4 32-bit words
      */
 
-static inline void transp4(u32 d[], unsigned int n, unsigned int m)
+static __always_inline void transp4(u32 d[], unsigned int n, unsigned int m)
 {
 	u32 mask = get_mask(n);
 
@@ -126,7 +126,7 @@ static inline void transp4(u32 d[], unsigned int n, unsigned int m)
      *  Transpose operations on 4 32-bit words (reverse order)
      */
 
-static inline void transp4x(u32 d[], unsigned int n, unsigned int m)
+static __always_inline void transp4x(u32 d[], unsigned int n, unsigned int m)
 {
 	u32 mask = get_mask(n);
 
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 042/135] ASoC: hdac_hda: fix race in device removal
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (40 preceding siblings ...)
  2019-12-03 22:34 ` [PATCH 5.3 041/135] fbdev: c2p: Fix link failure on non-inlining Greg Kroah-Hartman
@ 2019-12-03 22:34 ` Greg Kroah-Hartman
  2019-12-03 22:34 ` [PATCH 5.3 043/135] clk: ti: dra7-atl-clock: Remove ti_clk_add_alias call Greg Kroah-Hartman
                   ` (96 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Kai Vehmanen, Pierre-Louis Bossart,
	Mark Brown, Sasha Levin

From: Kai Vehmanen <kai.vehmanen@linux.intel.com>

[ Upstream commit 5dc7d5bc9627eb26d33c7c7eefc467cf217f9326 ]

When ASoC card instance is removed containing a HDA codec,
hdac_hda_codec_remove() may run in parallel with codec resume.
This will cause problems if the HDA link is freed with
snd_hdac_ext_bus_link_put() while the codec is still in
middle of its resume process.

To fix this, change the order such that pm_runtime_disable()
is called before the link is freed. This will ensure any
pending runtime PM action is completed before proceeding
to free the link.

This issue can be easily hit with e.g. SOF driver by loading and
unloading the drivers.

Signed-off-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Link: https://lore.kernel.org/r/20191101170635.26389-1-pierre-louis.bossart@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/codecs/hdac_hda.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sound/soc/codecs/hdac_hda.c b/sound/soc/codecs/hdac_hda.c
index 91242b6f8ea7a..4570f662fb48b 100644
--- a/sound/soc/codecs/hdac_hda.c
+++ b/sound/soc/codecs/hdac_hda.c
@@ -410,8 +410,8 @@ static void hdac_hda_codec_remove(struct snd_soc_component *component)
 		return;
 	}
 
-	snd_hdac_ext_bus_link_put(hdev->bus, hlink);
 	pm_runtime_disable(&hdev->dev);
+	snd_hdac_ext_bus_link_put(hdev->bus, hlink);
 }
 
 static const struct snd_soc_dapm_route hdac_hda_dapm_routes[] = {
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 043/135] clk: ti: dra7-atl-clock: Remove ti_clk_add_alias call
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (41 preceding siblings ...)
  2019-12-03 22:34 ` [PATCH 5.3 042/135] ASoC: hdac_hda: fix race in device removal Greg Kroah-Hartman
@ 2019-12-03 22:34 ` Greg Kroah-Hartman
  2019-12-03 22:34 ` [PATCH 5.3 044/135] clk: ti: clkctrl: Fix failed to enable error with double udelay timeout Greg Kroah-Hartman
                   ` (95 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Peter Ujfalusi, Stephen Boyd, Sasha Levin

From: Peter Ujfalusi <peter.ujfalusi@ti.com>

[ Upstream commit 9982b0f69b49931b652d35f86f519be2ccfc7027 ]

ti_clk_register() calls it already so the driver should not create
duplicated alias.

Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
Link: https://lkml.kernel.org/r/20191002083436.10194-1-peter.ujfalusi@ti.com
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/ti/clk-dra7-atl.c | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/drivers/clk/ti/clk-dra7-atl.c b/drivers/clk/ti/clk-dra7-atl.c
index a01ca9395179a..f65e16c4f3c4b 100644
--- a/drivers/clk/ti/clk-dra7-atl.c
+++ b/drivers/clk/ti/clk-dra7-atl.c
@@ -174,7 +174,6 @@ static void __init of_dra7_atl_clock_setup(struct device_node *node)
 	struct clk_init_data init = { NULL };
 	const char **parent_names = NULL;
 	struct clk *clk;
-	int ret;
 
 	clk_hw = kzalloc(sizeof(*clk_hw), GFP_KERNEL);
 	if (!clk_hw) {
@@ -207,11 +206,6 @@ static void __init of_dra7_atl_clock_setup(struct device_node *node)
 	clk = ti_clk_register(NULL, &clk_hw->hw, node->name);
 
 	if (!IS_ERR(clk)) {
-		ret = ti_clk_add_alias(NULL, clk, node->name);
-		if (ret) {
-			clk_unregister(clk);
-			goto cleanup;
-		}
 		of_clk_add_provider(node, of_clk_src_simple_get, clk);
 		kfree(parent_names);
 		return;
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 044/135] clk: ti: clkctrl: Fix failed to enable error with double udelay timeout
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (42 preceding siblings ...)
  2019-12-03 22:34 ` [PATCH 5.3 043/135] clk: ti: dra7-atl-clock: Remove ti_clk_add_alias call Greg Kroah-Hartman
@ 2019-12-03 22:34 ` Greg Kroah-Hartman
  2019-12-03 22:34 ` [PATCH 5.3 045/135] net: fec: add missed clk_disable_unprepare in remove Greg Kroah-Hartman
                   ` (94 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Keerthy, Tero Kristo, Tony Lindgren,
	Stephen Boyd, Sasha Levin

From: Tony Lindgren <tony@atomide.com>

[ Upstream commit 81a41901ffd46bac6df4c95b8290ac259e0feda8 ]

Commit 3d8598fb9c5a ("clk: ti: clkctrl: use fallback udelay approach if
timekeeping is suspended") added handling for cases when timekeeping is
suspended. But looks like we can still get occasional "failed to enable"
errors on the PM runtime resume path with udelay() returning faster than
expected.

With ti-sysc interconnect target module driver this leads into device
failure with PM runtime failing with "failed to enable" clkctrl error.

Let's fix the issue with a delay of two times the desired delay as in
often done for udelay() to account for the inaccuracy.

Fixes: 3d8598fb9c5a ("clk: ti: clkctrl: use fallback udelay approach if timekeeping is suspended")
Cc: Keerthy <j-keerthy@ti.com>
Cc: Tero Kristo <t-kristo@ti.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Link: https://lkml.kernel.org/r/20190930154001.46581-1-tony@atomide.com
Tested-by: Keerthy <j-keerthy@ti.com>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/ti/clkctrl.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/clk/ti/clkctrl.c b/drivers/clk/ti/clkctrl.c
index 975995eea15cb..b0c0690a5a121 100644
--- a/drivers/clk/ti/clkctrl.c
+++ b/drivers/clk/ti/clkctrl.c
@@ -100,11 +100,12 @@ static bool _omap4_is_timeout(union omap4_timeout *time, u32 timeout)
 	 * can be from a timer that requires pm_runtime access, which
 	 * will eventually bring us here with timekeeping_suspended,
 	 * during both suspend entry and resume paths. This happens
-	 * at least on am43xx platform.
+	 * at least on am43xx platform. Account for flakeyness
+	 * with udelay() by multiplying the timeout value by 2.
 	 */
 	if (unlikely(_early_timeout || timekeeping_suspended)) {
 		if (time->cycles++ < timeout) {
-			udelay(1);
+			udelay(1 * 2);
 			return false;
 		}
 	} else {
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 045/135] net: fec: add missed clk_disable_unprepare in remove
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (43 preceding siblings ...)
  2019-12-03 22:34 ` [PATCH 5.3 044/135] clk: ti: clkctrl: Fix failed to enable error with double udelay timeout Greg Kroah-Hartman
@ 2019-12-03 22:34 ` Greg Kroah-Hartman
  2019-12-03 22:34 ` [PATCH 5.3 046/135] netfilter: ipset: Fix nla_policies to fully support NL_VALIDATE_STRICT Greg Kroah-Hartman
                   ` (93 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chuhong Yuan, David S. Miller, Sasha Levin

From: Chuhong Yuan <hslester96@gmail.com>

[ Upstream commit c43eab3eddb4c6742ac20138659a9b701822b274 ]

This driver forgets to disable and unprepare clks when remove.
Add calls to clk_disable_unprepare to fix it.

Signed-off-by: Chuhong Yuan <hslester96@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/freescale/fec_main.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index e5610a4da5390..9cb1d6ab19d5b 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -3589,6 +3589,8 @@ fec_drv_remove(struct platform_device *pdev)
 		regulator_disable(fep->reg_phy);
 	pm_runtime_put(&pdev->dev);
 	pm_runtime_disable(&pdev->dev);
+	clk_disable_unprepare(fep->clk_ahb);
+	clk_disable_unprepare(fep->clk_ipg);
 	if (of_phy_is_fixed_link(np))
 		of_phy_deregister_fixed_link(np);
 	of_node_put(fep->phy_node);
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 046/135] netfilter: ipset: Fix nla_policies to fully support NL_VALIDATE_STRICT
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (44 preceding siblings ...)
  2019-12-03 22:34 ` [PATCH 5.3 045/135] net: fec: add missed clk_disable_unprepare in remove Greg Kroah-Hartman
@ 2019-12-03 22:34 ` Greg Kroah-Hartman
  2019-12-03 22:34 ` [PATCH 5.3 047/135] bridge: ebtables: dont crash when using dnat target in output chains Greg Kroah-Hartman
                   ` (92 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:34 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jozsef Kadlecsik, Sasha Levin

From: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>

[ Upstream commit 1289975643f4cdecb071dc641059a47679fd170f ]

Since v5.2 (commit "netlink: re-add parse/validate functions in strict
mode") NL_VALIDATE_STRICT is enabled. Fix the ipset nla_policies which did
not support strict mode and convert from deprecated parsings to verified ones.

Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/netfilter/ipset/ip_set_core.c        | 41 ++++++++++++++++--------
 net/netfilter/ipset/ip_set_hash_net.c    |  1 +
 net/netfilter/ipset/ip_set_hash_netnet.c |  1 +
 3 files changed, 30 insertions(+), 13 deletions(-)

diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c
index e7288eab75126..d73d1828216a6 100644
--- a/net/netfilter/ipset/ip_set_core.c
+++ b/net/netfilter/ipset/ip_set_core.c
@@ -296,7 +296,8 @@ ip_set_get_ipaddr4(struct nlattr *nla,  __be32 *ipaddr)
 
 	if (unlikely(!flag_nested(nla)))
 		return -IPSET_ERR_PROTOCOL;
-	if (nla_parse_nested_deprecated(tb, IPSET_ATTR_IPADDR_MAX, nla, ipaddr_policy, NULL))
+	if (nla_parse_nested(tb, IPSET_ATTR_IPADDR_MAX, nla,
+			     ipaddr_policy, NULL))
 		return -IPSET_ERR_PROTOCOL;
 	if (unlikely(!ip_set_attr_netorder(tb, IPSET_ATTR_IPADDR_IPV4)))
 		return -IPSET_ERR_PROTOCOL;
@@ -314,7 +315,8 @@ ip_set_get_ipaddr6(struct nlattr *nla, union nf_inet_addr *ipaddr)
 	if (unlikely(!flag_nested(nla)))
 		return -IPSET_ERR_PROTOCOL;
 
-	if (nla_parse_nested_deprecated(tb, IPSET_ATTR_IPADDR_MAX, nla, ipaddr_policy, NULL))
+	if (nla_parse_nested(tb, IPSET_ATTR_IPADDR_MAX, nla,
+			     ipaddr_policy, NULL))
 		return -IPSET_ERR_PROTOCOL;
 	if (unlikely(!ip_set_attr_netorder(tb, IPSET_ATTR_IPADDR_IPV6)))
 		return -IPSET_ERR_PROTOCOL;
@@ -934,7 +936,8 @@ static int ip_set_create(struct net *net, struct sock *ctnl,
 
 	/* Without holding any locks, create private part. */
 	if (attr[IPSET_ATTR_DATA] &&
-	    nla_parse_nested_deprecated(tb, IPSET_ATTR_CREATE_MAX, attr[IPSET_ATTR_DATA], set->type->create_policy, NULL)) {
+	    nla_parse_nested(tb, IPSET_ATTR_CREATE_MAX, attr[IPSET_ATTR_DATA],
+			     set->type->create_policy, NULL)) {
 		ret = -IPSET_ERR_PROTOCOL;
 		goto put_out;
 	}
@@ -1281,6 +1284,14 @@ dump_attrs(struct nlmsghdr *nlh)
 	}
 }
 
+static const struct nla_policy
+ip_set_dump_policy[IPSET_ATTR_CMD_MAX + 1] = {
+	[IPSET_ATTR_PROTOCOL]	= { .type = NLA_U8 },
+	[IPSET_ATTR_SETNAME]	= { .type = NLA_NUL_STRING,
+				    .len = IPSET_MAXNAMELEN - 1 },
+	[IPSET_ATTR_FLAGS]	= { .type = NLA_U32 },
+};
+
 static int
 dump_init(struct netlink_callback *cb, struct ip_set_net *inst)
 {
@@ -1292,9 +1303,9 @@ dump_init(struct netlink_callback *cb, struct ip_set_net *inst)
 	ip_set_id_t index;
 	int ret;
 
-	ret = nla_parse_deprecated(cda, IPSET_ATTR_CMD_MAX, attr,
-				   nlh->nlmsg_len - min_len,
-				   ip_set_setname_policy, NULL);
+	ret = nla_parse(cda, IPSET_ATTR_CMD_MAX, attr,
+			nlh->nlmsg_len - min_len,
+			ip_set_dump_policy, NULL);
 	if (ret)
 		return ret;
 
@@ -1543,9 +1554,9 @@ call_ad(struct sock *ctnl, struct sk_buff *skb, struct ip_set *set,
 		memcpy(&errmsg->msg, nlh, nlh->nlmsg_len);
 		cmdattr = (void *)&errmsg->msg + min_len;
 
-		ret = nla_parse_deprecated(cda, IPSET_ATTR_CMD_MAX, cmdattr,
-					   nlh->nlmsg_len - min_len,
-					   ip_set_adt_policy, NULL);
+		ret = nla_parse(cda, IPSET_ATTR_CMD_MAX, cmdattr,
+				nlh->nlmsg_len - min_len, ip_set_adt_policy,
+				NULL);
 
 		if (ret) {
 			nlmsg_free(skb2);
@@ -1596,7 +1607,9 @@ static int ip_set_ad(struct net *net, struct sock *ctnl,
 
 	use_lineno = !!attr[IPSET_ATTR_LINENO];
 	if (attr[IPSET_ATTR_DATA]) {
-		if (nla_parse_nested_deprecated(tb, IPSET_ATTR_ADT_MAX, attr[IPSET_ATTR_DATA], set->type->adt_policy, NULL))
+		if (nla_parse_nested(tb, IPSET_ATTR_ADT_MAX,
+				     attr[IPSET_ATTR_DATA],
+				     set->type->adt_policy, NULL))
 			return -IPSET_ERR_PROTOCOL;
 		ret = call_ad(ctnl, skb, set, tb, adt, flags,
 			      use_lineno);
@@ -1606,7 +1619,8 @@ static int ip_set_ad(struct net *net, struct sock *ctnl,
 		nla_for_each_nested(nla, attr[IPSET_ATTR_ADT], nla_rem) {
 			if (nla_type(nla) != IPSET_ATTR_DATA ||
 			    !flag_nested(nla) ||
-			    nla_parse_nested_deprecated(tb, IPSET_ATTR_ADT_MAX, nla, set->type->adt_policy, NULL))
+			    nla_parse_nested(tb, IPSET_ATTR_ADT_MAX, nla,
+					     set->type->adt_policy, NULL))
 				return -IPSET_ERR_PROTOCOL;
 			ret = call_ad(ctnl, skb, set, tb, adt,
 				      flags, use_lineno);
@@ -1655,7 +1669,8 @@ static int ip_set_utest(struct net *net, struct sock *ctnl, struct sk_buff *skb,
 	if (!set)
 		return -ENOENT;
 
-	if (nla_parse_nested_deprecated(tb, IPSET_ATTR_ADT_MAX, attr[IPSET_ATTR_DATA], set->type->adt_policy, NULL))
+	if (nla_parse_nested(tb, IPSET_ATTR_ADT_MAX, attr[IPSET_ATTR_DATA],
+			     set->type->adt_policy, NULL))
 		return -IPSET_ERR_PROTOCOL;
 
 	rcu_read_lock_bh();
@@ -1961,7 +1976,7 @@ static const struct nfnl_callback ip_set_netlink_subsys_cb[IPSET_MSG_MAX] = {
 	[IPSET_CMD_LIST]	= {
 		.call		= ip_set_dump,
 		.attr_count	= IPSET_ATTR_CMD_MAX,
-		.policy		= ip_set_setname_policy,
+		.policy		= ip_set_dump_policy,
 	},
 	[IPSET_CMD_SAVE]	= {
 		.call		= ip_set_dump,
diff --git a/net/netfilter/ipset/ip_set_hash_net.c b/net/netfilter/ipset/ip_set_hash_net.c
index c259cbc3ef453..3d932de0ad295 100644
--- a/net/netfilter/ipset/ip_set_hash_net.c
+++ b/net/netfilter/ipset/ip_set_hash_net.c
@@ -368,6 +368,7 @@ static struct ip_set_type hash_net_type __read_mostly = {
 		[IPSET_ATTR_IP_TO]	= { .type = NLA_NESTED },
 		[IPSET_ATTR_CIDR]	= { .type = NLA_U8 },
 		[IPSET_ATTR_TIMEOUT]	= { .type = NLA_U32 },
+		[IPSET_ATTR_LINENO]	= { .type = NLA_U32 },
 		[IPSET_ATTR_CADT_FLAGS]	= { .type = NLA_U32 },
 		[IPSET_ATTR_BYTES]	= { .type = NLA_U64 },
 		[IPSET_ATTR_PACKETS]	= { .type = NLA_U64 },
diff --git a/net/netfilter/ipset/ip_set_hash_netnet.c b/net/netfilter/ipset/ip_set_hash_netnet.c
index a3ae69bfee668..4398322fad592 100644
--- a/net/netfilter/ipset/ip_set_hash_netnet.c
+++ b/net/netfilter/ipset/ip_set_hash_netnet.c
@@ -476,6 +476,7 @@ static struct ip_set_type hash_netnet_type __read_mostly = {
 		[IPSET_ATTR_CIDR]	= { .type = NLA_U8 },
 		[IPSET_ATTR_CIDR2]	= { .type = NLA_U8 },
 		[IPSET_ATTR_TIMEOUT]	= { .type = NLA_U32 },
+		[IPSET_ATTR_LINENO]	= { .type = NLA_U32 },
 		[IPSET_ATTR_CADT_FLAGS]	= { .type = NLA_U32 },
 		[IPSET_ATTR_BYTES]	= { .type = NLA_U64 },
 		[IPSET_ATTR_PACKETS]	= { .type = NLA_U64 },
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 047/135] bridge: ebtables: dont crash when using dnat target in output chains
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (45 preceding siblings ...)
  2019-12-03 22:34 ` [PATCH 5.3 046/135] netfilter: ipset: Fix nla_policies to fully support NL_VALIDATE_STRICT Greg Kroah-Hartman
@ 2019-12-03 22:34 ` Greg Kroah-Hartman
  2019-12-03 22:34 ` [PATCH 5.3 048/135] netfilter: nf_tables: bogus EOPNOTSUPP on basechain update Greg Kroah-Hartman
                   ` (91 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Tom Yan, Linus Lüssing,
	Florian Westphal, Pablo Neira Ayuso, Sasha Levin

From: Florian Westphal <fw@strlen.de>

[ Upstream commit b23c0742c2ce7e33ed79d10e451f70fdb5ca85d1 ]

xt_in() returns NULL in the output hook, skip the pkt_type change for
that case, redirection only makes sense in broute/prerouting hooks.

Reported-by: Tom Yan <tom.ty89@gmail.com>
Cc: Linus Lüssing <linus.luessing@c0d3.blue>
Fixes: cf3cb246e277d ("bridge: ebtables: fix reception of frames DNAT-ed to bridge device/port")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/bridge/netfilter/ebt_dnat.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/net/bridge/netfilter/ebt_dnat.c b/net/bridge/netfilter/ebt_dnat.c
index ed91ea31978af..12a4f4d936810 100644
--- a/net/bridge/netfilter/ebt_dnat.c
+++ b/net/bridge/netfilter/ebt_dnat.c
@@ -20,7 +20,6 @@ static unsigned int
 ebt_dnat_tg(struct sk_buff *skb, const struct xt_action_param *par)
 {
 	const struct ebt_nat_info *info = par->targinfo;
-	struct net_device *dev;
 
 	if (skb_ensure_writable(skb, ETH_ALEN))
 		return EBT_DROP;
@@ -33,10 +32,22 @@ ebt_dnat_tg(struct sk_buff *skb, const struct xt_action_param *par)
 		else
 			skb->pkt_type = PACKET_MULTICAST;
 	} else {
-		if (xt_hooknum(par) != NF_BR_BROUTING)
-			dev = br_port_get_rcu(xt_in(par))->br->dev;
-		else
+		const struct net_device *dev;
+
+		switch (xt_hooknum(par)) {
+		case NF_BR_BROUTING:
 			dev = xt_in(par);
+			break;
+		case NF_BR_PRE_ROUTING:
+			dev = br_port_get_rcu(xt_in(par))->br->dev;
+			break;
+		default:
+			dev = NULL;
+			break;
+		}
+
+		if (!dev) /* NF_BR_LOCAL_OUT */
+			return info->target;
 
 		if (ether_addr_equal(info->mac, dev->dev_addr))
 			skb->pkt_type = PACKET_HOST;
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 048/135] netfilter: nf_tables: bogus EOPNOTSUPP on basechain update
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (46 preceding siblings ...)
  2019-12-03 22:34 ` [PATCH 5.3 047/135] bridge: ebtables: dont crash when using dnat target in output chains Greg Kroah-Hartman
@ 2019-12-03 22:34 ` Greg Kroah-Hartman
  2019-12-03 22:34 ` [PATCH 5.3 049/135] netfilter: nf_tables_offload: skip EBUSY on chain update Greg Kroah-Hartman
                   ` (90 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:34 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Pablo Neira Ayuso, Sasha Levin

From: Pablo Neira Ayuso <pablo@netfilter.org>

[ Upstream commit 1ed012f6fd83e7ee7efd22e2c32f23efff015b30 ]

Userspace never includes the NFT_BASE_CHAIN flag, this flag is inferred
from the NFTA_CHAIN_HOOK atribute. The chain update path does not allow
to update flags at this stage, the existing sanity check bogusly hits
EOPNOTSUPP in the basechain case if the offload flag is set on.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/netfilter/nf_tables_api.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 3b81323fa0171..5dbc6bfb532cd 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -1922,6 +1922,7 @@ static int nf_tables_newchain(struct net *net, struct sock *nlsk,
 		if (nlh->nlmsg_flags & NLM_F_REPLACE)
 			return -EOPNOTSUPP;
 
+		flags |= chain->flags & NFT_BASE_CHAIN;
 		return nf_tables_updchain(&ctx, genmask, policy, flags);
 	}
 
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 049/135] netfilter: nf_tables_offload: skip EBUSY on chain update
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (47 preceding siblings ...)
  2019-12-03 22:34 ` [PATCH 5.3 048/135] netfilter: nf_tables: bogus EOPNOTSUPP on basechain update Greg Kroah-Hartman
@ 2019-12-03 22:34 ` Greg Kroah-Hartman
  2019-12-03 22:34 ` [PATCH 5.3 050/135] stacktrace: Dont skip first entry on noncurrent tasks Greg Kroah-Hartman
                   ` (89 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:34 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Pablo Neira Ayuso, Sasha Levin

From: Pablo Neira Ayuso <pablo@netfilter.org>

[ Upstream commit 88c749840dff58e7a40e18bf9bdace15f27ef259 ]

Do not try to bind a chain again if it exists, otherwise the driver
returns EBUSY.

Fixes: c9626a2cbdb2 ("netfilter: nf_tables: add hardware offload support")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/netfilter/nf_tables_offload.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/netfilter/nf_tables_offload.c b/net/netfilter/nf_tables_offload.c
index c0d18c1d77ac0..04fbab60e8080 100644
--- a/net/netfilter/nf_tables_offload.c
+++ b/net/netfilter/nf_tables_offload.c
@@ -241,7 +241,8 @@ int nft_flow_rule_offload_commit(struct net *net)
 
 		switch (trans->msg_type) {
 		case NFT_MSG_NEWCHAIN:
-			if (!(trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD))
+			if (!(trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD) ||
+			    nft_trans_chain_update(trans))
 				continue;
 
 			err = nft_flow_offload_chain(trans, FLOW_BLOCK_BIND);
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 050/135] stacktrace: Dont skip first entry on noncurrent tasks
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (48 preceding siblings ...)
  2019-12-03 22:34 ` [PATCH 5.3 049/135] netfilter: nf_tables_offload: skip EBUSY on chain update Greg Kroah-Hartman
@ 2019-12-03 22:34 ` Greg Kroah-Hartman
  2019-12-03 22:34 ` [PATCH 5.3 051/135] can: peak_usb: report bus recovery as well Greg Kroah-Hartman
                   ` (88 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jiri Slaby, Thomas Gleixner,
	Michal Suchanek, Josh Poimboeuf, Sasha Levin

From: Jiri Slaby <jslaby@suse.cz>

[ Upstream commit b0c51f158455e31d5024100cf3580fcd88214b0e ]

When doing cat /proc/<PID>/stack, the output is missing the first entry.
When the current code walks the stack starting in stack_trace_save_tsk,
it skips all scheduler functions (that's OK) plus one more function. But
this one function should be skipped only for the 'current' task as it is
stack_trace_save_tsk proper.

The original code (before the common infrastructure) skipped one
function only for the 'current' task -- see save_stack_trace_tsk before
3599fe12a125. So do so also in the new infrastructure now.

Fixes: 214d8ca6ee85 ("stacktrace: Provide common infrastructure")
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Tested-by: Michal Suchanek <msuchanek@suse.de>
Acked-by: Josh Poimboeuf <jpoimboe@redhat.com>
Link: https://lkml.kernel.org/r/20191030072545.19462-1-jslaby@suse.cz
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/stacktrace.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/kernel/stacktrace.c b/kernel/stacktrace.c
index f5440abb75329..9bbfbdb96ae51 100644
--- a/kernel/stacktrace.c
+++ b/kernel/stacktrace.c
@@ -141,7 +141,8 @@ unsigned int stack_trace_save_tsk(struct task_struct *tsk, unsigned long *store,
 	struct stacktrace_cookie c = {
 		.store	= store,
 		.size	= size,
-		.skip	= skipnr + 1,
+		/* skip this function if they are tracing us */
+		.skip	= skipnr + !!(current == tsk),
 	};
 
 	if (!try_get_task_stack(tsk))
@@ -298,7 +299,8 @@ unsigned int stack_trace_save_tsk(struct task_struct *task,
 	struct stack_trace trace = {
 		.entries	= store,
 		.max_entries	= size,
-		.skip		= skipnr + 1,
+		/* skip this function if they are tracing us */
+		.skip	= skipnr + !!(current == task),
 	};
 
 	save_stack_trace_tsk(task, &trace);
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 051/135] can: peak_usb: report bus recovery as well
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (49 preceding siblings ...)
  2019-12-03 22:34 ` [PATCH 5.3 050/135] stacktrace: Dont skip first entry on noncurrent tasks Greg Kroah-Hartman
@ 2019-12-03 22:34 ` Greg Kroah-Hartman
  2019-12-03 22:34 ` [PATCH 5.3 052/135] can: c_can: D_CAN: c_can_chip_config(): perform a sofware reset on open Greg Kroah-Hartman
                   ` (87 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jeroen Hofstee, Stephane Grosjean,
	Marc Kleine-Budde, Sasha Levin

From: Jeroen Hofstee <jhofstee@victronenergy.com>

[ Upstream commit 128a1b87d3ceb2ba449d5aadb222fe22395adeb0 ]

While the state changes are reported when the error counters increase
and decrease, there is no event when the bus recovers and the error
counters decrease again. So add those as well.

Change the state going downward to be ERROR_PASSIVE -> ERROR_WARNING ->
ERROR_ACTIVE instead of directly to ERROR_ACTIVE again.

Signed-off-by: Jeroen Hofstee <jhofstee@victronenergy.com>
Cc: Stephane Grosjean <s.grosjean@peak-system.com>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/can/usb/peak_usb/pcan_usb.c | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/drivers/net/can/usb/peak_usb/pcan_usb.c b/drivers/net/can/usb/peak_usb/pcan_usb.c
index 5a66c9f53aae6..d2539c95adb65 100644
--- a/drivers/net/can/usb/peak_usb/pcan_usb.c
+++ b/drivers/net/can/usb/peak_usb/pcan_usb.c
@@ -436,8 +436,8 @@ static int pcan_usb_decode_error(struct pcan_usb_msg_context *mc, u8 n,
 		}
 		if ((n & PCAN_USB_ERROR_BUS_LIGHT) == 0) {
 			/* no error (back to active state) */
-			mc->pdev->dev.can.state = CAN_STATE_ERROR_ACTIVE;
-			return 0;
+			new_state = CAN_STATE_ERROR_ACTIVE;
+			break;
 		}
 		break;
 
@@ -460,9 +460,9 @@ static int pcan_usb_decode_error(struct pcan_usb_msg_context *mc, u8 n,
 		}
 
 		if ((n & PCAN_USB_ERROR_BUS_HEAVY) == 0) {
-			/* no error (back to active state) */
-			mc->pdev->dev.can.state = CAN_STATE_ERROR_ACTIVE;
-			return 0;
+			/* no error (back to warning state) */
+			new_state = CAN_STATE_ERROR_WARNING;
+			break;
 		}
 		break;
 
@@ -501,6 +501,11 @@ static int pcan_usb_decode_error(struct pcan_usb_msg_context *mc, u8 n,
 		mc->pdev->dev.can.can_stats.error_warning++;
 		break;
 
+	case CAN_STATE_ERROR_ACTIVE:
+		cf->can_id |= CAN_ERR_CRTL;
+		cf->data[1] = CAN_ERR_CRTL_ACTIVE;
+		break;
+
 	default:
 		/* CAN_STATE_MAX (trick to handle other errors) */
 		cf->can_id |= CAN_ERR_CRTL;
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 052/135] can: c_can: D_CAN: c_can_chip_config(): perform a sofware reset on open
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (50 preceding siblings ...)
  2019-12-03 22:34 ` [PATCH 5.3 051/135] can: peak_usb: report bus recovery as well Greg Kroah-Hartman
@ 2019-12-03 22:34 ` Greg Kroah-Hartman
  2019-12-03 22:34 ` [PATCH 5.3 053/135] can: rx-offload: can_rx_offload_queue_tail(): fix error handling, avoid skb mem leak Greg Kroah-Hartman
                   ` (86 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jeroen Hofstee, Marc Kleine-Budde,
	Sasha Levin

From: Jeroen Hofstee <jhofstee@victronenergy.com>

[ Upstream commit 23c5a9488f076bab336177cd1d1a366bd8ddf087 ]

When the CAN interface is closed it the hardwre is put in power down
mode, but does not reset the error counters / state. Reset the D_CAN on
open, so the reported state and the actual state match.

According to [1], the C_CAN module doesn't have the software reset.

[1] http://www.bosch-semiconductors.com/media/ip_modules/pdf_2/c_can_fd8/users_manual_c_can_fd8_r210_1.pdf

Signed-off-by: Jeroen Hofstee <jhofstee@victronenergy.com>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/can/c_can/c_can.c | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/drivers/net/can/c_can/c_can.c b/drivers/net/can/c_can/c_can.c
index 9b61bfbea6cd1..24c6015f6c92b 100644
--- a/drivers/net/can/c_can/c_can.c
+++ b/drivers/net/can/c_can/c_can.c
@@ -52,6 +52,7 @@
 #define CONTROL_EX_PDR		BIT(8)
 
 /* control register */
+#define CONTROL_SWR		BIT(15)
 #define CONTROL_TEST		BIT(7)
 #define CONTROL_CCE		BIT(6)
 #define CONTROL_DISABLE_AR	BIT(5)
@@ -572,6 +573,26 @@ static void c_can_configure_msg_objects(struct net_device *dev)
 				   IF_MCONT_RCV_EOB);
 }
 
+static int c_can_software_reset(struct net_device *dev)
+{
+	struct c_can_priv *priv = netdev_priv(dev);
+	int retry = 0;
+
+	if (priv->type != BOSCH_D_CAN)
+		return 0;
+
+	priv->write_reg(priv, C_CAN_CTRL_REG, CONTROL_SWR | CONTROL_INIT);
+	while (priv->read_reg(priv, C_CAN_CTRL_REG) & CONTROL_SWR) {
+		msleep(20);
+		if (retry++ > 100) {
+			netdev_err(dev, "CCTRL: software reset failed\n");
+			return -EIO;
+		}
+	}
+
+	return 0;
+}
+
 /*
  * Configure C_CAN chip:
  * - enable/disable auto-retransmission
@@ -581,6 +602,11 @@ static void c_can_configure_msg_objects(struct net_device *dev)
 static int c_can_chip_config(struct net_device *dev)
 {
 	struct c_can_priv *priv = netdev_priv(dev);
+	int err;
+
+	err = c_can_software_reset(dev);
+	if (err)
+		return err;
 
 	/* enable automatic retransmission */
 	priv->write_reg(priv, C_CAN_CTRL_REG, CONTROL_ENABLE_AR);
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 053/135] can: rx-offload: can_rx_offload_queue_tail(): fix error handling, avoid skb mem leak
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (51 preceding siblings ...)
  2019-12-03 22:34 ` [PATCH 5.3 052/135] can: c_can: D_CAN: c_can_chip_config(): perform a sofware reset on open Greg Kroah-Hartman
@ 2019-12-03 22:34 ` Greg Kroah-Hartman
  2019-12-03 22:34 ` [PATCH 5.3 054/135] can: rx-offload: can_rx_offload_offload_one(): do not increase the skb_queue beyond skb_queue_len_max Greg Kroah-Hartman
                   ` (85 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Kurt Van Dijck, Marc Kleine-Budde,
	Sasha Levin

From: Marc Kleine-Budde <mkl@pengutronix.de>

[ Upstream commit 6caf8a6d6586d44fd72f4aa1021d14aa82affafb ]

If the rx-offload skb_queue is full can_rx_offload_queue_tail() will not
queue the skb and return with an error.

This patch frees the skb in case of a full queue, which brings
can_rx_offload_queue_tail() in line with the
can_rx_offload_queue_sorted() function, which has been adjusted in the
previous patch.

The return value is adjusted to -ENOBUFS to better reflect the actual
problem.

The device stats handling is left to the caller.

Fixes: d254586c3453 ("can: rx-offload: Add support for HW fifo based irq offloading")
Reported-by: Kurt Van Dijck <dev.kurt@vandijck-laurijssen.be>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/can/rx-offload.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/net/can/rx-offload.c b/drivers/net/can/rx-offload.c
index 663697439d1c7..d1c8634099450 100644
--- a/drivers/net/can/rx-offload.c
+++ b/drivers/net/can/rx-offload.c
@@ -252,8 +252,10 @@ int can_rx_offload_queue_tail(struct can_rx_offload *offload,
 			      struct sk_buff *skb)
 {
 	if (skb_queue_len(&offload->skb_queue) >
-	    offload->skb_queue_len_max)
-		return -ENOMEM;
+	    offload->skb_queue_len_max) {
+		kfree_skb(skb);
+		return -ENOBUFS;
+	}
 
 	skb_queue_tail(&offload->skb_queue, skb);
 	can_rx_offload_schedule(offload);
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 054/135] can: rx-offload: can_rx_offload_offload_one(): do not increase the skb_queue beyond skb_queue_len_max
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (52 preceding siblings ...)
  2019-12-03 22:34 ` [PATCH 5.3 053/135] can: rx-offload: can_rx_offload_queue_tail(): fix error handling, avoid skb mem leak Greg Kroah-Hartman
@ 2019-12-03 22:34 ` Greg Kroah-Hartman
  2019-12-03 22:34 ` [PATCH 5.3 055/135] can: rx-offload: can_rx_offload_offload_one(): increment rx_fifo_errors on queue overflow or OOM Greg Kroah-Hartman
                   ` (84 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:34 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Marc Kleine-Budde, Sasha Levin

From: Marc Kleine-Budde <mkl@pengutronix.de>

[ Upstream commit a2dc3f5e1022a5ede8af9ab89a144f1e69db8636 ]

The skb_queue is a linked list, holding the skb to be processed in the
next NAPI call.

Without this patch, the queue length in can_rx_offload_offload_one() is
limited to skb_queue_len_max + 1. As the skb_queue is a linked list, no
array or other resources are accessed out-of-bound, however this
behaviour is counterintuitive.

This patch limits the rx-offload skb_queue length to skb_queue_len_max.

