linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH 4.9 000/271] 4.9.212-stable review
@ 2020-01-28 14:02 Greg Kroah-Hartman
  2020-01-28 14:02 ` [PATCH 4.9 001/271] xfs: Sanity check flags of Q_XQUOTARM call Greg Kroah-Hartman
                   ` (275 more replies)
  0 siblings, 276 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:02 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, torvalds, akpm, linux, shuah, patches,
	ben.hutchings, lkft-triage, stable

This is the start of the stable review cycle for the 4.9.212 release.
There are 271 patches in this series, all will be posted as a response
to this one.  If anyone has any issues with these being applied, please
let me know.

Responses should be made by Thu, 30 Jan 2020 13:57:09 +0000.
Anything received after that time might be too late.

The whole patch series can be found in one patch at:
	https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.212-rc1.gz
or in the git tree and branch at:
	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Linux 4.9.212-rc1

Martin Schiller <ms@dev.tdt.de>
    net/x25: fix nonblocking connect

Kadlecsik József <kadlec@blackhole.kfki.hu>
    netfilter: ipset: use bitmap infrastructure completely

Andy Shevchenko <andriy.shevchenko@linux.intel.com>
    bitmap: Add bitmap_alloc(), bitmap_zalloc() and bitmap_free()

Andy Shevchenko <andriy.shevchenko@linux.intel.com>
    md: Avoid namespace collision with bitmap API

Bo Wu <wubo40@huawei.com>
    scsi: iscsi: Avoid potential deadlock in iscsi_if_rx func

Dan Carpenter <dan.carpenter@oracle.com>
    bcache: silence static checker warning

Wen Huang <huangwenabc@gmail.com>
    libertas: Fix two buffer overflows at parsing bss descriptor

Suzuki K Poulose <suzuki.poulose@arm.com>
    coresight: tmc-etf: Do not call smp_processor_id from preemptible

Suzuki K Poulose <suzuki.poulose@arm.com>
    coresight: etb10: Do not call smp_processor_id from preemptible

Will Deacon <will.deacon@arm.com>
    arm64: kpti: Whitelist Cortex-A CPUs that don't implement the CSV3 field

Jeremy Linton <jeremy.linton@arm.com>
    Documentation: Document arm64 kpti control

Al Viro <viro@zeniv.linux.org.uk>
    do_last(): fetch directory ->i_mode and ->i_uid before it's too late

Changbin Du <changbin.du@gmail.com>
    tracing: xen: Ordered comparison of function pointers

Bart Van Assche <bvanassche@acm.org>
    scsi: RDMA/isert: Fix a recently introduced regression related to logout

Gilles Buloz <gilles.buloz@kontron.com>
    hwmon: (nct7802) Fix voltage limits to wrong registers

Chuhong Yuan <hslester96@gmail.com>
    Input: sun4i-ts - add a check for devm_thermal_zone_of_sensor_register

Johan Hovold <johan@kernel.org>
    Input: pegasus_notetaker - fix endpoint sanity check

Johan Hovold <johan@kernel.org>
    Input: aiptek - fix endpoint sanity check

Johan Hovold <johan@kernel.org>
    Input: gtco - fix endpoint sanity check

Johan Hovold <johan@kernel.org>
    Input: sur40 - fix interface sanity checks

Michał Mirosław <mirq-linux@rere.qmqm.pl>
    mmc: sdhci: fix minimum clock rate for v3 controller

Michał Mirosław <mirq-linux@rere.qmqm.pl>
    mmc: tegra: fix SDR50 tuning override

Alex Sverdlin <alexander.sverdlin@nokia.com>
    ARM: 8950/1: ftrace/recordmcount: filter relocation types

Johan Hovold <johan@kernel.org>
    Input: keyspan-remote - fix control-message timeouts

Guenter Roeck <linux@roeck-us.net>
    hwmon: (core) Do not use device managed functions for memory allocations

Dmitry Osipenko <digetx@gmail.com>
    hwmon: (core) Fix double-free in __hwmon_device_register()

Linus Walleij <linus.walleij@linaro.org>
    hwmon: Deal with errors from the thermal subsystem

Guenter Roeck <linux@roeck-us.net>
    hwmon: (core) Simplify sysfs attribute name allocation

Luuk Paulussen <luuk.paulussen@alliedtelesis.co.nz>
    hwmon: (adt7475) Make volt2reg return same reg as reg2volt input

Eric Dumazet <edumazet@google.com>
    gtp: make sure only SOCK_DGRAM UDP sockets are accepted

James Hughes <james.hughes@raspberrypi.org>
    net: usb: lan78xx: Add .ndo_features_check

Wen Yang <wenyang@linux.alibaba.com>
    tcp_bbr: improve arithmetic division in bbr_update_bw()

Cong Wang <xiyou.wangcong@gmail.com>
    net_sched: fix datalen for ematch

William Dauchy <w.dauchy@criteo.com>
    net, ip_tunnel: fix namespaces move

William Dauchy <w.dauchy@criteo.com>
    net, ip6_tunnel: fix namespaces move

Michael Ellerman <mpe@ellerman.id.au>
    net: cxgb3_main: Add CAP_NET_ADMIN check to CHELSIO_GET_MEM

Wenwen Wang <wenwen@cs.uga.edu>
    firestream: fix memory leaks

Richard Palethorpe <rpalethorpe@suse.com>
    can, slip: Protect tty->disc_data in write_wakeup and close with RCU

Florian Fainelli <f.fainelli@gmail.com>
    net: phy: Keep reporting transceiver type

Florian Fainelli <f.fainelli@gmail.com>
    net: ethtool: Add back transceiver type

Finn Thain <fthain@telegraphics.com.au>
    m68k: Call timer_interrupt() with interrupts disabled

Max Gurtovoy <maxg@mellanox.com>
    IB/iser: Fix dma_nents type definition

Andre Przywara <andre.przywara@arm.com>
    arm64: dts: juno: Fix UART frequency

Sam Bobroff <sbobroff@linux.ibm.com>
    drm/radeon: fix bad DMA from INTERRUPT_CNTL2

Chuhong Yuan <hslester96@gmail.com>
    dmaengine: ti: edma: fix missed failure handling

Eric Dumazet <edumazet@google.com>
    packet: fix data-race in fanout_flow_is_huge()

Eric Dumazet <edumazet@google.com>
    net: neigh: use long type to store jiffies delta

Tiezhu Yang <yangtiezhu@loongson.cn>
    MIPS: Loongson: Fix return value of loongson_hwmon_init

Janusz Krzysztofik <jmkrzyszt@gmail.com>
    media: ov6650: Fix .get_fmt() V4L2_SUBDEV_FORMAT_TRY support

Janusz Krzysztofik <jmkrzyszt@gmail.com>
    media: ov6650: Fix some format attributes not under control

Janusz Krzysztofik <jmkrzyszt@gmail.com>
    media: ov6650: Fix incorrect use of JPEG colorspace

Marc Dionne <marc.dionne@auristor.com>
    afs: Fix large file support

Stefan Wahren <stefan.wahren@in-tech.com>
    net: qca_spi: Move reset_count to struct qcaspi

Jakub Kicinski <jakub.kicinski@netronome.com>
    net: netem: correct the parent's backlog when corrupted packet was dropped

Jakub Kicinski <jakub.kicinski@netronome.com>
    net: netem: fix error path for corrupted GSO frames

Robin Gong <yibin.gong@nxp.com>
    dmaengine: imx-sdma: fix size check for sdma script_number

Jeffrey Hugo <jeffrey.l.hugo@gmail.com>
    drm/msm/dsi: Implement reset correctly

YueHaibing <yuehaibing@huawei.com>
    act_mirred: Fix mirred_init_module error handling

Antonio Borneo <antonio.borneo@st.com>
    net: stmmac: fix length of PTP clock's name string

Eric Biggers <ebiggers@google.com>
    llc: fix sk_buff refcounting in llc_conn_state_process()

Eric Biggers <ebiggers@google.com>
    llc: fix another potential sk_buff leak in llc_ui_sendmsg()

Johannes Berg <johannes.berg@intel.com>
    mac80211: accept deauth frames in IBSS mode

Jose Abreu <Jose.Abreu@synopsys.com>
    net: stmmac: gmac4+: Not all Unicast addresses may be available

Ard Biesheuvel <ard.biesheuvel@linaro.org>
    nvme: retain split access workaround for capability reads

Dan Carpenter <dan.carpenter@oracle.com>
    net: ethernet: stmmac: Fix signedness bug in ipq806x_gmac_of_parse()

Dan Carpenter <dan.carpenter@oracle.com>
    of: mdio: Fix a signedness bug in of_phy_get_and_connect()

Dan Carpenter <dan.carpenter@oracle.com>
    net: stmmac: dwmac-meson8b: Fix signedness bug in probe

Dan Carpenter <dan.carpenter@oracle.com>
    net: broadcom/bcmsysport: Fix signedness in bcm_sysport_probe()

Dan Carpenter <dan.carpenter@oracle.com>
    net: hisilicon: Fix signedness bug in hix5hd2_dev_probe()

Filippo Sironi <sironi@amazon.de>
    iommu/amd: Wait for completion of IOTLB flush in attach_device

Gerd Rausch <gerd.rausch@oracle.com>
    net/rds: Fix 'ib_evt_handler_call' element in 'rds_ib_stat_names'

Mao Wenan <maowenan@huawei.com>
    net: sonic: replace dev_kfree_skb in sonic_send_packet

Dan Robertson <dan@dlrobertson.com>
    hwmon: (shtc1) fix shtc1 and shtw1 id mask

Filipe Manana <fdmanana@suse.com>
    Btrfs: fix hang when loading existing inode cache off disk

Mao Wenan <maowenan@huawei.com>
    net: sonic: return NETDEV_TX_OK if failed to map buffer

Lorenzo Bianconi <lorenzo@kernel.org>
    ath9k: dynack: fix possible deadlock in ath_dynack_node_{de}init

Colin Ian King <colin.king@canonical.com>
    iio: dac: ad5380: fix incorrect assignment to val

Colin Ian King <colin.king@canonical.com>
    bcma: fix incorrect update of BCMA_CORE_PCI_MDIO_DATA

Dan Carpenter <dan.carpenter@oracle.com>
    staging: greybus: light: fix a couple double frees

Masami Hiramatsu <mhiramat@kernel.org>
    x86, perf: Fix the dependency of the x86 insn decoder selftest

Stephen Boyd <swboyd@chromium.org>
    power: supply: Init device wakeup after device_add()

Guenter Roeck <linux@roeck-us.net>
    hwmon: (lm75) Fix write operations for negative temperatures

Linus Torvalds <torvalds@linux-foundation.org>
    Partially revert "kfifo: fix kfifo_alloc() and kfifo_init()"

Andy Shevchenko <andriy.shevchenko@linux.intel.com>
    ahci: Do not export local variable ahci_em_messages

Nick Desaulniers <ndesaulniers@google.com>
    mips: avoid explicit UB in assignment of mips_io_port_base

Felix Fietkau <nbd@nbd.name>
    mac80211: minstrel_ht: fix per-group max throughput rate initialization

Andy Shevchenko <andriy.shevchenko@linux.intel.com>
    dmaengine: dw: platform: Switch to acpi_dma_controller_register()

Maxime Ripard <maxime.ripard@bootlin.com>
    ASoC: sun4i-i2s: RX and TX counter registers are swapped

Eric W. Biederman <ebiederm@xmission.com>
    signal: Allow cifs and drbd to receive their terminating signals

YueHaibing <yuehaibing@huawei.com>
    ASoC: wm8737: Fix copy-paste error in wm8737_snd_controls

YueHaibing <yuehaibing@huawei.com>
    ASoC: cs4349: Use PM ops 'cs4349_runtime_pm'

YueHaibing <yuehaibing@huawei.com>
    ASoC: es8328: Fix copy-paste error in es8328_right_line_controls

Colin Ian King <colin.king@canonical.com>
    ext4: set error return correctly when ext4_htree_store_dirent fails

Iuliana Prodan <iuliana.prodan@nxp.com>
    crypto: caam - free resources in case caam_rng registration failed

Steve French <stfrench@microsoft.com>
    cifs: fix rmmod regression in cifs.ko caused by force_sig changes

Mark Zhang <markz@mellanox.com>
    net/mlx5: Fix mlx5_ifc_query_lag_out_bits

Johannes Berg <johannes@sipsolutions.net>
    ALSA: aoa: onyx: always initialize register read value

Thomas Gleixner <tglx@linutronix.de>
    x86/kgbd: Use NMI_VECTOR not APIC_DM_NMI

Arnd Bergmann <arnd@arndb.de>
    mic: avoid statically declaring a 'struct device'.

Ruslan Bilovol <ruslan.bilovol@gmail.com>
    usb: host: xhci-hub: fix extra endianness conversion

Arnd Bergmann <arnd@arndb.de>
    qed: reduce maximum stack frame size

YueHaibing <yuehaibing@huawei.com>
    libertas_tf: Use correct channel range in lbtf_geo_init

Colin Ian King <colin.king@canonical.com>
    scsi: libfc: fix null pointer dereference on a null lport

Wen Yang <wen.yang99@zte.com.cn>
    net: pasemi: fix an use-after-free in pasemi_mac_phy_init()

Xi Wang <wangxi11@huawei.com>
    RDMA/hns: Fixs hw access invalid dma memory error

Arnd Bergmann <arnd@arndb.de>
    devres: allow const resource arguments

David Howells <dhowells@redhat.com>
    rxrpc: Fix uninitialized error code in rxrpc_send_data_packet()

Andy Shevchenko <andriy.shevchenko@linux.intel.com>
    mfd: intel-lpss: Release IDA resources

Kevin Mitchell <kevmitch@arista.com>
    iommu/amd: Make iommu_disable safer

Nathan Huckleberry <nhuck@google.com>
    clk: qcom: Fix -Wunused-const-variable

Andy Shevchenko <andriy.shevchenko@linux.intel.com>
    dmaengine: hsu: Revert "set HSU_CH_MTSR to memory width"

Ravi Bangoria <ravi.bangoria@linux.ibm.com>
    perf/ioctl: Add check for the sample_period value

Rob Clark <robdclark@chromium.org>
    drm/msm/a3xx: remove TPL1 regs from snapshot

Chen-Yu Tsai <wens@csie.org>
    rtc: pcf8563: Clear event flags and disable interrupts before requesting irq

Peter Ujfalusi <peter.ujfalusi@ti.com>
    ASoC: ti: davinci-mcasp: Fix slot mask settings when using multiple AXRs

Julian Wiedmann <jwi@linux.ibm.com>
    net/af_iucv: always register net_device notifier

Jakub Kicinski <jakub.kicinski@netronome.com>
    net: netem: fix backlog accounting for corrupted GSO frames

Jeffrey Hugo <jeffrey.l.hugo@gmail.com>
    drm/msm/mdp5: Fix mdp5_cfg_init error return

Nathan Lynch <nathanl@linux.ibm.com>
    powerpc/cacheinfo: add cacheinfo_teardown, cacheinfo_rebuild

Colin Ian King <colin.king@canonical.com>
    media: vivid: fix incorrect assignment operation when setting video mode

Eric Dumazet <edumazet@google.com>
    inet: frags: call inet_frags_fini() after unregister_pernet_subsys()

Eric W. Biederman <ebiederm@xmission.com>
    signal/cifs: Fix cifs_put_tcp_session to call send_sig instead of force_sig

Lu Baolu <baolu.lu@linux.intel.com>
    iommu: Use right function to get group for device

Nathan Chancellor <natechancellor@gmail.com>
    misc: sgi-xp: Properly initialize buf in xpc_get_rsvd_page_pa

Erwan Le Ray <erwan.leray@st.com>
    serial: stm32: fix transmit_chars when tx is stopped

Hook, Gary <Gary.Hook@amd.com>
    crypto: ccp - fix AES CFB error exposed by new test vectors

Christophe Leroy <christophe.leroy@c-s.fr>
    spi: spi-fsl-spi: call spi_finalize_current_message() at the end

Jon Hunter <jonathanh@nvidia.com>
    dmaengine: tegra210-adma: Fix crash during probe

Matthias Kaehlcke <mka@chromium.org>
    thermal: cpu_cooling: Actually trace CPU load in thermal_power_cpu_get_power

Brian Masney <masneyb@onstation.org>
    backlight: lm3630a: Return 0 on success in update_status functions

Dan Carpenter <dan.carpenter@oracle.com>
    kdb: do a sanity check on the cpu in kdb_per_cpu()

Russell King <rmk+kernel@armlinux.org.uk>
    ARM: riscpc: fix lack of keyboard interrupts after irq conversion

Bichao Zheng <bichao.zheng@amlogic.com>
    pwm: meson: Don't disable PWM when setting duty repeatedly

Florian Westphal <fw@strlen.de>
    netfilter: ebtables: CONFIG_COMPAT: reject trailing data after last rule

Dan Carpenter <dan.carpenter@oracle.com>
    platform/x86: alienware-wmi: printing the wrong error code

Dan Carpenter <dan.carpenter@oracle.com>
    media: davinci/vpbe: array underflow in vpbe_enum_outputs()

Dan Carpenter <dan.carpenter@oracle.com>
    media: omap_vout: potential buffer overflow in vidioc_dqbuf()

YueHaibing <yuehaibing@huawei.com>
    l2tp: Fix possible NULL pointer dereference

Sameer Pujar <spujar@nvidia.com>
    dmaengine: tegra210-adma: restore channel status

Sameeh Jubran <sameehj@amazon.com>
    net: ena: fix ena_com_fill_hash_function() implementation

Sameeh Jubran <sameehj@amazon.com>
    net: ena: fix incorrect test of supported hash function

Sameeh Jubran <sameehj@amazon.com>
    net: ena: fix: Free napi resources when ena_up() fails

Sameeh Jubran <sameehj@amazon.com>
    net: ena: fix swapped parameters when calling ena_com_indirect_table_fill_entry

Lu Baolu <baolu.lu@linux.intel.com>
    iommu/vt-d: Make kernel parameter igfx_off work with vIOMMU

Jack Morgenstein <jackm@dev.mellanox.co.il>
    IB/mlx5: Add missing XRC options to QP optional params mask

Arnd Bergmann <arnd@arndb.de>
    usb: gadget: fsl: fix link error against usb-gadget module

Jerome Brunet <jbrunet@baylibre.com>
    ASoC: fix valid stream condition

Willem de Bruijn <willemb@google.com>
    packet: in recvmsg msg_name return at least sizeof sockaddr_ll

Takashi Iwai <tiwai@suse.de>
    ALSA: usb-audio: Handle the error from snd_usb_mixer_apply_create_quirk()

Alexandru Ardelean <alexandru.ardelean@analog.com>
    dmaengine: axi-dmac: Don't check the number of frames for alignment

Dan Carpenter <dan.carpenter@oracle.com>
    6lowpan: Off by one handling ->nexthdr

Akinobu Mita <akinobu.mita@gmail.com>
    media: ov2659: fix unbalanced mutex_lock/unlock

Vladimir Oltean <olteanv@gmail.com>
    ARM: dts: ls1021: Fix SGMII PCS link remaining down after PHY disconnect

Ben Hutchings <ben@decadent.org.uk>
    powerpc: vdso: Make vdso32 installation conditional in vdso_install

Jie Liu <liujie165@huawei.com>
    tipc: set sysctl_tipc_rmem and named_timeout right range

Guenter Roeck <linux@roeck-us.net>
    hwmon: (w83627hf) Use request_muxed_region for Super-IO accesses

YueHaibing <yuehaibing@huawei.com>
    ARM: pxa: ssp: Fix "WARNING: invalid free of devm_ allocated data"

Bart Van Assche <bvanassche@acm.org>
    scsi: qla2xxx: Unregister chrdev if module initialization fails

YueHaibing <yuehaibing@huawei.com>
    ehea: Fix a copy-paste err in ehea_init_port_res

Martin Sperl <kernel@martin.sperl.org>
    spi: bcm2835aux: fix driver to not allow 65535 (=-1) cs-gpios

Dan Carpenter <dan.carpenter@oracle.com>
    soc/fsl/qe: Fix an error code in qe_pin_request()

Sowjanya Komatineni <skomatineni@nvidia.com>
    spi: tegra114: fix for unpacked mode transfers

Sowjanya Komatineni <skomatineni@nvidia.com>
    spi: tegra114: clear packed bit for unpacked mode

YueHaibing <yuehaibing@huawei.com>
    media: tw5864: Fix possible NULL pointer dereference in tw5864_handle_frame

Arnd Bergmann <arnd@arndb.de>
    media: davinci-isif: avoid uninitialized variable use

Tony Lindgren <tony@atomide.com>
    ARM: OMAP2+: Fix potentially uninitialized return value for _setup_reset()

Finn Thain <fthain@telegraphics.com.au>
    m68k: mac: Fix VIA timer counter accesses

Jon Maloy <jon.maloy@ericsson.com>
    tipc: tipc clang warning

Arnd Bergmann <arnd@arndb.de>
    jfs: fix bogus variable self-initialization

Axel Lin <axel.lin@ingics.com>
    regulator: tps65086: Fix tps65086_ldoa1_ranges for selector 0xB

Nicholas Mc Guire <hofrat@osadl.org>
    media: cx23885: check allocation return

Dan Carpenter <dan.carpenter@oracle.com>
    media: wl128x: Fix an error code in fm_download_firmware()

Dan Carpenter <dan.carpenter@oracle.com>
    media: cx18: update *pos correctly in cx18_read_pos()

Dan Carpenter <dan.carpenter@oracle.com>
    media: ivtv: update *pos correctly in ivtv_read_pos()

Kangjie Lu <kjlu@umn.edu>
    net: sh_eth: fix a missing check of of_get_phy_mode

Dan Carpenter <dan.carpenter@oracle.com>
    xen, cpu_hotplug: Prevent an out of bounds access

Dan Carpenter <dan.carpenter@oracle.com>
    drivers/rapidio/rio_cm.c: fix potential oops in riocm_ch_listen()

Steve Sistare <steven.sistare@oracle.com>
    scsi: megaraid_sas: reduce module load time

Guenter Roeck <linux@roeck-us.net>
    nios2: ksyms: Add missing symbol exports

Axel Lin <axel.lin@ingics.com>
    regulator: wm831x-dcdc: Fix list of wm831x_dcdc_ilim from mA to uA

Vladimir Murzin <vladimir.murzin@arm.com>
    ARM: 8848/1: virt: Align GIC version check with arm64 counterpart

Marek Szyprowski <m.szyprowski@samsung.com>
    ARM: 8847/1: pm: fix HYP/SVC mode mismatch when MCPM is used

Stefan Wahren <stefan.wahren@i2se.com>
    mmc: sdhci-brcmstb: handle mmc_of_parse() errors during probe

Marek Szyprowski <m.szyprowski@samsung.com>
    clocksource/drivers/exynos_mct: Fix error path in timer resources initialization

Chen-Yu Tsai <wens@csie.org>
    clocksource/drivers/sun5i: Fail gracefully when clock rate is unavailable

Trond Myklebust <trond.myklebust@hammerspace.com>
    NFS: Fix a soft lockup in the delegation recovery code

Eric W. Biederman <ebiederm@xmission.com>
    fs/nfs: Fix nfs_parse_devname to not modify it's argument

Takashi Iwai <tiwai@suse.de>
    ASoC: qcom: Fix of-node refcount unbalance in apq8016_sbc_parse_of()

Colin Ian King <colin.king@canonical.com>
    drm/nouveau/pmu: don't print reply values if exec is false

Colin Ian King <colin.king@canonical.com>
    drm/nouveau/bios/ramcfg: fix missing parentheses when calculating RON

Vinod Koul <vkoul@kernel.org>
    net: dsa: qca8k: Enable delay for RGMII_ID mode

Axel Lin <axel.lin@ingics.com>
    regulator: pv88090: Fix array out-of-bounds access

Axel Lin <axel.lin@ingics.com>
    regulator: pv88080: Fix array out-of-bounds access

Axel Lin <axel.lin@ingics.com>
    regulator: pv88060: Fix array out-of-bounds access

YueHaibing <yuehaibing@huawei.com>
    cdc-wdm: pass return value of recover_from_urb_loss

Robin Murphy <robin.murphy@arm.com>
    dmaengine: mv_xor: Use correct device for DMA API

Eric Auger <eric.auger@redhat.com>
    vfio_pci: Enable memory accesses before calling pci_map_rom

David Howells <dhowells@redhat.com>
    keys: Timestamp new keys

Ming Lei <ming.lei@redhat.com>
    block: don't use bio->bi_vcnt to figure out segment number

Sven Van Asbroeck <thesven73@gmail.com>
    usb: phy: twl6030-usb: fix possible use-after-free on remove

Geert Uytterhoeven <geert+renesas@glider.be>
    pinctrl: sh-pfc: sh73a0: Fix fsic_spdif pin groups

Geert Uytterhoeven <geert+renesas@glider.be>
    pinctrl: sh-pfc: r8a7792: Fix vin1_data18_b pin group

Geert Uytterhoeven <geert+renesas@glider.be>
    pinctrl: sh-pfc: r8a7791: Fix scifb2_data_c pin group

Geert Uytterhoeven <geert+renesas@glider.be>
    pinctrl: sh-pfc: emev2: Add missing pinmux functions

Steve Wise <swise@opengridcomputing.com>
    iw_cxgb4: use tos when finding ipv6 routes

Steve Wise <swise@opengridcomputing.com>
    iw_cxgb4: use tos when importing the endpoint

YueHaibing <yuehaibing@huawei.com>
    fbdev: chipsfb: remove set but not used variable 'size'

Colin Ian King <colin.king@canonical.com>
    rtc: pm8xxx: fix unintended sign extension

Colin Ian King <colin.king@canonical.com>
    rtc: 88pm80x: fix unintended sign extension

Colin Ian King <colin.king@canonical.com>
    rtc: 88pm860x: fix unintended sign extension

Moritz Fischer <mdf@kernel.org>
    net: phy: fixed_phy: Fix fixed_phy not checking GPIO

Michael Kao <michael.kao@mediatek.com>
    thermal: mediatek: fix register index error

Colin Ian King <colin.king@canonical.com>
    rtc: ds1672: fix unintended sign extension

Colin Ian King <colin.king@canonical.com>
    staging: most: cdev: add missing check for cdev_add failure

Sara Sharon <sara.sharon@intel.com>
    iwlwifi: mvm: fix RSS config command

Vladimir Zapolskiy <vz@mleia.com>
    ARM: dts: lpc32xx: phy3250: fix SD card regulator voltage

Vladimir Zapolskiy <vz@mleia.com>
    ARM: dts: lpc32xx: fix ARM PrimeCell LCD controller clocks property

Vladimir Zapolskiy <vz@mleia.com>
    ARM: dts: lpc32xx: fix ARM PrimeCell LCD controller variant

Vladimir Zapolskiy <vz@mleia.com>
    ARM: dts: lpc32xx: reparent keypad controller to SIC1

Vladimir Zapolskiy <vz@mleia.com>
    ARM: dts: lpc32xx: add required clocks property to keypad device node

Corentin Labbe <clabbe@baylibre.com>
    crypto: crypto4xx - Fix wrong ppc4xx_trng_probe()/ppc4xx_trng_remove() arguments

YueHaibing <yuehaibing@huawei.com>
    tty: ipwireless: Fix potential NULL pointer dereference

Johannes Berg <johannes.berg@intel.com>
    iwlwifi: mvm: fix A-MPDU reference assignment

Chen-Yu Tsai <wens@csie.org>
    clk: sunxi-ng: sun8i-a23: Enable PLL-MIPI LDOs when ungating it

Eric Wong <e@80x24.org>
    rtc: cmos: ignore bogus century byte

Israel Rukshin <israelr@mellanox.com>
    IB/iser: Pass the correct number of entries for dma mapped SGL

Stefan Agner <stefan@agner.ch>
    ASoC: imx-sgtl5000: put of nodes if finding codec fails

Eric Biggers <ebiggers@google.com>
    crypto: tgr192 - fix unaligned memory access

Pawe? Chmiel <pawel.mikolaj.chmiel@gmail.com>
    media: s5p-jpeg: Correct step and max values for V4L2_CID_JPEG_RESTART_INTERVAL

Dan Carpenter <dan.carpenter@oracle.com>
    drm/etnaviv: NULL vs IS_ERR() buf in etnaviv_core_dump()

Loic Poulain <loic.poulain@linaro.org>
    arm64: dts: apq8016-sbc: Increase load on l11 for SDCARD

Gal Pressman <galpress@amazon.com>
    RDMA/qedr: Fix out of bounds index check in query pkey

Gal Pressman <galpress@amazon.com>
    RDMA/ocrdma: Fix out of bounds index check in query pkey

Gal Pressman <galpress@amazon.com>
    IB/usnic: Fix out of bounds index check in query pkey

Yangtao Li <tiny.windzz@gmail.com>
    clk: dove: fix refcount leak in dove_clk_init()

Yangtao Li <tiny.windzz@gmail.com>
    clk: armada-xp: fix refcount leak in axp_clk_init()

Yangtao Li <tiny.windzz@gmail.com>
    clk: kirkwood: fix refcount leak in kirkwood_clk_init()

Yangtao Li <tiny.windzz@gmail.com>
    clk: armada-370: fix refcount leak in a370_clk_init()

Yangtao Li <tiny.windzz@gmail.com>
    clk: vf610: fix refcount leak in vf610_clocks_init()

Yangtao Li <tiny.windzz@gmail.com>
    clk: imx7d: fix refcount leak in imx7d_clocks_init()

Yangtao Li <tiny.windzz@gmail.com>
    clk: imx6sx: fix refcount leak in imx6sx_clocks_init()

Yangtao Li <tiny.windzz@gmail.com>
    clk: imx6q: fix refcount leak in imx6q_clocks_init()

Yangtao Li <tiny.windzz@gmail.com>
    clk: samsung: exynos4: fix refcount leak in exynos4_get_xom()

Yangtao Li <tiny.windzz@gmail.com>
    clk: socfpga: fix refcount leak

Yangtao Li <tiny.windzz@gmail.com>
    clk: qoriq: fix refcount leak in clockgen_init()

Yangtao Li <tiny.windzz@gmail.com>
    clk: highbank: fix refcount leak in hb_clk_init()

Dan Carpenter <dan.carpenter@oracle.com>
    Input: nomadik-ske-keypad - fix a loop timeout test

Geert Uytterhoeven <geert+renesas@glider.be>
    pinctrl: sh-pfc: sh7734: Remove bogus IPSR10 value

Geert Uytterhoeven <geert+renesas@glider.be>
    pinctrl: sh-pfc: sh7269: Add missing PCIOR0 field

Geert Uytterhoeven <geert+renesas@glider.be>
    pinctrl: sh-pfc: sh7734: Add missing IPSR11 field

Geert Uytterhoeven <geert+renesas@glider.be>
    pinctrl: sh-pfc: r8a7794: Remove bogus IPSR9 field

Geert Uytterhoeven <geert+renesas@glider.be>
    pinctrl: sh-pfc: sh73a0: Add missing TO pin to tpu4_to3 group

Geert Uytterhoeven <geert+renesas@glider.be>
    pinctrl: sh-pfc: r8a7791: Remove bogus marks from vin1_b_data18 group

Geert Uytterhoeven <geert+renesas@glider.be>
    pinctrl: sh-pfc: r8a7791: Remove bogus ctrl marks from qspi_data4_b group

Geert Uytterhoeven <geert+renesas@glider.be>
    pinctrl: sh-pfc: r8a7740: Add missing LCD0 marks to lcd0_data24_1 group

Geert Uytterhoeven <geert+renesas@glider.be>
    pinctrl: sh-pfc: r8a7740: Add missing REF125CK pin to gether_gmii group

Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
    net: phy: Fix not to call phy_resume() if PHY is not attached

Lyude Paul <lyude@redhat.com>
    drm/dp_mst: Skip validating ports during destruction, just ref

YueHaibing <yuehaibing@huawei.com>
    exportfs: fix 'passing zero to ERR_PTR()' warning

Colin Ian King <colin.king@canonical.com>
    pcrypt: use format specifier in kobject_add

Petr Machata <petrm@mellanox.com>
    mlxsw: reg: QEEC: Add minimum shaper fields

Hans de Goede <hdegoede@redhat.com>
    pwm: lpss: Release runtime-pm reference from the driver's remove callback

Spencer E. Olson <olsonse@umich.edu>
    staging: comedi: ni_mio_common: protect register write overflow

Nicolas Huaman <nicolas@herochao.de>
    ALSA: usb-audio: update quirk for B&W PX to remove microphone

Zhu Yanjun <yanjun.zhu@oracle.com>
    IB/rxe: replace kvfree with vfree

Anders Roxell <anders.roxell@linaro.org>
    ALSA: hda: fix unused variable warning

Dan Carpenter <dan.carpenter@oracle.com>
    drm/virtio: fix bounds check in virtio_gpu_cmd_get_capset()

Peter Rosin <peda@axentia.se>
    drm/sti: do not remove the drm_bridge that was never added

Lorenzo Bianconi <lorenzo@kernel.org>
    mt7601u: fix bbp version check in mt7601u_wait_bbp_ready

Ard Biesheuvel <ardb@kernel.org>
    powerpc/archrandom: fix arch_get_random_seed_int()

Jan Kara <jack@suse.cz>
    xfs: Sanity check flags of Q_XQUOTARM call


-------------

Diffstat:

 Documentation/kernel-parameters.txt                |   6 ++
 Makefile                                           |   4 +-
 arch/arm/boot/dts/lpc3250-phy3250.dts              |   4 +-
 arch/arm/boot/dts/lpc32xx.dtsi                     |  10 +-
 arch/arm/boot/dts/ls1021a-twr.dts                  |   9 +-
 arch/arm/boot/dts/ls1021a.dtsi                     |  11 +-
 arch/arm/common/mcpm_entry.c                       |   2 +-
 arch/arm/include/asm/suspend.h                     |   1 +
 arch/arm/kernel/hyp-stub.S                         |   4 +-
 arch/arm/kernel/sleep.S                            |  12 +++
 arch/arm/mach-omap2/omap_hwmod.c                   |   2 +-
 arch/arm/mach-rpc/irq.c                            |   3 +-
 arch/arm/plat-pxa/ssp.c                            |   6 --
 arch/arm64/boot/dts/arm/juno-clocks.dtsi           |   4 +-
 arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi          |   2 +
 arch/arm64/kernel/cpufeature.c                     |   5 +
 arch/m68k/amiga/cia.c                              |   9 ++
 arch/m68k/atari/ataints.c                          |   4 +-
 arch/m68k/atari/time.c                             |  15 ++-
 arch/m68k/bvme6000/config.c                        |  20 ++--
 arch/m68k/hp300/time.c                             |  10 +-
 arch/m68k/mac/via.c                                | 119 ++++++++++++---------
 arch/m68k/mvme147/config.c                         |  18 ++--
 arch/m68k/mvme16x/config.c                         |  21 ++--
 arch/m68k/q40/q40ints.c                            |  19 ++--
 arch/m68k/sun3/sun3ints.c                          |   3 +
 arch/m68k/sun3x/time.c                             |  16 +--
 arch/mips/include/asm/io.h                         |  14 +--
 arch/mips/kernel/setup.c                           |   2 +-
 arch/nios2/kernel/nios2_ksyms.c                    |  12 +++
 arch/powerpc/Makefile                              |   2 +
 arch/powerpc/include/asm/archrandom.h              |   2 +-
 arch/powerpc/kernel/cacheinfo.c                    |  21 ++++
 arch/powerpc/kernel/cacheinfo.h                    |   4 +
 arch/x86/Kconfig.debug                             |   2 +-
 arch/x86/kernel/kgdb.c                             |   2 +-
 block/blk-merge.c                                  |   8 +-
 crypto/pcrypt.c                                    |   2 +-
 crypto/tgr192.c                                    |   6 +-
 drivers/ata/libahci.c                              |   1 -
 drivers/atm/firestream.c                           |   3 +
 drivers/bcma/driver_pci.c                          |   4 +-
 drivers/block/drbd/drbd_main.c                     |   2 +
 drivers/clk/clk-highbank.c                         |   1 +
 drivers/clk/clk-qoriq.c                            |   1 +
 drivers/clk/imx/clk-imx6q.c                        |   1 +
 drivers/clk/imx/clk-imx6sx.c                       |   1 +
 drivers/clk/imx/clk-imx7d.c                        |   1 +
 drivers/clk/imx/clk-vf610.c                        |   1 +
 drivers/clk/mvebu/armada-370.c                     |   4 +-
 drivers/clk/mvebu/armada-xp.c                      |   4 +-
 drivers/clk/mvebu/dove.c                           |   8 +-
 drivers/clk/mvebu/kirkwood.c                       |   2 +
 drivers/clk/qcom/gcc-msm8996.c                     |  36 -------
 drivers/clk/samsung/clk-exynos4.c                  |   1 +
 drivers/clk/socfpga/clk-pll-a10.c                  |   1 +
 drivers/clk/socfpga/clk-pll.c                      |   1 +
 drivers/clk/sunxi-ng/ccu-sun8i-a23.c               |   2 +-
 drivers/clocksource/exynos_mct.c                   |  14 ++-
 drivers/clocksource/timer-sun5i.c                  |  10 ++
 drivers/crypto/amcc/crypto4xx_trng.h               |   4 +-
 drivers/crypto/caam/caamrng.c                      |   5 +-
 drivers/crypto/ccp/ccp-crypto-aes.c                |   8 +-
 drivers/dma/dma-axi-dmac.c                         |   2 +-
 drivers/dma/dw/platform.c                          |  14 ++-
 drivers/dma/edma.c                                 |   6 +-
 drivers/dma/hsu/hsu.c                              |   4 +-
 drivers/dma/imx-sdma.c                             |   8 ++
 drivers/dma/mv_xor.c                               |   2 +-
 drivers/dma/tegra210-adma.c                        |  72 ++++++++++---
 drivers/gpu/drm/drm_dp_mst_topology.c              |  15 ++-
 drivers/gpu/drm/etnaviv/etnaviv_dump.c             |   2 +-
 drivers/gpu/drm/msm/adreno/a3xx_gpu.c              |  24 ++---
 drivers/gpu/drm/msm/dsi/dsi_host.c                 |   6 +-
 drivers/gpu/drm/msm/mdp/mdp5/mdp5_cfg.c            |   2 +-
 drivers/gpu/drm/nouveau/nvkm/subdev/fb/gddr3.c     |   2 +-
 drivers/gpu/drm/nouveau/nvkm/subdev/pmu/memx.c     |   4 +-
 drivers/gpu/drm/radeon/cik.c                       |   4 +-
 drivers/gpu/drm/radeon/r600.c                      |   4 +-
 drivers/gpu/drm/radeon/si.c                        |   4 +-
 drivers/gpu/drm/sti/sti_hda.c                      |   1 -
 drivers/gpu/drm/sti/sti_hdmi.c                     |   1 -
 drivers/gpu/drm/virtio/virtgpu_vq.c                |   5 +-
 drivers/hwmon/adt7475.c                            |   5 +-
 drivers/hwmon/hwmon.c                              |  98 +++++++++++------
 drivers/hwmon/lm75.c                               |   2 +-
 drivers/hwmon/nct7802.c                            |   4 +-
 drivers/hwmon/shtc1.c                              |   2 +-
 drivers/hwmon/w83627hf.c                           |  42 +++++++-
 drivers/hwtracing/coresight/coresight-etb10.c      |   4 +-
 drivers/hwtracing/coresight/coresight-tmc-etf.c    |   4 +-
 drivers/iio/dac/ad5380.c                           |   2 +-
 drivers/infiniband/hw/cxgb4/cm.c                   |   7 +-
 drivers/infiniband/hw/hns/hns_roce_qp.c            |   1 -
 drivers/infiniband/hw/mlx5/qp.c                    |  21 ++++
 drivers/infiniband/hw/ocrdma/ocrdma_verbs.c        |   2 +-
 drivers/infiniband/hw/qedr/verbs.c                 |   2 +-
 drivers/infiniband/hw/usnic/usnic_ib_verbs.c       |   2 +-
 drivers/infiniband/sw/rxe/rxe_cq.c                 |   4 +-
 drivers/infiniband/sw/rxe/rxe_qp.c                 |   5 +-
 drivers/infiniband/ulp/iser/iscsi_iser.h           |   2 +-
 drivers/infiniband/ulp/iser/iser_memory.c          |  10 +-
 drivers/infiniband/ulp/isert/ib_isert.c            |  12 ---
 drivers/input/keyboard/nomadik-ske-keypad.c        |   2 +-
 drivers/input/misc/keyspan_remote.c                |   9 +-
 drivers/input/tablet/aiptek.c                      |   6 +-
 drivers/input/tablet/gtco.c                        |  10 +-
 drivers/input/tablet/pegasus_notetaker.c           |   2 +-
 drivers/input/touchscreen/sun4i-ts.c               |   6 +-
 drivers/input/touchscreen/sur40.c                  |   2 +-
 drivers/iommu/amd_iommu.c                          |   2 +
 drivers/iommu/amd_iommu_init.c                     |   3 +
 drivers/iommu/intel-iommu.c                        |   5 +-
 drivers/iommu/iommu.c                              |   6 +-
 drivers/md/bcache/super.c                          |   3 -
 drivers/md/bitmap.c                                |   8 +-
 drivers/media/i2c/ov2659.c                         |   2 +-
 drivers/media/i2c/soc_camera/ov6650.c              |  72 ++++++++-----
 drivers/media/pci/cx18/cx18-fileops.c              |   2 +-
 drivers/media/pci/cx23885/cx23885-dvb.c            |   5 +-
 drivers/media/pci/ivtv/ivtv-fileops.c              |   2 +-
 drivers/media/pci/tw5864/tw5864-video.c            |   4 +-
 drivers/media/platform/davinci/isif.c              |   9 --
 drivers/media/platform/davinci/vpbe.c              |   2 +-
 drivers/media/platform/omap/omap_vout.c            |  15 ++-
 drivers/media/platform/s5p-jpeg/jpeg-core.c        |   2 +-
 drivers/media/platform/vivid/vivid-osd.c           |   2 +-
 drivers/media/radio/wl128x/fmdrv_common.c          |   5 +-
 drivers/mfd/intel-lpss.c                           |   1 +
 drivers/misc/mic/card/mic_x100.c                   |  28 +++--
 drivers/misc/sgi-xp/xpc_partition.c                |   2 +-
 drivers/mmc/host/sdhci-brcmstb.c                   |   4 +-
 drivers/mmc/host/sdhci-tegra.c                     |   2 +-
 drivers/mmc/host/sdhci.c                           |  10 +-
 drivers/net/can/slcan.c                            |  12 ++-
 drivers/net/dsa/qca8k.c                            |  12 +++
 drivers/net/dsa/qca8k.h                            |   1 +
 drivers/net/ethernet/amazon/ena/ena_com.c          |   3 +-
 drivers/net/ethernet/amazon/ena/ena_ethtool.c      |   4 +-
 drivers/net/ethernet/amazon/ena/ena_netdev.c       |   1 +
 drivers/net/ethernet/broadcom/bcmsysport.c         |   2 +-
 drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c    |   2 +
 drivers/net/ethernet/hisilicon/hix5hd2_gmac.c      |   2 +-
 drivers/net/ethernet/ibm/ehea/ehea_main.c          |   2 +-
 drivers/net/ethernet/mellanox/mlxsw/reg.h          |  22 +++-
 drivers/net/ethernet/natsemi/sonic.c               |   6 +-
 drivers/net/ethernet/pasemi/pasemi_mac.c           |   2 +-
 drivers/net/ethernet/qlogic/qed/qed_l2.c           |  34 +++---
 drivers/net/ethernet/qualcomm/qca_spi.c            |   9 +-
 drivers/net/ethernet/qualcomm/qca_spi.h            |   1 +
 drivers/net/ethernet/renesas/sh_eth.c              |   6 +-
 .../net/ethernet/stmicro/stmmac/dwmac-ipq806x.c    |   2 +-
 .../net/ethernet/stmicro/stmmac/dwmac-meson8b.c    |   2 +-
 drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c  |   2 +-
 drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c   |   2 +-
 drivers/net/gtp.c                                  |   4 +-
 drivers/net/phy/fixed_phy.c                        |   6 +-
 drivers/net/phy/phy.c                              |   3 +-
 drivers/net/phy/phy_device.c                       |  11 +-
 drivers/net/slip/slip.c                            |  12 ++-
 drivers/net/usb/lan78xx.c                          |  15 +++
 drivers/net/wireless/ath/ath9k/dynack.c            |   8 +-
 drivers/net/wireless/intel/iwlwifi/mvm/fw.c        |  12 +--
 drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c      |   2 +-
 drivers/net/wireless/marvell/libertas/cfg.c        |  16 ++-
 drivers/net/wireless/marvell/libertas_tf/cmd.c     |   2 +-
 drivers/net/wireless/mediatek/mt7601u/phy.c        |   2 +-
 drivers/nvme/host/pci.c                            |   2 +-
 drivers/of/of_mdio.c                               |   2 +-
 drivers/pinctrl/sh-pfc/pfc-emev2.c                 |  20 ++++
 drivers/pinctrl/sh-pfc/pfc-r8a7740.c               |   3 +-
 drivers/pinctrl/sh-pfc/pfc-r8a7791.c               |   8 +-
 drivers/pinctrl/sh-pfc/pfc-r8a7792.c               |   1 +
 drivers/pinctrl/sh-pfc/pfc-r8a7794.c               |   2 +-
 drivers/pinctrl/sh-pfc/pfc-sh7269.c                |   2 +-
 drivers/pinctrl/sh-pfc/pfc-sh73a0.c                |   4 +-
 drivers/pinctrl/sh-pfc/pfc-sh7734.c                |   4 +-
 drivers/platform/mips/cpu_hwmon.c                  |   2 +-
 drivers/platform/x86/alienware-wmi.c               |   2 +-
 drivers/power/supply/power_supply_core.c           |  10 +-
 drivers/pwm/pwm-lpss.c                             |   6 ++
 drivers/pwm/pwm-meson.c                            |   5 -
 drivers/rapidio/rio_cm.c                           |   4 +-
 drivers/regulator/pv88060-regulator.c              |   2 +-
 drivers/regulator/pv88080-regulator.c              |   2 +-
 drivers/regulator/pv88090-regulator.c              |   2 +-
 drivers/regulator/tps65086-regulator.c             |   4 +-
 drivers/regulator/wm831x-dcdc.c                    |   4 +-
 drivers/rtc/rtc-88pm80x.c                          |  21 ++--
 drivers/rtc/rtc-88pm860x.c                         |  21 ++--
 drivers/rtc/rtc-ds1672.c                           |   3 +-
 drivers/rtc/rtc-mc146818-lib.c                     |   2 +-
 drivers/rtc/rtc-pcf8563.c                          |  11 +-
 drivers/rtc/rtc-pm8xxx.c                           |   6 +-
 drivers/scsi/libfc/fc_exch.c                       |   2 +-
 drivers/scsi/megaraid/megaraid_sas_base.c          |   4 +-
 drivers/scsi/qla2xxx/qla_os.c                      |  34 +++---
 drivers/scsi/scsi_transport_iscsi.c                |   7 ++
 drivers/soc/fsl/qe/gpio.c                          |   4 +-
 drivers/spi/spi-bcm2835aux.c                       |  13 ++-
 drivers/spi/spi-fsl-spi.c                          |   2 +-
 drivers/spi/spi-tegra114.c                         |  45 ++++++--
 drivers/staging/comedi/drivers/ni_mio_common.c     |  24 +++--
 drivers/staging/greybus/light.c                    |  12 +--
 drivers/staging/most/aim-cdev/cdev.c               |   5 +-
 drivers/target/iscsi/iscsi_target.c                |   6 +-
 drivers/thermal/cpu_cooling.c                      |   2 +-
 drivers/thermal/mtk_thermal.c                      |   6 +-
 drivers/tty/ipwireless/hardware.c                  |   2 +
 drivers/tty/serial/stm32-usart.c                   |  11 +-
 drivers/usb/class/cdc-wdm.c                        |   2 +-
 drivers/usb/host/xhci-hub.c                        |   2 +-
 drivers/usb/phy/Kconfig                            |   2 +-
 drivers/usb/phy/phy-twl6030-usb.c                  |   2 +-
 drivers/vfio/pci/vfio_pci.c                        |  19 +++-
 drivers/video/backlight/lm3630a_bl.c               |   4 +-
 drivers/video/fbdev/chipsfb.c                      |   3 +-
 drivers/xen/cpu_hotplug.c                          |   2 +-
 fs/afs/super.c                                     |   1 +
 fs/btrfs/inode-map.c                               |   1 +
 fs/cifs/connect.c                                  |   3 +-
 fs/exportfs/expfs.c                                |   1 +
 fs/ext4/inline.c                                   |   2 +-
 fs/jfs/jfs_txnmgr.c                                |   3 +-
 fs/namei.c                                         |  17 +--
 fs/nfs/delegation.c                                |  20 ++--
 fs/nfs/delegation.h                                |   1 +
 fs/nfs/super.c                                     |   2 +-
 fs/xfs/xfs_quotaops.c                              |   3 +
 include/linux/bitmap.h                             |   8 ++
 include/linux/device.h                             |   3 +-
 include/linux/mlx5/mlx5_ifc.h                      |   2 -
 include/linux/netfilter/ipset/ip_set.h             |   7 --
 include/linux/platform_data/dma-imx-sdma.h         |   3 +
 include/linux/signal.h                             |  15 ++-
 include/media/davinci/vpbe.h                       |   2 +-
 include/trace/events/xen.h                         |   6 +-
 include/uapi/linux/ethtool.h                       |   6 +-
 kernel/debug/kdb/kdb_main.c                        |   2 +-
 kernel/events/core.c                               |   3 +
 kernel/signal.c                                    |   5 +
 lib/bitmap.c                                       |  20 ++++
 lib/devres.c                                       |   3 +-
 lib/kfifo.c                                        |   3 +-
 net/6lowpan/nhc.c                                  |   2 +-
 net/bridge/netfilter/ebtables.c                    |   4 +-
 net/core/ethtool.c                                 |   2 +
 net/core/neighbour.c                               |   4 +-
 net/ieee802154/6lowpan/reassembly.c                |   2 +-
 net/ipv4/ip_tunnel.c                               |   4 +-
 net/ipv4/tcp_bbr.c                                 |   3 +-
 net/ipv6/ip6_tunnel.c                              |   4 +-
 net/ipv6/reassembly.c                              |   2 +-
 net/iucv/af_iucv.c                                 |  27 +++--
 net/l2tp/l2tp_core.c                               |   3 +-
 net/llc/af_llc.c                                   |  34 +++---
 net/llc/llc_conn.c                                 |  35 ++----
 net/llc/llc_if.c                                   |  12 ++-
 net/mac80211/rc80211_minstrel_ht.c                 |   2 +-
 net/mac80211/rx.c                                  |  11 +-
 net/netfilter/ipset/ip_set_bitmap_gen.h            |   2 +-
 net/netfilter/ipset/ip_set_bitmap_ip.c             |   6 +-
 net/netfilter/ipset/ip_set_bitmap_ipmac.c          |   6 +-
 net/netfilter/ipset/ip_set_bitmap_port.c           |   6 +-
 net/packet/af_packet.c                             |  25 ++++-
 net/rds/ib_stats.c                                 |   2 +-
 net/rxrpc/output.c                                 |   3 +
 net/sched/act_mirred.c                             |   6 +-
 net/sched/ematch.c                                 |   2 +-
 net/sched/sch_netem.c                              |  18 +++-
 net/tipc/node.c                                    |   7 +-
 net/tipc/sysctl.c                                  |   8 +-
 net/x25/af_x25.c                                   |   6 +-
 scripts/recordmcount.c                             |  17 +++
 security/keys/key.c                                |   1 +
 sound/aoa/codecs/onyx.c                            |   4 +-
 sound/pci/hda/hda_controller.h                     |   9 +-
 sound/soc/codecs/cs4349.c                          |   1 +
 sound/soc/codecs/es8328.c                          |   2 +-
 sound/soc/codecs/wm8737.c                          |   2 +-
 sound/soc/davinci/davinci-mcasp.c                  |  13 ++-
 sound/soc/fsl/imx-sgtl5000.c                       |   3 +-
 sound/soc/qcom/apq8016_sbc.c                       |  21 +++-
 sound/soc/soc-pcm.c                                |   4 +-
 sound/soc/sunxi/sun4i-i2s.c                        |   4 +-
 sound/usb/mixer.c                                  |   4 +-
 sound/usb/quirks-table.h                           |   9 +-
 287 files changed, 1451 insertions(+), 803 deletions(-)



^ permalink raw reply	[flat|nested] 283+ messages in thread

* [PATCH 4.9 001/271] xfs: Sanity check flags of Q_XQUOTARM call
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
@ 2020-01-28 14:02 ` Greg Kroah-Hartman
  2020-01-28 14:02 ` [PATCH 4.9 002/271] powerpc/archrandom: fix arch_get_random_seed_int() Greg Kroah-Hartman
                   ` (274 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:02 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yang Xu, Jan Kara, Eric Sandeen,
	Darrick J. Wong

From: Jan Kara <jack@suse.cz>

commit 3dd4d40b420846dd35869ccc8f8627feef2cff32 upstream.