Fixes: d254586c3453 ("can: rx-offload: Add support for HW fifo based irq offloading")
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/can/rx-offload.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/can/rx-offload.c b/drivers/net/can/rx-offload.c
index d1c8634099450..bdc27481b57f9 100644
--- a/drivers/net/can/rx-offload.c
+++ b/drivers/net/can/rx-offload.c
@@ -115,7 +115,7 @@ static struct sk_buff *can_rx_offload_offload_one(struct can_rx_offload *offload
 	int ret;
 
 	/* If queue is full or skb not available, read to discard mailbox */
-	if (likely(skb_queue_len(&offload->skb_queue) <=
+	if (likely(skb_queue_len(&offload->skb_queue) <
 		   offload->skb_queue_len_max))
 		skb = alloc_can_skb(offload->dev, &cf);
 
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 055/135] can: rx-offload: can_rx_offload_offload_one(): increment rx_fifo_errors on queue overflow or OOM
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (53 preceding siblings ...)
  2019-12-03 22:34 ` [PATCH 5.3 054/135] can: rx-offload: can_rx_offload_offload_one(): do not increase the skb_queue beyond skb_queue_len_max Greg Kroah-Hartman
@ 2019-12-03 22:34 ` Greg Kroah-Hartman
  2019-12-03 22:34 ` [PATCH 5.3 056/135] can: rx-offload: can_rx_offload_offload_one(): use ERR_PTR() to propagate error value in case of errors Greg Kroah-Hartman
                   ` (83 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:34 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Marc Kleine-Budde, Sasha Levin

From: Marc Kleine-Budde <mkl@pengutronix.de>

[ Upstream commit 4e9016bee3bf0c24963097edace034ff205b565c ]

If the rx-offload skb_queue is full or the skb allocation fails (due to OOM),
the mailbox contents is discarded.

This patch adds the incrementing of the rx_fifo_errors statistics counter.

Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/can/rx-offload.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/net/can/rx-offload.c b/drivers/net/can/rx-offload.c
index bdc27481b57f9..e224530a06300 100644
--- a/drivers/net/can/rx-offload.c
+++ b/drivers/net/can/rx-offload.c
@@ -125,8 +125,10 @@ static struct sk_buff *can_rx_offload_offload_one(struct can_rx_offload *offload
 
 		ret = offload->mailbox_read(offload, &cf_overflow,
 					    &timestamp, n);
-		if (ret)
+		if (ret) {
 			offload->dev->stats.rx_dropped++;
+			offload->dev->stats.rx_fifo_errors++;
+		}
 
 		return NULL;
 	}
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 056/135] can: rx-offload: can_rx_offload_offload_one(): use ERR_PTR() to propagate error value in case of errors
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (54 preceding siblings ...)
  2019-12-03 22:34 ` [PATCH 5.3 055/135] can: rx-offload: can_rx_offload_offload_one(): increment rx_fifo_errors on queue overflow or OOM Greg Kroah-Hartman
@ 2019-12-03 22:34 ` Greg Kroah-Hartman
  2019-12-03 22:34 ` [PATCH 5.3 057/135] can: rx-offload: can_rx_offload_irq_offload_timestamp(): continue on error Greg Kroah-Hartman
                   ` (82 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:34 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Marc Kleine-Budde, Sasha Levin

From: Marc Kleine-Budde <mkl@pengutronix.de>

[ Upstream commit d763ab3044f0bf50bd0e6179f6b2cf1c125d1d94 ]

Before this patch can_rx_offload_offload_one() returns a pointer to a
skb containing the read CAN frame or a NULL pointer.

However the meaning of the NULL pointer is ambiguous, it can either mean
the requested mailbox is empty or there was an error.

This patch fixes this situation by returning:
- pointer to skb on success
- NULL pointer if mailbox is empty
- ERR_PTR() in case of an error

All users of can_rx_offload_offload_one() have been adopted, no
functional change intended.

Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/can/rx-offload.c | 86 ++++++++++++++++++++++++++++++------
 1 file changed, 73 insertions(+), 13 deletions(-)

diff --git a/drivers/net/can/rx-offload.c b/drivers/net/can/rx-offload.c
index e224530a06300..3f5e040f0c712 100644
--- a/drivers/net/can/rx-offload.c
+++ b/drivers/net/can/rx-offload.c
@@ -107,39 +107,95 @@ static int can_rx_offload_compare(struct sk_buff *a, struct sk_buff *b)
 	return cb_b->timestamp - cb_a->timestamp;
 }
 
-static struct sk_buff *can_rx_offload_offload_one(struct can_rx_offload *offload, unsigned int n)
+/**
+ * can_rx_offload_offload_one() - Read one CAN frame from HW
+ * @offload: pointer to rx_offload context
+ * @n: number of mailbox to read
+ *
+ * The task of this function is to read a CAN frame from mailbox @n
+ * from the device and return the mailbox's content as a struct
+ * sk_buff.
+ *
+ * If the struct can_rx_offload::skb_queue exceeds the maximal queue
+ * length (struct can_rx_offload::skb_queue_len_max) or no skb can be
+ * allocated, the mailbox contents is discarded by reading it into an
+ * overflow buffer. This way the mailbox is marked as free by the
+ * driver.
+ *
+ * Return: A pointer to skb containing the CAN frame on success.
+ *
+ *         NULL if the mailbox @n is empty.
+ *
+ *         ERR_PTR() in case of an error
+ */
+static struct sk_buff *
+can_rx_offload_offload_one(struct can_rx_offload *offload, unsigned int n)
 {
-	struct sk_buff *skb = NULL;
+	struct sk_buff *skb = NULL, *skb_error = NULL;
 	struct can_rx_offload_cb *cb;
 	struct can_frame *cf;
 	int ret;
 
-	/* If queue is full or skb not available, read to discard mailbox */
 	if (likely(skb_queue_len(&offload->skb_queue) <
-		   offload->skb_queue_len_max))
+		   offload->skb_queue_len_max)) {
 		skb = alloc_can_skb(offload->dev, &cf);
+		if (unlikely(!skb))
+			skb_error = ERR_PTR(-ENOMEM);	/* skb alloc failed */
+	} else {
+		skb_error = ERR_PTR(-ENOBUFS);		/* skb_queue is full */
+	}
 
-	if (!skb) {
+	/* If queue is full or skb not available, drop by reading into
+	 * overflow buffer.
+	 */
+	if (unlikely(skb_error)) {
 		struct can_frame cf_overflow;
 		u32 timestamp;
 
 		ret = offload->mailbox_read(offload, &cf_overflow,
 					    &timestamp, n);
-		if (ret) {
-			offload->dev->stats.rx_dropped++;
-			offload->dev->stats.rx_fifo_errors++;
-		}
 
-		return NULL;
+		/* Mailbox was empty. */
+		if (unlikely(!ret))
+			return NULL;
+
+		/* Mailbox has been read and we're dropping it or
+		 * there was a problem reading the mailbox.
+		 *
+		 * Increment error counters in any case.
+		 */
+		offload->dev->stats.rx_dropped++;
+		offload->dev->stats.rx_fifo_errors++;
+
+		/* There was a problem reading the mailbox, propagate
+		 * error value.
+		 */
+		if (unlikely(ret < 0))
+			return ERR_PTR(ret);
+
+		return skb_error;
 	}
 
 	cb = can_rx_offload_get_cb(skb);
 	ret = offload->mailbox_read(offload, cf, &cb->timestamp, n);
-	if (!ret) {
+
+	/* Mailbox was empty. */
+	if (unlikely(!ret)) {
 		kfree_skb(skb);
 		return NULL;
 	}
 
+	/* There was a problem reading the mailbox, propagate error value. */
+	if (unlikely(ret < 0)) {
+		kfree_skb(skb);
+
+		offload->dev->stats.rx_dropped++;
+		offload->dev->stats.rx_fifo_errors++;
+
+		return ERR_PTR(ret);
+	}
+
+	/* Mailbox was read. */
 	return skb;
 }
 
@@ -159,7 +215,7 @@ int can_rx_offload_irq_offload_timestamp(struct can_rx_offload *offload, u64 pen
 			continue;
 
 		skb = can_rx_offload_offload_one(offload, i);
-		if (!skb)
+		if (IS_ERR_OR_NULL(skb))
 			break;
 
 		__skb_queue_add_sort(&skb_queue, skb, can_rx_offload_compare);
@@ -190,7 +246,11 @@ int can_rx_offload_irq_offload_fifo(struct can_rx_offload *offload)
 	struct sk_buff *skb;
 	int received = 0;
 
-	while ((skb = can_rx_offload_offload_one(offload, 0))) {
+	while (1) {
+		skb = can_rx_offload_offload_one(offload, 0);
+		if (IS_ERR_OR_NULL(skb))
+			break;
+
 		skb_queue_tail(&offload->skb_queue, skb);
 		received++;
 	}
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 057/135] can: rx-offload: can_rx_offload_irq_offload_timestamp(): continue on error
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (55 preceding siblings ...)
  2019-12-03 22:34 ` [PATCH 5.3 056/135] can: rx-offload: can_rx_offload_offload_one(): use ERR_PTR() to propagate error value in case of errors Greg Kroah-Hartman
@ 2019-12-03 22:34 ` Greg Kroah-Hartman
  2019-12-03 22:34 ` [PATCH 5.3 058/135] can: rx-offload: can_rx_offload_irq_offload_fifo(): " Greg Kroah-Hartman
                   ` (81 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jeroen Hofstee, Marc Kleine-Budde,
	Sasha Levin

From: Jeroen Hofstee <jhofstee@victronenergy.com>

[ Upstream commit c2a9f74c9d18acfdcabd3361adc7eac82c537a66 ]

In case of a resource shortage, i.e. the rx_offload queue will overflow
or a skb fails to be allocated (due to OOM),
can_rx_offload_offload_one() will call mailbox_read() to discard the
mailbox and return an ERR_PTR.

However can_rx_offload_irq_offload_timestamp() bails out in the error
case. In case of a resource shortage all mailboxes should be discarded,
to avoid an IRQ storm and give the system some time to recover.

Since can_rx_offload_irq_offload_timestamp() is typically called from a
while loop, all message will eventually be discarded. So let's continue
on error instead to discard them directly.

Signed-off-by: Jeroen Hofstee <jhofstee@victronenergy.com>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/can/rx-offload.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/can/rx-offload.c b/drivers/net/can/rx-offload.c
index 3f5e040f0c712..2ea8676579a9c 100644
--- a/drivers/net/can/rx-offload.c
+++ b/drivers/net/can/rx-offload.c
@@ -216,7 +216,7 @@ int can_rx_offload_irq_offload_timestamp(struct can_rx_offload *offload, u64 pen
 
 		skb = can_rx_offload_offload_one(offload, i);
 		if (IS_ERR_OR_NULL(skb))
-			break;
+			continue;
 
 		__skb_queue_add_sort(&skb_queue, skb, can_rx_offload_compare);
 	}
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 058/135] can: rx-offload: can_rx_offload_irq_offload_fifo(): continue on error
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (56 preceding siblings ...)
  2019-12-03 22:34 ` [PATCH 5.3 057/135] can: rx-offload: can_rx_offload_irq_offload_timestamp(): continue on error Greg Kroah-Hartman
@ 2019-12-03 22:34 ` " Greg Kroah-Hartman
  2019-12-03 22:34 ` [PATCH 5.3 059/135] can: flexcan: increase error counters if skb enqueueing via can_rx_offload_queue_sorted() fails Greg Kroah-Hartman
                   ` (80 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:34 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Marc Kleine-Budde, Sasha Levin

From: Marc Kleine-Budde <mkl@pengutronix.de>

[ Upstream commit 1f7f504dcd9d1262437bdcf4fa071e41dec1af03 ]

In case of a resource shortage, i.e. the rx_offload queue will overflow
or a skb fails to be allocated (due to OOM),
can_rx_offload_offload_one() will call mailbox_read() to discard the
mailbox and return an ERR_PTR.

If the hardware FIFO is empty can_rx_offload_offload_one() will return
NULL.

In case a CAN frame was read from the hardware,
can_rx_offload_offload_one() returns the skb containing it.

Without this patch can_rx_offload_irq_offload_fifo() bails out if no skb
returned, regardless of the reason.

Similar to can_rx_offload_irq_offload_timestamp() in case of a resource
shortage the whole FIFO should be discarded, to avoid an IRQ storm and
give the system some time to recover. However if the FIFO is empty the
loop can be left.

With this patch the loop is left in case of empty FIFO, but not on
errors.

Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/can/rx-offload.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/net/can/rx-offload.c b/drivers/net/can/rx-offload.c
index 2ea8676579a9c..84cae167e42f6 100644
--- a/drivers/net/can/rx-offload.c
+++ b/drivers/net/can/rx-offload.c
@@ -248,7 +248,9 @@ int can_rx_offload_irq_offload_fifo(struct can_rx_offload *offload)
 
 	while (1) {
 		skb = can_rx_offload_offload_one(offload, 0);
-		if (IS_ERR_OR_NULL(skb))
+		if (IS_ERR(skb))
+			continue;
+		if (!skb)
 			break;
 
 		skb_queue_tail(&offload->skb_queue, skb);
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 059/135] can: flexcan: increase error counters if skb enqueueing via can_rx_offload_queue_sorted() fails
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (57 preceding siblings ...)
  2019-12-03 22:34 ` [PATCH 5.3 058/135] can: rx-offload: can_rx_offload_irq_offload_fifo(): " Greg Kroah-Hartman
@ 2019-12-03 22:34 ` Greg Kroah-Hartman
  2019-12-03 22:35 ` [PATCH 5.3 060/135] x86/tsc: Respect tsc command line paraemeter for clocksource_tsc_early Greg Kroah-Hartman
                   ` (79 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Martin Hundebøll,
	Marc Kleine-Budde, Sasha Levin

From: Marc Kleine-Budde <mkl@pengutronix.de>

[ Upstream commit 758124335a9dd649ab820bfb5b328170919ee7dc ]

The call to can_rx_offload_queue_sorted() may fail and return an error
(in the current implementation due to resource shortage). The passed skb
is consumed.

This patch adds incrementing of the appropriate error counters to let
the device statistics reflect that there's a problem.

Reported-by: Martin Hundebøll <martin@geanix.com>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/can/flexcan.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
index 56fa98d7aa90c..a4f0fa94d136a 100644
--- a/drivers/net/can/flexcan.c
+++ b/drivers/net/can/flexcan.c
@@ -658,6 +658,7 @@ static void flexcan_irq_bus_err(struct net_device *dev, u32 reg_esr)
 	struct can_frame *cf;
 	bool rx_errors = false, tx_errors = false;
 	u32 timestamp;
+	int err;
 
 	timestamp = priv->read(&regs->timer) << 16;
 
@@ -706,7 +707,9 @@ static void flexcan_irq_bus_err(struct net_device *dev, u32 reg_esr)
 	if (tx_errors)
 		dev->stats.tx_errors++;
 
-	can_rx_offload_queue_sorted(&priv->offload, skb, timestamp);
+	err = can_rx_offload_queue_sorted(&priv->offload, skb, timestamp);
+	if (err)
+		dev->stats.rx_fifo_errors++;
 }
 
 static void flexcan_irq_state(struct net_device *dev, u32 reg_esr)
@@ -719,6 +722,7 @@ static void flexcan_irq_state(struct net_device *dev, u32 reg_esr)
 	int flt;
 	struct can_berr_counter bec;
 	u32 timestamp;
+	int err;
 
 	timestamp = priv->read(&regs->timer) << 16;
 
@@ -750,7 +754,9 @@ static void flexcan_irq_state(struct net_device *dev, u32 reg_esr)
 	if (unlikely(new_state == CAN_STATE_BUS_OFF))
 		can_bus_off(dev);
 
-	can_rx_offload_queue_sorted(&priv->offload, skb, timestamp);
+	err = can_rx_offload_queue_sorted(&priv->offload, skb, timestamp);
+	if (err)
+		dev->stats.rx_fifo_errors++;
 }
 
 static inline struct flexcan_priv *rx_offload_to_priv(struct can_rx_offload *offload)
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 060/135] x86/tsc: Respect tsc command line paraemeter for clocksource_tsc_early
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (58 preceding siblings ...)
  2019-12-03 22:34 ` [PATCH 5.3 059/135] can: flexcan: increase error counters if skb enqueueing via can_rx_offload_queue_sorted() fails Greg Kroah-Hartman
@ 2019-12-03 22:35 ` Greg Kroah-Hartman
  2019-12-03 22:35 ` [PATCH 5.3 061/135] perf scripting engines: Iterate on tep event arrays directly Greg Kroah-Hartman
                   ` (78 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:35 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Michael Zhivich, Thomas Gleixner,
	Sasha Levin

From: Michael Zhivich <mzhivich@akamai.com>

[ Upstream commit 63ec58b44fcc05efd1542045abd7faf056ac27d9 ]

The introduction of clocksource_tsc_early broke the functionality of
"tsc=reliable" and "tsc=nowatchdog" command line parameters, since
clocksource_tsc_early is unconditionally registered with
CLOCK_SOURCE_MUST_VERIFY and thus put on the watchdog list.

This can cause the TSC to be declared unstable during boot:

  clocksource: timekeeping watchdog on CPU0: Marking clocksource
               'tsc-early' as unstable because the skew is too large:
  clocksource: 'refined-jiffies' wd_now: fffb7018 wd_last: fffb6e9d
               mask: ffffffff
  clocksource: 'tsc-early' cs_now: 68a6a7070f6a0 cs_last: 68a69ab6f74d6
               mask: ffffffffffffffff
  tsc: Marking TSC unstable due to clocksource watchdog

The corresponding elapsed times are cs_nsec=1224152026 and wd_nsec=378942392, so
the watchdog differs from TSC by 0.84 seconds.

This happens when HPET is not available and jiffies are used as the TSC
watchdog instead and the jiffies update is not happening due to lost timer
interrupts in periodic mode, which can happen e.g. with expensive debug
mechanisms enabled or under massive overload conditions in virtualized
environments.

Before the introduction of the early TSC clocksource the command line
parameters "tsc=reliable" and "tsc=nowatchdog" could be used to work around
this issue.

Restore the behaviour by disabling the watchdog if requested on the kernel
command line.

[ tglx: Clarify changelog ]

Fixes: aa83c45762a24 ("x86/tsc: Introduce early tsc clocksource")
Signed-off-by: Michael Zhivich <mzhivich@akamai.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Link: https://lkml.kernel.org/r/20191024175945.14338-1-mzhivich@akamai.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/kernel/tsc.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/arch/x86/kernel/tsc.c b/arch/x86/kernel/tsc.c
index 57d87f79558f2..04dd3cc6c6edd 100644
--- a/arch/x86/kernel/tsc.c
+++ b/arch/x86/kernel/tsc.c
@@ -1505,6 +1505,9 @@ void __init tsc_init(void)
 		return;
 	}
 
+	if (tsc_clocksource_reliable || no_tsc_watchdog)
+		clocksource_tsc_early.flags &= ~CLOCK_SOURCE_MUST_VERIFY;
+
 	clocksource_register_khz(&clocksource_tsc_early, tsc_khz);
 	detect_art();
 }
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 061/135] perf scripting engines: Iterate on tep event arrays directly
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (59 preceding siblings ...)
  2019-12-03 22:35 ` [PATCH 5.3 060/135] x86/tsc: Respect tsc command line paraemeter for clocksource_tsc_early Greg Kroah-Hartman
@ 2019-12-03 22:35 ` Greg Kroah-Hartman
  2019-12-03 22:35 ` [PATCH 5.3 062/135] can: mcp251x: mcp251x_restart_work_handler(): Fix potential force_quit race condition Greg Kroah-Hartman
                   ` (77 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:35 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Daniel Bristot de Oliveira,
	Steven Rostedt (VMware),
	Arnaldo Carvalho de Melo, Andrew Morton, Jiri Olsa, Namhyung Kim,
	Tzvetomir Stoyanov, linux-trace-devel, Sasha Levin

From: Steven Rostedt (VMware) <rostedt@goodmis.org>

[ Upstream commit 443b0636ea7386d01dc460b4a4264e125f710b53 ]

Instead of calling a useless (and broken) helper function to get the
next event of a tep event array, just get the array directly and iterate
over it.

Note, the broken part was from trace_find_next_event() which after this
will no longer be used, and can be removed.

Committer notes:

This fixes a segfault when generating python scripts from perf.data
files with multiple tracepoint events, i.e. the following use case is
fixed by this patch:

  # perf record -e sched:* sleep 1
  [ perf record: Woken up 31 times to write data ]
  [ perf record: Captured and wrote 0.031 MB perf.data (9 samples) ]
  # perf script -g python
  Segmentation fault (core dumped)
  #

Reported-by: Daniel Bristot de Oliveira <bristot@redhat.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Tzvetomir Stoyanov <tstoyanov@vmware.com>
Cc: linux-trace-devel@vger.kernel.org
Link: http://lkml.kernel.org/r/20191017153733.630cd5eb@gandalf.local.home
Link: http://lore.kernel.org/lkml/20191017210636.061448713@goodmis.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/perf/util/scripting-engines/trace-event-perl.c   | 8 ++++++--
 tools/perf/util/scripting-engines/trace-event-python.c | 9 +++++++--
 2 files changed, 13 insertions(+), 4 deletions(-)

diff --git a/tools/perf/util/scripting-engines/trace-event-perl.c b/tools/perf/util/scripting-engines/trace-event-perl.c
index 61aa7f3df915b..6a0dcaee3f3ee 100644
--- a/tools/perf/util/scripting-engines/trace-event-perl.c
+++ b/tools/perf/util/scripting-engines/trace-event-perl.c
@@ -539,10 +539,11 @@ static int perl_stop_script(void)
 
 static int perl_generate_script(struct tep_handle *pevent, const char *outfile)
 {
+	int i, not_first, count, nr_events;
+	struct tep_event **all_events;
 	struct tep_event *event = NULL;
 	struct tep_format_field *f;
 	char fname[PATH_MAX];
-	int not_first, count;
 	FILE *ofp;
 
 	sprintf(fname, "%s.pl", outfile);
@@ -603,8 +604,11 @@ sub print_backtrace\n\
 }\n\n\
 ");
 
+	nr_events = tep_get_events_count(pevent);
+	all_events = tep_list_events(pevent, TEP_EVENT_SORT_ID);
 
-	while ((event = trace_find_next_event(pevent, event))) {
+	for (i = 0; all_events && i < nr_events; i++) {
+		event = all_events[i];
 		fprintf(ofp, "sub %s::%s\n{\n", event->system, event->name);
 		fprintf(ofp, "\tmy (");
 
diff --git a/tools/perf/util/scripting-engines/trace-event-python.c b/tools/perf/util/scripting-engines/trace-event-python.c
index 25dc1d765553b..df5ebb6af9fc8 100644
--- a/tools/perf/util/scripting-engines/trace-event-python.c
+++ b/tools/perf/util/scripting-engines/trace-event-python.c
@@ -1687,10 +1687,11 @@ static int python_stop_script(void)
 
 static int python_generate_script(struct tep_handle *pevent, const char *outfile)
 {
+	int i, not_first, count, nr_events;
+	struct tep_event **all_events;
 	struct tep_event *event = NULL;
 	struct tep_format_field *f;
 	char fname[PATH_MAX];
-	int not_first, count;
 	FILE *ofp;
 
 	sprintf(fname, "%s.py", outfile);
@@ -1735,7 +1736,11 @@ static int python_generate_script(struct tep_handle *pevent, const char *outfile
 	fprintf(ofp, "def trace_end():\n");
 	fprintf(ofp, "\tprint(\"in trace_end\")\n\n");
 
-	while ((event = trace_find_next_event(pevent, event))) {
+	nr_events = tep_get_events_count(pevent);
+	all_events = tep_list_events(pevent, TEP_EVENT_SORT_ID);
+
+	for (i = 0; all_events && i < nr_events; i++) {
+		event = all_events[i];
 		fprintf(ofp, "def %s__%s(", event->system, event->name);
 		fprintf(ofp, "event_name, ");
 		fprintf(ofp, "context, ");
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 062/135] can: mcp251x: mcp251x_restart_work_handler(): Fix potential force_quit race condition
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (60 preceding siblings ...)
  2019-12-03 22:35 ` [PATCH 5.3 061/135] perf scripting engines: Iterate on tep event arrays directly Greg Kroah-Hartman
@ 2019-12-03 22:35 ` Greg Kroah-Hartman
  2019-12-03 22:35 ` [PATCH 5.3 063/135] nvme-rdma: fix a segmentation fault during module unload Greg Kroah-Hartman
                   ` (76 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:35 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Timo Schlüßler,
	Marc Kleine-Budde, Sasha Levin

From: Timo Schlüßler <schluessler@krause.de>

[ Upstream commit 27a0e54bae09d2dd023a01254db506d61cc50ba1 ]

In mcp251x_restart_work_handler() the variable to stop the interrupt
handler (priv->force_quit) is reset after the chip is restarted and thus
a interrupt might occur.

This patch fixes the potential race condition by resetting force_quit
before enabling interrupts.

Signed-off-by: Timo Schlüßler <schluessler@krause.de>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/can/spi/mcp251x.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/can/spi/mcp251x.c b/drivers/net/can/spi/mcp251x.c
index 5d6f8977df3f8..c0ee0fa909702 100644
--- a/drivers/net/can/spi/mcp251x.c
+++ b/drivers/net/can/spi/mcp251x.c
@@ -759,6 +759,7 @@ static void mcp251x_restart_work_handler(struct work_struct *ws)
 	if (priv->after_suspend) {
 		mcp251x_hw_reset(spi);
 		mcp251x_setup(net, spi);
+		priv->force_quit = 0;
 		if (priv->after_suspend & AFTER_SUSPEND_RESTART) {
 			mcp251x_set_normal_mode(spi);
 		} else if (priv->after_suspend & AFTER_SUSPEND_UP) {
@@ -770,7 +771,6 @@ static void mcp251x_restart_work_handler(struct work_struct *ws)
 			mcp251x_hw_sleep(spi);
 		}
 		priv->after_suspend = 0;
-		priv->force_quit = 0;
 	}
 
 	if (priv->restart_tx) {
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 063/135] nvme-rdma: fix a segmentation fault during module unload
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (61 preceding siblings ...)
  2019-12-03 22:35 ` [PATCH 5.3 062/135] can: mcp251x: mcp251x_restart_work_handler(): Fix potential force_quit race condition Greg Kroah-Hartman
@ 2019-12-03 22:35 ` Greg Kroah-Hartman
  2019-12-03 22:35 ` [PATCH 5.3 064/135] nvme-multipath: fix crash in nvme_mpath_clear_ctrl_paths Greg Kroah-Hartman
                   ` (75 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:35 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sagi Grimberg, Max Gurtovoy,
	Keith Busch, Sasha Levin

From: Max Gurtovoy <maxg@mellanox.com>

[ Upstream commit 9ad9e8d6ca29c1446d81c6518ae634a2141dfd22 ]

In case there are controllers that are not associated with any RDMA
device (e.g. during unsuccessful reconnection) and the user will unload
the module, these controllers will not be freed and will access already
freed memory. The same logic appears in other fabric drivers as well.

Fixes: 87fd125344d6 ("nvme-rdma: remove redundant reference between ib_device and tagset")
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Max Gurtovoy <maxg@mellanox.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nvme/host/rdma.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
index 842ef876724f7..439e66769f250 100644
--- a/drivers/nvme/host/rdma.c
+++ b/drivers/nvme/host/rdma.c
@@ -2118,8 +2118,16 @@ err_unreg_client:
 
 static void __exit nvme_rdma_cleanup_module(void)
 {
+	struct nvme_rdma_ctrl *ctrl;
+
 	nvmf_unregister_transport(&nvme_rdma_transport);
 	ib_unregister_client(&nvme_rdma_ib_client);
+
+	mutex_lock(&nvme_rdma_ctrl_mutex);
+	list_for_each_entry(ctrl, &nvme_rdma_ctrl_list, list)
+		nvme_delete_ctrl(&ctrl->ctrl);
+	mutex_unlock(&nvme_rdma_ctrl_mutex);
+	flush_workqueue(nvme_delete_wq);
 }
 
 module_init(nvme_rdma_init_module);
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 064/135] nvme-multipath: fix crash in nvme_mpath_clear_ctrl_paths
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (62 preceding siblings ...)
  2019-12-03 22:35 ` [PATCH 5.3 063/135] nvme-rdma: fix a segmentation fault during module unload Greg Kroah-Hartman
@ 2019-12-03 22:35 ` Greg Kroah-Hartman
  2019-12-03 22:35 ` [PATCH 5.3 065/135] watchdog: pm8916_wdt: fix pretimeout registration flow Greg Kroah-Hartman
                   ` (74 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:35 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sagi Grimberg, Christoph Hellwig,
	Anton Eidelman, Keith Busch, Sasha Levin

From: Anton Eidelman <anton@lightbitslabs.com>

[ Upstream commit 763303a83a095a88c3a8a0d1abf97165db2e8bf5 ]

nvme_mpath_clear_ctrl_paths() iterates through
the ctrl->namespaces list while holding ctrl->scan_lock.
This does not seem to be the correct way of protecting
from concurrent list modification.

Specifically, nvme_scan_work() sorts ctrl->namespaces
AFTER unlocking scan_lock.

This may result in the following (rare) crash in ctrl disconnect
during scan_work:

    BUG: kernel NULL pointer dereference, address: 0000000000000050
    Oops: 0000 [#1] SMP PTI
    CPU: 0 PID: 3995 Comm: nvme 5.3.5-050305-generic
    RIP: 0010:nvme_mpath_clear_current_path+0xe/0x90 [nvme_core]
    ...
    Call Trace:
     nvme_mpath_clear_ctrl_paths+0x3c/0x70 [nvme_core]
     nvme_remove_namespaces+0x35/0xe0 [nvme_core]
     nvme_do_delete_ctrl+0x47/0x90 [nvme_core]
     nvme_sysfs_delete+0x49/0x60 [nvme_core]
     dev_attr_store+0x17/0x30
     sysfs_kf_write+0x3e/0x50
     kernfs_fop_write+0x11e/0x1a0
     __vfs_write+0x1b/0x40
     vfs_write+0xb9/0x1a0
     ksys_write+0x67/0xe0
     __x64_sys_write+0x1a/0x20
     do_syscall_64+0x5a/0x130
     entry_SYSCALL_64_after_hwframe+0x44/0xa9
    RIP: 0033:0x7f8d02bfb154

Fix:
After taking scan_lock in nvme_mpath_clear_ctrl_paths()
down_read(&ctrl->namespaces_rwsem) as well to make list traversal safe.
This will not cause deadlocks because taking scan_lock never happens
while holding the namespaces_rwsem.
Moreover, scan work downs namespaces_rwsem in the same order.

Alternative: sort ctrl->namespaces in nvme_scan_work()
while still holding the scan_lock.
This would leave nvme_mpath_clear_ctrl_paths() without correct protection
against ctrl->namespaces modification by anyone other than scan_work.

Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Anton Eidelman <anton@lightbitslabs.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nvme/host/multipath.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c
index d320684d25b20..a5c809c85f6d2 100644
--- a/drivers/nvme/host/multipath.c
+++ b/drivers/nvme/host/multipath.c
@@ -158,9 +158,11 @@ void nvme_mpath_clear_ctrl_paths(struct nvme_ctrl *ctrl)
 	struct nvme_ns *ns;
 
 	mutex_lock(&ctrl->scan_lock);
+	down_read(&ctrl->namespaces_rwsem);
 	list_for_each_entry(ns, &ctrl->namespaces, list)
 		if (nvme_mpath_clear_current_path(ns))
 			kblockd_schedule_work(&ns->head->requeue_work);
+	up_read(&ctrl->namespaces_rwsem);
 	mutex_unlock(&ctrl->scan_lock);
 }
 
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 065/135] watchdog: pm8916_wdt: fix pretimeout registration flow
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (63 preceding siblings ...)
  2019-12-03 22:35 ` [PATCH 5.3 064/135] nvme-multipath: fix crash in nvme_mpath_clear_ctrl_paths Greg Kroah-Hartman
@ 2019-12-03 22:35 ` Greg Kroah-Hartman
  2019-12-03 22:35 ` [PATCH 5.3 066/135] watchdog: meson: Fix the wrong value of left time Greg Kroah-Hartman
                   ` (73 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:35 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jorge Ramirez-Ortiz, Loic Poulain,
	Guenter Roeck, Wim Van Sebroeck, Sasha Levin

From: Jorge Ramirez-Ortiz <jorge.ramirez-ortiz@linaro.org>

[ Upstream commit 1993f1d7ca3f315e0459c58c8e7038039a96dd85 ]

When an IRQ is present in the dts, the probe function shall fail if
the interrupt can not be registered.

The probe function shall also be retried if getting the irq is being
deferred.

Signed-off-by: Jorge Ramirez-Ortiz <jorge.ramirez-ortiz@linaro.org>
Reviewed-by: Loic Poulain <loic.poulain@linaro.org>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/watchdog/pm8916_wdt.c | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/drivers/watchdog/pm8916_wdt.c b/drivers/watchdog/pm8916_wdt.c
index 2d3652004e39c..1213179f863c2 100644
--- a/drivers/watchdog/pm8916_wdt.c
+++ b/drivers/watchdog/pm8916_wdt.c
@@ -163,9 +163,17 @@ static int pm8916_wdt_probe(struct platform_device *pdev)
 
 	irq = platform_get_irq(pdev, 0);
 	if (irq > 0) {
-		if (devm_request_irq(dev, irq, pm8916_wdt_isr, 0, "pm8916_wdt",
-				     wdt))
-			irq = 0;
+		err = devm_request_irq(dev, irq, pm8916_wdt_isr, 0,
+				       "pm8916_wdt", wdt);
+		if (err)
+			return err;
+
+		wdt->wdev.info = &pm8916_wdt_pt_ident;
+	} else {
+		if (irq == -EPROBE_DEFER)
+			return -EPROBE_DEFER;
+
+		wdt->wdev.info = &pm8916_wdt_ident;
 	}
 
 	/* Configure watchdog to hard-reset mode */
@@ -177,7 +185,6 @@ static int pm8916_wdt_probe(struct platform_device *pdev)
 		return err;
 	}
 
-	wdt->wdev.info = (irq > 0) ? &pm8916_wdt_pt_ident : &pm8916_wdt_ident,
 	wdt->wdev.ops = &pm8916_wdt_ops,
 	wdt->wdev.parent = dev;
 	wdt->wdev.min_timeout = PM8916_WDT_MIN_TIMEOUT;
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 066/135] watchdog: meson: Fix the wrong value of left time
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (64 preceding siblings ...)
  2019-12-03 22:35 ` [PATCH 5.3 065/135] watchdog: pm8916_wdt: fix pretimeout registration flow Greg Kroah-Hartman
@ 2019-12-03 22:35 ` Greg Kroah-Hartman
  2019-12-03 22:35 ` [PATCH 5.3 067/135] watchdog: imx_sc_wdt: Pretimeout should follow SCU firmware format Greg Kroah-Hartman
                   ` (72 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:35 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Xingyu Chen, Neil Armstrong,
	Kevin Hilman, Guenter Roeck, Wim Van Sebroeck, Sasha Levin

From: Xingyu Chen <xingyu.chen@amlogic.com>

[ Upstream commit 2c77734642d52448aca673e889b39f981110828b ]

The left time value is wrong when we get it by sysfs. The left time value
should be equal to preset timeout value minus elapsed time value. According
to the Meson-GXB/GXL datasheets which can be found at [0], the timeout value
is saved to BIT[0-15] of the WATCHDOG_TCNT, and elapsed time value is saved
to BIT[16-31] of the WATCHDOG_TCNT.

[0]: http://linux-meson.com

Fixes: 683fa50f0e18 ("watchdog: Add Meson GXBB Watchdog Driver")
Signed-off-by: Xingyu Chen <xingyu.chen@amlogic.com>
Acked-by: Neil Armstrong <narmstrong@baylibre.com>
Reviewed-by: Kevin Hilman <khilman@baylibre.com>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/watchdog/meson_gxbb_wdt.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/watchdog/meson_gxbb_wdt.c b/drivers/watchdog/meson_gxbb_wdt.c
index d17c1a6ed7234..5a9ca10fbcfa0 100644
--- a/drivers/watchdog/meson_gxbb_wdt.c
+++ b/drivers/watchdog/meson_gxbb_wdt.c
@@ -89,8 +89,8 @@ static unsigned int meson_gxbb_wdt_get_timeleft(struct watchdog_device *wdt_dev)
 
 	reg = readl(data->reg_base + GXBB_WDT_TCNT_REG);
 
-	return ((reg >> GXBB_WDT_TCNT_CNT_SHIFT) -
-		(reg & GXBB_WDT_TCNT_SETUP_MASK)) / 1000;
+	return ((reg & GXBB_WDT_TCNT_SETUP_MASK) -
+		(reg >> GXBB_WDT_TCNT_CNT_SHIFT)) / 1000;
 }
 
 static const struct watchdog_ops meson_gxbb_wdt_ops = {
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 067/135] watchdog: imx_sc_wdt: Pretimeout should follow SCU firmware format
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (65 preceding siblings ...)
  2019-12-03 22:35 ` [PATCH 5.3 066/135] watchdog: meson: Fix the wrong value of left time Greg Kroah-Hartman
@ 2019-12-03 22:35 ` Greg Kroah-Hartman
  2019-12-03 22:35 ` [PATCH 5.3 068/135] watchdog: bd70528: Add MODULE_ALIAS to allow module auto loading Greg Kroah-Hartman
                   ` (71 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:35 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Anson Huang, Guenter Roeck,
	Wim Van Sebroeck, Sasha Levin

From: Anson Huang <Anson.Huang@nxp.com>

[ Upstream commit 2c50a6b825b3463a7600d6e6acadba73211c3d2c ]

SCU firmware calculates pretimeout based on current time stamp
instead of watchdog timeout stamp, need to convert the pretimeout
to SCU firmware's timeout value.

Fixes: 15f7d7fc5542 ("watchdog: imx_sc: Add pretimeout support")
Signed-off-by: Anson Huang <Anson.Huang@nxp.com>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/watchdog/imx_sc_wdt.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/drivers/watchdog/imx_sc_wdt.c b/drivers/watchdog/imx_sc_wdt.c
index 78eaaf75a263f..9545d1e07421a 100644
--- a/drivers/watchdog/imx_sc_wdt.c
+++ b/drivers/watchdog/imx_sc_wdt.c
@@ -99,8 +99,14 @@ static int imx_sc_wdt_set_pretimeout(struct watchdog_device *wdog,
 {
 	struct arm_smccc_res res;
 
+	/*
+	 * SCU firmware calculates pretimeout based on current time
+	 * stamp instead of watchdog timeout stamp, need to convert
+	 * the pretimeout to SCU firmware's timeout value.
+	 */
 	arm_smccc_smc(IMX_SIP_TIMER, IMX_SIP_TIMER_SET_PRETIME_WDOG,
-		      pretimeout * 1000, 0, 0, 0, 0, 0, &res);
+		      (wdog->timeout - pretimeout) * 1000, 0, 0, 0,
+		      0, 0, &res);
 	if (res.a0)
 		return -EACCES;
 
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 068/135] watchdog: bd70528: Add MODULE_ALIAS to allow module auto loading
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (66 preceding siblings ...)
  2019-12-03 22:35 ` [PATCH 5.3 067/135] watchdog: imx_sc_wdt: Pretimeout should follow SCU firmware format Greg Kroah-Hartman
@ 2019-12-03 22:35 ` Greg Kroah-Hartman
  2019-12-03 22:35 ` [PATCH 5.3 069/135] ASoC: stm32: sai: add restriction on mmap support Greg Kroah-Hartman
                   ` (70 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:35 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Matti Vaittinen, Guenter Roeck,
	Wim Van Sebroeck, Sasha Levin

From: Matti Vaittinen <matti.vaittinen@fi.rohmeurope.com>

[ Upstream commit 81363f248aecd2b5f10547af268a4dfaf8963489 ]

The bd70528 watchdog driver is probed by MFD driver. Add MODULE_ALIAS
in order to allow udev to load the module when MFD sub-device cell for
watchdog is added.

Fixes: bbc88a0ec9f37 ("watchdog: bd70528: Initial support for ROHM BD70528 watchdog block")
Signed-off-by: Matti Vaittinen <matti.vaittinen@fi.rohmeurope.com>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/watchdog/bd70528_wdt.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/watchdog/bd70528_wdt.c b/drivers/watchdog/bd70528_wdt.c
index b0152fef4fc7e..bc60e036627af 100644
--- a/drivers/watchdog/bd70528_wdt.c
+++ b/drivers/watchdog/bd70528_wdt.c
@@ -288,3 +288,4 @@ module_platform_driver(bd70528_wdt);
 MODULE_AUTHOR("Matti Vaittinen <matti.vaittinen@fi.rohmeurope.com>");
 MODULE_DESCRIPTION("BD70528 watchdog driver");
 MODULE_LICENSE("GPL");
+MODULE_ALIAS("platform:bd70528-wdt");
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 069/135] ASoC: stm32: sai: add restriction on mmap support
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (67 preceding siblings ...)
  2019-12-03 22:35 ` [PATCH 5.3 068/135] watchdog: bd70528: Add MODULE_ALIAS to allow module auto loading Greg Kroah-Hartman
@ 2019-12-03 22:35 ` Greg Kroah-Hartman
  2019-12-03 22:35 ` [PATCH 5.3 070/135] ALSA: hda: hdmi - add Tigerlake support Greg Kroah-Hartman
                   ` (69 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:35 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Olivier Moysan, Mark Brown, Sasha Levin

From: Olivier Moysan <olivier.moysan@st.com>

[ Upstream commit eaf072e512d54c95b0977eda06cbca3151ace1e5 ]

Do not support mmap in S/PDIF mode. In S/PDIF mode
the buffer has to be copied, to allow the channel status
bits insertion.

Signed-off-by: Olivier Moysan <olivier.moysan@st.com>
Link: https://lore.kernel.org/r/20191104133654.28750-1-olivier.moysan@st.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/stm/stm32_sai_sub.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/sound/soc/stm/stm32_sai_sub.c b/sound/soc/stm/stm32_sai_sub.c
index d7501f88aaa63..34e73071d4db8 100644
--- a/sound/soc/stm/stm32_sai_sub.c
+++ b/sound/soc/stm/stm32_sai_sub.c
@@ -1217,6 +1217,16 @@ static int stm32_sai_pcm_process_spdif(struct snd_pcm_substream *substream,
 	return 0;
 }
 
+/* No support of mmap in S/PDIF mode */
+static const struct snd_pcm_hardware stm32_sai_pcm_hw_spdif = {
+	.info = SNDRV_PCM_INFO_INTERLEAVED,
+	.buffer_bytes_max = 8 * PAGE_SIZE,
+	.period_bytes_min = 1024,
+	.period_bytes_max = PAGE_SIZE,
+	.periods_min = 2,
+	.periods_max = 8,
+};
+
 static const struct snd_pcm_hardware stm32_sai_pcm_hw = {
 	.info = SNDRV_PCM_INFO_INTERLEAVED | SNDRV_PCM_INFO_MMAP,
 	.buffer_bytes_max = 8 * PAGE_SIZE,
@@ -1269,7 +1279,7 @@ static const struct snd_dmaengine_pcm_config stm32_sai_pcm_config = {
 };
 
 static const struct snd_dmaengine_pcm_config stm32_sai_pcm_config_spdif = {
-	.pcm_hardware = &stm32_sai_pcm_hw,
+	.pcm_hardware = &stm32_sai_pcm_hw_spdif,
 	.prepare_slave_config = snd_dmaengine_pcm_prepare_slave_config,
 	.process = stm32_sai_pcm_process_spdif,
 };
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 070/135] ALSA: hda: hdmi - add Tigerlake support
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (68 preceding siblings ...)
  2019-12-03 22:35 ` [PATCH 5.3 069/135] ASoC: stm32: sai: add restriction on mmap support Greg Kroah-Hartman
@ 2019-12-03 22:35 ` Greg Kroah-Hartman
  2019-12-03 22:35 ` [PATCH 5.3 071/135] ARM: dts: stm32: Fix CAN RAM mapping on stm32mp157c Greg Kroah-Hartman
                   ` (68 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:35 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Pan Xiuli, Kai Vehmanen,
	Takashi Iwai, Sasha Levin

From: Kai Vehmanen <kai.vehmanen@linux.intel.com>

[ Upstream commit 9a11ba7388f165762549903492fc34d29bbb3c04 ]

Add Tigerlake HDMI codec support.

BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=205379
BugLink: https://bugs.freedesktop.org/show_bug.cgi?id=112171
Cc: Pan Xiuli <xiuli.pan@linux.intel.com>
Signed-off-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
Link: https://lore.kernel.org/r/20191105161053.22958-1-kai.vehmanen@linux.intel.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/pci/hda/patch_hdmi.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
index 00796c7727ea2..ff99f5feaace9 100644
--- a/sound/pci/hda/patch_hdmi.c
+++ b/sound/pci/hda/patch_hdmi.c
@@ -2703,6 +2703,18 @@ static int patch_i915_icl_hdmi(struct hda_codec *codec)
 	return intel_hsw_common_init(codec, 0x02, map, ARRAY_SIZE(map));
 }
 
+static int patch_i915_tgl_hdmi(struct hda_codec *codec)
+{
+	/*
+	 * pin to port mapping table where the value indicate the pin number and
+	 * the index indicate the port number with 1 base.
+	 */
+	static const int map[] = {0x4, 0x6, 0x8, 0xa, 0xb, 0xc, 0xd, 0xe, 0xf};
+
+	return intel_hsw_common_init(codec, 0x02, map, ARRAY_SIZE(map));
+}
+
+
 /* Intel Baytrail and Braswell; with eld notifier */
 static int patch_i915_byt_hdmi(struct hda_codec *codec)
 {
@@ -3960,6 +3972,7 @@ HDA_CODEC_ENTRY(0x8086280b, "Kabylake HDMI",	patch_i915_hsw_hdmi),
 HDA_CODEC_ENTRY(0x8086280c, "Cannonlake HDMI",	patch_i915_glk_hdmi),
 HDA_CODEC_ENTRY(0x8086280d, "Geminilake HDMI",	patch_i915_glk_hdmi),
 HDA_CODEC_ENTRY(0x8086280f, "Icelake HDMI",	patch_i915_icl_hdmi),
+HDA_CODEC_ENTRY(0x80862812, "Tigerlake HDMI",	patch_i915_tgl_hdmi),
 HDA_CODEC_ENTRY(0x80862880, "CedarTrail HDMI",	patch_generic_hdmi),
 HDA_CODEC_ENTRY(0x80862882, "Valleyview2 HDMI",	patch_i915_byt_hdmi),
 HDA_CODEC_ENTRY(0x80862883, "Braswell HDMI",	patch_i915_byt_hdmi),
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 071/135] ARM: dts: stm32: Fix CAN RAM mapping on stm32mp157c
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (69 preceding siblings ...)
  2019-12-03 22:35 ` [PATCH 5.3 070/135] ALSA: hda: hdmi - add Tigerlake support Greg Kroah-Hartman
@ 2019-12-03 22:35 ` Greg Kroah-Hartman
  2019-12-03 22:35 ` [PATCH 5.3 072/135] ASoC: SOF: topology: Fix bytes control size checks Greg Kroah-Hartman
                   ` (67 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:35 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christophe Roullier,
	Alexandre Torgue, Sasha Levin

From: Christophe Roullier <christophe.roullier@st.com>

[ Upstream commit 9df50c2e16de7fd739d11d37303afec9e573b46f ]

Split the 10Kbytes CAN message RAM to be able to use simultaneously
FDCAN1 and FDCAN2 instances.
First 5Kbytes are allocated to FDCAN1 and last 5Kbytes are used for
FDCAN2. To do so, set the offset to 0x1400 in mram-cfg for FDCAN2.

Fixes: d44d6e021301 ("ARM: dts: stm32: change CAN RAM mapping on stm32mp157c")
Signed-off-by: Christophe Roullier <christophe.roullier@st.com>
Signed-off-by: Alexandre Torgue <alexandre.torgue@st.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/stm32mp157c.dtsi | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm/boot/dts/stm32mp157c.dtsi b/arch/arm/boot/dts/stm32mp157c.dtsi
index 0c4e6ebc35291..31556bea2c933 100644
--- a/arch/arm/boot/dts/stm32mp157c.dtsi
+++ b/arch/arm/boot/dts/stm32mp157c.dtsi
@@ -914,7 +914,7 @@
 			interrupt-names = "int0", "int1";
 			clocks = <&rcc CK_HSE>, <&rcc FDCAN_K>;
 			clock-names = "hclk", "cclk";
-			bosch,mram-cfg = <0x1400 0 0 32 0 0 2 2>;
+			bosch,mram-cfg = <0x0 0 0 32 0 0 2 2>;
 			status = "disabled";
 		};
 
@@ -927,7 +927,7 @@
 			interrupt-names = "int0", "int1";
 			clocks = <&rcc CK_HSE>, <&rcc FDCAN_K>;
 			clock-names = "hclk", "cclk";
-			bosch,mram-cfg = <0x0 0 0 32 0 0 2 2>;
+			bosch,mram-cfg = <0x1400 0 0 32 0 0 2 2>;
 			status = "disabled";
 		};
 
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 072/135] ASoC: SOF: topology: Fix bytes control size checks
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (70 preceding siblings ...)
  2019-12-03 22:35 ` [PATCH 5.3 071/135] ARM: dts: stm32: Fix CAN RAM mapping on stm32mp157c Greg Kroah-Hartman
@ 2019-12-03 22:35 ` Greg Kroah-Hartman
  2019-12-03 22:35 ` [PATCH 5.3 073/135] mm/gup_benchmark: fix MAP_HUGETLB case Greg Kroah-Hartman
                   ` (66 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:35 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jaska Uimonen, Ranjani Sridharan,
	Dragos Tarcatu, Pierre-Louis Bossart, Mark Brown, Sasha Levin

From: Dragos Tarcatu <dragos_tarcatu@mentor.com>

[ Upstream commit 9508ef5a980f5d847cad9b932b6ada8f2a3466c1 ]

When using the example SOF amp widget topology, KASAN dumps this
when the AMP bytes kcontrol gets loaded:

[ 9.579548] BUG: KASAN: slab-out-of-bounds in
sof_control_load+0x8cc/0xac0 [snd_sof]
[ 9.588194] Write of size 40 at addr ffff8882314559dc by task
systemd-udevd/2411

Fix that by rejecting the topology if the bytes data size > max_size

Fixes: 311ce4fe7637d ("ASoC: SOF: Add support for loading topologies")
Reviewed-by: Jaska Uimonen <jaska.uimonen@intel.com>
Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
Signed-off-by: Dragos Tarcatu <dragos_tarcatu@mentor.com>
Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Link: https://lore.kernel.org/r/20191106145816.9367-1-pierre-louis.bossart@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/sof/topology.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/sound/soc/sof/topology.c b/sound/soc/sof/topology.c
index 96230329e678f..355f04663f576 100644
--- a/sound/soc/sof/topology.c
+++ b/sound/soc/sof/topology.c
@@ -533,15 +533,16 @@ static int sof_control_load_bytes(struct snd_soc_component *scomp,
 	struct soc_bytes_ext *sbe = (struct soc_bytes_ext *)kc->private_value;
 	int max_size = sbe->max;
 
-	if (le32_to_cpu(control->priv.size) > max_size) {
+	/* init the get/put bytes data */
+	scontrol->size = sizeof(struct sof_ipc_ctrl_data) +
+		le32_to_cpu(control->priv.size);
+
+	if (scontrol->size > max_size) {
 		dev_err(sdev->dev, "err: bytes data size %d exceeds max %d.\n",
-			control->priv.size, max_size);
+			scontrol->size, max_size);
 		return -EINVAL;
 	}
 
-	/* init the get/put bytes data */
-	scontrol->size = sizeof(struct sof_ipc_ctrl_data) +
-		le32_to_cpu(control->priv.size);
 	scontrol->control_data = kzalloc(max_size, GFP_KERNEL);
 	cdata = scontrol->control_data;
 	if (!scontrol->control_data)
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 073/135] mm/gup_benchmark: fix MAP_HUGETLB case
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (71 preceding siblings ...)
  2019-12-03 22:35 ` [PATCH 5.3 072/135] ASoC: SOF: topology: Fix bytes control size checks Greg Kroah-Hartman
@ 2019-12-03 22:35 ` Greg Kroah-Hartman
  2019-12-03 22:35 ` [PATCH 5.3 074/135] scripts/gdb: fix debugging modules compiled with hot/cold partitioning Greg Kroah-Hartman
                   ` (65 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:35 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, John Hubbard, Andrew Morton,
	Jérôme Glisse, Keith Busch, Linus Torvalds,
	Sasha Levin

From: John Hubbard <jhubbard@nvidia.com>

[ Upstream commit 64801d19eba156170340c76f70ade743defcb8ce ]

The MAP_HUGETLB ("-H" option) of gup_benchmark fails:

  $ sudo ./gup_benchmark -H
  mmap: Invalid argument

This is because gup_benchmark.c is passing in a file descriptor to
mmap(), but the fd came from opening up the /dev/zero file.  This
confuses the mmap syscall implementation, which thinks that, if the
caller did not specify MAP_ANONYMOUS, then the file must be a huge page
file.  So it attempts to verify that the file really is a huge page
file, as you can see here:

ksys_mmap_pgoff()
{
    if (!(flags & MAP_ANONYMOUS)) {
        retval = -EINVAL;
        if (unlikely(flags & MAP_HUGETLB && !is_file_hugepages(file)))
            goto out_fput; /* THIS IS WHERE WE END UP */

    else if (flags & MAP_HUGETLB) {
        ...proceed normally, /dev/zero is ok here...

...and of course is_file_hugepages() returns "false" for the /dev/zero
file.

The problem is that the user space program, gup_benchmark.c, really just
wants anonymous memory here.  The simplest way to get that is to pass
MAP_ANONYMOUS whenever MAP_HUGETLB is specified, so that's what this
patch does.

Link: http://lkml.kernel.org/r/20191021212435.398153-2-jhubbard@nvidia.com
Signed-off-by: John Hubbard <jhubbard@nvidia.com>
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Jérôme Glisse <jglisse@redhat.com>
Cc: Keith Busch <keith.busch@intel.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/testing/selftests/vm/gup_benchmark.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/testing/selftests/vm/gup_benchmark.c b/tools/testing/selftests/vm/gup_benchmark.c
index c0534e298b512..8e9929ce64cdb 100644
--- a/tools/testing/selftests/vm/gup_benchmark.c
+++ b/tools/testing/selftests/vm/gup_benchmark.c
@@ -71,7 +71,7 @@ int main(int argc, char **argv)
 			flags |= MAP_SHARED;
 			break;
 		case 'H':
-			flags |= MAP_HUGETLB;
+			flags |= (MAP_HUGETLB | MAP_ANONYMOUS);
 			break;
 		default:
 			return -1;
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 074/135] scripts/gdb: fix debugging modules compiled with hot/cold partitioning
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (72 preceding siblings ...)
  2019-12-03 22:35 ` [PATCH 5.3 073/135] mm/gup_benchmark: fix MAP_HUGETLB case Greg Kroah-Hartman
@ 2019-12-03 22:35 ` Greg Kroah-Hartman
  2019-12-03 22:35 ` [PATCH 5.3 075/135] net: bcmgenet: use RGMII loopback for MAC reset Greg Kroah-Hartman
                   ` (64 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:35 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ilya Leoshkevich, Jan Kiszka,
	Kieran Bingham, Heiko Carstens, Vasily Gorbik, Andrew Morton,
	Linus Torvalds, Sasha Levin

From: Ilya Leoshkevich <iii@linux.ibm.com>

[ Upstream commit 8731acc5068eb3f422a45c760d32198175c756f8 ]

gcc's -freorder-blocks-and-partition option makes it group frequently
and infrequently used code in .text.hot and .text.unlikely sections
respectively.  At least when building modules on s390, this option is
used by default.

gdb assumes that all code is located in .text section, and that .text
section is located at module load address.  With such modules this is no
longer the case: there is code in .text.hot and .text.unlikely, and
either of them might precede .text.

Fix by explicitly telling gdb the addresses of code sections.

It might be tempting to do this for all sections, not only the ones in
the white list.  Unfortunately, gdb appears to have an issue, when
telling it about e.g. loadable .note.gnu.build-id section causes it to
think that non-loadable .note.Linux section is loaded at address 0,
which in turn causes NULL pointers to be resolved to bogus symbols.  So
keep using the white list approach for the time being.

Link: http://lkml.kernel.org/r/20191028152734.13065-1-iii@linux.ibm.com
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Reviewed-by: Jan Kiszka <jan.kiszka@siemens.com>
Cc: Kieran Bingham <kbingham@kernel.org>
Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
Cc: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 scripts/gdb/linux/symbols.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/scripts/gdb/linux/symbols.py b/scripts/gdb/linux/symbols.py
index 2f5b95f09fa03..3c29504302896 100644
--- a/scripts/gdb/linux/symbols.py
+++ b/scripts/gdb/linux/symbols.py
@@ -99,7 +99,8 @@ lx-symbols command."""
             attrs[n]['name'].string(): attrs[n]['address']
             for n in range(int(sect_attrs['nsections']))}
         args = []
-        for section_name in [".data", ".data..read_mostly", ".rodata", ".bss"]:
+        for section_name in [".data", ".data..read_mostly", ".rodata", ".bss",
+                             ".text", ".text.hot", ".text.unlikely"]:
             address = section_name_to_address.get(section_name)
             if address:
                 args.append(" -s {name} {addr}".format(
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 075/135] net: bcmgenet: use RGMII loopback for MAC reset
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (73 preceding siblings ...)
  2019-12-03 22:35 ` [PATCH 5.3 074/135] scripts/gdb: fix debugging modules compiled with hot/cold partitioning Greg Kroah-Hartman
@ 2019-12-03 22:35 ` Greg Kroah-Hartman
  2019-12-03 22:35 ` [PATCH 5.3 076/135] net: bcmgenet: reapply manual settings to the PHY Greg Kroah-Hartman
                   ` (63 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:35 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Doug Berger, Florian Fainelli,
	David S. Miller, Sasha Levin

From: Doug Berger <opendmb@gmail.com>

[ Upstream commit 3a55402c93877d291b0a612d25edb03d1b4b93ac ]

As noted in commit 28c2d1a7a0bf ("net: bcmgenet: enable loopback
during UniMAC sw_reset") the UniMAC must be clocked while sw_reset
is asserted for its state machines to reset cleanly.

The transmit and receive clocks used by the UniMAC are derived from
the signals used on its PHY interface. The bcmgenet MAC can be
configured to work with different PHY interfaces including MII,
GMII, RGMII, and Reverse MII on internal and external interfaces.
Unfortunately for the UniMAC, when configured for MII the Tx clock
is always driven from the PHY which places it outside of the direct
control of the MAC.

The earlier commit enabled a local loopback mode within the UniMAC
so that the receive clock would be derived from the transmit clock
which addressed the observed issue with an external GPHY disabling
it's Rx clock. However, when a Tx clock is not available this
loopback is insufficient.

This commit implements a workaround that leverages the fact that
the MAC can reliably generate all of its necessary clocking by
enterring the external GPHY RGMII interface mode with the UniMAC in
local loopback during the sw_reset interval. Unfortunately, this
has the undesirable side efect of the RGMII GTXCLK signal being
driven during the same window.

In most configurations this is a benign side effect as the signal
is either not routed to a pin or is already expected to drive the
pin. The one exception is when an external MII PHY is expected to
drive the same pin with its TX_CLK output creating output driver
contention.

This commit exploits the IEEE 802.3 clause 22 standard defined
isolate mode to force an external MII PHY to present a high
impedance on its TX_CLK output during the window to prevent any
contention at the pin.

The MII interface is used internally with the 40nm internal EPHY
which agressively disables its clocks for power savings leading to
incomplete resets of the UniMAC and many instabilities observed
over the years. The workaround of this commit is expected to put
an end to those problems.

Fixes: 1c1008c793fa ("net: bcmgenet: add main driver file")
Signed-off-by: Doug Berger <opendmb@gmail.com>
Acked-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../net/ethernet/broadcom/genet/bcmgenet.c    |  2 --
 drivers/net/ethernet/broadcom/genet/bcmmii.c  | 33 +++++++++++++++++++
 2 files changed, 33 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
index 06e2581b28eaf..4c90923d7a1c8 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
@@ -1996,8 +1996,6 @@ static void reset_umac(struct bcmgenet_priv *priv)
 
 	/* issue soft reset with (rg)mii loopback to ensure a stable rxclk */
 	bcmgenet_umac_writel(priv, CMD_SW_RESET | CMD_LCL_LOOP_EN, UMAC_CMD);
-	udelay(2);
-	bcmgenet_umac_writel(priv, 0, UMAC_CMD);
 }
 
 static void bcmgenet_intr_disable(struct bcmgenet_priv *priv)
diff --git a/drivers/net/ethernet/broadcom/genet/bcmmii.c b/drivers/net/ethernet/broadcom/genet/bcmmii.c
index e7c291bf4ed17..dbe18cdf6c1b8 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmmii.c
+++ b/drivers/net/ethernet/broadcom/genet/bcmmii.c
@@ -181,8 +181,38 @@ int bcmgenet_mii_config(struct net_device *dev, bool init)
 	const char *phy_name = NULL;
 	u32 id_mode_dis = 0;
 	u32 port_ctrl;
+	int bmcr = -1;
+	int ret;
 	u32 reg;
 
+	/* MAC clocking workaround during reset of umac state machines */
+	reg = bcmgenet_umac_readl(priv, UMAC_CMD);
+	if (reg & CMD_SW_RESET) {
+		/* An MII PHY must be isolated to prevent TXC contention */
+		if (priv->phy_interface == PHY_INTERFACE_MODE_MII) {
+			ret = phy_read(phydev, MII_BMCR);
+			if (ret >= 0) {
+				bmcr = ret;
+				ret = phy_write(phydev, MII_BMCR,
+						bmcr | BMCR_ISOLATE);
+			}
+			if (ret) {
+				netdev_err(dev, "failed to isolate PHY\n");
+				return ret;
+			}
+		}
+		/* Switch MAC clocking to RGMII generated clock */
+		bcmgenet_sys_writel(priv, PORT_MODE_EXT_GPHY, SYS_PORT_CTRL);
+		/* Ensure 5 clks with Rx disabled
+		 * followed by 5 clks with Reset asserted
+		 */
+		udelay(4);
+		reg &= ~(CMD_SW_RESET | CMD_LCL_LOOP_EN);
+		bcmgenet_umac_writel(priv, reg, UMAC_CMD);
+		/* Ensure 5 more clocks before Rx is enabled */
+		udelay(2);
+	}
+
 	priv->ext_phy = !priv->internal_phy &&
 			(priv->phy_interface != PHY_INTERFACE_MODE_MOCA);
 
@@ -214,6 +244,9 @@ int bcmgenet_mii_config(struct net_device *dev, bool init)
 		phy_set_max_speed(phydev, SPEED_100);
 		bcmgenet_sys_writel(priv,
 				    PORT_MODE_EXT_EPHY, SYS_PORT_CTRL);
+		/* Restore the MII PHY after isolation */
+		if (bmcr >= 0)
+			phy_write(phydev, MII_BMCR, bmcr);
 		break;
 
 	case PHY_INTERFACE_MODE_REVMII:
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 076/135] net: bcmgenet: reapply manual settings to the PHY
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (74 preceding siblings ...)
  2019-12-03 22:35 ` [PATCH 5.3 075/135] net: bcmgenet: use RGMII loopback for MAC reset Greg Kroah-Hartman
@ 2019-12-03 22:35 ` Greg Kroah-Hartman
  2019-12-03 22:35 ` [PATCH 5.3 077/135] drm/amdgpu: dont schedule jobs while in reset Greg Kroah-Hartman
                   ` (62 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:35 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Doug Berger, Florian Fainelli,
	David S. Miller, Sasha Levin

From: Doug Berger <opendmb@gmail.com>

[ Upstream commit 0686bd9d5e6863f60e4bb1e78e6fe7bb217a0890 ]

The phy_init_hw() function may reset the PHY to a configuration
that does not match manual network settings stored in the phydev
structure. If the phy state machine is polled rather than event
driven this can create a timing hazard where the phy state machine
might alter the settings stored in the phydev structure from the
value read from the BMCR.

This commit follows invocations of phy_init_hw() by the bcmgenet
driver with invocations of the genphy_config_aneg() function to
ensure that the BMCR is written to match the settings held in the
phydev structure. This prevents the risk of manual settings being
accidentally altered.

Fixes: 1c1008c793fa ("net: bcmgenet: add main driver file")
Signed-off-by: Doug Berger <opendmb@gmail.com>
Acked-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/broadcom/genet/bcmgenet.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
index 4c90923d7a1c8..2f0011465af0c 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
@@ -2617,8 +2617,10 @@ static void bcmgenet_irq_task(struct work_struct *work)
 	spin_unlock_irq(&priv->lock);
 
 	if (status & UMAC_IRQ_PHY_DET_R &&
-	    priv->dev->phydev->autoneg != AUTONEG_ENABLE)
+	    priv->dev->phydev->autoneg != AUTONEG_ENABLE) {
 		phy_init_hw(priv->dev->phydev);
+		genphy_config_aneg(priv->dev->phydev);
+	}
 
 	/* Link UP/DOWN event */
 	if (status & UMAC_IRQ_LINK_EVENT)
@@ -3641,6 +3643,7 @@ static int bcmgenet_resume(struct device *d)
 	phy_init_hw(dev->phydev);
 
 	/* Speed settings must be restored */
+	genphy_config_aneg(dev->phydev);
 	bcmgenet_mii_config(priv->dev, false);
 
 	bcmgenet_set_hw_addr(priv, dev->dev_addr);
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 077/135] drm/amdgpu: dont schedule jobs while in reset
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (75 preceding siblings ...)
  2019-12-03 22:35 ` [PATCH 5.3 076/135] net: bcmgenet: reapply manual settings to the PHY Greg Kroah-Hartman
@ 2019-12-03 22:35 ` Greg Kroah-Hartman
  2019-12-03 22:35 ` [PATCH 5.3 078/135] net/mlx5e: Fix eswitch debug print of max fdb flow Greg Kroah-Hartman
                   ` (61 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:35 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Shirish S, Christian König,
	Andrey Grodzovsky, Alex Deucher, Sasha Levin

From: Shirish S <shirish.s@amd.com>

[ Upstream commit f2efc6e60089c99c342a6b7da47f1037e06c4296 ]

[Why]

doing kthread_park()/unpark() from drm_sched_entity_fini
while GPU reset is in progress defeats all the purpose of
drm_sched_stop->kthread_park.
If drm_sched_entity_fini->kthread_unpark() happens AFTER
drm_sched_stop->kthread_park nothing prevents from another
(third) thread to keep submitting job to HW which will be
picked up by the unparked scheduler thread and try to submit
to HW but fail because the HW ring is deactivated.

[How]
grab the reset lock before calling drm_sched_entity_fini()

Signed-off-by: Shirish S <shirish.s@amd.com>
Suggested-by: Christian König <christian.koenig@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Reviewed-by: Andrey Grodzovsky <andrey.grodzovsky@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c
index 7398b4850649b..b7633484d15f2 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c
@@ -597,8 +597,11 @@ void amdgpu_ctx_mgr_entity_fini(struct amdgpu_ctx_mgr *mgr)
 			continue;
 		}
 
-		for (i = 0; i < num_entities; i++)
+		for (i = 0; i < num_entities; i++) {
+			mutex_lock(&ctx->adev->lock_reset);
 			drm_sched_entity_fini(&ctx->entities[0][i].entity);
+			mutex_unlock(&ctx->adev->lock_reset);
+		}
 	}
 }
 
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 078/135] net/mlx5e: Fix eswitch debug print of max fdb flow
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (76 preceding siblings ...)
  2019-12-03 22:35 ` [PATCH 5.3 077/135] drm/amdgpu: dont schedule jobs while in reset Greg Kroah-Hartman
@ 2019-12-03 22:35 ` Greg Kroah-Hartman
  2019-12-03 22:35 ` [PATCH 5.3 079/135] net/mlx5e: Use correct enum to determine uplink port Greg Kroah-Hartman
                   ` (60 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:35 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Roi Dayan, Eli Britstein,
	Saeed Mahameed, Sasha Levin

From: Roi Dayan <roid@mellanox.com>

[ Upstream commit f382b0df6946d48fae80a2201ccff43b41382099 ]

The value is already the calculation so remove the log prefix.

Fixes: e52c28024008 ("net/mlx5: E-Switch, Add chains and priorities")
Signed-off-by: Roi Dayan <roid@mellanox.com>
Reviewed-by: Eli Britstein <elibr@mellanox.com>
Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
index 35945cdd0a618..3ac6104e9924c 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
@@ -1085,7 +1085,7 @@ static int esw_create_offloads_fdb_tables(struct mlx5_eswitch *esw, int nvports)
 			    MLX5_CAP_GEN(dev, max_flow_counter_15_0);
 	fdb_max = 1 << MLX5_CAP_ESW_FLOWTABLE_FDB(dev, log_max_ft_size);
 
-	esw_debug(dev, "Create offloads FDB table, min (max esw size(2^%d), max counters(%d), groups(%d), max flow table size(2^%d))\n",
+	esw_debug(dev, "Create offloads FDB table, min (max esw size(2^%d), max counters(%d), groups(%d), max flow table size(%d))\n",
 		  MLX5_CAP_ESW_FLOWTABLE_FDB(dev, log_max_ft_size),
 		  max_flow_counter, ESW_OFFLOADS_NUM_GROUPS,
 		  fdb_max);
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 079/135] net/mlx5e: Use correct enum to determine uplink port
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (77 preceding siblings ...)
  2019-12-03 22:35 ` [PATCH 5.3 078/135] net/mlx5e: Fix eswitch debug print of max fdb flow Greg Kroah-Hartman
@ 2019-12-03 22:35 ` Greg Kroah-Hartman
  2019-12-03 22:35 ` [PATCH 5.3 080/135] net: mscc: ocelot: fix __ocelot_rmw_ix prototype Greg Kroah-Hartman
                   ` (59 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:35 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dmytro Linkin, Vlad Buslov,
	Roi Dayan, Saeed Mahameed, Sasha Levin

From: Dmytro Linkin <dmitrolin@mellanox.com>

[ Upstream commit 950d3af70ea89cf7ac51d734a634174013631192 ]

For vlan push action, if eswitch flow source capability is enabled, flow
source value compared with MLX5_VPORT_UPLINK enum, to determine uplink
port. This lead to syndrome in dmesg if try to add vlan push action.
For example:
 $ tc filter add dev vxlan0 ingress protocol ip prio 1 flower \
       enc_dst_port 4789 \
       action tunnel_key unset pipe \
       action vlan push id 20 pipe \
       action mirred egress redirect dev ens1f0_0
 $ dmesg
 ...
 [ 2456.883693] mlx5_core 0000:82:00.0: mlx5_cmd_check:756:(pid 5273): SET_FLOW_TABLE_ENTRY(0x936) op_mod(0x0) failed, status bad parameter(0x3), syndrome (0xa9c090)
Use the correct enum value MLX5_FLOW_CONTEXT_FLOW_SOURCE_UPLINK.

Fixes: bb204dcf39fe ("net/mlx5e: Determine source port properly for vlan push action")
Signed-off-by: Dmytro Linkin <dmitrolin@mellanox.com>
Reviewed-by: Vlad Buslov <vladbu@mellanox.com>
Reviewed-by: Roi Dayan <roid@mellanox.com>
Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../net/ethernet/mellanox/mlx5/core/eswitch_offloads_termtbl.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads_termtbl.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads_termtbl.c
index 7879e1746297c..366bda1bb1c32 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads_termtbl.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads_termtbl.c
@@ -183,7 +183,8 @@ static bool mlx5_eswitch_offload_is_uplink_port(const struct mlx5_eswitch *esw,
 	u32 port_mask, port_value;
 
 	if (MLX5_CAP_ESW_FLOWTABLE(esw->dev, flow_source))
-		return spec->flow_context.flow_source == MLX5_VPORT_UPLINK;
+		return spec->flow_context.flow_source ==
+					MLX5_FLOW_CONTEXT_FLOW_SOURCE_UPLINK;
 
 	port_mask = MLX5_GET(fte_match_param, spec->match_criteria,
 			     misc_parameters.source_port);
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 080/135] net: mscc: ocelot: fix __ocelot_rmw_ix prototype
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (78 preceding siblings ...)
  2019-12-03 22:35 ` [PATCH 5.3 079/135] net/mlx5e: Use correct enum to determine uplink port Greg Kroah-Hartman
@ 2019-12-03 22:35 ` Greg Kroah-Hartman
  2019-12-03 22:35 ` [PATCH 5.3 081/135] drm/amd/swSMU: fix smu workload bit map error Greg Kroah-Hartman
                   ` (58 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:35 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Vladimir Oltean, David S. Miller,
	Sasha Levin

From: Vladimir Oltean <olteanv@gmail.com>

[ Upstream commit 17fdd7638cb687cd7f15a48545f25d738f0101e0 ]

The "read-modify-write register index" function is declared with a
confusing prototype: the "mask" and "reg" arguments are swapped.

Fortunately, this does not affect callers so far. Both arguments are
u32, and the wrapper macros (ocelot_rmw_ix etc) have the arguments in
the correct order (the one from ocelot_io.c).