Flags passed to Q_XQUOTARM were not sanity checked for invalid values.
Fix that.

Fixes: 9da93f9b7cdf ("xfs: fix Q_XQUOTARM ioctl")
Reported-by: Yang Xu <xuyang2018.jy@cn.fujitsu.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Reviewed-by: Eric Sandeen <sandeen@redhat.com>
Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/xfs/xfs_quotaops.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/fs/xfs/xfs_quotaops.c
+++ b/fs/xfs/xfs_quotaops.c
@@ -214,6 +214,9 @@ xfs_fs_rm_xquota(
 	if (XFS_IS_QUOTA_ON(mp))
 		return -EINVAL;
 
+	if (uflags & ~(FS_USER_QUOTA | FS_GROUP_QUOTA | FS_PROJ_QUOTA))
+		return -EINVAL;
+
 	if (uflags & FS_USER_QUOTA)
 		flags |= XFS_DQ_USER;
 	if (uflags & FS_GROUP_QUOTA)



^ permalink raw reply	[flat|nested] 283+ messages in thread

* [PATCH 4.9 002/271] powerpc/archrandom: fix arch_get_random_seed_int()
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
  2020-01-28 14:02 ` [PATCH 4.9 001/271] xfs: Sanity check flags of Q_XQUOTARM call Greg Kroah-Hartman
@ 2020-01-28 14:02 ` Greg Kroah-Hartman
  2020-01-28 14:02 ` [PATCH 4.9 003/271] mt7601u: fix bbp version check in mt7601u_wait_bbp_ready Greg Kroah-Hartman
                   ` (273 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:02 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Ard Biesheuvel, Michael Ellerman

From: Ard Biesheuvel <ardb@kernel.org>

commit b6afd1234cf93aa0d71b4be4788c47534905f0be upstream.

Commit 01c9348c7620ec65

  powerpc: Use hardware RNG for arch_get_random_seed_* not arch_get_random_*

updated arch_get_random_[int|long]() to be NOPs, and moved the hardware
RNG backing to arch_get_random_seed_[int|long]() instead. However, it
failed to take into account that arch_get_random_int() was implemented
in terms of arch_get_random_long(), and so we ended up with a version
of the former that is essentially a NOP as well.

Fix this by calling arch_get_random_seed_long() from
arch_get_random_seed_int() instead.

Fixes: 01c9348c7620ec65 ("powerpc: Use hardware RNG for arch_get_random_seed_* not arch_get_random_*")
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20191204115015.18015-1-ardb@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/powerpc/include/asm/archrandom.h |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/powerpc/include/asm/archrandom.h
+++ b/arch/powerpc/include/asm/archrandom.h
@@ -27,7 +27,7 @@ static inline int arch_get_random_seed_i
 	unsigned long val;
 	int rc;
 
-	rc = arch_get_random_long(&val);
+	rc = arch_get_random_seed_long(&val);
 	if (rc)
 		*v = val;
 



^ permalink raw reply	[flat|nested] 283+ messages in thread

* [PATCH 4.9 003/271] mt7601u: fix bbp version check in mt7601u_wait_bbp_ready
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
  2020-01-28 14:02 ` [PATCH 4.9 001/271] xfs: Sanity check flags of Q_XQUOTARM call Greg Kroah-Hartman
  2020-01-28 14:02 ` [PATCH 4.9 002/271] powerpc/archrandom: fix arch_get_random_seed_int() Greg Kroah-Hartman
@ 2020-01-28 14:02 ` Greg Kroah-Hartman
  2020-01-28 14:02 ` [PATCH 4.9 004/271] drm/sti: do not remove the drm_bridge that was never added Greg Kroah-Hartman
                   ` (272 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:02 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jakub Kicinski, Lorenzo Bianconi, Kalle Valo

From: Lorenzo Bianconi <lorenzo@kernel.org>

commit 15e14f76f85f4f0eab3b8146e1cd3c58ce272823 upstream.

Fix bbp ready check in mt7601u_wait_bbp_ready. The issue is reported by
coverity with the following error:

Logical vs. bitwise operator
The expression's value does not depend on the operands; inadvertent use
of the wrong operator is a likely logic error.

Addresses-Coverity-ID: 1309441 ("Logical vs. bitwise operator")
Fixes: c869f77d6abb ("add mt7601u driver")
Acked-by: Jakub Kicinski <kubakici@wp.pl>
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/wireless/mediatek/mt7601u/phy.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/net/wireless/mediatek/mt7601u/phy.c
+++ b/drivers/net/wireless/mediatek/mt7601u/phy.c
@@ -221,7 +221,7 @@ int mt7601u_wait_bbp_ready(struct mt7601
 
 	do {
 		val = mt7601u_bbp_rr(dev, MT_BBP_REG_VERSION);
-		if (val && ~val)
+		if (val && val != 0xff)
 			break;
 	} while (--i);
 



^ permalink raw reply	[flat|nested] 283+ messages in thread

* [PATCH 4.9 004/271] drm/sti: do not remove the drm_bridge that was never added
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (2 preceding siblings ...)
  2020-01-28 14:02 ` [PATCH 4.9 003/271] mt7601u: fix bbp version check in mt7601u_wait_bbp_ready Greg Kroah-Hartman
@ 2020-01-28 14:02 ` Greg Kroah-Hartman
  2020-01-28 14:02 ` [PATCH 4.9 005/271] drm/virtio: fix bounds check in virtio_gpu_cmd_get_capset() Greg Kroah-Hartman
                   ` (271 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:02 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Daniel Vetter, Peter Rosin,
	Benjamin Gaignard, Sasha Levin

From: Peter Rosin <peda@axentia.se>

[ Upstream commit 66e31a72dc38543b2d9d1ce267dc78ba9beebcfd ]

Removing the drm_bridge_remove call should avoid a NULL dereference
during list processing in drm_bridge_remove if the error path is ever
taken.

The more natural approach would perhaps be to add a drm_bridge_add,
but there are several other bridges that never call drm_bridge_add.
Just removing the drm_bridge_remove is the easier fix.

Fixes: 84601dbdea36 ("drm: sti: rework init sequence")
Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Peter Rosin <peda@axentia.se>
Signed-off-by: Benjamin Gaignard <benjamin.gaignard@linaro.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20180806061910.29914-2-peda@axentia.se
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/sti/sti_hda.c  | 1 -
 drivers/gpu/drm/sti/sti_hdmi.c | 1 -
 2 files changed, 2 deletions(-)

diff --git a/drivers/gpu/drm/sti/sti_hda.c b/drivers/gpu/drm/sti/sti_hda.c
index e7c243f708702..08808e3701de9 100644
--- a/drivers/gpu/drm/sti/sti_hda.c
+++ b/drivers/gpu/drm/sti/sti_hda.c
@@ -740,7 +740,6 @@ static int sti_hda_bind(struct device *dev, struct device *master, void *data)
 	return 0;
 
 err_sysfs:
-	drm_bridge_remove(bridge);
 	return -EINVAL;
 }
 
diff --git a/drivers/gpu/drm/sti/sti_hdmi.c b/drivers/gpu/drm/sti/sti_hdmi.c
index 376b0763c874a..a5412a6fbeca2 100644
--- a/drivers/gpu/drm/sti/sti_hdmi.c
+++ b/drivers/gpu/drm/sti/sti_hdmi.c
@@ -1352,7 +1352,6 @@ static int sti_hdmi_bind(struct device *dev, struct device *master, void *data)
 	return 0;
 
 err_sysfs:
-	drm_bridge_remove(bridge);
 	hdmi->drm_connector = NULL;
 	return -EINVAL;
 }
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 005/271] drm/virtio: fix bounds check in virtio_gpu_cmd_get_capset()
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (3 preceding siblings ...)
  2020-01-28 14:02 ` [PATCH 4.9 004/271] drm/sti: do not remove the drm_bridge that was never added Greg Kroah-Hartman
@ 2020-01-28 14:02 ` Greg Kroah-Hartman
  2020-01-28 14:02 ` [PATCH 4.9 006/271] ALSA: hda: fix unused variable warning Greg Kroah-Hartman
                   ` (270 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:02 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Gerd Hoffmann, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit 09c4b49457434fa74749ad6194ef28464d9f5df9 ]

This doesn't affect runtime because in the current code "idx" is always
valid.

First, we read from "vgdev->capsets[idx].max_size" before checking
whether "idx" is within bounds.  And secondly the bounds check is off by
one so we could end up reading one element beyond the end of the
vgdev->capsets[] array.

Fixes: 62fb7a5e1096 ("virtio-gpu: add 3d/virgl support")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: http://patchwork.freedesktop.org/patch/msgid/20180704094250.m7sgvvzg3dhcvv3h@kili.mountain
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/virtio/virtgpu_vq.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/virtio/virtgpu_vq.c b/drivers/gpu/drm/virtio/virtgpu_vq.c
index a1b3ea1ccb65b..772a5a3b0ce1a 100644
--- a/drivers/gpu/drm/virtio/virtgpu_vq.c
+++ b/drivers/gpu/drm/virtio/virtgpu_vq.c
@@ -681,11 +681,11 @@ int virtio_gpu_cmd_get_capset(struct virtio_gpu_device *vgdev,
 {
 	struct virtio_gpu_get_capset *cmd_p;
 	struct virtio_gpu_vbuffer *vbuf;
-	int max_size = vgdev->capsets[idx].max_size;
+	int max_size;
 	struct virtio_gpu_drv_cap_cache *cache_ent;
 	void *resp_buf;
 
-	if (idx > vgdev->num_capsets)
+	if (idx >= vgdev->num_capsets)
 		return -EINVAL;
 
 	if (version > vgdev->capsets[idx].max_version)
@@ -695,6 +695,7 @@ int virtio_gpu_cmd_get_capset(struct virtio_gpu_device *vgdev,
 	if (!cache_ent)
 		return -ENOMEM;
 
+	max_size = vgdev->capsets[idx].max_size;
 	cache_ent->caps_cache = kmalloc(max_size, GFP_KERNEL);
 	if (!cache_ent->caps_cache) {
 		kfree(cache_ent);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 006/271] ALSA: hda: fix unused variable warning
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (4 preceding siblings ...)
  2020-01-28 14:02 ` [PATCH 4.9 005/271] drm/virtio: fix bounds check in virtio_gpu_cmd_get_capset() Greg Kroah-Hartman
@ 2020-01-28 14:02 ` Greg Kroah-Hartman
  2020-01-28 14:02 ` [PATCH 4.9 007/271] IB/rxe: replace kvfree with vfree Greg Kroah-Hartman
                   ` (269 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:02 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Anders Roxell, Takashi Iwai, Sasha Levin

From: Anders Roxell <anders.roxell@linaro.org>

[ Upstream commit 5b03006d5c58ddd31caf542eef4d0269bcf265b3 ]

When CONFIG_X86=n function azx_snoop doesn't use the variable chip it
only returns true.

sound/pci/hda/hda_intel.c: In function ‘dma_alloc_pages’:
sound/pci/hda/hda_intel.c:2002:14: warning: unused variable ‘chip’ [-Wunused-variable]
  struct azx *chip = bus_to_azx(bus);
              ^~~~

Create a inline function of azx_snoop.

Fixes: a41d122449be ("ALSA: hda - Embed bus into controller object")
Signed-off-by: Anders Roxell <anders.roxell@linaro.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/pci/hda/hda_controller.h | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/sound/pci/hda/hda_controller.h b/sound/pci/hda/hda_controller.h
index b83feecf1e40c..8f93869982703 100644
--- a/sound/pci/hda/hda_controller.h
+++ b/sound/pci/hda/hda_controller.h
@@ -171,11 +171,10 @@ struct azx {
 #define azx_bus(chip)	(&(chip)->bus.core)
 #define bus_to_azx(_bus)	container_of(_bus, struct azx, bus.core)
 
-#ifdef CONFIG_X86
-#define azx_snoop(chip)		((chip)->snoop)
-#else
-#define azx_snoop(chip)		true
-#endif
+static inline bool azx_snoop(struct azx *chip)
+{
+	return !IS_ENABLED(CONFIG_X86) || chip->snoop;
+}
 
 /*
  * macros for easy use
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 007/271] IB/rxe: replace kvfree with vfree
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (5 preceding siblings ...)
  2020-01-28 14:02 ` [PATCH 4.9 006/271] ALSA: hda: fix unused variable warning Greg Kroah-Hartman
@ 2020-01-28 14:02 ` Greg Kroah-Hartman
  2020-01-28 14:02 ` [PATCH 4.9 008/271] ALSA: usb-audio: update quirk for B&W PX to remove microphone Greg Kroah-Hartman
                   ` (268 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:02 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Leon Romanovsky, Zhu Yanjun,
	Jason Gunthorpe, Sasha Levin

From: Zhu Yanjun <yanjun.zhu@oracle.com>

[ Upstream commit 721ad7e643f7002efa398838693f90284ea216d1 ]

The buf is allocated by vmalloc_user in the function rxe_queue_init.
So it is better to free it by vfree.

Fixes: 8700e3e7c485 ("Soft RoCE driver")
Reviewed-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Zhu Yanjun <yanjun.zhu@oracle.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/sw/rxe/rxe_cq.c | 4 ++--
 drivers/infiniband/sw/rxe/rxe_qp.c | 5 +++--
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/drivers/infiniband/sw/rxe/rxe_cq.c b/drivers/infiniband/sw/rxe/rxe_cq.c
index e5e6a5e7dee9c..5ac88412f1ffe 100644
--- a/drivers/infiniband/sw/rxe/rxe_cq.c
+++ b/drivers/infiniband/sw/rxe/rxe_cq.c
@@ -30,7 +30,7 @@
  * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  * SOFTWARE.
  */
-
+#include <linux/vmalloc.h>
 #include "rxe.h"
 #include "rxe_loc.h"
 #include "rxe_queue.h"
@@ -89,7 +89,7 @@ int rxe_cq_from_init(struct rxe_dev *rxe, struct rxe_cq *cq, int cqe,
 	err = do_mmap_info(rxe, udata, false, context, cq->queue->buf,
 			   cq->queue->buf_size, &cq->queue->ip);
 	if (err) {
-		kvfree(cq->queue->buf);
+		vfree(cq->queue->buf);
 		kfree(cq->queue);
 		return err;
 	}
diff --git a/drivers/infiniband/sw/rxe/rxe_qp.c b/drivers/infiniband/sw/rxe/rxe_qp.c
index 44b2108253bd9..d6672127808b7 100644
--- a/drivers/infiniband/sw/rxe/rxe_qp.c
+++ b/drivers/infiniband/sw/rxe/rxe_qp.c
@@ -34,6 +34,7 @@
 #include <linux/skbuff.h>
 #include <linux/delay.h>
 #include <linux/sched.h>
+#include <linux/vmalloc.h>
 
 #include "rxe.h"
 #include "rxe_loc.h"
@@ -255,7 +256,7 @@ static int rxe_qp_init_req(struct rxe_dev *rxe, struct rxe_qp *qp,
 			   qp->sq.queue->buf_size, &qp->sq.queue->ip);
 
 	if (err) {
-		kvfree(qp->sq.queue->buf);
+		vfree(qp->sq.queue->buf);
 		kfree(qp->sq.queue);
 		return err;
 	}
@@ -312,7 +313,7 @@ static int rxe_qp_init_resp(struct rxe_dev *rxe, struct rxe_qp *qp,
 				   qp->rq.queue->buf_size,
 				   &qp->rq.queue->ip);
 		if (err) {
-			kvfree(qp->rq.queue->buf);
+			vfree(qp->rq.queue->buf);
 			kfree(qp->rq.queue);
 			return err;
 		}
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 008/271] ALSA: usb-audio: update quirk for B&W PX to remove microphone
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (6 preceding siblings ...)
  2020-01-28 14:02 ` [PATCH 4.9 007/271] IB/rxe: replace kvfree with vfree Greg Kroah-Hartman
@ 2020-01-28 14:02 ` Greg Kroah-Hartman
  2020-01-28 14:02 ` [PATCH 4.9 009/271] staging: comedi: ni_mio_common: protect register write overflow Greg Kroah-Hartman
                   ` (267 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:02 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Nicolas Huaman, Takashi Iwai, Sasha Levin

From: Nicolas Huaman <nicolas@herochao.de>

[ Upstream commit c369c8db15d51fa175d2ba85928f79d16af6b562 ]

A quirk in snd-usb-audio was added to automate setting sample rate to
4800k and remove the previously exposed nonfunctional microphone for
the Bowers & Wilkins PX:
commit 240a8af929c7c57dcde28682725b29cf8474e8e5
https://lore.kernel.org/patchwork/patch/919689/

However the headphones where updated shortly after that to remove the
unintentional microphone functionality. I guess because of this the
headphones now crash when connecting them via USB while the quirk is
active. Dmesg:

snd-usb-audio: probe of 2-3:1.0 failed with error -22
usb 2-3: 2:1: cannot get min/max values for control 2 (id 2)

This patch removes the microfone and allows the headphones to connect
and work out of the box. It is based on the current mainline kernel
 and successfully applied an tested on my machine (4.18.10.arch1-1).

Fixes: 240a8af929c7 ("ALSA: usb-audio: Add a quirck for B&W PX headphones")
Signed-off-by: Nicolas Huaman <nicolas@herochao.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/usb/quirks-table.h | 9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h
index d32727c74a168..c892b4d1e733f 100644
--- a/sound/usb/quirks-table.h
+++ b/sound/usb/quirks-table.h
@@ -3293,19 +3293,14 @@ AU0828_DEVICE(0x2040, 0x7270, "Hauppauge", "HVR-950Q"),
 				.ifnum = 0,
 				.type = QUIRK_AUDIO_STANDARD_MIXER,
 			},
-			/* Capture */
-			{
-				.ifnum = 1,
-				.type = QUIRK_IGNORE_INTERFACE,
-			},
 			/* Playback */
 			{
-				.ifnum = 2,
+				.ifnum = 1,
 				.type = QUIRK_AUDIO_FIXED_ENDPOINT,
 				.data = &(const struct audioformat) {
 					.formats = SNDRV_PCM_FMTBIT_S16_LE,
 					.channels = 2,
-					.iface = 2,
+					.iface = 1,
 					.altsetting = 1,
 					.altset_idx = 1,
 					.attributes = UAC_EP_CS_ATTR_FILL_MAX |
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 009/271] staging: comedi: ni_mio_common: protect register write overflow
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (7 preceding siblings ...)
  2020-01-28 14:02 ` [PATCH 4.9 008/271] ALSA: usb-audio: update quirk for B&W PX to remove microphone Greg Kroah-Hartman
@ 2020-01-28 14:02 ` Greg Kroah-Hartman
  2020-01-28 14:02 ` [PATCH 4.9 010/271] pwm: lpss: Release runtime-pm reference from the drivers remove callback Greg Kroah-Hartman
                   ` (266 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:02 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Spencer E. Olson, Ian Abbott, Sasha Levin

From: Spencer E. Olson <olsonse@umich.edu>

[ Upstream commit 1cbca5852d6c16e85a21487a15d211195aacd4a1 ]

Fixes two problems introduced as early as
commit 03aef4b6dc12  ("Staging: comedi: add ni_mio_common code"):
(1) Ensures that the last four bits of NISTC_RTSI_TRIGB_OUT_REG register is
    not unduly overwritten on e-series devices.  On e-series devices, the
    first three of the last four bits are reserved.  The last bit defines
    the output selection of the RGOUT0 pin, otherwise known as
    RTSI_Sub_Selection.  For m-series devices, these last four bits are
    indeed used as the output selection of the RTSI7 pin (and the
    RTSI_Sub_Selection bit for the RGOUT0 pin is moved to the
    RTSI_Trig_Direction register.
(2) Allows all 4 RTSI_BRD lines to be treated as valid sources for RTSI
    lines.

This patch also cleans up the ni_get_rtsi_routing command for readability.

Fixes: 03aef4b6dc12  ("Staging: comedi: add ni_mio_common code")
Signed-off-by: Spencer E. Olson <olsonse@umich.edu>
Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../staging/comedi/drivers/ni_mio_common.c    | 24 +++++++++++++------
 1 file changed, 17 insertions(+), 7 deletions(-)

diff --git a/drivers/staging/comedi/drivers/ni_mio_common.c b/drivers/staging/comedi/drivers/ni_mio_common.c
index fe03a41dc5cf5..12056eb3cbe81 100644
--- a/drivers/staging/comedi/drivers/ni_mio_common.c
+++ b/drivers/staging/comedi/drivers/ni_mio_common.c
@@ -4945,7 +4945,10 @@ static int ni_valid_rtsi_output_source(struct comedi_device *dev,
 	case NI_RTSI_OUTPUT_G_SRC0:
 	case NI_RTSI_OUTPUT_G_GATE0:
 	case NI_RTSI_OUTPUT_RGOUT0:
-	case NI_RTSI_OUTPUT_RTSI_BRD_0:
+	case NI_RTSI_OUTPUT_RTSI_BRD(0):
+	case NI_RTSI_OUTPUT_RTSI_BRD(1):
+	case NI_RTSI_OUTPUT_RTSI_BRD(2):
+	case NI_RTSI_OUTPUT_RTSI_BRD(3):
 		return 1;
 	case NI_RTSI_OUTPUT_RTSI_OSC:
 		return (devpriv->is_m_series) ? 1 : 0;
@@ -4966,11 +4969,18 @@ static int ni_set_rtsi_routing(struct comedi_device *dev,
 		devpriv->rtsi_trig_a_output_reg |= NISTC_RTSI_TRIG(chan, src);
 		ni_stc_writew(dev, devpriv->rtsi_trig_a_output_reg,
 			      NISTC_RTSI_TRIGA_OUT_REG);
-	} else if (chan < 8) {
+	} else if (chan < NISTC_RTSI_TRIG_NUM_CHAN(devpriv->is_m_series)) {
 		devpriv->rtsi_trig_b_output_reg &= ~NISTC_RTSI_TRIG_MASK(chan);
 		devpriv->rtsi_trig_b_output_reg |= NISTC_RTSI_TRIG(chan, src);
 		ni_stc_writew(dev, devpriv->rtsi_trig_b_output_reg,
 			      NISTC_RTSI_TRIGB_OUT_REG);
+	} else if (chan != NISTC_RTSI_TRIG_OLD_CLK_CHAN) {
+		/* probably should never reach this, since the
+		 * ni_valid_rtsi_output_source above errors out if chan is too
+		 * high
+		 */
+		dev_err(dev->class_dev, "%s: unknown rtsi channel\n", __func__);
+		return -EINVAL;
 	}
 	return 2;
 }
@@ -4986,12 +4996,12 @@ static unsigned int ni_get_rtsi_routing(struct comedi_device *dev,
 	} else if (chan < NISTC_RTSI_TRIG_NUM_CHAN(devpriv->is_m_series)) {
 		return NISTC_RTSI_TRIG_TO_SRC(chan,
 					      devpriv->rtsi_trig_b_output_reg);
-	} else {
-		if (chan == NISTC_RTSI_TRIG_OLD_CLK_CHAN)
-			return NI_RTSI_OUTPUT_RTSI_OSC;
-		dev_err(dev->class_dev, "bug! should never get here?\n");
-		return 0;
+	} else if (chan == NISTC_RTSI_TRIG_OLD_CLK_CHAN) {
+		return NI_RTSI_OUTPUT_RTSI_OSC;
 	}
+
+	dev_err(dev->class_dev, "%s: unknown rtsi channel\n", __func__);
+	return -EINVAL;
 }
 
 static int ni_rtsi_insn_config(struct comedi_device *dev,
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 010/271] pwm: lpss: Release runtime-pm reference from the drivers remove callback
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (8 preceding siblings ...)
  2020-01-28 14:02 ` [PATCH 4.9 009/271] staging: comedi: ni_mio_common: protect register write overflow Greg Kroah-Hartman
@ 2020-01-28 14:02 ` Greg Kroah-Hartman
  2020-01-28 14:02 ` [PATCH 4.9 011/271] mlxsw: reg: QEEC: Add minimum shaper fields Greg Kroah-Hartman
                   ` (265 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:02 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Andy Shevchenko, Hans de Goede,
	Thierry Reding, Sasha Levin

From: Hans de Goede <hdegoede@redhat.com>

[ Upstream commit 42885551cedb45961879d2fc3dc3c4dc545cc23e ]

For each pwm output which gets enabled through pwm_lpss_apply(), we do a
pm_runtime_get_sync().

This commit adds pm_runtime_put() calls to pwm_lpss_remove() to balance
these when the driver gets removed with some of the outputs still enabled.

Fixes: f080be27d7d9 ("pwm: lpss: Add support for runtime PM")
Acked-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pwm/pwm-lpss.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/pwm/pwm-lpss.c b/drivers/pwm/pwm-lpss.c
index 5208b3f80ad85..239003807c085 100644
--- a/drivers/pwm/pwm-lpss.c
+++ b/drivers/pwm/pwm-lpss.c
@@ -205,6 +205,12 @@ EXPORT_SYMBOL_GPL(pwm_lpss_probe);
 
 int pwm_lpss_remove(struct pwm_lpss_chip *lpwm)
 {
+	int i;
+
+	for (i = 0; i < lpwm->info->npwm; i++) {
+		if (pwm_is_enabled(&lpwm->chip.pwms[i]))
+			pm_runtime_put(lpwm->chip.dev);
+	}
 	return pwmchip_remove(&lpwm->chip);
 }
 EXPORT_SYMBOL_GPL(pwm_lpss_remove);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 011/271] mlxsw: reg: QEEC: Add minimum shaper fields
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (9 preceding siblings ...)
  2020-01-28 14:02 ` [PATCH 4.9 010/271] pwm: lpss: Release runtime-pm reference from the drivers remove callback Greg Kroah-Hartman
@ 2020-01-28 14:02 ` Greg Kroah-Hartman
  2020-01-28 14:02 ` [PATCH 4.9 012/271] pcrypt: use format specifier in kobject_add Greg Kroah-Hartman
                   ` (264 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:02 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Petr Machata, Ido Schimmel,
	David S. Miller, Sasha Levin

From: Petr Machata <petrm@mellanox.com>

[ Upstream commit 8b931821aa04823e2e5df0ae93937baabbd23286 ]

Add QEEC.mise (minimum shaper enable) and QEEC.min_shaper_rate to enable
configuration of minimum shaper.

Increase the QEEC length to 0x20 as well: that's the length that the
register has had for a long time now, but with the configurations that
mlxsw typically exercises, the firmware tolerated 0x1C-sized packets.
With mise=true however, FW rejects packets unless they have the full
required length.

Fixes: b9b7cee40579 ("mlxsw: reg: Add QoS ETS Element Configuration register")
Signed-off-by: Petr Machata <petrm@mellanox.com>
Signed-off-by: Ido Schimmel <idosch@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/mellanox/mlxsw/reg.h | 22 +++++++++++++++++++++-
 1 file changed, 21 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/mellanox/mlxsw/reg.h b/drivers/net/ethernet/mellanox/mlxsw/reg.h
index b2a745b579fd1..fdc69218c8cac 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/reg.h
+++ b/drivers/net/ethernet/mellanox/mlxsw/reg.h
@@ -1873,7 +1873,7 @@ static inline void mlxsw_reg_qtct_pack(char *payload, u8 local_port,
  * Configures the ETS elements.
  */
 #define MLXSW_REG_QEEC_ID 0x400D
-#define MLXSW_REG_QEEC_LEN 0x1C
+#define MLXSW_REG_QEEC_LEN 0x20
 
 static const struct mlxsw_reg_info mlxsw_reg_qeec = {
 	.id = MLXSW_REG_QEEC_ID,
@@ -1918,6 +1918,15 @@ MLXSW_ITEM32(reg, qeec, element_index, 0x04, 0, 8);
  */
 MLXSW_ITEM32(reg, qeec, next_element_index, 0x08, 0, 8);
 
+/* reg_qeec_mise
+ * Min shaper configuration enable. Enables configuration of the min
+ * shaper on this ETS element
+ * 0 - Disable
+ * 1 - Enable
+ * Access: RW
+ */
+MLXSW_ITEM32(reg, qeec, mise, 0x0C, 31, 1);
+
 enum {
 	MLXSW_REG_QEEC_BYTES_MODE,
 	MLXSW_REG_QEEC_PACKETS_MODE,
@@ -1934,6 +1943,17 @@ enum {
  */
 MLXSW_ITEM32(reg, qeec, pb, 0x0C, 28, 1);
 
+/* The smallest permitted min shaper rate. */
+#define MLXSW_REG_QEEC_MIS_MIN	200000		/* Kbps */
+
+/* reg_qeec_min_shaper_rate
+ * Min shaper information rate.
+ * For CPU port, can only be configured for port hierarchy.
+ * When in bytes mode, value is specified in units of 1000bps.
+ * Access: RW
+ */
+MLXSW_ITEM32(reg, qeec, min_shaper_rate, 0x0C, 0, 28);
+
 /* reg_qeec_mase
  * Max shaper configuration enable. Enables configuration of the max
  * shaper on this ETS element.
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 012/271] pcrypt: use format specifier in kobject_add
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (10 preceding siblings ...)
  2020-01-28 14:02 ` [PATCH 4.9 011/271] mlxsw: reg: QEEC: Add minimum shaper fields Greg Kroah-Hartman
@ 2020-01-28 14:02 ` Greg Kroah-Hartman
  2020-01-28 14:02 ` [PATCH 4.9 013/271] exportfs: fix passing zero to ERR_PTR() warning Greg Kroah-Hartman
                   ` (263 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:02 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Colin Ian King, Herbert Xu, Sasha Levin

From: Colin Ian King <colin.king@canonical.com>

[ Upstream commit b1e3874c75ab15288f573b3532e507c37e8e7656 ]

Passing string 'name' as the format specifier is potentially hazardous
because name could (although very unlikely to) have a format specifier
embedded in it causing issues when parsing the non-existent arguments
to these.  Follow best practice by using the "%s" format string for
the string 'name'.

Cleans up clang warning:
crypto/pcrypt.c:397:40: warning: format string is not a string literal
(potentially insecure) [-Wformat-security]

Fixes: a3fb1e330dd2 ("pcrypt: Added sysfs interface to pcrypt")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 crypto/pcrypt.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/crypto/pcrypt.c b/crypto/pcrypt.c
index f8ec3d4ba4a80..a5718c0a3dc4e 100644
--- a/crypto/pcrypt.c
+++ b/crypto/pcrypt.c
@@ -394,7 +394,7 @@ static int pcrypt_sysfs_add(struct padata_instance *pinst, const char *name)
 	int ret;
 
 	pinst->kobj.kset = pcrypt_kset;
-	ret = kobject_add(&pinst->kobj, NULL, name);
+	ret = kobject_add(&pinst->kobj, NULL, "%s", name);
 	if (!ret)
 		kobject_uevent(&pinst->kobj, KOBJ_ADD);
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 013/271] exportfs: fix passing zero to ERR_PTR() warning
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (11 preceding siblings ...)
  2020-01-28 14:02 ` [PATCH 4.9 012/271] pcrypt: use format specifier in kobject_add Greg Kroah-Hartman
@ 2020-01-28 14:02 ` Greg Kroah-Hartman
  2020-01-28 14:02 ` [PATCH 4.9 014/271] drm/dp_mst: Skip validating ports during destruction, just ref Greg Kroah-Hartman
                   ` (262 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:02 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, YueHaibing, Al Viro, Sasha Levin

From: YueHaibing <yuehaibing@huawei.com>

[ Upstream commit 909e22e05353a783c526829427e9a8de122fba9c ]

Fix a static code checker warning:
  fs/exportfs/expfs.c:171 reconnect_one() warn: passing zero to 'ERR_PTR'

The error path for lookup_one_len_unlocked failure
should set err to PTR_ERR.

Fixes: bbf7a8a3562f ("exportfs: move most of reconnect_path to helper function")
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/exportfs/expfs.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/exportfs/expfs.c b/fs/exportfs/expfs.c
index 3706939e5dd5e..1730122b10e06 100644
--- a/fs/exportfs/expfs.c
+++ b/fs/exportfs/expfs.c
@@ -146,6 +146,7 @@ static struct dentry *reconnect_one(struct vfsmount *mnt,
 	tmp = lookup_one_len_unlocked(nbuf, parent, strlen(nbuf));
 	if (IS_ERR(tmp)) {
 		dprintk("%s: lookup failed: %d\n", __func__, PTR_ERR(tmp));
+		err = PTR_ERR(tmp);
 		goto out_err;
 	}
 	if (tmp != dentry) {
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 014/271] drm/dp_mst: Skip validating ports during destruction, just ref
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (12 preceding siblings ...)
  2020-01-28 14:02 ` [PATCH 4.9 013/271] exportfs: fix passing zero to ERR_PTR() warning Greg Kroah-Hartman
@ 2020-01-28 14:02 ` Greg Kroah-Hartman
  2020-01-28 14:02 ` [PATCH 4.9 015/271] net: phy: Fix not to call phy_resume() if PHY is not attached Greg Kroah-Hartman
                   ` (261 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:02 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lyude Paul, Jerry Zuo,
	Harry Wentland, Dave Airlie, Sean Paul, Sasha Levin

From: Lyude Paul <lyude@redhat.com>

[ Upstream commit c54c7374ff44de5e609506aca7c0deae4703b6d1 ]

Jerry Zuo pointed out a rather obscure hotplugging issue that it seems I
accidentally introduced into DRM two years ago.

Pretend we have a topology like this:

|- DP-1: mst_primary
   |- DP-4: active display
   |- DP-5: disconnected
   |- DP-6: active hub
      |- DP-7: active display
      |- DP-8: disconnected
      |- DP-9: disconnected

If we unplug DP-6, the topology starting at DP-7 will be destroyed but
it's payloads will live on in DP-1's VCPI allocations and thus require
removal. However, this removal currently fails because
drm_dp_update_payload_part1() will (rightly so) try to validate the port
before accessing it, fail then abort. If we keep going, eventually we
run the MST hub out of bandwidth and all new allocations will start to
fail (or in my case; all new displays just start flickering a ton).

We could just teach drm_dp_update_payload_part1() not to drop the port
ref in this case, but then we also need to teach
drm_dp_destroy_payload_step1() to do the same thing, then hope no one
ever adds anything to the that requires a validated port reference in
drm_dp_destroy_connector_work(). Kind of sketchy.

So let's go with a more clever solution: any port that
drm_dp_destroy_connector_work() interacts with is guaranteed to still
exist in memory until we say so. While said port might not be valid we
don't really care: that's the whole reason we're destroying it in the
first place! So, teach drm_dp_get_validated_port_ref() to use the all
mighty current_work() function to avoid attempting to validate ports
from the context of mgr->destroy_connector_work. I can't see any
situation where this wouldn't be safe, and this avoids having to play
whack-a-mole in the future of trying to work around port validation.

Signed-off-by: Lyude Paul <lyude@redhat.com>
Fixes: 263efde31f97 ("drm/dp/mst: Get validated port ref in drm_dp_update_payload_part1()")
Reported-by: Jerry Zuo <Jerry.Zuo@amd.com>
Cc: Jerry Zuo <Jerry.Zuo@amd.com>
Cc: Harry Wentland <Harry.Wentland@amd.com>
Cc: <stable@vger.kernel.org> # v4.6+
Reviewed-by: Dave Airlie <airlied@redhat.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20181113224613.28809-1-lyude@redhat.com
Signed-off-by: Sean Paul <seanpaul@chromium.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/drm_dp_mst_topology.c | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
index e05dda92398c6..17aedaaf364c1 100644
--- a/drivers/gpu/drm/drm_dp_mst_topology.c
+++ b/drivers/gpu/drm/drm_dp_mst_topology.c
@@ -980,9 +980,20 @@ static struct drm_dp_mst_port *drm_dp_mst_get_port_ref_locked(struct drm_dp_mst_
 static struct drm_dp_mst_port *drm_dp_get_validated_port_ref(struct drm_dp_mst_topology_mgr *mgr, struct drm_dp_mst_port *port)
 {
 	struct drm_dp_mst_port *rport = NULL;
+
 	mutex_lock(&mgr->lock);
-	if (mgr->mst_primary)
-		rport = drm_dp_mst_get_port_ref_locked(mgr->mst_primary, port);
+	/*
+	 * Port may or may not be 'valid' but we don't care about that when
+	 * destroying the port and we are guaranteed that the port pointer
+	 * will be valid until we've finished
+	 */
+	if (current_work() == &mgr->destroy_connector_work) {
+		kref_get(&port->kref);
+		rport = port;
+	} else if (mgr->mst_primary) {
+		rport = drm_dp_mst_get_port_ref_locked(mgr->mst_primary,
+						       port);
+	}
 	mutex_unlock(&mgr->lock);
 	return rport;
 }
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 015/271] net: phy: Fix not to call phy_resume() if PHY is not attached
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (13 preceding siblings ...)
  2020-01-28 14:02 ` [PATCH 4.9 014/271] drm/dp_mst: Skip validating ports during destruction, just ref Greg Kroah-Hartman
@ 2020-01-28 14:02 ` Greg Kroah-Hartman
  2020-01-28 14:02 ` [PATCH 4.9 016/271] pinctrl: sh-pfc: r8a7740: Add missing REF125CK pin to gether_gmii group Greg Kroah-Hartman
                   ` (260 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:02 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yoshihiro Shimoda, David S. Miller,
	Sasha Levin

From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>

[ Upstream commit ef1b5bf506b1f0ee3edc98533e1f3ecb105eb46a ]

This patch fixes an issue that mdio_bus_phy_resume() doesn't call
phy_resume() if the PHY is not attached.

Fixes: 803dd9c77ac3 ("net: phy: avoid suspending twice a PHY")
Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/phy/phy_device.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index 3289fd910c4a6..487d0372a4441 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -80,7 +80,7 @@ static LIST_HEAD(phy_fixup_list);
 static DEFINE_MUTEX(phy_fixup_lock);
 
 #ifdef CONFIG_PM
-static bool mdio_bus_phy_may_suspend(struct phy_device *phydev)
+static bool mdio_bus_phy_may_suspend(struct phy_device *phydev, bool suspend)
 {
 	struct device_driver *drv = phydev->mdio.dev.driver;
 	struct phy_driver *phydrv = to_phy_driver(drv);
@@ -92,10 +92,11 @@ static bool mdio_bus_phy_may_suspend(struct phy_device *phydev)
 	/* PHY not attached? May suspend if the PHY has not already been
 	 * suspended as part of a prior call to phy_disconnect() ->
 	 * phy_detach() -> phy_suspend() because the parent netdev might be the
-	 * MDIO bus driver and clock gated at this point.
+	 * MDIO bus driver and clock gated at this point. Also may resume if
+	 * PHY is not attached.
 	 */
 	if (!netdev)
-		return !phydev->suspended;
+		return suspend ? !phydev->suspended : phydev->suspended;
 
 	/* Don't suspend PHY if the attached netdev parent may wakeup.
 	 * The parent may point to a PCI device, as in tg3 driver.
@@ -125,7 +126,7 @@ static int mdio_bus_phy_suspend(struct device *dev)
 	if (phydev->attached_dev && phydev->adjust_link)
 		phy_stop_machine(phydev);
 
-	if (!mdio_bus_phy_may_suspend(phydev))
+	if (!mdio_bus_phy_may_suspend(phydev, true))
 		return 0;
 
 	return phy_suspend(phydev);
@@ -136,7 +137,7 @@ static int mdio_bus_phy_resume(struct device *dev)
 	struct phy_device *phydev = to_phy_device(dev);
 	int ret;
 
-	if (!mdio_bus_phy_may_suspend(phydev))
+	if (!mdio_bus_phy_may_suspend(phydev, false))
 		goto no_resume;
 
 	ret = phy_resume(phydev);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 016/271] pinctrl: sh-pfc: r8a7740: Add missing REF125CK pin to gether_gmii group
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (14 preceding siblings ...)
  2020-01-28 14:02 ` [PATCH 4.9 015/271] net: phy: Fix not to call phy_resume() if PHY is not attached Greg Kroah-Hartman
@ 2020-01-28 14:02 ` Greg Kroah-Hartman
  2020-01-28 14:02 ` [PATCH 4.9 017/271] pinctrl: sh-pfc: r8a7740: Add missing LCD0 marks to lcd0_data24_1 group Greg Kroah-Hartman
                   ` (259 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:02 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Geert Uytterhoeven, Simon Horman,
	Sasha Levin

From: Geert Uytterhoeven <geert+renesas@glider.be>

[ Upstream commit 1ebc589a7786f17f97b9e87b44e0fb4d0290d8f8 ]

The gether_gmii_mux[] array contains the REF125CK pin mark, but the
gether_gmii_pins[] array lacks the corresponding pin number.

Fixes: bae11d30d0cafdc5 ("sh-pfc: r8a7740: Add GETHER pin groups and functions")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pinctrl/sh-pfc/pfc-r8a7740.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7740.c b/drivers/pinctrl/sh-pfc/pfc-r8a7740.c
index 35f436bcb8491..d8077065636e3 100644
--- a/drivers/pinctrl/sh-pfc/pfc-r8a7740.c
+++ b/drivers/pinctrl/sh-pfc/pfc-r8a7740.c
@@ -1982,7 +1982,7 @@ static const unsigned int gether_gmii_pins[] = {
 	 */
 	185, 186, 187, 188, 189, 190, 191, 192, 174, 161, 204,
 	171, 170, 169, 168, 167, 166, 173, 172, 176, 184, 183, 203,
-	205, 163, 206, 207,
+	205, 163, 206, 207, 158,
 };
 static const unsigned int gether_gmii_mux[] = {
 	ET_ERXD0_MARK, ET_ERXD1_MARK, ET_ERXD2_MARK, ET_ERXD3_MARK,
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 017/271] pinctrl: sh-pfc: r8a7740: Add missing LCD0 marks to lcd0_data24_1 group
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (15 preceding siblings ...)
  2020-01-28 14:02 ` [PATCH 4.9 016/271] pinctrl: sh-pfc: r8a7740: Add missing REF125CK pin to gether_gmii group Greg Kroah-Hartman
@ 2020-01-28 14:02 ` Greg Kroah-Hartman
  2020-01-28 14:02 ` [PATCH 4.9 018/271] pinctrl: sh-pfc: r8a7791: Remove bogus ctrl marks from qspi_data4_b group Greg Kroah-Hartman
                   ` (258 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:02 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Geert Uytterhoeven, Simon Horman,
	Sasha Levin

From: Geert Uytterhoeven <geert+renesas@glider.be>

[ Upstream commit 96bb2a6ab4eca10e5b6490b3f0738e9f7ec22c2b ]

The lcd0_data24_1_pins[] array contains the LCD0 D1[2-5] pin numbers,
but the lcd0_data24_1_mux[] array lacks the corresponding pin marks.

Fixes: 06c7dd866da70f6c ("sh-pfc: r8a7740: Add LCDC0 and LCDC1 pin groups and functions")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pinctrl/sh-pfc/pfc-r8a7740.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7740.c b/drivers/pinctrl/sh-pfc/pfc-r8a7740.c
index d8077065636e3..e9739dbcb356e 100644
--- a/drivers/pinctrl/sh-pfc/pfc-r8a7740.c
+++ b/drivers/pinctrl/sh-pfc/pfc-r8a7740.c
@@ -2154,6 +2154,7 @@ static const unsigned int lcd0_data24_1_mux[] = {
 	LCD0_D0_MARK, LCD0_D1_MARK, LCD0_D2_MARK, LCD0_D3_MARK,
 	LCD0_D4_MARK, LCD0_D5_MARK, LCD0_D6_MARK, LCD0_D7_MARK,
 	LCD0_D8_MARK, LCD0_D9_MARK, LCD0_D10_MARK, LCD0_D11_MARK,
+	LCD0_D12_MARK, LCD0_D13_MARK, LCD0_D14_MARK, LCD0_D15_MARK,
 	LCD0_D16_MARK, LCD0_D17_MARK, LCD0_D18_PORT163_MARK,
 	LCD0_D19_PORT162_MARK, LCD0_D20_PORT161_MARK, LCD0_D21_PORT158_MARK,
 	LCD0_D22_PORT160_MARK, LCD0_D23_PORT159_MARK,
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 018/271] pinctrl: sh-pfc: r8a7791: Remove bogus ctrl marks from qspi_data4_b group
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (16 preceding siblings ...)
  2020-01-28 14:02 ` [PATCH 4.9 017/271] pinctrl: sh-pfc: r8a7740: Add missing LCD0 marks to lcd0_data24_1 group Greg Kroah-Hartman
@ 2020-01-28 14:02 ` Greg Kroah-Hartman
  2020-01-28 14:02 ` [PATCH 4.9 019/271] pinctrl: sh-pfc: r8a7791: Remove bogus marks from vin1_b_data18 group Greg Kroah-Hartman
                   ` (257 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:02 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Geert Uytterhoeven, Simon Horman,
	Sasha Levin

From: Geert Uytterhoeven <geert+renesas@glider.be>

[ Upstream commit 884fa25fb6e5e63ab970d612a628313bb68f37cc ]

The qspi_data4_b_mux[] array contains pin marks for the clock and chip
select pins.  The qspi_data4_b_pins[] array rightfully does not contain
the corresponding pin numbers, as the control pins are provided by a
separate group (qspi_ctrl_b).

Fixes: 2d0c386f135e4186 ("pinctrl: sh-pfc: r8a7791: Add QSPI pin groups")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pinctrl/sh-pfc/pfc-r8a7791.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7791.c b/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
index baa98d7fe9473..fcf731994811f 100644
--- a/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
+++ b/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
@@ -3136,8 +3136,7 @@ static const unsigned int qspi_data4_b_pins[] = {
 	RCAR_GP_PIN(6, 4),
 };
 static const unsigned int qspi_data4_b_mux[] = {
-	SPCLK_B_MARK, MOSI_IO0_B_MARK, MISO_IO1_B_MARK,
-	IO2_B_MARK, IO3_B_MARK, SSL_B_MARK,
+	MOSI_IO0_B_MARK, MISO_IO1_B_MARK, IO2_B_MARK, IO3_B_MARK,
 };
 /* - SCIF0 ------------------------------------------------------------------ */
 static const unsigned int scif0_data_pins[] = {
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 019/271] pinctrl: sh-pfc: r8a7791: Remove bogus marks from vin1_b_data18 group
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (17 preceding siblings ...)
  2020-01-28 14:02 ` [PATCH 4.9 018/271] pinctrl: sh-pfc: r8a7791: Remove bogus ctrl marks from qspi_data4_b group Greg Kroah-Hartman
@ 2020-01-28 14:02 ` Greg Kroah-Hartman
  2020-01-28 14:02 ` [PATCH 4.9 020/271] pinctrl: sh-pfc: sh73a0: Add missing TO pin to tpu4_to3 group Greg Kroah-Hartman
                   ` (256 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:02 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Geert Uytterhoeven, Simon Horman,
	Sasha Levin

From: Geert Uytterhoeven <geert+renesas@glider.be>

[ Upstream commit 0d6256cb880166a4111bebce35790019e56b6e1b ]

The vin1_b_data18_mux[] arrays contains pin marks for the 2 LSB bits of
the color components.  The vin1_b_data18_pins[] array rightfully does
not include the corresponding pin numbers, as RGB18 is subset of RGB24,
containing only the 6 MSB bits of each component.

Fixes: 8e32c9671f84acd8 ("pinctrl: sh-pfc: r8a7791: Add VIN pins")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pinctrl/sh-pfc/pfc-r8a7791.c | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7791.c b/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
index fcf731994811f..1e7f32b5dce8c 100644
--- a/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
+++ b/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
@@ -4264,17 +4264,14 @@ static const unsigned int vin1_b_data18_pins[] = {
 };
 static const unsigned int vin1_b_data18_mux[] = {
 	/* B */
-	VI1_DATA0_B_MARK, VI1_DATA1_B_MARK,
 	VI1_DATA2_B_MARK, VI1_DATA3_B_MARK,
 	VI1_DATA4_B_MARK, VI1_DATA5_B_MARK,
 	VI1_DATA6_B_MARK, VI1_DATA7_B_MARK,
 	/* G */
-	VI1_G0_B_MARK, VI1_G1_B_MARK,
 	VI1_G2_B_MARK, VI1_G3_B_MARK,
 	VI1_G4_B_MARK, VI1_G5_B_MARK,
 	VI1_G6_B_MARK, VI1_G7_B_MARK,
 	/* R */
-	VI1_R0_B_MARK, VI1_R1_B_MARK,
 	VI1_R2_B_MARK, VI1_R3_B_MARK,
 	VI1_R4_B_MARK, VI1_R5_B_MARK,
 	VI1_R6_B_MARK, VI1_R7_B_MARK,
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 020/271] pinctrl: sh-pfc: sh73a0: Add missing TO pin to tpu4_to3 group
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (18 preceding siblings ...)
  2020-01-28 14:02 ` [PATCH 4.9 019/271] pinctrl: sh-pfc: r8a7791: Remove bogus marks from vin1_b_data18 group Greg Kroah-Hartman
@ 2020-01-28 14:02 ` Greg Kroah-Hartman
  2020-01-28 14:02 ` [PATCH 4.9 021/271] pinctrl: sh-pfc: r8a7794: Remove bogus IPSR9 field Greg Kroah-Hartman
                   ` (255 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:02 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Geert Uytterhoeven, Simon Horman,
	Sasha Levin

From: Geert Uytterhoeven <geert+renesas@glider.be>

[ Upstream commit 124cde98f856b6206b804acbdec3b7c80f8c3427 ]

The tpu4_to3_mux[] array contains the TPU4TO3 pin mark, but the
tpu4_to3_pins[] array lacks the corresponding pin number.

Add the missing pin number, for non-GPIO pin F26.