Signed-off-by: Vladimir Oltean <olteanv@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/mscc/ocelot.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/mscc/ocelot.h b/drivers/net/ethernet/mscc/ocelot.h
index f7eeb4806897d..aa372aba66c8c 100644
--- a/drivers/net/ethernet/mscc/ocelot.h
+++ b/drivers/net/ethernet/mscc/ocelot.h
@@ -479,7 +479,7 @@ void __ocelot_write_ix(struct ocelot *ocelot, u32 val, u32 reg, u32 offset);
 #define ocelot_write_rix(ocelot, val, reg, ri) __ocelot_write_ix(ocelot, val, reg, reg##_RSZ * (ri))
 #define ocelot_write(ocelot, val, reg) __ocelot_write_ix(ocelot, val, reg, 0)
 
-void __ocelot_rmw_ix(struct ocelot *ocelot, u32 val, u32 reg, u32 mask,
+void __ocelot_rmw_ix(struct ocelot *ocelot, u32 val, u32 mask, u32 reg,
 		     u32 offset);
 #define ocelot_rmw_ix(ocelot, val, m, reg, gi, ri) __ocelot_rmw_ix(ocelot, val, m, reg, reg##_GSZ * (gi) + reg##_RSZ * (ri))
 #define ocelot_rmw_gix(ocelot, val, m, reg, gi) __ocelot_rmw_ix(ocelot, val, m, reg, reg##_GSZ * (gi))
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 081/135] drm/amd/swSMU: fix smu workload bit map error
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (79 preceding siblings ...)
  2019-12-03 22:35 ` [PATCH 5.3 080/135] net: mscc: ocelot: fix __ocelot_rmw_ix prototype Greg Kroah-Hartman
@ 2019-12-03 22:35 ` Greg Kroah-Hartman
  2019-12-03 22:35 ` [PATCH 5.3 082/135] drm/amdgpu: register gpu instance before fan boost feature enablment Greg Kroah-Hartman
                   ` (57 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:35 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Kevin Wang, Kenneth Feng,
	Alex Deucher, Sasha Levin

From: Kevin Wang <kevin1.wang@amd.com>

[ Upstream commit 38264de0dce80d223f358ce47512378fae0de586 ]

fix workload bit (WORKLOAD_PPLIB_COMPUTE_BIT) map error
on vega20 and navi asic.

fix commit:
drm/amd/powerplay: add function get_workload_type_map for swsmu

Signed-off-by: Kevin Wang <kevin1.wang@amd.com>
Reviewed-by: Kenneth Feng <kenneth.feng@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/powerplay/navi10_ppt.c | 2 +-
 drivers/gpu/drm/amd/powerplay/vega20_ppt.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/amd/powerplay/navi10_ppt.c b/drivers/gpu/drm/amd/powerplay/navi10_ppt.c
index 8bf9f541e7fe7..a0ef44d025d61 100644
--- a/drivers/gpu/drm/amd/powerplay/navi10_ppt.c
+++ b/drivers/gpu/drm/amd/powerplay/navi10_ppt.c
@@ -205,7 +205,7 @@ static int navi10_workload_map[] = {
 	WORKLOAD_MAP(PP_SMC_POWER_PROFILE_POWERSAVING,		WORKLOAD_PPLIB_POWER_SAVING_BIT),
 	WORKLOAD_MAP(PP_SMC_POWER_PROFILE_VIDEO,		WORKLOAD_PPLIB_VIDEO_BIT),
 	WORKLOAD_MAP(PP_SMC_POWER_PROFILE_VR,			WORKLOAD_PPLIB_VR_BIT),
-	WORKLOAD_MAP(PP_SMC_POWER_PROFILE_COMPUTE,		WORKLOAD_PPLIB_CUSTOM_BIT),
+	WORKLOAD_MAP(PP_SMC_POWER_PROFILE_COMPUTE,		WORKLOAD_PPLIB_COMPUTE_BIT),
 	WORKLOAD_MAP(PP_SMC_POWER_PROFILE_CUSTOM,		WORKLOAD_PPLIB_CUSTOM_BIT),
 };
 
diff --git a/drivers/gpu/drm/amd/powerplay/vega20_ppt.c b/drivers/gpu/drm/amd/powerplay/vega20_ppt.c
index 6a14497257e43..33ca6c581f219 100644
--- a/drivers/gpu/drm/amd/powerplay/vega20_ppt.c
+++ b/drivers/gpu/drm/amd/powerplay/vega20_ppt.c
@@ -219,7 +219,7 @@ static int vega20_workload_map[] = {
 	WORKLOAD_MAP(PP_SMC_POWER_PROFILE_POWERSAVING,		WORKLOAD_PPLIB_POWER_SAVING_BIT),
 	WORKLOAD_MAP(PP_SMC_POWER_PROFILE_VIDEO,		WORKLOAD_PPLIB_VIDEO_BIT),
 	WORKLOAD_MAP(PP_SMC_POWER_PROFILE_VR,			WORKLOAD_PPLIB_VR_BIT),
-	WORKLOAD_MAP(PP_SMC_POWER_PROFILE_COMPUTE,		WORKLOAD_PPLIB_CUSTOM_BIT),
+	WORKLOAD_MAP(PP_SMC_POWER_PROFILE_COMPUTE,		WORKLOAD_PPLIB_COMPUTE_BIT),
 	WORKLOAD_MAP(PP_SMC_POWER_PROFILE_CUSTOM,		WORKLOAD_PPLIB_CUSTOM_BIT),
 };
 
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 082/135] drm/amdgpu: register gpu instance before fan boost feature enablment
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (80 preceding siblings ...)
  2019-12-03 22:35 ` [PATCH 5.3 081/135] drm/amd/swSMU: fix smu workload bit map error Greg Kroah-Hartman
@ 2019-12-03 22:35 ` Greg Kroah-Hartman
  2019-12-03 22:35 ` [PATCH 5.3 083/135] drm/amdgpu: add warning for GRBM 1-cycle delay issue in gfx9 Greg Kroah-Hartman
                   ` (56 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:35 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Evan Quan, Alex Deucher, Sasha Levin

From: Evan Quan <evan.quan@amd.com>

[ Upstream commit 6a299d7aaa97dfde5988d8f9e2fa2c046b5793ff ]

Otherwise, the feature enablement will be skipped due to wrong count.

Fixes: beff74bc6e0fa91 ("drm/amdgpu: fix a race in GPU reset with IB test (v2)")
Signed-off-by: Evan Quan <evan.quan@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 7 +++++++
 drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c    | 1 -
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
index 5a7f893cf7244..2877ce84aef2b 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
@@ -2788,6 +2788,13 @@ fence_driver_init:
 			DRM_INFO("amdgpu: acceleration disabled, skipping benchmarks\n");
 	}
 
+	/*
+	 * Register gpu instance before amdgpu_device_enable_mgpu_fan_boost.
+	 * Otherwise the mgpu fan boost feature will be skipped due to the
+	 * gpu instance is counted less.
+	 */
+	amdgpu_register_gpu_instance(adev);
+
 	/* enable clockgating, etc. after ib tests, etc. since some blocks require
 	 * explicit gating rather than handling it automatically.
 	 */
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
index 65f6619f0c0c4..e531ba9195a0f 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
@@ -190,7 +190,6 @@ int amdgpu_driver_load_kms(struct drm_device *dev, unsigned long flags)
 		pm_runtime_put_autosuspend(dev->dev);
 	}
 
-	amdgpu_register_gpu_instance(adev);
 out:
 	if (r) {
 		/* balance pm_runtime_get_sync in amdgpu_driver_unload_kms */
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 083/135] drm/amdgpu: add warning for GRBM 1-cycle delay issue in gfx9
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (81 preceding siblings ...)
  2019-12-03 22:35 ` [PATCH 5.3 082/135] drm/amdgpu: register gpu instance before fan boost feature enablment Greg Kroah-Hartman
@ 2019-12-03 22:35 ` Greg Kroah-Hartman
  2019-12-03 22:35 ` [PATCH 5.3 084/135] net: stmmac: gmac4: bitrev32 returns u32 Greg Kroah-Hartman
                   ` (55 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:35 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, changzhu, Christian König,
	Alex Deucher, Sasha Levin

From: changzhu <Changfeng.Zhu@amd.com>

[ Upstream commit 440a7a54e7ec012ec8b27c27e460dfd6f9a24ddb ]

It needs to add warning to update firmware in gfx9
in case that firmware is too old to have function to
realize dummy read in cp firmware.

Signed-off-by: changzhu <Changfeng.Zhu@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
index 75faa56f243a4..b1388d3e72f74 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
@@ -538,6 +538,13 @@ static void gfx_v9_0_check_fw_write_wait(struct amdgpu_device *adev)
 	adev->gfx.me_fw_write_wait = false;
 	adev->gfx.mec_fw_write_wait = false;
 
+	if ((adev->gfx.mec_fw_version < 0x000001a5) ||
+	    (adev->gfx.mec_feature_version < 46) ||
+	    (adev->gfx.pfp_fw_version < 0x000000b7) ||
+	    (adev->gfx.pfp_feature_version < 46))
+		DRM_WARN_ONCE("Warning: check cp_fw_version and update it to realize \
+			      GRBM requires 1-cycle delay in cp firmware\n");
+
 	switch (adev->asic_type) {
 	case CHIP_VEGA10:
 		if ((adev->gfx.me_fw_version >= 0x0000009c) &&
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 084/135] net: stmmac: gmac4: bitrev32 returns u32
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (82 preceding siblings ...)
  2019-12-03 22:35 ` [PATCH 5.3 083/135] drm/amdgpu: add warning for GRBM 1-cycle delay issue in gfx9 Greg Kroah-Hartman
@ 2019-12-03 22:35 ` Greg Kroah-Hartman
  2019-12-03 22:35 ` [PATCH 5.3 085/135] net: stmmac: xgmac: " Greg Kroah-Hartman
                   ` (54 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:35 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jose Abreu, David S. Miller, Sasha Levin

From: Jose Abreu <Jose.Abreu@synopsys.com>

[ Upstream commit 4d7c47e34fab0d25790bb6e85b85e26fdf0090d5 ]

The bitrev32 function returns an u32 var, not an int. Fix it.

Fixes: 477286b53f55 ("stmmac: add GMAC4 core support")
Signed-off-by: Jose Abreu <Jose.Abreu@synopsys.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
index 9c73fb759b575..ff830bb5fcaf7 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
@@ -438,7 +438,7 @@ static void dwmac4_set_filter(struct mac_device_info *hw,
 			 * bits used depends on the hardware configuration
 			 * selected at core configuration time.
 			 */
-			int bit_nr = bitrev32(~crc32_le(~0, ha->addr,
+			u32 bit_nr = bitrev32(~crc32_le(~0, ha->addr,
 					ETH_ALEN)) >> (32 - mcbitslog2);
 			/* The most significant bit determines the register to
 			 * use (H/L) while the other 5 bits determine the bit
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 085/135] net: stmmac: xgmac: bitrev32 returns u32
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (83 preceding siblings ...)
  2019-12-03 22:35 ` [PATCH 5.3 084/135] net: stmmac: gmac4: bitrev32 returns u32 Greg Kroah-Hartman
@ 2019-12-03 22:35 ` " Greg Kroah-Hartman
  2019-12-03 22:35 ` [PATCH 5.3 086/135] net: stmmac: xgmac: Fix TSA selection Greg Kroah-Hartman
                   ` (53 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:35 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jose Abreu, David S. Miller, Sasha Levin

From: Jose Abreu <Jose.Abreu@synopsys.com>

[ Upstream commit 3d00e45d498fd5347cea653ef494c56731b651e0 ]

The bitrev32 function returns an u32 var, not an int. Fix it.

Fixes: 0efedbf11f07 ("net: stmmac: xgmac: Fix XGMAC selftests")
Signed-off-by: Jose Abreu <Jose.Abreu@synopsys.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c
index 46d74f407aab6..91d7dec2540a1 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c
@@ -361,7 +361,7 @@ static void dwxgmac2_set_filter(struct mac_device_info *hw,
 		value |= XGMAC_FILTER_HMC;
 
 		netdev_for_each_mc_addr(ha, dev) {
-			int nr = (bitrev32(~crc32_le(~0, ha->addr, 6)) >>
+			u32 nr = (bitrev32(~crc32_le(~0, ha->addr, 6)) >>
 					(32 - mcbitslog2));
 			mc_filter[nr >> 5] |= (1 << (nr & 0x1F));
 		}
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 086/135] net: stmmac: xgmac: Fix TSA selection
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (84 preceding siblings ...)
  2019-12-03 22:35 ` [PATCH 5.3 085/135] net: stmmac: xgmac: " Greg Kroah-Hartman
@ 2019-12-03 22:35 ` Greg Kroah-Hartman
  2019-12-03 22:35 ` [PATCH 5.3 087/135] net: stmmac: xgmac: Disable Flow Control when 1 or more queues are in AV Greg Kroah-Hartman
                   ` (52 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:35 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jose Abreu, David S. Miller, Sasha Levin

From: Jose Abreu <Jose.Abreu@synopsys.com>

[ Upstream commit 97add93fbcfa566735d6a4b96684110d356ebd35 ]

When we change between Transmission Scheduling Algorithms, we need to
clear previous values so that the new chosen algorithm is correctly
selected.

Fixes: ec6ea8e3eee9 ("net: stmmac: Add CBS support in XGMAC2")
Signed-off-by: Jose Abreu <Jose.Abreu@synopsys.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c
index 91d7dec2540a1..341c7a70fc71a 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c
@@ -196,6 +196,7 @@ static void dwxgmac2_config_cbs(struct mac_device_info *hw,
 	writel(low_credit, ioaddr + XGMAC_MTL_TCx_LOCREDIT(queue));
 
 	value = readl(ioaddr + XGMAC_MTL_TCx_ETS_CONTROL(queue));
+	value &= ~XGMAC_TSA;
 	value |= XGMAC_CC | XGMAC_CBS;
 	writel(value, ioaddr + XGMAC_MTL_TCx_ETS_CONTROL(queue));
 }
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 087/135] net: stmmac: xgmac: Disable Flow Control when 1 or more queues are in AV
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (85 preceding siblings ...)
  2019-12-03 22:35 ` [PATCH 5.3 086/135] net: stmmac: xgmac: Fix TSA selection Greg Kroah-Hartman
@ 2019-12-03 22:35 ` Greg Kroah-Hartman
  2019-12-03 22:35 ` [PATCH 5.3 088/135] ceph: return -EINVAL if given fsc mount option on kernel w/o support Greg Kroah-Hartman
                   ` (51 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:35 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jose Abreu, David S. Miller, Sasha Levin

From: Jose Abreu <Jose.Abreu@synopsys.com>

[ Upstream commit 132f2f20c9866325d12c155aca06d260f358d3cb ]

When in AVB mode we need to disable flow control to prevent MAC from
pausing in TX side.

Fixes: ec6ea8e3eee9 ("net: stmmac: Add CBS support in XGMAC2")
Signed-off-by: Jose Abreu <Jose.Abreu@synopsys.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c
index a4f236e3593e7..28dc3b33606e1 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c
@@ -441,6 +441,7 @@ static void dwxgmac2_enable_tso(void __iomem *ioaddr, bool en, u32 chan)
 static void dwxgmac2_qmode(void __iomem *ioaddr, u32 channel, u8 qmode)
 {
 	u32 value = readl(ioaddr + XGMAC_MTL_TXQ_OPMODE(channel));
+	u32 flow = readl(ioaddr + XGMAC_RX_FLOW_CTRL);
 
 	value &= ~XGMAC_TXQEN;
 	if (qmode != MTL_QUEUE_AVB) {
@@ -448,6 +449,7 @@ static void dwxgmac2_qmode(void __iomem *ioaddr, u32 channel, u8 qmode)
 		writel(0, ioaddr + XGMAC_MTL_TCx_ETS_CONTROL(channel));
 	} else {
 		value |= 0x1 << XGMAC_TXQEN_SHIFT;
+		writel(flow & (~XGMAC_RFE), ioaddr + XGMAC_RX_FLOW_CTRL);
 	}
 
 	writel(value, ioaddr +  XGMAC_MTL_TXQ_OPMODE(channel));
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 088/135] ceph: return -EINVAL if given fsc mount option on kernel w/o support
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (86 preceding siblings ...)
  2019-12-03 22:35 ` [PATCH 5.3 087/135] net: stmmac: xgmac: Disable Flow Control when 1 or more queues are in AV Greg Kroah-Hartman
@ 2019-12-03 22:35 ` Greg Kroah-Hartman
  2019-12-03 22:35 ` [PATCH 5.3 089/135] mac80211: fix ieee80211_txq_setup_flows() failure path Greg Kroah-Hartman
                   ` (50 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:35 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jeff Layton, Ilya Dryomov, Sasha Levin

From: Jeff Layton <jlayton@kernel.org>

[ Upstream commit ff29fde84d1fc82f233c7da0daa3574a3942bec7 ]

If someone requests fscache on the mount, and the kernel doesn't
support it, it should fail the mount.

[ Drop ceph prefix -- it's provided by pr_err. ]

Signed-off-by: Jeff Layton <jlayton@kernel.org>
Reviewed-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ceph/super.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/fs/ceph/super.c b/fs/ceph/super.c
index ab4868c7308ec..b565c55ed0648 100644
--- a/fs/ceph/super.c
+++ b/fs/ceph/super.c
@@ -255,6 +255,7 @@ static int parse_fsopt_token(char *c, void *private)
 			return -ENOMEM;
 		break;
 	case Opt_fscache_uniq:
+#ifdef CONFIG_CEPH_FSCACHE
 		kfree(fsopt->fscache_uniq);
 		fsopt->fscache_uniq = kstrndup(argstr[0].from,
 					       argstr[0].to-argstr[0].from,
@@ -263,7 +264,10 @@ static int parse_fsopt_token(char *c, void *private)
 			return -ENOMEM;
 		fsopt->flags |= CEPH_MOUNT_OPT_FSCACHE;
 		break;
-		/* misc */
+#else
+		pr_err("fscache support is disabled\n");
+		return -EINVAL;
+#endif
 	case Opt_wsize:
 		if (intval < (int)PAGE_SIZE || intval > CEPH_MAX_WRITE_SIZE)
 			return -EINVAL;
@@ -340,10 +344,15 @@ static int parse_fsopt_token(char *c, void *private)
 		fsopt->flags &= ~CEPH_MOUNT_OPT_INO32;
 		break;
 	case Opt_fscache:
+#ifdef CONFIG_CEPH_FSCACHE
 		fsopt->flags |= CEPH_MOUNT_OPT_FSCACHE;
 		kfree(fsopt->fscache_uniq);
 		fsopt->fscache_uniq = NULL;
 		break;
+#else
+		pr_err("fscache support is disabled\n");
+		return -EINVAL;
+#endif
 	case Opt_nofscache:
 		fsopt->flags &= ~CEPH_MOUNT_OPT_FSCACHE;
 		kfree(fsopt->fscache_uniq);
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 089/135] mac80211: fix ieee80211_txq_setup_flows() failure path
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (87 preceding siblings ...)
  2019-12-03 22:35 ` [PATCH 5.3 088/135] ceph: return -EINVAL if given fsc mount option on kernel w/o support Greg Kroah-Hartman
@ 2019-12-03 22:35 ` Greg Kroah-Hartman
  2019-12-03 22:35 ` [PATCH 5.3 090/135] net/fq_impl: Switch to kvmalloc() for memory allocation Greg Kroah-Hartman
                   ` (49 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:35 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Johannes Berg,
	Toke Høiland-Jørgensen, Sasha Levin

From: Johannes Berg <johannes.berg@intel.com>

[ Upstream commit 6dd47d9754ff0589715054b11294771f2c9a16ac ]

If ieee80211_txq_setup_flows() fails, we don't clean up LED
state properly, leading to crashes later on, fix that.

Fixes: dc8b274f0952 ("mac80211: Move up init of TXQs")
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Acked-by: Toke Høiland-Jørgensen <toke@toke.dk>
Link: https://lore.kernel.org/r/20191105154110.1ccf7112ba5d.I0ba865792446d051867b33153be65ce6b063d98c@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/mac80211/main.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 4c2702f128f3a..868705ed5cbbb 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -1297,8 +1297,8 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
 	ieee80211_remove_interfaces(local);
  fail_rate:
 	rtnl_unlock();
-	ieee80211_led_exit(local);
  fail_flows:
+	ieee80211_led_exit(local);
 	destroy_workqueue(local->workqueue);
  fail_workqueue:
 	wiphy_unregister(local->hw.wiphy);
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 090/135] net/fq_impl: Switch to kvmalloc() for memory allocation
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (88 preceding siblings ...)
  2019-12-03 22:35 ` [PATCH 5.3 089/135] mac80211: fix ieee80211_txq_setup_flows() failure path Greg Kroah-Hartman
@ 2019-12-03 22:35 ` Greg Kroah-Hartman
  2019-12-03 22:35 ` [PATCH 5.3 091/135] mac80211: fix station inactive_time shortly after boot Greg Kroah-Hartman
                   ` (48 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:35 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Johannes Berg,
	Toke Høiland-Jørgensen, Johannes Berg, Sasha Levin

From: Toke Høiland-Jørgensen <toke@redhat.com>

[ Upstream commit 71e67c3bd127cfe7863f54e4b087eba1cc8f9a7a ]

The FQ implementation used by mac80211 allocates memory using kmalloc(),
which can fail; and Johannes reported that this actually happens in
practice.

To avoid this, switch the allocation to kvmalloc() instead; this also
brings fq_impl in line with all the FQ qdiscs.

Fixes: 557fc4a09803 ("fq: add fair queuing framework")
Reported-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
Link: https://lore.kernel.org/r/20191105155750.547379-1-toke@redhat.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/net/fq_impl.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/net/fq_impl.h b/include/net/fq_impl.h
index 107c0d700ed6f..38a9a3d1222b7 100644
--- a/include/net/fq_impl.h
+++ b/include/net/fq_impl.h
@@ -313,7 +313,7 @@ static int fq_init(struct fq *fq, int flows_cnt)
 	fq->limit = 8192;
 	fq->memory_limit = 16 << 20; /* 16 MBytes */
 
-	fq->flows = kcalloc(fq->flows_cnt, sizeof(fq->flows[0]), GFP_KERNEL);
+	fq->flows = kvcalloc(fq->flows_cnt, sizeof(fq->flows[0]), GFP_KERNEL);
 	if (!fq->flows)
 		return -ENOMEM;
 
@@ -331,7 +331,7 @@ static void fq_reset(struct fq *fq,
 	for (i = 0; i < fq->flows_cnt; i++)
 		fq_flow_reset(fq, &fq->flows[i], free_func);
 
-	kfree(fq->flows);
+	kvfree(fq->flows);
 	fq->flows = NULL;
 }
 
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 091/135] mac80211: fix station inactive_time shortly after boot
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (89 preceding siblings ...)
  2019-12-03 22:35 ` [PATCH 5.3 090/135] net/fq_impl: Switch to kvmalloc() for memory allocation Greg Kroah-Hartman
@ 2019-12-03 22:35 ` Greg Kroah-Hartman
  2019-12-03 22:35 ` [PATCH 5.3 092/135] block: drbd: remove a stray unlock in __drbd_send_protocol() Greg Kroah-Hartman
                   ` (47 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:35 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ahmed Zaki, Johannes Berg, Sasha Levin

From: Ahmed Zaki <anzaki@gmail.com>

[ Upstream commit 285531f9e6774e3be71da6673d475ff1a088d675 ]

In the first 5 minutes after boot (time of INITIAL_JIFFIES),
ieee80211_sta_last_active() returns zero if last_ack is zero. This
leads to "inactive time" showing jiffies_to_msecs(jiffies).

 # iw wlan0 station get fc:ec:da:64:a6:dd
 Station fc:ec:da:64:a6:dd (on wlan0)
	inactive time:	4294894049 ms
	.
	.
	connected time:	70 seconds

Fix by returning last_rx if last_ack == 0.

Signed-off-by: Ahmed Zaki <anzaki@gmail.com>
Link: https://lore.kernel.org/r/20191031121243.27694-1-anzaki@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/mac80211/sta_info.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index 5fb368cc26338..0030b13c2f501 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -2455,7 +2455,8 @@ unsigned long ieee80211_sta_last_active(struct sta_info *sta)
 {
 	struct ieee80211_sta_rx_stats *stats = sta_get_last_rx_stats(sta);
 
-	if (time_after(stats->last_rx, sta->status_stats.last_ack))
+	if (!sta->status_stats.last_ack ||
+	    time_after(stats->last_rx, sta->status_stats.last_ack))
 		return stats->last_rx;
 	return sta->status_stats.last_ack;
 }
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 092/135] block: drbd: remove a stray unlock in __drbd_send_protocol()
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (90 preceding siblings ...)
  2019-12-03 22:35 ` [PATCH 5.3 091/135] mac80211: fix station inactive_time shortly after boot Greg Kroah-Hartman
@ 2019-12-03 22:35 ` Greg Kroah-Hartman
  2019-12-03 22:35 ` [PATCH 5.3 093/135] pwm: bcm-iproc: Prevent unloading the driver module while in use Greg Kroah-Hartman
                   ` (46 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:35 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Jens Axboe, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit 8e9c523016cf9983b295e4bc659183d1fa6ef8e0 ]

There are two callers of this function and they both unlock the mutex so
this ends up being a double unlock.

Fixes: 44ed167da748 ("drbd: rcu_read_lock() and rcu_dereference() for tconn->net_conf")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/block/drbd/drbd_main.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/block/drbd/drbd_main.c b/drivers/block/drbd/drbd_main.c
index 5b248763a6724..a18155cdce416 100644
--- a/drivers/block/drbd/drbd_main.c
+++ b/drivers/block/drbd/drbd_main.c
@@ -786,7 +786,6 @@ int __drbd_send_protocol(struct drbd_connection *connection, enum drbd_packet cm
 
 	if (nc->tentative && connection->agreed_pro_version < 92) {
 		rcu_read_unlock();
-		mutex_unlock(&sock->mutex);
 		drbd_err(connection, "--dry-run is not supported by peer");
 		return -EOPNOTSUPP;
 	}
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 093/135] pwm: bcm-iproc: Prevent unloading the driver module while in use
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (91 preceding siblings ...)
  2019-12-03 22:35 ` [PATCH 5.3 092/135] block: drbd: remove a stray unlock in __drbd_send_protocol() Greg Kroah-Hartman
@ 2019-12-03 22:35 ` Greg Kroah-Hartman
  2019-12-03 22:35 ` [PATCH 5.3 094/135] ice: fix potential infinite loop because loop counter being too small Greg Kroah-Hartman
                   ` (45 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:35 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Uwe Kleine-König,
	Florian Fainelli, Thierry Reding, Sasha Levin

From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>

[ Upstream commit 24906a41eecb73d51974ade0847c21e429beec60 ]

The owner member of struct pwm_ops must be set to THIS_MODULE to
increase the reference count of the module such that the module cannot
be removed while its code is in use.

Fixes: daa5abc41c80 ("pwm: Add support for Broadcom iProc PWM controller")
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pwm/pwm-bcm-iproc.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/pwm/pwm-bcm-iproc.c b/drivers/pwm/pwm-bcm-iproc.c
index d961a8207b1cb..31b01035d0ab3 100644
--- a/drivers/pwm/pwm-bcm-iproc.c
+++ b/drivers/pwm/pwm-bcm-iproc.c
@@ -187,6 +187,7 @@ static int iproc_pwmc_apply(struct pwm_chip *chip, struct pwm_device *pwm,
 static const struct pwm_ops iproc_pwm_ops = {
 	.apply = iproc_pwmc_apply,
 	.get_state = iproc_pwmc_get_state,
+	.owner = THIS_MODULE,
 };
 
 static int iproc_pwmc_probe(struct platform_device *pdev)
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 094/135] ice: fix potential infinite loop because loop counter being too small
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (92 preceding siblings ...)
  2019-12-03 22:35 ` [PATCH 5.3 093/135] pwm: bcm-iproc: Prevent unloading the driver module while in use Greg Kroah-Hartman
@ 2019-12-03 22:35 ` Greg Kroah-Hartman
  2019-12-03 22:35 ` [PATCH 5.3 095/135] iavf: initialize ITRN registers with correct values Greg Kroah-Hartman
                   ` (44 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:35 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Colin Ian King, Andrew Bowers,
	Jeff Kirsher, Sasha Levin

From: Colin Ian King <colin.king@canonical.com>

[ Upstream commit 615457a226f042bffc3a1532afb244cab37460d4 ]

Currently the for-loop counter i is a u8 however it is being checked
against a maximum value hw->num_tx_sched_layers which is a u16. Hence
there is a potential wrap-around of counter i back to zero if
hw->num_tx_sched_layers is greater than 255.  Fix this by making i
a u16.

Addresses-Coverity: ("Infinite loop")
Fixes: b36c598c999c ("ice: Updates to Tx scheduler code")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/intel/ice/ice_sched.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/intel/ice/ice_sched.c b/drivers/net/ethernet/intel/ice/ice_sched.c
index 2a232504379d2..602b0fd84c29e 100644
--- a/drivers/net/ethernet/intel/ice/ice_sched.c
+++ b/drivers/net/ethernet/intel/ice/ice_sched.c
@@ -1052,7 +1052,7 @@ enum ice_status ice_sched_query_res_alloc(struct ice_hw *hw)
 	struct ice_aqc_query_txsched_res_resp *buf;
 	enum ice_status status = 0;
 	__le16 max_sibl;
-	u8 i;
+	u16 i;
 
 	if (hw->layer_info)
 		return status;
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 095/135] iavf: initialize ITRN registers with correct values
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (93 preceding siblings ...)
  2019-12-03 22:35 ` [PATCH 5.3 094/135] ice: fix potential infinite loop because loop counter being too small Greg Kroah-Hartman
@ 2019-12-03 22:35 ` Greg Kroah-Hartman
  2019-12-03 22:35 ` [PATCH 5.3 096/135] i40e: Fix for ethtool -m issue on X722 NIC Greg Kroah-Hartman
                   ` (43 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:35 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Nicholas Nunley, Andrew Bowers,
	Jeff Kirsher, Sasha Levin

From: Nicholas Nunley <nicholas.d.nunley@intel.com>

[ Upstream commit 4eda4e0096842764d725bcfd77471a419832b074 ]

Since commit 92418fb14750 ("i40e/i40evf: Use usec value instead of reg
value for ITR defines") the driver tracks the interrupt throttling
intervals in single usec units, although the actual ITRN registers are
programmed in 2 usec units. Most register programming flows in the driver
correctly handle the conversion, although it is currently not applied when
the registers are initialized to their default values. Most of the time
this doesn't present a problem since the default values are usually
immediately overwritten through the standard adaptive throttling mechanism,
or updated manually by the user, but if adaptive throttling is disabled and
the interval values are left alone then the incorrect value will persist.

Since the intended default interval of 50 usecs (vs. 100 usecs as
programmed) performs better for most traffic workloads, this can lead to
performance regressions.

This patch adds the correct conversion when writing the initial values to
the ITRN registers.

Signed-off-by: Nicholas Nunley <nicholas.d.nunley@intel.com>
Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/intel/iavf/iavf_main.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/intel/iavf/iavf_main.c b/drivers/net/ethernet/intel/iavf/iavf_main.c
index 9d2b50964a08f..fa857b60ba2b6 100644
--- a/drivers/net/ethernet/intel/iavf/iavf_main.c
+++ b/drivers/net/ethernet/intel/iavf/iavf_main.c
@@ -336,7 +336,7 @@ iavf_map_vector_to_rxq(struct iavf_adapter *adapter, int v_idx, int r_idx)
 	q_vector->rx.target_itr = ITR_TO_REG(rx_ring->itr_setting);
 	q_vector->ring_mask |= BIT(r_idx);
 	wr32(hw, IAVF_VFINT_ITRN1(IAVF_RX_ITR, q_vector->reg_idx),
-	     q_vector->rx.current_itr);
+	     q_vector->rx.current_itr >> 1);
 	q_vector->rx.current_itr = q_vector->rx.target_itr;
 }
 
@@ -362,7 +362,7 @@ iavf_map_vector_to_txq(struct iavf_adapter *adapter, int v_idx, int t_idx)
 	q_vector->tx.target_itr = ITR_TO_REG(tx_ring->itr_setting);
 	q_vector->num_ringpairs++;
 	wr32(hw, IAVF_VFINT_ITRN1(IAVF_TX_ITR, q_vector->reg_idx),
-	     q_vector->tx.target_itr);
+	     q_vector->tx.target_itr >> 1);
 	q_vector->tx.current_itr = q_vector->tx.target_itr;
 }
 
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 096/135] i40e: Fix for ethtool -m issue on X722 NIC
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (94 preceding siblings ...)
  2019-12-03 22:35 ` [PATCH 5.3 095/135] iavf: initialize ITRN registers with correct values Greg Kroah-Hartman
@ 2019-12-03 22:35 ` Greg Kroah-Hartman
  2019-12-03 22:35 ` [PATCH 5.3 097/135] clk: at91: fix update bit maps on CFG_MOR write Greg Kroah-Hartman
                   ` (42 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:35 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Arkadiusz Kubalewski, Andrew Bowers,
	Jeff Kirsher, Sasha Levin

From: Arkadiusz Kubalewski <arkadiusz.kubalewski@intel.com>

[ Upstream commit 4c9da6f2b8a029052c75bd4a61ae229135831177 ]

This patch contains fix for a problem with command:
'ethtool -m <dev>'
which breaks functionality of:
'ethtool <dev>'
when called on X722 NIC

Disallowed update of link phy_types on X722 NIC
Currently correct value cannot be obtained from FW
Previously wrong value returned by FW was used and was
a root cause for incorrect output of 'ethtool <dev>' command

Signed-off-by: Arkadiusz Kubalewski <arkadiusz.kubalewski@intel.com>
Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/intel/i40e/i40e_common.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/intel/i40e/i40e_common.c b/drivers/net/ethernet/intel/i40e/i40e_common.c
index 906cf68d3453a..4a53bfc017b13 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_common.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_common.c
@@ -1861,7 +1861,8 @@ i40e_status i40e_aq_get_link_info(struct i40e_hw *hw,
 	     hw->aq.fw_min_ver < 40)) && hw_link_info->phy_type == 0xE)
 		hw_link_info->phy_type = I40E_PHY_TYPE_10GBASE_SFPP_CU;
 
-	if (hw->flags & I40E_HW_FLAG_AQ_PHY_ACCESS_CAPABLE) {
+	if (hw->flags & I40E_HW_FLAG_AQ_PHY_ACCESS_CAPABLE &&
+	    hw->mac.type != I40E_MAC_X722) {
 		__le32 tmp;
 
 		memcpy(&tmp, resp->link_type, sizeof(tmp));
-- 
2.20.1




^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 097/135] clk: at91: fix update bit maps on CFG_MOR write
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (95 preceding siblings ...)
  2019-12-03 22:35 ` [PATCH 5.3 096/135] i40e: Fix for ethtool -m issue on X722 NIC Greg Kroah-Hartman
@ 2019-12-03 22:35 ` Greg Kroah-Hartman
  2019-12-03 22:35 ` [PATCH 5.3 098/135] usb: dwc2: use a longer core rest timeout in dwc2_core_reset() Greg Kroah-Hartman
                   ` (41 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:35 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Eugen Hristev, Alexandre Belloni,
	Claudiu Beznea, Stephen Boyd, Lee Jones

From: Eugen Hristev <eugen.hristev@microchip.com>

commit 263eaf8f172d9f44e15d6aca85fe40ec18d2c477 upstream.

The regmap update bits call was not selecting the proper mask, considering
the bits which was updating.
Update the mask from call to also include OSCBYPASS.
Removed MOSCEN which was not updated.

Fixes: 1bdf02326b71 ("clk: at91: make use of syscon/regmap internally")
Signed-off-by: Eugen Hristev <eugen.hristev@microchip.com>
Link: https://lkml.kernel.org/r/1568042692-11784-1-git-send-email-eugen.hristev@microchip.com
Acked-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Reviewed-by: Claudiu Beznea <claudiu.beznea@microchip.com>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/clk/at91/clk-main.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/clk/at91/clk-main.c
+++ b/drivers/clk/at91/clk-main.c
@@ -156,7 +156,7 @@ at91_clk_register_main_osc(struct regmap
 	if (bypass)
 		regmap_update_bits(regmap,
 				   AT91_CKGR_MOR, MOR_KEY_MASK |
-				   AT91_PMC_MOSCEN,
+				   AT91_PMC_OSCBYPASS,
 				   AT91_PMC_OSCBYPASS | AT91_PMC_KEY);
 
 	hw = &osc->hw;



^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 098/135] usb: dwc2: use a longer core rest timeout in dwc2_core_reset()
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (96 preceding siblings ...)
  2019-12-03 22:35 ` [PATCH 5.3 097/135] clk: at91: fix update bit maps on CFG_MOR write Greg Kroah-Hartman
@ 2019-12-03 22:35 ` Greg Kroah-Hartman
  2019-12-03 22:35 ` [PATCH 5.3 099/135] staging: wilc1000: fix illegal memory access in wilc_parse_join_bss_param() Greg Kroah-Hartman
                   ` (40 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:35 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Mathias Kresin, Felipe Balbi

From: Mathias Kresin <dev@kresin.me>

commit 6689f0f4bb14e50917ba42eb9b41c25e0184970c upstream.

Testing on different generations of Lantiq MIPS SoC based boards, showed
that it takes up to 1500 us until the core reset bit is cleared.

The driver from the vendor SDK (ifxhcd) uses a 1 second timeout. Use the
same timeout to fix wrong hang detections and make the driver work for
Lantiq MIPS SoCs.

At least till kernel 4.14 the hanging reset only caused a warning but
the driver was probed successful. With kernel 4.19 errors out with
EBUSY.

Cc: linux-stable <stable@vger.kernel.org> # 4.19+
Signed-off-by: Mathias Kresin <dev@kresin.me>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/dwc2/core.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/usb/dwc2/core.c
+++ b/drivers/usb/dwc2/core.c
@@ -524,7 +524,7 @@ int dwc2_core_reset(struct dwc2_hsotg *h
 	greset |= GRSTCTL_CSFTRST;
 	dwc2_writel(hsotg, greset, GRSTCTL);
 
-	if (dwc2_hsotg_wait_bit_clear(hsotg, GRSTCTL, GRSTCTL_CSFTRST, 50)) {
+	if (dwc2_hsotg_wait_bit_clear(hsotg, GRSTCTL, GRSTCTL_CSFTRST, 10000)) {
 		dev_warn(hsotg->dev, "%s: HANG! Soft Reset timeout GRSTCTL GRSTCTL_CSFTRST\n",
 			 __func__);
 		return -EBUSY;



^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 099/135] staging: wilc1000: fix illegal memory access in wilc_parse_join_bss_param()
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (97 preceding siblings ...)
  2019-12-03 22:35 ` [PATCH 5.3 098/135] usb: dwc2: use a longer core rest timeout in dwc2_core_reset() Greg Kroah-Hartman
@ 2019-12-03 22:35 ` Greg Kroah-Hartman
  2019-12-03 22:35 ` [PATCH 5.3 100/135] staging: rtl8192e: fix potential use after free Greg Kroah-Hartman
                   ` (39 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:35 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, coverity-bot, Ajay Singh

From: Ajay Singh <ajay.kathat@microchip.com>

commit c7e621bb981b76d3bfd8a595070ee8282ac4a32b upstream.