Fixes: 5da4eb049de803c7 ("sh-pfc: sh73a0: Add TPU pin groups and functions")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pinctrl/sh-pfc/pfc-sh73a0.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/pinctrl/sh-pfc/pfc-sh73a0.c b/drivers/pinctrl/sh-pfc/pfc-sh73a0.c
index d25e6f674d0ab..f8fbedb46585d 100644
--- a/drivers/pinctrl/sh-pfc/pfc-sh73a0.c
+++ b/drivers/pinctrl/sh-pfc/pfc-sh73a0.c
@@ -3086,6 +3086,7 @@ static const unsigned int tpu4_to2_mux[] = {
 };
 static const unsigned int tpu4_to3_pins[] = {
 	/* TO */
+	PIN_NUMBER(6, 26),
 };
 static const unsigned int tpu4_to3_mux[] = {
 	TPU4TO3_MARK,
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 021/271] pinctrl: sh-pfc: r8a7794: Remove bogus IPSR9 field
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (19 preceding siblings ...)
  2020-01-28 14:02 ` [PATCH 4.9 020/271] pinctrl: sh-pfc: sh73a0: Add missing TO pin to tpu4_to3 group Greg Kroah-Hartman
@ 2020-01-28 14:02 ` Greg Kroah-Hartman
  2020-01-28 14:02 ` [PATCH 4.9 022/271] pinctrl: sh-pfc: sh7734: Add missing IPSR11 field Greg Kroah-Hartman
                   ` (254 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:02 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Geert Uytterhoeven, Simon Horman,
	Sasha Levin

From: Geert Uytterhoeven <geert+renesas@glider.be>

[ Upstream commit 6a6c195d98a1a5e70faa87f594d7564af1dd1bed ]

The Peripheral Function Select Register 9 contains 12 fields, but the
variable field descriptor contains a 13th bogus field of 3 bits.

Fixes: 43c4436e2f1890a7 ("pinctrl: sh-pfc: add R8A7794 PFC support")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pinctrl/sh-pfc/pfc-r8a7794.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7794.c b/drivers/pinctrl/sh-pfc/pfc-r8a7794.c
index ef093ac0cf2fb..fe8c9c24634d8 100644
--- a/drivers/pinctrl/sh-pfc/pfc-r8a7794.c
+++ b/drivers/pinctrl/sh-pfc/pfc-r8a7794.c
@@ -4826,7 +4826,7 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = {
 		FN_AVB_MDC, FN_SSI_SDATA6_B, 0, 0, }
 	},
 	{ PINMUX_CFG_REG_VAR("IPSR9", 0xE6060044, 32,
-			     1, 3, 3, 3, 3, 2, 2, 3, 3, 3, 3, 3, 3) {
+			     1, 3, 3, 3, 3, 2, 2, 3, 3, 3, 3, 3) {
 		/* IP9_31 [1] */
 		0, 0,
 		/* IP9_30_28 [3] */
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 022/271] pinctrl: sh-pfc: sh7734: Add missing IPSR11 field
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (20 preceding siblings ...)
  2020-01-28 14:02 ` [PATCH 4.9 021/271] pinctrl: sh-pfc: r8a7794: Remove bogus IPSR9 field Greg Kroah-Hartman
@ 2020-01-28 14:02 ` Greg Kroah-Hartman
  2020-01-28 14:02 ` [PATCH 4.9 023/271] pinctrl: sh-pfc: sh7269: Add missing PCIOR0 field Greg Kroah-Hartman
                   ` (253 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:02 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Geert Uytterhoeven, Simon Horman,
	Sasha Levin

From: Geert Uytterhoeven <geert+renesas@glider.be>

[ Upstream commit 94482af7055e1ffa211c1135256b85590ebcac99 ]

The Peripheral Function Select Register 11 contains 3 reserved bits and
15 variable-width fields, but the variable field descriptor does not
contain the 3-bit field IP11[25:23].

Fixes: 856cb4bb337ee504 ("sh: Add support pinmux for SH7734")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pinctrl/sh-pfc/pfc-sh7734.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/pinctrl/sh-pfc/pfc-sh7734.c b/drivers/pinctrl/sh-pfc/pfc-sh7734.c
index 3eccc9b3ca84a..05ccb27f77818 100644
--- a/drivers/pinctrl/sh-pfc/pfc-sh7734.c
+++ b/drivers/pinctrl/sh-pfc/pfc-sh7734.c
@@ -2237,7 +2237,7 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = {
 		FN_LCD_DATA15_B, 0, 0, 0 }
 	},
 	{ PINMUX_CFG_REG_VAR("IPSR11", 0xFFFC0048, 32,
-			3, 1, 2, 2, 2, 3, 3, 1, 2, 3, 3, 1, 1, 1, 1) {
+			3, 1, 2, 3, 2, 2, 3, 3, 1, 2, 3, 3, 1, 1, 1, 1) {
 	    /* IP11_31_29 [3] */
 	    0, 0, 0, 0, 0, 0, 0, 0,
 	    /* IP11_28 [1] */
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 023/271] pinctrl: sh-pfc: sh7269: Add missing PCIOR0 field
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (21 preceding siblings ...)
  2020-01-28 14:02 ` [PATCH 4.9 022/271] pinctrl: sh-pfc: sh7734: Add missing IPSR11 field Greg Kroah-Hartman
@ 2020-01-28 14:02 ` Greg Kroah-Hartman
  2020-01-28 14:02 ` [PATCH 4.9 024/271] pinctrl: sh-pfc: sh7734: Remove bogus IPSR10 value Greg Kroah-Hartman
                   ` (252 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:02 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Geert Uytterhoeven, Simon Horman,
	Sasha Levin

From: Geert Uytterhoeven <geert+renesas@glider.be>

[ Upstream commit 9540cbdfcd861caf67a6f0e4bb7f46d41c4aad86 ]

The Port C I/O Register 0 contains 7 reserved bits, but the descriptor
contains only dummy configuration values for 6 reserved bits, thus
breaking the configuration of all subsequent fields in the register.

Fix this by adding the two missing configuration values.

Fixes: f5e811f2a43117b2 ("sh-pfc: Add sh7269 pinmux support")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pinctrl/sh-pfc/pfc-sh7269.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/pinctrl/sh-pfc/pfc-sh7269.c b/drivers/pinctrl/sh-pfc/pfc-sh7269.c
index a50d22bef1f44..cfdb4fc177c3e 100644
--- a/drivers/pinctrl/sh-pfc/pfc-sh7269.c
+++ b/drivers/pinctrl/sh-pfc/pfc-sh7269.c
@@ -2119,7 +2119,7 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = {
 	},
 
 	{ PINMUX_CFG_REG("PCIOR0", 0xfffe3852, 16, 1) {
-		0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+		0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
 		PC8_IN, PC8_OUT,
 		PC7_IN, PC7_OUT,
 		PC6_IN, PC6_OUT,
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 024/271] pinctrl: sh-pfc: sh7734: Remove bogus IPSR10 value
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (22 preceding siblings ...)
  2020-01-28 14:02 ` [PATCH 4.9 023/271] pinctrl: sh-pfc: sh7269: Add missing PCIOR0 field Greg Kroah-Hartman
@ 2020-01-28 14:02 ` Greg Kroah-Hartman
  2020-01-28 14:02 ` [PATCH 4.9 025/271] Input: nomadik-ske-keypad - fix a loop timeout test Greg Kroah-Hartman
                   ` (251 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:02 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Geert Uytterhoeven, Simon Horman,
	Sasha Levin

From: Geert Uytterhoeven <geert+renesas@glider.be>

[ Upstream commit 4d374bacd7c9665179f9752a52d5d602c45d8190 ]

The IP10[5:3] field in Peripheral Function Select Register 10 has a
width of 3 bits, i.e. it allows programming one out of 8 different
configurations.
However, 9 values are provided instead of 8, overflowing into the
subsequent field in the register, and thus breaking the configuration of
the latter.

Fix this by dropping a bogus zero value.

Fixes: ac1ebc2190f575fc ("sh-pfc: Add sh7734 pinmux support")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pinctrl/sh-pfc/pfc-sh7734.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/pinctrl/sh-pfc/pfc-sh7734.c b/drivers/pinctrl/sh-pfc/pfc-sh7734.c
index 05ccb27f77818..c691e5e9d9dea 100644
--- a/drivers/pinctrl/sh-pfc/pfc-sh7734.c
+++ b/drivers/pinctrl/sh-pfc/pfc-sh7734.c
@@ -2231,7 +2231,7 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = {
 		FN_LCD_CL1_B, 0, 0,
 	    /* IP10_5_3 [3] */
 		FN_SSI_WS23, FN_VI1_5_B, FN_TX1_D, FN_HSCK0_C, FN_FALE_B,
-		FN_LCD_DON_B, 0, 0, 0,
+		FN_LCD_DON_B, 0, 0,
 	    /* IP10_2_0 [3] */
 		FN_SSI_SCK23, FN_VI1_4_B, FN_RX1_D, FN_FCLE_B,
 		FN_LCD_DATA15_B, 0, 0, 0 }
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 025/271] Input: nomadik-ske-keypad - fix a loop timeout test
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (23 preceding siblings ...)
  2020-01-28 14:02 ` [PATCH 4.9 024/271] pinctrl: sh-pfc: sh7734: Remove bogus IPSR10 value Greg Kroah-Hartman
@ 2020-01-28 14:02 ` Greg Kroah-Hartman
  2020-01-28 14:02 ` [PATCH 4.9 026/271] clk: highbank: fix refcount leak in hb_clk_init() Greg Kroah-Hartman
                   ` (250 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:02 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Dmitry Torokhov, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit 4d8f727b83bcd6702c2d210330872c9122d2d360 ]

The loop exits with "timeout" set to -1 not to 0.

Fixes: 1158f0f16224 ("Input: add support for Nomadik SKE keypad controller")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/input/keyboard/nomadik-ske-keypad.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/input/keyboard/nomadik-ske-keypad.c b/drivers/input/keyboard/nomadik-ske-keypad.c
index 8567ee47761e1..ae3b045570740 100644
--- a/drivers/input/keyboard/nomadik-ske-keypad.c
+++ b/drivers/input/keyboard/nomadik-ske-keypad.c
@@ -100,7 +100,7 @@ static int __init ske_keypad_chip_init(struct ske_keypad *keypad)
 	while ((readl(keypad->reg_base + SKE_RIS) != 0x00000000) && timeout--)
 		cpu_relax();
 
-	if (!timeout)
+	if (timeout == -1)
 		return -EINVAL;
 
 	/*
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 026/271] clk: highbank: fix refcount leak in hb_clk_init()
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (24 preceding siblings ...)
  2020-01-28 14:02 ` [PATCH 4.9 025/271] Input: nomadik-ske-keypad - fix a loop timeout test Greg Kroah-Hartman
@ 2020-01-28 14:02 ` Greg Kroah-Hartman
  2020-01-28 14:02 ` [PATCH 4.9 027/271] clk: qoriq: fix refcount leak in clockgen_init() Greg Kroah-Hartman
                   ` (249 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:02 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yangtao Li, Stephen Boyd, Sasha Levin

From: Yangtao Li <tiny.windzz@gmail.com>

[ Upstream commit 5eb8ba90958de1285120dae5d3a5d2b1a360b3b4 ]

The of_find_compatible_node() returns a node pointer with refcount
incremented, but there is the lack of use of the of_node_put() when
done. Add the missing of_node_put() to release the refcount.

Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
Fixes: 26cae166cff9 ("ARM: highbank: remove custom .init_time hook")
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/clk-highbank.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/clk/clk-highbank.c b/drivers/clk/clk-highbank.c
index 727ed8e1bb726..8e4581004695c 100644
--- a/drivers/clk/clk-highbank.c
+++ b/drivers/clk/clk-highbank.c
@@ -293,6 +293,7 @@ static __init struct clk *hb_clk_init(struct device_node *node, const struct clk
 	/* Map system registers */
 	srnp = of_find_compatible_node(NULL, NULL, "calxeda,hb-sregs");
 	hb_clk->reg = of_iomap(srnp, 0);
+	of_node_put(srnp);
 	BUG_ON(!hb_clk->reg);
 	hb_clk->reg += reg;
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 027/271] clk: qoriq: fix refcount leak in clockgen_init()
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (25 preceding siblings ...)
  2020-01-28 14:02 ` [PATCH 4.9 026/271] clk: highbank: fix refcount leak in hb_clk_init() Greg Kroah-Hartman
@ 2020-01-28 14:02 ` Greg Kroah-Hartman
  2020-01-28 14:02 ` [PATCH 4.9 028/271] clk: socfpga: fix refcount leak Greg Kroah-Hartman
                   ` (248 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:02 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yangtao Li, Stephen Boyd, Sasha Levin

From: Yangtao Li <tiny.windzz@gmail.com>

[ Upstream commit 70af6c5b5270e8101f318c4b69cc98a726edfab9 ]

The of_find_compatible_node() returns a node pointer with refcount
incremented, but there is the lack of use of the of_node_put() when
done. Add the missing of_node_put() to release the refcount.

Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
Fixes: 0dfc86b3173f ("clk: qoriq: Move chip-specific knowledge into driver")
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/clk-qoriq.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/clk/clk-qoriq.c b/drivers/clk/clk-qoriq.c
index cdce49f6476aa..65876ff6df411 100644
--- a/drivers/clk/clk-qoriq.c
+++ b/drivers/clk/clk-qoriq.c
@@ -1245,6 +1245,7 @@ static void __init clockgen_init(struct device_node *np)
 				pr_err("%s: Couldn't map %s regs\n", __func__,
 				       guts->full_name);
 			}
+			of_node_put(guts);
 		}
 
 	}
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 028/271] clk: socfpga: fix refcount leak
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (26 preceding siblings ...)
  2020-01-28 14:02 ` [PATCH 4.9 027/271] clk: qoriq: fix refcount leak in clockgen_init() Greg Kroah-Hartman
@ 2020-01-28 14:02 ` Greg Kroah-Hartman
  2020-01-28 14:02 ` [PATCH 4.9 029/271] clk: samsung: exynos4: fix refcount leak in exynos4_get_xom() Greg Kroah-Hartman
                   ` (247 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:02 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yangtao Li, Stephen Boyd, Sasha Levin

From: Yangtao Li <tiny.windzz@gmail.com>

[ Upstream commit 7f9705beeb3759e69165e7aff588f6488ff6c1ac ]

The of_find_compatible_node() returns a node pointer with refcount
incremented, but there is the lack of use of the of_node_put() when
done. Add the missing of_node_put() to release the refcount.

Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
Fixes: 5343325ff3dd ("clk: socfpga: add a clock driver for the Arria 10 platform")
Fixes: a30d27ed739b ("clk: socfpga: fix clock driver for 3.15")
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/socfpga/clk-pll-a10.c | 1 +
 drivers/clk/socfpga/clk-pll.c     | 1 +
 2 files changed, 2 insertions(+)

diff --git a/drivers/clk/socfpga/clk-pll-a10.c b/drivers/clk/socfpga/clk-pll-a10.c
index 35fabe1a32c30..269467e8e07e1 100644
--- a/drivers/clk/socfpga/clk-pll-a10.c
+++ b/drivers/clk/socfpga/clk-pll-a10.c
@@ -95,6 +95,7 @@ static struct clk * __init __socfpga_pll_init(struct device_node *node,
 
 	clkmgr_np = of_find_compatible_node(NULL, NULL, "altr,clk-mgr");
 	clk_mgr_a10_base_addr = of_iomap(clkmgr_np, 0);
+	of_node_put(clkmgr_np);
 	BUG_ON(!clk_mgr_a10_base_addr);
 	pll_clk->hw.reg = clk_mgr_a10_base_addr + reg;
 
diff --git a/drivers/clk/socfpga/clk-pll.c b/drivers/clk/socfpga/clk-pll.c
index c7f463172e4b9..b4b44e9b59011 100644
--- a/drivers/clk/socfpga/clk-pll.c
+++ b/drivers/clk/socfpga/clk-pll.c
@@ -100,6 +100,7 @@ static __init struct clk *__socfpga_pll_init(struct device_node *node,
 
 	clkmgr_np = of_find_compatible_node(NULL, NULL, "altr,clk-mgr");
 	clk_mgr_base_addr = of_iomap(clkmgr_np, 0);
+	of_node_put(clkmgr_np);
 	BUG_ON(!clk_mgr_base_addr);
 	pll_clk->hw.reg = clk_mgr_base_addr + reg;
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 029/271] clk: samsung: exynos4: fix refcount leak in exynos4_get_xom()
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (27 preceding siblings ...)
  2020-01-28 14:02 ` [PATCH 4.9 028/271] clk: socfpga: fix refcount leak Greg Kroah-Hartman
@ 2020-01-28 14:02 ` Greg Kroah-Hartman
  2020-01-28 14:02 ` [PATCH 4.9 030/271] clk: imx6q: fix refcount leak in imx6q_clocks_init() Greg Kroah-Hartman
                   ` (246 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:02 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yangtao Li, Stephen Boyd, Sasha Levin

From: Yangtao Li <tiny.windzz@gmail.com>

[ Upstream commit cee82eb9532090cd1dc953e845d71f9b1445c84e ]

The of_find_compatible_node() returns a node pointer with refcount
incremented, but there is the lack of use of the of_node_put() when
done. Add the missing of_node_put() to release the refcount.

Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
Fixes: e062b571777f ("clk: exynos4: register clocks using common clock framework")
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/samsung/clk-exynos4.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/clk/samsung/clk-exynos4.c b/drivers/clk/samsung/clk-exynos4.c
index faab9b31baf5b..91f9b79e39411 100644
--- a/drivers/clk/samsung/clk-exynos4.c
+++ b/drivers/clk/samsung/clk-exynos4.c
@@ -1225,6 +1225,7 @@ static unsigned long __init exynos4_get_xom(void)
 			xom = readl(chipid_base + 8);
 
 		iounmap(chipid_base);
+		of_node_put(np);
 	}
 
 	return xom;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 030/271] clk: imx6q: fix refcount leak in imx6q_clocks_init()
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (28 preceding siblings ...)
  2020-01-28 14:02 ` [PATCH 4.9 029/271] clk: samsung: exynos4: fix refcount leak in exynos4_get_xom() Greg Kroah-Hartman
@ 2020-01-28 14:02 ` Greg Kroah-Hartman
  2020-01-28 14:03 ` [PATCH 4.9 031/271] clk: imx6sx: fix refcount leak in imx6sx_clocks_init() Greg Kroah-Hartman
                   ` (245 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:02 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yangtao Li, Stephen Boyd, Sasha Levin

From: Yangtao Li <tiny.windzz@gmail.com>

[ Upstream commit c9ec1d8fef31b5fc9e90e99f9bd685db5caa7c5e ]

The of_find_compatible_node() returns a node pointer with refcount
incremented, but there is the lack of use of the of_node_put() when
done. Add the missing of_node_put() to release the refcount.

Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
Fixes: 2acd1b6f889c ("ARM: i.MX6: implement clocks using common clock framework")
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/imx/clk-imx6q.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/clk/imx/clk-imx6q.c b/drivers/clk/imx/clk-imx6q.c
index 14682df5d3123..d83f6221f1b00 100644
--- a/drivers/clk/imx/clk-imx6q.c
+++ b/drivers/clk/imx/clk-imx6q.c
@@ -174,6 +174,7 @@ static void __init imx6q_clocks_init(struct device_node *ccm_node)
 	np = of_find_compatible_node(NULL, NULL, "fsl,imx6q-anatop");
 	base = of_iomap(np, 0);
 	WARN_ON(!base);
+	of_node_put(np);
 
 	/* Audio/video PLL post dividers do not work on i.MX6q revision 1.0 */
 	if (clk_on_imx6q() && imx_get_soc_revision() == IMX_CHIP_REVISION_1_0) {
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 031/271] clk: imx6sx: fix refcount leak in imx6sx_clocks_init()
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (29 preceding siblings ...)
  2020-01-28 14:02 ` [PATCH 4.9 030/271] clk: imx6q: fix refcount leak in imx6q_clocks_init() Greg Kroah-Hartman
@ 2020-01-28 14:03 ` Greg Kroah-Hartman
  2020-01-28 14:03 ` [PATCH 4.9 032/271] clk: imx7d: fix refcount leak in imx7d_clocks_init() Greg Kroah-Hartman
                   ` (244 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:03 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yangtao Li, Stephen Boyd, Sasha Levin

From: Yangtao Li <tiny.windzz@gmail.com>

[ Upstream commit 1731e14fb30212dd8c1e9f8fc1af061e56498c55 ]

The of_find_compatible_node() returns a node pointer with refcount
incremented, but there is the lack of use of the of_node_put() when
done. Add the missing of_node_put() to release the refcount.

Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
Fixes: d55135689019 ("ARM: imx: add clock driver for imx6sx")
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/imx/clk-imx6sx.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/clk/imx/clk-imx6sx.c b/drivers/clk/imx/clk-imx6sx.c
index b5c96de41ccf9..8bbc2542f2f70 100644
--- a/drivers/clk/imx/clk-imx6sx.c
+++ b/drivers/clk/imx/clk-imx6sx.c
@@ -164,6 +164,7 @@ static void __init imx6sx_clocks_init(struct device_node *ccm_node)
 	np = of_find_compatible_node(NULL, NULL, "fsl,imx6sx-anatop");
 	base = of_iomap(np, 0);
 	WARN_ON(!base);
+	of_node_put(np);
 
 	clks[IMX6SX_PLL1_BYPASS_SRC] = imx_clk_mux("pll1_bypass_src", base + 0x00, 14, 1, pll_bypass_src_sels, ARRAY_SIZE(pll_bypass_src_sels));
 	clks[IMX6SX_PLL2_BYPASS_SRC] = imx_clk_mux("pll2_bypass_src", base + 0x30, 14, 1, pll_bypass_src_sels, ARRAY_SIZE(pll_bypass_src_sels));
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 032/271] clk: imx7d: fix refcount leak in imx7d_clocks_init()
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (30 preceding siblings ...)
  2020-01-28 14:03 ` [PATCH 4.9 031/271] clk: imx6sx: fix refcount leak in imx6sx_clocks_init() Greg Kroah-Hartman
@ 2020-01-28 14:03 ` Greg Kroah-Hartman
  2020-01-28 14:03 ` [PATCH 4.9 033/271] clk: vf610: fix refcount leak in vf610_clocks_init() Greg Kroah-Hartman
                   ` (243 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:03 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yangtao Li, Stephen Boyd, Sasha Levin

From: Yangtao Li <tiny.windzz@gmail.com>

[ Upstream commit 5f8c183a996b76bb09748073c856e4246fd4ce95 ]

The of_find_compatible_node() returns a node pointer with refcount
incremented, but there is the lack of use of the of_node_put() when
done. Add the missing of_node_put() to release the refcount.

Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
Fixes: 8f6d8094b215 ("ARM: imx: add imx7d clk tree support")
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/imx/clk-imx7d.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/clk/imx/clk-imx7d.c b/drivers/clk/imx/clk-imx7d.c
index e7c7353a86fc6..8c0c0d0151321 100644
--- a/drivers/clk/imx/clk-imx7d.c
+++ b/drivers/clk/imx/clk-imx7d.c
@@ -415,6 +415,7 @@ static void __init imx7d_clocks_init(struct device_node *ccm_node)
 	np = of_find_compatible_node(NULL, NULL, "fsl,imx7d-anatop");
 	base = of_iomap(np, 0);
 	WARN_ON(!base);
+	of_node_put(np);
 
 	clks[IMX7D_PLL_ARM_MAIN_SRC]  = imx_clk_mux("pll_arm_main_src", base + 0x60, 14, 2, pll_bypass_src_sel, ARRAY_SIZE(pll_bypass_src_sel));
 	clks[IMX7D_PLL_DRAM_MAIN_SRC] = imx_clk_mux("pll_dram_main_src", base + 0x70, 14, 2, pll_bypass_src_sel, ARRAY_SIZE(pll_bypass_src_sel));
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 033/271] clk: vf610: fix refcount leak in vf610_clocks_init()
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (31 preceding siblings ...)
  2020-01-28 14:03 ` [PATCH 4.9 032/271] clk: imx7d: fix refcount leak in imx7d_clocks_init() Greg Kroah-Hartman
@ 2020-01-28 14:03 ` Greg Kroah-Hartman
  2020-01-28 14:03 ` [PATCH 4.9 034/271] clk: armada-370: fix refcount leak in a370_clk_init() Greg Kroah-Hartman
                   ` (242 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:03 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yangtao Li, Stephen Boyd, Sasha Levin

From: Yangtao Li <tiny.windzz@gmail.com>

[ Upstream commit 567177024e0313e4f0dcba7ba10c0732e50e655d ]

The of_find_compatible_node() returns a node pointer with refcount
incremented, but there is the lack of use of the of_node_put() when
done. Add the missing of_node_put() to release the refcount.

Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
Fixes: 1f2c5fd5f048 ("ARM: imx: add VF610 clock support")
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/imx/clk-vf610.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/clk/imx/clk-vf610.c b/drivers/clk/imx/clk-vf610.c
index 0476353ab423f..a19ab032d0731 100644
--- a/drivers/clk/imx/clk-vf610.c
+++ b/drivers/clk/imx/clk-vf610.c
@@ -203,6 +203,7 @@ static void __init vf610_clocks_init(struct device_node *ccm_node)
 	np = of_find_compatible_node(NULL, NULL, "fsl,vf610-anatop");
 	anatop_base = of_iomap(np, 0);
 	BUG_ON(!anatop_base);
+	of_node_put(np);
 
 	np = ccm_node;
 	ccm_base = of_iomap(np, 0);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 034/271] clk: armada-370: fix refcount leak in a370_clk_init()
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (32 preceding siblings ...)
  2020-01-28 14:03 ` [PATCH 4.9 033/271] clk: vf610: fix refcount leak in vf610_clocks_init() Greg Kroah-Hartman
@ 2020-01-28 14:03 ` Greg Kroah-Hartman
  2020-01-28 14:03 ` [PATCH 4.9 035/271] clk: kirkwood: fix refcount leak in kirkwood_clk_init() Greg Kroah-Hartman
                   ` (241 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:03 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yangtao Li, Gregory CLEMENT,
	Stephen Boyd, Sasha Levin

From: Yangtao Li <tiny.windzz@gmail.com>

[ Upstream commit a3c24050bdf70c958a8d98c2823b66ea761e6a31 ]

The of_find_compatible_node() returns a node pointer with refcount
incremented, but there is the lack of use of the of_node_put() when
done. Add the missing of_node_put() to release the refcount.

Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
Reviewed-by: Gregory CLEMENT <gregory.clement@bootlin.com>
Fixes: 07ad6836fa21 ("clk: mvebu: armada-370: maintain clock init order")
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/mvebu/armada-370.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/clk/mvebu/armada-370.c b/drivers/clk/mvebu/armada-370.c
index 2c7c1085f8830..8fdfa97900cd8 100644
--- a/drivers/clk/mvebu/armada-370.c
+++ b/drivers/clk/mvebu/armada-370.c
@@ -177,8 +177,10 @@ static void __init a370_clk_init(struct device_node *np)
 
 	mvebu_coreclk_setup(np, &a370_coreclks);
 
-	if (cgnp)
+	if (cgnp) {
 		mvebu_clk_gating_setup(cgnp, a370_gating_desc);
+		of_node_put(cgnp);
+	}
 }
 CLK_OF_DECLARE(a370_clk, "marvell,armada-370-core-clock", a370_clk_init);
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 035/271] clk: kirkwood: fix refcount leak in kirkwood_clk_init()
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (33 preceding siblings ...)
  2020-01-28 14:03 ` [PATCH 4.9 034/271] clk: armada-370: fix refcount leak in a370_clk_init() Greg Kroah-Hartman
@ 2020-01-28 14:03 ` Greg Kroah-Hartman
  2020-01-28 14:03 ` [PATCH 4.9 036/271] clk: armada-xp: fix refcount leak in axp_clk_init() Greg Kroah-Hartman
                   ` (240 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:03 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yangtao Li, Gregory CLEMENT,
	Stephen Boyd, Sasha Levin

From: Yangtao Li <tiny.windzz@gmail.com>

[ Upstream commit e7beeab9c61591cd0e690d8733d534c3f4278ff8 ]

The of_find_compatible_node() returns a node pointer with refcount
incremented, but there is the lack of use of the of_node_put() when
done. Add the missing of_node_put() to release the refcount.

Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
Reviewed-by: Gregory CLEMENT <gregory.clement@bootlin.com>
Fixes: 58d516ae95cb ("clk: mvebu: kirkwood: maintain clock init order")
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/mvebu/kirkwood.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/clk/mvebu/kirkwood.c b/drivers/clk/mvebu/kirkwood.c
index a2a8d614039da..890ebf623261b 100644
--- a/drivers/clk/mvebu/kirkwood.c
+++ b/drivers/clk/mvebu/kirkwood.c
@@ -333,6 +333,8 @@ static void __init kirkwood_clk_init(struct device_node *np)
 	if (cgnp) {
 		mvebu_clk_gating_setup(cgnp, kirkwood_gating_desc);
 		kirkwood_clk_muxing_setup(cgnp, kirkwood_mux_desc);
+
+		of_node_put(cgnp);
 	}
 }
 CLK_OF_DECLARE(kirkwood_clk, "marvell,kirkwood-core-clock",
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 036/271] clk: armada-xp: fix refcount leak in axp_clk_init()
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (34 preceding siblings ...)
  2020-01-28 14:03 ` [PATCH 4.9 035/271] clk: kirkwood: fix refcount leak in kirkwood_clk_init() Greg Kroah-Hartman
@ 2020-01-28 14:03 ` Greg Kroah-Hartman
  2020-01-28 14:03 ` [PATCH 4.9 037/271] clk: dove: fix refcount leak in dove_clk_init() Greg Kroah-Hartman
                   ` (239 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:03 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yangtao Li, Gregory CLEMENT,
	Stephen Boyd, Sasha Levin

From: Yangtao Li <tiny.windzz@gmail.com>

[ Upstream commit db20a90a4b6745dad62753f8bd2f66afdd5abc84 ]

The of_find_compatible_node() returns a node pointer with refcount
incremented, but there is the lack of use of the of_node_put() when
done. Add the missing of_node_put() to release the refcount.

Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
Reviewed-by: Gregory CLEMENT <gregory.clement@bootlin.com>
Fixes: 0a11a6ae9437 ("clk: mvebu: armada-xp: maintain clock init order")
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/mvebu/armada-xp.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/clk/mvebu/armada-xp.c b/drivers/clk/mvebu/armada-xp.c
index b3094315a3c0f..2fa15a2747190 100644
--- a/drivers/clk/mvebu/armada-xp.c
+++ b/drivers/clk/mvebu/armada-xp.c
@@ -202,7 +202,9 @@ static void __init axp_clk_init(struct device_node *np)
 
 	mvebu_coreclk_setup(np, &axp_coreclks);
 
-	if (cgnp)
+	if (cgnp) {
 		mvebu_clk_gating_setup(cgnp, axp_gating_desc);
+		of_node_put(cgnp);
+	}
 }
 CLK_OF_DECLARE(axp_clk, "marvell,armada-xp-core-clock", axp_clk_init);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 037/271] clk: dove: fix refcount leak in dove_clk_init()
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (35 preceding siblings ...)
  2020-01-28 14:03 ` [PATCH 4.9 036/271] clk: armada-xp: fix refcount leak in axp_clk_init() Greg Kroah-Hartman
@ 2020-01-28 14:03 ` Greg Kroah-Hartman
  2020-01-28 14:03 ` [PATCH 4.9 038/271] IB/usnic: Fix out of bounds index check in query pkey Greg Kroah-Hartman
                   ` (238 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:03 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yangtao Li, Gregory CLEMENT,
	Stephen Boyd, Sasha Levin

From: Yangtao Li <tiny.windzz@gmail.com>

[ Upstream commit 8d726c5128298386b907963033be93407b0c4275 ]

The of_find_compatible_node() returns a node pointer with refcount
incremented, but there is the lack of use of the of_node_put() when
done. Add the missing of_node_put() to release the refcount.

Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
Reviewed-by: Gregory CLEMENT <gregory.clement@bootlin.com>
Fixes: 8f7fc5450b64 ("clk: mvebu: dove: maintain clock init order")
Fixes: 63b8d92c793f ("clk: add Dove PLL divider support for GPU, VMeta and AXI clocks")
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/mvebu/dove.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/clk/mvebu/dove.c b/drivers/clk/mvebu/dove.c
index 59fad9546c847..5f258c9bb68bf 100644
--- a/drivers/clk/mvebu/dove.c
+++ b/drivers/clk/mvebu/dove.c
@@ -190,10 +190,14 @@ static void __init dove_clk_init(struct device_node *np)
 
 	mvebu_coreclk_setup(np, &dove_coreclks);
 
-	if (ddnp)
+	if (ddnp) {
 		dove_divider_clk_init(ddnp);
+		of_node_put(ddnp);
+	}
 
-	if (cgnp)
+	if (cgnp) {
 		mvebu_clk_gating_setup(cgnp, dove_gating_desc);
+		of_node_put(cgnp);
+	}
 }
 CLK_OF_DECLARE(dove_clk, "marvell,dove-core-clock", dove_clk_init);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 038/271] IB/usnic: Fix out of bounds index check in query pkey
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (36 preceding siblings ...)
  2020-01-28 14:03 ` [PATCH 4.9 037/271] clk: dove: fix refcount leak in dove_clk_init() Greg Kroah-Hartman
@ 2020-01-28 14:03 ` Greg Kroah-Hartman
  2020-01-28 14:03 ` [PATCH 4.9 039/271] RDMA/ocrdma: " Greg Kroah-Hartman
                   ` (237 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:03 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Gal Pressman, Parvi Kaustubhi,
	Jason Gunthorpe, Sasha Levin

From: Gal Pressman <galpress@amazon.com>

[ Upstream commit 4959d5da5737dd804255c75b8cea0a2929ce279a ]

The pkey table size is one element, index should be tested for > 0 instead
of > 1.

Fixes: e3cf00d0a87f ("IB/usnic: Add Cisco VIC low-level hardware driver")
Signed-off-by: Gal Pressman <galpress@amazon.com>
Acked-by: Parvi Kaustubhi <pkaustub@cisco.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/hw/usnic/usnic_ib_verbs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/infiniband/hw/usnic/usnic_ib_verbs.c b/drivers/infiniband/hw/usnic/usnic_ib_verbs.c
index a5bfbba6bbac0..cacb720f44a02 100644
--- a/drivers/infiniband/hw/usnic/usnic_ib_verbs.c
+++ b/drivers/infiniband/hw/usnic/usnic_ib_verbs.c
@@ -425,7 +425,7 @@ int usnic_ib_query_gid(struct ib_device *ibdev, u8 port, int index,
 int usnic_ib_query_pkey(struct ib_device *ibdev, u8 port, u16 index,
 				u16 *pkey)
 {
-	if (index > 1)
+	if (index > 0)
 		return -EINVAL;
 
 	*pkey = 0xffff;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 039/271] RDMA/ocrdma: Fix out of bounds index check in query pkey
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (37 preceding siblings ...)
  2020-01-28 14:03 ` [PATCH 4.9 038/271] IB/usnic: Fix out of bounds index check in query pkey Greg Kroah-Hartman
@ 2020-01-28 14:03 ` Greg Kroah-Hartman
  2020-01-28 14:03 ` [PATCH 4.9 040/271] RDMA/qedr: " Greg Kroah-Hartman
                   ` (236 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:03 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Gal Pressman, Jason Gunthorpe, Sasha Levin

From: Gal Pressman <galpress@amazon.com>

[ Upstream commit b188940796c7be31c1b8c25a9a0e0842c2e7a49e ]

The pkey table size is one element, index should be tested for > 0 instead
of > 1.

Fixes: fe2caefcdf58 ("RDMA/ocrdma: Add driver for Emulex OneConnect IBoE RDMA adapter")
Signed-off-by: Gal Pressman <galpress@amazon.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
index 6af44f8db3d54..4d28bd8eff01c 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
@@ -55,7 +55,7 @@
 
 int ocrdma_query_pkey(struct ib_device *ibdev, u8 port, u16 index, u16 *pkey)
 {
-	if (index > 1)
+	if (index > 0)
 		return -EINVAL;
 
 	*pkey = 0xffff;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 040/271] RDMA/qedr: Fix out of bounds index check in query pkey
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (38 preceding siblings ...)
  2020-01-28 14:03 ` [PATCH 4.9 039/271] RDMA/ocrdma: " Greg Kroah-Hartman
@ 2020-01-28 14:03 ` Greg Kroah-Hartman
  2020-01-28 14:03 ` [PATCH 4.9 041/271] arm64: dts: apq8016-sbc: Increase load on l11 for SDCARD Greg Kroah-Hartman
                   ` (235 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:03 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Gal Pressman, Michal Kalderon,
	Jason Gunthorpe, Sasha Levin

From: Gal Pressman <galpress@amazon.com>

[ Upstream commit dbe30dae487e1a232158c24b432d45281c2805b7 ]

The pkey table size is QEDR_ROCE_PKEY_TABLE_LEN, index should be tested
for >= QEDR_ROCE_PKEY_TABLE_LEN instead of > QEDR_ROCE_PKEY_TABLE_LEN.

Fixes: a7efd7773e31 ("qedr: Add support for PD,PKEY and CQ verbs")
Signed-off-by: Gal Pressman <galpress@amazon.com>
Acked-by: Michal Kalderon <michal.kalderon@marvell.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/hw/qedr/verbs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/infiniband/hw/qedr/verbs.c b/drivers/infiniband/hw/qedr/verbs.c
index cd0408c2b376f..7603a1641c7d8 100644
--- a/drivers/infiniband/hw/qedr/verbs.c
+++ b/drivers/infiniband/hw/qedr/verbs.c
@@ -54,7 +54,7 @@
 
 int qedr_query_pkey(struct ib_device *ibdev, u8 port, u16 index, u16 *pkey)
 {
-	if (index > QEDR_ROCE_PKEY_TABLE_LEN)
+	if (index >= QEDR_ROCE_PKEY_TABLE_LEN)
 		return -EINVAL;
 
 	*pkey = QEDR_ROCE_PKEY_DEFAULT;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 041/271] arm64: dts: apq8016-sbc: Increase load on l11 for SDCARD
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (39 preceding siblings ...)
  2020-01-28 14:03 ` [PATCH 4.9 040/271] RDMA/qedr: " Greg Kroah-Hartman
@ 2020-01-28 14:03 ` Greg Kroah-Hartman
  2020-01-28 14:03 ` [PATCH 4.9 042/271] drm/etnaviv: NULL vs IS_ERR() buf in etnaviv_core_dump() Greg Kroah-Hartman
                   ` (234 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:03 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Manabu Igusa, Loic Poulain,
	Bjorn Andersson, Andy Gross, Sasha Levin

From: Loic Poulain <loic.poulain@linaro.org>

[ Upstream commit af61bef513ba179559e56908b8c465e587bc3890 ]

In the same way as for msm8974-hammerhead, l11 load, used for SDCARD
VMMC, needs to be increased in order to prevent any voltage drop issues
(due to limited current) happening with some SDCARDS or during specific
operations (e.g. write).

Tested on Dragonboard-410c and DART-SD410 boards.

Fixes: 4c7d53d16d77 (arm64: dts: apq8016-sbc: add regulators support)
Reported-by: Manabu Igusa <migusa@arrowjapan.com>
Signed-off-by: Loic Poulain <loic.poulain@linaro.org>
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Andy Gross <andy.gross@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi b/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi
index 601be6127628a..948efff7d830c 100644
--- a/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi
+++ b/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi
@@ -355,6 +355,8 @@
 	l11 {
 		regulator-min-microvolt = <1750000>;
 		regulator-max-microvolt = <3337000>;
+		regulator-allow-set-load;
+		regulator-system-load = <200000>;
 	};
 
 	l12 {
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 042/271] drm/etnaviv: NULL vs IS_ERR() buf in etnaviv_core_dump()
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (40 preceding siblings ...)
  2020-01-28 14:03 ` [PATCH 4.9 041/271] arm64: dts: apq8016-sbc: Increase load on l11 for SDCARD Greg Kroah-Hartman
@ 2020-01-28 14:03 ` Greg Kroah-Hartman
  2020-01-28 14:03 ` [PATCH 4.9 043/271] media: s5p-jpeg: Correct step and max values for V4L2_CID_JPEG_RESTART_INTERVAL Greg Kroah-Hartman
                   ` (233 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:03 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Lucas Stach, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit f8261c376e7f8cb9024af5a6c54be540c7f9108e ]

The etnaviv_gem_get_pages() never returns NULL.  It returns error
pointers on error.

Fixes: a8c21a5451d8 ("drm/etnaviv: add initial etnaviv DRM driver")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/etnaviv/etnaviv_dump.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/etnaviv/etnaviv_dump.c b/drivers/gpu/drm/etnaviv/etnaviv_dump.c
index 2bef501d4a172..5af7c2594a79e 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_dump.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_dump.c
@@ -206,7 +206,7 @@ void etnaviv_core_dump(struct etnaviv_gpu *gpu)
 		mutex_lock(&obj->lock);
 		pages = etnaviv_gem_get_pages(obj);
 		mutex_unlock(&obj->lock);
-		if (pages) {
+		if (!IS_ERR(pages)) {
 			int j;
 
 			iter.hdr->data[0] = bomap - bomap_start;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 043/271] media: s5p-jpeg: Correct step and max values for V4L2_CID_JPEG_RESTART_INTERVAL
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (41 preceding siblings ...)
  2020-01-28 14:03 ` [PATCH 4.9 042/271] drm/etnaviv: NULL vs IS_ERR() buf in etnaviv_core_dump() Greg Kroah-Hartman
@ 2020-01-28 14:03 ` Greg Kroah-Hartman
  2020-01-28 14:03 ` [PATCH 4.9 044/271] crypto: tgr192 - fix unaligned memory access Greg Kroah-Hartman
                   ` (232 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:03 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Pawe? Chmiel, Jacek Anaszewski,
	Sylwester Nawrocki, Hans Verkuil, Mauro Carvalho Chehab,
	Sasha Levin

From: Pawe? Chmiel <pawel.mikolaj.chmiel@gmail.com>

[ Upstream commit 19c624c6b29e244c418f8b44a711cbf5e82e3cd4 ]

This commit corrects max and step values for v4l2 control for
V4L2_CID_JPEG_RESTART_INTERVAL. Max should be 0xffff and step should be 1.
It was found by using v4l2-compliance tool and checking result of
VIDIOC_QUERY_EXT_CTRL/QUERYMENU test.
Previously it was complaining that step was bigger than difference
between max and min.

Fixes: 15f4bc3b1f42 ("[media] s5p-jpeg: Add JPEG controls support")

Signed-off-by: Pawe? Chmiel <pawel.mikolaj.chmiel@gmail.com>
Reviewed-by: Jacek Anaszewski <jacek.anaszewski@gmail.com>
Reviewed-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/s5p-jpeg/jpeg-core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/platform/s5p-jpeg/jpeg-core.c b/drivers/media/platform/s5p-jpeg/jpeg-core.c
index c89922fb42cef..a63f4eec366eb 100644
--- a/drivers/media/platform/s5p-jpeg/jpeg-core.c
+++ b/drivers/media/platform/s5p-jpeg/jpeg-core.c
@@ -1963,7 +1963,7 @@ static int s5p_jpeg_controls_create(struct s5p_jpeg_ctx *ctx)
 
 		v4l2_ctrl_new_std(&ctx->ctrl_handler, &s5p_jpeg_ctrl_ops,
 				  V4L2_CID_JPEG_RESTART_INTERVAL,
-				  0, 3, 0xffff, 0);
+				  0, 0xffff, 1, 0);
 		if (ctx->jpeg->variant->version == SJPEG_S5P)
 			mask = ~0x06; /* 422, 420 */
 	}
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 044/271] crypto: tgr192 - fix unaligned memory access
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (42 preceding siblings ...)
  2020-01-28 14:03 ` [PATCH 4.9 043/271] media: s5p-jpeg: Correct step and max values for V4L2_CID_JPEG_RESTART_INTERVAL Greg Kroah-Hartman
@ 2020-01-28 14:03 ` Greg Kroah-Hartman
  2020-01-28 14:03 ` [PATCH 4.9 045/271] ASoC: imx-sgtl5000: put of nodes if finding codec fails Greg Kroah-Hartman
                   ` (231 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:03 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Eric Biggers, Herbert Xu, Sasha Levin

From: Eric Biggers <ebiggers@google.com>

[ Upstream commit f990f7fb58ac8ac9a43316f09a48cff1a49dda42 ]

Fix an unaligned memory access in tgr192_transform() by using the
unaligned access helpers.

Fixes: 06ace7a9bafe ("[CRYPTO] Use standard byte order macros wherever possible")
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 crypto/tgr192.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/crypto/tgr192.c b/crypto/tgr192.c
index 321bc6ff2a9d1..904c8444aa0a2 100644
--- a/crypto/tgr192.c
+++ b/crypto/tgr192.c
@@ -25,8 +25,9 @@
 #include <linux/init.h>
 #include <linux/module.h>
 #include <linux/mm.h>
-#include <asm/byteorder.h>
 #include <linux/types.h>
+#include <asm/byteorder.h>
+#include <asm/unaligned.h>
 
 #define TGR192_DIGEST_SIZE 24
 #define TGR160_DIGEST_SIZE 20
@@ -468,10 +469,9 @@ static void tgr192_transform(struct tgr192_ctx *tctx, const u8 * data)
 	u64 a, b, c, aa, bb, cc;
 	u64 x[8];
 	int i;
-	const __le64 *ptr = (const __le64 *)data;
 
 	for (i = 0; i < 8; i++)
-		x[i] = le64_to_cpu(ptr[i]);
+		x[i] = get_unaligned_le64(data + i * sizeof(__le64));
 
 	/* save */
 	a = aa = tctx->a;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 045/271] ASoC: imx-sgtl5000: put of nodes if finding codec fails
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (43 preceding siblings ...)
  2020-01-28 14:03 ` [PATCH 4.9 044/271] crypto: tgr192 - fix unaligned memory access Greg Kroah-Hartman
@ 2020-01-28 14:03 ` Greg Kroah-Hartman
  2020-01-28 14:03 ` [PATCH 4.9 046/271] IB/iser: Pass the correct number of entries for dma mapped SGL Greg Kroah-Hartman
                   ` (230 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:03 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Stefan Agner, Daniel Baluta,
	Nicolin Chen, Fabio Estevam, Mark Brown, Sasha Levin

From: Stefan Agner <stefan@agner.ch>

[ Upstream commit d9866572486802bc598a3e8576a5231378d190de ]

Make sure to properly put the of node in case finding the codec
fails.

Fixes: 81e8e4926167 ("ASoC: fsl: add sgtl5000 clock support for imx-sgtl5000")
Signed-off-by: Stefan Agner <stefan@agner.ch>
Reviewed-by: Daniel Baluta <daniel.baluta@nxp.com>
Acked-by: Nicolin Chen <nicoleotsuka@gmail.com>
Reviewed-by: Fabio Estevam <festevam@gmail.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/fsl/imx-sgtl5000.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/sound/soc/fsl/imx-sgtl5000.c b/sound/soc/fsl/imx-sgtl5000.c
index 8e525f7ac08d1..3d99a8579c99f 100644
--- a/sound/soc/fsl/imx-sgtl5000.c
+++ b/sound/soc/fsl/imx-sgtl5000.c
@@ -119,7 +119,8 @@ static int imx_sgtl5000_probe(struct platform_device *pdev)
 	codec_dev = of_find_i2c_device_by_node(codec_np);
 	if (!codec_dev) {
 		dev_err(&pdev->dev, "failed to find codec platform device\n");
-		return -EPROBE_DEFER;
+		ret = -EPROBE_DEFER;
+		goto fail;
 	}
 
 	data = devm_kzalloc(&pdev->dev, sizeof(*data), GFP_KERNEL);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 046/271] IB/iser: Pass the correct number of entries for dma mapped SGL
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (44 preceding siblings ...)
  2020-01-28 14:03 ` [PATCH 4.9 045/271] ASoC: imx-sgtl5000: put of nodes if finding codec fails Greg Kroah-Hartman
@ 2020-01-28 14:03 ` Greg Kroah-Hartman
  2020-01-28 14:03 ` [PATCH 4.9 047/271] rtc: cmos: ignore bogus century byte Greg Kroah-Hartman
                   ` (229 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:03 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Israel Rukshin, Max Gurtovoy,
	Sagi Grimberg, Jason Gunthorpe, Sasha Levin

From: Israel Rukshin <israelr@mellanox.com>

[ Upstream commit 57b26497fabe1b9379b59fbc7e35e608e114df16 ]

ib_dma_map_sg() augments the SGL into a 'dma mapped SGL'. This process may
change the number of entries and the lengths of each entry.

Code that touches dma_address is iterating over the 'dma mapped SGL' and
must use dma_nents which returned from ib_dma_map_sg().

ib_sg_to_pages() and ib_map_mr_sg() are using dma_address so they must use
dma_nents.

Fixes: 39405885005a ("IB/iser: Port to new fast registration API")
Fixes: bfe066e256d5 ("IB/iser: Reuse ib_sg_to_pages")
Signed-off-by: Israel Rukshin <israelr@mellanox.com>
Reviewed-by: Max Gurtovoy <maxg@mellanox.com>
Acked-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/ulp/iser/iser_memory.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/infiniband/ulp/iser/iser_memory.c b/drivers/infiniband/ulp/iser/iser_memory.c
index 9c3e9ab53a415..759c2fe033e71 100644
--- a/drivers/infiniband/ulp/iser/iser_memory.c
+++ b/drivers/infiniband/ulp/iser/iser_memory.c
@@ -240,8 +240,8 @@ int iser_fast_reg_fmr(struct iscsi_iser_task *iser_task,
 	page_vec->npages = 0;
 	page_vec->fake_mr.page_size = SIZE_4K;
 	plen = ib_sg_to_pages(&page_vec->fake_mr, mem->sg,
-			      mem->size, NULL, iser_set_page);
-	if (unlikely(plen < mem->size)) {
+			      mem->dma_nents, NULL, iser_set_page);
+	if (unlikely(plen < mem->dma_nents)) {
 		iser_err("page vec too short to hold this SG\n");
 		iser_data_buf_dump(mem, device->ib_device);
 		iser_dump_page_vec(page_vec);
@@ -450,10 +450,10 @@ static int iser_fast_reg_mr(struct iscsi_iser_task *iser_task,
 
 	ib_update_fast_reg_key(mr, ib_inc_rkey(mr->rkey));
 
-	n = ib_map_mr_sg(mr, mem->sg, mem->size, NULL, SIZE_4K);
-	if (unlikely(n != mem->size)) {
+	n = ib_map_mr_sg(mr, mem->sg, mem->dma_nents, NULL, SIZE_4K);
+	if (unlikely(n != mem->dma_nents)) {
 		iser_err("failed to map sg (%d/%d)\n",
-			 n, mem->size);
+			 n, mem->dma_nents);
 		return n < 0 ? n : -EINVAL;
 	}
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 047/271] rtc: cmos: ignore bogus century byte
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (45 preceding siblings ...)
  2020-01-28 14:03 ` [PATCH 4.9 046/271] IB/iser: Pass the correct number of entries for dma mapped SGL Greg Kroah-Hartman
@ 2020-01-28 14:03 ` Greg Kroah-Hartman
  2020-01-28 14:03 ` [PATCH 4.9 048/271] clk: sunxi-ng: sun8i-a23: Enable PLL-MIPI LDOs when ungating it Greg Kroah-Hartman
                   ` (228 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:03 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Alexandre Belloni, Alessandro Zummo,
	Sylvain Chouleur, Patrick McDermott, linux-rtc, Eric Wong,
	Sasha Levin

From: Eric Wong <e@80x24.org>

[ Upstream commit 2a4daadd4d3e507138f8937926e6a4df49c6bfdc ]

Older versions of Libreboot and Coreboot had an invalid value
(`3' in my case) in the century byte affecting the GM45 in
the Thinkpad X200.  Not everybody's updated their firmwares,
and Linux <= 4.2 was able to read the RTC without problems,
so workaround this by ignoring invalid values.

Fixes: 3c217e51d8a272b9 ("rtc: cmos: century support")

Cc: Alexandre Belloni <alexandre.belloni@bootlin.com>
Cc: Alessandro Zummo <a.zummo@towertech.it>
Cc: Sylvain Chouleur <sylvain.chouleur@intel.com>
Cc: Patrick McDermott <patrick.mcdermott@libiquity.com>
Cc: linux-rtc@vger.kernel.org
Signed-off-by: Eric Wong <e@80x24.org>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/rtc/rtc-mc146818-lib.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/rtc/rtc-mc146818-lib.c b/drivers/rtc/rtc-mc146818-lib.c
index 2f1772a358ca5..18a6f15e313d8 100644
--- a/drivers/rtc/rtc-mc146818-lib.c
+++ b/drivers/rtc/rtc-mc146818-lib.c
@@ -82,7 +82,7 @@ unsigned int mc146818_get_time(struct rtc_time *time)
 	time->tm_year += real_year - 72;
 #endif
 
-	if (century)
+	if (century > 20)
 		time->tm_year += (century - 19) * 100;
 
 	/*
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 048/271] clk: sunxi-ng: sun8i-a23: Enable PLL-MIPI LDOs when ungating it
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (46 preceding siblings ...)
  2020-01-28 14:03 ` [PATCH 4.9 047/271] rtc: cmos: ignore bogus century byte Greg Kroah-Hartman
@ 2020-01-28 14:03 ` Greg Kroah-Hartman
  2020-01-28 14:03 ` [PATCH 4.9 049/271] iwlwifi: mvm: fix A-MPDU reference assignment Greg Kroah-Hartman
                   ` (227 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:03 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chen-Yu Tsai, Maxime Ripard, Sasha Levin

From: Chen-Yu Tsai <wens@csie.org>

[ Upstream commit 108a459ef4cd17a28711d81092044e597b5c7618 ]

The PLL-MIPI clock is somewhat special as it has its own LDOs which
need to be turned on for this PLL to actually work and output a clock
signal.

Add the 2 LDO enable bits to the gate bits.

Fixes: 5690879d93e8 ("clk: sunxi-ng: Add A23 CCU")
Signed-off-by: Chen-Yu Tsai <wens@csie.org>
Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/sunxi-ng/ccu-sun8i-a23.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/clk/sunxi-ng/ccu-sun8i-a23.c b/drivers/clk/sunxi-ng/ccu-sun8i-a23.c
index 5c6d37bdf247c..765c6977484e7 100644
--- a/drivers/clk/sunxi-ng/ccu-sun8i-a23.c
+++ b/drivers/clk/sunxi-ng/ccu-sun8i-a23.c
@@ -132,7 +132,7 @@ static SUNXI_CCU_NKM_WITH_GATE_LOCK(pll_mipi_clk, "pll-mipi",
 				    8, 4,		/* N */
 				    4, 2,		/* K */
 				    0, 4,		/* M */
-				    BIT(31),		/* gate */
+				    BIT(31) | BIT(23) | BIT(22), /* gate */
 				    BIT(28),		/* lock */
 				    CLK_SET_RATE_UNGATE);
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 049/271] iwlwifi: mvm: fix A-MPDU reference assignment
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (47 preceding siblings ...)
  2020-01-28 14:03 ` [PATCH 4.9 048/271] clk: sunxi-ng: sun8i-a23: Enable PLL-MIPI LDOs when ungating it Greg Kroah-Hartman
@ 2020-01-28 14:03 ` Greg Kroah-Hartman
  2020-01-28 14:03 ` [PATCH 4.9 050/271] tty: ipwireless: Fix potential NULL pointer dereference Greg Kroah-Hartman
                   ` (226 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:03 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Danny Alexander, Johannes Berg,
	Luca Coelho, Sasha Levin

From: Johannes Berg <johannes.berg@intel.com>

[ Upstream commit 1f7698abedeeb3fef3cbcf78e16f925df675a179 ]

The current code assigns the reference, and then goes to increment
it if the toggle bit has changed. That way, we get

Toggle  0  0  0  0  1  1  1  1
ID      1  1  1  1  1  2  2  2

Fix that by assigning the post-toggle ID to get

Toggle  0  0  0  0  1  1  1  1
ID      1  1  1  1  2  2  2  2

Reported-by: Danny Alexander <danny.alexander@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Fixes: fbe4112791b8 ("iwlwifi: mvm: update mpdu metadata API")
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
index c2bbc8c17beb9..bc06d87a0106c 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
@@ -810,12 +810,12 @@ void iwl_mvm_rx_mpdu_mq(struct iwl_mvm *mvm, struct napi_struct *napi,
 		bool toggle_bit = phy_info & IWL_RX_MPDU_PHY_AMPDU_TOGGLE;
 
 		rx_status->flag |= RX_FLAG_AMPDU_DETAILS;
-		rx_status->ampdu_reference = mvm->ampdu_ref;
 		/* toggle is switched whenever new aggregation starts */
 		if (toggle_bit != mvm->ampdu_toggle) {
 			mvm->ampdu_ref++;
 			mvm->ampdu_toggle = toggle_bit;
 		}
+		rx_status->ampdu_reference = mvm->ampdu_ref;
 	}
 
 	rcu_read_lock();
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 050/271] tty: ipwireless: Fix potential NULL pointer dereference
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (48 preceding siblings ...)
  2020-01-28 14:03 ` [PATCH 4.9 049/271] iwlwifi: mvm: fix A-MPDU reference assignment Greg Kroah-Hartman
@ 2020-01-28 14:03 ` Greg Kroah-Hartman
  2020-01-28 14:03 ` [PATCH 4.9 051/271] crypto: crypto4xx - Fix wrong ppc4xx_trng_probe()/ppc4xx_trng_remove() arguments Greg Kroah-Hartman
                   ` (225 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:03 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, YueHaibing, Sasha Levin

From: YueHaibing <yuehaibing@huawei.com>

[ Upstream commit 7dd50e205b3348dc7784efbdf85723551de64a25 ]

There is a potential NULL pointer dereference in case
alloc_ctrl_packet() fails and returns NULL.

Fixes: 099dc4fb6265 ("ipwireless: driver for PC Card 3G/UMTS modem")
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/ipwireless/hardware.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/tty/ipwireless/hardware.c b/drivers/tty/ipwireless/hardware.c
index df0204b6148fb..4417f75684221 100644
--- a/drivers/tty/ipwireless/hardware.c
+++ b/drivers/tty/ipwireless/hardware.c
@@ -1515,6 +1515,8 @@ static void ipw_send_setup_packet(struct ipw_hardware *hw)
 			sizeof(struct ipw_setup_get_version_query_packet),
 			ADDR_SETUP_PROT, TL_PROTOCOLID_SETUP,
 			TL_SETUP_SIGNO_GET_VERSION_QRY);
+	if (!ver_packet)
+		return;
 	ver_packet->header.length = sizeof(struct tl_setup_get_version_qry);
 
 	/*
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 051/271] crypto: crypto4xx - Fix wrong ppc4xx_trng_probe()/ppc4xx_trng_remove() arguments
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (49 preceding siblings ...)
  2020-01-28 14:03 ` [PATCH 4.9 050/271] tty: ipwireless: Fix potential NULL pointer dereference Greg Kroah-Hartman
@ 2020-01-28 14:03 ` Greg Kroah-Hartman
  2020-01-28 14:03 ` [PATCH 4.9 052/271] ARM: dts: lpc32xx: add required clocks property to keypad device node Greg Kroah-Hartman
                   ` (224 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:03 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Corentin Labbe, Herbert Xu, Sasha Levin

From: Corentin Labbe <clabbe@baylibre.com>

[ Upstream commit 6e88098ca43a3d80ae86908f7badba683c8a0d84 ]

When building without CONFIG_HW_RANDOM_PPC4XX, I hit the following build failure:
drivers/crypto/amcc/crypto4xx_core.c: In function 'crypto4xx_probe':
drivers/crypto/amcc/crypto4xx_core.c:1407:20: error: passing argument 1 of 'ppc4xx_trng_probe' from incompatible pointer type [-Werror=incompatible-pointer-types]
In file included from drivers/crypto/amcc/crypto4xx_core.c:50:0:
drivers/crypto/amcc/crypto4xx_trng.h:28:20: note: expected 'struct crypto4xx_device *' but argument is of type 'struct crypto4xx_core_device *'
drivers/crypto/amcc/crypto4xx_core.c: In function 'crypto4xx_remove':
drivers/crypto/amcc/crypto4xx_core.c:1434:21: error: passing argument 1 of 'ppc4xx_trng_remove' from incompatible pointer type [-Werror=incompatible-pointer-types]
In file included from drivers/crypto/amcc/crypto4xx_core.c:50:0:
drivers/crypto/amcc/crypto4xx_trng.h:30:20: note: expected 'struct crypto4xx_device *' but argument is of type 'struct crypto4xx_core_device *'

This patch fix the needed argument of ppc4xx_trng_probe()/ppc4xx_trng_remove() in that case.

Fixes: 5343e674f32f ("crypto4xx: integrate ppc4xx-rng into crypto4xx")
Signed-off-by: Corentin Labbe <clabbe@baylibre.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/amcc/crypto4xx_trng.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/crypto/amcc/crypto4xx_trng.h b/drivers/crypto/amcc/crypto4xx_trng.h
index 931d22531f515..7bbda51b7337c 100644
--- a/drivers/crypto/amcc/crypto4xx_trng.h
+++ b/drivers/crypto/amcc/crypto4xx_trng.h
@@ -26,9 +26,9 @@ void ppc4xx_trng_probe(struct crypto4xx_core_device *core_dev);
 void ppc4xx_trng_remove(struct crypto4xx_core_device *core_dev);
 #else
 static inline void ppc4xx_trng_probe(
-	struct crypto4xx_device *dev __maybe_unused) { }
+	struct crypto4xx_core_device *dev __maybe_unused) { }
 static inline void ppc4xx_trng_remove(
-	struct crypto4xx_device *dev __maybe_unused) { }
+	struct crypto4xx_core_device *dev __maybe_unused) { }
 #endif
 
 #endif
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 052/271] ARM: dts: lpc32xx: add required clocks property to keypad device node
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (50 preceding siblings ...)
  2020-01-28 14:03 ` [PATCH 4.9 051/271] crypto: crypto4xx - Fix wrong ppc4xx_trng_probe()/ppc4xx_trng_remove() arguments Greg Kroah-Hartman
@ 2020-01-28 14:03 ` Greg Kroah-Hartman
  2020-01-28 14:03 ` [PATCH 4.9 053/271] ARM: dts: lpc32xx: reparent keypad controller to SIC1 Greg Kroah-Hartman
                   ` (223 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:03 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Vladimir Zapolskiy, Sasha Levin

From: Vladimir Zapolskiy <vz@mleia.com>

[ Upstream commit 3e88bc38b9f6fe4b69cecf81badd3c19fde97f97 ]

NXP LPC32xx keypad controller requires a clock property to be defined.

The change fixes the driver initialization problem:

  lpc32xx_keys 40050000.key: failed to get clock
  lpc32xx_keys: probe of 40050000.key failed with error -2

Fixes: 93898eb775e5 ("arm: dts: lpc32xx: add clock properties to device nodes")
Signed-off-by: Vladimir Zapolskiy <vz@mleia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/lpc32xx.dtsi | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/arm/boot/dts/lpc32xx.dtsi b/arch/arm/boot/dts/lpc32xx.dtsi
index 5fa3111731cb0..da375813afd04 100644
--- a/arch/arm/boot/dts/lpc32xx.dtsi
+++ b/arch/arm/boot/dts/lpc32xx.dtsi
@@ -462,6 +462,7 @@
 			key: key@40050000 {
 				compatible = "nxp,lpc3220-key";
 				reg = <0x40050000 0x1000>;
+				clocks = <&clk LPC32XX_CLK_KEY>;
 				interrupts = <54 IRQ_TYPE_LEVEL_HIGH>;
 				status = "disabled";
 			};
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 053/271] ARM: dts: lpc32xx: reparent keypad controller to SIC1
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (51 preceding siblings ...)
  2020-01-28 14:03 ` [PATCH 4.9 052/271] ARM: dts: lpc32xx: add required clocks property to keypad device node Greg Kroah-Hartman
@ 2020-01-28 14:03 ` Greg Kroah-Hartman
  2020-01-28 14:03 ` [PATCH 4.9 054/271] ARM: dts: lpc32xx: fix ARM PrimeCell LCD controller variant Greg Kroah-Hartman
                   ` (222 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:03 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Vladimir Zapolskiy, Sasha Levin

From: Vladimir Zapolskiy <vz@mleia.com>

[ Upstream commit 489261c45f0ebbc1c2813f337bbdf858267f5033 ]

After switching to a new interrupt controller scheme by separating SIC1
and SIC2 from MIC interrupt controller just one SoC keypad controller
was not taken into account, fix it now:

  WARNING: CPU: 0 PID: 1 at kernel/irq/irqdomain.c:524 irq_domain_associate+0x50/0x1b0
  error: hwirq 0x36 is too large for interrupt-controller@40008000
  ...
  lpc32xx_keys 40050000.key: failed to get platform irq
  lpc32xx_keys: probe of 40050000.key failed with error -22

Fixes: 9b8ad3fb81ae ("ARM: dts: lpc32xx: reparent SIC1 and SIC2 interrupts from MIC")
Signed-off-by: Vladimir Zapolskiy <vz@mleia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/lpc32xx.dtsi | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/lpc32xx.dtsi b/arch/arm/boot/dts/lpc32xx.dtsi
index da375813afd04..6bd196457ccc2 100644
--- a/arch/arm/boot/dts/lpc32xx.dtsi
+++ b/arch/arm/boot/dts/lpc32xx.dtsi
@@ -463,7 +463,8 @@
 				compatible = "nxp,lpc3220-key";
 				reg = <0x40050000 0x1000>;
 				clocks = <&clk LPC32XX_CLK_KEY>;
-				interrupts = <54 IRQ_TYPE_LEVEL_HIGH>;
+				interrupt-parent = <&sic1>;
+				interrupts = <22 IRQ_TYPE_LEVEL_HIGH>;
 				status = "disabled";
 			};
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 054/271] ARM: dts: lpc32xx: fix ARM PrimeCell LCD controller variant
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (52 preceding siblings ...)
  2020-01-28 14:03 ` [PATCH 4.9 053/271] ARM: dts: lpc32xx: reparent keypad controller to SIC1 Greg Kroah-Hartman
@ 2020-01-28 14:03 ` Greg Kroah-Hartman
  2020-01-28 14:03 ` [PATCH 4.9 055/271] ARM: dts: lpc32xx: fix ARM PrimeCell LCD controller clocks property Greg Kroah-Hartman
                   ` (221 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:03 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Vladimir Zapolskiy, Sasha Levin

From: Vladimir Zapolskiy <vz@mleia.com>

[ Upstream commit 7a0790a4121cbcd111cc537cdc801c46ccb789ee ]

ARM PrimeCell PL111 LCD controller is found on On NXP LPC3230
and LPC3250 SoCs variants, the original reference in compatible
property to an older one ARM PrimeCell PL110 is invalid.

Fixes: e04920d9efcb3 ("ARM: LPC32xx: DTS files for device tree conversion")
Signed-off-by: Vladimir Zapolskiy <vz@mleia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/lpc32xx.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/lpc32xx.dtsi b/arch/arm/boot/dts/lpc32xx.dtsi
index 6bd196457ccc2..3adbbaff79715 100644
--- a/arch/arm/boot/dts/lpc32xx.dtsi
+++ b/arch/arm/boot/dts/lpc32xx.dtsi
@@ -139,7 +139,7 @@
 		};
 
 		clcd: clcd@31040000 {
-			compatible = "arm,pl110", "arm,primecell";
+			compatible = "arm,pl111", "arm,primecell";
 			reg = <0x31040000 0x1000>;
 			interrupts = <14 IRQ_TYPE_LEVEL_HIGH>;
 			clocks = <&clk LPC32XX_CLK_LCD>;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 055/271] ARM: dts: lpc32xx: fix ARM PrimeCell LCD controller clocks property
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (53 preceding siblings ...)
  2020-01-28 14:03 ` [PATCH 4.9 054/271] ARM: dts: lpc32xx: fix ARM PrimeCell LCD controller variant Greg Kroah-Hartman
@ 2020-01-28 14:03 ` Greg Kroah-Hartman
  2020-01-28 14:03 ` [PATCH 4.9 056/271] ARM: dts: lpc32xx: phy3250: fix SD card regulator voltage Greg Kroah-Hartman
                   ` (220 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:03 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Vladimir Zapolskiy, Sasha Levin

From: Vladimir Zapolskiy <vz@mleia.com>

[ Upstream commit 30fc01bae3cda747e7d9c352b1aa51ca113c8a9d ]

The originally added ARM PrimeCell PL111 clocks property misses
the required "clcdclk" clock, which is the same as a clock to enable
the LCD controller on NXP LPC3230 and NXP LPC3250 SoCs.

Fixes: 93898eb775e5 ("arm: dts: lpc32xx: add clock properties to device nodes")
Signed-off-by: Vladimir Zapolskiy <vz@mleia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/lpc32xx.dtsi | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm/boot/dts/lpc32xx.dtsi b/arch/arm/boot/dts/lpc32xx.dtsi
index 3adbbaff79715..2802c9565b6ca 100644
--- a/arch/arm/boot/dts/lpc32xx.dtsi
+++ b/arch/arm/boot/dts/lpc32xx.dtsi
@@ -142,8 +142,8 @@
 			compatible = "arm,pl111", "arm,primecell";
 			reg = <0x31040000 0x1000>;
 			interrupts = <14 IRQ_TYPE_LEVEL_HIGH>;
-			clocks = <&clk LPC32XX_CLK_LCD>;
-			clock-names = "apb_pclk";
+			clocks = <&clk LPC32XX_CLK_LCD>, <&clk LPC32XX_CLK_LCD>;
+			clock-names = "clcdclk", "apb_pclk";
 			status = "disabled";
 		};
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 056/271] ARM: dts: lpc32xx: phy3250: fix SD card regulator voltage
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (54 preceding siblings ...)
  2020-01-28 14:03 ` [PATCH 4.9 055/271] ARM: dts: lpc32xx: fix ARM PrimeCell LCD controller clocks property Greg Kroah-Hartman
@ 2020-01-28 14:03 ` Greg Kroah-Hartman
  2020-01-28 14:03 ` [PATCH 4.9 057/271] iwlwifi: mvm: fix RSS config command Greg Kroah-Hartman
                   ` (219 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:03 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Vladimir Zapolskiy, Sasha Levin

From: Vladimir Zapolskiy <vz@mleia.com>

[ Upstream commit dc141b99fc36cf910a1d8d5ee30f43f2442fd1bd ]

The fixed voltage regulator on Phytec phyCORE-LPC3250 board, which
supplies SD/MMC card's power, has a constant output voltage level
of either 3.15V or 3.3V, the actual value depends on JP4 position,
the power rail is referenced as VCC_SDIO in the board hardware manual.

Fixes: d06670e96267 ("arm: dts: phy3250: add SD fixed regulator")
Signed-off-by: Vladimir Zapolskiy <vz@mleia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/lpc3250-phy3250.dts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm/boot/dts/lpc3250-phy3250.dts b/arch/arm/boot/dts/lpc3250-phy3250.dts
index b7bd3a110a8dd..dd0bdf765599d 100644
--- a/arch/arm/boot/dts/lpc3250-phy3250.dts
+++ b/arch/arm/boot/dts/lpc3250-phy3250.dts
@@ -49,8 +49,8 @@
 		sd_reg: regulator@2 {
 			compatible = "regulator-fixed";
 			regulator-name = "sd_reg";
-			regulator-min-microvolt = <1800000>;
-			regulator-max-microvolt = <1800000>;
+			regulator-min-microvolt = <3300000>;
+			regulator-max-microvolt = <3300000>;
 			gpio = <&gpio 5 5 0>;
 			enable-active-high;
 		};
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 057/271] iwlwifi: mvm: fix RSS config command
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (55 preceding siblings ...)
  2020-01-28 14:03 ` [PATCH 4.9 056/271] ARM: dts: lpc32xx: phy3250: fix SD card regulator voltage Greg Kroah-Hartman
@ 2020-01-28 14:03 ` Greg Kroah-Hartman
  2020-01-28 14:03 ` [PATCH 4.9 058/271] staging: most: cdev: add missing check for cdev_add failure Greg Kroah-Hartman
                   ` (218 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:03 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sara Sharon, Luca Coelho, Sasha Levin

From: Sara Sharon <sara.sharon@intel.com>

[ Upstream commit 608dce95db10b8ee1a26dbce3f60204bb69812a5 ]

The hash mask is a bitmap, so we should use BIT() on
the enum values.

Signed-off-by: Sara Sharon <sara.sharon@intel.com>
Fixes: 43413a975d06 ("iwlwifi: mvm: support rss queues configuration command")
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
index 2ec3a91a0f6b6..bba7ace1a744d 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
@@ -106,12 +106,12 @@ static int iwl_send_rss_cfg_cmd(struct iwl_mvm *mvm)
 	int i;
 	struct iwl_rss_config_cmd cmd = {
 		.flags = cpu_to_le32(IWL_RSS_ENABLE),
-		.hash_mask = IWL_RSS_HASH_TYPE_IPV4_TCP |
-			     IWL_RSS_HASH_TYPE_IPV4_UDP |
-			     IWL_RSS_HASH_TYPE_IPV4_PAYLOAD |
-			     IWL_RSS_HASH_TYPE_IPV6_TCP |
-			     IWL_RSS_HASH_TYPE_IPV6_UDP |
-			     IWL_RSS_HASH_TYPE_IPV6_PAYLOAD,
+		.hash_mask = BIT(IWL_RSS_HASH_TYPE_IPV4_TCP) |
+			     BIT(IWL_RSS_HASH_TYPE_IPV4_UDP) |
+			     BIT(IWL_RSS_HASH_TYPE_IPV4_PAYLOAD) |
+			     BIT(IWL_RSS_HASH_TYPE_IPV6_TCP) |
+			     BIT(IWL_RSS_HASH_TYPE_IPV6_UDP) |
+			     BIT(IWL_RSS_HASH_TYPE_IPV6_PAYLOAD),
 	};
 
 	if (mvm->trans->num_rx_queues == 1)
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 058/271] staging: most: cdev: add missing check for cdev_add failure
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (56 preceding siblings ...)
  2020-01-28 14:03 ` [PATCH 4.9 057/271] iwlwifi: mvm: fix RSS config command Greg Kroah-Hartman
@ 2020-01-28 14:03 ` Greg Kroah-Hartman
  2020-01-28 14:03 ` [PATCH 4.9 059/271] rtc: ds1672: fix unintended sign extension Greg Kroah-Hartman
                   ` (217 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:03 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Colin Ian King, Sasha Levin

From: Colin Ian King <colin.king@canonical.com>

[ Upstream commit 5ae890780e1b4d08f2c0c5d4ea96fc3928fc0ee9 ]

Currently the call to cdev_add is missing a check for failure. Fix this by
checking for failure and exiting via a new error path that ensures the
allocated comp_channel struct is kfree'd.

Detected by CoverityScan, CID#1462359 ("Unchecked return value")

Fixes: 9bc79bbcd0c5 ("Staging: most: add MOST driver's aim-cdev module")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/staging/most/aim-cdev/cdev.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/staging/most/aim-cdev/cdev.c b/drivers/staging/most/aim-cdev/cdev.c
index 7f51024dc5ebb..e87b9ed4f37de 100644
--- a/drivers/staging/most/aim-cdev/cdev.c
+++ b/drivers/staging/most/aim-cdev/cdev.c
@@ -451,7 +451,9 @@ static int aim_probe(struct most_interface *iface, int channel_id,
 	c->devno = MKDEV(major, current_minor);
 	cdev_init(&c->cdev, &channel_fops);
 	c->cdev.owner = THIS_MODULE;
-	cdev_add(&c->cdev, c->devno, 1);
+	retval = cdev_add(&c->cdev, c->devno, 1);
+	if (retval < 0)
+		goto err_free_c;
 	c->iface = iface;
 	c->cfg = cfg;
 	c->channel_id = channel_id;
@@ -487,6 +489,7 @@ error_create_device:
 	list_del(&c->list);
 error_alloc_kfifo:
 	cdev_del(&c->cdev);
+err_free_c:
 	kfree(c);
 error_alloc_channel:
 	ida_simple_remove(&minor_id, current_minor);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 059/271] rtc: ds1672: fix unintended sign extension
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (57 preceding siblings ...)
  2020-01-28 14:03 ` [PATCH 4.9 058/271] staging: most: cdev: add missing check for cdev_add failure Greg Kroah-Hartman
@ 2020-01-28 14:03 ` Greg Kroah-Hartman
  2020-01-28 14:03 ` [PATCH 4.9 060/271] thermal: mediatek: fix register index error Greg Kroah-Hartman
                   ` (216 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:03 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Colin Ian King, Alexandre Belloni,
	Sasha Levin

From: Colin Ian King <colin.king@canonical.com>

[ Upstream commit f0c04c276739ed8acbb41b4868e942a55b128dca ]

Shifting a u8 by 24 will cause the value to be promoted to an integer. If
the top bit of the u8 is set then the following conversion to an unsigned
long will sign extend the value causing the upper 32 bits to be set in
the result.

Fix this by casting the u8 value to an unsigned long before the shift.

Detected by CoverityScan, CID#138801 ("Unintended sign extension")

Fixes: edf1aaa31fc5 ("[PATCH] RTC subsystem: DS1672 driver")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/rtc/rtc-ds1672.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/rtc/rtc-ds1672.c b/drivers/rtc/rtc-ds1672.c
index 5c18ac7394c42..c911f2db0af5e 100644
--- a/drivers/rtc/rtc-ds1672.c
+++ b/drivers/rtc/rtc-ds1672.c
@@ -58,7 +58,8 @@ static int ds1672_get_datetime(struct i2c_client *client, struct rtc_time *tm)
 		"%s: raw read data - counters=%02x,%02x,%02x,%02x\n",
 		__func__, buf[0], buf[1], buf[2], buf[3]);
 
-	time = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
+	time = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
+	       (buf[1] << 8) | buf[0];
 
 	rtc_time_to_tm(time, tm);
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 060/271] thermal: mediatek: fix register index error
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (58 preceding siblings ...)
  2020-01-28 14:03 ` [PATCH 4.9 059/271] rtc: ds1672: fix unintended sign extension Greg Kroah-Hartman
@ 2020-01-28 14:03 ` Greg Kroah-Hartman
  2020-01-28 14:03 ` [PATCH 4.9 061/271] net: phy: fixed_phy: Fix fixed_phy not checking GPIO Greg Kroah-Hartman
                   ` (215 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:03 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Michael Kao, Eduardo Valentin, Sasha Levin

From: Michael Kao <michael.kao@mediatek.com>

[ Upstream commit eb9aecd90d1a39601e91cd08b90d5fee51d321a6 ]

The index of msr and adcpnp should match the sensor
which belongs to the selected bank in the for loop.

Fixes: b7cf0053738c ("thermal: Add Mediatek thermal driver for mt2701.")
Signed-off-by: Michael Kao <michael.kao@mediatek.com>
Signed-off-by: Eduardo Valentin <edubezval@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/thermal/mtk_thermal.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/thermal/mtk_thermal.c b/drivers/thermal/mtk_thermal.c
index 34169c32d4956..ea9558679634b 100644
--- a/drivers/thermal/mtk_thermal.c
+++ b/drivers/thermal/mtk_thermal.c
@@ -348,7 +348,8 @@ static int mtk_thermal_bank_temperature(struct mtk_thermal_bank *bank)
 	u32 raw;
 
 	for (i = 0; i < conf->bank_data[bank->id].num_sensors; i++) {
-		raw = readl(mt->thermal_base + conf->msr[i]);
+		raw = readl(mt->thermal_base +
+			    conf->msr[conf->bank_data[bank->id].sensors[i]]);
 
 		temp = raw_to_mcelsius(mt,
 				       conf->bank_data[bank->id].sensors[i],
@@ -485,7 +486,8 @@ static void mtk_thermal_init_bank(struct mtk_thermal *mt, int num,
 
 	for (i = 0; i < conf->bank_data[num].num_sensors; i++)
 		writel(conf->sensor_mux_values[conf->bank_data[num].sensors[i]],
-		       mt->thermal_base + conf->adcpnp[i]);
+		       mt->thermal_base +
+		       conf->adcpnp[conf->bank_data[num].sensors[i]]);
 
 	writel((1 << conf->bank_data[num].num_sensors) - 1,
 	       mt->thermal_base + TEMP_MONCTL0);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 061/271] net: phy: fixed_phy: Fix fixed_phy not checking GPIO
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (59 preceding siblings ...)
  2020-01-28 14:03 ` [PATCH 4.9 060/271] thermal: mediatek: fix register index error Greg Kroah-Hartman
@ 2020-01-28 14:03 ` Greg Kroah-Hartman
  2020-01-28 14:03 ` [PATCH 4.9 062/271] rtc: 88pm860x: fix unintended sign extension Greg Kroah-Hartman
                   ` (214 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:03 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Andrew Lunn, Moritz Fischer,
	David S. Miller, Sasha Levin

From: Moritz Fischer <mdf@kernel.org>

[ Upstream commit 8f289805616e81f7c1690931aa8a586c76f4fa88 ]

Fix fixed_phy not checking GPIO if no link_update callback
is registered.

In the original version all users registered a link_update
callback so the issue was masked.

Fixes: a5597008dbc2 ("phy: fixed_phy: Add gpio to determine link up/down.")
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: Moritz Fischer <mdf@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/phy/fixed_phy.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/net/phy/fixed_phy.c b/drivers/net/phy/fixed_phy.c
index eb51672106811..3ab2eb677a599 100644
--- a/drivers/net/phy/fixed_phy.c
+++ b/drivers/net/phy/fixed_phy.c
@@ -67,11 +67,11 @@ static int fixed_mdio_read(struct mii_bus *bus, int phy_addr, int reg_num)
 			do {
 				s = read_seqcount_begin(&fp->seqcount);
 				/* Issue callback if user registered it. */
-				if (fp->link_update) {
+				if (fp->link_update)
 					fp->link_update(fp->phydev->attached_dev,
 							&fp->status);
-					fixed_phy_update(fp);
-				}
+				/* Check the GPIO for change in status */
+				fixed_phy_update(fp);
 				state = fp->status;
 			} while (read_seqcount_retry(&fp->seqcount, s));
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 062/271] rtc: 88pm860x: fix unintended sign extension
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (60 preceding siblings ...)
  2020-01-28 14:03 ` [PATCH 4.9 061/271] net: phy: fixed_phy: Fix fixed_phy not checking GPIO Greg Kroah-Hartman
@ 2020-01-28 14:03 ` Greg Kroah-Hartman
  2020-01-28 14:03 ` [PATCH 4.9 063/271] rtc: 88pm80x: " Greg Kroah-Hartman
                   ` (213 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:03 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Colin Ian King, Alexandre Belloni,
	Sasha Levin

From: Colin Ian King <colin.king@canonical.com>

[ Upstream commit dc9e47160626cdb58d5c39a4f43dcfdb27a5c004 ]

Shifting a u8 by 24 will cause the value to be promoted to an integer. If
the top bit of the u8 is set then the following conversion to an unsigned
long will sign extend the value causing the upper 32 bits to be set in
the result.

Fix this by casting the u8 value to an unsigned long before the shift.

Detected by CoverityScan, CID#144925-144928 ("Unintended sign extension")

Fixes: 008b30408c40 ("mfd: Add rtc support to 88pm860x")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/rtc/rtc-88pm860x.c | 21 ++++++++++++++-------
 1 file changed, 14 insertions(+), 7 deletions(-)

diff --git a/drivers/rtc/rtc-88pm860x.c b/drivers/rtc/rtc-88pm860x.c
index 166faae3a59cd..7d3e5168fcefc 100644
--- a/drivers/rtc/rtc-88pm860x.c
+++ b/drivers/rtc/rtc-88pm860x.c
@@ -115,11 +115,13 @@ static int pm860x_rtc_read_time(struct device *dev, struct rtc_time *tm)
 	pm860x_page_bulk_read(info->i2c, REG0_ADDR, 8, buf);
 	dev_dbg(info->dev, "%x-%x-%x-%x-%x-%x-%x-%x\n", buf[0], buf[1],
 		buf[2], buf[3], buf[4], buf[5], buf[6], buf[7]);
-	base = (buf[1] << 24) | (buf[3] << 16) | (buf[5] << 8) | buf[7];
+	base = ((unsigned long)buf[1] << 24) | (buf[3] << 16) |
+		(buf[5] << 8) | buf[7];
 
 	/* load 32-bit read-only counter */
 	pm860x_bulk_read(info->i2c, PM8607_RTC_COUNTER1, 4, buf);
-	data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
+	data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
+		(buf[1] << 8) | buf[0];
 	ticks = base + data;
 	dev_dbg(info->dev, "get base:0x%lx, RO count:0x%lx, ticks:0x%lx\n",
 		base, data, ticks);
@@ -145,7 +147,8 @@ static int pm860x_rtc_set_time(struct device *dev, struct rtc_time *tm)
 
 	/* load 32-bit read-only counter */
 	pm860x_bulk_read(info->i2c, PM8607_RTC_COUNTER1, 4, buf);
-	data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
+	data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
+		(buf[1] << 8) | buf[0];
 	base = ticks - data;
 	dev_dbg(info->dev, "set base:0x%lx, RO count:0x%lx, ticks:0x%lx\n",
 		base, data, ticks);
@@ -170,10 +173,12 @@ static int pm860x_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *alrm)
 	pm860x_page_bulk_read(info->i2c, REG0_ADDR, 8, buf);
 	dev_dbg(info->dev, "%x-%x-%x-%x-%x-%x-%x-%x\n", buf[0], buf[1],
 		buf[2], buf[3], buf[4], buf[5], buf[6], buf[7]);
-	base = (buf[1] << 24) | (buf[3] << 16) | (buf[5] << 8) | buf[7];
+	base = ((unsigned long)buf[1] << 24) | (buf[3] << 16) |
+		(buf[5] << 8) | buf[7];
 
 	pm860x_bulk_read(info->i2c, PM8607_RTC_EXPIRE1, 4, buf);
-	data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
+	data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
+		(buf[1] << 8) | buf[0];
 	ticks = base + data;
 	dev_dbg(info->dev, "get base:0x%lx, RO count:0x%lx, ticks:0x%lx\n",
 		base, data, ticks);
@@ -198,11 +203,13 @@ static int pm860x_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *alrm)
 	pm860x_page_bulk_read(info->i2c, REG0_ADDR, 8, buf);
 	dev_dbg(info->dev, "%x-%x-%x-%x-%x-%x-%x-%x\n", buf[0], buf[1],
 		buf[2], buf[3], buf[4], buf[5], buf[6], buf[7]);
-	base = (buf[1] << 24) | (buf[3] << 16) | (buf[5] << 8) | buf[7];
+	base = ((unsigned long)buf[1] << 24) | (buf[3] << 16) |
+		(buf[5] << 8) | buf[7];
 
 	/* load 32-bit read-only counter */
 	pm860x_bulk_read(info->i2c, PM8607_RTC_COUNTER1, 4, buf);
-	data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
+	data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
+		(buf[1] << 8) | buf[0];
 	ticks = base + data;
 	dev_dbg(info->dev, "get base:0x%lx, RO count:0x%lx, ticks:0x%lx\n",
 		base, data, ticks);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 063/271] rtc: 88pm80x: fix unintended sign extension
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (61 preceding siblings ...)
  2020-01-28 14:03 ` [PATCH 4.9 062/271] rtc: 88pm860x: fix unintended sign extension Greg Kroah-Hartman
@ 2020-01-28 14:03 ` Greg Kroah-Hartman
  2020-01-28 14:03 ` [PATCH 4.9 064/271] rtc: pm8xxx: " Greg Kroah-Hartman
                   ` (212 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:03 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Colin Ian King, Alexandre Belloni,
	Sasha Levin

From: Colin Ian King <colin.king@canonical.com>

[ Upstream commit fb0b322537a831b5b0cb948c56f8f958ce493d3a ]

Shifting a u8 by 24 will cause the value to be promoted to an integer. If
the top bit of the u8 is set then the following conversion to an unsigned
long will sign extend the value causing the upper 32 bits to be set in
the result.

Fix this by casting the u8 value to an unsigned long before the shift.

Detected by CoverityScan, CID#714646-714649 ("Unintended sign extension")

Fixes: 2985c29c1964 ("rtc: Add rtc support to 88PM80X PMIC")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/rtc/rtc-88pm80x.c | 21 ++++++++++++++-------
 1 file changed, 14 insertions(+), 7 deletions(-)

diff --git a/drivers/rtc/rtc-88pm80x.c b/drivers/rtc/rtc-88pm80x.c
index 466bf7f9a285a..7da2a1fb50f89 100644
--- a/drivers/rtc/rtc-88pm80x.c
+++ b/drivers/rtc/rtc-88pm80x.c
@@ -116,12 +116,14 @@ static int pm80x_rtc_read_time(struct device *dev, struct rtc_time *tm)
 	unsigned char buf[4];
 	unsigned long ticks, base, data;
 	regmap_raw_read(info->map, PM800_RTC_EXPIRE2_1, buf, 4);
-	base = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
+	base = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
+		(buf[1] << 8) | buf[0];
 	dev_dbg(info->dev, "%x-%x-%x-%x\n", buf[0], buf[1], buf[2], buf[3]);
 
 	/* load 32-bit read-only counter */
 	regmap_raw_read(info->map, PM800_RTC_COUNTER1, buf, 4);
-	data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
+	data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
+		(buf[1] << 8) | buf[0];
 	ticks = base + data;
 	dev_dbg(info->dev, "get base:0x%lx, RO count:0x%lx, ticks:0x%lx\n",
 		base, data, ticks);
@@ -144,7 +146,8 @@ static int pm80x_rtc_set_time(struct device *dev, struct rtc_time *tm)
 
 	/* load 32-bit read-only counter */
 	regmap_raw_read(info->map, PM800_RTC_COUNTER1, buf, 4);
-	data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
+	data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
+		(buf[1] << 8) | buf[0];
 	base = ticks - data;
 	dev_dbg(info->dev, "set base:0x%lx, RO count:0x%lx, ticks:0x%lx\n",
 		base, data, ticks);
@@ -165,11 +168,13 @@ static int pm80x_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *alrm)
 	int ret;
 
 	regmap_raw_read(info->map, PM800_RTC_EXPIRE2_1, buf, 4);
-	base = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
+	base = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
+		(buf[1] << 8) | buf[0];
 	dev_dbg(info->dev, "%x-%x-%x-%x\n", buf[0], buf[1], buf[2], buf[3]);
 
 	regmap_raw_read(info->map, PM800_RTC_EXPIRE1_1, buf, 4);
-	data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
+	data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
+		(buf[1] << 8) | buf[0];
 	ticks = base + data;
 	dev_dbg(info->dev, "get base:0x%lx, RO count:0x%lx, ticks:0x%lx\n",
 		base, data, ticks);
@@ -192,12 +197,14 @@ static int pm80x_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *alrm)
 	regmap_update_bits(info->map, PM800_RTC_CONTROL, PM800_ALARM1_EN, 0);
 
 	regmap_raw_read(info->map, PM800_RTC_EXPIRE2_1, buf, 4);
-	base = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
+	base = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
+		(buf[1] << 8) | buf[0];
 	dev_dbg(info->dev, "%x-%x-%x-%x\n", buf[0], buf[1], buf[2], buf[3]);
 
 	/* load 32-bit read-only counter */
 	regmap_raw_read(info->map, PM800_RTC_COUNTER1, buf, 4);
-	data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
+	data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
+		(buf[1] << 8) | buf[0];
 	ticks = base + data;
 	dev_dbg(info->dev, "get base:0x%lx, RO count:0x%lx, ticks:0x%lx\n",
 		base, data, ticks);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 064/271] rtc: pm8xxx: fix unintended sign extension
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (62 preceding siblings ...)
  2020-01-28 14:03 ` [PATCH 4.9 063/271] rtc: 88pm80x: " Greg Kroah-Hartman
@ 2020-01-28 14:03 ` Greg Kroah-Hartman
  2020-01-28 14:03 ` [PATCH 4.9 065/271] fbdev: chipsfb: remove set but not used variable size Greg Kroah-Hartman
                   ` (211 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:03 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Colin Ian King, Alexandre Belloni,
	Sasha Levin

From: Colin Ian King <colin.king@canonical.com>

[ Upstream commit e42280886018c6f77f0a90190f7cba344b0df3e0 ]

Shifting a u8 by 24 will cause the value to be promoted to an integer. If
the top bit of the u8 is set then the following conversion to an unsigned
long will sign extend the value causing the upper 32 bits to be set in
the result.

Fix this by casting the u8 value to an unsigned long before the shift.

Detected by CoverityScan, CID#1309693 ("Unintended sign extension")

Fixes: 9a9a54ad7aa2 ("drivers/rtc: add support for Qualcomm PMIC8xxx RTC")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/rtc/rtc-pm8xxx.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/rtc/rtc-pm8xxx.c b/drivers/rtc/rtc-pm8xxx.c
index fac835530671f..a1b4b0ed1f196 100644
--- a/drivers/rtc/rtc-pm8xxx.c
+++ b/drivers/rtc/rtc-pm8xxx.c
@@ -186,7 +186,8 @@ static int pm8xxx_rtc_read_time(struct device *dev, struct rtc_time *tm)
 		}
 	}
 
-	secs = value[0] | (value[1] << 8) | (value[2] << 16) | (value[3] << 24);
+	secs = value[0] | (value[1] << 8) | (value[2] << 16) |
+	       ((unsigned long)value[3] << 24);
 
 	rtc_time_to_tm(secs, tm);
 
@@ -267,7 +268,8 @@ static int pm8xxx_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *alarm)
 		return rc;
 	}
 
-	secs = value[0] | (value[1] << 8) | (value[2] << 16) | (value[3] << 24);
+	secs = value[0] | (value[1] << 8) | (value[2] << 16) |
+	       ((unsigned long)value[3] << 24);
 
 	rtc_time_to_tm(secs, &alarm->time);
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 065/271] fbdev: chipsfb: remove set but not used variable size
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (63 preceding siblings ...)
  2020-01-28 14:03 ` [PATCH 4.9 064/271] rtc: pm8xxx: " Greg Kroah-Hartman
@ 2020-01-28 14:03 ` Greg Kroah-Hartman
  2020-01-28 14:03 ` [PATCH 4.9 066/271] iw_cxgb4: use tos when importing the endpoint Greg Kroah-Hartman
                   ` (210 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:03 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, YueHaibing, Michael Ellerman,
	Daniel Vetter, Christophe Leroy, Bartlomiej Zolnierkiewicz,
	Sasha Levin

From: YueHaibing <yuehaibing@huawei.com>

[ Upstream commit 8e71fa5e4d86bedfd26df85381d65d6b4c860020 ]

Fixes gcc '-Wunused-but-set-variable' warning:

drivers/video/fbdev/chipsfb.c: In function 'chipsfb_pci_init':
drivers/video/fbdev/chipsfb.c:352:22: warning:
 variable 'size' set but not used [-Wunused-but-set-variable]

Fixes: 8c8709334cec ("[PATCH] ppc32: Remove CONFIG_PMAC_PBOOK").
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Acked-by: Michael Ellerman <mpe@ellerman.id.au>
Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
Cc: Christophe Leroy <christophe.leroy@c-s.fr>
[b.zolnierkie: minor commit summary and description fixups]
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/video/fbdev/chipsfb.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/video/fbdev/chipsfb.c b/drivers/video/fbdev/chipsfb.c
index 59abdc6a97f66..314b7eceb81c5 100644
--- a/drivers/video/fbdev/chipsfb.c
+++ b/drivers/video/fbdev/chipsfb.c
@@ -350,7 +350,7 @@ static void init_chips(struct fb_info *p, unsigned long addr)
 static int chipsfb_pci_init(struct pci_dev *dp, const struct pci_device_id *ent)
 {
 	struct fb_info *p;
-	unsigned long addr, size;
+	unsigned long addr;
 	unsigned short cmd;
 	int rc = -ENODEV;
 
@@ -362,7 +362,6 @@ static int chipsfb_pci_init(struct pci_dev *dp, const struct pci_device_id *ent)
 	if ((dp->resource[0].flags & IORESOURCE_MEM) == 0)
 		goto err_disable;
 	addr = pci_resource_start(dp, 0);
-	size = pci_resource_len(dp, 0);
 	if (addr == 0)
 		goto err_disable;
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 066/271] iw_cxgb4: use tos when importing the endpoint
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (64 preceding siblings ...)
  2020-01-28 14:03 ` [PATCH 4.9 065/271] fbdev: chipsfb: remove set but not used variable size Greg Kroah-Hartman
@ 2020-01-28 14:03 ` Greg Kroah-Hartman
  2020-01-28 14:03 ` [PATCH 4.9 067/271] iw_cxgb4: use tos when finding ipv6 routes Greg Kroah-Hartman
                   ` (209 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:03 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Steve Wise, Jason Gunthorpe, Sasha Levin

From: Steve Wise <swise@opengridcomputing.com>

[ Upstream commit cb3ba0bde881f0cb7e3945d2a266901e2bd18c92 ]

import_ep() is passed the correct tos, but doesn't use it correctly.

Fixes: ac8e4c69a021 ("cxgb4/iw_cxgb4: TOS support")
Signed-off-by: Steve Wise <swise@opengridcomputing.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/hw/cxgb4/cm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
index 605d50ad123cc..a29fe11d688a5 100644
--- a/drivers/infiniband/hw/cxgb4/cm.c
+++ b/drivers/infiniband/hw/cxgb4/cm.c
@@ -2044,7 +2044,7 @@ static int import_ep(struct c4iw_ep *ep, int iptype, __u8 *peer_ip,
 	} else {
 		pdev = get_real_dev(n->dev);
 		ep->l2t = cxgb4_l2t_get(cdev->rdev.lldi.l2t,
-					n, pdev, 0);
+					n, pdev, rt_tos2priority(tos));
 		if (!ep->l2t)
 			goto out;
 		ep->mtu = dst_mtu(dst);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 067/271] iw_cxgb4: use tos when finding ipv6 routes
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (65 preceding siblings ...)
  2020-01-28 14:03 ` [PATCH 4.9 066/271] iw_cxgb4: use tos when importing the endpoint Greg Kroah-Hartman
@ 2020-01-28 14:03 ` Greg Kroah-Hartman
  2020-01-28 14:03 ` [PATCH 4.9 068/271] pinctrl: sh-pfc: emev2: Add missing pinmux functions Greg Kroah-Hartman
                   ` (208 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:03 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Steve Wise, Jason Gunthorpe, Sasha Levin

From: Steve Wise <swise@opengridcomputing.com>

[ Upstream commit c8a7eb554a83214c3d8ee5cb322da8c72810d2dc ]

When IPv6 support was added, the correct tos was not passed to
cxgb_find_route6(). This potentially results in the wrong route entry.

Fixes: 830662f6f032 ("RDMA/cxgb4: Add support for active and passive open connection with IPv6 address")
Signed-off-by: Steve Wise <swise@opengridcomputing.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/hw/cxgb4/cm.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
index a29fe11d688a5..a04a53acb24ff 100644
--- a/drivers/infiniband/hw/cxgb4/cm.c
+++ b/drivers/infiniband/hw/cxgb4/cm.c
@@ -2135,7 +2135,8 @@ static int c4iw_reconnect(struct c4iw_ep *ep)
 					   laddr6->sin6_addr.s6_addr,
 					   raddr6->sin6_addr.s6_addr,
 					   laddr6->sin6_port,
-					   raddr6->sin6_port, 0,
+					   raddr6->sin6_port,
+					   ep->com.cm_id->tos,
 					   raddr6->sin6_scope_id);
 		iptype = 6;
 		ra = (__u8 *)&raddr6->sin6_addr;
@@ -3278,7 +3279,7 @@ int c4iw_connect(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
 					   laddr6->sin6_addr.s6_addr,
 					   raddr6->sin6_addr.s6_addr,
 					   laddr6->sin6_port,
-					   raddr6->sin6_port, 0,
+					   raddr6->sin6_port, cm_id->tos,
 					   raddr6->sin6_scope_id);
 	}
 	if (!ep->dst) {
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 068/271] pinctrl: sh-pfc: emev2: Add missing pinmux functions
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (66 preceding siblings ...)
  2020-01-28 14:03 ` [PATCH 4.9 067/271] iw_cxgb4: use tos when finding ipv6 routes Greg Kroah-Hartman
@ 2020-01-28 14:03 ` Greg Kroah-Hartman
  2020-01-28 14:03 ` [PATCH 4.9 069/271] pinctrl: sh-pfc: r8a7791: Fix scifb2_data_c pin group Greg Kroah-Hartman
                   ` (207 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:03 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Geert Uytterhoeven, Simon Horman,
	Sasha Levin

From: Geert Uytterhoeven <geert+renesas@glider.be>

[ Upstream commit 1ecd8c9cb899ae277e6986ae134635cb1a50f5de ]

The err_rst_reqb, ext_clki, lowpwr, and ref_clko pin groups are present,
but no pinmux functions refer to them, hence they can not be selected.

Fixes: 1e7d5d849cf4f0c5 ("sh-pfc: Add emev2 pinmux support")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pinctrl/sh-pfc/pfc-emev2.c | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/drivers/pinctrl/sh-pfc/pfc-emev2.c b/drivers/pinctrl/sh-pfc/pfc-emev2.c
index 1cbbe04d7df65..eafd8edbcbe95 100644
--- a/drivers/pinctrl/sh-pfc/pfc-emev2.c
+++ b/drivers/pinctrl/sh-pfc/pfc-emev2.c
@@ -1263,6 +1263,14 @@ static const char * const dtv_groups[] = {
 	"dtv_b",
 };
 
+static const char * const err_rst_reqb_groups[] = {
+	"err_rst_reqb",
+};
+
+static const char * const ext_clki_groups[] = {
+	"ext_clki",
+};
+
 static const char * const iic0_groups[] = {
 	"iic0",
 };
@@ -1285,6 +1293,10 @@ static const char * const lcd_groups[] = {
 	"yuv3",
 };
 
+static const char * const lowpwr_groups[] = {
+	"lowpwr",
+};
+
 static const char * const ntsc_groups[] = {
 	"ntsc_clk",
 	"ntsc_data",
@@ -1298,6 +1310,10 @@ static const char * const pwm1_groups[] = {
 	"pwm1",
 };
 
+static const char * const ref_clko_groups[] = {
+	"ref_clko",
+};
+
 static const char * const sd_groups[] = {
 	"sd_cki",
 };
@@ -1391,13 +1407,17 @@ static const struct sh_pfc_function pinmux_functions[] = {
 	SH_PFC_FUNCTION(cam),
 	SH_PFC_FUNCTION(cf),
 	SH_PFC_FUNCTION(dtv),
+	SH_PFC_FUNCTION(err_rst_reqb),
+	SH_PFC_FUNCTION(ext_clki),
 	SH_PFC_FUNCTION(iic0),
 	SH_PFC_FUNCTION(iic1),
 	SH_PFC_FUNCTION(jtag),
 	SH_PFC_FUNCTION(lcd),
+	SH_PFC_FUNCTION(lowpwr),
 	SH_PFC_FUNCTION(ntsc),
 	SH_PFC_FUNCTION(pwm0),
 	SH_PFC_FUNCTION(pwm1),
+	SH_PFC_FUNCTION(ref_clko),
 	SH_PFC_FUNCTION(sd),
 	SH_PFC_FUNCTION(sdi0),
 	SH_PFC_FUNCTION(sdi1),
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 069/271] pinctrl: sh-pfc: r8a7791: Fix scifb2_data_c pin group
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (67 preceding siblings ...)
  2020-01-28 14:03 ` [PATCH 4.9 068/271] pinctrl: sh-pfc: emev2: Add missing pinmux functions Greg Kroah-Hartman
@ 2020-01-28 14:03 ` Greg Kroah-Hartman
  2020-01-28 14:03 ` [PATCH 4.9 070/271] pinctrl: sh-pfc: r8a7792: Fix vin1_data18_b " Greg Kroah-Hartman
                   ` (206 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:03 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Geert Uytterhoeven, Simon Horman,
	Sasha Levin

From: Geert Uytterhoeven <geert+renesas@glider.be>

[ Upstream commit a4b0350047f1b10207e25e72d7cd3f7826e93769 ]

The entry for "scifb2_data_c" in the SCIFB2 pin group array contains a
typo, thus the group cannot be selected.