Do not copy the extended supported rates in 'param->supp_rates' if the
array is already full with basic rates values. The array size check
helped to avoid possible illegal memory access [1] while copying to
'param->supp_rates' array.

1. https://marc.info/?l=linux-next&m=157301720517456&w=2

Reported-by: coverity-bot <keescook+coverity-bot@chromium.org>
Addresses-Coverity-ID: 1487400 ("Memory - illegal accesses")
Fixes: 4e0b0f42c9c7 ("staging: wilc1000: use struct to pack join parameters for FW")
Cc: stable@vger.kernel.org
Signed-off-by: Ajay Singh <ajay.kathat@microchip.com>
Link: https://lore.kernel.org/r/20191106062127.3165-1-ajay.kathat@microchip.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/staging/wilc1000/wilc_hif.c |   23 ++++++++++++++---------
 1 file changed, 14 insertions(+), 9 deletions(-)

--- a/drivers/staging/wilc1000/wilc_hif.c
+++ b/drivers/staging/wilc1000/wilc_hif.c
@@ -477,16 +477,21 @@ void *wilc_parse_join_bss_param(struct c
 		memcpy(&param->supp_rates[1], rates_ie + 2, rates_len);
 	}
 
-	supp_rates_ie = cfg80211_find_ie(WLAN_EID_EXT_SUPP_RATES, ies->data,
-					 ies->len);
-	if (supp_rates_ie) {
-		if (supp_rates_ie[1] > (WILC_MAX_RATES_SUPPORTED - rates_len))
-			param->supp_rates[0] = WILC_MAX_RATES_SUPPORTED;
-		else
-			param->supp_rates[0] += supp_rates_ie[1];
+	if (rates_len < WILC_MAX_RATES_SUPPORTED) {
+		supp_rates_ie = cfg80211_find_ie(WLAN_EID_EXT_SUPP_RATES,
+						 ies->data, ies->len);
+		if (supp_rates_ie) {
+			u8 ext_rates = supp_rates_ie[1];
 
-		memcpy(&param->supp_rates[rates_len + 1], supp_rates_ie + 2,
-		       (param->supp_rates[0] - rates_len));
+			if (ext_rates > (WILC_MAX_RATES_SUPPORTED - rates_len))
+				param->supp_rates[0] = WILC_MAX_RATES_SUPPORTED;
+			else
+				param->supp_rates[0] += ext_rates;
+
+			memcpy(&param->supp_rates[rates_len + 1],
+			       supp_rates_ie + 2,
+			       (param->supp_rates[0] - rates_len));
+		}
 	}
 
 	ht_ie = cfg80211_find_ie(WLAN_EID_HT_CAPABILITY, ies->data, ies->len);



^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 100/135] staging: rtl8192e: fix potential use after free
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (98 preceding siblings ...)
  2019-12-03 22:35 ` [PATCH 5.3 099/135] staging: wilc1000: fix illegal memory access in wilc_parse_join_bss_param() Greg Kroah-Hartman
@ 2019-12-03 22:35 ` Greg Kroah-Hartman
  2019-12-03 22:35 ` [PATCH 5.3 101/135] staging: rtl8723bs: Drop ACPI device ids Greg Kroah-Hartman
                   ` (38 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:35 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Pan Bian, Dan Carpenter

From: Pan Bian <bianpan2016@163.com>

commit b7aa39a2ed0112d07fc277ebd24a08a7b2368ab9 upstream.

The variable skb is released via kfree_skb() when the return value of
_rtl92e_tx is not zero. However, after that, skb is accessed again to
read its length, which may result in a use after free bug. This patch
fixes the bug by moving the release operation to where skb is never
used later.

Signed-off-by: Pan Bian <bianpan2016@163.com>
Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/1572965351-6745-1-git-send-email-bianpan2016@163.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/staging/rtl8192e/rtl8192e/rtl_core.c |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

--- a/drivers/staging/rtl8192e/rtl8192e/rtl_core.c
+++ b/drivers/staging/rtl8192e/rtl8192e/rtl_core.c
@@ -1616,14 +1616,15 @@ static void _rtl92e_hard_data_xmit(struc
 	memcpy((unsigned char *)(skb->cb), &dev, sizeof(dev));
 	skb_push(skb, priv->rtllib->tx_headroom);
 	ret = _rtl92e_tx(dev, skb);
-	if (ret != 0)
-		kfree_skb(skb);
 
 	if (queue_index != MGNT_QUEUE) {
 		priv->rtllib->stats.tx_bytes += (skb->len -
 						 priv->rtllib->tx_headroom);
 		priv->rtllib->stats.tx_packets++;
 	}
+
+	if (ret != 0)
+		kfree_skb(skb);
 }
 
 static int _rtl92e_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)



^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 101/135] staging: rtl8723bs: Drop ACPI device ids
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (99 preceding siblings ...)
  2019-12-03 22:35 ` [PATCH 5.3 100/135] staging: rtl8192e: fix potential use after free Greg Kroah-Hartman
@ 2019-12-03 22:35 ` Greg Kroah-Hartman
  2019-12-03 22:35 ` [PATCH 5.3 102/135] staging: rtl8723bs: Add 024c:0525 to the list of SDIO device-ids Greg Kroah-Hartman
                   ` (37 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:35 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Hans de Goede

From: Hans de Goede <hdegoede@redhat.com>

commit 2d9d2491530a156b9a5614adf9dc79285e35d55e upstream.

The driver only binds by SDIO device-ids, all the ACPI device-id does
is causing the driver to load unnecessarily on devices where the DSDT
contains a bogus OBDA8723 device.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20191111113846.24940-2-hdegoede@redhat.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/staging/rtl8723bs/os_dep/sdio_intf.c |    6 ------
 1 file changed, 6 deletions(-)

--- a/drivers/staging/rtl8723bs/os_dep/sdio_intf.c
+++ b/drivers/staging/rtl8723bs/os_dep/sdio_intf.c
@@ -23,13 +23,7 @@ static const struct sdio_device_id sdio_
 	{ SDIO_DEVICE(0x024c, 0xb723), },
 	{ /* end: all zeroes */				},
 };
-static const struct acpi_device_id acpi_ids[] = {
-	{"OBDA8723", 0x0000},
-	{}
-};
-
 MODULE_DEVICE_TABLE(sdio, sdio_ids);
-MODULE_DEVICE_TABLE(acpi, acpi_ids);
 
 static int rtw_drv_init(struct sdio_func *func, const struct sdio_device_id *id);
 static void rtw_dev_remove(struct sdio_func *func);



^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 102/135] staging: rtl8723bs: Add 024c:0525 to the list of SDIO device-ids
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (100 preceding siblings ...)
  2019-12-03 22:35 ` [PATCH 5.3 101/135] staging: rtl8723bs: Drop ACPI device ids Greg Kroah-Hartman
@ 2019-12-03 22:35 ` Greg Kroah-Hartman
  2019-12-03 22:35 ` [PATCH 5.3 103/135] USB: serial: ftdi_sio: add device IDs for U-Blox C099-F9P Greg Kroah-Hartman
                   ` (36 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:35 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Hans de Goede, youling257

From: Hans de Goede <hdegoede@redhat.com>

commit 3d5f1eedbfd22ceea94b39989d6021b1958181f4 upstream.

Add 024c:0525 to the list of SDIO device-ids, based on a patch found
in the Android X86 kernels. According to that patch this device id is
used on the Alcatel Plus 10 device.

Reported-and-tested-by: youling257 <youling257@gmail.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20191111113846.24940-1-hdegoede@redhat.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/staging/rtl8723bs/os_dep/sdio_intf.c |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/staging/rtl8723bs/os_dep/sdio_intf.c
+++ b/drivers/staging/rtl8723bs/os_dep/sdio_intf.c
@@ -18,6 +18,7 @@
 static const struct sdio_device_id sdio_ids[] =
 {
 	{ SDIO_DEVICE(0x024c, 0x0523), },
+	{ SDIO_DEVICE(0x024c, 0x0525), },
 	{ SDIO_DEVICE(0x024c, 0x0623), },
 	{ SDIO_DEVICE(0x024c, 0x0626), },
 	{ SDIO_DEVICE(0x024c, 0xb723), },



^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 103/135] USB: serial: ftdi_sio: add device IDs for U-Blox C099-F9P
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (101 preceding siblings ...)
  2019-12-03 22:35 ` [PATCH 5.3 102/135] staging: rtl8723bs: Add 024c:0525 to the list of SDIO device-ids Greg Kroah-Hartman
@ 2019-12-03 22:35 ` Greg Kroah-Hartman
  2019-12-03 22:35 ` [PATCH 5.3 104/135] mei: bus: prefix device names on bus with the bus name Greg Kroah-Hartman
                   ` (35 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:35 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Fabio DUrso, Johan Hovold

From: Fabio D'Urso <fabiodurso@hotmail.it>

commit c1a1f273d0825774c80896b8deb1c9ea1d0b91e3 upstream.

This device presents itself as a USB hub with three attached devices:
 - An ACM serial port connected to the GPS module (not affected by this
   commit)
 - An FTDI serial port connected to the GPS module (1546:0502)
 - Another FTDI serial port connected to the ODIN-W2 radio module
   (1546:0503)

This commit registers U-Blox's VID and the PIDs of the second and third
devices.

Datasheet: https://www.u-blox.com/sites/default/files/C099-F9P-AppBoard-Mbed-OS3-FW_UserGuide_%28UBX-18063024%29.pdf

Signed-off-by: Fabio D'Urso <fabiodurso@hotmail.it>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/serial/ftdi_sio.c     |    3 +++
 drivers/usb/serial/ftdi_sio_ids.h |    7 +++++++
 2 files changed, 10 insertions(+)

--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -1033,6 +1033,9 @@ static const struct usb_device_id id_tab
 	/* Sienna devices */
 	{ USB_DEVICE(FTDI_VID, FTDI_SIENNA_PID) },
 	{ USB_DEVICE(ECHELON_VID, ECHELON_U20_PID) },
+	/* U-Blox devices */
+	{ USB_DEVICE(UBLOX_VID, UBLOX_C099F9P_ZED_PID) },
+	{ USB_DEVICE(UBLOX_VID, UBLOX_C099F9P_ODIN_PID) },
 	{ }					/* Terminating entry */
 };
 
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -1558,3 +1558,10 @@
  */
 #define UNJO_VID			0x22B7
 #define UNJO_ISODEBUG_V1_PID		0x150D
+
+/*
+ * U-Blox products (http://www.u-blox.com).
+ */
+#define UBLOX_VID			0x1546
+#define UBLOX_C099F9P_ZED_PID		0x0502
+#define UBLOX_C099F9P_ODIN_PID		0x0503



^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 104/135] mei: bus: prefix device names on bus with the bus name
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (102 preceding siblings ...)
  2019-12-03 22:35 ` [PATCH 5.3 103/135] USB: serial: ftdi_sio: add device IDs for U-Blox C099-F9P Greg Kroah-Hartman
@ 2019-12-03 22:35 ` Greg Kroah-Hartman
  2019-12-03 22:35 ` [PATCH 5.3 105/135] mei: me: add comet point V device id Greg Kroah-Hartman
                   ` (34 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:35 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Alexander Usyskin, Tomas Winkler

From: Alexander Usyskin <alexander.usyskin@intel.com>

commit 7a2b9e6ec84588b0be65cc0ae45a65bac431496b upstream.

Add parent device name to the name of devices on bus to avoid
device names collisions for same client UUID available
from different MEI heads. Namely this prevents sysfs collision under
/sys/bus/mei/device/

In the device part leave just UUID other parameters that are
required for device matching are not required here and are
just bloating the name.

Cc: <stable@vger.kernel.org>
Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Link: https://lore.kernel.org/r/20191105150514.14010-1-tomas.winkler@intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/misc/mei/bus.c |    9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

--- a/drivers/misc/mei/bus.c
+++ b/drivers/misc/mei/bus.c
@@ -873,15 +873,16 @@ static const struct device_type mei_cl_d
 
 /**
  * mei_cl_bus_set_name - set device name for me client device
+ *  <controller>-<client device>
+ *  Example: 0000:00:16.0-55213584-9a29-4916-badf-0fb7ed682aeb
  *
  * @cldev: me client device
  */
 static inline void mei_cl_bus_set_name(struct mei_cl_device *cldev)
 {
-	dev_set_name(&cldev->dev, "mei:%s:%pUl:%02X",
-		     cldev->name,
-		     mei_me_cl_uuid(cldev->me_cl),
-		     mei_me_cl_ver(cldev->me_cl));
+	dev_set_name(&cldev->dev, "%s-%pUl",
+		     dev_name(cldev->bus->dev),
+		     mei_me_cl_uuid(cldev->me_cl));
 }
 
 /**



^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 105/135] mei: me: add comet point V device id
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (103 preceding siblings ...)
  2019-12-03 22:35 ` [PATCH 5.3 104/135] mei: bus: prefix device names on bus with the bus name Greg Kroah-Hartman
@ 2019-12-03 22:35 ` Greg Kroah-Hartman
  2019-12-03 22:35 ` [PATCH 5.3 106/135] thunderbolt: Power cycle the router if NVM authentication fails Greg Kroah-Hartman
                   ` (33 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:35 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Alexander Usyskin, Tomas Winkler

From: Alexander Usyskin <alexander.usyskin@intel.com>

commit 82b29b9f72afdccb40ea5f3c13c6a3cb65a597bc upstream.

Comet Point (Comet Lake) V device id.

Cc: <stable@vger.kernel.org>
Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Link: https://lore.kernel.org/r/20191105150514.14010-2-tomas.winkler@intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/misc/mei/hw-me-regs.h |    1 +
 drivers/misc/mei/pci-me.c     |    1 +
 2 files changed, 2 insertions(+)

--- a/drivers/misc/mei/hw-me-regs.h
+++ b/drivers/misc/mei/hw-me-regs.h
@@ -81,6 +81,7 @@
 
 #define MEI_DEV_ID_CMP_LP     0x02e0  /* Comet Point LP */
 #define MEI_DEV_ID_CMP_LP_3   0x02e4  /* Comet Point LP 3 (iTouch) */
+#define MEI_DEV_ID_CMP_V      0xA3BA  /* Comet Point Lake V */
 
 #define MEI_DEV_ID_ICP_LP     0x34E0  /* Ice Lake Point LP */
 
--- a/drivers/misc/mei/pci-me.c
+++ b/drivers/misc/mei/pci-me.c
@@ -98,6 +98,7 @@ static const struct pci_device_id mei_me
 
 	{MEI_PCI_DEVICE(MEI_DEV_ID_CMP_LP, MEI_ME_PCH12_CFG)},
 	{MEI_PCI_DEVICE(MEI_DEV_ID_CMP_LP_3, MEI_ME_PCH8_CFG)},
+	{MEI_PCI_DEVICE(MEI_DEV_ID_CMP_V, MEI_ME_PCH12_CFG)},
 
 	{MEI_PCI_DEVICE(MEI_DEV_ID_ICP_LP, MEI_ME_PCH12_CFG)},
 



^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 106/135] thunderbolt: Power cycle the router if NVM authentication fails
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (104 preceding siblings ...)
  2019-12-03 22:35 ` [PATCH 5.3 105/135] mei: me: add comet point V device id Greg Kroah-Hartman
@ 2019-12-03 22:35 ` Greg Kroah-Hartman
  2019-12-03 22:35 ` [PATCH 5.3 107/135] xfrm: Fix memleak on xfrm state destroy Greg Kroah-Hartman
                   ` (32 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:35 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, zang, Mika Westerberg

From: Mika Westerberg <mika.westerberg@linux.intel.com>

commit 7a7ebfa85f4fac349f3ab219538c44efe18b0cf6 upstream.

On zang's Dell XPS 13 9370 after Thunderbolt NVM firmware upgrade the
Thunderbolt controller did not come back as expected. Only after the
system was rebooted it became available again. It is not entirely clear
what happened but I suspect the new NVM firmware image authentication
failed for some reason. Regardless of this the router needs to be power
cycled if NVM authentication fails in order to get it fully functional
again.

This modifies the driver to issue a power cycle in case the NVM
authentication fails immediately when dma_port_flash_update_auth()
returns. We also need to call tb_switch_set_uuid() earlier to be able to
fetch possible NVM authentication failure when DMA port is added.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=205457
Reported-by: zang <dump@tzib.net>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/thunderbolt/switch.c |   54 +++++++++++++++++++++++++++++++++----------
 1 file changed, 42 insertions(+), 12 deletions(-)

--- a/drivers/thunderbolt/switch.c
+++ b/drivers/thunderbolt/switch.c
@@ -168,7 +168,7 @@ static int nvm_validate_and_write(struct
 
 static int nvm_authenticate_host(struct tb_switch *sw)
 {
-	int ret;
+	int ret = 0;
 
 	/*
 	 * Root switch NVM upgrade requires that we disconnect the
@@ -176,6 +176,8 @@ static int nvm_authenticate_host(struct
 	 * already).
 	 */
 	if (!sw->safe_mode) {
+		u32 status;
+
 		ret = tb_domain_disconnect_all_paths(sw->tb);
 		if (ret)
 			return ret;
@@ -184,7 +186,16 @@ static int nvm_authenticate_host(struct
 		 * everything goes well so getting timeout is expected.
 		 */
 		ret = dma_port_flash_update_auth(sw->dma_port);
-		return ret == -ETIMEDOUT ? 0 : ret;
+		if (!ret || ret == -ETIMEDOUT)
+			return 0;
+
+		/*
+		 * Any error from update auth operation requires power
+		 * cycling of the host router.
+		 */
+		tb_sw_warn(sw, "failed to authenticate NVM, power cycling\n");
+		if (dma_port_flash_update_auth_status(sw->dma_port, &status) > 0)
+			nvm_set_auth_status(sw, status);
 	}
 
 	/*
@@ -192,7 +203,7 @@ static int nvm_authenticate_host(struct
 	 * switch.
 	 */
 	dma_port_power_cycle(sw->dma_port);
-	return 0;
+	return ret;
 }
 
 static int nvm_authenticate_device(struct tb_switch *sw)
@@ -200,8 +211,16 @@ static int nvm_authenticate_device(struc
 	int ret, retries = 10;
 
 	ret = dma_port_flash_update_auth(sw->dma_port);
-	if (ret && ret != -ETIMEDOUT)
+	switch (ret) {
+	case 0:
+	case -ETIMEDOUT:
+	case -EACCES:
+	case -EINVAL:
+		/* Power cycle is required */
+		break;
+	default:
 		return ret;
+	}
 
 	/*
 	 * Poll here for the authentication status. It takes some time
@@ -1237,8 +1256,6 @@ static ssize_t nvm_authenticate_store(st
 			 */
 			nvm_authenticate_start(sw);
 			ret = nvm_authenticate_host(sw);
-			if (ret)
-				nvm_authenticate_complete(sw);
 		} else {
 			ret = nvm_authenticate_device(sw);
 		}
@@ -1664,13 +1681,16 @@ static int tb_switch_add_dma_port(struct
 	int ret;
 
 	switch (sw->generation) {
-	case 3:
-		break;
-
 	case 2:
 		/* Only root switch can be upgraded */
 		if (tb_route(sw))
 			return 0;
+
+		/* fallthrough */
+	case 3:
+		ret = tb_switch_set_uuid(sw);
+		if (ret)
+			return ret;
 		break;
 
 	default:
@@ -1691,6 +1711,19 @@ static int tb_switch_add_dma_port(struct
 		return 0;
 
 	/*
+	 * If there is status already set then authentication failed
+	 * when the dma_port_flash_update_auth() returned. Power cycling
+	 * is not needed (it was done already) so only thing we do here
+	 * is to unblock runtime PM of the root port.
+	 */
+	nvm_get_auth_status(sw, &status);
+	if (status) {
+		if (!tb_route(sw))
+			nvm_authenticate_complete(sw);
+		return 0;
+	}
+
+	/*
 	 * Check status of the previous flash authentication. If there
 	 * is one we need to power cycle the switch in any case to make
 	 * it functional again.
@@ -1705,9 +1738,6 @@ static int tb_switch_add_dma_port(struct
 
 	if (status) {
 		tb_sw_info(sw, "switch flash authentication failed\n");
-		ret = tb_switch_set_uuid(sw);
-		if (ret)
-			return ret;
 		nvm_set_auth_status(sw, status);
 	}
 



^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 107/135] xfrm: Fix memleak on xfrm state destroy
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (105 preceding siblings ...)
  2019-12-03 22:35 ` [PATCH 5.3 106/135] thunderbolt: Power cycle the router if NVM authentication fails Greg Kroah-Hartman
@ 2019-12-03 22:35 ` Greg Kroah-Hartman
  2019-12-03 22:35 ` [PATCH 5.3 108/135] x86/fpu: Dont cache access to fpu_fpregs_owner_ctx Greg Kroah-Hartman
                   ` (31 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:35 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, JD, Paul Wouters, Steffen Klassert

From: Steffen Klassert <steffen.klassert@secunet.com>

commit 86c6739eda7d2a03f2db30cbee67a5fb81afa8ba upstream.

We leak the page that we use to create skb page fragments
when destroying the xfrm_state. Fix this by dropping a
page reference if a page was assigned to the xfrm_state.

Fixes: cac2661c53f3 ("esp4: Avoid skb_cow_data whenever possible")
Reported-by: JD <jdtxs00@gmail.com>
Reported-by: Paul Wouters <paul@nohats.ca>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/xfrm/xfrm_state.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -495,6 +495,8 @@ static void ___xfrm_state_destroy(struct
 		x->type->destructor(x);
 		xfrm_put_type(x->type);
 	}
+	if (x->xfrag.page)
+		put_page(x->xfrag.page);
 	xfrm_dev_state_free(x);
 	security_xfrm_state_free(x);
 	xfrm_state_free(x);



^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 108/135] x86/fpu: Dont cache access to fpu_fpregs_owner_ctx
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (106 preceding siblings ...)
  2019-12-03 22:35 ` [PATCH 5.3 107/135] xfrm: Fix memleak on xfrm state destroy Greg Kroah-Hartman
@ 2019-12-03 22:35 ` Greg Kroah-Hartman
  2019-12-03 22:35 ` [PATCH 5.3 109/135] gve: Fix the queue page list allocated pages count Greg Kroah-Hartman
                   ` (30 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:35 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sebastian Andrzej Siewior,
	Borislav Petkov, Rik van Riel, Aubrey Li, Austin Clements,
	Barret Rhoden, Dave Hansen, David Chase, H. Peter Anvin, ian,
	Ingo Molnar, Josh Bleecher Snyder, Thomas Gleixner, x86-ml

From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>

commit 59c4bd853abcea95eccc167a7d7fd5f1a5f47b98 upstream.

The state/owner of the FPU is saved to fpu_fpregs_owner_ctx by pointing
to the context that is currently loaded. It never changed during the
lifetime of a task - it remained stable/constant.

After deferred FPU registers loading until return to userland was
implemented, the content of fpu_fpregs_owner_ctx may change during
preemption and must not be cached.

This went unnoticed for some time and was now noticed, in particular
since gcc 9 is caching that load in copy_fpstate_to_sigframe() and
reusing it in the retry loop:

  copy_fpstate_to_sigframe()
    load fpu_fpregs_owner_ctx and save on stack
    fpregs_lock()
    copy_fpregs_to_sigframe() /* failed */
    fpregs_unlock()
         *** PREEMPTION, another uses FPU, changes fpu_fpregs_owner_ctx ***

    fault_in_pages_writeable() /* succeed, retry */

    fpregs_lock()
	__fpregs_load_activate()
	  fpregs_state_valid() /* uses fpu_fpregs_owner_ctx from stack */
    copy_fpregs_to_sigframe() /* succeeds, random FPU content */

This is a comparison of the assembly produced by gcc 9, without vs with this
patch:

| # arch/x86/kernel/fpu/signal.c:173:      if (!access_ok(buf, size))
|        cmpq    %rdx, %rax      # tmp183, _4
|        jb      .L190   #,
|-# arch/x86/include/asm/fpu/internal.h:512:       return fpu == this_cpu_read_stable(fpu_fpregs_owner_ctx) && cpu == fpu->last_cpu;
|-#APP
|-# 512 "arch/x86/include/asm/fpu/internal.h" 1
|-       movq %gs:fpu_fpregs_owner_ctx,%rax      #, pfo_ret__
|-# 0 "" 2
|-#NO_APP
|-       movq    %rax, -88(%rbp) # pfo_ret__, %sfp
…
|-# arch/x86/include/asm/fpu/internal.h:512:       return fpu == this_cpu_read_stable(fpu_fpregs_owner_ctx) && cpu == fpu->last_cpu;
|-       movq    -88(%rbp), %rcx # %sfp, pfo_ret__
|-       cmpq    %rcx, -64(%rbp) # pfo_ret__, %sfp
|+# arch/x86/include/asm/fpu/internal.h:512:       return fpu == this_cpu_read(fpu_fpregs_owner_ctx) && cpu == fpu->last_cpu;
|+#APP
|+# 512 "arch/x86/include/asm/fpu/internal.h" 1
|+       movq %gs:fpu_fpregs_owner_ctx(%rip),%rax        # fpu_fpregs_owner_ctx, pfo_ret__
|+# 0 "" 2
|+# arch/x86/include/asm/fpu/internal.h:512:       return fpu == this_cpu_read(fpu_fpregs_owner_ctx) && cpu == fpu->last_cpu;
|+#NO_APP
|+       cmpq    %rax, -64(%rbp) # pfo_ret__, %sfp

Use this_cpu_read() instead this_cpu_read_stable() to avoid caching of
fpu_fpregs_owner_ctx during preemption points.

The Fixes: tag points to the commit where deferred FPU loading was
added. Since this commit, the compiler is no longer allowed to move the
load of fpu_fpregs_owner_ctx somewhere else / outside of the locked
section. A task preemption will change its value and stale content will
be observed.

 [ bp: Massage. ]

Debugged-by: Austin Clements <austin@google.com>
Debugged-by: David Chase <drchase@golang.org>
Debugged-by: Ian Lance Taylor <ian@airs.com>
Fixes: 5f409e20b7945 ("x86/fpu: Defer FPU state load until return to userspace")
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Borislav Petkov <bp@suse.de>
Reviewed-by: Rik van Riel <riel@surriel.com>
Tested-by: Borislav Petkov <bp@suse.de>
Cc: Aubrey Li <aubrey.li@intel.com>
Cc: Austin Clements <austin@google.com>
Cc: Barret Rhoden <brho@google.com>
Cc: Dave Hansen <dave.hansen@intel.com>
Cc: David Chase <drchase@golang.org>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: ian@airs.com
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Josh Bleecher Snyder <josharian@gmail.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: x86-ml <x86@kernel.org>
Link: https://lkml.kernel.org/r/20191128085306.hxfa2o3knqtu4wfn@linutronix.de
Link: https://bugzilla.kernel.org/show_bug.cgi?id=205663
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/x86/include/asm/fpu/internal.h |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/x86/include/asm/fpu/internal.h
+++ b/arch/x86/include/asm/fpu/internal.h
@@ -509,7 +509,7 @@ static inline void __fpu_invalidate_fpre
 
 static inline int fpregs_state_valid(struct fpu *fpu, unsigned int cpu)
 {
-	return fpu == this_cpu_read_stable(fpu_fpregs_owner_ctx) && cpu == fpu->last_cpu;
+	return fpu == this_cpu_read(fpu_fpregs_owner_ctx) && cpu == fpu->last_cpu;
 }
 
 /*



^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 109/135] gve: Fix the queue page list allocated pages count
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (107 preceding siblings ...)
  2019-12-03 22:35 ` [PATCH 5.3 108/135] x86/fpu: Dont cache access to fpu_fpregs_owner_ctx Greg Kroah-Hartman
@ 2019-12-03 22:35 ` Greg Kroah-Hartman
  2019-12-03 22:35 ` [PATCH 5.3 110/135] macvlan: schedule bc_work even if error Greg Kroah-Hartman
                   ` (29 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:35 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jeroen de Borst, Catherine Sullivan,
	David S. Miller

From: Jeroen de Borst <jeroendb@google.com>

[ Upstream commit a95069ecb7092d03b2ea1c39ee04514fe9627540 ]

In gve_alloc_queue_page_list(), when a page allocation fails,
qpl->num_entries will be wrong.  In this case priv->num_registered_pages
can underflow in gve_free_queue_page_list(), causing subsequent calls
to gve_alloc_queue_page_list() to fail.

Fixes: f5cedc84a30d ("gve: Add transmit and receive support")
Signed-off-by: Jeroen de Borst <jeroendb@google.com>
Reviewed-by: Catherine Sullivan <csully@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/google/gve/gve_main.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/net/ethernet/google/gve/gve_main.c
+++ b/drivers/net/ethernet/google/gve/gve_main.c
@@ -544,7 +544,7 @@ static int gve_alloc_queue_page_list(str
 	}
 
 	qpl->id = id;
-	qpl->num_entries = pages;
+	qpl->num_entries = 0;
 	qpl->pages = kvzalloc(pages * sizeof(*qpl->pages), GFP_KERNEL);
 	/* caller handles clean up */
 	if (!qpl->pages)
@@ -562,6 +562,7 @@ static int gve_alloc_queue_page_list(str
 		/* caller handles clean up */
 		if (err)
 			return -ENOMEM;
+		qpl->num_entries++;
 	}
 	priv->num_registered_pages += pages;
 



^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 110/135] macvlan: schedule bc_work even if error
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (108 preceding siblings ...)
  2019-12-03 22:35 ` [PATCH 5.3 109/135] gve: Fix the queue page list allocated pages count Greg Kroah-Hartman
@ 2019-12-03 22:35 ` Greg Kroah-Hartman
  2019-12-03 22:35 ` [PATCH 5.3 111/135] mdio_bus: dont use managed reset-controller Greg Kroah-Hartman
                   ` (28 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:35 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Menglong Dong, David S. Miller

From: Menglong Dong <dong.menglong@zte.com.cn>

[ Upstream commit 1d7ea55668878bb350979c377fc72509dd6f5b21 ]

While enqueueing a broadcast skb to port->bc_queue, schedule_work()
is called to add port->bc_work, which processes the skbs in
bc_queue, to "events" work queue. If port->bc_queue is full, the
skb will be discarded and schedule_work(&port->bc_work) won't be
called. However, if port->bc_queue is full and port->bc_work is not
running or pending, port->bc_queue will keep full and schedule_work()
won't be called any more, and all broadcast skbs to macvlan will be
discarded. This case can happen:

macvlan_process_broadcast() is the pending function of port->bc_work,
it moves all the skbs in port->bc_queue to the queue "list", and
processes the skbs in "list". During this, new skbs will keep being
added to port->bc_queue in macvlan_broadcast_enqueue(), and
port->bc_queue may already full when macvlan_process_broadcast()
return. This may happen, especially when there are a lot of real-time
threads and the process is preempted.

Fix this by calling schedule_work(&port->bc_work) even if
port->bc_work is full in macvlan_broadcast_enqueue().

Fixes: 412ca1550cbe ("macvlan: Move broadcasts into a work queue")
Signed-off-by: Menglong Dong <dong.menglong@zte.com.cn>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/macvlan.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
@@ -359,10 +359,11 @@ static void macvlan_broadcast_enqueue(st
 	}
 	spin_unlock(&port->bc_queue.lock);
 
+	schedule_work(&port->bc_work);
+
 	if (err)
 		goto free_nskb;
 
-	schedule_work(&port->bc_work);
 	return;
 
 free_nskb:



^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 111/135] mdio_bus: dont use managed reset-controller
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (109 preceding siblings ...)
  2019-12-03 22:35 ` [PATCH 5.3 110/135] macvlan: schedule bc_work even if error Greg Kroah-Hartman
@ 2019-12-03 22:35 ` Greg Kroah-Hartman
  2019-12-03 22:35 ` [PATCH 5.3 112/135] net: dsa: sja1105: fix sja1105_parse_rgmii_delays() Greg Kroah-Hartman
                   ` (27 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:35 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Geert Uytterhoeven, Andrew Lunn,
	David Bauer, David S. Miller

From: David Bauer <mail@david-bauer.net>

[ Upstream commit 32085f25d7b68404055f3525c780142fc72e543f ]

Geert Uytterhoeven reported that using devm_reset_controller_get leads
to a WARNING when probing a reset-controlled PHY. This is because the
device devm_reset_controller_get gets supplied is not actually the
one being probed.

Acquire an unmanaged reset-control as well as free the reset_control on
unregister to fix this.

Reported-by: Geert Uytterhoeven <geert@linux-m68k.org>
CC: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: David Bauer <mail@david-bauer.net>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/phy/mdio_bus.c |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

--- a/drivers/net/phy/mdio_bus.c
+++ b/drivers/net/phy/mdio_bus.c
@@ -66,8 +66,8 @@ static int mdiobus_register_reset(struct
 	struct reset_control *reset = NULL;
 
 	if (mdiodev->dev.of_node)
-		reset = devm_reset_control_get_exclusive(&mdiodev->dev,
-							 "phy");
+		reset = of_reset_control_get_exclusive(mdiodev->dev.of_node,
+						       "phy");
 	if (IS_ERR(reset)) {
 		if (PTR_ERR(reset) == -ENOENT || PTR_ERR(reset) == -ENOTSUPP)
 			reset = NULL;
@@ -111,6 +111,8 @@ int mdiobus_unregister_device(struct mdi
 	if (mdiodev->bus->mdio_map[mdiodev->addr] != mdiodev)
 		return -EINVAL;
 
+	reset_control_put(mdiodev->reset_ctrl);
+
 	mdiodev->bus->mdio_map[mdiodev->addr] = NULL;
 
 	return 0;



^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 112/135] net: dsa: sja1105: fix sja1105_parse_rgmii_delays()
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (110 preceding siblings ...)
  2019-12-03 22:35 ` [PATCH 5.3 111/135] mdio_bus: dont use managed reset-controller Greg Kroah-Hartman
@ 2019-12-03 22:35 ` Greg Kroah-Hartman
  2019-12-03 22:35 ` [PATCH 5.3 113/135] net: macb: add missed tasklet_kill Greg Kroah-Hartman
                   ` (26 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:35 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Oleksij Rempel, Vladimir Oltean,
	David S. Miller

From: Oleksij Rempel <o.rempel@pengutronix.de>

[ Upstream commit 9bca3a0a923fc3f0fb9e41391be1d0f291e86858 ]

This function was using configuration of port 0 in devicetree for all ports.
In case CPU port was not 0, the delay settings was ignored. This resulted not
working communication between CPU and the switch.

Fixes: f5b8631c293b ("net: dsa: sja1105: Error out if RGMII delays are requested in DT")
Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
Reviewed-by: Vladimir Oltean <olteanv@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/dsa/sja1105/sja1105_main.c |   10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

--- a/drivers/net/dsa/sja1105/sja1105_main.c
+++ b/drivers/net/dsa/sja1105/sja1105_main.c
@@ -591,15 +591,15 @@ static int sja1105_parse_rgmii_delays(st
 	int i;
 
 	for (i = 0; i < SJA1105_NUM_PORTS; i++) {
-		if (ports->role == XMII_MAC)
+		if (ports[i].role == XMII_MAC)
 			continue;
 
-		if (ports->phy_mode == PHY_INTERFACE_MODE_RGMII_RXID ||
-		    ports->phy_mode == PHY_INTERFACE_MODE_RGMII_ID)
+		if (ports[i].phy_mode == PHY_INTERFACE_MODE_RGMII_RXID ||
+		    ports[i].phy_mode == PHY_INTERFACE_MODE_RGMII_ID)
 			priv->rgmii_rx_delay[i] = true;
 
-		if (ports->phy_mode == PHY_INTERFACE_MODE_RGMII_TXID ||
-		    ports->phy_mode == PHY_INTERFACE_MODE_RGMII_ID)
+		if (ports[i].phy_mode == PHY_INTERFACE_MODE_RGMII_TXID ||
+		    ports[i].phy_mode == PHY_INTERFACE_MODE_RGMII_ID)
 			priv->rgmii_tx_delay[i] = true;
 
 		if ((priv->rgmii_rx_delay[i] || priv->rgmii_tx_delay[i]) &&



^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 113/135] net: macb: add missed tasklet_kill
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (111 preceding siblings ...)
  2019-12-03 22:35 ` [PATCH 5.3 112/135] net: dsa: sja1105: fix sja1105_parse_rgmii_delays() Greg Kroah-Hartman
@ 2019-12-03 22:35 ` Greg Kroah-Hartman
  2019-12-03 22:35 ` [PATCH 5.3 114/135] net: psample: fix skb_over_panic Greg Kroah-Hartman
                   ` (25 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:35 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Chuhong Yuan, David S. Miller

From: Chuhong Yuan <hslester96@gmail.com>

[ Upstream commit 61183b056b49e2937ff92a1424291ba36a6f6d05 ]

This driver forgets to kill tasklet in remove.
Add the call to fix it.