Fixes: 5088451962389924 ("pinctrl: sh-pfc: r8a7791 PFC support")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pinctrl/sh-pfc/pfc-r8a7791.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7791.c b/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
index 1e7f32b5dce8c..dd350e2961423 100644
--- a/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
+++ b/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
@@ -5078,7 +5078,7 @@ static const char * const scifb2_groups[] = {
 	"scifb2_data_b",
 	"scifb2_clk_b",
 	"scifb2_ctrl_b",
-	"scifb0_data_c",
+	"scifb2_data_c",
 	"scifb2_clk_c",
 	"scifb2_data_d",
 };
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 070/271] pinctrl: sh-pfc: r8a7792: Fix vin1_data18_b pin group
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (68 preceding siblings ...)
  2020-01-28 14:03 ` [PATCH 4.9 069/271] pinctrl: sh-pfc: r8a7791: Fix scifb2_data_c pin group Greg Kroah-Hartman
@ 2020-01-28 14:03 ` Greg Kroah-Hartman
  2020-01-28 14:03 ` [PATCH 4.9 071/271] pinctrl: sh-pfc: sh73a0: Fix fsic_spdif pin groups Greg Kroah-Hartman
                   ` (205 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:03 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Geert Uytterhoeven, Simon Horman,
	Sasha Levin

From: Geert Uytterhoeven <geert+renesas@glider.be>

[ Upstream commit b9fd50488b4939ce5b3a026d29e752e17c2d1800 ]

The vin1_data18_b pin group itself is present, but it is not listed in
the VIN1 pin group array, and thus cannot be selected.

Fixes: 7dd74bb1f058786e ("pinctrl: sh-pfc: r8a7792: Add VIN pin groups")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pinctrl/sh-pfc/pfc-r8a7792.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7792.c b/drivers/pinctrl/sh-pfc/pfc-r8a7792.c
index 21badb6166b92..97998929db938 100644
--- a/drivers/pinctrl/sh-pfc/pfc-r8a7792.c
+++ b/drivers/pinctrl/sh-pfc/pfc-r8a7792.c
@@ -1863,6 +1863,7 @@ static const char * const vin1_groups[] = {
 	"vin1_data8",
 	"vin1_data24_b",
 	"vin1_data20_b",
+	"vin1_data18_b",
 	"vin1_data16_b",
 	"vin1_sync",
 	"vin1_field",
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 071/271] pinctrl: sh-pfc: sh73a0: Fix fsic_spdif pin groups
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (69 preceding siblings ...)
  2020-01-28 14:03 ` [PATCH 4.9 070/271] pinctrl: sh-pfc: r8a7792: Fix vin1_data18_b " Greg Kroah-Hartman
@ 2020-01-28 14:03 ` Greg Kroah-Hartman
  2020-01-28 14:03 ` [PATCH 4.9 072/271] usb: phy: twl6030-usb: fix possible use-after-free on remove Greg Kroah-Hartman
                   ` (204 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:03 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Geert Uytterhoeven, Simon Horman,
	Sasha Levin

From: Geert Uytterhoeven <geert+renesas@glider.be>

[ Upstream commit 0e6e448bdcf896d001a289a6112a704542d51516 ]

There are two pin groups for the FSIC SPDIF signal, but the FSIC pin
group array lists only one, and it refers to a nonexistent group.

Fixes: 2ecd4154c906b7d6 ("sh-pfc: sh73a0: Add FSI pin groups and functions")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pinctrl/sh-pfc/pfc-sh73a0.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/pinctrl/sh-pfc/pfc-sh73a0.c b/drivers/pinctrl/sh-pfc/pfc-sh73a0.c
index f8fbedb46585d..6dca760f9f280 100644
--- a/drivers/pinctrl/sh-pfc/pfc-sh73a0.c
+++ b/drivers/pinctrl/sh-pfc/pfc-sh73a0.c
@@ -3367,7 +3367,8 @@ static const char * const fsic_groups[] = {
 	"fsic_sclk_out",
 	"fsic_data_in",
 	"fsic_data_out",
-	"fsic_spdif",
+	"fsic_spdif_0",
+	"fsic_spdif_1",
 };
 
 static const char * const fsid_groups[] = {
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 072/271] usb: phy: twl6030-usb: fix possible use-after-free on remove
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (70 preceding siblings ...)
  2020-01-28 14:03 ` [PATCH 4.9 071/271] pinctrl: sh-pfc: sh73a0: Fix fsic_spdif pin groups Greg Kroah-Hartman
@ 2020-01-28 14:03 ` Greg Kroah-Hartman
  2020-01-28 14:03 ` [PATCH 4.9 073/271] block: dont use bio->bi_vcnt to figure out segment number Greg Kroah-Hartman
                   ` (203 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:03 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Tony Lindgren, Bin Liu,
	Sven Van Asbroeck, Felipe Balbi, Sasha Levin

From: Sven Van Asbroeck <thesven73@gmail.com>

[ Upstream commit 5895d311d28f2605e2f71c1a3e043ed38f3ac9d2 ]

In remove(), use cancel_delayed_work_sync() to cancel the
delayed work. Otherwise there's a chance that this work
will continue to run until after the device has been removed.

This issue was detected with the help of Coccinelle.

Cc: Tony Lindgren <tony@atomide.com>
Cc: Bin Liu <b-liu@ti.com>
Fixes: b6a619a883c3 ("usb: phy: Check initial state for twl6030")
Signed-off-by: Sven Van Asbroeck <TheSven73@gmail.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/phy/phy-twl6030-usb.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/phy/phy-twl6030-usb.c b/drivers/usb/phy/phy-twl6030-usb.c
index a72e8d670adc8..cf0b67433ac95 100644
--- a/drivers/usb/phy/phy-twl6030-usb.c
+++ b/drivers/usb/phy/phy-twl6030-usb.c
@@ -422,7 +422,7 @@ static int twl6030_usb_remove(struct platform_device *pdev)
 {
 	struct twl6030_usb *twl = platform_get_drvdata(pdev);
 
-	cancel_delayed_work(&twl->get_status_work);
+	cancel_delayed_work_sync(&twl->get_status_work);
 	twl6030_interrupt_mask(TWL6030_USBOTG_INT_MASK,
 		REG_INT_MSK_LINE_C);
 	twl6030_interrupt_mask(TWL6030_USBOTG_INT_MASK,
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 073/271] block: dont use bio->bi_vcnt to figure out segment number
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (71 preceding siblings ...)
  2020-01-28 14:03 ` [PATCH 4.9 072/271] usb: phy: twl6030-usb: fix possible use-after-free on remove Greg Kroah-Hartman
@ 2020-01-28 14:03 ` Greg Kroah-Hartman
  2020-01-28 14:03 ` [PATCH 4.9 074/271] keys: Timestamp new keys Greg Kroah-Hartman
                   ` (202 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:03 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Omar Sandoval, Christoph Hellwig,
	Ming Lei, Jens Axboe, Sasha Levin

From: Ming Lei <ming.lei@redhat.com>

[ Upstream commit 1a67356e9a4829da2935dd338630a550c59c8489 ]

It is wrong to use bio->bi_vcnt to figure out how many segments
there are in the bio even though CLONED flag isn't set on this bio,
because this bio may be splitted or advanced.

So always use bio_segments() in blk_recount_segments(), and it shouldn't
cause any performance loss now because the physical segment number is figured
out in blk_queue_split() and BIO_SEG_VALID is set meantime since
bdced438acd83ad83a6c ("block: setup bi_phys_segments after splitting").

Reviewed-by: Omar Sandoval <osandov@fb.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Fixes: 76d8137a3113 ("blk-merge: recaculate segment if it isn't less than max segments")
Signed-off-by: Ming Lei <ming.lei@redhat.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 block/blk-merge.c | 8 +-------
 1 file changed, 1 insertion(+), 7 deletions(-)

diff --git a/block/blk-merge.c b/block/blk-merge.c
index 2642e5fc8b69a..66795cca662a3 100644
--- a/block/blk-merge.c
+++ b/block/blk-merge.c
@@ -305,13 +305,7 @@ void blk_recalc_rq_segments(struct request *rq)
 
 void blk_recount_segments(struct request_queue *q, struct bio *bio)
 {
-	unsigned short seg_cnt;
-
-	/* estimate segment number by bi_vcnt for non-cloned bio */
-	if (bio_flagged(bio, BIO_CLONED))
-		seg_cnt = bio_segments(bio);
-	else
-		seg_cnt = bio->bi_vcnt;
+	unsigned short seg_cnt = bio_segments(bio);
 
 	if (test_bit(QUEUE_FLAG_NO_SG_MERGE, &q->queue_flags) &&
 			(seg_cnt < queue_max_segments(q)))
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 074/271] keys: Timestamp new keys
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (72 preceding siblings ...)
  2020-01-28 14:03 ` [PATCH 4.9 073/271] block: dont use bio->bi_vcnt to figure out segment number Greg Kroah-Hartman
@ 2020-01-28 14:03 ` Greg Kroah-Hartman
  2020-01-28 14:03 ` [PATCH 4.9 075/271] vfio_pci: Enable memory accesses before calling pci_map_rom Greg Kroah-Hartman
                   ` (201 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:03 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, David Howells, James Morris, Sasha Levin

From: David Howells <dhowells@redhat.com>

[ Upstream commit 7c1857bdbdf1e4c541e45eab477ee23ed4333ea4 ]

Set the timestamp on new keys rather than leaving it unset.

Fixes: 31d5a79d7f3d ("KEYS: Do LRU discard in full keyrings")
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: James Morris <james.morris@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 security/keys/key.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/security/keys/key.c b/security/keys/key.c
index 7276d1a009d49..280b4feccdc00 100644
--- a/security/keys/key.c
+++ b/security/keys/key.c
@@ -296,6 +296,7 @@ struct key *key_alloc(struct key_type *type, const char *desc,
 	key->gid = gid;
 	key->perm = perm;
 	key->restrict_link = restrict_link;
+	key->last_used_at = ktime_get_real_seconds();
 
 	if (!(flags & KEY_ALLOC_NOT_IN_QUOTA))
 		key->flags |= 1 << KEY_FLAG_IN_QUOTA;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 075/271] vfio_pci: Enable memory accesses before calling pci_map_rom
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (73 preceding siblings ...)
  2020-01-28 14:03 ` [PATCH 4.9 074/271] keys: Timestamp new keys Greg Kroah-Hartman
@ 2020-01-28 14:03 ` Greg Kroah-Hartman
  2020-01-28 14:03 ` [PATCH 4.9 076/271] dmaengine: mv_xor: Use correct device for DMA API Greg Kroah-Hartman
                   ` (200 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:03 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Eric Auger, Alex Williamson, Sasha Levin

From: Eric Auger <eric.auger@redhat.com>

[ Upstream commit 0cfd027be1d6def4a462cdc180c055143af24069 ]

pci_map_rom/pci_get_rom_size() performs memory access in the ROM.
In case the Memory Space accesses were disabled, readw() is likely
to trigger a synchronous external abort on some platforms.

In case memory accesses were disabled, re-enable them before the
call and disable them back again just after.

Fixes: 89e1f7d4c66d ("vfio: Add PCI device driver")
Signed-off-by: Eric Auger <eric.auger@redhat.com>
Suggested-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/vfio/pci/vfio_pci.c | 19 ++++++++++++++-----
 1 file changed, 14 insertions(+), 5 deletions(-)

diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
index da3f0ed18c769..c94167d871789 100644
--- a/drivers/vfio/pci/vfio_pci.c
+++ b/drivers/vfio/pci/vfio_pci.c
@@ -729,6 +729,7 @@ static long vfio_pci_ioctl(void *device_data,
 		{
 			void __iomem *io;
 			size_t size;
+			u16 orig_cmd;
 
 			info.offset = VFIO_PCI_INDEX_TO_OFFSET(info.index);
 			info.flags = 0;
@@ -744,15 +745,23 @@ static long vfio_pci_ioctl(void *device_data,
 					break;
 			}
 
-			/* Is it really there? */
+			/*
+			 * Is it really there?  Enable memory decode for
+			 * implicit access in pci_map_rom().
+			 */
+			pci_read_config_word(pdev, PCI_COMMAND, &orig_cmd);
+			pci_write_config_word(pdev, PCI_COMMAND,
+					      orig_cmd | PCI_COMMAND_MEMORY);
+
 			io = pci_map_rom(pdev, &size);
-			if (!io || !size) {
+			if (io) {
+				info.flags = VFIO_REGION_INFO_FLAG_READ;
+				pci_unmap_rom(pdev, io);
+			} else {
 				info.size = 0;
-				break;
 			}
-			pci_unmap_rom(pdev, io);
 
-			info.flags = VFIO_REGION_INFO_FLAG_READ;
+			pci_write_config_word(pdev, PCI_COMMAND, orig_cmd);
 			break;
 		}
 		case VFIO_PCI_VGA_REGION_INDEX:
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 076/271] dmaengine: mv_xor: Use correct device for DMA API
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (74 preceding siblings ...)
  2020-01-28 14:03 ` [PATCH 4.9 075/271] vfio_pci: Enable memory accesses before calling pci_map_rom Greg Kroah-Hartman
@ 2020-01-28 14:03 ` Greg Kroah-Hartman
  2020-01-28 14:03 ` [PATCH 4.9 077/271] cdc-wdm: pass return value of recover_from_urb_loss Greg Kroah-Hartman
                   ` (199 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:03 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, John David Anglin, Robin Murphy,
	Thomas Petazzoni, Vinod Koul, Sasha Levin

From: Robin Murphy <robin.murphy@arm.com>

[ Upstream commit 3e5daee5ecf314da33a890fabaa2404244cd2a36 ]

Using dma_dev->dev for mappings before it's assigned with the correct
device is unlikely to work as expected, and with future dma-direct
changes, passing a NULL device may end up crashing entirely. I don't
know enough about this hardware or the mv_xor_prep_dma_interrupt()
operation to implement the appropriate error-handling logic that would
have revealed those dma_map_single() calls failing on arm64 for as long
as the driver has been enabled there, but moving the assignment earlier
will at least make the current code operate as intended.

Fixes: 22843545b200 ("dma: mv_xor: Add support for DMA_INTERRUPT")
Reported-by: John David Anglin <dave.anglin@bell.net>
Tested-by: John David Anglin <dave.anglin@bell.net>
Signed-off-by: Robin Murphy <robin.murphy@arm.com>
Acked-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Tested-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/dma/mv_xor.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/dma/mv_xor.c b/drivers/dma/mv_xor.c
index 23f75285a4d9c..5d524f29c5f11 100644
--- a/drivers/dma/mv_xor.c
+++ b/drivers/dma/mv_xor.c
@@ -1044,6 +1044,7 @@ mv_xor_channel_add(struct mv_xor_device *xordev,
 		mv_chan->op_in_desc = XOR_MODE_IN_DESC;
 
 	dma_dev = &mv_chan->dmadev;
+	dma_dev->dev = &pdev->dev;
 	mv_chan->xordev = xordev;
 
 	/*
@@ -1076,7 +1077,6 @@ mv_xor_channel_add(struct mv_xor_device *xordev,
 	dma_dev->device_free_chan_resources = mv_xor_free_chan_resources;
 	dma_dev->device_tx_status = mv_xor_status;
 	dma_dev->device_issue_pending = mv_xor_issue_pending;
-	dma_dev->dev = &pdev->dev;
 
 	/* set prep routines based on capability */
 	if (dma_has_cap(DMA_INTERRUPT, dma_dev->cap_mask))
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 077/271] cdc-wdm: pass return value of recover_from_urb_loss
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (75 preceding siblings ...)
  2020-01-28 14:03 ` [PATCH 4.9 076/271] dmaengine: mv_xor: Use correct device for DMA API Greg Kroah-Hartman
@ 2020-01-28 14:03 ` Greg Kroah-Hartman
  2020-01-28 14:03 ` [PATCH 4.9 078/271] regulator: pv88060: Fix array out-of-bounds access Greg Kroah-Hartman
                   ` (198 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:03 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, YueHaibing, Sasha Levin

From: YueHaibing <yuehaibing@huawei.com>

[ Upstream commit 0742a338f5b3446a26de551ad8273fb41b2787f2 ]

'rv' is the correct return value, pass it upstream instead of 0

Fixes: 17d80d562fd7 ("USB: autosuspend for cdc-wdm")
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/class/cdc-wdm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
index 217a479165e03..09337a973335c 100644
--- a/drivers/usb/class/cdc-wdm.c
+++ b/drivers/usb/class/cdc-wdm.c
@@ -1098,7 +1098,7 @@ static int wdm_post_reset(struct usb_interface *intf)
 	rv = recover_from_urb_loss(desc);
 	mutex_unlock(&desc->wlock);
 	mutex_unlock(&desc->rlock);
-	return 0;
+	return rv;
 }
 
 static struct usb_driver wdm_driver = {
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 078/271] regulator: pv88060: Fix array out-of-bounds access
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (76 preceding siblings ...)
  2020-01-28 14:03 ` [PATCH 4.9 077/271] cdc-wdm: pass return value of recover_from_urb_loss Greg Kroah-Hartman
@ 2020-01-28 14:03 ` Greg Kroah-Hartman
  2020-01-28 14:03 ` [PATCH 4.9 079/271] regulator: pv88080: " Greg Kroah-Hartman
                   ` (197 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:03 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Axel Lin, Mark Brown, Sasha Levin

From: Axel Lin <axel.lin@ingics.com>

[ Upstream commit 7cd415f875591bc66c5ecb49bf84ef97e80d7b0e ]

Fix off-by-one while iterating current_limits array.
The valid index should be 0 ~ n_current_limits -1.

Fixes: f307a7e9b7af ("regulator: pv88060: new regulator driver")
Signed-off-by: Axel Lin <axel.lin@ingics.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/regulator/pv88060-regulator.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/regulator/pv88060-regulator.c b/drivers/regulator/pv88060-regulator.c
index 6c4afc73ecac3..d229245d2b5e8 100644
--- a/drivers/regulator/pv88060-regulator.c
+++ b/drivers/regulator/pv88060-regulator.c
@@ -135,7 +135,7 @@ static int pv88060_set_current_limit(struct regulator_dev *rdev, int min,
 	int i;
 
 	/* search for closest to maximum */
-	for (i = info->n_current_limits; i >= 0; i--) {
+	for (i = info->n_current_limits - 1; i >= 0; i--) {
 		if (min <= info->current_limits[i]
 			&& max >= info->current_limits[i]) {
 			return regmap_update_bits(rdev->regmap,
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 079/271] regulator: pv88080: Fix array out-of-bounds access
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (77 preceding siblings ...)
  2020-01-28 14:03 ` [PATCH 4.9 078/271] regulator: pv88060: Fix array out-of-bounds access Greg Kroah-Hartman
@ 2020-01-28 14:03 ` Greg Kroah-Hartman
  2020-01-28 14:03 ` [PATCH 4.9 080/271] regulator: pv88090: " Greg Kroah-Hartman
                   ` (196 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:03 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Axel Lin, Mark Brown, Sasha Levin

From: Axel Lin <axel.lin@ingics.com>

[ Upstream commit 3c413f594c4f9df40061445667ca11a12bc8ee34 ]

Fix off-by-one while iterating current_limits array.
The valid index should be 0 ~ n_current_limits -1.

Fixes: 99cf3af5e2d5 ("regulator: pv88080: new regulator driver")
Signed-off-by: Axel Lin <axel.lin@ingics.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/regulator/pv88080-regulator.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/regulator/pv88080-regulator.c b/drivers/regulator/pv88080-regulator.c
index 954a20eeb26f8..a40ecfb772107 100644
--- a/drivers/regulator/pv88080-regulator.c
+++ b/drivers/regulator/pv88080-regulator.c
@@ -279,7 +279,7 @@ static int pv88080_set_current_limit(struct regulator_dev *rdev, int min,
 	int i;
 
 	/* search for closest to maximum */
-	for (i = info->n_current_limits; i >= 0; i--) {
+	for (i = info->n_current_limits - 1; i >= 0; i--) {
 		if (min <= info->current_limits[i]
 			&& max >= info->current_limits[i]) {
 				return regmap_update_bits(rdev->regmap,
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 080/271] regulator: pv88090: Fix array out-of-bounds access
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (78 preceding siblings ...)
  2020-01-28 14:03 ` [PATCH 4.9 079/271] regulator: pv88080: " Greg Kroah-Hartman
@ 2020-01-28 14:03 ` Greg Kroah-Hartman
  2020-01-28 14:03 ` [PATCH 4.9 081/271] net: dsa: qca8k: Enable delay for RGMII_ID mode Greg Kroah-Hartman
                   ` (195 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:03 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Axel Lin, Mark Brown, Sasha Levin

From: Axel Lin <axel.lin@ingics.com>

[ Upstream commit a5455c9159414748bed4678184bf69989a4f7ba3 ]

Fix off-by-one while iterating current_limits array.
The valid index should be 0 ~ n_current_limits -1.

Fixes: c90456e36d9c ("regulator: pv88090: new regulator driver")
Signed-off-by: Axel Lin <axel.lin@ingics.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/regulator/pv88090-regulator.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/regulator/pv88090-regulator.c b/drivers/regulator/pv88090-regulator.c
index 4216411753529..789652c9b0142 100644
--- a/drivers/regulator/pv88090-regulator.c
+++ b/drivers/regulator/pv88090-regulator.c
@@ -157,7 +157,7 @@ static int pv88090_set_current_limit(struct regulator_dev *rdev, int min,
 	int i;
 
 	/* search for closest to maximum */
-	for (i = info->n_current_limits; i >= 0; i--) {
+	for (i = info->n_current_limits - 1; i >= 0; i--) {
 		if (min <= info->current_limits[i]
 			&& max >= info->current_limits[i]) {
 			return regmap_update_bits(rdev->regmap,
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 081/271] net: dsa: qca8k: Enable delay for RGMII_ID mode
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (79 preceding siblings ...)
  2020-01-28 14:03 ` [PATCH 4.9 080/271] regulator: pv88090: " Greg Kroah-Hartman
@ 2020-01-28 14:03 ` Greg Kroah-Hartman
  2020-01-28 14:03 ` [PATCH 4.9 082/271] drm/nouveau/bios/ramcfg: fix missing parentheses when calculating RON Greg Kroah-Hartman
                   ` (194 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:03 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Michal Vokáč,
	Vinod Koul, Andrew Lunn, David S. Miller, Sasha Levin

From: Vinod Koul <vkoul@kernel.org>

[ Upstream commit a968b5e9d5879f9535d6099505f9e14abcafb623 ]

RGMII_ID specifies that we should have internal delay, so resurrect the
delay addition routine but under the RGMII_ID mode.

Fixes: 40269aa9f40a ("net: dsa: qca8k: disable delay for RGMII mode")
Tested-by: Michal Vokáč <michal.vokac@ysoft.com>
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/dsa/qca8k.c | 12 ++++++++++++
 drivers/net/dsa/qca8k.h |  1 +
 2 files changed, 13 insertions(+)

diff --git a/drivers/net/dsa/qca8k.c b/drivers/net/dsa/qca8k.c
index ebfbaf8597f40..3bbe85aae49bb 100644
--- a/drivers/net/dsa/qca8k.c
+++ b/drivers/net/dsa/qca8k.c
@@ -460,6 +460,18 @@ qca8k_set_pad_ctrl(struct qca8k_priv *priv, int port, int mode)
 		qca8k_write(priv, QCA8K_REG_PORT5_PAD_CTRL,
 			    QCA8K_PORT_PAD_RGMII_RX_DELAY_EN);
 		break;
+	case PHY_INTERFACE_MODE_RGMII_ID:
+		/* RGMII_ID needs internal delay. This is enabled through
+		 * PORT5_PAD_CTRL for all ports, rather than individual port
+		 * registers
+		 */
+		qca8k_write(priv, reg,
+			    QCA8K_PORT_PAD_RGMII_EN |
+			    QCA8K_PORT_PAD_RGMII_TX_DELAY(QCA8K_MAX_DELAY) |
+			    QCA8K_PORT_PAD_RGMII_RX_DELAY(QCA8K_MAX_DELAY));
+		qca8k_write(priv, QCA8K_REG_PORT5_PAD_CTRL,
+			    QCA8K_PORT_PAD_RGMII_RX_DELAY_EN);
+		break;
 	case PHY_INTERFACE_MODE_SGMII:
 		qca8k_write(priv, reg, QCA8K_PORT_PAD_SGMII_EN);
 		break;
diff --git a/drivers/net/dsa/qca8k.h b/drivers/net/dsa/qca8k.h
index 9c22bc3210cdf..db95168ca111d 100644
--- a/drivers/net/dsa/qca8k.h
+++ b/drivers/net/dsa/qca8k.h
@@ -40,6 +40,7 @@
 						((0x8 + (x & 0x3)) << 22)
 #define   QCA8K_PORT_PAD_RGMII_RX_DELAY(x)		\
 						((0x10 + (x & 0x3)) << 20)
+#define   QCA8K_MAX_DELAY				3
 #define   QCA8K_PORT_PAD_RGMII_RX_DELAY_EN		BIT(24)
 #define   QCA8K_PORT_PAD_SGMII_EN			BIT(7)
 #define QCA8K_REG_MODULE_EN				0x030
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 082/271] drm/nouveau/bios/ramcfg: fix missing parentheses when calculating RON
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (80 preceding siblings ...)
  2020-01-28 14:03 ` [PATCH 4.9 081/271] net: dsa: qca8k: Enable delay for RGMII_ID mode Greg Kroah-Hartman
@ 2020-01-28 14:03 ` Greg Kroah-Hartman
  2020-01-28 14:03 ` [PATCH 4.9 083/271] drm/nouveau/pmu: dont print reply values if exec is false Greg Kroah-Hartman
                   ` (193 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:03 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Colin Ian King, Ben Skeggs, Sasha Levin

From: Colin Ian King <colin.king@canonical.com>

[ Upstream commit 13649101a25c53c87f4ab98a076dfe61f3636ab1 ]

Currently, the expression for calculating RON is always going to result
in zero no matter the value of ram->mr[1] because the ! operator has
higher precedence than the shift >> operator.  I believe the missing
parentheses around the expression before appying the ! operator will
result in the desired result.

[ Note, not tested ]

Detected by CoveritScan, CID#1324005 ("Operands don't affect result")

Fixes: c25bf7b6155c ("drm/nouveau/bios/ramcfg: Separate out RON pull value")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/nouveau/nvkm/subdev/fb/gddr3.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/fb/gddr3.c b/drivers/gpu/drm/nouveau/nvkm/subdev/fb/gddr3.c
index 60ece0a8a2e1b..1d2d6bae73cd1 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/fb/gddr3.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/fb/gddr3.c
@@ -87,7 +87,7 @@ nvkm_gddr3_calc(struct nvkm_ram *ram)
 		WR  = (ram->next->bios.timing[2] & 0x007f0000) >> 16;
 		/* XXX: Get these values from the VBIOS instead */
 		DLL = !(ram->mr[1] & 0x1);
-		RON = !(ram->mr[1] & 0x300) >> 8;
+		RON = !((ram->mr[1] & 0x300) >> 8);
 		break;
 	default:
 		return -ENOSYS;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 083/271] drm/nouveau/pmu: dont print reply values if exec is false
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (81 preceding siblings ...)
  2020-01-28 14:03 ` [PATCH 4.9 082/271] drm/nouveau/bios/ramcfg: fix missing parentheses when calculating RON Greg Kroah-Hartman
@ 2020-01-28 14:03 ` Greg Kroah-Hartman
  2020-01-28 14:03 ` [PATCH 4.9 084/271] ASoC: qcom: Fix of-node refcount unbalance in apq8016_sbc_parse_of() Greg Kroah-Hartman
                   ` (192 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:03 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Colin Ian King, Ben Skeggs, Sasha Levin

From: Colin Ian King <colin.king@canonical.com>

[ Upstream commit b1d03fc36ec9834465a08c275c8d563e07f6f6bf ]

Currently the uninitialized values in the array reply are printed out
when exec is false and nvkm_pmu_send has not updated the array. Avoid
confusion by only dumping out these values if they have been actually
updated.

Detected by CoverityScan, CID#1271291 ("Uninitialized scaler variable")
Fixes: ebb58dc2ef8c ("drm/nouveau/pmu: rename from pwr (no binary change)")

Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/nouveau/nvkm/subdev/pmu/memx.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/memx.c b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/memx.c
index e6f74168238c7..2ef9e942f43a2 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/memx.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/memx.c
@@ -87,10 +87,10 @@ nvkm_memx_fini(struct nvkm_memx **pmemx, bool exec)
 	if (exec) {
 		nvkm_pmu_send(pmu, reply, PROC_MEMX, MEMX_MSG_EXEC,
 			      memx->base, finish);
+		nvkm_debug(subdev, "Exec took %uns, PMU_IN %08x\n",
+			   reply[0], reply[1]);
 	}
 
-	nvkm_debug(subdev, "Exec took %uns, PMU_IN %08x\n",
-		   reply[0], reply[1]);
 	kfree(memx);
 	return 0;
 }
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 084/271] ASoC: qcom: Fix of-node refcount unbalance in apq8016_sbc_parse_of()
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (82 preceding siblings ...)
  2020-01-28 14:03 ` [PATCH 4.9 083/271] drm/nouveau/pmu: dont print reply values if exec is false Greg Kroah-Hartman
@ 2020-01-28 14:03 ` Greg Kroah-Hartman
  2020-01-28 14:03 ` [PATCH 4.9 085/271] fs/nfs: Fix nfs_parse_devname to not modify its argument Greg Kroah-Hartman
                   ` (191 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:03 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Patrick Lai, Banajit Goswami,
	Takashi Iwai, Mark Brown, Sasha Levin

From: Takashi Iwai <tiwai@suse.de>

[ Upstream commit 8d1667200850f8753c0265fa4bd25c9a6e5f94ce ]

The apq8016 driver leaves the of-node refcount at aborting from the
loop of for_each_child_of_node() in the error path.  Not only the
iterator node of for_each_child_of_node(), the children nodes referred
from it for codec and cpu have to be properly unreferenced.

Fixes: bdb052e81f62 ("ASoC: qcom: add apq8016 sound card support")
Cc: Patrick Lai <plai@codeaurora.org>
Cc: Banajit Goswami <bgoswami@codeaurora.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/qcom/apq8016_sbc.c | 21 ++++++++++++++++-----
 1 file changed, 16 insertions(+), 5 deletions(-)

diff --git a/sound/soc/qcom/apq8016_sbc.c b/sound/soc/qcom/apq8016_sbc.c
index 07f91e918b234..754742018515a 100644
--- a/sound/soc/qcom/apq8016_sbc.c
+++ b/sound/soc/qcom/apq8016_sbc.c
@@ -114,13 +114,15 @@ static struct apq8016_sbc_data *apq8016_sbc_parse_of(struct snd_soc_card *card)
 
 		if (!cpu || !codec) {
 			dev_err(dev, "Can't find cpu/codec DT node\n");
-			return ERR_PTR(-EINVAL);
+			ret = -EINVAL;
+			goto error;
 		}
 
 		link->cpu_of_node = of_parse_phandle(cpu, "sound-dai", 0);
 		if (!link->cpu_of_node) {
 			dev_err(card->dev, "error getting cpu phandle\n");
-			return ERR_PTR(-EINVAL);
+			ret = -EINVAL;
+			goto error;
 		}
 
 		link->codec_of_node = of_parse_phandle(codec, "sound-dai", 0);
@@ -132,28 +134,37 @@ static struct apq8016_sbc_data *apq8016_sbc_parse_of(struct snd_soc_card *card)
 		ret = snd_soc_of_get_dai_name(cpu, &link->cpu_dai_name);
 		if (ret) {
 			dev_err(card->dev, "error getting cpu dai name\n");
-			return ERR_PTR(ret);
+			goto error;
 		}
 
 		ret = snd_soc_of_get_dai_name(codec, &link->codec_dai_name);
 		if (ret) {
 			dev_err(card->dev, "error getting codec dai name\n");
-			return ERR_PTR(ret);
+			goto error;
 		}
 
 		link->platform_of_node = link->cpu_of_node;
 		ret = of_property_read_string(np, "link-name", &link->name);
 		if (ret) {
 			dev_err(card->dev, "error getting codec dai_link name\n");
-			return ERR_PTR(ret);
+			goto error;
 		}
 
 		link->stream_name = link->name;
 		link->init = apq8016_sbc_dai_init;
 		link++;
+
+		of_node_put(cpu);
+		of_node_put(codec);
 	}
 
 	return data;
+
+ error:
+	of_node_put(np);
+	of_node_put(cpu);
+	of_node_put(codec);
+	return ERR_PTR(ret);
 }
 
 static const struct snd_soc_dapm_widget apq8016_sbc_dapm_widgets[] = {
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 085/271] fs/nfs: Fix nfs_parse_devname to not modify its argument
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (83 preceding siblings ...)
  2020-01-28 14:03 ` [PATCH 4.9 084/271] ASoC: qcom: Fix of-node refcount unbalance in apq8016_sbc_parse_of() Greg Kroah-Hartman
@ 2020-01-28 14:03 ` Greg Kroah-Hartman
  2020-01-28 14:03 ` [PATCH 4.9 086/271] NFS: Fix a soft lockup in the delegation recovery code Greg Kroah-Hartman
                   ` (190 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:03 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Eric W. Biederman, Trond Myklebust,
	Sasha Levin

From: Eric W. Biederman <ebiederm@xmission.com>

[ Upstream commit 40cc394be1aa18848b8757e03bd8ed23281f572e ]

In the rare and unsupported case of a hostname list nfs_parse_devname
will modify dev_name.  There is no need to modify dev_name as the all
that is being computed is the length of the hostname, so the computed
length can just be shorted.

Fixes: dc04589827f7 ("NFS: Use common device name parsing logic for NFSv4 and NFSv2/v3")
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/nfs/super.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/nfs/super.c b/fs/nfs/super.c
index 42c31587a936c..4c21e572f2d9e 100644
--- a/fs/nfs/super.c
+++ b/fs/nfs/super.c
@@ -1928,7 +1928,7 @@ static int nfs_parse_devname(const char *dev_name,
 		/* kill possible hostname list: not supported */
 		comma = strchr(dev_name, ',');
 		if (comma != NULL && comma < end)
-			*comma = 0;
+			len = comma - dev_name;
 	}
 
 	if (len > maxnamlen)
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 086/271] NFS: Fix a soft lockup in the delegation recovery code
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (84 preceding siblings ...)
  2020-01-28 14:03 ` [PATCH 4.9 085/271] fs/nfs: Fix nfs_parse_devname to not modify its argument Greg Kroah-Hartman
@ 2020-01-28 14:03 ` Greg Kroah-Hartman
  2020-01-28 14:03 ` [PATCH 4.9 087/271] clocksource/drivers/sun5i: Fail gracefully when clock rate is unavailable Greg Kroah-Hartman
                   ` (189 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:03 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Trond Myklebust, Sasha Levin

From: Trond Myklebust <trond.myklebust@hammerspace.com>

[ Upstream commit 6f9449be53f3ce383caed797708b332ede8d952c ]

Fix a soft lockup when NFS client delegation recovery is attempted
but the inode is in the process of being freed. When the
igrab(inode) call fails, and we have to restart the recovery process,
we need to ensure that we won't attempt to recover the same delegation
again.

Fixes: 45870d6909d5a ("NFSv4.1: Test delegation stateids when server...")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/nfs/delegation.c | 20 ++++++++++++--------
 fs/nfs/delegation.h |  1 +
 2 files changed, 13 insertions(+), 8 deletions(-)

diff --git a/fs/nfs/delegation.c b/fs/nfs/delegation.c
index 9a8830a0f31f9..014039618cff0 100644
--- a/fs/nfs/delegation.c
+++ b/fs/nfs/delegation.c
@@ -234,6 +234,8 @@ static struct inode *nfs_delegation_grab_inode(struct nfs_delegation *delegation
 	spin_lock(&delegation->lock);
 	if (delegation->inode != NULL)
 		inode = igrab(delegation->inode);
+	if (!inode)
+		set_bit(NFS_DELEGATION_INODE_FREEING, &delegation->flags);
 	spin_unlock(&delegation->lock);
 	return inode;
 }
@@ -867,10 +869,11 @@ restart:
 	list_for_each_entry_rcu(server, &clp->cl_superblocks, client_link) {
 		list_for_each_entry_rcu(delegation, &server->delegations,
 								super_list) {
-			if (test_bit(NFS_DELEGATION_RETURNING,
-						&delegation->flags))
-				continue;
-			if (test_bit(NFS_DELEGATION_NEED_RECLAIM,
+			if (test_bit(NFS_DELEGATION_INODE_FREEING,
+						&delegation->flags) ||
+			    test_bit(NFS_DELEGATION_RETURNING,
+						&delegation->flags) ||
+			    test_bit(NFS_DELEGATION_NEED_RECLAIM,
 						&delegation->flags) == 0)
 				continue;
 			if (!nfs_sb_active(server->super))
@@ -975,10 +978,11 @@ restart:
 	list_for_each_entry_rcu(server, &clp->cl_superblocks, client_link) {
 		list_for_each_entry_rcu(delegation, &server->delegations,
 								super_list) {
-			if (test_bit(NFS_DELEGATION_RETURNING,
-						&delegation->flags))
-				continue;
-			if (test_bit(NFS_DELEGATION_TEST_EXPIRED,
+			if (test_bit(NFS_DELEGATION_INODE_FREEING,
+						&delegation->flags) ||
+			    test_bit(NFS_DELEGATION_RETURNING,
+						&delegation->flags) ||
+			    test_bit(NFS_DELEGATION_TEST_EXPIRED,
 						&delegation->flags) == 0)
 				continue;
 			if (!nfs_sb_active(server->super))
diff --git a/fs/nfs/delegation.h b/fs/nfs/delegation.h
index 2c6cb7fb7d5ee..f72095bf9e107 100644
--- a/fs/nfs/delegation.h
+++ b/fs/nfs/delegation.h
@@ -33,6 +33,7 @@ enum {
 	NFS_DELEGATION_RETURNING,
 	NFS_DELEGATION_REVOKED,
 	NFS_DELEGATION_TEST_EXPIRED,
+	NFS_DELEGATION_INODE_FREEING,
 };
 
 int nfs_inode_set_delegation(struct inode *inode, struct rpc_cred *cred, struct nfs_openres *res);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 087/271] clocksource/drivers/sun5i: Fail gracefully when clock rate is unavailable
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (85 preceding siblings ...)
  2020-01-28 14:03 ` [PATCH 4.9 086/271] NFS: Fix a soft lockup in the delegation recovery code Greg Kroah-Hartman
@ 2020-01-28 14:03 ` Greg Kroah-Hartman
  2020-01-28 14:03 ` [PATCH 4.9 088/271] clocksource/drivers/exynos_mct: Fix error path in timer resources initialization Greg Kroah-Hartman
                   ` (188 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:03 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chen-Yu Tsai, Maxime Ripard,
	Daniel Lezcano, Sasha Levin

From: Chen-Yu Tsai <wens@csie.org>

[ Upstream commit e7e7e0d7beafebd11b0c065cd5fbc1e5759c5aab ]

If the clock tree is not fully populated when the timer-sun5i init code
is called, attempts to get the clock rate for the timer would fail and
return 0.

Make the init code for both clock events and clocksource check the
returned clock rate and fail gracefully if the result is 0, instead of
causing a divide by 0 exception later on.

Fixes: 4a59058f0b09 ("clocksource/drivers/sun5i: Refactor the current code")
Signed-off-by: Chen-Yu Tsai <wens@csie.org>
Acked-by: Maxime Ripard <maxime.ripard@bootlin.com>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clocksource/timer-sun5i.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/drivers/clocksource/timer-sun5i.c b/drivers/clocksource/timer-sun5i.c
index 4f87f3e76d832..c3e96de525a24 100644
--- a/drivers/clocksource/timer-sun5i.c
+++ b/drivers/clocksource/timer-sun5i.c
@@ -201,6 +201,11 @@ static int __init sun5i_setup_clocksource(struct device_node *node,
 	}
 
 	rate = clk_get_rate(clk);
+	if (!rate) {
+		pr_err("Couldn't get parent clock rate\n");
+		ret = -EINVAL;
+		goto err_disable_clk;
+	}
 
 	cs->timer.base = base;
 	cs->timer.clk = clk;
@@ -274,6 +279,11 @@ static int __init sun5i_setup_clockevent(struct device_node *node, void __iomem
 	}
 
 	rate = clk_get_rate(clk);
+	if (!rate) {
+		pr_err("Couldn't get parent clock rate\n");
+		ret = -EINVAL;
+		goto err_disable_clk;
+	}
 
 	ce->timer.base = base;
 	ce->timer.ticks_per_jiffy = DIV_ROUND_UP(rate, HZ);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 088/271] clocksource/drivers/exynos_mct: Fix error path in timer resources initialization
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (86 preceding siblings ...)
  2020-01-28 14:03 ` [PATCH 4.9 087/271] clocksource/drivers/sun5i: Fail gracefully when clock rate is unavailable Greg Kroah-Hartman
@ 2020-01-28 14:03 ` Greg Kroah-Hartman
  2020-01-28 14:03 ` [PATCH 4.9 089/271] mmc: sdhci-brcmstb: handle mmc_of_parse() errors during probe Greg Kroah-Hartman
                   ` (187 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:03 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Krzysztof Kozlowski,
	Marek Szyprowski, Chanwoo Choi, Daniel Lezcano, Sasha Levin

From: Marek Szyprowski <m.szyprowski@samsung.com>

[ Upstream commit b9307420196009cdf18bad55e762ac49fb9a80f4 ]

While freeing interrupt handlers in error path, don't assume that all
requested interrupts are per-processor interrupts and properly release
standard interrupts too.

Reported-by: Krzysztof Kozlowski <krzk@kernel.org>
Fixes: 56a94f13919c ("clocksource: exynos_mct: Avoid blocking calls in the cpu hotplug notifier")
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Reviewed-by: Krzysztof Kozlowski <krzk@kernel.org>
Reviewed-by: Chanwoo Choi <cw00.choi@samsung.com>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clocksource/exynos_mct.c | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/drivers/clocksource/exynos_mct.c b/drivers/clocksource/exynos_mct.c
index d32248e2ceab4..ae3cbaeffd9c5 100644
--- a/drivers/clocksource/exynos_mct.c
+++ b/drivers/clocksource/exynos_mct.c
@@ -563,7 +563,19 @@ static int __init exynos4_timer_resources(struct device_node *np, void __iomem *
 	return 0;
 
 out_irq:
-	free_percpu_irq(mct_irqs[MCT_L0_IRQ], &percpu_mct_tick);
+	if (mct_int_type == MCT_INT_PPI) {
+		free_percpu_irq(mct_irqs[MCT_L0_IRQ], &percpu_mct_tick);
+	} else {
+		for_each_possible_cpu(cpu) {
+			struct mct_clock_event_device *pcpu_mevt =
+				per_cpu_ptr(&percpu_mct_tick, cpu);
+
+			if (pcpu_mevt->evt.irq != -1) {
+				free_irq(pcpu_mevt->evt.irq, pcpu_mevt);
+				pcpu_mevt->evt.irq = -1;
+			}
+		}
+	}
 	return err;
 }
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 089/271] mmc: sdhci-brcmstb: handle mmc_of_parse() errors during probe
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (87 preceding siblings ...)
  2020-01-28 14:03 ` [PATCH 4.9 088/271] clocksource/drivers/exynos_mct: Fix error path in timer resources initialization Greg Kroah-Hartman
@ 2020-01-28 14:03 ` Greg Kroah-Hartman
  2020-01-28 14:03 ` [PATCH 4.9 090/271] ARM: 8847/1: pm: fix HYP/SVC mode mismatch when MCPM is used Greg Kroah-Hartman
                   ` (186 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:03 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Stefan Wahren, Ulf Hansson, Sasha Levin

From: Stefan Wahren <stefan.wahren@i2se.com>

[ Upstream commit 1e20186e706da8446f9435f2924cd65ab1397e73 ]

We need to handle mmc_of_parse() errors during probe otherwise the
MMC driver could start without proper initialization (e.g. power sequence).

Fixes: 476bf3d62d5c ("mmc: sdhci-brcmstb: Add driver for Broadcom BRCMSTB SoCs")
Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mmc/host/sdhci-brcmstb.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/mmc/host/sdhci-brcmstb.c b/drivers/mmc/host/sdhci-brcmstb.c
index 159f6f64c68e7..ed6473731b458 100644
--- a/drivers/mmc/host/sdhci-brcmstb.c
+++ b/drivers/mmc/host/sdhci-brcmstb.c
@@ -90,7 +90,9 @@ static int sdhci_brcmstb_probe(struct platform_device *pdev)
 	host->mmc->caps2 |= MMC_CAP2_HC_ERASE_SZ;
 
 	sdhci_get_of_property(pdev);
-	mmc_of_parse(host->mmc);
+	res = mmc_of_parse(host->mmc);
+	if (res)
+		goto err;
 
 	/*
 	 * Supply the existing CAPS, but clear the UHS modes. This
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 090/271] ARM: 8847/1: pm: fix HYP/SVC mode mismatch when MCPM is used
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (88 preceding siblings ...)
  2020-01-28 14:03 ` [PATCH 4.9 089/271] mmc: sdhci-brcmstb: handle mmc_of_parse() errors during probe Greg Kroah-Hartman
@ 2020-01-28 14:03 ` Greg Kroah-Hartman
  2020-01-28 14:04 ` [PATCH 4.9 091/271] ARM: 8848/1: virt: Align GIC version check with arm64 counterpart Greg Kroah-Hartman
                   ` (185 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:03 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Marek Szyprowski, Nicolas Pitre,
	Anand Moon, Russell King, Sasha Levin

From: Marek Szyprowski <m.szyprowski@samsung.com>

[ Upstream commit ca70ea43f80c98582f5ffbbd1e6f4da2742da0c4 ]

MCPM does a soft reset of the CPUs and uses common cpu_resume() routine to
perform low-level platform initialization. This results in a try to install
HYP stubs for the second time for each CPU and results in false HYP/SVC
mode mismatch detection. The HYP stubs are already installed at the
beginning of the kernel initialization on the boot CPU (head.S) or in the
secondary_startup() for other CPUs. To fix this issue MCPM code should use
a cpu_resume() routine without HYP stubs installation.

This change fixes HYP/SVC mode mismatch on Samsung Exynos5422-based Odroid
XU3/XU4/HC1 boards.

Fixes: 3721924c8154 ("ARM: 8081/1: MCPM: provide infrastructure to allow for MCPM loopback")
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Acked-by: Nicolas Pitre <nico@linaro.org>
Tested-by: Anand Moon <linux.amoon@gmail.com>
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/common/mcpm_entry.c   |  2 +-
 arch/arm/include/asm/suspend.h |  1 +
 arch/arm/kernel/sleep.S        | 12 ++++++++++++
 3 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/arch/arm/common/mcpm_entry.c b/arch/arm/common/mcpm_entry.c
index a923524d10407..8617323eb2735 100644
--- a/arch/arm/common/mcpm_entry.c
+++ b/arch/arm/common/mcpm_entry.c
@@ -379,7 +379,7 @@ static int __init nocache_trampoline(unsigned long _arg)
 	unsigned int cluster = MPIDR_AFFINITY_LEVEL(mpidr, 1);
 	phys_reset_t phys_reset;
 
-	mcpm_set_entry_vector(cpu, cluster, cpu_resume);
+	mcpm_set_entry_vector(cpu, cluster, cpu_resume_no_hyp);
 	setup_mm_for_reboot();
 
 	__mcpm_cpu_going_down(cpu, cluster);
diff --git a/arch/arm/include/asm/suspend.h b/arch/arm/include/asm/suspend.h
index 6c7182f32cefe..e6c2f426f8c86 100644
--- a/arch/arm/include/asm/suspend.h
+++ b/arch/arm/include/asm/suspend.h
@@ -7,6 +7,7 @@ struct sleep_save_sp {
 };
 
 extern void cpu_resume(void);
+extern void cpu_resume_no_hyp(void);
 extern void cpu_resume_arm(void);
 extern int cpu_suspend(unsigned long, int (*)(unsigned long));
 
diff --git a/arch/arm/kernel/sleep.S b/arch/arm/kernel/sleep.S
index 0f6c1000582c3..c8569390e7e7e 100644
--- a/arch/arm/kernel/sleep.S
+++ b/arch/arm/kernel/sleep.S
@@ -119,6 +119,14 @@ ENDPROC(cpu_resume_after_mmu)
 	.text
 	.align
 
+#ifdef CONFIG_MCPM
+	.arm
+THUMB(	.thumb			)
+ENTRY(cpu_resume_no_hyp)
+ARM_BE8(setend be)			@ ensure we are in BE mode
+	b	no_hyp
+#endif
+
 #ifdef CONFIG_MMU
 	.arm
 ENTRY(cpu_resume_arm)
@@ -134,6 +142,7 @@ ARM_BE8(setend be)			@ ensure we are in BE mode
 	bl	__hyp_stub_install_secondary
 #endif
 	safe_svcmode_maskall r1
+no_hyp:
 	mov	r1, #0
 	ALT_SMP(mrc p15, 0, r0, c0, c0, 5)
 	ALT_UP_B(1f)
@@ -162,6 +171,9 @@ ENDPROC(cpu_resume)
 
 #ifdef CONFIG_MMU
 ENDPROC(cpu_resume_arm)
+#endif
+#ifdef CONFIG_MCPM
+ENDPROC(cpu_resume_no_hyp)
 #endif
 
 	.align 2
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 091/271] ARM: 8848/1: virt: Align GIC version check with arm64 counterpart
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (89 preceding siblings ...)
  2020-01-28 14:03 ` [PATCH 4.9 090/271] ARM: 8847/1: pm: fix HYP/SVC mode mismatch when MCPM is used Greg Kroah-Hartman
@ 2020-01-28 14:04 ` Greg Kroah-Hartman
  2020-01-28 14:04 ` [PATCH 4.9 092/271] regulator: wm831x-dcdc: Fix list of wm831x_dcdc_ilim from mA to uA Greg Kroah-Hartman
                   ` (184 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Vladimir Murzin, Marc Zyngier,
	Russell King, Sasha Levin

From: Vladimir Murzin <vladimir.murzin@arm.com>

[ Upstream commit 9db043d36bd379f4cc99054c079de0dabfc38d03 ]

arm64 has got relaxation on GIC version check at early boot stage due
to update of the GIC architecture let's align ARM with that.

To help backports (even though the code was correct at the time of writing)
Fixes: e59941b9b381 ("ARM: 8527/1: virt: enable GICv3 system registers")
Signed-off-by: Vladimir Murzin <vladimir.murzin@arm.com>
Reviewed-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/kernel/hyp-stub.S | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm/kernel/hyp-stub.S b/arch/arm/kernel/hyp-stub.S
index 15d073ae5da2a..f5e5e3e196592 100644
--- a/arch/arm/kernel/hyp-stub.S
+++ b/arch/arm/kernel/hyp-stub.S
@@ -179,8 +179,8 @@ ARM_BE8(orr	r7, r7, #(1 << 25))     @ HSCTLR.EE
 	@ Check whether GICv3 system registers are available
 	mrc	p15, 0, r7, c0, c1, 1	@ ID_PFR1
 	ubfx	r7, r7, #28, #4
-	cmp	r7, #1
-	bne	2f
+	teq	r7, #0
+	beq	2f
 
 	@ Enable system register accesses
 	mrc	p15, 4, r7, c12, c9, 5	@ ICC_HSRE
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 092/271] regulator: wm831x-dcdc: Fix list of wm831x_dcdc_ilim from mA to uA
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (90 preceding siblings ...)
  2020-01-28 14:04 ` [PATCH 4.9 091/271] ARM: 8848/1: virt: Align GIC version check with arm64 counterpart Greg Kroah-Hartman
@ 2020-01-28 14:04 ` Greg Kroah-Hartman
  2020-01-28 14:04 ` [PATCH 4.9 093/271] nios2: ksyms: Add missing symbol exports Greg Kroah-Hartman
                   ` (183 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Axel Lin, Charles Keepax, Mark Brown,
	Sasha Levin

From: Axel Lin <axel.lin@ingics.com>

[ Upstream commit c25d47888f0fb3d836d68322d4aea2caf31a75a6 ]

The wm831x_dcdc_ilim entries needs to be uA because it is used to compare
with min_uA and max_uA.
While at it also make the array const and change to use unsigned int.

Fixes: e4ee831f949a ("regulator: Add WM831x DC-DC buck convertor support")
Signed-off-by: Axel Lin <axel.lin@ingics.com>
Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/regulator/wm831x-dcdc.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/regulator/wm831x-dcdc.c b/drivers/regulator/wm831x-dcdc.c
index 5a5bc4bb08d26..df591435d12a3 100644
--- a/drivers/regulator/wm831x-dcdc.c
+++ b/drivers/regulator/wm831x-dcdc.c
@@ -327,8 +327,8 @@ static int wm831x_buckv_get_voltage_sel(struct regulator_dev *rdev)
 }
 
 /* Current limit options */
-static u16 wm831x_dcdc_ilim[] = {
-	125, 250, 375, 500, 625, 750, 875, 1000
+static const unsigned int wm831x_dcdc_ilim[] = {
+	125000, 250000, 375000, 500000, 625000, 750000, 875000, 1000000
 };
 
 static int wm831x_buckv_set_current_limit(struct regulator_dev *rdev,
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 093/271] nios2: ksyms: Add missing symbol exports
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (91 preceding siblings ...)
  2020-01-28 14:04 ` [PATCH 4.9 092/271] regulator: wm831x-dcdc: Fix list of wm831x_dcdc_ilim from mA to uA Greg Kroah-Hartman
@ 2020-01-28 14:04 ` Greg Kroah-Hartman
  2020-01-28 14:04 ` [PATCH 4.9 094/271] scsi: megaraid_sas: reduce module load time Greg Kroah-Hartman
                   ` (182 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Guenter Roeck, Ley Foon Tan, Sasha Levin

From: Guenter Roeck <linux@roeck-us.net>

[ Upstream commit 0f8ed994575429d6042cf5d7ef70081c94091587 ]

Building nios2:allmodconfig fails as follows (each symbol is only listed
once).

ERROR: "__ashldi3" [drivers/md/dm-writecache.ko] undefined!
ERROR: "__ashrdi3" [fs/xfs/xfs.ko] undefined!
ERROR: "__ucmpdi2" [drivers/media/i2c/adv7842.ko] undefined!
ERROR: "__lshrdi3" [drivers/md/dm-zoned.ko] undefined!
ERROR: "flush_icache_range" [drivers/misc/lkdtm/lkdtm.ko] undefined!
ERROR: "empty_zero_page" [drivers/md/dm-mod.ko] undefined!

The problem is seen with gcc 7.3.0.

Export the missing symbols.

Fixes: 2fc8483fdcde ("nios2: Build infrastructure")
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Ley Foon Tan <ley.foon.tan@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/nios2/kernel/nios2_ksyms.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/arch/nios2/kernel/nios2_ksyms.c b/arch/nios2/kernel/nios2_ksyms.c
index bf2f55d10a4d8..4e704046a150c 100644
--- a/arch/nios2/kernel/nios2_ksyms.c
+++ b/arch/nios2/kernel/nios2_ksyms.c
@@ -9,12 +9,20 @@
 #include <linux/export.h>
 #include <linux/string.h>
 
+#include <asm/cacheflush.h>
+#include <asm/pgtable.h>
+
 /* string functions */
 
 EXPORT_SYMBOL(memcpy);
 EXPORT_SYMBOL(memset);
 EXPORT_SYMBOL(memmove);
 
+/* memory management */
+
+EXPORT_SYMBOL(empty_zero_page);
+EXPORT_SYMBOL(flush_icache_range);
+
 /*
  * libgcc functions - functions that are used internally by the
  * compiler...  (prototypes are not correct though, but that
@@ -31,3 +39,7 @@ DECLARE_EXPORT(__udivsi3);
 DECLARE_EXPORT(__umoddi3);
 DECLARE_EXPORT(__umodsi3);
 DECLARE_EXPORT(__muldi3);
+DECLARE_EXPORT(__ucmpdi2);
+DECLARE_EXPORT(__lshrdi3);
+DECLARE_EXPORT(__ashldi3);
+DECLARE_EXPORT(__ashrdi3);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 094/271] scsi: megaraid_sas: reduce module load time
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (92 preceding siblings ...)
  2020-01-28 14:04 ` [PATCH 4.9 093/271] nios2: ksyms: Add missing symbol exports Greg Kroah-Hartman
@ 2020-01-28 14:04 ` Greg Kroah-Hartman
  2020-01-28 14:04 ` [PATCH 4.9 095/271] drivers/rapidio/rio_cm.c: fix potential oops in riocm_ch_listen() Greg Kroah-Hartman
                   ` (181 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Steve Sistare, Sumit Saxena,
	Martin K. Petersen, Sasha Levin

From: Steve Sistare <steven.sistare@oracle.com>

[ Upstream commit 31b6a05f86e690e1818116fd23c3be915cc9d9ed ]

megaraid_sas takes 1+ seconds to load while waiting for firmware:

[2.822603] megaraid_sas 0000:03:00.0: Waiting for FW to come to ready state
[3.871003] megaraid_sas 0000:03:00.0: FW now in Ready state

This is due to the following loop in megasas_transition_to_ready(), which
waits a minimum of 1 second, even though the FW becomes ready in tens of
millisecs:

        /*
         * The cur_state should not last for more than max_wait secs
         */
        for (i = 0; i < max_wait; i++) {
                ...
                msleep(1000);
        ...
        dev_info(&instance->pdev->dev, "FW now in Ready state\n");

This is a regression, caused by a change of the msleep granularity from 1
to 1000 due to concern about waiting too long on systems with coarse
jiffies.

To fix, increase iterations and use msleep(20), which results in:

[2.670627] megaraid_sas 0000:03:00.0: Waiting for FW to come to ready state
[2.739386] megaraid_sas 0000:03:00.0: FW now in Ready state

Fixes: fb2f3e96d80f ("scsi: megaraid_sas: Fix msleep granularity")
Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
Acked-by: Sumit Saxena <sumit.saxena@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/megaraid/megaraid_sas_base.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
index c5cc002dfdd5c..10ae624dd2662 100644
--- a/drivers/scsi/megaraid/megaraid_sas_base.c
+++ b/drivers/scsi/megaraid/megaraid_sas_base.c
@@ -3694,12 +3694,12 @@ megasas_transition_to_ready(struct megasas_instance *instance, int ocr)
 		/*
 		 * The cur_state should not last for more than max_wait secs
 		 */
-		for (i = 0; i < max_wait; i++) {
+		for (i = 0; i < max_wait * 50; i++) {
 			curr_abs_state = instance->instancet->
 				read_fw_status_reg(instance->reg_set);
 
 			if (abs_state == curr_abs_state) {
-				msleep(1000);
+				msleep(20);
 			} else
 				break;
 		}
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 095/271] drivers/rapidio/rio_cm.c: fix potential oops in riocm_ch_listen()
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (93 preceding siblings ...)
  2020-01-28 14:04 ` [PATCH 4.9 094/271] scsi: megaraid_sas: reduce module load time Greg Kroah-Hartman
@ 2020-01-28 14:04 ` Greg Kroah-Hartman
  2020-01-28 14:04 ` [PATCH 4.9 096/271] xen, cpu_hotplug: Prevent an out of bounds access Greg Kroah-Hartman
                   ` (180 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Andrew Morton,
	Matt Porter, Alexandre Bounine, Linus Torvalds, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit 5ac188b12e7cbdd92dee60877d1fac913fc1d074 ]

If riocm_get_channel() fails, then we should just return -EINVAL.
Calling riocm_put_channel() will trigger a NULL dereference and
generally we should call put() if the get() didn't succeed.

Link: http://lkml.kernel.org/r/20190110130230.GB27017@kadam
Fixes: b6e8d4aa1110 ("rapidio: add RapidIO channelized messaging driver")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Matt Porter <mporter@kernel.crashing.org>
Cc: Alexandre Bounine <alexandre.bounine@idt.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/rapidio/rio_cm.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/rapidio/rio_cm.c b/drivers/rapidio/rio_cm.c
index ef989a15aefc4..b29fc258eeba4 100644
--- a/drivers/rapidio/rio_cm.c
+++ b/drivers/rapidio/rio_cm.c
@@ -1215,7 +1215,9 @@ static int riocm_ch_listen(u16 ch_id)
 	riocm_debug(CHOP, "(ch_%d)", ch_id);
 
 	ch = riocm_get_channel(ch_id);
-	if (!ch || !riocm_cmp_exch(ch, RIO_CM_CHAN_BOUND, RIO_CM_LISTEN))
+	if (!ch)
+		return -EINVAL;
+	if (!riocm_cmp_exch(ch, RIO_CM_CHAN_BOUND, RIO_CM_LISTEN))
 		ret = -EINVAL;
 	riocm_put_channel(ch);
 	return ret;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 096/271] xen, cpu_hotplug: Prevent an out of bounds access
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (94 preceding siblings ...)
  2020-01-28 14:04 ` [PATCH 4.9 095/271] drivers/rapidio/rio_cm.c: fix potential oops in riocm_ch_listen() Greg Kroah-Hartman
@ 2020-01-28 14:04 ` Greg Kroah-Hartman
  2020-01-28 14:04 ` [PATCH 4.9 097/271] net: sh_eth: fix a missing check of of_get_phy_mode Greg Kroah-Hartman
                   ` (179 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Juergen Gross, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit 201676095dda7e5b31a5e1d116d10fc22985075e ]

The "cpu" variable comes from the sscanf() so Smatch marks it as
untrusted data.  We can't pass a higher value than "nr_cpu_ids" to
cpu_possible() or it results in an out of bounds access.

Fixes: d68d82afd4c8 ("xen: implement CPU hotplugging")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/xen/cpu_hotplug.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/xen/cpu_hotplug.c b/drivers/xen/cpu_hotplug.c
index f4e59c445964d..17054d6954117 100644
--- a/drivers/xen/cpu_hotplug.c
+++ b/drivers/xen/cpu_hotplug.c
@@ -53,7 +53,7 @@ static int vcpu_online(unsigned int cpu)
 }
 static void vcpu_hotplug(unsigned int cpu)
 {
-	if (!cpu_possible(cpu))
+	if (cpu >= nr_cpu_ids || !cpu_possible(cpu))
 		return;
 
 	switch (vcpu_online(cpu)) {
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 097/271] net: sh_eth: fix a missing check of of_get_phy_mode
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (95 preceding siblings ...)
  2020-01-28 14:04 ` [PATCH 4.9 096/271] xen, cpu_hotplug: Prevent an out of bounds access Greg Kroah-Hartman
@ 2020-01-28 14:04 ` Greg Kroah-Hartman
  2020-01-28 14:04 ` [PATCH 4.9 098/271] media: ivtv: update *pos correctly in ivtv_read_pos() Greg Kroah-Hartman
                   ` (178 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Kangjie Lu, Sergei Shtylyov,
	Geert Uytterhoeven, David S. Miller, Sasha Levin

From: Kangjie Lu <kjlu@umn.edu>

[ Upstream commit 035a14e71f27eefa50087963b94cbdb3580d08bf ]

of_get_phy_mode may fail and return a negative error code;
the fix checks the return value of of_get_phy_mode and
returns NULL of it fails.

Fixes: b356e978e92f ("sh_eth: add device tree support")
Signed-off-by: Kangjie Lu <kjlu@umn.edu>
Reviewed-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/renesas/sh_eth.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
index 49300194d3f9f..6f8d4810ce979 100644
--- a/drivers/net/ethernet/renesas/sh_eth.c
+++ b/drivers/net/ethernet/renesas/sh_eth.c
@@ -2929,12 +2929,16 @@ static struct sh_eth_plat_data *sh_eth_parse_dt(struct device *dev)
 	struct device_node *np = dev->of_node;
 	struct sh_eth_plat_data *pdata;
 	const char *mac_addr;
+	int ret;
 
 	pdata = devm_kzalloc(dev, sizeof(*pdata), GFP_KERNEL);
 	if (!pdata)
 		return NULL;
 
-	pdata->phy_interface = of_get_phy_mode(np);
+	ret = of_get_phy_mode(np);
+	if (ret < 0)
+		return NULL;
+	pdata->phy_interface = ret;
 
 	mac_addr = of_get_mac_address(np);
 	if (mac_addr)
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 098/271] media: ivtv: update *pos correctly in ivtv_read_pos()
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (96 preceding siblings ...)
  2020-01-28 14:04 ` [PATCH 4.9 097/271] net: sh_eth: fix a missing check of of_get_phy_mode Greg Kroah-Hartman
@ 2020-01-28 14:04 ` Greg Kroah-Hartman
  2020-01-28 14:04 ` [PATCH 4.9 099/271] media: cx18: update *pos correctly in cx18_read_pos() Greg Kroah-Hartman
                   ` (177 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Hans Verkuil,
	Mauro Carvalho Chehab, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit f8e579f3ca0973daef263f513da5edff520a6c0d ]

We had intended to update *pos, but the current code is a no-op.

Fixes: 1a0adaf37c30 ("V4L/DVB (5345): ivtv driver for Conexant cx23416/cx23415 MPEG encoder/decoder")

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/pci/ivtv/ivtv-fileops.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/pci/ivtv/ivtv-fileops.c b/drivers/media/pci/ivtv/ivtv-fileops.c
index c9bd018e53de6..e2b19c3eaa876 100644
--- a/drivers/media/pci/ivtv/ivtv-fileops.c
+++ b/drivers/media/pci/ivtv/ivtv-fileops.c
@@ -420,7 +420,7 @@ static ssize_t ivtv_read_pos(struct ivtv_stream *s, char __user *ubuf, size_t co
 
 	IVTV_DEBUG_HI_FILE("read %zd from %s, got %zd\n", count, s->name, rc);
 	if (rc > 0)
-		pos += rc;
+		*pos += rc;
 	return rc;
 }
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 099/271] media: cx18: update *pos correctly in cx18_read_pos()
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (97 preceding siblings ...)
  2020-01-28 14:04 ` [PATCH 4.9 098/271] media: ivtv: update *pos correctly in ivtv_read_pos() Greg Kroah-Hartman
@ 2020-01-28 14:04 ` Greg Kroah-Hartman
  2020-01-28 14:04 ` [PATCH 4.9 100/271] media: wl128x: Fix an error code in fm_download_firmware() Greg Kroah-Hartman
                   ` (176 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Hans Verkuil,
	Mauro Carvalho Chehab, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit 7afb0df554292dca7568446f619965fb8153085d ]

We should be updating *pos.  The current code is a no-op.

Fixes: 1c1e45d17b66 ("V4L/DVB (7786): cx18: new driver for the Conexant CX23418 MPEG encoder chip")

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/pci/cx18/cx18-fileops.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/pci/cx18/cx18-fileops.c b/drivers/media/pci/cx18/cx18-fileops.c
index df837408efd59..0171dc5b8809e 100644
--- a/drivers/media/pci/cx18/cx18-fileops.c
+++ b/drivers/media/pci/cx18/cx18-fileops.c
@@ -490,7 +490,7 @@ static ssize_t cx18_read_pos(struct cx18_stream *s, char __user *ubuf,
 
 	CX18_DEBUG_HI_FILE("read %zd from %s, got %zd\n", count, s->name, rc);
 	if (rc > 0)
-		pos += rc;
+		*pos += rc;
 	return rc;
 }
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 100/271] media: wl128x: Fix an error code in fm_download_firmware()
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (98 preceding siblings ...)
  2020-01-28 14:04 ` [PATCH 4.9 099/271] media: cx18: update *pos correctly in cx18_read_pos() Greg Kroah-Hartman
@ 2020-01-28 14:04 ` Greg Kroah-Hartman
  2020-01-28 14:04 ` [PATCH 4.9 101/271] media: cx23885: check allocation return Greg Kroah-Hartman
                   ` (175 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Hans Verkuil,
	Mauro Carvalho Chehab, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit ef4bb63dc1f7213c08e13f6943c69cd27f69e4a3 ]

We forgot to set "ret" on this error path.

Fixes: e8454ff7b9a4 ("[media] drivers:media:radio: wl128x: FM Driver Common sources")

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/radio/wl128x/fmdrv_common.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/media/radio/wl128x/fmdrv_common.c b/drivers/media/radio/wl128x/fmdrv_common.c
index c1457cf466981..db987dda356e0 100644
--- a/drivers/media/radio/wl128x/fmdrv_common.c
+++ b/drivers/media/radio/wl128x/fmdrv_common.c
@@ -1278,8 +1278,9 @@ static int fm_download_firmware(struct fmdev *fmdev, const u8 *fw_name)
 
 		switch (action->type) {
 		case ACTION_SEND_COMMAND:	/* Send */
-			if (fmc_send_cmd(fmdev, 0, 0, action->data,
-						action->size, NULL, NULL))
+			ret = fmc_send_cmd(fmdev, 0, 0, action->data,
+					   action->size, NULL, NULL);
+			if (ret)
 				goto rel_fw;
 
 			cmd_cnt++;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 101/271] media: cx23885: check allocation return
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (99 preceding siblings ...)
  2020-01-28 14:04 ` [PATCH 4.9 100/271] media: wl128x: Fix an error code in fm_download_firmware() Greg Kroah-Hartman
@ 2020-01-28 14:04 ` Greg Kroah-Hartman
  2020-01-28 14:04 ` [PATCH 4.9 102/271] regulator: tps65086: Fix tps65086_ldoa1_ranges for selector 0xB Greg Kroah-Hartman
                   ` (174 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Nicholas Mc Guire, Sean Young,
	Mauro Carvalho Chehab, Sasha Levin

From: Nicholas Mc Guire <hofrat@osadl.org>

[ Upstream commit a3d7f22ef34ec4206b50ee121384d5c8bebd5591 ]

Checking of kmalloc() seems to have been committed - as
cx23885_dvb_register() is checking for != 0 return, returning
-ENOMEM should be fine here.  While at it address the coccicheck
suggestion to move to kmemdup rather than using kmalloc+memcpy.

Fixes: 46b21bbaa8a8 ("[media] Add support for DViCO FusionHDTV DVB-T Dual Express2")

Signed-off-by: Nicholas Mc Guire <hofrat@osadl.org>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/pci/cx23885/cx23885-dvb.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/media/pci/cx23885/cx23885-dvb.c b/drivers/media/pci/cx23885/cx23885-dvb.c
index 818f3c2fc98d8..1d86e57f4d9fd 100644
--- a/drivers/media/pci/cx23885/cx23885-dvb.c
+++ b/drivers/media/pci/cx23885/cx23885-dvb.c
@@ -1471,8 +1471,9 @@ static int dvb_register(struct cx23885_tsport *port)
 		if (fe0->dvb.frontend != NULL) {
 			struct i2c_adapter *tun_i2c;
 
-			fe0->dvb.frontend->sec_priv = kmalloc(sizeof(dib7000p_ops), GFP_KERNEL);
-			memcpy(fe0->dvb.frontend->sec_priv, &dib7000p_ops, sizeof(dib7000p_ops));
+			fe0->dvb.frontend->sec_priv = kmemdup(&dib7000p_ops, sizeof(dib7000p_ops), GFP_KERNEL);
+			if (!fe0->dvb.frontend->sec_priv)
+				return -ENOMEM;
 			tun_i2c = dib7000p_ops.get_i2c_master(fe0->dvb.frontend, DIBX000_I2C_INTERFACE_TUNER, 1);
 			if (!dvb_attach(dib0070_attach, fe0->dvb.frontend, tun_i2c, &dib7070p_dib0070_config))
 				return -ENODEV;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 102/271] regulator: tps65086: Fix tps65086_ldoa1_ranges for selector 0xB
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (100 preceding siblings ...)
  2020-01-28 14:04 ` [PATCH 4.9 101/271] media: cx23885: check allocation return Greg Kroah-Hartman
@ 2020-01-28 14:04 ` Greg Kroah-Hartman
  2020-01-28 14:04 ` [PATCH 4.9 103/271] jfs: fix bogus variable self-initialization Greg Kroah-Hartman
                   ` (173 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Axel Lin, Andrew F. Davis,
	Mark Brown, Sasha Levin

From: Axel Lin <axel.lin@ingics.com>

[ Upstream commit e69b394703e032e56a140172440ec4f9890b536d ]

selector 0xB (1011) should be 2.6V rather than 2.7V, fit ix.

Table 5-4. LDOA1 Output Voltage Options
VID Bits VOUT VID Bits VOUT VID Bits VOUT VID Bits VOUT
0000     1.35 0100     1.8  1000     2.3  1100     2.85
0001     1.5  0101     1.9  1001     2.4  1101     3.0
0010     1.6  0110     2.0  1010     2.5  1110     3.3
0011     1.7  0111     2.1  1011     2.6  1111     Not Used

Fixes: d2a2e729a666 ("regulator: tps65086: Add regulator driver for the TPS65086 PMIC")
Signed-off-by: Axel Lin <axel.lin@ingics.com>
Acked-by: Andrew F. Davis <afd@ti.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/regulator/tps65086-regulator.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/regulator/tps65086-regulator.c b/drivers/regulator/tps65086-regulator.c
index 6dbf3cf3951e2..12d26261394f1 100644
--- a/drivers/regulator/tps65086-regulator.c
+++ b/drivers/regulator/tps65086-regulator.c
@@ -89,8 +89,8 @@ static const struct regulator_linear_range tps65086_buck345_25mv_ranges[] = {
 static const struct regulator_linear_range tps65086_ldoa1_ranges[] = {
 	REGULATOR_LINEAR_RANGE(1350000, 0x0, 0x0, 0),
 	REGULATOR_LINEAR_RANGE(1500000, 0x1, 0x7, 100000),
-	REGULATOR_LINEAR_RANGE(2300000, 0x8, 0xA, 100000),
-	REGULATOR_LINEAR_RANGE(2700000, 0xB, 0xD, 150000),
+	REGULATOR_LINEAR_RANGE(2300000, 0x8, 0xB, 100000),
+	REGULATOR_LINEAR_RANGE(2850000, 0xC, 0xD, 150000),
 	REGULATOR_LINEAR_RANGE(3300000, 0xE, 0xE, 0),
 };
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 103/271] jfs: fix bogus variable self-initialization
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (101 preceding siblings ...)
  2020-01-28 14:04 ` [PATCH 4.9 102/271] regulator: tps65086: Fix tps65086_ldoa1_ranges for selector 0xB Greg Kroah-Hartman
@ 2020-01-28 14:04 ` Greg Kroah-Hartman
  2020-01-28 14:04 ` [PATCH 4.9 104/271] tipc: tipc clang warning Greg Kroah-Hartman
                   ` (172 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Arnd Bergmann, Dave Kleikamp, Sasha Levin

From: Arnd Bergmann <arnd@arndb.de>

[ Upstream commit a5fdd713d256887b5f012608701149fa939e5645 ]

A statement was originally added in 2006 to shut up a gcc warning,
now but now clang warns about it:

fs/jfs/jfs_txnmgr.c:1932:15: error: variable 'pxd' is uninitialized when used within its own initialization
      [-Werror,-Wuninitialized]
                pxd_t pxd = pxd;        /* truncated extent of xad */
                      ~~~   ^~~

Modern versions of gcc are fine without the silly assignment, so just
drop it. Tested with gcc-4.6 (released 2011), 4.7, 4.8, and 4.9.

Fixes: c9e3ad6021e5 ("JFS: Get rid of "may be used uninitialized" warnings")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/jfs/jfs_txnmgr.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/fs/jfs/jfs_txnmgr.c b/fs/jfs/jfs_txnmgr.c
index 4d973524c8879..224ef034004b7 100644
--- a/fs/jfs/jfs_txnmgr.c
+++ b/fs/jfs/jfs_txnmgr.c
@@ -1928,8 +1928,7 @@ static void xtLog(struct jfs_log * log, struct tblock * tblk, struct lrd * lrd,
 	 * header ?
 	 */
 	if (tlck->type & tlckTRUNCATE) {
-		/* This odd declaration suppresses a bogus gcc warning */
-		pxd_t pxd = pxd;	/* truncated extent of xad */
+		pxd_t pxd;	/* truncated extent of xad */
 		int twm;
 
 		/*
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 104/271] tipc: tipc clang warning
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (102 preceding siblings ...)
  2020-01-28 14:04 ` [PATCH 4.9 103/271] jfs: fix bogus variable self-initialization Greg Kroah-Hartman
@ 2020-01-28 14:04 ` Greg Kroah-Hartman
  2020-01-28 14:04 ` [PATCH 4.9 105/271] m68k: mac: Fix VIA timer counter accesses Greg Kroah-Hartman
                   ` (171 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Nathan Chancellor, Jon Maloy,
	David S. Miller, Sasha Levin

From: Jon Maloy <jon.maloy@ericsson.com>

[ Upstream commit 737889efe9713a0f20a75fd0de952841d9275e6b ]

When checking the code with clang -Wsometimes-uninitialized we get the
following warning:

if (!tipc_link_is_establishing(l)) {
    ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
net/tipc/node.c:847:46: note: uninitialized use occurs here
      tipc_bearer_xmit(n->net, bearer_id, &xmitq, maddr);

net/tipc/node.c:831:2: note: remove the 'if' if its condition is always
true
if (!tipc_link_is_establishing(l)) {
    ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
net/tipc/node.c:821:31: note: initialize the variable 'maddr' to silence
this warning
struct tipc_media_addr *maddr;

We fix this by initializing 'maddr' to NULL. For the matter of clarity,
we also test if 'xmitq' is non-empty before we use it and 'maddr'
further down in the  function. It will never happen that 'xmitq' is non-
empty at the same time as 'maddr' is NULL, so this is a sufficient test.

Fixes: 598411d70f85 ("tipc: make resetting of links non-atomic")
Reported-by: Nathan Chancellor <natechancellor@gmail.com>
Signed-off-by: Jon Maloy <jon.maloy@ericsson.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/tipc/node.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/net/tipc/node.c b/net/tipc/node.c
index db8fbc076e1a5..fe7b0ad1d6f32 100644
--- a/net/tipc/node.c
+++ b/net/tipc/node.c
@@ -688,10 +688,10 @@ static void __tipc_node_link_down(struct tipc_node *n, int *bearer_id,
 static void tipc_node_link_down(struct tipc_node *n, int bearer_id, bool delete)
 {
 	struct tipc_link_entry *le = &n->links[bearer_id];
+	struct tipc_media_addr *maddr = NULL;
 	struct tipc_link *l = le->link;
-	struct tipc_media_addr *maddr;
-	struct sk_buff_head xmitq;
 	int old_bearer_id = bearer_id;
+	struct sk_buff_head xmitq;
 
 	if (!l)
 		return;
@@ -713,7 +713,8 @@ static void tipc_node_link_down(struct tipc_node *n, int bearer_id, bool delete)
 	tipc_node_write_unlock(n);
 	if (delete)
 		tipc_mon_remove_peer(n->net, n->addr, old_bearer_id);
-	tipc_bearer_xmit(n->net, bearer_id, &xmitq, maddr);
+	if (!skb_queue_empty(&xmitq))
+		tipc_bearer_xmit(n->net, bearer_id, &xmitq, maddr);
 	tipc_sk_rcv(n->net, &le->inputq);
 }
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 105/271] m68k: mac: Fix VIA timer counter accesses
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (103 preceding siblings ...)
  2020-01-28 14:04 ` [PATCH 4.9 104/271] tipc: tipc clang warning Greg Kroah-Hartman
@ 2020-01-28 14:04 ` Greg Kroah-Hartman
  2020-01-28 14:04 ` [PATCH 4.9 106/271] ARM: OMAP2+: Fix potentially uninitialized return value for _setup_reset() Greg Kroah-Hartman
                   ` (170 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Finn Thain, Geert Uytterhoeven, Sasha Levin

From: Finn Thain <fthain@telegraphics.com.au>

[ Upstream commit 0ca7ce7db771580433bf24454f7a1542bd326078 ]

This resolves some bugs that affect VIA timer counter accesses.
Avoid lost interrupts caused by reading the counter low byte register.
Make allowance for the fact that the counter will be decremented to
0xFFFF before being reloaded.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/m68k/mac/via.c | 102 +++++++++++++++++++++++---------------------
 1 file changed, 53 insertions(+), 49 deletions(-)

diff --git a/arch/m68k/mac/via.c b/arch/m68k/mac/via.c
index 920ff63d4a81d..c27bf9a906be4 100644
--- a/arch/m68k/mac/via.c
+++ b/arch/m68k/mac/via.c
@@ -53,16 +53,6 @@ static __u8 rbv_clear;
 
 static int gIER,gIFR,gBufA,gBufB;
 
-/*
- * Timer defs.
- */
-
-#define TICK_SIZE		10000
-#define MAC_CLOCK_TICK		(783300/HZ)		/* ticks per HZ */
-#define MAC_CLOCK_LOW		(MAC_CLOCK_TICK&0xFF)
-#define MAC_CLOCK_HIGH		(MAC_CLOCK_TICK>>8)
-
-
 /*
  * On Macs with a genuine VIA chip there is no way to mask an individual slot
  * interrupt. This limitation also seems to apply to VIA clone logic cores in
@@ -277,22 +267,6 @@ void __init via_init(void)
 	}
 }
 
-/*
- * Start the 100 Hz clock
- */
-
-void __init via_init_clock(irq_handler_t func)
-{
-	via1[vACR] |= 0x40;
-	via1[vT1LL] = MAC_CLOCK_LOW;
-	via1[vT1LH] = MAC_CLOCK_HIGH;
-	via1[vT1CL] = MAC_CLOCK_LOW;
-	via1[vT1CH] = MAC_CLOCK_HIGH;
-
-	if (request_irq(IRQ_MAC_TIMER_1, func, 0, "timer", func))
-		pr_err("Couldn't register %s interrupt\n", "timer");
-}
-
 /*
  * Debugging dump, used in various places to see what's going on.
  */
@@ -320,29 +294,6 @@ void via_debug_dump(void)
 	}
 }
 
-/*
- * This is always executed with interrupts disabled.
- *
- * TBI: get time offset between scheduling timer ticks
- */
-
-u32 mac_gettimeoffset(void)
-{
-	unsigned long ticks, offset = 0;
-
-	/* read VIA1 timer 2 current value */
-	ticks = via1[vT1CL] | (via1[vT1CH] << 8);
-	/* The probability of underflow is less than 2% */
-	if (ticks > MAC_CLOCK_TICK - MAC_CLOCK_TICK / 50)
-		/* Check for pending timer interrupt in VIA1 IFR */
-		if (via1[vIFR] & 0x40) offset = TICK_SIZE;
-
-	ticks = MAC_CLOCK_TICK - ticks;
-	ticks = ticks * 10000L / MAC_CLOCK_TICK;
-
-	return (ticks + offset) * 1000;
-}
-
 /*
  * Flush the L2 cache on Macs that have it by flipping
  * the system into 24-bit mode for an instant.
@@ -619,3 +570,56 @@ int via2_scsi_drq_pending(void)
 	return via2[gIFR] & (1 << IRQ_IDX(IRQ_MAC_SCSIDRQ));
 }
 EXPORT_SYMBOL(via2_scsi_drq_pending);
+
+/* timer and clock source */
+
+#define VIA_CLOCK_FREQ     783360                /* VIA "phase 2" clock in Hz */
+#define VIA_TIMER_INTERVAL (1000000 / HZ)        /* microseconds per jiffy */
+#define VIA_TIMER_CYCLES   (VIA_CLOCK_FREQ / HZ) /* clock cycles per jiffy */
+
+#define VIA_TC             (VIA_TIMER_CYCLES - 2) /* including 0 and -1 */
+#define VIA_TC_LOW         (VIA_TC & 0xFF)
+#define VIA_TC_HIGH        (VIA_TC >> 8)
+
+void __init via_init_clock(irq_handler_t timer_routine)
+{
+	if (request_irq(IRQ_MAC_TIMER_1, timer_routine, 0, "timer", NULL)) {
+		pr_err("Couldn't register %s interrupt\n", "timer");
+		return;
+	}
+
+	via1[vT1LL] = VIA_TC_LOW;
+	via1[vT1LH] = VIA_TC_HIGH;
+	via1[vT1CL] = VIA_TC_LOW;
+	via1[vT1CH] = VIA_TC_HIGH;
+	via1[vACR] |= 0x40;
+}
+
+u32 mac_gettimeoffset(void)
+{
+	unsigned long flags;
+	u8 count_high;
+	u16 count, offset = 0;
+
+	/*
+	 * Timer counter wrap-around is detected with the timer interrupt flag
+	 * but reading the counter low byte (vT1CL) would reset the flag.
+	 * Also, accessing both counter registers is essentially a data race.
+	 * These problems are avoided by ignoring the low byte. Clock accuracy
+	 * is 256 times worse (error can reach 0.327 ms) but CPU overhead is
+	 * reduced by avoiding slow VIA register accesses.
+	 */
+
+	local_irq_save(flags);
+	count_high = via1[vT1CH];
+	if (count_high == 0xFF)
+		count_high = 0;
+	if (count_high > 0 && (via1[vIFR] & VIA_TIMER_1_INT))
+		offset = VIA_TIMER_CYCLES;
+	local_irq_restore(flags);
+
+	count = count_high << 8;
+	count = VIA_TIMER_CYCLES - count + offset;
+
+	return ((count * VIA_TIMER_INTERVAL) / VIA_TIMER_CYCLES) * 1000;
+}
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 106/271] ARM: OMAP2+: Fix potentially uninitialized return value for _setup_reset()
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (104 preceding siblings ...)
  2020-01-28 14:04 ` [PATCH 4.9 105/271] m68k: mac: Fix VIA timer counter accesses Greg Kroah-Hartman
@ 2020-01-28 14:04 ` Greg Kroah-Hartman
  2020-01-28 14:04 ` [PATCH 4.9 107/271] media: davinci-isif: avoid uninitialized variable use Greg Kroah-Hartman
                   ` (169 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Paul Walmsley, Tero Kristo,
	Tony Lindgren, Sasha Levin

From: Tony Lindgren <tony@atomide.com>

[ Upstream commit 7f0d078667a494466991aa7133f49594f32ff6a2 ]

Commit 747834ab8347 ("ARM: OMAP2+: hwmod: revise hardreset behavior") made
the call to _enable() conditional based on no oh->rst_lines_cnt. This
caused the return value to be potentially uninitialized. Curiously we see
no compiler warnings for this, probably as this gets inlined.

We call _setup_reset() from _setup() and only _setup_postsetup() if the
return value is zero. Currently the return value can be uninitialized for
cases where oh->rst_lines_cnt is set and HWMOD_INIT_NO_RESET is not set.

Fixes: 747834ab8347 ("ARM: OMAP2+: hwmod: revise hardreset behavior")
Cc: Paul Walmsley <paul@pwsan.com>
Cc: Tero Kristo <t-kristo@ti.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/mach-omap2/omap_hwmod.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/mach-omap2/omap_hwmod.c b/arch/arm/mach-omap2/omap_hwmod.c
index bfc74954540ce..9421b78f869d3 100644
--- a/arch/arm/mach-omap2/omap_hwmod.c
+++ b/arch/arm/mach-omap2/omap_hwmod.c
@@ -2588,7 +2588,7 @@ static void _setup_iclk_autoidle(struct omap_hwmod *oh)
  */
 static int _setup_reset(struct omap_hwmod *oh)
 {
-	int r;
+	int r = 0;
 
 	if (oh->_state != _HWMOD_STATE_INITIALIZED)
 		return -EINVAL;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 107/271] media: davinci-isif: avoid uninitialized variable use
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (105 preceding siblings ...)
  2020-01-28 14:04 ` [PATCH 4.9 106/271] ARM: OMAP2+: Fix potentially uninitialized return value for _setup_reset() Greg Kroah-Hartman
@ 2020-01-28 14:04 ` Greg Kroah-Hartman
  2020-01-28 14:04 ` [PATCH 4.9 108/271] media: tw5864: Fix possible NULL pointer dereference in tw5864_handle_frame Greg Kroah-Hartman
                   ` (168 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Arnd Bergmann, Nathan Chancellor,
	Lad, Prabhakar, Hans Verkuil, Mauro Carvalho Chehab, Sasha Levin

From: Arnd Bergmann <arnd@arndb.de>

[ Upstream commit 0e633f97162c1c74c68e2eb20bbd9259dce87cd9 ]

clang warns about a possible variable use that gcc never
complained about:

drivers/media/platform/davinci/isif.c:982:32: error: variable 'frame_size' is uninitialized when used here
      [-Werror,-Wuninitialized]
                dm365_vpss_set_pg_frame_size(frame_size);
                                             ^~~~~~~~~~
drivers/media/platform/davinci/isif.c:887:2: note: variable 'frame_size' is declared here
        struct vpss_pg_frame_size frame_size;
        ^
1 error generated.

There is no initialization for this variable at all, and there
has never been one in the mainline kernel, so we really should
not put that stack data into an mmio register.

On the other hand, I suspect that gcc checks the condition
more closely and notices that the global
isif_cfg.bayer.config_params.test_pat_gen flag is initialized
to zero and never written to from any code path, so anything
depending on it can be eliminated.

To shut up the clang warning, just remove the dead code manually,
it has probably never been used because any attempt to do so
would have resulted in undefined behavior.

Fixes: 63e3ab142fa3 ("V4L/DVB: V4L - vpfe capture - source for ISIF driver on DM365")

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Nathan Chancellor <natechancellor@gmail.com>
Acked-by: Lad, Prabhakar <prabhakar.csengg@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/davinci/isif.c | 9 ---------
 1 file changed, 9 deletions(-)

diff --git a/drivers/media/platform/davinci/isif.c b/drivers/media/platform/davinci/isif.c
index 78e37cf3470f2..b51b875c5a612 100644
--- a/drivers/media/platform/davinci/isif.c
+++ b/drivers/media/platform/davinci/isif.c
@@ -890,9 +890,7 @@ static int isif_set_hw_if_params(struct vpfe_hw_if_param *params)
 static int isif_config_ycbcr(void)
 {
 	struct isif_ycbcr_config *params = &isif_cfg.ycbcr;
-	struct vpss_pg_frame_size frame_size;
 	u32 modeset = 0, ccdcfg = 0;
-	struct vpss_sync_pol sync;
 
 	dev_dbg(isif_cfg.dev, "\nStarting isif_config_ycbcr...");
 
@@ -980,13 +978,6 @@ static int isif_config_ycbcr(void)
 		/* two fields are interleaved in memory */
 		regw(0x00000249, SDOFST);
 
-	/* Setup test pattern if enabled */
-	if (isif_cfg.bayer.config_params.test_pat_gen) {
-		sync.ccdpg_hdpol = params->hd_pol;
-		sync.ccdpg_vdpol = params->vd_pol;
-		dm365_vpss_set_sync_pol(sync);
-		dm365_vpss_set_pg_frame_size(frame_size);
-	}
 	return 0;
 }
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 108/271] media: tw5864: Fix possible NULL pointer dereference in tw5864_handle_frame
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (106 preceding siblings ...)
  2020-01-28 14:04 ` [PATCH 4.9 107/271] media: davinci-isif: avoid uninitialized variable use Greg Kroah-Hartman
@ 2020-01-28 14:04 ` Greg Kroah-Hartman
  2020-01-28 14:04 ` [PATCH 4.9 109/271] spi: tegra114: clear packed bit for unpacked mode Greg Kroah-Hartman
                   ` (167 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, YueHaibing, Hans Verkuil,
	Mauro Carvalho Chehab, Sasha Levin

From: YueHaibing <yuehaibing@huawei.com>

[ Upstream commit 2e7682ebfc750177a4944eeb56e97a3f05734528 ]

'vb' null check should be done before dereferencing it in
tw5864_handle_frame, otherwise a NULL pointer dereference
may occur.

Fixes: 34d1324edd31 ("[media] pci: Add tw5864 driver")

Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/pci/tw5864/tw5864-video.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/media/pci/tw5864/tw5864-video.c b/drivers/media/pci/tw5864/tw5864-video.c
index 1ddf80f85c248..27ff6e0d98453 100644
--- a/drivers/media/pci/tw5864/tw5864-video.c
+++ b/drivers/media/pci/tw5864/tw5864-video.c
@@ -1386,13 +1386,13 @@ static void tw5864_handle_frame(struct tw5864_h264_frame *frame)
 	input->vb = NULL;
 	spin_unlock_irqrestore(&input->slock, flags);
 
-	v4l2_buf = to_vb2_v4l2_buffer(&vb->vb.vb2_buf);
-
 	if (!vb) { /* Gone because of disabling */
 		dev_dbg(&dev->pci->dev, "vb is empty, dropping frame\n");
 		return;
 	}
 
+	v4l2_buf = to_vb2_v4l2_buffer(&vb->vb.vb2_buf);
+
 	/*
 	 * Check for space.
 	 * Mind the overhead of startcode emulation prevention.
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 109/271] spi: tegra114: clear packed bit for unpacked mode
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (107 preceding siblings ...)
  2020-01-28 14:04 ` [PATCH 4.9 108/271] media: tw5864: Fix possible NULL pointer dereference in tw5864_handle_frame Greg Kroah-Hartman
@ 2020-01-28 14:04 ` Greg Kroah-Hartman
  2020-01-28 14:04 ` [PATCH 4.9 110/271] spi: tegra114: fix for unpacked mode transfers Greg Kroah-Hartman
                   ` (166 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sowjanya Komatineni, Mark Brown, Sasha Levin

From: Sowjanya Komatineni <skomatineni@nvidia.com>

[ Upstream commit 7b3d10cdf54b8bc1dc0da21faed9789ac4da3684 ]

Fixes: Clear packed bit when not using packed mode.

Packed bit is not cleared when not using packed mode. This results
in transfer timeouts for the unpacked mode transfers followed by the
packed mode transfers.

Signed-off-by: Sowjanya Komatineni <skomatineni@nvidia.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-tegra114.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/spi/spi-tegra114.c b/drivers/spi/spi-tegra114.c
index 705f515863d4f..d98c502a9c478 100644
--- a/drivers/spi/spi-tegra114.c
+++ b/drivers/spi/spi-tegra114.c
@@ -730,6 +730,8 @@ static int tegra_spi_start_transfer_one(struct spi_device *spi,
 
 	if (tspi->is_packed)
 		command1 |= SPI_PACKED;
+	else
+		command1 &= ~SPI_PACKED;
 
 	command1 &= ~(SPI_CS_SEL_MASK | SPI_TX_EN | SPI_RX_EN);
 	tspi->cur_direction = 0;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 110/271] spi: tegra114: fix for unpacked mode transfers
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (108 preceding siblings ...)
  2020-01-28 14:04 ` [PATCH 4.9 109/271] spi: tegra114: clear packed bit for unpacked mode Greg Kroah-Hartman
@ 2020-01-28 14:04 ` Greg Kroah-Hartman
  2020-01-28 14:04 ` [PATCH 4.9 111/271] soc/fsl/qe: Fix an error code in qe_pin_request() Greg Kroah-Hartman
                   ` (165 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sowjanya Komatineni, Mark Brown, Sasha Levin

From: Sowjanya Komatineni <skomatineni@nvidia.com>

[ Upstream commit 1a89ac5b91895127f7c586ec5075c3753ca25501 ]

Fixes: computation of actual bytes to fill/receive in/from FIFO in unpacked
mode when transfer length is not a multiple of requested bits per word.

unpacked mode transfers fails when the transfer includes partial bytes in
the last word.

Total words to be written/read to/from FIFO is computed based on transfer
length and bits per word. Unpacked mode includes 0 padding bytes for partial
words to align with bits per word and these extra bytes are also accounted
for calculating bytes left to transfer in the current driver.

This causes extra bytes access of tx/rx buffers along with buffer index
position crossing actual length where remain_len becomes negative and due to
unsigned type, negative value is a 32 bit representation of signed value
and transferred bytes never meets the actual transfer length resulting in
transfer timeout and a hang.

This patch fixes this with proper computation of the actual bytes to fill in
FIFO during transmit and the actual bytes to read from FIFO during receive
ignoring 0 padded bytes.

Signed-off-by: Sowjanya Komatineni <skomatineni@nvidia.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-tegra114.c | 43 +++++++++++++++++++++++++++++++-------
 1 file changed, 36 insertions(+), 7 deletions(-)

diff --git a/drivers/spi/spi-tegra114.c b/drivers/spi/spi-tegra114.c
index d98c502a9c478..e37712bed0b2d 100644
--- a/drivers/spi/spi-tegra114.c
+++ b/drivers/spi/spi-tegra114.c
@@ -307,10 +307,16 @@ static unsigned tegra_spi_fill_tx_fifo_from_client_txbuf(
 				x |= (u32)(*tx_buf++) << (i * 8);
 			tegra_spi_writel(tspi, x, SPI_TX_FIFO);
 		}
+
+		tspi->cur_tx_pos += written_words * tspi->bytes_per_word;
 	} else {
+		unsigned int write_bytes;
 		max_n_32bit = min(tspi->curr_dma_words,  tx_empty_count);
 		written_words = max_n_32bit;
 		nbytes = written_words * tspi->bytes_per_word;
+		if (nbytes > t->len - tspi->cur_pos)
+			nbytes = t->len - tspi->cur_pos;
+		write_bytes = nbytes;
 		for (count = 0; count < max_n_32bit; count++) {
 			u32 x = 0;
 
@@ -319,8 +325,10 @@ static unsigned tegra_spi_fill_tx_fifo_from_client_txbuf(
 				x |= (u32)(*tx_buf++) << (i * 8);
 			tegra_spi_writel(tspi, x, SPI_TX_FIFO);
 		}
+
+		tspi->cur_tx_pos += write_bytes;
 	}
-	tspi->cur_tx_pos += written_words * tspi->bytes_per_word;
+
 	return written_words;
 }
 
@@ -344,20 +352,27 @@ static unsigned int tegra_spi_read_rx_fifo_to_client_rxbuf(
 			for (i = 0; len && (i < 4); i++, len--)
 				*rx_buf++ = (x >> i*8) & 0xFF;
 		}
-		tspi->cur_rx_pos += tspi->curr_dma_words * tspi->bytes_per_word;
 		read_words += tspi->curr_dma_words;
+		tspi->cur_rx_pos += tspi->curr_dma_words * tspi->bytes_per_word;
 	} else {
 		u32 rx_mask = ((u32)1 << t->bits_per_word) - 1;
+		u8 bytes_per_word = tspi->bytes_per_word;
+		unsigned int read_bytes;
 
+		len = rx_full_count * bytes_per_word;
+		if (len > t->len - tspi->cur_pos)
+			len = t->len - tspi->cur_pos;
+		read_bytes = len;
 		for (count = 0; count < rx_full_count; count++) {
 			u32 x = tegra_spi_readl(tspi, SPI_RX_FIFO) & rx_mask;
 
-			for (i = 0; (i < tspi->bytes_per_word); i++)
+			for (i = 0; len && (i < bytes_per_word); i++, len--)
 				*rx_buf++ = (x >> (i*8)) & 0xFF;
 		}
-		tspi->cur_rx_pos += rx_full_count * tspi->bytes_per_word;
 		read_words += rx_full_count;
+		tspi->cur_rx_pos += read_bytes;
 	}
+
 	return read_words;
 }
 
@@ -372,12 +387,17 @@ static void tegra_spi_copy_client_txbuf_to_spi_txbuf(
 		unsigned len = tspi->curr_dma_words * tspi->bytes_per_word;
 
 		memcpy(tspi->tx_dma_buf, t->tx_buf + tspi->cur_pos, len);
+		tspi->cur_tx_pos += tspi->curr_dma_words * tspi->bytes_per_word;
 	} else {
 		unsigned int i;
 		unsigned int count;
 		u8 *tx_buf = (u8 *)t->tx_buf + tspi->cur_tx_pos;
 		unsigned consume = tspi->curr_dma_words * tspi->bytes_per_word;
+		unsigned int write_bytes;
 
+		if (consume > t->len - tspi->cur_pos)
+			consume = t->len - tspi->cur_pos;
+		write_bytes = consume;
 		for (count = 0; count < tspi->curr_dma_words; count++) {
 			u32 x = 0;
 
@@ -386,8 +406,9 @@ static void tegra_spi_copy_client_txbuf_to_spi_txbuf(
 				x |= (u32)(*tx_buf++) << (i * 8);
 			tspi->tx_dma_buf[count] = x;
 		}
+
+		tspi->cur_tx_pos += write_bytes;
 	}
-	tspi->cur_tx_pos += tspi->curr_dma_words * tspi->bytes_per_word;
 
 	/* Make the dma buffer to read by dma */
 	dma_sync_single_for_device(tspi->dev, tspi->tx_dma_phys,
@@ -405,20 +426,28 @@ static void tegra_spi_copy_spi_rxbuf_to_client_rxbuf(
 		unsigned len = tspi->curr_dma_words * tspi->bytes_per_word;
 
 		memcpy(t->rx_buf + tspi->cur_rx_pos, tspi->rx_dma_buf, len);
+		tspi->cur_rx_pos += tspi->curr_dma_words * tspi->bytes_per_word;
 	} else {
 		unsigned int i;
 		unsigned int count;
 		unsigned char *rx_buf = t->rx_buf + tspi->cur_rx_pos;
 		u32 rx_mask = ((u32)1 << t->bits_per_word) - 1;
+		unsigned consume = tspi->curr_dma_words * tspi->bytes_per_word;
+		unsigned int read_bytes;
 
+		if (consume > t->len - tspi->cur_pos)
+			consume = t->len - tspi->cur_pos;
+		read_bytes = consume;
 		for (count = 0; count < tspi->curr_dma_words; count++) {
 			u32 x = tspi->rx_dma_buf[count] & rx_mask;
 
-			for (i = 0; (i < tspi->bytes_per_word); i++)
+			for (i = 0; consume && (i < tspi->bytes_per_word);
+							i++, consume--)
 				*rx_buf++ = (x >> (i*8)) & 0xFF;
 		}
+
+		tspi->cur_rx_pos += read_bytes;
 	}
-	tspi->cur_rx_pos += tspi->curr_dma_words * tspi->bytes_per_word;
 
 	/* Make the dma buffer to read by dma */
 	dma_sync_single_for_device(tspi->dev, tspi->rx_dma_phys,
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 111/271] soc/fsl/qe: Fix an error code in qe_pin_request()
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (109 preceding siblings ...)
  2020-01-28 14:04 ` [PATCH 4.9 110/271] spi: tegra114: fix for unpacked mode transfers Greg Kroah-Hartman
@ 2020-01-28 14:04 ` Greg Kroah-Hartman
  2020-01-28 14:04 ` [PATCH 4.9 112/271] spi: bcm2835aux: fix driver to not allow 65535 (=-1) cs-gpios Greg Kroah-Hartman
                   ` (164 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Li Yang, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit 5674a92ca4b7e5a6a19231edd10298d30324cd27 ]

We forgot to set "err" on this error path.