Fixes: 032dc41ba6e2 ("net: macb: Handle HRESP error")
Signed-off-by: Chuhong Yuan <hslester96@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/cadence/macb_main.c |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/net/ethernet/cadence/macb_main.c
+++ b/drivers/net/ethernet/cadence/macb_main.c
@@ -4393,6 +4393,7 @@ static int macb_remove(struct platform_d
 		mdiobus_free(bp->mii_bus);
 
 		unregister_netdev(dev);
+		tasklet_kill(&bp->hresp_err_tasklet);
 		pm_runtime_disable(&pdev->dev);
 		pm_runtime_dont_use_autosuspend(&pdev->dev);
 		if (!pm_runtime_suspended(&pdev->dev)) {



^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 114/135] net: psample: fix skb_over_panic
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (112 preceding siblings ...)
  2019-12-03 22:35 ` [PATCH 5.3 113/135] net: macb: add missed tasklet_kill Greg Kroah-Hartman
@ 2019-12-03 22:35 ` Greg Kroah-Hartman
  2019-12-03 22:35 ` [PATCH 5.3 115/135] net: sched: fix `tc -s class show` no bstats on class with nolock subqueues Greg Kroah-Hartman
                   ` (24 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:35 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yotam Gigi, Jiri Pirko,
	Jamal Hadi Salim, Simon Horman, Roopa Prabhu,
	Nikolay Aleksandrov, David S. Miller

From: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>

[ Upstream commit 7eb9d7675c08937cd11d32b0b40442d4d731c5ee ]

We need to calculate the skb size correctly otherwise we risk triggering
skb_over_panic[1]. The issue is that data_len is added to the skb in a
nl attribute, but we don't account for its header size (nlattr 4 bytes)
and alignment. We account for it when calculating the total size in
the > PSAMPLE_MAX_PACKET_SIZE comparison correctly, but not when
allocating after that. The fix is simple - use nla_total_size() for
data_len when allocating.

To reproduce:
 $ tc qdisc add dev eth1 clsact
 $ tc filter add dev eth1 egress matchall action sample rate 1 group 1 trunc 129
 $ mausezahn eth1 -b bcast -a rand -c 1 -p 129
 < skb_over_panic BUG(), tail is 4 bytes past skb->end >

[1] Trace:
 [   50.459526][ T3480] skbuff: skb_over_panic: text:(____ptrval____) len:196 put:136 head:(____ptrval____) data:(____ptrval____) tail:0xc4 end:0xc0 dev:<NULL>
 [   50.474339][ T3480] ------------[ cut here ]------------
 [   50.481132][ T3480] kernel BUG at net/core/skbuff.c:108!
 [   50.486059][ T3480] invalid opcode: 0000 [#1] PREEMPT SMP
 [   50.489463][ T3480] CPU: 3 PID: 3480 Comm: mausezahn Not tainted 5.4.0-rc7 #108
 [   50.492844][ T3480] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-2.fc30 04/01/2014
 [   50.496551][ T3480] RIP: 0010:skb_panic+0x79/0x7b
 [   50.498261][ T3480] Code: bc 00 00 00 41 57 4c 89 e6 48 c7 c7 90 29 9a 83 4c 8b 8b c0 00 00 00 50 8b 83 b8 00 00 00 50 ff b3 c8 00 00 00 e8 ae ef c0 fe <0f> 0b e8 2f df c8 fe 48 8b 55 08 44 89 f6 4c 89 e7 48 c7 c1 a0 22
 [   50.504111][ T3480] RSP: 0018:ffffc90000447a10 EFLAGS: 00010282
 [   50.505835][ T3480] RAX: 0000000000000087 RBX: ffff888039317d00 RCX: 0000000000000000
 [   50.507900][ T3480] RDX: 0000000000000000 RSI: ffffffff812716e1 RDI: 00000000ffffffff
 [   50.509820][ T3480] RBP: ffffc90000447a60 R08: 0000000000000001 R09: 0000000000000000
 [   50.511735][ T3480] R10: ffffffff81d4f940 R11: 0000000000000000 R12: ffffffff834a22b0
 [   50.513494][ T3480] R13: ffffffff82c10433 R14: 0000000000000088 R15: ffffffff838a8084
 [   50.515222][ T3480] FS:  00007f3536462700(0000) GS:ffff88803eac0000(0000) knlGS:0000000000000000
 [   50.517135][ T3480] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
 [   50.518583][ T3480] CR2: 0000000000442008 CR3: 000000003b222000 CR4: 00000000000006e0
 [   50.520723][ T3480] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
 [   50.522709][ T3480] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
 [   50.524450][ T3480] Call Trace:
 [   50.525214][ T3480]  skb_put.cold+0x1b/0x1b
 [   50.526171][ T3480]  psample_sample_packet+0x1d3/0x340
 [   50.527307][ T3480]  tcf_sample_act+0x178/0x250
 [   50.528339][ T3480]  tcf_action_exec+0xb1/0x190
 [   50.529354][ T3480]  mall_classify+0x67/0x90
 [   50.530332][ T3480]  tcf_classify+0x72/0x160
 [   50.531286][ T3480]  __dev_queue_xmit+0x3db/0xd50
 [   50.532327][ T3480]  dev_queue_xmit+0x18/0x20
 [   50.533299][ T3480]  packet_sendmsg+0xee7/0x2090
 [   50.534331][ T3480]  sock_sendmsg+0x54/0x70
 [   50.535271][ T3480]  __sys_sendto+0x148/0x1f0
 [   50.536252][ T3480]  ? tomoyo_file_ioctl+0x23/0x30
 [   50.537334][ T3480]  ? ksys_ioctl+0x5e/0xb0
 [   50.540068][ T3480]  __x64_sys_sendto+0x2a/0x30
 [   50.542810][ T3480]  do_syscall_64+0x73/0x1f0
 [   50.545383][ T3480]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
 [   50.548477][ T3480] RIP: 0033:0x7f35357d6fb3
 [   50.551020][ T3480] Code: 48 8b 0d 18 90 20 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 83 3d f9 d3 20 00 00 75 13 49 89 ca b8 2c 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 34 c3 48 83 ec 08 e8 eb f6 ff ff 48 89 04 24
 [   50.558547][ T3480] RSP: 002b:00007ffe0c7212c8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
 [   50.561870][ T3480] RAX: ffffffffffffffda RBX: 0000000001dac010 RCX: 00007f35357d6fb3
 [   50.565142][ T3480] RDX: 0000000000000082 RSI: 0000000001dac2a2 RDI: 0000000000000003
 [   50.568469][ T3480] RBP: 00007ffe0c7212f0 R08: 00007ffe0c7212d0 R09: 0000000000000014
 [   50.571731][ T3480] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000082
 [   50.574961][ T3480] R13: 0000000001dac2a2 R14: 0000000000000001 R15: 0000000000000003
 [   50.578170][ T3480] Modules linked in: sch_ingress virtio_net
 [   50.580976][ T3480] ---[ end trace 61a515626a595af6 ]---

CC: Yotam Gigi <yotamg@mellanox.com>
CC: Jiri Pirko <jiri@mellanox.com>
CC: Jamal Hadi Salim <jhs@mojatatu.com>
CC: Simon Horman <simon.horman@netronome.com>
CC: Roopa Prabhu <roopa@cumulusnetworks.com>
Fixes: 6ae0a6286171 ("net: Introduce psample, a new genetlink channel for packet sampling")
Signed-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/psample/psample.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/net/psample/psample.c
+++ b/net/psample/psample.c
@@ -221,7 +221,7 @@ void psample_sample_packet(struct psampl
 		data_len = PSAMPLE_MAX_PACKET_SIZE - meta_len - NLA_HDRLEN
 			    - NLA_ALIGNTO;
 
-	nl_skb = genlmsg_new(meta_len + data_len, GFP_ATOMIC);
+	nl_skb = genlmsg_new(meta_len + nla_total_size(data_len), GFP_ATOMIC);
 	if (unlikely(!nl_skb))
 		return;
 



^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 115/135] net: sched: fix `tc -s class show` no bstats on class with nolock subqueues
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (113 preceding siblings ...)
  2019-12-03 22:35 ` [PATCH 5.3 114/135] net: psample: fix skb_over_panic Greg Kroah-Hartman
@ 2019-12-03 22:35 ` Greg Kroah-Hartman
  2019-12-03 22:35 ` [PATCH 5.3 116/135] openvswitch: fix flow command message size Greg Kroah-Hartman
                   ` (23 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:35 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dust Li, Tony Lu, Cong Wang, David S. Miller

From: Dust Li <dust.li@linux.alibaba.com>

[ Upstream commit 14e54ab9143fa60794d13ea0a66c792a2046a8f3 ]

When a classful qdisc's child qdisc has set the flag
TCQ_F_CPUSTATS (pfifo_fast for example), the child qdisc's
cpu_bstats should be passed to gnet_stats_copy_basic(),
but many classful qdisc didn't do that. As a result,
`tc -s class show dev DEV` always return 0 for bytes and
packets in this case.

Pass the child qdisc's cpu_bstats to gnet_stats_copy_basic()
to fix this issue.

The qstats also has this problem, but it has been fixed
in 5dd431b6b9 ("net: sched: introduce and use qstats read...")
and bstats still remains buggy.

Fixes: 22e0f8b9322c ("net: sched: make bstats per cpu and estimator RCU safe")
Signed-off-by: Dust Li <dust.li@linux.alibaba.com>
Signed-off-by: Tony Lu <tonylu@linux.alibaba.com>
Acked-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/sched/sch_mq.c     |    3 ++-
 net/sched/sch_mqprio.c |    4 ++--
 net/sched/sch_multiq.c |    2 +-
 net/sched/sch_prio.c   |    2 +-
 4 files changed, 6 insertions(+), 5 deletions(-)

--- a/net/sched/sch_mq.c
+++ b/net/sched/sch_mq.c
@@ -245,7 +245,8 @@ static int mq_dump_class_stats(struct Qd
 	struct netdev_queue *dev_queue = mq_queue_get(sch, cl);
 
 	sch = dev_queue->qdisc_sleeping;
-	if (gnet_stats_copy_basic(&sch->running, d, NULL, &sch->bstats) < 0 ||
+	if (gnet_stats_copy_basic(&sch->running, d, sch->cpu_bstats,
+				  &sch->bstats) < 0 ||
 	    qdisc_qstats_copy(d, sch) < 0)
 		return -1;
 	return 0;
--- a/net/sched/sch_mqprio.c
+++ b/net/sched/sch_mqprio.c
@@ -557,8 +557,8 @@ static int mqprio_dump_class_stats(struc
 		struct netdev_queue *dev_queue = mqprio_queue_get(sch, cl);
 
 		sch = dev_queue->qdisc_sleeping;
-		if (gnet_stats_copy_basic(qdisc_root_sleeping_running(sch),
-					  d, NULL, &sch->bstats) < 0 ||
+		if (gnet_stats_copy_basic(qdisc_root_sleeping_running(sch), d,
+					  sch->cpu_bstats, &sch->bstats) < 0 ||
 		    qdisc_qstats_copy(d, sch) < 0)
 			return -1;
 	}
--- a/net/sched/sch_multiq.c
+++ b/net/sched/sch_multiq.c
@@ -330,7 +330,7 @@ static int multiq_dump_class_stats(struc
 
 	cl_q = q->queues[cl - 1];
 	if (gnet_stats_copy_basic(qdisc_root_sleeping_running(sch),
-				  d, NULL, &cl_q->bstats) < 0 ||
+				  d, cl_q->cpu_bstats, &cl_q->bstats) < 0 ||
 	    qdisc_qstats_copy(d, cl_q) < 0)
 		return -1;
 
--- a/net/sched/sch_prio.c
+++ b/net/sched/sch_prio.c
@@ -356,7 +356,7 @@ static int prio_dump_class_stats(struct
 
 	cl_q = q->queues[cl - 1];
 	if (gnet_stats_copy_basic(qdisc_root_sleeping_running(sch),
-				  d, NULL, &cl_q->bstats) < 0 ||
+				  d, cl_q->cpu_bstats, &cl_q->bstats) < 0 ||
 	    qdisc_qstats_copy(d, cl_q) < 0)
 		return -1;
 



^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 116/135] openvswitch: fix flow command message size
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (114 preceding siblings ...)
  2019-12-03 22:35 ` [PATCH 5.3 115/135] net: sched: fix `tc -s class show` no bstats on class with nolock subqueues Greg Kroah-Hartman
@ 2019-12-03 22:35 ` Greg Kroah-Hartman
  2019-12-03 22:35 ` [PATCH 5.3 117/135] sctp: Fix memory leak in sctp_sf_do_5_2_4_dupcook Greg Kroah-Hartman
                   ` (22 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:35 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Qi Jun Ding, Paolo Abeni, David S. Miller

From: Paolo Abeni <pabeni@redhat.com>

[ Upstream commit 4e81c0b3fa93d07653e2415fa71656b080a112fd ]

When user-space sets the OVS_UFID_F_OMIT_* flags, and the relevant
flow has no UFID, we can exceed the computed size, as
ovs_nla_put_identifier() will always dump an OVS_FLOW_ATTR_KEY
attribute.
Take the above in account when computing the flow command message
size.

Fixes: 74ed7ab9264c ("openvswitch: Add support for unique flow IDs.")
Reported-by: Qi Jun Ding <qding@redhat.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/openvswitch/datapath.c |    6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

--- a/net/openvswitch/datapath.c
+++ b/net/openvswitch/datapath.c
@@ -701,9 +701,13 @@ static size_t ovs_flow_cmd_msg_size(cons
 {
 	size_t len = NLMSG_ALIGN(sizeof(struct ovs_header));
 
-	/* OVS_FLOW_ATTR_UFID */
+	/* OVS_FLOW_ATTR_UFID, or unmasked flow key as fallback
+	 * see ovs_nla_put_identifier()
+	 */
 	if (sfid && ovs_identifier_is_ufid(sfid))
 		len += nla_total_size(sfid->ufid_len);
+	else
+		len += nla_total_size(ovs_key_attr_size());
 
 	/* OVS_FLOW_ATTR_KEY */
 	if (!sfid || should_fill_key(sfid, ufid_flags))



^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 117/135] sctp: Fix memory leak in sctp_sf_do_5_2_4_dupcook
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (115 preceding siblings ...)
  2019-12-03 22:35 ` [PATCH 5.3 116/135] openvswitch: fix flow command message size Greg Kroah-Hartman
@ 2019-12-03 22:35 ` Greg Kroah-Hartman
  2019-12-03 22:35 ` [PATCH 5.3 118/135] slip: Fix use-after-free Read in slip_open Greg Kroah-Hartman
                   ` (21 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:35 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Navid Emamdoost,
	Marcelo Ricardo Leitner, Jakub Kicinski

From: Navid Emamdoost <navid.emamdoost@gmail.com>

[ Upstream commit b6631c6031c746ed004c4221ec0616d7a520f441 ]

In the implementation of sctp_sf_do_5_2_4_dupcook() the allocated
new_asoc is leaked if security_sctp_assoc_request() fails. Release it
via sctp_association_free().

Fixes: 2277c7cd75e3 ("sctp: Add LSM hooks")
Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/sctp/sm_statefuns.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -2160,8 +2160,10 @@ enum sctp_disposition sctp_sf_do_5_2_4_d
 
 	/* Update socket peer label if first association. */
 	if (security_sctp_assoc_request((struct sctp_endpoint *)ep,
-					chunk->skb))
+					chunk->skb)) {
+		sctp_association_free(new_asoc);
 		return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
+	}
 
 	/* Set temp so that it won't be added into hashtable */
 	new_asoc->temp = 1;



^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 118/135] slip: Fix use-after-free Read in slip_open
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (116 preceding siblings ...)
  2019-12-03 22:35 ` [PATCH 5.3 117/135] sctp: Fix memory leak in sctp_sf_do_5_2_4_dupcook Greg Kroah-Hartman
@ 2019-12-03 22:35 ` Greg Kroah-Hartman
  2019-12-03 22:35 ` [PATCH 5.3 119/135] sctp: cache netns in sctp_ep_common Greg Kroah-Hartman
                   ` (20 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:35 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, syzbot+4d5170758f3762109542,
	David Miller, Oliver Hartkopp, Lukas Bulwahn, Jouni Hogander

From: Jouni Hogander <jouni.hogander@unikie.com>

[ Upstream commit e58c1912418980f57ba2060017583067f5f71e52 ]

Slip_open doesn't clean-up device which registration failed from the
slip_devs device list. On next open after failure this list is iterated
and freed device is accessed. Fix this by calling sl_free_netdev in error
path.

Here is the trace from the Syzbot:

__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x197/0x210 lib/dump_stack.c:118
print_address_description.constprop.0.cold+0xd4/0x30b mm/kasan/report.c:374
__kasan_report.cold+0x1b/0x41 mm/kasan/report.c:506
kasan_report+0x12/0x20 mm/kasan/common.c:634
__asan_report_load8_noabort+0x14/0x20 mm/kasan/generic_report.c:132
sl_sync drivers/net/slip/slip.c:725 [inline]
slip_open+0xecd/0x11b7 drivers/net/slip/slip.c:801
tty_ldisc_open.isra.0+0xa3/0x110 drivers/tty/tty_ldisc.c:469
tty_set_ldisc+0x30e/0x6b0 drivers/tty/tty_ldisc.c:596
tiocsetd drivers/tty/tty_io.c:2334 [inline]
tty_ioctl+0xe8d/0x14f0 drivers/tty/tty_io.c:2594
vfs_ioctl fs/ioctl.c:46 [inline]
file_ioctl fs/ioctl.c:509 [inline]
do_vfs_ioctl+0xdb6/0x13e0 fs/ioctl.c:696
ksys_ioctl+0xab/0xd0 fs/ioctl.c:713
__do_sys_ioctl fs/ioctl.c:720 [inline]
__se_sys_ioctl fs/ioctl.c:718 [inline]
__x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:718
do_syscall_64+0xfa/0x760 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe

Fixes: 3b5a39979daf ("slip: Fix memory leak in slip_open error path")
Reported-by: syzbot+4d5170758f3762109542@syzkaller.appspotmail.com
Cc: David Miller <davem@davemloft.net>
Cc: Oliver Hartkopp <socketcan@hartkopp.net>
Cc: Lukas Bulwahn <lukas.bulwahn@gmail.com>
Signed-off-by: Jouni Hogander <jouni.hogander@unikie.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/slip/slip.c |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/net/slip/slip.c
+++ b/drivers/net/slip/slip.c
@@ -855,6 +855,7 @@ err_free_chan:
 	sl->tty = NULL;
 	tty->disc_data = NULL;
 	clear_bit(SLF_INUSE, &sl->flags);
+	sl_free_netdev(sl->dev);
 	free_netdev(sl->dev);
 
 err_exit:



^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 119/135] sctp: cache netns in sctp_ep_common
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (117 preceding siblings ...)
  2019-12-03 22:35 ` [PATCH 5.3 118/135] slip: Fix use-after-free Read in slip_open Greg Kroah-Hartman
@ 2019-12-03 22:35 ` Greg Kroah-Hartman
  2019-12-03 22:36 ` [PATCH 5.3 120/135] openvswitch: drop unneeded BUG_ON() in ovs_flow_cmd_build_info() Greg Kroah-Hartman
                   ` (19 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:35 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, syzbot+e3b35fe7918ff0ee474e,
	Xin Long, Marcelo Ricardo Leitner, Jakub Kicinski

From: Xin Long <lucien.xin@gmail.com>

[ Upstream commit 312434617cb16be5166316cf9d08ba760b1042a1 ]

This patch is to fix a data-race reported by syzbot:

  BUG: KCSAN: data-race in sctp_assoc_migrate / sctp_hash_obj

  write to 0xffff8880b67c0020 of 8 bytes by task 18908 on cpu 1:
    sctp_assoc_migrate+0x1a6/0x290 net/sctp/associola.c:1091
    sctp_sock_migrate+0x8aa/0x9b0 net/sctp/socket.c:9465
    sctp_accept+0x3c8/0x470 net/sctp/socket.c:4916
    inet_accept+0x7f/0x360 net/ipv4/af_inet.c:734
    __sys_accept4+0x224/0x430 net/socket.c:1754
    __do_sys_accept net/socket.c:1795 [inline]
    __se_sys_accept net/socket.c:1792 [inline]
    __x64_sys_accept+0x4e/0x60 net/socket.c:1792
    do_syscall_64+0xcc/0x370 arch/x86/entry/common.c:290
    entry_SYSCALL_64_after_hwframe+0x44/0xa9

  read to 0xffff8880b67c0020 of 8 bytes by task 12003 on cpu 0:
    sctp_hash_obj+0x4f/0x2d0 net/sctp/input.c:894
    rht_key_get_hash include/linux/rhashtable.h:133 [inline]
    rht_key_hashfn include/linux/rhashtable.h:159 [inline]
    rht_head_hashfn include/linux/rhashtable.h:174 [inline]
    head_hashfn lib/rhashtable.c:41 [inline]
    rhashtable_rehash_one lib/rhashtable.c:245 [inline]
    rhashtable_rehash_chain lib/rhashtable.c:276 [inline]
    rhashtable_rehash_table lib/rhashtable.c:316 [inline]
    rht_deferred_worker+0x468/0xab0 lib/rhashtable.c:420
    process_one_work+0x3d4/0x890 kernel/workqueue.c:2269
    worker_thread+0xa0/0x800 kernel/workqueue.c:2415
    kthread+0x1d4/0x200 drivers/block/aoe/aoecmd.c:1253
    ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:352

It was caused by rhashtable access asoc->base.sk when sctp_assoc_migrate
is changing its value. However, what rhashtable wants is netns from asoc
base.sk, and for an asoc, its netns won't change once set. So we can
simply fix it by caching netns since created.

Fixes: d6c0256a60e6 ("sctp: add the rhashtable apis for sctp global transport hashtable")
Reported-by: syzbot+e3b35fe7918ff0ee474e@syzkaller.appspotmail.com
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/net/sctp/structs.h |    3 +++
 net/sctp/associola.c       |    1 +
 net/sctp/endpointola.c     |    1 +
 net/sctp/input.c           |    4 ++--
 4 files changed, 7 insertions(+), 2 deletions(-)

--- a/include/net/sctp/structs.h
+++ b/include/net/sctp/structs.h
@@ -1239,6 +1239,9 @@ struct sctp_ep_common {
 	/* What socket does this endpoint belong to?  */
 	struct sock *sk;
 
+	/* Cache netns and it won't change once set */
+	struct net *net;
+
 	/* This is where we receive inbound chunks.  */
 	struct sctp_inq	  inqueue;
 
--- a/net/sctp/associola.c
+++ b/net/sctp/associola.c
@@ -65,6 +65,7 @@ static struct sctp_association *sctp_ass
 	/* Discarding const is appropriate here.  */
 	asoc->ep = (struct sctp_endpoint *)ep;
 	asoc->base.sk = (struct sock *)sk;
+	asoc->base.net = sock_net(sk);
 
 	sctp_endpoint_hold(asoc->ep);
 	sock_hold(asoc->base.sk);
--- a/net/sctp/endpointola.c
+++ b/net/sctp/endpointola.c
@@ -152,6 +152,7 @@ static struct sctp_endpoint *sctp_endpoi
 
 	/* Remember who we are attached to.  */
 	ep->base.sk = sk;
+	ep->base.net = sock_net(sk);
 	sock_hold(ep->base.sk);
 
 	return ep;
--- a/net/sctp/input.c
+++ b/net/sctp/input.c
@@ -876,7 +876,7 @@ static inline int sctp_hash_cmp(struct r
 	if (!sctp_transport_hold(t))
 		return err;
 
-	if (!net_eq(sock_net(t->asoc->base.sk), x->net))
+	if (!net_eq(t->asoc->base.net, x->net))
 		goto out;
 	if (x->lport != htons(t->asoc->base.bind_addr.port))
 		goto out;
@@ -891,7 +891,7 @@ static inline __u32 sctp_hash_obj(const
 {
 	const struct sctp_transport *t = data;
 
-	return sctp_hashfn(sock_net(t->asoc->base.sk),
+	return sctp_hashfn(t->asoc->base.net,
 			   htons(t->asoc->base.bind_addr.port),
 			   &t->ipaddr, seed);
 }



^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 120/135] openvswitch: drop unneeded BUG_ON() in ovs_flow_cmd_build_info()
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (118 preceding siblings ...)
  2019-12-03 22:35 ` [PATCH 5.3 119/135] sctp: cache netns in sctp_ep_common Greg Kroah-Hartman
@ 2019-12-03 22:36 ` Greg Kroah-Hartman
  2019-12-03 22:36 ` [PATCH 5.3 121/135] openvswitch: remove another BUG_ON() Greg Kroah-Hartman
                   ` (18 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:36 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Paolo Abeni, David S. Miller

From: Paolo Abeni <pabeni@redhat.com>

[ Upstream commit 8ffeb03fbba3b599690b361467bfd2373e8c450f ]

All the callers of ovs_flow_cmd_build_info() already deal with
error return code correctly, so we can handle the error condition
in a more gracefull way. Still dump a warning to preserve
debuggability.

v1 -> v2:
 - clarify the commit message
 - clean the skb and report the error (DaveM)

Fixes: ccb1352e76cf ("net: Add Open vSwitch kernel components.")
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/openvswitch/datapath.c |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

--- a/net/openvswitch/datapath.c
+++ b/net/openvswitch/datapath.c
@@ -883,7 +883,10 @@ static struct sk_buff *ovs_flow_cmd_buil
 	retval = ovs_flow_cmd_fill_info(flow, dp_ifindex, skb,
 					info->snd_portid, info->snd_seq, 0,
 					cmd, ufid_flags);
-	BUG_ON(retval < 0);
+	if (WARN_ON_ONCE(retval < 0)) {
+		kfree_skb(skb);
+		skb = ERR_PTR(retval);
+	}
 	return skb;
 }
 



^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 121/135] openvswitch: remove another BUG_ON()
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (119 preceding siblings ...)
  2019-12-03 22:36 ` [PATCH 5.3 120/135] openvswitch: drop unneeded BUG_ON() in ovs_flow_cmd_build_info() Greg Kroah-Hartman
@ 2019-12-03 22:36 ` Greg Kroah-Hartman
  2019-12-03 22:36 ` [PATCH 5.3 122/135] net/tls: take into account that bpf_exec_tx_verdict() may free the record Greg Kroah-Hartman
                   ` (17 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:36 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Paolo Abeni, David S. Miller

From: Paolo Abeni <pabeni@redhat.com>

[ Upstream commit 8a574f86652a4540a2433946ba826ccb87f398cc ]

If we can't build the flow del notification, we can simply delete
the flow, no need to crash the kernel. Still keep a WARN_ON to
preserve debuggability.

Note: the BUG_ON() predates the Fixes tag, but this change
can be applied only after the mentioned commit.

v1 -> v2:
 - do not leak an skb on error

Fixes: aed067783e50 ("openvswitch: Minimize ovs_flow_cmd_del critical section.")
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/openvswitch/datapath.c |    6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

--- a/net/openvswitch/datapath.c
+++ b/net/openvswitch/datapath.c
@@ -1350,7 +1350,10 @@ static int ovs_flow_cmd_del(struct sk_bu
 						     OVS_FLOW_CMD_DEL,
 						     ufid_flags);
 			rcu_read_unlock();
-			BUG_ON(err < 0);
+			if (WARN_ON_ONCE(err < 0)) {
+				kfree_skb(reply);
+				goto out_free;
+			}
 
 			ovs_notify(&dp_flow_genl_family, reply, info);
 		} else {
@@ -1358,6 +1361,7 @@ static int ovs_flow_cmd_del(struct sk_bu
 		}
 	}
 
+out_free:
 	ovs_flow_free(flow, true);
 	return 0;
 unlock:



^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 122/135] net/tls: take into account that bpf_exec_tx_verdict() may free the record
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (120 preceding siblings ...)
  2019-12-03 22:36 ` [PATCH 5.3 121/135] openvswitch: remove another BUG_ON() Greg Kroah-Hartman
@ 2019-12-03 22:36 ` Greg Kroah-Hartman
  2019-12-03 22:36 ` [PATCH 5.3 123/135] net/tls: free the record on encryption error Greg Kroah-Hartman
                   ` (16 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:36 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jakub Kicinski, Simon Horman,
	John Fastabend, David S. Miller

From: Jakub Kicinski <jakub.kicinski@netronome.com>

[ Upstream commit c329ef9684de9517d82af5b4758c9e1b64a8a11a ]

bpf_exec_tx_verdict() may free the record if tls_push_record()
fails, or if the entire record got consumed by BPF. Re-check
ctx->open_rec before touching the data.

Fixes: d3b18ad31f93 ("tls: add bpf support to sk_msg handling")
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Reviewed-by: Simon Horman <simon.horman@netronome.com>
Acked-by: John Fastabend <john.fastabend@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/tls/tls_sw.c |   13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

--- a/net/tls/tls_sw.c
+++ b/net/tls/tls_sw.c
@@ -979,7 +979,7 @@ alloc_encrypted:
 					num_async++;
 				else if (ret == -ENOMEM)
 					goto wait_for_memory;
-				else if (ret == -ENOSPC)
+				else if (ctx->open_rec && ret == -ENOSPC)
 					goto rollback_iter;
 				else if (ret != -EAGAIN)
 					goto send_end;
@@ -1048,11 +1048,12 @@ wait_for_memory:
 		ret = sk_stream_wait_memory(sk, &timeo);
 		if (ret) {
 trim_sgl:
-			tls_trim_both_msgs(sk, orig_size);
+			if (ctx->open_rec)
+				tls_trim_both_msgs(sk, orig_size);
 			goto send_end;
 		}
 
-		if (msg_en->sg.size < required_size)
+		if (ctx->open_rec && msg_en->sg.size < required_size)
 			goto alloc_encrypted;
 	}
 
@@ -1185,11 +1186,13 @@ wait_for_sndbuf:
 wait_for_memory:
 		ret = sk_stream_wait_memory(sk, &timeo);
 		if (ret) {
-			tls_trim_both_msgs(sk, msg_pl->sg.size);
+			if (ctx->open_rec)
+				tls_trim_both_msgs(sk, msg_pl->sg.size);
 			goto sendpage_end;
 		}
 
-		goto alloc_payload;
+		if (ctx->open_rec)
+			goto alloc_payload;
 	}
 
 	if (num_async) {



^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 123/135] net/tls: free the record on encryption error
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (121 preceding siblings ...)
  2019-12-03 22:36 ` [PATCH 5.3 122/135] net/tls: take into account that bpf_exec_tx_verdict() may free the record Greg Kroah-Hartman
@ 2019-12-03 22:36 ` Greg Kroah-Hartman
  2019-12-03 22:36 ` [PATCH 5.3 124/135] net: skmsg: fix TLS 1.3 crash with full sk_msg Greg Kroah-Hartman
                   ` (15 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:36 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, syzbot+df0d4ec12332661dd1f9,
	Jakub Kicinski, Simon Horman, John Fastabend, David S. Miller

From: Jakub Kicinski <jakub.kicinski@netronome.com>

[ Upstream commit d10523d0b3d78153ee58d19853ced26c9004c8c4 ]

When tls_do_encryption() fails the SG lists are left with the
SG_END and SG_CHAIN marks in place. One could hope that once
encryption fails we will never see the record again, but that
is in fact not true. Commit d3b18ad31f93 ("tls: add bpf support
to sk_msg handling") added special handling to ENOMEM and ENOSPC
errors which mean we may see the same record re-submitted.

As suggested by John free the record, the BPF code is already
doing just that.

Reported-by: syzbot+df0d4ec12332661dd1f9@syzkaller.appspotmail.com
Fixes: d3b18ad31f93 ("tls: add bpf support to sk_msg handling")
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Reviewed-by: Simon Horman <simon.horman@netronome.com>
Acked-by: John Fastabend <john.fastabend@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/tls/tls_sw.c |   10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

--- a/net/tls/tls_sw.c
+++ b/net/tls/tls_sw.c
@@ -766,8 +766,14 @@ static int bpf_exec_tx_verdict(struct sk
 
 	policy = !(flags & MSG_SENDPAGE_NOPOLICY);
 	psock = sk_psock_get(sk);
-	if (!psock || !policy)
-		return tls_push_record(sk, flags, record_type);
+	if (!psock || !policy) {
+		err = tls_push_record(sk, flags, record_type);
+		if (err) {
+			*copied -= sk_msg_free(sk, msg);
+			tls_free_open_rec(sk);
+		}
+		return err;
+	}
 more_data:
 	enospc = sk_msg_full(msg);
 	if (psock->eval == __SK_NONE) {



^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 124/135] net: skmsg: fix TLS 1.3 crash with full sk_msg
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (122 preceding siblings ...)
  2019-12-03 22:36 ` [PATCH 5.3 123/135] net/tls: free the record on encryption error Greg Kroah-Hartman
@ 2019-12-03 22:36 ` Greg Kroah-Hartman
  2019-12-03 22:36 ` [PATCH 5.3 125/135] selftests/tls: add a test for fragmented messages Greg Kroah-Hartman
                   ` (14 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:36 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jakub Kicinski, Simon Horman,
	David S. Miller

From: Jakub Kicinski <jakub.kicinski@netronome.com>

[ Upstream commit 031097d9e079e40dce401031d1012e83d80eaf01 ]

TLS 1.3 started using the entry at the end of the SG array
for chaining-in the single byte content type entry. This mostly
works:

[ E E E E E E . . ]
  ^           ^
   start       end

                 E < content type
               /
[ E E E E E E C . ]
  ^           ^
   start       end

(Where E denotes a populated SG entry; C denotes a chaining entry.)

If the array is full, however, the end will point to the start:

[ E E E E E E E E ]
  ^
   start
   end

And we end up overwriting the start:

    E < content type
   /
[ C E E E E E E E ]
  ^
   start
   end

The sg array is supposed to be a circular buffer with start and
end markers pointing anywhere. In case where start > end
(i.e. the circular buffer has "wrapped") there is an extra entry
reserved at the end to chain the two halves together.

[ E E E E E E . . l ]

(Where l is the reserved entry for "looping" back to front.

As suggested by John, let's reserve another entry for chaining
SG entries after the main circular buffer. Note that this entry
has to be pointed to by the end entry so its position is not fixed.

Examples of full messages:

[ E E E E E E E E . l ]
  ^               ^
   start           end

   <---------------.
[ E E . E E E E E E l ]
      ^ ^
   end   start

Now the end will always point to an unused entry, so TLS 1.3
can always use it.

Fixes: 130b392c6cd6 ("net: tls: Add tls 1.3 support")
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Reviewed-by: Simon Horman <simon.horman@netronome.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/linux/skmsg.h |   26 +++++++++++++-------------
 net/core/filter.c     |    8 ++++----
 net/core/skmsg.c      |    2 +-
 net/ipv4/tcp_bpf.c    |    2 +-
 4 files changed, 19 insertions(+), 19 deletions(-)

--- a/include/linux/skmsg.h
+++ b/include/linux/skmsg.h
@@ -14,6 +14,7 @@
 #include <net/strparser.h>
 
 #define MAX_MSG_FRAGS			MAX_SKB_FRAGS
+#define NR_MSG_FRAG_IDS			(MAX_MSG_FRAGS + 1)
 
 enum __sk_action {
 	__SK_DROP = 0,
@@ -29,11 +30,13 @@ struct sk_msg_sg {
 	u32				size;
 	u32				copybreak;
 	bool				copy[MAX_MSG_FRAGS];
-	/* The extra element is used for chaining the front and sections when
-	 * the list becomes partitioned (e.g. end < start). The crypto APIs
-	 * require the chaining.
+	/* The extra two elements:
+	 * 1) used for chaining the front and sections when the list becomes
+	 *    partitioned (e.g. end < start). The crypto APIs require the
+	 *    chaining;
+	 * 2) to chain tailer SG entries after the message.
 	 */
-	struct scatterlist		data[MAX_MSG_FRAGS + 1];
+	struct scatterlist		data[MAX_MSG_FRAGS + 2];
 };
 
 /* UAPI in filter.c depends on struct sk_msg_sg being first element. */
@@ -141,13 +144,13 @@ static inline void sk_msg_apply_bytes(st
 
 static inline u32 sk_msg_iter_dist(u32 start, u32 end)
 {
-	return end >= start ? end - start : end + (MAX_MSG_FRAGS - start);
+	return end >= start ? end - start : end + (NR_MSG_FRAG_IDS - start);
 }
 
 #define sk_msg_iter_var_prev(var)			\
 	do {						\
 		if (var == 0)				\
-			var = MAX_MSG_FRAGS - 1;	\
+			var = NR_MSG_FRAG_IDS - 1;	\
 		else					\
 			var--;				\
 	} while (0)
@@ -155,7 +158,7 @@ static inline u32 sk_msg_iter_dist(u32 s
 #define sk_msg_iter_var_next(var)			\
 	do {						\
 		var++;					\
-		if (var == MAX_MSG_FRAGS)		\
+		if (var == NR_MSG_FRAG_IDS)		\
 			var = 0;			\
 	} while (0)
 
@@ -172,9 +175,9 @@ static inline void sk_msg_clear_meta(str
 
 static inline void sk_msg_init(struct sk_msg *msg)
 {
-	BUILD_BUG_ON(ARRAY_SIZE(msg->sg.data) - 1 != MAX_MSG_FRAGS);
+	BUILD_BUG_ON(ARRAY_SIZE(msg->sg.data) - 1 != NR_MSG_FRAG_IDS);
 	memset(msg, 0, sizeof(*msg));
-	sg_init_marker(msg->sg.data, MAX_MSG_FRAGS);
+	sg_init_marker(msg->sg.data, NR_MSG_FRAG_IDS);
 }
 
 static inline void sk_msg_xfer(struct sk_msg *dst, struct sk_msg *src,
@@ -195,14 +198,11 @@ static inline void sk_msg_xfer_full(stru
 
 static inline bool sk_msg_full(const struct sk_msg *msg)
 {
-	return (msg->sg.end == msg->sg.start) && msg->sg.size;
+	return sk_msg_iter_dist(msg->sg.start, msg->sg.end) == MAX_MSG_FRAGS;
 }
 
 static inline u32 sk_msg_elem_used(const struct sk_msg *msg)
 {
-	if (sk_msg_full(msg))
-		return MAX_MSG_FRAGS;
-
 	return sk_msg_iter_dist(msg->sg.start, msg->sg.end);
 }
 
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -2299,7 +2299,7 @@ BPF_CALL_4(bpf_msg_pull_data, struct sk_
 	WARN_ON_ONCE(last_sge == first_sge);
 	shift = last_sge > first_sge ?
 		last_sge - first_sge - 1 :
-		MAX_SKB_FRAGS - first_sge + last_sge - 1;
+		NR_MSG_FRAG_IDS - first_sge + last_sge - 1;
 	if (!shift)
 		goto out;
 
@@ -2308,8 +2308,8 @@ BPF_CALL_4(bpf_msg_pull_data, struct sk_
 	do {
 		u32 move_from;
 
-		if (i + shift >= MAX_MSG_FRAGS)
-			move_from = i + shift - MAX_MSG_FRAGS;
+		if (i + shift >= NR_MSG_FRAG_IDS)
+			move_from = i + shift - NR_MSG_FRAG_IDS;
 		else
 			move_from = i + shift;
 		if (move_from == msg->sg.end)
@@ -2323,7 +2323,7 @@ BPF_CALL_4(bpf_msg_pull_data, struct sk_
 	} while (1);
 
 	msg->sg.end = msg->sg.end - shift > msg->sg.end ?
-		      msg->sg.end - shift + MAX_MSG_FRAGS :
+		      msg->sg.end - shift + NR_MSG_FRAG_IDS :
 		      msg->sg.end - shift;
 out:
 	msg->data = sg_virt(&msg->sg.data[first_sge]) + start - offset;
--- a/net/core/skmsg.c
+++ b/net/core/skmsg.c
@@ -422,7 +422,7 @@ static int sk_psock_skb_ingress(struct s
 	copied = skb->len;
 	msg->sg.start = 0;
 	msg->sg.size = copied;
-	msg->sg.end = num_sge == MAX_MSG_FRAGS ? 0 : num_sge;
+	msg->sg.end = num_sge;
 	msg->skb = skb;
 
 	sk_psock_queue_msg(psock, msg);
--- a/net/ipv4/tcp_bpf.c
+++ b/net/ipv4/tcp_bpf.c
@@ -301,7 +301,7 @@ EXPORT_SYMBOL_GPL(tcp_bpf_sendmsg_redir)
 static int tcp_bpf_send_verdict(struct sock *sk, struct sk_psock *psock,
 				struct sk_msg *msg, int *copied, int flags)
 {
-	bool cork = false, enospc = msg->sg.start == msg->sg.end;
+	bool cork = false, enospc = sk_msg_full(msg);
 	struct sock *sk_redir;
 	u32 tosend, delta = 0;
 	int ret;



^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 125/135] selftests/tls: add a test for fragmented messages
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (123 preceding siblings ...)
  2019-12-03 22:36 ` [PATCH 5.3 124/135] net: skmsg: fix TLS 1.3 crash with full sk_msg Greg Kroah-Hartman
@ 2019-12-03 22:36 ` Greg Kroah-Hartman
  2019-12-03 22:36 ` [PATCH 5.3 126/135] net/tls: remove the dead inplace_crypto code Greg Kroah-Hartman
                   ` (13 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:36 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jakub Kicinski, Simon Horman,
	David S. Miller

From: Jakub Kicinski <jakub.kicinski@netronome.com>

[ Upstream commit 65190f77424d7b82c4aad7326c9cce6bd91a2fcc ]

Add a sendmsg test with very fragmented messages. This should
fill up sk_msg and test the boundary conditions.

Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Reviewed-by: Simon Horman <simon.horman@netronome.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 tools/testing/selftests/net/tls.c |   60 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 60 insertions(+)

--- a/tools/testing/selftests/net/tls.c
+++ b/tools/testing/selftests/net/tls.c
@@ -268,6 +268,38 @@ TEST_F(tls, sendmsg_single)
 	EXPECT_EQ(memcmp(buf, test_str, send_len), 0);
 }
 
+#define MAX_FRAGS	64
+#define SEND_LEN	13
+TEST_F(tls, sendmsg_fragmented)
+{
+	char const *test_str = "test_sendmsg";
+	char buf[SEND_LEN * MAX_FRAGS];
+	struct iovec vec[MAX_FRAGS];
+	struct msghdr msg;
+	int i, frags;
+
+	for (frags = 1; frags <= MAX_FRAGS; frags++) {
+		for (i = 0; i < frags; i++) {
+			vec[i].iov_base = (char *)test_str;
+			vec[i].iov_len = SEND_LEN;
+		}
+
+		memset(&msg, 0, sizeof(struct msghdr));
+		msg.msg_iov = vec;
+		msg.msg_iovlen = frags;
+
+		EXPECT_EQ(sendmsg(self->fd, &msg, 0), SEND_LEN * frags);
+		EXPECT_EQ(recv(self->cfd, buf, SEND_LEN * frags, MSG_WAITALL),
+			  SEND_LEN * frags);
+
+		for (i = 0; i < frags; i++)
+			EXPECT_EQ(memcmp(buf + SEND_LEN * i,
+					 test_str, SEND_LEN), 0);
+	}
+}
+#undef MAX_FRAGS
+#undef SEND_LEN
+
 TEST_F(tls, sendmsg_large)
 {
 	void *mem = malloc(16384);
@@ -694,6 +726,34 @@ TEST_F(tls, recv_lowat)
 	EXPECT_EQ(memcmp(send_mem, recv_mem + 10, 5), 0);
 }
 
+TEST_F(tls, recv_rcvbuf)
+{
+	char send_mem[4096];
+	char recv_mem[4096];
+	int rcv_buf = 1024;
+
+	memset(send_mem, 0x1c, sizeof(send_mem));
+
+	EXPECT_EQ(setsockopt(self->cfd, SOL_SOCKET, SO_RCVBUF,
+			     &rcv_buf, sizeof(rcv_buf)), 0);
+
+	EXPECT_EQ(send(self->fd, send_mem, 512, 0), 512);
+	memset(recv_mem, 0, sizeof(recv_mem));
+	EXPECT_EQ(recv(self->cfd, recv_mem, sizeof(recv_mem), 0), 512);
+	EXPECT_EQ(memcmp(send_mem, recv_mem, 512), 0);
+
+	if (self->notls)
+		return;
+
+	EXPECT_EQ(send(self->fd, send_mem, 4096, 0), 4096);
+	memset(recv_mem, 0, sizeof(recv_mem));
+	EXPECT_EQ(recv(self->cfd, recv_mem, sizeof(recv_mem), 0), -1);
+	EXPECT_EQ(errno, EMSGSIZE);
+
+	EXPECT_EQ(recv(self->cfd, recv_mem, sizeof(recv_mem), 0), -1);
+	EXPECT_EQ(errno, EMSGSIZE);
+}
+
 TEST_F(tls, bidir)
 {
 	char const *test_str = "test_read";



^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 126/135] net/tls: remove the dead inplace_crypto code
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (124 preceding siblings ...)
  2019-12-03 22:36 ` [PATCH 5.3 125/135] selftests/tls: add a test for fragmented messages Greg Kroah-Hartman
@ 2019-12-03 22:36 ` Greg Kroah-Hartman
  2019-12-03 22:36 ` [PATCH 5.3 127/135] net/tls: use sg_next() to walk sg entries Greg Kroah-Hartman
                   ` (12 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:36 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jakub Kicinski, Simon Horman,
	David S. Miller

From: Jakub Kicinski <jakub.kicinski@netronome.com>

[ Upstream commit 9e5ffed37df68d0ccfb2fdc528609e23a1e70ebe ]

Looks like when BPF support was added by commit d3b18ad31f93
("tls: add bpf support to sk_msg handling") and
commit d829e9c4112b ("tls: convert to generic sk_msg interface")
it broke/removed the support for in-place crypto as added by
commit 4e6d47206c32 ("tls: Add support for inplace records
encryption").

The inplace_crypto member of struct tls_rec is dead, inited
to zero, and sometimes set to zero again. It used to be
set to 1 when record was allocated, but the skmsg code doesn't
seem to have been written with the idea of in-place crypto
in mind.

Since non trivial effort is required to bring the feature back
and we don't really have the HW to measure the benefit just
remove the left over support for now to avoid confusing readers.

Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Reviewed-by: Simon Horman <simon.horman@netronome.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/net/tls.h |    1 -
 net/tls/tls_sw.c  |    6 +-----
 2 files changed, 1 insertion(+), 6 deletions(-)

--- a/include/net/tls.h
+++ b/include/net/tls.h
@@ -121,7 +121,6 @@ struct tls_rec {
 	struct list_head list;
 	int tx_ready;
 	int tx_flags;
-	int inplace_crypto;
 
 	struct sk_msg msg_plaintext;
 	struct sk_msg msg_encrypted;
--- a/net/tls/tls_sw.c
+++ b/net/tls/tls_sw.c
@@ -705,8 +705,7 @@ static int tls_push_record(struct sock *
 	}
 
 	i = msg_pl->sg.start;
-	sg_chain(rec->sg_aead_in, 2, rec->inplace_crypto ?
-		 &msg_en->sg.data[i] : &msg_pl->sg.data[i]);
+	sg_chain(rec->sg_aead_in, 2, &msg_pl->sg.data[i]);
 
 	i = msg_en->sg.end;
 	sk_msg_iter_var_prev(i);
@@ -971,8 +970,6 @@ alloc_encrypted:
 			if (ret)
 				goto fallback_to_reg_send;
 
-			rec->inplace_crypto = 0;
-
 			num_zc++;
 			copied += try_to_copy;
 
@@ -1171,7 +1168,6 @@ alloc_payload:
 
 		tls_ctx->pending_open_record_frags = true;
 		if (full_record || eor || sk_msg_full(msg_pl)) {
-			rec->inplace_crypto = 0;
 			ret = bpf_exec_tx_verdict(msg_pl, sk, full_record,
 						  record_type, &copied, flags);
 			if (ret) {



^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 127/135] net/tls: use sg_next() to walk sg entries
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (125 preceding siblings ...)
  2019-12-03 22:36 ` [PATCH 5.3 126/135] net/tls: remove the dead inplace_crypto code Greg Kroah-Hartman
@ 2019-12-03 22:36 ` Greg Kroah-Hartman
  2019-12-03 22:36 ` [PATCH 5.3 128/135] selftests: bpf: test_sockmap: handle file creation failures gracefully Greg Kroah-Hartman
                   ` (11 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:36 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jakub Kicinski, Simon Horman,
	David S. Miller

From: Jakub Kicinski <jakub.kicinski@netronome.com>

[ Upstream commit c5daa6cccdc2f94aca2c9b3fa5f94e4469997293 ]

Partially sent record cleanup path increments an SG entry
directly instead of using sg_next(). This should not be a
problem today, as encrypted messages should be always
allocated as arrays. But given this is a cleanup path it's
easy to miss was this ever to change. Use sg_next(), and
simplify the code.

Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Reviewed-by: Simon Horman <simon.horman@netronome.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/net/tls.h  |    2 +-
 net/tls/tls_main.c |   13 ++-----------
 net/tls/tls_sw.c   |    3 ++-
 3 files changed, 5 insertions(+), 13 deletions(-)

--- a/include/net/tls.h
+++ b/include/net/tls.h
@@ -407,7 +407,7 @@ int tls_push_sg(struct sock *sk, struct
 		int flags);
 int tls_push_partial_record(struct sock *sk, struct tls_context *ctx,
 			    int flags);
-bool tls_free_partial_record(struct sock *sk, struct tls_context *ctx);
+void tls_free_partial_record(struct sock *sk, struct tls_context *ctx);
 
 static inline struct tls_msg *tls_msg(struct sk_buff *skb)
 {
--- a/net/tls/tls_main.c
+++ b/net/tls/tls_main.c
@@ -208,24 +208,15 @@ int tls_push_partial_record(struct sock
 	return tls_push_sg(sk, ctx, sg, offset, flags);
 }
 
-bool tls_free_partial_record(struct sock *sk, struct tls_context *ctx)
+void tls_free_partial_record(struct sock *sk, struct tls_context *ctx)
 {
 	struct scatterlist *sg;
 
-	sg = ctx->partially_sent_record;
-	if (!sg)
-		return false;
-
-	while (1) {
+	for (sg = ctx->partially_sent_record; sg; sg = sg_next(sg)) {
 		put_page(sg_page(sg));
 		sk_mem_uncharge(sk, sg->length);
-
-		if (sg_is_last(sg))
-			break;
-		sg++;
 	}
 	ctx->partially_sent_record = NULL;
-	return true;
 }
 
 static void tls_write_space(struct sock *sk)
--- a/net/tls/tls_sw.c
+++ b/net/tls/tls_sw.c
@@ -2086,7 +2086,8 @@ void tls_sw_release_resources_tx(struct
 	/* Free up un-sent records in tx_list. First, free
 	 * the partially sent record if any at head of tx_list.
 	 */
-	if (tls_free_partial_record(sk, tls_ctx)) {
+	if (tls_ctx->partially_sent_record) {
+		tls_free_partial_record(sk, tls_ctx);
 		rec = list_first_entry(&ctx->tx_list,
 				       struct tls_rec, list);
 		list_del(&rec->list);



^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 128/135] selftests: bpf: test_sockmap: handle file creation failures gracefully
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (126 preceding siblings ...)
  2019-12-03 22:36 ` [PATCH 5.3 127/135] net/tls: use sg_next() to walk sg entries Greg Kroah-Hartman
@ 2019-12-03 22:36 ` Greg Kroah-Hartman
  2019-12-03 22:36 ` [PATCH 5.3 129/135] selftests: bpf: correct perror strings Greg Kroah-Hartman
                   ` (10 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:36 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jakub Kicinski, Simon Horman,
	David S. Miller

From: Jakub Kicinski <jakub.kicinski@netronome.com>

[ Upstream commit 4b67c515036313f3c3ecba3cb2babb9cbddb3f85 ]

test_sockmap creates a temporary file to use for sendpage.
this may fail for various reasons. Handle the error rather
than segfault.

Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Reviewed-by: Simon Horman <simon.horman@netronome.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 tools/testing/selftests/bpf/test_sockmap.c |    9 +++++++++
 1 file changed, 9 insertions(+)

--- a/tools/testing/selftests/bpf/test_sockmap.c
+++ b/tools/testing/selftests/bpf/test_sockmap.c
@@ -332,6 +332,10 @@ static int msg_loop_sendpage(int fd, int
 	int i, fp;
 
 	file = fopen(".sendpage_tst.tmp", "w+");
+	if (!file) {
+		perror("create file for sendpage");
+		return 1;
+	}
 	for (i = 0; i < iov_length * cnt; i++, k++)
 		fwrite(&k, sizeof(char), 1, file);
 	fflush(file);
@@ -339,6 +343,11 @@ static int msg_loop_sendpage(int fd, int
 	fclose(file);
 
 	fp = open(".sendpage_tst.tmp", O_RDONLY);
+	if (fp < 0) {
+		perror("reopen file for sendpage");
+		return 1;
+	}
+
 	clock_gettime(CLOCK_MONOTONIC, &s->start);
 	for (i = 0; i < cnt; i++) {
 		int sent = sendfile(fd, fp, NULL, iov_length);



^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 129/135] selftests: bpf: correct perror strings
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (127 preceding siblings ...)
  2019-12-03 22:36 ` [PATCH 5.3 128/135] selftests: bpf: test_sockmap: handle file creation failures gracefully Greg Kroah-Hartman
@ 2019-12-03 22:36 ` Greg Kroah-Hartman
  2019-12-03 22:36 ` [PATCH 5.3 130/135] tipc: fix link name length check Greg Kroah-Hartman
                   ` (9 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:36 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jakub Kicinski, Simon Horman,
	David S. Miller

From: Jakub Kicinski <jakub.kicinski@netronome.com>

[ Upstream commit e5dc9dd3258098bf8b5ceb75fc3433b41eff618a ]

perror(str) is basically equivalent to
print("%s: %s\n", str, strerror(errno)).
New line or colon at the end of str is
a mistake/breaks formatting.

Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Reviewed-by: Simon Horman <simon.horman@netronome.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 tools/testing/selftests/bpf/test_sockmap.c |   38 ++++++++++++++---------------
 tools/testing/selftests/bpf/xdping.c       |    2 -
 2 files changed, 20 insertions(+), 20 deletions(-)

--- a/tools/testing/selftests/bpf/test_sockmap.c
+++ b/tools/testing/selftests/bpf/test_sockmap.c
@@ -240,14 +240,14 @@ static int sockmap_init_sockets(int verb
 	addr.sin_port = htons(S1_PORT);
 	err = bind(s1, (struct sockaddr *)&addr, sizeof(addr));
 	if (err < 0) {
-		perror("bind s1 failed()\n");
+		perror("bind s1 failed()");
 		return errno;
 	}
 
 	addr.sin_port = htons(S2_PORT);
 	err = bind(s2, (struct sockaddr *)&addr, sizeof(addr));
 	if (err < 0) {
-		perror("bind s2 failed()\n");
+		perror("bind s2 failed()");
 		return errno;
 	}
 
@@ -255,14 +255,14 @@ static int sockmap_init_sockets(int verb
 	addr.sin_port = htons(S1_PORT);
 	err = listen(s1, 32);
 	if (err < 0) {
-		perror("listen s1 failed()\n");
+		perror("listen s1 failed()");
 		return errno;
 	}
 
 	addr.sin_port = htons(S2_PORT);
 	err = listen(s2, 32);
 	if (err < 0) {
-		perror("listen s1 failed()\n");
+		perror("listen s1 failed()");
 		return errno;
 	}
 
@@ -270,14 +270,14 @@ static int sockmap_init_sockets(int verb
 	addr.sin_port = htons(S1_PORT);
 	err = connect(c1, (struct sockaddr *)&addr, sizeof(addr));
 	if (err < 0 && errno != EINPROGRESS) {
-		perror("connect c1 failed()\n");
+		perror("connect c1 failed()");
 		return errno;
 	}
 
 	addr.sin_port = htons(S2_PORT);
 	err = connect(c2, (struct sockaddr *)&addr, sizeof(addr));
 	if (err < 0 && errno != EINPROGRESS) {
-		perror("connect c2 failed()\n");
+		perror("connect c2 failed()");
 		return errno;
 	} else if (err < 0) {
 		err = 0;
@@ -286,13 +286,13 @@ static int sockmap_init_sockets(int verb
 	/* Accept Connecrtions */
 	p1 = accept(s1, NULL, NULL);
 	if (p1 < 0) {
-		perror("accept s1 failed()\n");
+		perror("accept s1 failed()");
 		return errno;
 	}
 
 	p2 = accept(s2, NULL, NULL);
 	if (p2 < 0) {
-		perror("accept s1 failed()\n");
+		perror("accept s1 failed()");
 		return errno;
 	}
 
@@ -353,7 +353,7 @@ static int msg_loop_sendpage(int fd, int
 		int sent = sendfile(fd, fp, NULL, iov_length);
 
 		if (!drop && sent < 0) {
-			perror("send loop error:");
+			perror("send loop error");
 			close(fp);
 			return sent;
 		} else if (drop && sent >= 0) {
@@ -472,7 +472,7 @@ static int msg_loop(int fd, int iov_coun
 			int sent = sendmsg(fd, &msg, flags);
 
 			if (!drop && sent < 0) {
-				perror("send loop error:");
+				perror("send loop error");
 				goto out_errno;
 			} else if (drop && sent >= 0) {
 				printf("send loop error expected: %i\n", sent);
@@ -508,7 +508,7 @@ static int msg_loop(int fd, int iov_coun
 		total_bytes -= txmsg_pop_total;
 		err = clock_gettime(CLOCK_MONOTONIC, &s->start);
 		if (err < 0)
-			perror("recv start time: ");
+			perror("recv start time");
 		while (s->bytes_recvd < total_bytes) {
 			if (txmsg_cork) {
 				timeout.tv_sec = 0;
@@ -552,7 +552,7 @@ static int msg_loop(int fd, int iov_coun
 			if (recv < 0) {
 				if (errno != EWOULDBLOCK) {
 					clock_gettime(CLOCK_MONOTONIC, &s->end);
-					perror("recv failed()\n");
+					perror("recv failed()");
 					goto out_errno;
 				}
 			}
@@ -566,7 +566,7 @@ static int msg_loop(int fd, int iov_coun
 
 				errno = msg_verify_data(&msg, recv, chunk_sz);
 				if (errno) {
-					perror("data verify msg failed\n");
+					perror("data verify msg failed");
 					goto out_errno;
 				}
 				if (recvp) {
@@ -574,7 +574,7 @@ static int msg_loop(int fd, int iov_coun
 								recvp,
 								chunk_sz);
 					if (errno) {
-						perror("data verify msg_peek failed\n");
+						perror("data verify msg_peek failed");
 						goto out_errno;
 					}
 				}
@@ -663,7 +663,7 @@ static int sendmsg_test(struct sockmap_o
 			err = 0;
 		exit(err ? 1 : 0);
 	} else if (rxpid == -1) {
-		perror("msg_loop_rx: ");
+		perror("msg_loop_rx");
 		return errno;
 	}
 
@@ -690,7 +690,7 @@ static int sendmsg_test(struct sockmap_o
 				s.bytes_recvd, recvd_Bps, recvd_Bps/giga);
 		exit(err ? 1 : 0);
 	} else if (txpid == -1) {
-		perror("msg_loop_tx: ");
+		perror("msg_loop_tx");
 		return errno;
 	}
 
@@ -724,7 +724,7 @@ static int forever_ping_pong(int rate, s
 	/* Ping/Pong data from client to server */
 	sc = send(c1, buf, sizeof(buf), 0);
 	if (sc < 0) {
-		perror("send failed()\n");
+		perror("send failed()");
 		return sc;
 	}
 
@@ -757,7 +757,7 @@ static int forever_ping_pong(int rate, s
 			rc = recv(i, buf, sizeof(buf), 0);
 			if (rc < 0) {
 				if (errno != EWOULDBLOCK) {
-					perror("recv failed()\n");
+					perror("recv failed()");
 					return rc;
 				}
 			}
@@ -769,7 +769,7 @@ static int forever_ping_pong(int rate, s
 
 			sc = send(i, buf, rc, 0);
 			if (sc < 0) {
-				perror("send failed()\n");
+				perror("send failed()");
 				return sc;
 			}
 		}
--- a/tools/testing/selftests/bpf/xdping.c
+++ b/tools/testing/selftests/bpf/xdping.c
@@ -45,7 +45,7 @@ static int get_stats(int fd, __u16 count
 	printf("\nXDP RTT data:\n");
 
 	if (bpf_map_lookup_elem(fd, &raddr, &pinginfo)) {
-		perror("bpf_map_lookup elem: ");
+		perror("bpf_map_lookup elem");
 		return 1;
 	}
 



^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 130/135] tipc: fix link name length check
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (128 preceding siblings ...)
  2019-12-03 22:36 ` [PATCH 5.3 129/135] selftests: bpf: correct perror strings Greg Kroah-Hartman
@ 2019-12-03 22:36 ` Greg Kroah-Hartman
  2019-12-03 22:36 ` [PATCH 5.3 131/135] selftests: pmtu: use -oneline for ip route list cache Greg Kroah-Hartman
                   ` (8 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:36 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, John Rutherford, Jon Maloy, David S. Miller

From: John Rutherford <john.rutherford@dektech.com.au>

[ Upstream commit fd567ac20cb0377ff466d3337e6e9ac5d0cb15e4 ]

In commit 4f07b80c9733 ("tipc: check msg->req data len in
tipc_nl_compat_bearer_disable") the same patch code was copied into
routines: tipc_nl_compat_bearer_disable(),
tipc_nl_compat_link_stat_dump() and tipc_nl_compat_link_reset_stats().
The two link routine occurrences should have been modified to check
the maximum link name length and not bearer name length.

Fixes: 4f07b80c9733 ("tipc: check msg->reg data len in tipc_nl_compat_bearer_disable")
Signed-off-by: John Rutherford <john.rutherford@dektech.com.au>
Acked-by: Jon Maloy <jon.maloy@ericsson.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/tipc/netlink_compat.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/net/tipc/netlink_compat.c
+++ b/net/tipc/netlink_compat.c
@@ -550,7 +550,7 @@ static int tipc_nl_compat_link_stat_dump
 	if (len <= 0)
 		return -EINVAL;
 
-	len = min_t(int, len, TIPC_MAX_BEARER_NAME);
+	len = min_t(int, len, TIPC_MAX_LINK_NAME);
 	if (!string_is_valid(name, len))
 		return -EINVAL;
 
@@ -822,7 +822,7 @@ static int tipc_nl_compat_link_reset_sta
 	if (len <= 0)
 		return -EINVAL;
 
-	len = min_t(int, len, TIPC_MAX_BEARER_NAME);
+	len = min_t(int, len, TIPC_MAX_LINK_NAME);
 	if (!string_is_valid(name, len))
 		return -EINVAL;
 



^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 131/135] selftests: pmtu: use -oneline for ip route list cache
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (129 preceding siblings ...)
  2019-12-03 22:36 ` [PATCH 5.3 130/135] tipc: fix link name length check Greg Kroah-Hartman
@ 2019-12-03 22:36 ` Greg Kroah-Hartman
  2019-12-03 22:36 ` [PATCH 5.3 132/135] ext4: add more paranoia checking in ext4_expand_extra_isize handling Greg Kroah-Hartman
                   ` (7 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:36 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Thadeu Lima de Souza Cascardo,
	Stefano Brivio, David S. Miller

From: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>

[ Upstream commit 2745aea6750ff0d2c48285d25bdb00e5b636ec8b ]

Some versions of iproute2 will output more than one line per entry, which
will cause the test to fail, like:

TEST: ipv6: list and flush cached exceptions                        [FAIL]
  can't list cached exceptions

That happens, for example, with iproute2 4.15.0. When using the -oneline
option, this will work just fine:

TEST: ipv6: list and flush cached exceptions                        [ OK ]

This also works just fine with a more recent version of iproute2, like
5.4.0.

For some reason, two lines are printed for the IPv4 test no matter what
version of iproute2 is used. Use the same -oneline parameter there instead
of counting the lines twice.

Fixes: b964641e9925 ("selftests: pmtu: Make list_flush_ipv6_exception test more demanding")
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
Acked-by: Stefano Brivio <sbrivio@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 tools/testing/selftests/net/pmtu.sh |    5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

--- a/tools/testing/selftests/net/pmtu.sh
+++ b/tools/testing/selftests/net/pmtu.sh
@@ -1249,8 +1249,7 @@ test_list_flush_ipv4_exception() {
 	done
 	run_cmd ${ns_a} ping -q -M want -i 0.1 -c 2 -s 1800 "${dst2}"
 
-	# Each exception is printed as two lines
-	if [ "$(${ns_a} ip route list cache | wc -l)" -ne 202 ]; then
+	if [ "$(${ns_a} ip -oneline route list cache | wc -l)" -ne 101 ]; then
 		err "  can't list cached exceptions"
 		fail=1
 	fi
@@ -1300,7 +1299,7 @@ test_list_flush_ipv6_exception() {
 		run_cmd ${ns_a} ping -q -M want -i 0.1 -w 1 -s 1800 "${dst_prefix1}${i}"
 	done
 	run_cmd ${ns_a} ping -q -M want -i 0.1 -w 1 -s 1800 "${dst2}"
-	if [ "$(${ns_a} ip -6 route list cache | wc -l)" -ne 101 ]; then
+	if [ "$(${ns_a} ip -oneline -6 route list cache | wc -l)" -ne 101 ]; then
 		err "  can't list cached exceptions"
 		fail=1
 	fi



^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 132/135] ext4: add more paranoia checking in ext4_expand_extra_isize handling
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (130 preceding siblings ...)
  2019-12-03 22:36 ` [PATCH 5.3 131/135] selftests: pmtu: use -oneline for ip route list cache Greg Kroah-Hartman
@ 2019-12-03 22:36 ` Greg Kroah-Hartman
  2019-12-03 22:36 ` [PATCH 5.3 133/135] HID: core: check whether Usage Page item is after Usage ID items Greg Kroah-Hartman
                   ` (6 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:36 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, syzbot+f8d6f8386ceacdbfff57,
	syzbot+33d7ea72e47de3bdf4e1, syzbot+44b6763edfc17144296f,
	Theodore Tso, stable

From: Theodore Ts'o <tytso@mit.edu>

commit 4ea99936a1630f51fc3a2d61a58ec4a1c4b7d55a upstream.

It's possible to specify a non-zero s_want_extra_isize via debugging
option, and this can cause bad things(tm) to happen when using a file
system with an inode size of 128 bytes.

Add better checking when the file system is mounted, as well as when
we are actually doing the trying to do the inode expansion.

Link: https://lore.kernel.org/r/20191110121510.GH23325@mit.edu
Reported-by: syzbot+f8d6f8386ceacdbfff57@syzkaller.appspotmail.com
Reported-by: syzbot+33d7ea72e47de3bdf4e1@syzkaller.appspotmail.com
Reported-by: syzbot+44b6763edfc17144296f@syzkaller.appspotmail.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: stable@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/ext4/inode.c |   15 +++++++++++++++
 fs/ext4/super.c |   21 ++++++++++++---------
 2 files changed, 27 insertions(+), 9 deletions(-)

--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -5942,8 +5942,23 @@ static int __ext4_expand_extra_isize(str
 {
 	struct ext4_inode *raw_inode;
 	struct ext4_xattr_ibody_header *header;
+	unsigned int inode_size = EXT4_INODE_SIZE(inode->i_sb);
+	struct ext4_inode_info *ei = EXT4_I(inode);
 	int error;
 
+	/* this was checked at iget time, but double check for good measure */
+	if ((EXT4_GOOD_OLD_INODE_SIZE + ei->i_extra_isize > inode_size) ||
+	    (ei->i_extra_isize & 3)) {
+		EXT4_ERROR_INODE(inode, "bad extra_isize %u (inode size %u)",
+				 ei->i_extra_isize,
+				 EXT4_INODE_SIZE(inode->i_sb));
+		return -EFSCORRUPTED;
+	}
+	if ((new_extra_isize < ei->i_extra_isize) ||
+	    (new_extra_isize < 4) ||
+	    (new_extra_isize > inode_size - EXT4_GOOD_OLD_INODE_SIZE))
+		return -EINVAL;	/* Should never happen */
+
 	raw_inode = ext4_raw_inode(iloc);
 
 	header = IHDR(inode, raw_inode);
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -3544,12 +3544,15 @@ static void ext4_clamp_want_extra_isize(
 {
 	struct ext4_sb_info *sbi = EXT4_SB(sb);
 	struct ext4_super_block *es = sbi->s_es;
+	unsigned def_extra_isize = sizeof(struct ext4_inode) -
+						EXT4_GOOD_OLD_INODE_SIZE;
 
-	/* determine the minimum size of new large inodes, if present */
-	if (sbi->s_inode_size > EXT4_GOOD_OLD_INODE_SIZE &&
-	    sbi->s_want_extra_isize == 0) {
-		sbi->s_want_extra_isize = sizeof(struct ext4_inode) -
-						     EXT4_GOOD_OLD_INODE_SIZE;
+	if (sbi->s_inode_size == EXT4_GOOD_OLD_INODE_SIZE) {
+		sbi->s_want_extra_isize = 0;
+		return;
+	}
+	if (sbi->s_want_extra_isize < 4) {
+		sbi->s_want_extra_isize = def_extra_isize;
 		if (ext4_has_feature_extra_isize(sb)) {
 			if (sbi->s_want_extra_isize <
 			    le16_to_cpu(es->s_want_extra_isize))
@@ -3562,10 +3565,10 @@ static void ext4_clamp_want_extra_isize(
 		}
 	}
 	/* Check if enough inode space is available */
-	if (EXT4_GOOD_OLD_INODE_SIZE + sbi->s_want_extra_isize >
-							sbi->s_inode_size) {
-		sbi->s_want_extra_isize = sizeof(struct ext4_inode) -
-						       EXT4_GOOD_OLD_INODE_SIZE;
+	if ((sbi->s_want_extra_isize > sbi->s_inode_size) ||
+	    (EXT4_GOOD_OLD_INODE_SIZE + sbi->s_want_extra_isize >
+							sbi->s_inode_size)) {
+		sbi->s_want_extra_isize = def_extra_isize;
 		ext4_msg(sb, KERN_INFO,
 			 "required extra inode space not available");
 	}



^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 133/135] HID: core: check whether Usage Page item is after Usage ID items
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (131 preceding siblings ...)
  2019-12-03 22:36 ` [PATCH 5.3 132/135] ext4: add more paranoia checking in ext4_expand_extra_isize handling Greg Kroah-Hartman
@ 2019-12-03 22:36 ` Greg Kroah-Hartman
  2019-12-03 22:36 ` [PATCH 5.3 134/135] platform/x86: hp-wmi: Fix ACPI errors caused by too small buffer Greg Kroah-Hartman
                   ` (5 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:36 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Candle Sun, Nianfu Bai,
	Benjamin Tissoires, Jiri Kosina, Siarhei Vishniakou

From: Candle Sun <candle.sun@unisoc.com>

commit 1cb0d2aee26335d0bccf29100c7bed00ebece851 upstream.

Upstream commit 58e75155009c ("HID: core: move Usage Page concatenation
to Main item") adds support for Usage Page item after Usage ID items
(such as keyboards manufactured by Primax).

Usage Page concatenation in Main item works well for following report
descriptor patterns:

    USAGE_PAGE (Keyboard)                   05 07
    USAGE_MINIMUM (Keyboard LeftControl)    19 E0
    USAGE_MAXIMUM (Keyboard Right GUI)      29 E7
    LOGICAL_MINIMUM (0)                     15 00
    LOGICAL_MAXIMUM (1)                     25 01
    REPORT_SIZE (1)                         75 01
    REPORT_COUNT (8)                        95 08
    INPUT (Data,Var,Abs)                    81 02

-------------

    USAGE_MINIMUM (Keyboard LeftControl)    19 E0
    USAGE_MAXIMUM (Keyboard Right GUI)      29 E7
    LOGICAL_MINIMUM (0)                     15 00
    LOGICAL_MAXIMUM (1)                     25 01
    REPORT_SIZE (1)                         75 01
    REPORT_COUNT (8)                        95 08
    USAGE_PAGE (Keyboard)                   05 07
    INPUT (Data,Var,Abs)                    81 02

But it makes the parser act wrong for the following report
descriptor pattern(such as some Gamepads):

    USAGE_PAGE (Button)                     05 09
    USAGE (Button 1)                        09 01
    USAGE (Button 2)                        09 02
    USAGE (Button 4)                        09 04
    USAGE (Button 5)                        09 05
    USAGE (Button 7)                        09 07
    USAGE (Button 8)                        09 08
    USAGE (Button 14)                       09 0E
    USAGE (Button 15)                       09 0F
    USAGE (Button 13)                       09 0D
    USAGE_PAGE (Consumer Devices)           05 0C
    USAGE (Back)                            0a 24 02
    USAGE (HomePage)                        0a 23 02
    LOGICAL_MINIMUM (0)                     15 00
    LOGICAL_MAXIMUM (1)                     25 01
    REPORT_SIZE (1)                         75 01
    REPORT_COUNT (11)                       95 0B
    INPUT (Data,Var,Abs)                    81 02

With Usage Page concatenation in Main item, parser recognizes all the
11 Usages as consumer keys, it is not the HID device's real intention.

This patch checks whether Usage Page is really defined after Usage ID
items by comparing usage page using status.

Usage Page concatenation on currently defined Usage Page will always
do in local parsing when Usage ID items encountered.

When Main item is parsing, concatenation will do again with last
defined Usage Page if this page has not been used in the previous
usages concatenation.