Fixes: 1a2d397a6eb5 ("gpio/powerpc: Eliminate duplication of of_get_named_gpio_flags()")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Li Yang <leoyang.li@nxp.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/soc/fsl/qe/gpio.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/soc/fsl/qe/gpio.c b/drivers/soc/fsl/qe/gpio.c
index 0aaf429f31d57..b5a7107a9c0a9 100644
--- a/drivers/soc/fsl/qe/gpio.c
+++ b/drivers/soc/fsl/qe/gpio.c
@@ -152,8 +152,10 @@ struct qe_pin *qe_pin_request(struct device_node *np, int index)
 	if (err < 0)
 		goto err0;
 	gc = gpio_to_chip(err);
-	if (WARN_ON(!gc))
+	if (WARN_ON(!gc)) {
+		err = -ENODEV;
 		goto err0;
+	}
 
 	if (!of_device_is_compatible(gc->of_node, "fsl,mpc8323-qe-pario-bank")) {
 		pr_debug("%s: tried to get a non-qe pin\n", __func__);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 112/271] spi: bcm2835aux: fix driver to not allow 65535 (=-1) cs-gpios
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (110 preceding siblings ...)
  2020-01-28 14:04 ` [PATCH 4.9 111/271] soc/fsl/qe: Fix an error code in qe_pin_request() Greg Kroah-Hartman
@ 2020-01-28 14:04 ` Greg Kroah-Hartman
  2020-01-28 14:04 ` [PATCH 4.9 113/271] ehea: Fix a copy-paste err in ehea_init_port_res Greg Kroah-Hartman
                   ` (163 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Martin Sperl, Stefan Wahren,
	Mark Brown, Sasha Levin

From: Martin Sperl <kernel@martin.sperl.org>

[ Upstream commit 509c583620e9053e43d611bf1614fc3d3abafa96 ]

The original driver by default defines num_chipselects as -1.
This actually allicates an array of 65535 entries in
of_spi_register_master.

There is a side-effect for buggy device trees that (contrary to
dt-binding documentation) have no cs-gpio defined.

This mode was never supported by the driver due to limitations
of native cs and additional code complexity and is explicitly
not stated to be implemented.

To keep backwards compatibility with such buggy DTs we limit
the number of chip_selects to 1, as for all practical purposes
it is only ever realistic to use a single chip select in
native cs mode without negative side-effects.

Fixes: 1ea29b39f4c812ec ("spi: bcm2835aux: add bcm2835 auxiliary spi device...")
Signed-off-by: Martin Sperl <kernel@martin.sperl.org>
Acked-by: Stefan Wahren <stefan.wahren@i2se.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-bcm2835aux.c | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/drivers/spi/spi-bcm2835aux.c b/drivers/spi/spi-bcm2835aux.c
index 5c89bbb05441b..e075712c501e8 100644
--- a/drivers/spi/spi-bcm2835aux.c
+++ b/drivers/spi/spi-bcm2835aux.c
@@ -416,7 +416,18 @@ static int bcm2835aux_spi_probe(struct platform_device *pdev)
 	platform_set_drvdata(pdev, master);
 	master->mode_bits = (SPI_CPOL | SPI_CS_HIGH | SPI_NO_CS);
 	master->bits_per_word_mask = SPI_BPW_MASK(8);
-	master->num_chipselect = -1;
+	/* even though the driver never officially supported native CS
+	 * allow a single native CS for legacy DT support purposes when
+	 * no cs-gpio is configured.
+	 * Known limitations for native cs are:
+	 * * multiple chip-selects: cs0-cs2 are all simultaniously asserted
+	 *     whenever there is a transfer -  this even includes SPI_NO_CS
+	 * * SPI_CS_HIGH: is ignores - cs are always asserted low
+	 * * cs_change: cs is deasserted after each spi_transfer
+	 * * cs_delay_usec: cs is always deasserted one SCK cycle after
+	 *     a spi_transfer
+	 */
+	master->num_chipselect = 1;
 	master->transfer_one = bcm2835aux_spi_transfer_one;
 	master->handle_err = bcm2835aux_spi_handle_err;
 	master->prepare_message = bcm2835aux_spi_prepare_message;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 113/271] ehea: Fix a copy-paste err in ehea_init_port_res
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (111 preceding siblings ...)
  2020-01-28 14:04 ` [PATCH 4.9 112/271] spi: bcm2835aux: fix driver to not allow 65535 (=-1) cs-gpios Greg Kroah-Hartman
@ 2020-01-28 14:04 ` Greg Kroah-Hartman
  2020-01-28 14:04 ` [PATCH 4.9 114/271] scsi: qla2xxx: Unregister chrdev if module initialization fails Greg Kroah-Hartman
                   ` (162 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, YueHaibing, Mukesh Ojha,
	David S. Miller, Sasha Levin

From: YueHaibing <yuehaibing@huawei.com>

[ Upstream commit c8f191282f819ab4e9b47b22a65c6c29734cefce ]

pr->tx_bytes should be assigned to tx_bytes other than
rx_bytes.

Reported-by: Hulk Robot <hulkci@huawei.com>
Fixes: ce45b873028f ("ehea: Fixing statistics")
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Reviewed-by: Mukesh Ojha <mojha@codeaurora.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/ibm/ehea/ehea_main.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/ibm/ehea/ehea_main.c b/drivers/net/ethernet/ibm/ehea/ehea_main.c
index 2dd17e01e3a7a..3692adb8902d1 100644
--- a/drivers/net/ethernet/ibm/ehea/ehea_main.c
+++ b/drivers/net/ethernet/ibm/ehea/ehea_main.c
@@ -1476,7 +1476,7 @@ static int ehea_init_port_res(struct ehea_port *port, struct ehea_port_res *pr,
 
 	memset(pr, 0, sizeof(struct ehea_port_res));
 
-	pr->tx_bytes = rx_bytes;
+	pr->tx_bytes = tx_bytes;
 	pr->tx_packets = tx_packets;
 	pr->rx_bytes = rx_bytes;
 	pr->rx_packets = rx_packets;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 114/271] scsi: qla2xxx: Unregister chrdev if module initialization fails
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (112 preceding siblings ...)
  2020-01-28 14:04 ` [PATCH 4.9 113/271] ehea: Fix a copy-paste err in ehea_init_port_res Greg Kroah-Hartman
@ 2020-01-28 14:04 ` Greg Kroah-Hartman
  2020-01-28 14:04 ` [PATCH 4.9 115/271] ARM: pxa: ssp: Fix "WARNING: invalid free of devm_ allocated data" Greg Kroah-Hartman
                   ` (161 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Himanshu Madhani, Giridhar Malavali,
	Bart Van Assche, Martin K. Petersen, Sasha Levin

From: Bart Van Assche <bvanassche@acm.org>

[ Upstream commit c794d24ec9eb6658909955772e70f34bef5b5b91 ]

If module initialization fails after the character device has been
registered, unregister the character device. Additionally, avoid
duplicating error path code.

Cc: Himanshu Madhani <hmadhani@marvell.com>
Cc: Giridhar Malavali <giridhar.malavali@qlogic.com>
Fixes: 6a03b4cd78f3 ("[SCSI] qla2xxx: Add char device to increase driver use count") # v2.6.35.
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/qla2xxx/qla_os.c | 34 +++++++++++++++++++++-------------
 1 file changed, 21 insertions(+), 13 deletions(-)

diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index 3bae56b202f87..e730aabc26d0d 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -6055,8 +6055,7 @@ qla2x00_module_init(void)
 	/* Initialize target kmem_cache and mem_pools */
 	ret = qlt_init();
 	if (ret < 0) {
-		kmem_cache_destroy(srb_cachep);
-		return ret;
+		goto destroy_cache;
 	} else if (ret > 0) {
 		/*
 		 * If initiator mode is explictly disabled by qlt_init(),
@@ -6075,11 +6074,10 @@ qla2x00_module_init(void)
 	qla2xxx_transport_template =
 	    fc_attach_transport(&qla2xxx_transport_functions);
 	if (!qla2xxx_transport_template) {
-		kmem_cache_destroy(srb_cachep);
 		ql_log(ql_log_fatal, NULL, 0x0002,
 		    "fc_attach_transport failed...Failing load!.\n");
-		qlt_exit();
-		return -ENODEV;
+		ret = -ENODEV;
+		goto qlt_exit;
 	}
 
 	apidev_major = register_chrdev(0, QLA2XXX_APIDEV, &apidev_fops);
@@ -6091,27 +6089,37 @@ qla2x00_module_init(void)
 	qla2xxx_transport_vport_template =
 	    fc_attach_transport(&qla2xxx_transport_vport_functions);
 	if (!qla2xxx_transport_vport_template) {
-		kmem_cache_destroy(srb_cachep);
-		qlt_exit();
-		fc_release_transport(qla2xxx_transport_template);
 		ql_log(ql_log_fatal, NULL, 0x0004,
 		    "fc_attach_transport vport failed...Failing load!.\n");
-		return -ENODEV;
+		ret = -ENODEV;
+		goto unreg_chrdev;
 	}
 	ql_log(ql_log_info, NULL, 0x0005,
 	    "QLogic Fibre Channel HBA Driver: %s.\n",
 	    qla2x00_version_str);
 	ret = pci_register_driver(&qla2xxx_pci_driver);
 	if (ret) {
-		kmem_cache_destroy(srb_cachep);
-		qlt_exit();
-		fc_release_transport(qla2xxx_transport_template);
-		fc_release_transport(qla2xxx_transport_vport_template);
 		ql_log(ql_log_fatal, NULL, 0x0006,
 		    "pci_register_driver failed...ret=%d Failing load!.\n",
 		    ret);
+		goto release_vport_transport;
 	}
 	return ret;
+
+release_vport_transport:
+	fc_release_transport(qla2xxx_transport_vport_template);
+
+unreg_chrdev:
+	if (apidev_major >= 0)
+		unregister_chrdev(apidev_major, QLA2XXX_APIDEV);
+	fc_release_transport(qla2xxx_transport_template);
+
+qlt_exit:
+	qlt_exit();
+
+destroy_cache:
+	kmem_cache_destroy(srb_cachep);
+	return ret;
 }
 
 /**
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 115/271] ARM: pxa: ssp: Fix "WARNING: invalid free of devm_ allocated data"
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (113 preceding siblings ...)
  2020-01-28 14:04 ` [PATCH 4.9 114/271] scsi: qla2xxx: Unregister chrdev if module initialization fails Greg Kroah-Hartman
@ 2020-01-28 14:04 ` Greg Kroah-Hartman
  2020-01-28 14:04 ` [PATCH 4.9 116/271] hwmon: (w83627hf) Use request_muxed_region for Super-IO accesses Greg Kroah-Hartman
                   ` (160 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, YueHaibing, Robert Jarzmik, Sasha Levin

From: YueHaibing <yuehaibing@huawei.com>

[ Upstream commit 9ee8578d953023cc57e7e736ae48502c707c0210 ]

Since commit 1c459de1e645 ("ARM: pxa: ssp: use devm_ functions")
kfree, iounmap, clk_put etc are not needed anymore in remove path.

Fixes: 1c459de1e645 ("ARM: pxa: ssp: use devm_ functions")
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
[ commit message spelling fix ]
Signed-off-by: Robert Jarzmik <robert.jarzmik@free.fr>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/plat-pxa/ssp.c | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/arch/arm/plat-pxa/ssp.c b/arch/arm/plat-pxa/ssp.c
index b92673efffffb..97bd43c16cd87 100644
--- a/arch/arm/plat-pxa/ssp.c
+++ b/arch/arm/plat-pxa/ssp.c
@@ -230,18 +230,12 @@ static int pxa_ssp_probe(struct platform_device *pdev)
 
 static int pxa_ssp_remove(struct platform_device *pdev)
 {
-	struct resource *res;
 	struct ssp_device *ssp;
 
 	ssp = platform_get_drvdata(pdev);
 	if (ssp == NULL)
 		return -ENODEV;
 
-	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-	release_mem_region(res->start, resource_size(res));
-
-	clk_put(ssp->clk);
-
 	mutex_lock(&ssp_lock);
 	list_del(&ssp->node);
 	mutex_unlock(&ssp_lock);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 116/271] hwmon: (w83627hf) Use request_muxed_region for Super-IO accesses
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (114 preceding siblings ...)
  2020-01-28 14:04 ` [PATCH 4.9 115/271] ARM: pxa: ssp: Fix "WARNING: invalid free of devm_ allocated data" Greg Kroah-Hartman
@ 2020-01-28 14:04 ` Greg Kroah-Hartman
  2020-01-28 14:04 ` [PATCH 4.9 117/271] tipc: set sysctl_tipc_rmem and named_timeout right range Greg Kroah-Hartman
                   ` (159 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:04 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Guenter Roeck, Sasha Levin

From: Guenter Roeck <linux@roeck-us.net>

[ Upstream commit e95fd518d05bfc087da6fcdea4900a57cfb083bd ]

Super-IO accesses may fail on a system with no or unmapped LPC bus.

Also, other drivers may attempt to access the LPC bus at the same time,
resulting in undefined behavior.

Use request_muxed_region() to ensure that IO access on the requested
address space is supported, and to ensure that access by multiple drivers
is synchronized.

Fixes: b72656dbc491 ("hwmon: (w83627hf) Stop using globals for I/O port numbers")
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hwmon/w83627hf.c | 42 +++++++++++++++++++++++++++++++++++-----
 1 file changed, 37 insertions(+), 5 deletions(-)

diff --git a/drivers/hwmon/w83627hf.c b/drivers/hwmon/w83627hf.c
index 721295b9a0517..43c0f89cefdf0 100644
--- a/drivers/hwmon/w83627hf.c
+++ b/drivers/hwmon/w83627hf.c
@@ -130,17 +130,23 @@ superio_select(struct w83627hf_sio_data *sio, int ld)
 	outb(ld,  sio->sioaddr + 1);
 }
 
-static inline void
+static inline int
 superio_enter(struct w83627hf_sio_data *sio)
 {
+	if (!request_muxed_region(sio->sioaddr, 2, DRVNAME))
+		return -EBUSY;
+
 	outb(0x87, sio->sioaddr);
 	outb(0x87, sio->sioaddr);
+
+	return 0;
 }
 
 static inline void
 superio_exit(struct w83627hf_sio_data *sio)
 {
 	outb(0xAA, sio->sioaddr);
+	release_region(sio->sioaddr, 2);
 }
 
 #define W627_DEVID 0x52
@@ -1275,7 +1281,7 @@ static DEVICE_ATTR(name, S_IRUGO, show_name, NULL);
 static int __init w83627hf_find(int sioaddr, unsigned short *addr,
 				struct w83627hf_sio_data *sio_data)
 {
-	int err = -ENODEV;
+	int err;
 	u16 val;
 
 	static __initconst char *const names[] = {
@@ -1287,7 +1293,11 @@ static int __init w83627hf_find(int sioaddr, unsigned short *addr,
 	};
 
 	sio_data->sioaddr = sioaddr;
-	superio_enter(sio_data);
+	err = superio_enter(sio_data);
+	if (err)
+		return err;
+
+	err = -ENODEV;
 	val = force_id ? force_id : superio_inb(sio_data, DEVID);
 	switch (val) {
 	case W627_DEVID:
@@ -1641,9 +1651,21 @@ static int w83627thf_read_gpio5(struct platform_device *pdev)
 	struct w83627hf_sio_data *sio_data = dev_get_platdata(&pdev->dev);
 	int res = 0xff, sel;
 
-	superio_enter(sio_data);
+	if (superio_enter(sio_data)) {
+		/*
+		 * Some other driver reserved the address space for itself.
+		 * We don't want to fail driver instantiation because of that,
+		 * so display a warning and keep going.
+		 */
+		dev_warn(&pdev->dev,
+			 "Can not read VID data: Failed to enable SuperIO access\n");
+		return res;
+	}
+
 	superio_select(sio_data, W83627HF_LD_GPIO5);
 
+	res = 0xff;
+
 	/* Make sure these GPIO pins are enabled */
 	if (!(superio_inb(sio_data, W83627THF_GPIO5_EN) & (1<<3))) {
 		dev_dbg(&pdev->dev, "GPIO5 disabled, no VID function\n");
@@ -1674,7 +1696,17 @@ static int w83687thf_read_vid(struct platform_device *pdev)
 	struct w83627hf_sio_data *sio_data = dev_get_platdata(&pdev->dev);
 	int res = 0xff;
 
-	superio_enter(sio_data);
+	if (superio_enter(sio_data)) {
+		/*
+		 * Some other driver reserved the address space for itself.
+		 * We don't want to fail driver instantiation because of that,
+		 * so display a warning and keep going.
+		 */
+		dev_warn(&pdev->dev,
+			 "Can not read VID data: Failed to enable SuperIO access\n");
+		return res;
+	}
+
 	superio_select(sio_data, W83627HF_LD_HWM);
 
 	/* Make sure these GPIO pins are enabled */
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 117/271] tipc: set sysctl_tipc_rmem and named_timeout right range
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (115 preceding siblings ...)
  2020-01-28 14:04 ` [PATCH 4.9 116/271] hwmon: (w83627hf) Use request_muxed_region for Super-IO accesses Greg Kroah-Hartman
@ 2020-01-28 14:04 ` Greg Kroah-Hartman
  2020-01-28 14:04 ` [PATCH 4.9 118/271] powerpc: vdso: Make vdso32 installation conditional in vdso_install Greg Kroah-Hartman
                   ` (158 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jie Liu, Qiang Ning, Zhiqiang Liu,
	Miaohe Lin, David S. Miller, Sasha Levin

From: Jie Liu <liujie165@huawei.com>

[ Upstream commit 4bcd4ec1017205644a2697bccbc3b5143f522f5f ]

We find that sysctl_tipc_rmem and named_timeout do not have the right minimum
setting. sysctl_tipc_rmem should be larger than zero, like sysctl_tcp_rmem.
And named_timeout as a timeout setting should be not less than zero.

Fixes: cc79dd1ba9c10 ("tipc: change socket buffer overflow control to respect sk_rcvbuf")
Fixes: a5325ae5b8bff ("tipc: add name distributor resiliency queue")
Signed-off-by: Jie Liu <liujie165@huawei.com>
Reported-by: Qiang Ning <ningqiang1@huawei.com>
Reviewed-by: Zhiqiang Liu <liuzhiqiang26@huawei.com>
Reviewed-by: Miaohe Lin <linmiaohe@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/tipc/sysctl.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/net/tipc/sysctl.c b/net/tipc/sysctl.c
index 1a779b1e85100..40f6d82083d7b 100644
--- a/net/tipc/sysctl.c
+++ b/net/tipc/sysctl.c
@@ -37,6 +37,8 @@
 
 #include <linux/sysctl.h>
 
+static int zero;
+static int one = 1;
 static struct ctl_table_header *tipc_ctl_hdr;
 
 static struct ctl_table tipc_table[] = {
@@ -45,14 +47,16 @@ static struct ctl_table tipc_table[] = {
 		.data		= &sysctl_tipc_rmem,
 		.maxlen		= sizeof(sysctl_tipc_rmem),
 		.mode		= 0644,
-		.proc_handler	= proc_dointvec,
+		.proc_handler	= proc_dointvec_minmax,
+		.extra1         = &one,
 	},
 	{
 		.procname	= "named_timeout",
 		.data		= &sysctl_tipc_named_timeout,
 		.maxlen		= sizeof(sysctl_tipc_named_timeout),
 		.mode		= 0644,
-		.proc_handler	= proc_dointvec,
+		.proc_handler	= proc_dointvec_minmax,
+		.extra1         = &zero,
 	},
 	{}
 };
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 118/271] powerpc: vdso: Make vdso32 installation conditional in vdso_install
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (116 preceding siblings ...)
  2020-01-28 14:04 ` [PATCH 4.9 117/271] tipc: set sysctl_tipc_rmem and named_timeout right range Greg Kroah-Hartman
@ 2020-01-28 14:04 ` Greg Kroah-Hartman
  2020-01-28 14:04 ` [PATCH 4.9 119/271] ARM: dts: ls1021: Fix SGMII PCS link remaining down after PHY disconnect Greg Kroah-Hartman
                   ` (157 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ben Hutchings, Michael Ellerman, Sasha Levin

From: Ben Hutchings <ben@decadent.org.uk>

[ Upstream commit ff6d27823f619892ab96f7461764840e0d786b15 ]

The 32-bit vDSO is not needed and not normally built for 64-bit
little-endian configurations.  However, the vdso_install target still
builds and installs it.  Add the same config condition as is normally
used for the build.

Fixes: e0d005916994 ("powerpc/vdso: Disable building the 32-bit VDSO ...")
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/Makefile | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile
index a60c9c6e5cc17..de29b88c0e700 100644
--- a/arch/powerpc/Makefile
+++ b/arch/powerpc/Makefile
@@ -373,7 +373,9 @@ vdso_install:
 ifeq ($(CONFIG_PPC64),y)
 	$(Q)$(MAKE) $(build)=arch/$(ARCH)/kernel/vdso64 $@
 endif
+ifdef CONFIG_VDSO32
 	$(Q)$(MAKE) $(build)=arch/$(ARCH)/kernel/vdso32 $@
+endif
 
 archclean:
 	$(Q)$(MAKE) $(clean)=$(boot)
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 119/271] ARM: dts: ls1021: Fix SGMII PCS link remaining down after PHY disconnect
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (117 preceding siblings ...)
  2020-01-28 14:04 ` [PATCH 4.9 118/271] powerpc: vdso: Make vdso32 installation conditional in vdso_install Greg Kroah-Hartman
@ 2020-01-28 14:04 ` Greg Kroah-Hartman
  2020-01-28 14:04 ` [PATCH 4.9 120/271] media: ov2659: fix unbalanced mutex_lock/unlock Greg Kroah-Hartman
                   ` (156 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Vladimir Oltean, Claudiu Manoil,
	Li Yang, Shawn Guo, Sasha Levin

From: Vladimir Oltean <olteanv@gmail.com>

[ Upstream commit c7861adbe37f576931650ad8ef805e0c47564b9a ]

Each eTSEC MAC has its own TBI (SGMII) PCS and private MDIO bus.
But due to a DTS oversight, both SGMII-compatible MACs of the LS1021 SoC
are pointing towards the same internal PCS. Therefore nobody is
controlling the internal PCS of eTSEC0.

Upon initial ndo_open, the SGMII link is ok by virtue of U-boot
initialization. But upon an ifdown/ifup sequence, the code path from
ndo_open -> init_phy -> gfar_configure_serdes does not get executed for
the PCS of eTSEC0 (and is executed twice for MAC eTSEC1). So the SGMII
link remains down for eTSEC0. On the LS1021A-TWR board, to signal this
failure condition, the PHY driver keeps printing
'803x_aneg_done: SGMII link is not ok'.

Also, it changes compatible of mdio0 to "fsl,etsec2-mdio" to match
mdio1 device.

Fixes: 055223d4d22d ("ARM: dts: ls1021a: Enable the eTSEC ports on QDS and TWR")
Signed-off-by: Vladimir Oltean <olteanv@gmail.com>
Reviewed-by: Claudiu Manoil <claudiu.manoil@nxp.com>
Acked-by: Li Yang <leoyang.li@nxp.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/ls1021a-twr.dts |  9 ++++++++-
 arch/arm/boot/dts/ls1021a.dtsi    | 11 ++++++++++-
 2 files changed, 18 insertions(+), 2 deletions(-)

diff --git a/arch/arm/boot/dts/ls1021a-twr.dts b/arch/arm/boot/dts/ls1021a-twr.dts
index 44715c8ef756b..72a3fc63d0ece 100644
--- a/arch/arm/boot/dts/ls1021a-twr.dts
+++ b/arch/arm/boot/dts/ls1021a-twr.dts
@@ -143,7 +143,7 @@
 };
 
 &enet0 {
-	tbi-handle = <&tbi1>;
+	tbi-handle = <&tbi0>;
 	phy-handle = <&sgmii_phy2>;
 	phy-connection-type = "sgmii";
 	status = "okay";
@@ -222,6 +222,13 @@
 	sgmii_phy2: ethernet-phy@2 {
 		reg = <0x2>;
 	};
+	tbi0: tbi-phy@1f {
+		reg = <0x1f>;
+		device_type = "tbi-phy";
+	};
+};
+
+&mdio1 {
 	tbi1: tbi-phy@1f {
 		reg = <0x1f>;
 		device_type = "tbi-phy";
diff --git a/arch/arm/boot/dts/ls1021a.dtsi b/arch/arm/boot/dts/ls1021a.dtsi
index 825f6eae3d1c1..27133c3a4b122 100644
--- a/arch/arm/boot/dts/ls1021a.dtsi
+++ b/arch/arm/boot/dts/ls1021a.dtsi
@@ -505,13 +505,22 @@
 		};
 
 		mdio0: mdio@2d24000 {
-			compatible = "gianfar";
+			compatible = "fsl,etsec2-mdio";
 			device_type = "mdio";
 			#address-cells = <1>;
 			#size-cells = <0>;
 			reg = <0x0 0x2d24000 0x0 0x4000>;
 		};
 
+		mdio1: mdio@2d64000 {
+			compatible = "fsl,etsec2-mdio";
+			device_type = "mdio";
+			#address-cells = <1>;
+			#size-cells = <0>;
+			reg = <0x0 0x2d64000 0x0 0x4000>,
+			      <0x0 0x2d50030 0x0 0x4>;
+		};
+
 		ptp_clock@2d10e00 {
 			compatible = "fsl,etsec-ptp";
 			reg = <0x0 0x2d10e00 0x0 0xb0>;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 120/271] media: ov2659: fix unbalanced mutex_lock/unlock
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (118 preceding siblings ...)
  2020-01-28 14:04 ` [PATCH 4.9 119/271] ARM: dts: ls1021: Fix SGMII PCS link remaining down after PHY disconnect Greg Kroah-Hartman
@ 2020-01-28 14:04 ` Greg Kroah-Hartman
  2020-01-28 14:04 ` [PATCH 4.9 121/271] 6lowpan: Off by one handling ->nexthdr Greg Kroah-Hartman
                   ` (155 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lad, Prabhakar, Akinobu Mita,
	Sakari Ailus, Mauro Carvalho Chehab, Sasha Levin

From: Akinobu Mita <akinobu.mita@gmail.com>

[ Upstream commit 384538bda10913e5c94ec5b5d34bd3075931bcf4 ]

Avoid returning with mutex locked.

Fixes: fa8cb6444c32 ("[media] ov2659: Don't depend on subdev API")

Cc: "Lad, Prabhakar" <prabhakar.csengg@gmail.com>
Signed-off-by: Akinobu Mita <akinobu.mita@gmail.com>
Acked-by: Lad, Prabhakar <prabhakar.csengg@gmail.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/i2c/ov2659.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/i2c/ov2659.c b/drivers/media/i2c/ov2659.c
index ade3c48e2e0cf..18546f950d792 100644
--- a/drivers/media/i2c/ov2659.c
+++ b/drivers/media/i2c/ov2659.c
@@ -1137,7 +1137,7 @@ static int ov2659_set_fmt(struct v4l2_subdev *sd,
 		mf = v4l2_subdev_get_try_format(sd, cfg, fmt->pad);
 		*mf = fmt->format;
 #else
-		return -ENOTTY;
+		ret = -ENOTTY;
 #endif
 	} else {
 		s64 val;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 121/271] 6lowpan: Off by one handling ->nexthdr
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (119 preceding siblings ...)
  2020-01-28 14:04 ` [PATCH 4.9 120/271] media: ov2659: fix unbalanced mutex_lock/unlock Greg Kroah-Hartman
@ 2020-01-28 14:04 ` Greg Kroah-Hartman
  2020-01-28 14:04 ` [PATCH 4.9 122/271] dmaengine: axi-dmac: Dont check the number of frames for alignment Greg Kroah-Hartman
                   ` (154 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Jukka Rissanen,
	Alexander Aring, Marcel Holtmann, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit f57c4bbf34439531adccd7d3a4ecc14f409c1399 ]

NEXTHDR_MAX is 255.  What happens here is that we take a u8 value
"hdr->nexthdr" from the network and then look it up in
lowpan_nexthdr_nhcs[].  The problem is that if hdr->nexthdr is 0xff then
we read one element beyond the end of the array so the array needs to
be one element larger.

Fixes: 92aa7c65d295 ("6lowpan: add generic nhc layer interface")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Jukka Rissanen <jukka.rissanen@linux.intel.com>
Acked-by: Alexander Aring <aring@mojatatu.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/6lowpan/nhc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/6lowpan/nhc.c b/net/6lowpan/nhc.c
index 7008d53e455c5..e61679bf09085 100644
--- a/net/6lowpan/nhc.c
+++ b/net/6lowpan/nhc.c
@@ -18,7 +18,7 @@
 #include "nhc.h"
 
 static struct rb_root rb_root = RB_ROOT;
-static struct lowpan_nhc *lowpan_nexthdr_nhcs[NEXTHDR_MAX];
+static struct lowpan_nhc *lowpan_nexthdr_nhcs[NEXTHDR_MAX + 1];
 static DEFINE_SPINLOCK(lowpan_nhc_lock);
 
 static int lowpan_nhc_insert(struct lowpan_nhc *nhc)
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 122/271] dmaengine: axi-dmac: Dont check the number of frames for alignment
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (120 preceding siblings ...)
  2020-01-28 14:04 ` [PATCH 4.9 121/271] 6lowpan: Off by one handling ->nexthdr Greg Kroah-Hartman
@ 2020-01-28 14:04 ` Greg Kroah-Hartman
  2020-01-28 14:04 ` [PATCH 4.9 123/271] ALSA: usb-audio: Handle the error from snd_usb_mixer_apply_create_quirk() Greg Kroah-Hartman
                   ` (153 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Alexandru Ardelean, Vinod Koul, Sasha Levin

From: Alexandru Ardelean <alexandru.ardelean@analog.com>

[ Upstream commit 648865a79d8ee3d1aa64aab5eb2a9d12eeed14f9 ]

In 2D transfers (for the AXI DMAC), the number of frames (numf) represents
Y_LENGTH, and the length of a frame is X_LENGTH. 2D transfers are useful
for video transfers where screen resolutions ( X * Y ) are typically
aligned for X, but not for Y.

There is no requirement for Y_LENGTH to be aligned to the bus-width (or
anything), and this is also true for AXI DMAC.

Checking the Y_LENGTH for alignment causes false errors when initiating DMA
transfers. This change fixes this by checking only that the Y_LENGTH is
non-zero.

Fixes: 0e3b67b348b8 ("dmaengine: Add support for the Analog Devices AXI-DMAC DMA controller")
Signed-off-by: Alexandru Ardelean <alexandru.ardelean@analog.com>
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/dma/dma-axi-dmac.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/dma/dma-axi-dmac.c b/drivers/dma/dma-axi-dmac.c
index 7f0b9aa158679..9887f2a14aa98 100644
--- a/drivers/dma/dma-axi-dmac.c
+++ b/drivers/dma/dma-axi-dmac.c
@@ -451,7 +451,7 @@ static struct dma_async_tx_descriptor *axi_dmac_prep_interleaved(
 
 	if (chan->hw_2d) {
 		if (!axi_dmac_check_len(chan, xt->sgl[0].size) ||
-		    !axi_dmac_check_len(chan, xt->numf))
+		    xt->numf == 0)
 			return NULL;
 		if (xt->sgl[0].size + dst_icg > chan->max_length ||
 		    xt->sgl[0].size + src_icg > chan->max_length)
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 123/271] ALSA: usb-audio: Handle the error from snd_usb_mixer_apply_create_quirk()
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (121 preceding siblings ...)
  2020-01-28 14:04 ` [PATCH 4.9 122/271] dmaengine: axi-dmac: Dont check the number of frames for alignment Greg Kroah-Hartman
@ 2020-01-28 14:04 ` Greg Kroah-Hartman
  2020-01-28 14:04 ` [PATCH 4.9 124/271] packet: in recvmsg msg_name return at least sizeof sockaddr_ll Greg Kroah-Hartman
                   ` (152 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:04 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Takashi Iwai, Sasha Levin

From: Takashi Iwai <tiwai@suse.de>

[ Upstream commit 328e9f6973be2ee67862cb17bf6c0c5c5918cd72 ]

The error from snd_usb_mixer_apply_create_quirk() is ignored in the
current usb-audio driver code, which will continue the probing even
after the error.  Let's take it more serious.

Fixes: 7b1eda223deb ("ALSA: usb-mixer: factor out quirks")
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/usb/mixer.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
index 64fa1bbf0acb3..54011f8543a72 100644
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -2626,7 +2626,9 @@ int snd_usb_create_mixer(struct snd_usb_audio *chip, int ctrlif,
 	    (err = snd_usb_mixer_status_create(mixer)) < 0)
 		goto _error;
 
-	snd_usb_mixer_apply_create_quirk(mixer);
+	err = snd_usb_mixer_apply_create_quirk(mixer);
+	if (err < 0)
+		goto _error;
 
 	err = snd_device_new(chip->card, SNDRV_DEV_CODEC, mixer, &dev_ops);
 	if (err < 0)
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 124/271] packet: in recvmsg msg_name return at least sizeof sockaddr_ll
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (122 preceding siblings ...)
  2020-01-28 14:04 ` [PATCH 4.9 123/271] ALSA: usb-audio: Handle the error from snd_usb_mixer_apply_create_quirk() Greg Kroah-Hartman
@ 2020-01-28 14:04 ` Greg Kroah-Hartman
  2020-01-28 14:04 ` [PATCH 4.9 125/271] ASoC: fix valid stream condition Greg Kroah-Hartman
                   ` (151 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, David Laight, Willem de Bruijn,
	David S. Miller, Sasha Levin

From: Willem de Bruijn <willemb@google.com>

[ Upstream commit b2cf86e1563e33a14a1c69b3e508d15dc12f804c ]

Packet send checks that msg_name is at least sizeof sockaddr_ll.
Packet recv must return at least this length, so that its output
can be passed unmodified to packet send.

This ceased to be true since adding support for lladdr longer than
sll_addr. Since, the return value uses true address length.

Always return at least sizeof sockaddr_ll, even if address length
is shorter. Zero the padding bytes.

Change v1->v2: do not overwrite zeroed padding again. use copy_len.

Fixes: 0fb375fb9b93 ("[AF_PACKET]: Allow for > 8 byte hardware addresses.")
Suggested-by: David Laight <David.Laight@aculab.com>
Signed-off-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/packet/af_packet.c | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 40cade140222f..47a862cc7b349 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -3404,20 +3404,29 @@ static int packet_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
 	sock_recv_ts_and_drops(msg, sk, skb);
 
 	if (msg->msg_name) {
+		int copy_len;
+
 		/* If the address length field is there to be filled
 		 * in, we fill it in now.
 		 */
 		if (sock->type == SOCK_PACKET) {
 			__sockaddr_check_size(sizeof(struct sockaddr_pkt));
 			msg->msg_namelen = sizeof(struct sockaddr_pkt);
+			copy_len = msg->msg_namelen;
 		} else {
 			struct sockaddr_ll *sll = &PACKET_SKB_CB(skb)->sa.ll;
 
 			msg->msg_namelen = sll->sll_halen +
 				offsetof(struct sockaddr_ll, sll_addr);
+			copy_len = msg->msg_namelen;
+			if (msg->msg_namelen < sizeof(struct sockaddr_ll)) {
+				memset(msg->msg_name +
+				       offsetof(struct sockaddr_ll, sll_addr),
+				       0, sizeof(sll->sll_addr));
+				msg->msg_namelen = sizeof(struct sockaddr_ll);
+			}
 		}
-		memcpy(msg->msg_name, &PACKET_SKB_CB(skb)->sa,
-		       msg->msg_namelen);
+		memcpy(msg->msg_name, &PACKET_SKB_CB(skb)->sa, copy_len);
 	}
 
 	if (pkt_sk(sk)->auxdata) {
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 125/271] ASoC: fix valid stream condition
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (123 preceding siblings ...)
  2020-01-28 14:04 ` [PATCH 4.9 124/271] packet: in recvmsg msg_name return at least sizeof sockaddr_ll Greg Kroah-Hartman
@ 2020-01-28 14:04 ` Greg Kroah-Hartman
  2020-01-28 14:04 ` [PATCH 4.9 126/271] usb: gadget: fsl: fix link error against usb-gadget module Greg Kroah-Hartman
                   ` (150 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jerome Brunet, Mark Brown, Sasha Levin

From: Jerome Brunet <jbrunet@baylibre.com>

[ Upstream commit 6a7c59c6d9f3b280e81d7a04bbe4e55e90152dce ]

A stream may specify a rate range using 'rate_min' and 'rate_max', so a
stream may be valid and not specify any rates. However, as stream cannot
be valid and not have any channel. Let's use this condition instead to
determine if a stream is valid or not.

Fixes: cde79035c6cf ("ASoC: Handle multiple codecs with split playback / capture")
Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/soc-pcm.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c
index d69559e458725..635b22fa1101a 100644
--- a/sound/soc/soc-pcm.c
+++ b/sound/soc/soc-pcm.c
@@ -48,8 +48,8 @@ static bool snd_soc_dai_stream_valid(struct snd_soc_dai *dai, int stream)
 	else
 		codec_stream = &dai->driver->capture;
 
-	/* If the codec specifies any rate at all, it supports the stream. */
-	return codec_stream->rates;
+	/* If the codec specifies any channels at all, it supports the stream */
+	return codec_stream->channels_min;
 }
 
 /**
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 126/271] usb: gadget: fsl: fix link error against usb-gadget module
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (124 preceding siblings ...)
  2020-01-28 14:04 ` [PATCH 4.9 125/271] ASoC: fix valid stream condition Greg Kroah-Hartman
@ 2020-01-28 14:04 ` Greg Kroah-Hartman
  2020-01-28 14:04 ` [PATCH 4.9 127/271] IB/mlx5: Add missing XRC options to QP optional params mask Greg Kroah-Hartman
                   ` (149 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Arnd Bergmann, Felipe Balbi, Sasha Levin

From: Arnd Bergmann <arnd@arndb.de>

[ Upstream commit 2100e3ca3676e894fa48b8f6f01d01733387fe81 ]

The dependency to ensure this driver links correctly fails since
it can not be a loadable module:

drivers/usb/phy/phy-fsl-usb.o: In function `fsl_otg_set_peripheral':
phy-fsl-usb.c:(.text+0x2224): undefined reference to `usb_gadget_vbus_disconnect'

Make the option 'tristate' so it can work correctly.

Fixes: 5a8d651a2bde ("usb: gadget: move gadget API functions to udc-core")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/phy/Kconfig | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/phy/Kconfig b/drivers/usb/phy/Kconfig
index 19ce615455c1b..de70e70d02bed 100644
--- a/drivers/usb/phy/Kconfig
+++ b/drivers/usb/phy/Kconfig
@@ -19,7 +19,7 @@ config AB8500_USB
 	  in host mode, low speed.
 
 config FSL_USB2_OTG
-	bool "Freescale USB OTG Transceiver Driver"
+	tristate "Freescale USB OTG Transceiver Driver"
 	depends on USB_EHCI_FSL && USB_FSL_USB2 && USB_OTG_FSM=y && PM
 	depends on USB_GADGET || !USB_GADGET # if USB_GADGET=m, this can't be 'y'
 	select USB_PHY
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 127/271] IB/mlx5: Add missing XRC options to QP optional params mask
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (125 preceding siblings ...)
  2020-01-28 14:04 ` [PATCH 4.9 126/271] usb: gadget: fsl: fix link error against usb-gadget module Greg Kroah-Hartman
@ 2020-01-28 14:04 ` Greg Kroah-Hartman
  2020-01-28 14:04 ` [PATCH 4.9 128/271] iommu/vt-d: Make kernel parameter igfx_off work with vIOMMU Greg Kroah-Hartman
                   ` (148 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jack Morgenstein, Leon Romanovsky,
	Jason Gunthorpe, Sasha Levin

From: Jack Morgenstein <jackm@dev.mellanox.co.il>

[ Upstream commit 8f4426aa19fcdb9326ac44154a117b1a3a5ae126 ]

The QP transition optional parameters for the various transition for XRC
QPs are identical to those for RC QPs.

Many of the XRC QP transition optional parameter bits are missing from the
QP optional mask table.  These omissions caused failures when doing XRC QP
state transitions.

For example, when trying to change the response timer of an XRC receive QP
via the RTS2RTS transition, the new timer value was ignored because
MLX5_QP_OPTPAR_RNR_TIMEOUT bit was missing from the optional params mask
for XRC qps for the RTS2RTS transition.

Fix this by adding the missing XRC optional parameters for all QP
transitions to the opt_mask table.

Fixes: e126ba97dba9 ("mlx5: Add driver for Mellanox Connect-IB adapters")
Fixes: a4774e9095de ("IB/mlx5: Fix opt param mask according to firmware spec")
Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il>
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/hw/mlx5/qp.c | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
index a7bc89f5dae7e..4d906a7904818 100644
--- a/drivers/infiniband/hw/mlx5/qp.c
+++ b/drivers/infiniband/hw/mlx5/qp.c
@@ -2324,6 +2324,11 @@ static enum mlx5_qp_optpar opt_mask[MLX5_QP_NUM_STATE][MLX5_QP_NUM_STATE][MLX5_Q
 			[MLX5_QP_ST_UD] = MLX5_QP_OPTPAR_PKEY_INDEX	|
 					  MLX5_QP_OPTPAR_Q_KEY		|
 					  MLX5_QP_OPTPAR_PRI_PORT,
+			[MLX5_QP_ST_XRC] = MLX5_QP_OPTPAR_RRE		|
+					  MLX5_QP_OPTPAR_RAE		|
+					  MLX5_QP_OPTPAR_RWE		|
+					  MLX5_QP_OPTPAR_PKEY_INDEX	|
+					  MLX5_QP_OPTPAR_PRI_PORT,
 		},
 		[MLX5_QP_STATE_RTR] = {
 			[MLX5_QP_ST_RC] = MLX5_QP_OPTPAR_ALT_ADDR_PATH  |
@@ -2357,6 +2362,12 @@ static enum mlx5_qp_optpar opt_mask[MLX5_QP_NUM_STATE][MLX5_QP_NUM_STATE][MLX5_Q
 					  MLX5_QP_OPTPAR_RWE		|
 					  MLX5_QP_OPTPAR_PM_STATE,
 			[MLX5_QP_ST_UD] = MLX5_QP_OPTPAR_Q_KEY,
+			[MLX5_QP_ST_XRC] = MLX5_QP_OPTPAR_ALT_ADDR_PATH	|
+					  MLX5_QP_OPTPAR_RRE		|
+					  MLX5_QP_OPTPAR_RAE		|
+					  MLX5_QP_OPTPAR_RWE		|
+					  MLX5_QP_OPTPAR_PM_STATE	|
+					  MLX5_QP_OPTPAR_RNR_TIMEOUT,
 		},
 	},
 	[MLX5_QP_STATE_RTS] = {
@@ -2373,6 +2384,12 @@ static enum mlx5_qp_optpar opt_mask[MLX5_QP_NUM_STATE][MLX5_QP_NUM_STATE][MLX5_Q
 			[MLX5_QP_ST_UD] = MLX5_QP_OPTPAR_Q_KEY		|
 					  MLX5_QP_OPTPAR_SRQN		|
 					  MLX5_QP_OPTPAR_CQN_RCV,
+			[MLX5_QP_ST_XRC] = MLX5_QP_OPTPAR_RRE		|
+					  MLX5_QP_OPTPAR_RAE		|
+					  MLX5_QP_OPTPAR_RWE		|
+					  MLX5_QP_OPTPAR_RNR_TIMEOUT	|
+					  MLX5_QP_OPTPAR_PM_STATE	|
+					  MLX5_QP_OPTPAR_ALT_ADDR_PATH,
 		},
 	},
 	[MLX5_QP_STATE_SQER] = {
@@ -2384,6 +2401,10 @@ static enum mlx5_qp_optpar opt_mask[MLX5_QP_NUM_STATE][MLX5_QP_NUM_STATE][MLX5_Q
 					   MLX5_QP_OPTPAR_RWE		|
 					   MLX5_QP_OPTPAR_RAE		|
 					   MLX5_QP_OPTPAR_RRE,
+			[MLX5_QP_ST_XRC]  = MLX5_QP_OPTPAR_RNR_TIMEOUT	|
+					   MLX5_QP_OPTPAR_RWE		|
+					   MLX5_QP_OPTPAR_RAE		|
+					   MLX5_QP_OPTPAR_RRE,
 		},
 	},
 };
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 128/271] iommu/vt-d: Make kernel parameter igfx_off work with vIOMMU
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (126 preceding siblings ...)
  2020-01-28 14:04 ` [PATCH 4.9 127/271] IB/mlx5: Add missing XRC options to QP optional params mask Greg Kroah-Hartman
@ 2020-01-28 14:04 ` Greg Kroah-Hartman
  2020-01-28 14:04 ` [PATCH 4.9 129/271] net: ena: fix swapped parameters when calling ena_com_indirect_table_fill_entry Greg Kroah-Hartman
                   ` (147 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ashok Raj, Jacob Pan, Kevin Tian,
	Lu Baolu, Zhenyu Wang, Joerg Roedel, Sasha Levin

From: Lu Baolu <baolu.lu@linux.intel.com>

[ Upstream commit 5daab58043ee2bca861068e2595564828f3bc663 ]

The kernel parameter igfx_off is used by users to disable
DMA remapping for the Intel integrated graphic device. It
was designed for bare metal cases where a dedicated IOMMU
is used for graphic. This doesn't apply to virtual IOMMU
case where an include-all IOMMU is used.  This makes the
kernel parameter work with virtual IOMMU as well.

Cc: Ashok Raj <ashok.raj@intel.com>
Cc: Jacob Pan <jacob.jun.pan@linux.intel.com>
Suggested-by: Kevin Tian <kevin.tian@intel.com>
Fixes: c0771df8d5297 ("intel-iommu: Export a flag indicating that the IOMMU is used for iGFX.")
Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
Tested-by: Zhenyu Wang <zhenyuw@linux.intel.com>
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iommu/intel-iommu.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
index 25cc6ae87039d..5c6e0a9fd2f36 100644
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -3345,9 +3345,12 @@ static int __init init_dmars(void)
 		iommu_identity_mapping |= IDENTMAP_ALL;
 
 #ifdef CONFIG_INTEL_IOMMU_BROKEN_GFX_WA
-	iommu_identity_mapping |= IDENTMAP_GFX;
+	dmar_map_gfx = 0;
 #endif
 
+	if (!dmar_map_gfx)
+		iommu_identity_mapping |= IDENTMAP_GFX;
+
 	check_tylersburg_isoch();
 
 	if (iommu_identity_mapping) {
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 129/271] net: ena: fix swapped parameters when calling ena_com_indirect_table_fill_entry
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (127 preceding siblings ...)
  2020-01-28 14:04 ` [PATCH 4.9 128/271] iommu/vt-d: Make kernel parameter igfx_off work with vIOMMU Greg Kroah-Hartman
@ 2020-01-28 14:04 ` Greg Kroah-Hartman
  2020-01-28 14:04 ` [PATCH 4.9 130/271] net: ena: fix: Free napi resources when ena_up() fails Greg Kroah-Hartman
                   ` (146 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Saeed Bshara, Sameeh Jubran,
	David S. Miller, Sasha Levin

From: Sameeh Jubran <sameehj@amazon.com>

[ Upstream commit 3c6eeff295f01bdf1c6c3addcb0a04c0c6c029e9 ]

second parameter should be the index of the table rather than the value.

Fixes: 1738cd3ed342 ("net: ena: Add a driver for Amazon Elastic Network Adapters (ENA)")
Signed-off-by: Saeed Bshara <saeedb@amazon.com>
Signed-off-by: Sameeh Jubran <sameehj@amazon.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/amazon/ena/ena_ethtool.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/amazon/ena/ena_ethtool.c b/drivers/net/ethernet/amazon/ena/ena_ethtool.c
index 67b2338f8fb34..06fd061a20e9a 100644
--- a/drivers/net/ethernet/amazon/ena/ena_ethtool.c
+++ b/drivers/net/ethernet/amazon/ena/ena_ethtool.c
@@ -697,8 +697,8 @@ static int ena_set_rxfh(struct net_device *netdev, const u32 *indir,
 	if (indir) {
 		for (i = 0; i < ENA_RX_RSS_TABLE_SIZE; i++) {
 			rc = ena_com_indirect_table_fill_entry(ena_dev,
-							       ENA_IO_RXQ_IDX(indir[i]),
-							       i);
+							       i,
+							       ENA_IO_RXQ_IDX(indir[i]));
 			if (unlikely(rc)) {
 				netif_err(adapter, drv, netdev,
 					  "Cannot fill indirect table (index is too large)\n");
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 130/271] net: ena: fix: Free napi resources when ena_up() fails
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (128 preceding siblings ...)
  2020-01-28 14:04 ` [PATCH 4.9 129/271] net: ena: fix swapped parameters when calling ena_com_indirect_table_fill_entry Greg Kroah-Hartman
@ 2020-01-28 14:04 ` Greg Kroah-Hartman
  2020-01-28 14:04 ` [PATCH 4.9 131/271] net: ena: fix incorrect test of supported hash function Greg Kroah-Hartman
                   ` (145 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Arthur Kiyanovski, Sameeh Jubran,
	David S. Miller, Sasha Levin

From: Sameeh Jubran <sameehj@amazon.com>

[ Upstream commit b287cdbd1cedfc9606682c6e02b58d00ff3a33ae ]

ena_up() calls ena_init_napi() but does not call ena_del_napi() in
case of failure. This causes a segmentation fault upon rmmod when
netif_napi_del() is called. Fix this bug by calling ena_del_napi()
before returning error from ena_up().

Fixes: 1738cd3ed342 ("net: ena: Add a driver for Amazon Elastic Network Adapters (ENA)")
Signed-off-by: Arthur Kiyanovski <akiyano@amazon.com>
Signed-off-by: Sameeh Jubran <sameehj@amazon.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/amazon/ena/ena_netdev.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.c b/drivers/net/ethernet/amazon/ena/ena_netdev.c
index 961f31c8356b7..da21886609e30 100644
--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c
+++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c
@@ -1702,6 +1702,7 @@ err_setup_rx:
 err_setup_tx:
 	ena_free_io_irq(adapter);
 err_req_irq:
+	ena_del_napi(adapter);
 
 	return rc;
 }
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 131/271] net: ena: fix incorrect test of supported hash function
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (129 preceding siblings ...)
  2020-01-28 14:04 ` [PATCH 4.9 130/271] net: ena: fix: Free napi resources when ena_up() fails Greg Kroah-Hartman
@ 2020-01-28 14:04 ` Greg Kroah-Hartman
  2020-01-28 14:04 ` [PATCH 4.9 132/271] net: ena: fix ena_com_fill_hash_function() implementation Greg Kroah-Hartman
                   ` (144 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Arthur Kiyanovski, Sameeh Jubran,
	David S. Miller, Sasha Levin

From: Sameeh Jubran <sameehj@amazon.com>

[ Upstream commit d3cfe7ddbc3dfbb9b201615b7fef8fd66d1b5fe8 ]

ena_com_set_hash_function() tests if a hash function is supported
by the device before setting it.
The test returns the opposite result than needed.
Reverse the condition to return the correct value.
Also use the BIT macro instead of inline shift.