Signed-off-by: Candle Sun <candle.sun@unisoc.com>
Signed-off-by: Nianfu Bai <nianfu.bai@unisoc.com>
Cc: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Cc: Siarhei Vishniakou <svv@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/hid/hid-core.c |   51 +++++++++++++++++++++++++++++++++++++++++++------
 1 file changed, 45 insertions(+), 6 deletions(-)

--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -212,6 +212,18 @@ static unsigned hid_lookup_collection(st
 }
 
 /*
+ * Concatenate usage which defines 16 bits or less with the
+ * currently defined usage page to form a 32 bit usage
+ */
+
+static void complete_usage(struct hid_parser *parser, unsigned int index)
+{
+	parser->local.usage[index] &= 0xFFFF;
+	parser->local.usage[index] |=
+		(parser->global.usage_page & 0xFFFF) << 16;
+}
+
+/*
  * Add a usage to the temporary parser table.
  */
 
@@ -222,6 +234,14 @@ static int hid_add_usage(struct hid_pars
 		return -1;
 	}
 	parser->local.usage[parser->local.usage_index] = usage;
+
+	/*
+	 * If Usage item only includes usage id, concatenate it with
+	 * currently defined usage page
+	 */
+	if (size <= 2)
+		complete_usage(parser, parser->local.usage_index);
+
 	parser->local.usage_size[parser->local.usage_index] = size;
 	parser->local.collection_index[parser->local.usage_index] =
 		parser->collection_stack_ptr ?
@@ -543,13 +563,32 @@ static int hid_parser_local(struct hid_p
  * usage value."
  */
 
-static void hid_concatenate_usage_page(struct hid_parser *parser)
+static void hid_concatenate_last_usage_page(struct hid_parser *parser)
 {
 	int i;
+	unsigned int usage_page;
+	unsigned int current_page;
+
+	if (!parser->local.usage_index)
+		return;
 
-	for (i = 0; i < parser->local.usage_index; i++)
-		if (parser->local.usage_size[i] <= 2)
-			parser->local.usage[i] += parser->global.usage_page << 16;
+	usage_page = parser->global.usage_page;
+
+	/*
+	 * Concatenate usage page again only if last declared Usage Page
+	 * has not been already used in previous usages concatenation
+	 */
+	for (i = parser->local.usage_index - 1; i >= 0; i--) {
+		if (parser->local.usage_size[i] > 2)
+			/* Ignore extended usages */
+			continue;
+
+		current_page = parser->local.usage[i] >> 16;
+		if (current_page == usage_page)
+			break;
+
+		complete_usage(parser, i);
+	}
 }
 
 /*
@@ -561,7 +600,7 @@ static int hid_parser_main(struct hid_pa
 	__u32 data;
 	int ret;
 
-	hid_concatenate_usage_page(parser);
+	hid_concatenate_last_usage_page(parser);
 
 	data = item_udata(item);
 
@@ -772,7 +811,7 @@ static int hid_scan_main(struct hid_pars
 	__u32 data;
 	int i;
 
-	hid_concatenate_usage_page(parser);
+	hid_concatenate_last_usage_page(parser);
 
 	data = item_udata(item);
 



^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 134/135] platform/x86: hp-wmi: Fix ACPI errors caused by too small buffer
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (132 preceding siblings ...)
  2019-12-03 22:36 ` [PATCH 5.3 133/135] HID: core: check whether Usage Page item is after Usage ID items Greg Kroah-Hartman
@ 2019-12-03 22:36 ` Greg Kroah-Hartman
  2019-12-03 22:36 ` [PATCH 5.3 135/135] platform/x86: hp-wmi: Fix ACPI errors caused by passing 0 as input size Greg Kroah-Hartman
                   ` (4 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:36 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Hans de Goede, Andy Shevchenko

From: Hans de Goede <hdegoede@redhat.com>

commit 16245db1489cd9aa579506f64afeeeb13d825a93 upstream.

The HP WMI calls may take up to 128 bytes of data as input, and
the AML methods implementing the WMI calls, declare a couple of fields for
accessing input in different sizes, specifycally the HWMC method contains:

        CreateField (Arg1, 0x80, 0x0400, D128)

Even though we do not use any of the WMI command-types which need a buffer
of this size, the APCI interpreter still tries to create it as it is
declared in generoc code at the top of the HWMC method which runs before
the code looks at which command-type is requested.

This results in many of these errors on many different HP laptop models:

[   14.459261] ACPI Error: Field [D128] at 1152 exceeds Buffer [NULL] size 160 (bits) (20170303/dsopcode-236)
[   14.459268] ACPI Error: Method parse/execution failed [\HWMC] (Node ffff8edcc61507f8), AE_AML_BUFFER_LIMIT (20170303/psparse-543)
[   14.459279] ACPI Error: Method parse/execution failed [\_SB.WMID.WMAA] (Node ffff8edcc61523c0), AE_AML_BUFFER_LIMIT (20170303/psparse-543)

This commit increases the size of the data element of the bios_args struct
to 128 bytes fixing these errors.

Cc: stable@vger.kernel.org
BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=197007
BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=201981
BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1520703
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/platform/x86/hp-wmi.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- a/drivers/platform/x86/hp-wmi.c
+++ b/drivers/platform/x86/hp-wmi.c
@@ -65,7 +65,7 @@ struct bios_args {
 	u32 command;
 	u32 commandtype;
 	u32 datasize;
-	u32 data;
+	u8 data[128];
 };
 
 enum hp_wmi_commandtype {
@@ -216,7 +216,7 @@ static int hp_wmi_perform_query(int quer
 		.command = command,
 		.commandtype = query,
 		.datasize = insize,
-		.data = 0,
+		.data = { 0 },
 	};
 	struct acpi_buffer input = { sizeof(struct bios_args), &args };
 	struct acpi_buffer output = { ACPI_ALLOCATE_BUFFER, NULL };
@@ -228,7 +228,7 @@ static int hp_wmi_perform_query(int quer
 
 	if (WARN_ON(insize > sizeof(args.data)))
 		return -EINVAL;
-	memcpy(&args.data, buffer, insize);
+	memcpy(&args.data[0], buffer, insize);
 
 	wmi_evaluate_method(HPWMI_BIOS_GUID, 0, mid, &input, &output);
 



^ permalink raw reply	[flat|nested] 140+ messages in thread

* [PATCH 5.3 135/135] platform/x86: hp-wmi: Fix ACPI errors caused by passing 0 as input size
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (133 preceding siblings ...)
  2019-12-03 22:36 ` [PATCH 5.3 134/135] platform/x86: hp-wmi: Fix ACPI errors caused by too small buffer Greg Kroah-Hartman
@ 2019-12-03 22:36 ` Greg Kroah-Hartman
  2019-12-04 10:06 ` [PATCH 5.3 000/135] 5.3.15-stable review Jon Hunter
                   ` (3 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Greg Kroah-Hartman @ 2019-12-03 22:36 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Hans de Goede, Andy Shevchenko

From: Hans de Goede <hdegoede@redhat.com>

commit f3e4f3fc8ee9729c4b1b27a478c68b713df53c0c upstream.

The AML code implementing the WMI methods creates a variable length
field to hold the input data we pass like this:

        CreateDWordField (Arg1, 0x0C, DSZI)
        Local5 = DSZI /* \HWMC.DSZI */
        CreateField (Arg1, 0x80, (Local5 * 0x08), DAIN)

If we pass 0 as bios_args.datasize argument then (Local5 * 0x08)
is 0 which results in these errors:

[   71.973305] ACPI BIOS Error (bug): Attempt to CreateField of length zero (20190816/dsopcode-133)
[   71.973332] ACPI Error: Aborting method \HWMC due to previous error (AE_AML_OPERAND_VALUE) (20190816/psparse-529)
[   71.973413] ACPI Error: Aborting method \_SB.WMID.WMAA due to previous error (AE_AML_OPERAND_VALUE) (20190816/psparse-529)

And in our HPWMI_WIRELESS2_QUERY calls always failing. for read commands
like HPWMI_WIRELESS2_QUERY the DSZI value is not used / checked, except for
read commands where extra input is needed to specify exactly what to read.

So for HPWMI_WIRELESS2_QUERY we can safely pass the size of the expected
output as insize to hp_wmi_perform_query(), as we are already doing for all
other HPWMI_READ commands we send. Doing so fixes these errors.

Cc: stable@vger.kernel.org
BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=197007
BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=201981
BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1520703
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/platform/x86/hp-wmi.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/platform/x86/hp-wmi.c
+++ b/drivers/platform/x86/hp-wmi.c
@@ -380,7 +380,7 @@ static int hp_wmi_rfkill2_refresh(void)
 	int err, i;
 
 	err = hp_wmi_perform_query(HPWMI_WIRELESS2_QUERY, HPWMI_READ, &state,
-				   0, sizeof(state));
+				   sizeof(state), sizeof(state));
 	if (err)
 		return err;
 
@@ -777,7 +777,7 @@ static int __init hp_wmi_rfkill2_setup(s
 	int err, i;
 
 	err = hp_wmi_perform_query(HPWMI_WIRELESS2_QUERY, HPWMI_READ, &state,
-				   0, sizeof(state));
+				   sizeof(state), sizeof(state));
 	if (err)
 		return err < 0 ? err : -EINVAL;
 



^ permalink raw reply	[flat|nested] 140+ messages in thread

* Re: [PATCH 5.3 000/135] 5.3.15-stable review
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (134 preceding siblings ...)
  2019-12-03 22:36 ` [PATCH 5.3 135/135] platform/x86: hp-wmi: Fix ACPI errors caused by passing 0 as input size Greg Kroah-Hartman
@ 2019-12-04 10:06 ` Jon Hunter
  2019-12-04 17:53 ` shuah
                   ` (2 subsequent siblings)
  138 siblings, 0 replies; 140+ messages in thread
From: Jon Hunter @ 2019-12-04 10:06 UTC (permalink / raw)
  To: Greg Kroah-Hartman, linux-kernel
  Cc: torvalds, akpm, linux, shuah, patches, ben.hutchings,
	lkft-triage, stable, linux-tegra


On 03/12/2019 22:34, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 5.3.15 release.
> There are 135 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.
> 
> Responses should be made by Thu, 05 Dec 2019 21:20:36 +0000.
> Anything received after that time might be too late.
> 
> The whole patch series can be found in one patch at:
> 	https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.3.15-rc1.gz
> or in the git tree and branch at:
> 	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.3.y
> and the diffstat can be found below.
> 
> thanks,
> 
> greg k-h
> 
> -------------

All tests are passing for Tegra ...

Test results for stable-v5.3:
    13 builds:	13 pass, 0 fail
    22 boots:	22 pass, 0 fail
    38 tests:	38 pass, 0 fail

Linux version:	5.3.15-rc1-g682bd5084c78
Boards tested:	tegra124-jetson-tk1, tegra186-p2771-0000,
                tegra194-p2972-0000, tegra20-ventana,
                tegra210-p2371-2180, tegra30-cardhu-a04

Cheers
Jon

-- 
nvpublic

^ permalink raw reply	[flat|nested] 140+ messages in thread

* Re: [PATCH 5.3 000/135] 5.3.15-stable review
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (135 preceding siblings ...)
  2019-12-04 10:06 ` [PATCH 5.3 000/135] 5.3.15-stable review Jon Hunter
@ 2019-12-04 17:53 ` shuah
  2019-12-04 19:05 ` Guenter Roeck
  2019-12-04 19:13 ` Naresh Kamboju
  138 siblings, 0 replies; 140+ messages in thread
From: shuah @ 2019-12-04 17:53 UTC (permalink / raw)
  To: Greg Kroah-Hartman, linux-kernel
  Cc: torvalds, akpm, linux, patches, ben.hutchings, lkft-triage,
	stable, shuah

On 12/3/19 3:34 PM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 5.3.15 release.
> There are 135 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.
> 
> Responses should be made by Thu, 05 Dec 2019 21:20:36 +0000.
> Anything received after that time might be too late.
> 
> The whole patch series can be found in one patch at:
> 	https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.3.15-rc1.gz
> or in the git tree and branch at:
> 	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.3.y
> and the diffstat can be found below.
> 
> thanks,
> 
> greg k-h
> 

Compiled and booted on my test system. No dmesg regressions.

thanks,
-- Shuah


^ permalink raw reply	[flat|nested] 140+ messages in thread

* Re: [PATCH 5.3 000/135] 5.3.15-stable review
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (136 preceding siblings ...)
  2019-12-04 17:53 ` shuah
@ 2019-12-04 19:05 ` Guenter Roeck
  2019-12-04 19:13 ` Naresh Kamboju
  138 siblings, 0 replies; 140+ messages in thread
From: Guenter Roeck @ 2019-12-04 19:05 UTC (permalink / raw)
  To: Greg Kroah-Hartman
  Cc: linux-kernel, torvalds, akpm, shuah, patches, ben.hutchings,
	lkft-triage, stable

On Tue, Dec 03, 2019 at 11:34:00PM +0100, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 5.3.15 release.
> There are 135 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.
> 
> Responses should be made by Thu, 05 Dec 2019 21:20:36 +0000.
> Anything received after that time might be too late.
> 

Build results:
	total: 158 pass: 158 fail: 0
Qemu test results:
	total: 391 pass: 391 fail: 0

Guenter

^ permalink raw reply	[flat|nested] 140+ messages in thread

* Re: [PATCH 5.3 000/135] 5.3.15-stable review
  2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
                   ` (137 preceding siblings ...)
  2019-12-04 19:05 ` Guenter Roeck
@ 2019-12-04 19:13 ` Naresh Kamboju
  138 siblings, 0 replies; 140+ messages in thread
From: Naresh Kamboju @ 2019-12-04 19:13 UTC (permalink / raw)
  To: Greg Kroah-Hartman
  Cc: open list, Shuah Khan, patches, lkft-triage, Ben Hutchings,
	linux- stable, Andrew Morton, Linus Torvalds, Guenter Roeck

On Wed, 4 Dec 2019 at 04:11, Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
>
> This is the start of the stable review cycle for the 5.3.15 release.
> There are 135 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Thu, 05 Dec 2019 21:20:36 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
>         https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.3.15-rc1.gz
> or in the git tree and branch at:
>         git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.3.y
> and the diffstat can be found below.
>

Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.

Summary
------------------------------------------------------------------------

kernel: 5.3.15-rc1
git repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
git branch: linux-5.3.y
git commit: 682bd5084c785a2b36f6d7e4cd76e8c6d85dcac3
git describe: v5.3.14-136-g682bd5084c78
Test details: https://qa-reports.linaro.org/lkft/linux-stable-rc-5.3-oe/build/v5.3.14-136-g682bd5084c78


No regressions (compared to build v5.3.14)

No fixes (compared to build v5.3.14)

Ran 23162 total tests in the following environments and test suites.

Environments
--------------
- dragonboard-410c
- hi6220-hikey
- i386
- juno-r2
- qemu_arm
- qemu_arm64
- qemu_i386
- qemu_x86_64
- x15
- x86

Test Suites
-----------
* build
* kselftest
* kvm-unit-tests
* libgpiod
* libhugetlbfs
* linux-log-parser
* ltp-cap_bounds-tests
* ltp-commands-tests
* ltp-containers-tests
* ltp-cpuhotplug-tests
* ltp-cve-tests
* ltp-dio-tests
* ltp-fcntl-locktests-tests
* ltp-filecaps-tests
* ltp-fs-tests
* ltp-fs_bind-tests
* ltp-fs_perms_simple-tests
* ltp-fsx-tests
* ltp-hugetlb-tests
* ltp-io-tests
* ltp-ipc-tests
* ltp-math-tests
* ltp-mm-tests
* ltp-nptl-tests
* ltp-open-posix-tests
* ltp-pty-tests
* ltp-sched-tests
* ltp-securebits-tests
* ltp-syscalls-tests
* network-basic-tests
* spectre-meltdown-checker-test
* v4l2-compliance
* perf
* install-android-platform-tools-r2600
* kselftest-vsyscall-mode-native
* kselftest-vsyscall-mode-none

-- 
Linaro LKFT
https://lkft.linaro.org

^ permalink raw reply	[flat|nested] 140+ messages in thread

end of thread, back to index

Thread overview: 140+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-12-03 22:34 [PATCH 5.3 000/135] 5.3.15-stable review Greg Kroah-Hartman
2019-12-03 22:34 ` [PATCH 5.3 001/135] io_uring: async workers should inherit the user creds Greg Kroah-Hartman
2019-12-03 22:34 ` [PATCH 5.3 002/135] net: separate out the msghdr copy from ___sys_{send,recv}msg() Greg Kroah-Hartman
2019-12-03 22:34 ` [PATCH 5.3 003/135] net: disallow ancillary data for __sys_{send,recv}msg_file() Greg Kroah-Hartman
2019-12-03 22:34 ` [PATCH 5.3 004/135] XArray: Fix xas_next() with a single entry at 0 Greg Kroah-Hartman
2019-12-03 22:34 ` [PATCH 5.3 005/135] clk: meson: gxbb: let sar_adc_clk_div set the parent clock rate Greg Kroah-Hartman
2019-12-03 22:34 ` [PATCH 5.3 006/135] clk: at91: sam9x60: fix programmable clock Greg Kroah-Hartman
2019-12-03 22:34 ` [PATCH 5.3 007/135] thunderbolt: Read DP IN adapter first two dwords in one go Greg Kroah-Hartman
2019-12-03 22:34 ` [PATCH 5.3 008/135] thunderbolt: Fix lockdep circular locking depedency warning Greg Kroah-Hartman
2019-12-03 22:34 ` [PATCH 5.3 009/135] clocksource/drivers/mediatek: Fix error handling Greg Kroah-Hartman
2019-12-03 22:34 ` [PATCH 5.3 010/135] soundwire: intel: fix intel_register_dai PDI offsets and numbers Greg Kroah-Hartman
2019-12-03 22:34 ` [PATCH 5.3 011/135] ASoC: msm8916-wcd-analog: Fix RX1 selection in RDAC2 MUX Greg Kroah-Hartman
2019-12-03 22:34 ` [PATCH 5.3 012/135] ASoC: compress: fix unsigned integer overflow check Greg Kroah-Hartman
2019-12-03 22:34 ` [PATCH 5.3 013/135] reset: Fix memory leak in reset_control_array_put() Greg Kroah-Hartman
2019-12-03 22:34 ` [PATCH 5.3 014/135] clk: samsung: exynos5433: Fix error paths Greg Kroah-Hartman
2019-12-03 22:34 ` [PATCH 5.3 015/135] clk: samsung: exynos542x: Move G3D subsystem clocks to its sub-CMU Greg Kroah-Hartman
2019-12-03 22:34 ` [PATCH 5.3 016/135] ASoC: kirkwood: fix external clock probe defer Greg Kroah-Hartman
2019-12-03 22:34 ` [PATCH 5.3 017/135] ASoC: kirkwood: fix device remove ordering Greg Kroah-Hartman
2019-12-03 22:34 ` [PATCH 5.3 018/135] arm64: dts: ls1028a: fix a compatible issue Greg Kroah-Hartman
2019-12-03 22:34 ` [PATCH 5.3 019/135] clk: samsung: exynos5420: Preserve PLL configuration during suspend/resume Greg Kroah-Hartman
2019-12-03 22:34 ` [PATCH 5.3 020/135] pinctrl: cherryview: Allocate IRQ chip dynamic Greg Kroah-Hartman
2019-12-03 22:34 ` [PATCH 5.3 021/135] ARM: dts: imx6qdl-sabreauto: Fix storm of accelerometer interrupts Greg Kroah-Hartman
2019-12-03 22:34 ` [PATCH 5.3 022/135] soc: imx: gpc: fix initialiser format Greg Kroah-Hartman
2019-12-03 22:34 ` [PATCH 5.3 023/135] reset: fix reset_control_ops kerneldoc comment Greg Kroah-Hartman
2019-12-03 22:34 ` [PATCH 5.3 024/135] arm64: dts: imx8mm: fix compatible string for sdma Greg Kroah-Hartman
2019-12-03 22:34 ` [PATCH 5.3 025/135] ASoC: SOF: ipc: Fix memory leak in sof_set_get_large_ctrl_data Greg Kroah-Hartman
2019-12-03 22:34 ` [PATCH 5.3 026/135] ASoC: ti: sdma-pcm: Add back the flags parameter for non standard dma names Greg Kroah-Hartman
2019-12-03 22:34 ` [PATCH 5.3 027/135] ASoC: rockchip: rockchip_max98090: Enable SHDN to fix headset detection Greg Kroah-Hartman
2019-12-03 22:34 ` [PATCH 5.3 028/135] clk: at91: avoid sleeping early Greg Kroah-Hartman
2019-12-03 22:34 ` [PATCH 5.3 029/135] clk: sunxi: Fix operator precedence in sunxi_divs_clk_setup Greg Kroah-Hartman
2019-12-03 22:34 ` [PATCH 5.3 030/135] clk: sunxi-ng: a80: fix the zeroing of bits 16 and 18 Greg Kroah-Hartman
2019-12-03 22:34 ` [PATCH 5.3 031/135] ARM: dts: sun8i-a83t-tbs-a711: Fix WiFi resume from suspend Greg Kroah-Hartman
2019-12-03 22:34 ` [PATCH 5.3 032/135] bpf: Allow narrow loads of bpf_sysctl fields with offset > 0 Greg Kroah-Hartman
2019-12-03 22:34 ` [PATCH 5.3 033/135] samples/bpf: fix build by setting HAVE_ATTR_TEST to zero Greg Kroah-Hartman
2019-12-03 22:34 ` [PATCH 5.3 034/135] bpf: Change size to u64 for bpf_map_{area_alloc, charge_init}() Greg Kroah-Hartman
2019-12-03 22:34 ` [PATCH 5.3 035/135] powerpc/bpf: Fix tail call implementation Greg Kroah-Hartman
2019-12-03 22:34 ` [PATCH 5.3 036/135] idr: Fix idr_get_next_ul race with idr_remove Greg Kroah-Hartman
2019-12-03 22:34 ` [PATCH 5.3 037/135] idr: Fix integer overflow in idr_for_each_entry Greg Kroah-Hartman
2019-12-03 22:34 ` [PATCH 5.3 038/135] idr: Fix idr_alloc_u32 on 32-bit systems Greg Kroah-Hartman
2019-12-03 22:34 ` [PATCH 5.3 039/135] x86/resctrl: Prevent NULL pointer dereference when reading mondata Greg Kroah-Hartman
2019-12-03 22:34 ` [PATCH 5.3 040/135] arm64: dts: zii-ultra: fix ARM regulator GPIO handle Greg Kroah-Hartman
2019-12-03 22:34 ` [PATCH 5.3 041/135] fbdev: c2p: Fix link failure on non-inlining Greg Kroah-Hartman
2019-12-03 22:34 ` [PATCH 5.3 042/135] ASoC: hdac_hda: fix race in device removal Greg Kroah-Hartman
2019-12-03 22:34 ` [PATCH 5.3 043/135] clk: ti: dra7-atl-clock: Remove ti_clk_add_alias call Greg Kroah-Hartman
2019-12-03 22:34 ` [PATCH 5.3 044/135] clk: ti: clkctrl: Fix failed to enable error with double udelay timeout Greg Kroah-Hartman
2019-12-03 22:34 ` [PATCH 5.3 045/135] net: fec: add missed clk_disable_unprepare in remove Greg Kroah-Hartman
2019-12-03 22:34 ` [PATCH 5.3 046/135] netfilter: ipset: Fix nla_policies to fully support NL_VALIDATE_STRICT Greg Kroah-Hartman
2019-12-03 22:34 ` [PATCH 5.3 047/135] bridge: ebtables: dont crash when using dnat target in output chains Greg Kroah-Hartman
2019-12-03 22:34 ` [PATCH 5.3 048/135] netfilter: nf_tables: bogus EOPNOTSUPP on basechain update Greg Kroah-Hartman
2019-12-03 22:34 ` [PATCH 5.3 049/135] netfilter: nf_tables_offload: skip EBUSY on chain update Greg Kroah-Hartman
2019-12-03 22:34 ` [PATCH 5.3 050/135] stacktrace: Dont skip first entry on noncurrent tasks Greg Kroah-Hartman
2019-12-03 22:34 ` [PATCH 5.3 051/135] can: peak_usb: report bus recovery as well Greg Kroah-Hartman
2019-12-03 22:34 ` [PATCH 5.3 052/135] can: c_can: D_CAN: c_can_chip_config(): perform a sofware reset on open Greg Kroah-Hartman
2019-12-03 22:34 ` [PATCH 5.3 053/135] can: rx-offload: can_rx_offload_queue_tail(): fix error handling, avoid skb mem leak Greg Kroah-Hartman
2019-12-03 22:34 ` [PATCH 5.3 054/135] can: rx-offload: can_rx_offload_offload_one(): do not increase the skb_queue beyond skb_queue_len_max Greg Kroah-Hartman
2019-12-03 22:34 ` [PATCH 5.3 055/135] can: rx-offload: can_rx_offload_offload_one(): increment rx_fifo_errors on queue overflow or OOM Greg Kroah-Hartman
2019-12-03 22:34 ` [PATCH 5.3 056/135] can: rx-offload: can_rx_offload_offload_one(): use ERR_PTR() to propagate error value in case of errors Greg Kroah-Hartman
2019-12-03 22:34 ` [PATCH 5.3 057/135] can: rx-offload: can_rx_offload_irq_offload_timestamp(): continue on error Greg Kroah-Hartman
2019-12-03 22:34 ` [PATCH 5.3 058/135] can: rx-offload: can_rx_offload_irq_offload_fifo(): " Greg Kroah-Hartman
2019-12-03 22:34 ` [PATCH 5.3 059/135] can: flexcan: increase error counters if skb enqueueing via can_rx_offload_queue_sorted() fails Greg Kroah-Hartman
2019-12-03 22:35 ` [PATCH 5.3 060/135] x86/tsc: Respect tsc command line paraemeter for clocksource_tsc_early Greg Kroah-Hartman
2019-12-03 22:35 ` [PATCH 5.3 061/135] perf scripting engines: Iterate on tep event arrays directly Greg Kroah-Hartman
2019-12-03 22:35 ` [PATCH 5.3 062/135] can: mcp251x: mcp251x_restart_work_handler(): Fix potential force_quit race condition Greg Kroah-Hartman
2019-12-03 22:35 ` [PATCH 5.3 063/135] nvme-rdma: fix a segmentation fault during module unload Greg Kroah-Hartman
2019-12-03 22:35 ` [PATCH 5.3 064/135] nvme-multipath: fix crash in nvme_mpath_clear_ctrl_paths Greg Kroah-Hartman
2019-12-03 22:35 ` [PATCH 5.3 065/135] watchdog: pm8916_wdt: fix pretimeout registration flow Greg Kroah-Hartman
2019-12-03 22:35 ` [PATCH 5.3 066/135] watchdog: meson: Fix the wrong value of left time Greg Kroah-Hartman
2019-12-03 22:35 ` [PATCH 5.3 067/135] watchdog: imx_sc_wdt: Pretimeout should follow SCU firmware format Greg Kroah-Hartman
2019-12-03 22:35 ` [PATCH 5.3 068/135] watchdog: bd70528: Add MODULE_ALIAS to allow module auto loading Greg Kroah-Hartman
2019-12-03 22:35 ` [PATCH 5.3 069/135] ASoC: stm32: sai: add restriction on mmap support Greg Kroah-Hartman
2019-12-03 22:35 ` [PATCH 5.3 070/135] ALSA: hda: hdmi - add Tigerlake support Greg Kroah-Hartman
2019-12-03 22:35 ` [PATCH 5.3 071/135] ARM: dts: stm32: Fix CAN RAM mapping on stm32mp157c Greg Kroah-Hartman
2019-12-03 22:35 ` [PATCH 5.3 072/135] ASoC: SOF: topology: Fix bytes control size checks Greg Kroah-Hartman
2019-12-03 22:35 ` [PATCH 5.3 073/135] mm/gup_benchmark: fix MAP_HUGETLB case Greg Kroah-Hartman
2019-12-03 22:35 ` [PATCH 5.3 074/135] scripts/gdb: fix debugging modules compiled with hot/cold partitioning Greg Kroah-Hartman
2019-12-03 22:35 ` [PATCH 5.3 075/135] net: bcmgenet: use RGMII loopback for MAC reset Greg Kroah-Hartman
2019-12-03 22:35 ` [PATCH 5.3 076/135] net: bcmgenet: reapply manual settings to the PHY Greg Kroah-Hartman
2019-12-03 22:35 ` [PATCH 5.3 077/135] drm/amdgpu: dont schedule jobs while in reset Greg Kroah-Hartman
2019-12-03 22:35 ` [PATCH 5.3 078/135] net/mlx5e: Fix eswitch debug print of max fdb flow Greg Kroah-Hartman
2019-12-03 22:35 ` [PATCH 5.3 079/135] net/mlx5e: Use correct enum to determine uplink port Greg Kroah-Hartman
2019-12-03 22:35 ` [PATCH 5.3 080/135] net: mscc: ocelot: fix __ocelot_rmw_ix prototype Greg Kroah-Hartman
2019-12-03 22:35 ` [PATCH 5.3 081/135] drm/amd/swSMU: fix smu workload bit map error Greg Kroah-Hartman
2019-12-03 22:35 ` [PATCH 5.3 082/135] drm/amdgpu: register gpu instance before fan boost feature enablment Greg Kroah-Hartman
2019-12-03 22:35 ` [PATCH 5.3 083/135] drm/amdgpu: add warning for GRBM 1-cycle delay issue in gfx9 Greg Kroah-Hartman
2019-12-03 22:35 ` [PATCH 5.3 084/135] net: stmmac: gmac4: bitrev32 returns u32 Greg Kroah-Hartman
2019-12-03 22:35 ` [PATCH 5.3 085/135] net: stmmac: xgmac: " Greg Kroah-Hartman
2019-12-03 22:35 ` [PATCH 5.3 086/135] net: stmmac: xgmac: Fix TSA selection Greg Kroah-Hartman
2019-12-03 22:35 ` [PATCH 5.3 087/135] net: stmmac: xgmac: Disable Flow Control when 1 or more queues are in AV Greg Kroah-Hartman
2019-12-03 22:35 ` [PATCH 5.3 088/135] ceph: return -EINVAL if given fsc mount option on kernel w/o support Greg Kroah-Hartman
2019-12-03 22:35 ` [PATCH 5.3 089/135] mac80211: fix ieee80211_txq_setup_flows() failure path Greg Kroah-Hartman
2019-12-03 22:35 ` [PATCH 5.3 090/135] net/fq_impl: Switch to kvmalloc() for memory allocation Greg Kroah-Hartman
2019-12-03 22:35 ` [PATCH 5.3 091/135] mac80211: fix station inactive_time shortly after boot Greg Kroah-Hartman
2019-12-03 22:35 ` [PATCH 5.3 092/135] block: drbd: remove a stray unlock in __drbd_send_protocol() Greg Kroah-Hartman
2019-12-03 22:35 ` [PATCH 5.3 093/135] pwm: bcm-iproc: Prevent unloading the driver module while in use Greg Kroah-Hartman
2019-12-03 22:35 ` [PATCH 5.3 094/135] ice: fix potential infinite loop because loop counter being too small Greg Kroah-Hartman
2019-12-03 22:35 ` [PATCH 5.3 095/135] iavf: initialize ITRN registers with correct values Greg Kroah-Hartman
2019-12-03 22:35 ` [PATCH 5.3 096/135] i40e: Fix for ethtool -m issue on X722 NIC Greg Kroah-Hartman
2019-12-03 22:35 ` [PATCH 5.3 097/135] clk: at91: fix update bit maps on CFG_MOR write Greg Kroah-Hartman
2019-12-03 22:35 ` [PATCH 5.3 098/135] usb: dwc2: use a longer core rest timeout in dwc2_core_reset() Greg Kroah-Hartman
2019-12-03 22:35 ` [PATCH 5.3 099/135] staging: wilc1000: fix illegal memory access in wilc_parse_join_bss_param() Greg Kroah-Hartman
2019-12-03 22:35 ` [PATCH 5.3 100/135] staging: rtl8192e: fix potential use after free Greg Kroah-Hartman
2019-12-03 22:35 ` [PATCH 5.3 101/135] staging: rtl8723bs: Drop ACPI device ids Greg Kroah-Hartman
2019-12-03 22:35 ` [PATCH 5.3 102/135] staging: rtl8723bs: Add 024c:0525 to the list of SDIO device-ids Greg Kroah-Hartman
2019-12-03 22:35 ` [PATCH 5.3 103/135] USB: serial: ftdi_sio: add device IDs for U-Blox C099-F9P Greg Kroah-Hartman
2019-12-03 22:35 ` [PATCH 5.3 104/135] mei: bus: prefix device names on bus with the bus name Greg Kroah-Hartman
2019-12-03 22:35 ` [PATCH 5.3 105/135] mei: me: add comet point V device id Greg Kroah-Hartman
2019-12-03 22:35 ` [PATCH 5.3 106/135] thunderbolt: Power cycle the router if NVM authentication fails Greg Kroah-Hartman
2019-12-03 22:35 ` [PATCH 5.3 107/135] xfrm: Fix memleak on xfrm state destroy Greg Kroah-Hartman
2019-12-03 22:35 ` [PATCH 5.3 108/135] x86/fpu: Dont cache access to fpu_fpregs_owner_ctx Greg Kroah-Hartman
2019-12-03 22:35 ` [PATCH 5.3 109/135] gve: Fix the queue page list allocated pages count Greg Kroah-Hartman
2019-12-03 22:35 ` [PATCH 5.3 110/135] macvlan: schedule bc_work even if error Greg Kroah-Hartman
2019-12-03 22:35 ` [PATCH 5.3 111/135] mdio_bus: dont use managed reset-controller Greg Kroah-Hartman
2019-12-03 22:35 ` [PATCH 5.3 112/135] net: dsa: sja1105: fix sja1105_parse_rgmii_delays() Greg Kroah-Hartman
2019-12-03 22:35 ` [PATCH 5.3 113/135] net: macb: add missed tasklet_kill Greg Kroah-Hartman
2019-12-03 22:35 ` [PATCH 5.3 114/135] net: psample: fix skb_over_panic Greg Kroah-Hartman
2019-12-03 22:35 ` [PATCH 5.3 115/135] net: sched: fix `tc -s class show` no bstats on class with nolock subqueues Greg Kroah-Hartman
2019-12-03 22:35 ` [PATCH 5.3 116/135] openvswitch: fix flow command message size Greg Kroah-Hartman
2019-12-03 22:35 ` [PATCH 5.3 117/135] sctp: Fix memory leak in sctp_sf_do_5_2_4_dupcook Greg Kroah-Hartman
2019-12-03 22:35 ` [PATCH 5.3 118/135] slip: Fix use-after-free Read in slip_open Greg Kroah-Hartman
2019-12-03 22:35 ` [PATCH 5.3 119/135] sctp: cache netns in sctp_ep_common Greg Kroah-Hartman
2019-12-03 22:36 ` [PATCH 5.3 120/135] openvswitch: drop unneeded BUG_ON() in ovs_flow_cmd_build_info() Greg Kroah-Hartman
2019-12-03 22:36 ` [PATCH 5.3 121/135] openvswitch: remove another BUG_ON() Greg Kroah-Hartman
2019-12-03 22:36 ` [PATCH 5.3 122/135] net/tls: take into account that bpf_exec_tx_verdict() may free the record Greg Kroah-Hartman
2019-12-03 22:36 ` [PATCH 5.3 123/135] net/tls: free the record on encryption error Greg Kroah-Hartman
2019-12-03 22:36 ` [PATCH 5.3 124/135] net: skmsg: fix TLS 1.3 crash with full sk_msg Greg Kroah-Hartman
2019-12-03 22:36 ` [PATCH 5.3 125/135] selftests/tls: add a test for fragmented messages Greg Kroah-Hartman
2019-12-03 22:36 ` [PATCH 5.3 126/135] net/tls: remove the dead inplace_crypto code Greg Kroah-Hartman
2019-12-03 22:36 ` [PATCH 5.3 127/135] net/tls: use sg_next() to walk sg entries Greg Kroah-Hartman
2019-12-03 22:36 ` [PATCH 5.3 128/135] selftests: bpf: test_sockmap: handle file creation failures gracefully Greg Kroah-Hartman
2019-12-03 22:36 ` [PATCH 5.3 129/135] selftests: bpf: correct perror strings Greg Kroah-Hartman
2019-12-03 22:36 ` [PATCH 5.3 130/135] tipc: fix link name length check Greg Kroah-Hartman
2019-12-03 22:36 ` [PATCH 5.3 131/135] selftests: pmtu: use -oneline for ip route list cache Greg Kroah-Hartman
2019-12-03 22:36 ` [PATCH 5.3 132/135] ext4: add more paranoia checking in ext4_expand_extra_isize handling Greg Kroah-Hartman
2019-12-03 22:36 ` [PATCH 5.3 133/135] HID: core: check whether Usage Page item is after Usage ID items Greg Kroah-Hartman
2019-12-03 22:36 ` [PATCH 5.3 134/135] platform/x86: hp-wmi: Fix ACPI errors caused by too small buffer Greg Kroah-Hartman
2019-12-03 22:36 ` [PATCH 5.3 135/135] platform/x86: hp-wmi: Fix ACPI errors caused by passing 0 as input size Greg Kroah-Hartman
2019-12-04 10:06 ` [PATCH 5.3 000/135] 5.3.15-stable review Jon Hunter
2019-12-04 17:53 ` shuah
2019-12-04 19:05 ` Guenter Roeck
2019-12-04 19:13 ` Naresh Kamboju

LKML Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/lkml/0 lkml/git/0.git
	git clone --mirror https://lore.kernel.org/lkml/1 lkml/git/1.git
	git clone --mirror https://lore.kernel.org/lkml/2 lkml/git/2.git
	git clone --mirror https://lore.kernel.org/lkml/3 lkml/git/3.git
	git clone --mirror https://lore.kernel.org/lkml/4 lkml/git/4.git
	git clone --mirror https://lore.kernel.org/lkml/5 lkml/git/5.git
	git clone --mirror https://lore.kernel.org/lkml/6 lkml/git/6.git
	git clone --mirror https://lore.kernel.org/lkml/7 lkml/git/7.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 lkml lkml/ https://lore.kernel.org/lkml \
		linux-kernel@vger.kernel.org
	public-inbox-index lkml

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.linux-kernel


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git