Fixes: 1738cd3ed342 ("net: ena: Add a driver for Amazon Elastic Network Adapters (ENA)")
Signed-off-by: Arthur Kiyanovski <akiyano@amazon.com>
Signed-off-by: Sameeh Jubran <sameehj@amazon.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/amazon/ena/ena_com.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/amazon/ena/ena_com.c b/drivers/net/ethernet/amazon/ena/ena_com.c
index bcd993140f841..2d196d521b836 100644
--- a/drivers/net/ethernet/amazon/ena/ena_com.c
+++ b/drivers/net/ethernet/amazon/ena/ena_com.c
@@ -1967,7 +1967,7 @@ int ena_com_set_hash_function(struct ena_com_dev *ena_dev)
 	if (unlikely(ret))
 		return ret;
 
-	if (get_resp.u.flow_hash_func.supported_func & (1 << rss->hash_func)) {
+	if (!(get_resp.u.flow_hash_func.supported_func & BIT(rss->hash_func))) {
 		pr_err("Func hash %d isn't supported by device, abort\n",
 		       rss->hash_func);
 		return -EPERM;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 132/271] net: ena: fix ena_com_fill_hash_function() implementation
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (130 preceding siblings ...)
  2020-01-28 14:04 ` [PATCH 4.9 131/271] net: ena: fix incorrect test of supported hash function Greg Kroah-Hartman
@ 2020-01-28 14:04 ` Greg Kroah-Hartman
  2020-01-28 14:04 ` [PATCH 4.9 133/271] dmaengine: tegra210-adma: restore channel status Greg Kroah-Hartman
                   ` (143 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Netanel Belgazal, Sameeh Jubran,
	David S. Miller, Sasha Levin

From: Sameeh Jubran <sameehj@amazon.com>

[ Upstream commit 11bd7a00c0d8ffe33d1e926f8e789b4aea787186 ]

ena_com_fill_hash_function() didn't configure the rss->hash_func.

Fixes: 1738cd3ed342 ("net: ena: Add a driver for Amazon Elastic Network Adapters (ENA)")
Signed-off-by: Netanel Belgazal <netanel@amazon.com>
Signed-off-by: Sameeh Jubran <sameehj@amazon.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/amazon/ena/ena_com.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/ethernet/amazon/ena/ena_com.c b/drivers/net/ethernet/amazon/ena/ena_com.c
index 2d196d521b836..912dc09bc7a74 100644
--- a/drivers/net/ethernet/amazon/ena/ena_com.c
+++ b/drivers/net/ethernet/amazon/ena/ena_com.c
@@ -2052,6 +2052,7 @@ int ena_com_fill_hash_function(struct ena_com_dev *ena_dev,
 		return -EINVAL;
 	}
 
+	rss->hash_func = func;
 	rc = ena_com_set_hash_function(ena_dev);
 
 	/* Restore the old function */
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 133/271] dmaengine: tegra210-adma: restore channel status
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (131 preceding siblings ...)
  2020-01-28 14:04 ` [PATCH 4.9 132/271] net: ena: fix ena_com_fill_hash_function() implementation Greg Kroah-Hartman
@ 2020-01-28 14:04 ` Greg Kroah-Hartman
  2020-01-28 14:04 ` [PATCH 4.9 134/271] l2tp: Fix possible NULL pointer dereference Greg Kroah-Hartman
                   ` (142 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sameer Pujar, Jon Hunter, Vinod Koul,
	Sasha Levin

From: Sameer Pujar <spujar@nvidia.com>

[ Upstream commit f33e7bb3eb922618612a90f0a828c790e8880773 ]

Status of ADMA channel registers is not saved and restored during system
suspend. During active playback if system enters suspend, this results in
wrong state of channel registers during system resume and playback fails
to resume properly. Fix this by saving following channel registers in
runtime suspend and restore during runtime resume.
 * ADMA_CH_LOWER_SRC_ADDR
 * ADMA_CH_LOWER_TRG_ADDR
 * ADMA_CH_FIFO_CTRL
 * ADMA_CH_CONFIG
 * ADMA_CH_CTRL
 * ADMA_CH_CMD
 * ADMA_CH_TC
Runtime PM calls will be inovked during system resume path if a playback
or capture needs to be resumed. Hence above changes work fine for system
suspend case.

Fixes: f46b195799b5 ("dmaengine: tegra-adma: Add support for Tegra210 ADMA")
Signed-off-by: Sameer Pujar <spujar@nvidia.com>
Reviewed-by: Jon Hunter <jonathanh@nvidia.com>
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/dma/tegra210-adma.c | 46 ++++++++++++++++++++++++++++++++++++-
 1 file changed, 45 insertions(+), 1 deletion(-)

diff --git a/drivers/dma/tegra210-adma.c b/drivers/dma/tegra210-adma.c
index e9e46a5207452..8c3cab463354f 100644
--- a/drivers/dma/tegra210-adma.c
+++ b/drivers/dma/tegra210-adma.c
@@ -98,6 +98,7 @@ struct tegra_adma_chan_regs {
 	unsigned int src_addr;
 	unsigned int trg_addr;
 	unsigned int fifo_ctrl;
+	unsigned int cmd;
 	unsigned int tc;
 };
 
@@ -127,6 +128,7 @@ struct tegra_adma_chan {
 	enum dma_transfer_direction	sreq_dir;
 	unsigned int			sreq_index;
 	bool				sreq_reserved;
+	struct tegra_adma_chan_regs	ch_regs;
 
 	/* Transfer count and position info */
 	unsigned int			tx_buf_count;
@@ -635,8 +637,30 @@ static struct dma_chan *tegra_dma_of_xlate(struct of_phandle_args *dma_spec,
 static int tegra_adma_runtime_suspend(struct device *dev)
 {
 	struct tegra_adma *tdma = dev_get_drvdata(dev);
+	struct tegra_adma_chan_regs *ch_reg;
+	struct tegra_adma_chan *tdc;
+	int i;
 
 	tdma->global_cmd = tdma_read(tdma, ADMA_GLOBAL_CMD);
+	if (!tdma->global_cmd)
+		goto clk_disable;
+
+	for (i = 0; i < tdma->nr_channels; i++) {
+		tdc = &tdma->channels[i];
+		ch_reg = &tdc->ch_regs;
+		ch_reg->cmd = tdma_ch_read(tdc, ADMA_CH_CMD);
+		/* skip if channel is not active */
+		if (!ch_reg->cmd)
+			continue;
+		ch_reg->tc = tdma_ch_read(tdc, ADMA_CH_TC);
+		ch_reg->src_addr = tdma_ch_read(tdc, ADMA_CH_LOWER_SRC_ADDR);
+		ch_reg->trg_addr = tdma_ch_read(tdc, ADMA_CH_LOWER_TRG_ADDR);
+		ch_reg->ctrl = tdma_ch_read(tdc, ADMA_CH_CTRL);
+		ch_reg->fifo_ctrl = tdma_ch_read(tdc, ADMA_CH_FIFO_CTRL);
+		ch_reg->config = tdma_ch_read(tdc, ADMA_CH_CONFIG);
+	}
+
+clk_disable:
 	clk_disable_unprepare(tdma->ahub_clk);
 
 	return 0;
@@ -645,7 +669,9 @@ static int tegra_adma_runtime_suspend(struct device *dev)
 static int tegra_adma_runtime_resume(struct device *dev)
 {
 	struct tegra_adma *tdma = dev_get_drvdata(dev);
-	int ret;
+	struct tegra_adma_chan_regs *ch_reg;
+	struct tegra_adma_chan *tdc;
+	int ret, i;
 
 	ret = clk_prepare_enable(tdma->ahub_clk);
 	if (ret) {
@@ -654,6 +680,24 @@ static int tegra_adma_runtime_resume(struct device *dev)
 	}
 	tdma_write(tdma, ADMA_GLOBAL_CMD, tdma->global_cmd);
 
+	if (!tdma->global_cmd)
+		return 0;
+
+	for (i = 0; i < tdma->nr_channels; i++) {
+		tdc = &tdma->channels[i];
+		ch_reg = &tdc->ch_regs;
+		/* skip if channel was not active earlier */
+		if (!ch_reg->cmd)
+			continue;
+		tdma_ch_write(tdc, ADMA_CH_TC, ch_reg->tc);
+		tdma_ch_write(tdc, ADMA_CH_LOWER_SRC_ADDR, ch_reg->src_addr);
+		tdma_ch_write(tdc, ADMA_CH_LOWER_TRG_ADDR, ch_reg->trg_addr);
+		tdma_ch_write(tdc, ADMA_CH_CTRL, ch_reg->ctrl);
+		tdma_ch_write(tdc, ADMA_CH_FIFO_CTRL, ch_reg->fifo_ctrl);
+		tdma_ch_write(tdc, ADMA_CH_CONFIG, ch_reg->config);
+		tdma_ch_write(tdc, ADMA_CH_CMD, ch_reg->cmd);
+	}
+
 	return 0;
 }
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 134/271] l2tp: Fix possible NULL pointer dereference
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (132 preceding siblings ...)
  2020-01-28 14:04 ` [PATCH 4.9 133/271] dmaengine: tegra210-adma: restore channel status Greg Kroah-Hartman
@ 2020-01-28 14:04 ` Greg Kroah-Hartman
  2020-01-28 14:04 ` [PATCH 4.9 135/271] media: omap_vout: potential buffer overflow in vidioc_dqbuf() Greg Kroah-Hartman
                   ` (141 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, YueHaibing, Guillaume Nault,
	David S. Miller, Sasha Levin

From: YueHaibing <yuehaibing@huawei.com>

[ Upstream commit 638a3a1e349ddf5b82f222ff5cb3b4f266e7c278 ]

BUG: unable to handle kernel NULL pointer dereference at 0000000000000128
PGD 0 P4D 0
Oops: 0000 [#1
CPU: 0 PID: 5697 Comm: modprobe Tainted: G        W         5.1.0-rc7+ #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.9.3-0-ge2fc41e-prebuilt.qemu-project.org 04/01/2014
RIP: 0010:__lock_acquire+0x53/0x10b0
Code: 8b 1c 25 40 5e 01 00 4c 8b 6d 10 45 85 e4 0f 84 bd 06 00 00 44 8b 1d 7c d2 09 02 49 89 fe 41 89 d2 45 85 db 0f 84 47 02 00 00 <48> 81 3f a0 05 70 83 b8 00 00 00 00 44 0f 44 c0 83 fe 01 0f 86 3a
RSP: 0018:ffffc90001c07a28 EFLAGS: 00010002
RAX: 0000000000000000 RBX: ffff88822f038440 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000128
RBP: ffffc90001c07a88 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000001
R13: 0000000000000000 R14: 0000000000000128 R15: 0000000000000000
FS:  00007fead0811540(0000) GS:ffff888237a00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000128 CR3: 00000002310da000 CR4: 00000000000006f0
Call Trace:
 ? __lock_acquire+0x24e/0x10b0
 lock_acquire+0xdf/0x230
 ? flush_workqueue+0x71/0x530
 flush_workqueue+0x97/0x530
 ? flush_workqueue+0x71/0x530
 l2tp_exit_net+0x170/0x2b0 [l2tp_core
 ? l2tp_exit_net+0x93/0x2b0 [l2tp_core
 ops_exit_list.isra.6+0x36/0x60
 unregister_pernet_operations+0xb8/0x110
 unregister_pernet_device+0x25/0x40
 l2tp_init+0x55/0x1000 [l2tp_core
 ? 0xffffffffa018d000
 do_one_initcall+0x6c/0x3cc
 ? do_init_module+0x22/0x1f1
 ? rcu_read_lock_sched_held+0x97/0xb0
 ? kmem_cache_alloc_trace+0x325/0x3b0
 do_init_module+0x5b/0x1f1
 load_module+0x1db1/0x2690
 ? m_show+0x1d0/0x1d0
 __do_sys_finit_module+0xc5/0xd0
 __x64_sys_finit_module+0x15/0x20
 do_syscall_64+0x6b/0x1d0
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7fead031a839
Code: 00 f3 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 1f f6 2c 00 f7 d8 64 89 01 48
RSP: 002b:00007ffe8d9acca8 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
RAX: ffffffffffffffda RBX: 0000560078398b80 RCX: 00007fead031a839
RDX: 0000000000000000 RSI: 000056007659dc2e RDI: 0000000000000003
RBP: 000056007659dc2e R08: 0000000000000000 R09: 0000560078398b80
R10: 0000000000000003 R11: 0000000000000246 R12: 0000000000000000
R13: 00005600783a04a0 R14: 0000000000040000 R15: 0000560078398b80
Modules linked in: l2tp_core(+) e1000 ip_tables ipv6 [last unloaded: l2tp_core
CR2: 0000000000000128
---[ end trace 8322b2b8bf83f8e1

If alloc_workqueue fails in l2tp_init, l2tp_net_ops
is unregistered on failure path. Then l2tp_exit_net
is called which will flush NULL workqueue, this patch
add a NULL check to fix it.

Fixes: 67e04c29ec0d ("l2tp: unregister l2tp_net_ops on failure path")
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Acked-by: Guillaume Nault <gnault@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/l2tp/l2tp_core.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
index 4ae758bcb2cf4..394a1ddb07827 100644
--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -1947,7 +1947,8 @@ static __net_exit void l2tp_exit_net(struct net *net)
 	}
 	rcu_read_unlock_bh();
 
-	flush_workqueue(l2tp_wq);
+	if (l2tp_wq)
+		flush_workqueue(l2tp_wq);
 	rcu_barrier();
 }
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 135/271] media: omap_vout: potential buffer overflow in vidioc_dqbuf()
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (133 preceding siblings ...)
  2020-01-28 14:04 ` [PATCH 4.9 134/271] l2tp: Fix possible NULL pointer dereference Greg Kroah-Hartman
@ 2020-01-28 14:04 ` Greg Kroah-Hartman
  2020-01-28 14:04 ` [PATCH 4.9 136/271] media: davinci/vpbe: array underflow in vpbe_enum_outputs() Greg Kroah-Hartman
                   ` (140 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Hans Verkuil,
	Mauro Carvalho Chehab, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit dd6e2a981bfe83aa4a493143fd8cf1edcda6c091 ]

The "b->index" is a u32 the comes from the user in the ioctl.  It hasn't
been checked.  We aren't supposed to use it but we're instead supposed
to use the value that gets written to it when we call videobuf_dqbuf().

The videobuf_dqbuf() first memsets it to zero and then re-initializes it
inside the videobuf_status() function.  It's this final value which we
want.

Hans Verkuil pointed out that we need to check the return from
videobuf_dqbuf().  I ended up doing a little cleanup related to that as
well.

Fixes: 72915e851da9 ("[media] V4L2: OMAP: VOUT: dma map and unmap v4l2 buffers in qbuf and dqbuf")

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/omap/omap_vout.c | 15 ++++++---------
 1 file changed, 6 insertions(+), 9 deletions(-)

diff --git a/drivers/media/platform/omap/omap_vout.c b/drivers/media/platform/omap/omap_vout.c
index a31b95cb3b09c..77ec70f5fef66 100644
--- a/drivers/media/platform/omap/omap_vout.c
+++ b/drivers/media/platform/omap/omap_vout.c
@@ -1526,23 +1526,20 @@ static int vidioc_dqbuf(struct file *file, void *fh, struct v4l2_buffer *b)
 	unsigned long size;
 	struct videobuf_buffer *vb;
 
-	vb = q->bufs[b->index];
-
 	if (!vout->streaming)
 		return -EINVAL;
 
-	if (file->f_flags & O_NONBLOCK)
-		/* Call videobuf_dqbuf for non blocking mode */
-		ret = videobuf_dqbuf(q, (struct v4l2_buffer *)b, 1);
-	else
-		/* Call videobuf_dqbuf for  blocking mode */
-		ret = videobuf_dqbuf(q, (struct v4l2_buffer *)b, 0);
+	ret = videobuf_dqbuf(q, b, !!(file->f_flags & O_NONBLOCK));
+	if (ret)
+		return ret;
+
+	vb = q->bufs[b->index];
 
 	addr = (unsigned long) vout->buf_phy_addr[vb->i];
 	size = (unsigned long) vb->size;
 	dma_unmap_single(vout->vid_dev->v4l2_dev.dev,  addr,
 				size, DMA_TO_DEVICE);
-	return ret;
+	return 0;
 }
 
 static int vidioc_streamon(struct file *file, void *fh, enum v4l2_buf_type i)
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 136/271] media: davinci/vpbe: array underflow in vpbe_enum_outputs()
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (134 preceding siblings ...)
  2020-01-28 14:04 ` [PATCH 4.9 135/271] media: omap_vout: potential buffer overflow in vidioc_dqbuf() Greg Kroah-Hartman
@ 2020-01-28 14:04 ` Greg Kroah-Hartman
  2020-01-28 14:04 ` [PATCH 4.9 137/271] platform/x86: alienware-wmi: printing the wrong error code Greg Kroah-Hartman
                   ` (139 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Lad, Prabhakar,
	Hans Verkuil, Mauro Carvalho Chehab, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit b72845ee5577b227131b1fef23f9d9a296621d7b ]

In vpbe_enum_outputs() we check if (temp_index >= cfg->num_outputs) but
the problem is that "temp_index" can be negative.  This patch changes
the types to unsigned to address this array underflow bug.

Fixes: 66715cdc3224 ("[media] davinci vpbe: VPBE display driver")

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: "Lad, Prabhakar" <prabhakar.csengg@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/davinci/vpbe.c | 2 +-
 include/media/davinci/vpbe.h          | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/media/platform/davinci/vpbe.c b/drivers/media/platform/davinci/vpbe.c
index abce9c4a1a8ec..59518c08528b8 100644
--- a/drivers/media/platform/davinci/vpbe.c
+++ b/drivers/media/platform/davinci/vpbe.c
@@ -130,7 +130,7 @@ static int vpbe_enum_outputs(struct vpbe_device *vpbe_dev,
 			     struct v4l2_output *output)
 {
 	struct vpbe_config *cfg = vpbe_dev->cfg;
-	int temp_index = output->index;
+	unsigned int temp_index = output->index;
 
 	if (temp_index >= cfg->num_outputs)
 		return -EINVAL;
diff --git a/include/media/davinci/vpbe.h b/include/media/davinci/vpbe.h
index 4376beeb28c2c..5d8ceeddc7973 100644
--- a/include/media/davinci/vpbe.h
+++ b/include/media/davinci/vpbe.h
@@ -96,7 +96,7 @@ struct vpbe_config {
 	struct encoder_config_info *ext_encoders;
 	/* amplifier information goes here */
 	struct amp_config_info *amp;
-	int num_outputs;
+	unsigned int num_outputs;
 	/* Order is venc outputs followed by LCD and then external encoders */
 	struct vpbe_output *outputs;
 };
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 137/271] platform/x86: alienware-wmi: printing the wrong error code
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (135 preceding siblings ...)
  2020-01-28 14:04 ` [PATCH 4.9 136/271] media: davinci/vpbe: array underflow in vpbe_enum_outputs() Greg Kroah-Hartman
@ 2020-01-28 14:04 ` Greg Kroah-Hartman
  2020-01-28 14:04 ` [PATCH 4.9 138/271] netfilter: ebtables: CONFIG_COMPAT: reject trailing data after last rule Greg Kroah-Hartman
                   ` (138 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Mario Limonciello,
	Andy Shevchenko, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit 6d1f8b3d75419a8659ac916a1e9543bb3513a882 ]

The "out_data" variable is uninitialized at the point.  Originally, this
used to print "status" instead and that seems like the correct thing to
print.

Fixes: bc2ef884320b ("alienware-wmi: For WMAX HDMI method, introduce a way to query HDMI cable status")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Mario Limonciello <mario.limonciello@dell.com>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/x86/alienware-wmi.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/platform/x86/alienware-wmi.c b/drivers/platform/x86/alienware-wmi.c
index fe419935041c1..bee2115ecf101 100644
--- a/drivers/platform/x86/alienware-wmi.c
+++ b/drivers/platform/x86/alienware-wmi.c
@@ -570,7 +570,7 @@ static ssize_t show_hdmi_source(struct device *dev,
 			return scnprintf(buf, PAGE_SIZE,
 					 "input [gpu] unknown\n");
 	}
-	pr_err("alienware-wmi: unknown HDMI source status: %d\n", out_data);
+	pr_err("alienware-wmi: unknown HDMI source status: %u\n", status);
 	return scnprintf(buf, PAGE_SIZE, "input gpu [unknown]\n");
 }
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 138/271] netfilter: ebtables: CONFIG_COMPAT: reject trailing data after last rule
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (136 preceding siblings ...)
  2020-01-28 14:04 ` [PATCH 4.9 137/271] platform/x86: alienware-wmi: printing the wrong error code Greg Kroah-Hartman
@ 2020-01-28 14:04 ` Greg Kroah-Hartman
  2020-01-28 14:04 ` [PATCH 4.9 139/271] pwm: meson: Dont disable PWM when setting duty repeatedly Greg Kroah-Hartman
                   ` (137 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Tetsuo Handa, Florian Westphal,
	Pablo Neira Ayuso, Sasha Levin

From: Florian Westphal <fw@strlen.de>

[ Upstream commit 680f6af5337c98d116e4f127cea7845339dba8da ]

If userspace provides a rule blob with trailing data after last target,
we trigger a splat, then convert ruleset to 64bit format (with trailing
data), then pass that to do_replace_finish() which then returns -EINVAL.

Erroring out right away avoids the splat plus unneeded translation and
error unwind.

Fixes: 81e675c227ec ("netfilter: ebtables: add CONFIG_COMPAT support")
Reported-by: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/bridge/netfilter/ebtables.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 56b7197f03739..1d850edecd724 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -2182,7 +2182,9 @@ static int compat_copy_entries(unsigned char *data, unsigned int size_user,
 	if (ret < 0)
 		return ret;
 
-	WARN_ON(size_remaining);
+	if (size_remaining)
+		return -EINVAL;
+
 	return state->buf_kern_offset;
 }
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 139/271] pwm: meson: Dont disable PWM when setting duty repeatedly
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (137 preceding siblings ...)
  2020-01-28 14:04 ` [PATCH 4.9 138/271] netfilter: ebtables: CONFIG_COMPAT: reject trailing data after last rule Greg Kroah-Hartman
@ 2020-01-28 14:04 ` Greg Kroah-Hartman
  2020-01-28 14:04 ` [PATCH 4.9 140/271] ARM: riscpc: fix lack of keyboard interrupts after irq conversion Greg Kroah-Hartman
                   ` (136 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Bichao Zheng, Martin Blumenstingl,
	Neil Armstrong, Thierry Reding, Sasha Levin

From: Bichao Zheng <bichao.zheng@amlogic.com>

[ Upstream commit a279345807e1e0ae79567a52cfdd9d30c9174a3c ]

There is an abnormally low about 20ms,when setting duty repeatedly.
Because setting the duty will disable PWM and then enable. Delete
this operation now.

Fixes: 211ed630753d2f ("pwm: Add support for Meson PWM Controller")
Signed-off-by: Bichao Zheng <bichao.zheng@amlogic.com>
[ Dropped code instead of hiding it behind a comment ]
Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Reviewed-by: Neil Armstrong <narmstrong@baylibre.com>
Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pwm/pwm-meson.c | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/drivers/pwm/pwm-meson.c b/drivers/pwm/pwm-meson.c
index f58a4867b5194..a196439ee14c7 100644
--- a/drivers/pwm/pwm-meson.c
+++ b/drivers/pwm/pwm-meson.c
@@ -320,11 +320,6 @@ static int meson_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm,
 	if (state->period != channel->state.period ||
 	    state->duty_cycle != channel->state.duty_cycle ||
 	    state->polarity != channel->state.polarity) {
-		if (channel->state.enabled) {
-			meson_pwm_disable(meson, pwm->hwpwm);
-			channel->state.enabled = false;
-		}
-
 		if (state->polarity != channel->state.polarity) {
 			if (state->polarity == PWM_POLARITY_NORMAL)
 				meson->inverter_mask |= BIT(pwm->hwpwm);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 140/271] ARM: riscpc: fix lack of keyboard interrupts after irq conversion
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (138 preceding siblings ...)
  2020-01-28 14:04 ` [PATCH 4.9 139/271] pwm: meson: Dont disable PWM when setting duty repeatedly Greg Kroah-Hartman
@ 2020-01-28 14:04 ` Greg Kroah-Hartman
  2020-01-28 14:04 ` [PATCH 4.9 141/271] kdb: do a sanity check on the cpu in kdb_per_cpu() Greg Kroah-Hartman
                   ` (135 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:04 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Russell King, Sasha Levin

From: Russell King <rmk+kernel@armlinux.org.uk>

[ Upstream commit 63a0666bca9311f35017be454587f3ba903644b8 ]

Fix lack of keyboard interrupts for RiscPC due to incorrect conversion.

Fixes: e8d36d5dbb6a ("ARM: kill off set_irq_flags usage")
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/mach-rpc/irq.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/arch/arm/mach-rpc/irq.c b/arch/arm/mach-rpc/irq.c
index 66502e6207fea..fce7fecbd8fa4 100644
--- a/arch/arm/mach-rpc/irq.c
+++ b/arch/arm/mach-rpc/irq.c
@@ -117,7 +117,7 @@ extern unsigned char rpc_default_fiq_start, rpc_default_fiq_end;
 
 void __init rpc_init_irq(void)
 {
-	unsigned int irq, clr, set = 0;
+	unsigned int irq, clr, set;
 
 	iomd_writeb(0, IOMD_IRQMASKA);
 	iomd_writeb(0, IOMD_IRQMASKB);
@@ -129,6 +129,7 @@ void __init rpc_init_irq(void)
 
 	for (irq = 0; irq < NR_IRQS; irq++) {
 		clr = IRQ_NOREQUEST;
+		set = 0;
 
 		if (irq <= 6 || (irq >= 9 && irq <= 15))
 			clr |= IRQ_NOPROBE;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 141/271] kdb: do a sanity check on the cpu in kdb_per_cpu()
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (139 preceding siblings ...)
  2020-01-28 14:04 ` [PATCH 4.9 140/271] ARM: riscpc: fix lack of keyboard interrupts after irq conversion Greg Kroah-Hartman
@ 2020-01-28 14:04 ` Greg Kroah-Hartman
  2020-01-28 14:04 ` [PATCH 4.9 142/271] backlight: lm3630a: Return 0 on success in update_status functions Greg Kroah-Hartman
                   ` (134 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Douglas Anderson,
	Daniel Thompson, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit b586627e10f57ee3aa8f0cfab0d6f7dc4ae63760 ]

The "whichcpu" comes from argv[3].  The cpu_online() macro looks up the
cpu in a bitmap of online cpus, but if the value is too high then it
could read beyond the end of the bitmap and possibly Oops.

Fixes: 5d5314d6795f ("kdb: core for kgdb back end (1 of 2)")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Signed-off-by: Daniel Thompson <daniel.thompson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/debug/kdb/kdb_main.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/debug/kdb/kdb_main.c b/kernel/debug/kdb/kdb_main.c
index 5a58421d7e2d7..a52a6da8c3d09 100644
--- a/kernel/debug/kdb/kdb_main.c
+++ b/kernel/debug/kdb/kdb_main.c
@@ -2632,7 +2632,7 @@ static int kdb_per_cpu(int argc, const char **argv)
 		diag = kdbgetularg(argv[3], &whichcpu);
 		if (diag)
 			return diag;
-		if (!cpu_online(whichcpu)) {
+		if (whichcpu >= nr_cpu_ids || !cpu_online(whichcpu)) {
 			kdb_printf("cpu %ld is not online\n", whichcpu);
 			return KDB_BADCPUNUM;
 		}
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 142/271] backlight: lm3630a: Return 0 on success in update_status functions
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (140 preceding siblings ...)
  2020-01-28 14:04 ` [PATCH 4.9 141/271] kdb: do a sanity check on the cpu in kdb_per_cpu() Greg Kroah-Hartman
@ 2020-01-28 14:04 ` Greg Kroah-Hartman
  2020-01-28 14:04 ` [PATCH 4.9 143/271] thermal: cpu_cooling: Actually trace CPU load in thermal_power_cpu_get_power Greg Kroah-Hartman
                   ` (133 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Brian Masney, Pavel Machek,
	Daniel Thompson, Lee Jones, Sasha Levin

From: Brian Masney <masneyb@onstation.org>

[ Upstream commit d3f48ec0954c6aac736ab21c34a35d7554409112 ]

lm3630a_bank_a_update_status() and lm3630a_bank_b_update_status()
both return the brightness value if the brightness was successfully
updated. Writing to these attributes via sysfs would cause a 'Bad
address' error to be returned. These functions should return 0 on
success, so let's change it to correct that error.

Fixes: 28e64a68a2ef ("backlight: lm3630: apply chip revision")
Signed-off-by: Brian Masney <masneyb@onstation.org>
Acked-by: Pavel Machek <pavel@ucw.cz>
Acked-by: Daniel Thompson <daniel.thompson@linaro.org>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/video/backlight/lm3630a_bl.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/video/backlight/lm3630a_bl.c b/drivers/video/backlight/lm3630a_bl.c
index 60d6c2ac87aa5..1771220b2437f 100644
--- a/drivers/video/backlight/lm3630a_bl.c
+++ b/drivers/video/backlight/lm3630a_bl.c
@@ -200,7 +200,7 @@ static int lm3630a_bank_a_update_status(struct backlight_device *bl)
 				      LM3630A_LEDA_ENABLE, LM3630A_LEDA_ENABLE);
 	if (ret < 0)
 		goto out_i2c_err;
-	return bl->props.brightness;
+	return 0;
 
 out_i2c_err:
 	dev_err(pchip->dev, "i2c failed to access\n");
@@ -277,7 +277,7 @@ static int lm3630a_bank_b_update_status(struct backlight_device *bl)
 				      LM3630A_LEDB_ENABLE, LM3630A_LEDB_ENABLE);
 	if (ret < 0)
 		goto out_i2c_err;
-	return bl->props.brightness;
+	return 0;
 
 out_i2c_err:
 	dev_err(pchip->dev, "i2c failed to access REG_CTRL\n");
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 143/271] thermal: cpu_cooling: Actually trace CPU load in thermal_power_cpu_get_power
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (141 preceding siblings ...)
  2020-01-28 14:04 ` [PATCH 4.9 142/271] backlight: lm3630a: Return 0 on success in update_status functions Greg Kroah-Hartman
@ 2020-01-28 14:04 ` Greg Kroah-Hartman
  2020-01-28 14:04 ` [PATCH 4.9 144/271] dmaengine: tegra210-adma: Fix crash during probe Greg Kroah-Hartman
                   ` (132 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Matthias Kaehlcke, Daniel Lezcano,
	Javi Merino, Viresh Kumar, Eduardo Valentin, Sasha Levin

From: Matthias Kaehlcke <mka@chromium.org>

[ Upstream commit bf45ac18b78038e43af3c1a273cae4ab5704d2ce ]

The CPU load values passed to the thermal_power_cpu_get_power
tracepoint are zero for all CPUs, unless, unless the
thermal_power_cpu_limit tracepoint is enabled too:

  irq/41-rockchip-98    [000] ....   290.972410: thermal_power_cpu_get_power:
  cpus=0000000f freq=1800000 load={{0x0,0x0,0x0,0x0}} dynamic_power=4815

vs

  irq/41-rockchip-96    [000] ....    95.773585: thermal_power_cpu_get_power:
  cpus=0000000f freq=1800000 load={{0x56,0x64,0x64,0x5e}} dynamic_power=4959
  irq/41-rockchip-96    [000] ....    95.773596: thermal_power_cpu_limit:
  cpus=0000000f freq=408000 cdev_state=10 power=416

There seems to be no good reason for omitting the CPU load information
depending on another tracepoint. My guess is that the intention was to
check whether thermal_power_cpu_get_power is (still) enabled, however
'load_cpu != NULL' already indicates that it was at least enabled when
cpufreq_get_requested_power() was entered, there seems little gain
from omitting the assignment if the tracepoint was just disabled, so
just remove the check.

Fixes: 6828a4711f99 ("thermal: add trace events to the power allocator governor")
Signed-off-by: Matthias Kaehlcke <mka@chromium.org>
Reviewed-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Acked-by: Javi Merino <javi.merino@kernel.org>
Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Eduardo Valentin <edubezval@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/thermal/cpu_cooling.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/thermal/cpu_cooling.c b/drivers/thermal/cpu_cooling.c
index f49d2989d0005..984e5f5141403 100644
--- a/drivers/thermal/cpu_cooling.c
+++ b/drivers/thermal/cpu_cooling.c
@@ -607,7 +607,7 @@ static int cpufreq_get_requested_power(struct thermal_cooling_device *cdev,
 			load = 0;
 
 		total_load += load;
-		if (trace_thermal_power_cpu_limit_enabled() && load_cpu)
+		if (load_cpu)
 			load_cpu[i] = load;
 
 		i++;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 144/271] dmaengine: tegra210-adma: Fix crash during probe
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (142 preceding siblings ...)
  2020-01-28 14:04 ` [PATCH 4.9 143/271] thermal: cpu_cooling: Actually trace CPU load in thermal_power_cpu_get_power Greg Kroah-Hartman
@ 2020-01-28 14:04 ` Greg Kroah-Hartman
  2020-01-28 14:04 ` [PATCH 4.9 145/271] spi: spi-fsl-spi: call spi_finalize_current_message() at the end Greg Kroah-Hartman
                   ` (131 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jon Hunter, Vinod Koul, Sasha Levin

From: Jon Hunter <jonathanh@nvidia.com>

[ Upstream commit b53611fb1ce9b1786bd18205473e0c1d6bfa8934 ]

Commit f33e7bb3eb92 ("dmaengine: tegra210-adma: restore channel status")
added support to save and restore the DMA channel registers when runtime
suspending the ADMA. This change is causing the kernel to crash when
probing the ADMA, if the device is probed deferred when looking up the
channel interrupts. The crash occurs because not all of the channel base
addresses have been setup at this point and in the clean-up path of the
probe, pm_runtime_suspend() is called invoking its callback which
expects all the channel base addresses to be initialised.

Although this could be fixed by simply checking for a NULL address, on
further review of the driver it seems more appropriate that we only call
pm_runtime_get_sync() after all the channel interrupts and base
addresses have been configured. Therefore, fix this crash by moving the
calls to pm_runtime_enable(), pm_runtime_get_sync() and
tegra_adma_init() after the DMA channels have been initialised.

Fixes: f33e7bb3eb92 ("dmaengine: tegra210-adma: restore channel status")

Signed-off-by: Jon Hunter <jonathanh@nvidia.com>
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/dma/tegra210-adma.c | 26 +++++++++++++-------------
 1 file changed, 13 insertions(+), 13 deletions(-)

diff --git a/drivers/dma/tegra210-adma.c b/drivers/dma/tegra210-adma.c
index 8c3cab463354f..2d4aeba579f75 100644
--- a/drivers/dma/tegra210-adma.c
+++ b/drivers/dma/tegra210-adma.c
@@ -744,16 +744,6 @@ static int tegra_adma_probe(struct platform_device *pdev)
 		return PTR_ERR(tdma->ahub_clk);
 	}
 
-	pm_runtime_enable(&pdev->dev);
-
-	ret = pm_runtime_get_sync(&pdev->dev);
-	if (ret < 0)
-		goto rpm_disable;
-
-	ret = tegra_adma_init(tdma);
-	if (ret)
-		goto rpm_put;
-
 	INIT_LIST_HEAD(&tdma->dma_dev.channels);
 	for (i = 0; i < tdma->nr_channels; i++) {
 		struct tegra_adma_chan *tdc = &tdma->channels[i];
@@ -771,6 +761,16 @@ static int tegra_adma_probe(struct platform_device *pdev)
 		tdc->tdma = tdma;
 	}
 
+	pm_runtime_enable(&pdev->dev);
+
+	ret = pm_runtime_get_sync(&pdev->dev);
+	if (ret < 0)
+		goto rpm_disable;
+
+	ret = tegra_adma_init(tdma);
+	if (ret)
+		goto rpm_put;
+
 	dma_cap_set(DMA_SLAVE, tdma->dma_dev.cap_mask);
 	dma_cap_set(DMA_PRIVATE, tdma->dma_dev.cap_mask);
 	dma_cap_set(DMA_CYCLIC, tdma->dma_dev.cap_mask);
@@ -812,13 +812,13 @@ static int tegra_adma_probe(struct platform_device *pdev)
 
 dma_remove:
 	dma_async_device_unregister(&tdma->dma_dev);
-irq_dispose:
-	while (--i >= 0)
-		irq_dispose_mapping(tdma->channels[i].irq);
 rpm_put:
 	pm_runtime_put_sync(&pdev->dev);
 rpm_disable:
 	pm_runtime_disable(&pdev->dev);
+irq_dispose:
+	while (--i >= 0)
+		irq_dispose_mapping(tdma->channels[i].irq);
 
 	return ret;
 }
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 145/271] spi: spi-fsl-spi: call spi_finalize_current_message() at the end
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (143 preceding siblings ...)
  2020-01-28 14:04 ` [PATCH 4.9 144/271] dmaengine: tegra210-adma: Fix crash during probe Greg Kroah-Hartman
@ 2020-01-28 14:04 ` Greg Kroah-Hartman
  2020-01-28 14:04 ` [PATCH 4.9 146/271] crypto: ccp - fix AES CFB error exposed by new test vectors Greg Kroah-Hartman
                   ` (130 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christophe Leroy, Mark Brown, Sasha Levin

From: Christophe Leroy <christophe.leroy@c-s.fr>

[ Upstream commit 44a042182cb1e9f7916e015c836967bf638b33c4 ]

spi_finalize_current_message() shall be called once all
actions are finished, otherwise the last actions might
step over a newly started transfer.

Fixes: c592becbe704 ("spi: fsl-(e)spi: migrate to generic master queueing")
Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-fsl-spi.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/spi/spi-fsl-spi.c b/drivers/spi/spi-fsl-spi.c
index 8b290d9d79350..5419de19859a0 100644
--- a/drivers/spi/spi-fsl-spi.c
+++ b/drivers/spi/spi-fsl-spi.c
@@ -408,7 +408,6 @@ static int fsl_spi_do_one_msg(struct spi_master *master,
 	}
 
 	m->status = status;
-	spi_finalize_current_message(master);
 
 	if (status || !cs_change) {
 		ndelay(nsecs);
@@ -416,6 +415,7 @@ static int fsl_spi_do_one_msg(struct spi_master *master,
 	}
 
 	fsl_spi_setup_transfer(spi, NULL);
+	spi_finalize_current_message(master);
 	return 0;
 }
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 146/271] crypto: ccp - fix AES CFB error exposed by new test vectors
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (144 preceding siblings ...)
  2020-01-28 14:04 ` [PATCH 4.9 145/271] spi: spi-fsl-spi: call spi_finalize_current_message() at the end Greg Kroah-Hartman
@ 2020-01-28 14:04 ` Greg Kroah-Hartman
  2020-01-28 14:04 ` [PATCH 4.9 147/271] serial: stm32: fix transmit_chars when tx is stopped Greg Kroah-Hartman
                   ` (129 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Gary R Hook, Herbert Xu, Sasha Levin

From: Hook, Gary <Gary.Hook@amd.com>

[ Upstream commit c3b359d6567c0b8f413e924feb37cf025067d55a ]

Updated testmgr will exhibit this error message when loading the
ccp-crypto module:

alg: skcipher: cfb-aes-ccp encryption failed with err -22 on test vector 3, cfg="in-place"

Update the CCP crypto driver to correctly treat CFB as a streaming mode
cipher (instead of block mode). Update the configuration for CFB to
specify the block size as a single byte;

Fixes: 2b789435d7f3 ('crypto: ccp - CCP AES crypto API support')

Signed-off-by: Gary R Hook <gary.hook@amd.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/ccp/ccp-crypto-aes.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/crypto/ccp/ccp-crypto-aes.c b/drivers/crypto/ccp/ccp-crypto-aes.c
index 89291c15015cd..3f768699332ba 100644
--- a/drivers/crypto/ccp/ccp-crypto-aes.c
+++ b/drivers/crypto/ccp/ccp-crypto-aes.c
@@ -1,7 +1,8 @@
+// SPDX-License-Identifier: GPL-2.0
 /*
  * AMD Cryptographic Coprocessor (CCP) AES crypto API support
  *
- * Copyright (C) 2013,2016 Advanced Micro Devices, Inc.
+ * Copyright (C) 2013-2019 Advanced Micro Devices, Inc.
  *
  * Author: Tom Lendacky <thomas.lendacky@amd.com>
  *
@@ -79,8 +80,7 @@ static int ccp_aes_crypt(struct ablkcipher_request *req, bool encrypt)
 		return -EINVAL;
 
 	if (((ctx->u.aes.mode == CCP_AES_MODE_ECB) ||
-	     (ctx->u.aes.mode == CCP_AES_MODE_CBC) ||
-	     (ctx->u.aes.mode == CCP_AES_MODE_CFB)) &&
+	     (ctx->u.aes.mode == CCP_AES_MODE_CBC)) &&
 	    (req->nbytes & (AES_BLOCK_SIZE - 1)))
 		return -EINVAL;
 
@@ -291,7 +291,7 @@ static struct ccp_aes_def aes_algs[] = {
 		.version	= CCP_VERSION(3, 0),
 		.name		= "cfb(aes)",
 		.driver_name	= "cfb-aes-ccp",
-		.blocksize	= AES_BLOCK_SIZE,
+		.blocksize	= 1,
 		.ivsize		= AES_BLOCK_SIZE,
 		.alg_defaults	= &ccp_aes_defaults,
 	},
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 147/271] serial: stm32: fix transmit_chars when tx is stopped
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (145 preceding siblings ...)
  2020-01-28 14:04 ` [PATCH 4.9 146/271] crypto: ccp - fix AES CFB error exposed by new test vectors Greg Kroah-Hartman
@ 2020-01-28 14:04 ` Greg Kroah-Hartman
  2020-01-28 14:04 ` [PATCH 4.9 148/271] misc: sgi-xp: Properly initialize buf in xpc_get_rsvd_page_pa Greg Kroah-Hartman
                   ` (128 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:04 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Erwan Le Ray, Sasha Levin

From: Erwan Le Ray <erwan.leray@st.com>

[ Upstream commit b83b957c91f68e53f0dc596e129e8305761f2a32 ]

Disables the tx irq  when the transmission is ended and updates stop_tx
conditions for code cleanup.

Fixes: 48a6092fb41f ("serial: stm32-usart: Add STM32 USART Driver")
Signed-off-by: Erwan Le Ray <erwan.leray@st.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/serial/stm32-usart.c | 11 +++--------
 1 file changed, 3 insertions(+), 8 deletions(-)

diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c
index 033856287ca21..ea8b591dd46f4 100644
--- a/drivers/tty/serial/stm32-usart.c
+++ b/drivers/tty/serial/stm32-usart.c
@@ -293,13 +293,8 @@ static void stm32_transmit_chars(struct uart_port *port)
 		return;
 	}
 
-	if (uart_tx_stopped(port)) {
-		stm32_stop_tx(port);
-		return;
-	}
-
-	if (uart_circ_empty(xmit)) {
-		stm32_stop_tx(port);
+	if (uart_circ_empty(xmit) || uart_tx_stopped(port)) {
+		stm32_clr_bits(port, ofs->cr1, USART_CR1_TXEIE);
 		return;
 	}
 
@@ -312,7 +307,7 @@ static void stm32_transmit_chars(struct uart_port *port)
 		uart_write_wakeup(port);
 
 	if (uart_circ_empty(xmit))
-		stm32_stop_tx(port);
+		stm32_clr_bits(port, ofs->cr1, USART_CR1_TXEIE);
 }
 
 static irqreturn_t stm32_interrupt(int irq, void *ptr)
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 148/271] misc: sgi-xp: Properly initialize buf in xpc_get_rsvd_page_pa
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (146 preceding siblings ...)
  2020-01-28 14:04 ` [PATCH 4.9 147/271] serial: stm32: fix transmit_chars when tx is stopped Greg Kroah-Hartman
@ 2020-01-28 14:04 ` Greg Kroah-Hartman
  2020-01-28 14:04 ` [PATCH 4.9 149/271] iommu: Use right function to get group for device Greg Kroah-Hartman
                   ` (127 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Stephen Hines, Arnd Bergmann,
	Nick Desaulniers, Nathan Chancellor, Sasha Levin

From: Nathan Chancellor <natechancellor@gmail.com>

[ Upstream commit b0576f9ecb5c51e9932531d23c447b2739261841 ]

Clang warns:

drivers/misc/sgi-xp/xpc_partition.c:73:14: warning: variable 'buf' is
uninitialized when used within its own initialization [-Wuninitialized]
        void *buf = buf;
              ~~~   ^~~
1 warning generated.

Arnd's explanation during review:

  /*
   * Returns the physical address of the partition's reserved page through
   * an iterative number of calls.
   *
   * On first call, 'cookie' and 'len' should be set to 0, and 'addr'
   * set to the nasid of the partition whose reserved page's address is
   * being sought.
   * On subsequent calls, pass the values, that were passed back on the
   * previous call.
   *
   * While the return status equals SALRET_MORE_PASSES, keep calling
   * this function after first copying 'len' bytes starting at 'addr'
   * into 'buf'. Once the return status equals SALRET_OK, 'addr' will
   * be the physical address of the partition's reserved page. If the
   * return status equals neither of these, an error as occurred.
   */
  static inline s64
  sn_partition_reserved_page_pa(u64 buf, u64 *cookie, u64 *addr, u64 *len)

  so *len is set to zero on the first call and tells the bios how many
  bytes are accessible at 'buf', and it does get updated by the BIOS to
  tell us how many bytes it needs, and then we allocate that and try again.

Fixes: 279290294662 ("[IA64-SGI] cleanup the way XPC locates the reserved page")
Link: https://github.com/ClangBuiltLinux/linux/issues/466
Suggested-by: Stephen Hines <srhines@google.com>
Reviewed-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/misc/sgi-xp/xpc_partition.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/misc/sgi-xp/xpc_partition.c b/drivers/misc/sgi-xp/xpc_partition.c
index 6956f7e7d4392..ca5f0102daef4 100644
--- a/drivers/misc/sgi-xp/xpc_partition.c
+++ b/drivers/misc/sgi-xp/xpc_partition.c
@@ -70,7 +70,7 @@ xpc_get_rsvd_page_pa(int nasid)
 	unsigned long rp_pa = nasid;	/* seed with nasid */
 	size_t len = 0;
 	size_t buf_len = 0;
-	void *buf = buf;
+	void *buf = NULL;
 	void *buf_base = NULL;
 	enum xp_retval (*get_partition_rsvd_page_pa)
 		(void *, u64 *, unsigned long *, size_t *) =
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 149/271] iommu: Use right function to get group for device
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (147 preceding siblings ...)
  2020-01-28 14:04 ` [PATCH 4.9 148/271] misc: sgi-xp: Properly initialize buf in xpc_get_rsvd_page_pa Greg Kroah-Hartman
@ 2020-01-28 14:04 ` Greg Kroah-Hartman
  2020-01-28 14:04 ` [PATCH 4.9 150/271] signal/cifs: Fix cifs_put_tcp_session to call send_sig instead of force_sig Greg Kroah-Hartman
                   ` (126 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lu Baolu, Joerg Roedel, Sasha Levin

From: Lu Baolu <baolu.lu@linux.intel.com>

[ Upstream commit 57274ea25736496ee019a5c40479855b21888839 ]

The iommu_group_get_for_dev() will allocate a group for a
device if it isn't in any group. This isn't the use case
in iommu_request_dm_for_dev(). Let's use iommu_group_get()
instead.

Fixes: d290f1e70d85a ("iommu: Introduce iommu_request_dm_for_dev()")
Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iommu/iommu.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c
index 71b89e47e9521..dbcc13efaf3c8 100644
--- a/drivers/iommu/iommu.c
+++ b/drivers/iommu/iommu.c
@@ -1582,9 +1582,9 @@ int iommu_request_dm_for_dev(struct device *dev)
 	int ret;
 
 	/* Device must already be in a group before calling this function */
-	group = iommu_group_get_for_dev(dev);
-	if (IS_ERR(group))
-		return PTR_ERR(group);
+	group = iommu_group_get(dev);
+	if (!group)
+		return -EINVAL;
 
 	mutex_lock(&group->mutex);
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 150/271] signal/cifs: Fix cifs_put_tcp_session to call send_sig instead of force_sig
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (148 preceding siblings ...)
  2020-01-28 14:04 ` [PATCH 4.9 149/271] iommu: Use right function to get group for device Greg Kroah-Hartman
@ 2020-01-28 14:04 ` Greg Kroah-Hartman
  2020-01-28 14:05 ` [PATCH 4.9 151/271] inet: frags: call inet_frags_fini() after unregister_pernet_subsys() Greg Kroah-Hartman
                   ` (125 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:04 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Namjae Jeon, Jeff Layton,
	Steve French, Eric W. Biederman, Sasha Levin

From: Eric W. Biederman <ebiederm@xmission.com>

[ Upstream commit 72abe3bcf0911d69b46c1e8bdb5612675e0ac42c ]

The locking in force_sig_info is not prepared to deal with a task that
exits or execs (as sighand may change).  The is not a locking problem
in force_sig as force_sig is only built to handle synchronous
exceptions.

Further the function force_sig_info changes the signal state if the
signal is ignored, or blocked or if SIGNAL_UNKILLABLE will prevent the
delivery of the signal.  The signal SIGKILL can not be ignored and can
not be blocked and SIGNAL_UNKILLABLE won't prevent it from being
delivered.

So using force_sig rather than send_sig for SIGKILL is confusing
and pointless.

Because it won't impact the sending of the signal and and because
using force_sig is wrong, replace force_sig with send_sig.

Cc: Namjae Jeon <namjae.jeon@samsung.com>
Cc: Jeff Layton <jlayton@primarydata.com>
Cc: Steve French <smfrench@gmail.com>
Fixes: a5c3e1c725af ("Revert "cifs: No need to send SIGKILL to demux_thread during umount"")
Fixes: e7ddee9037e7 ("cifs: disable sharing session and tcon and add new TCP sharing code")
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/cifs/connect.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index e43ba6db2bdd6..110febd697379 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -2221,7 +2221,7 @@ cifs_put_tcp_session(struct TCP_Server_Info *server, int from_reconnect)
 
 	task = xchg(&server->tsk, NULL);
 	if (task)
-		force_sig(SIGKILL, task);
+		send_sig(SIGKILL, task, 1);
 }
 
 static struct TCP_Server_Info *
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 151/271] inet: frags: call inet_frags_fini() after unregister_pernet_subsys()
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (149 preceding siblings ...)
  2020-01-28 14:04 ` [PATCH 4.9 150/271] signal/cifs: Fix cifs_put_tcp_session to call send_sig instead of force_sig Greg Kroah-Hartman
@ 2020-01-28 14:05 ` Greg Kroah-Hartman
  2020-01-28 14:05 ` [PATCH 4.9 152/271] media: vivid: fix incorrect assignment operation when setting video mode Greg Kroah-Hartman
                   ` (124 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Eric Dumazet, David S. Miller, Sasha Levin

From: Eric Dumazet <edumazet@google.com>

[ Upstream commit ae7352d384a552d8c799c242e74a934809990a71 ]

Both IPv6 and 6lowpan are calling inet_frags_fini() too soon.

inet_frags_fini() is dismantling a kmem_cache, that might be needed
later when unregister_pernet_subsys() eventually has to remove
frags queues from hash tables and free them.

This fixes potential use-after-free, and is a prereq for the following patch.

Fixes: d4ad4d22e7ac ("inet: frags: use kmem_cache for inet_frag_queue")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ieee802154/6lowpan/reassembly.c | 2 +-
 net/ipv6/reassembly.c               | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/ieee802154/6lowpan/reassembly.c b/net/ieee802154/6lowpan/reassembly.c
index c01df341b5f64..5936bfafb1c43 100644
--- a/net/ieee802154/6lowpan/reassembly.c
+++ b/net/ieee802154/6lowpan/reassembly.c
@@ -633,7 +633,7 @@ err_sysctl:
 
 void lowpan_net_frag_exit(void)
 {
-	inet_frags_fini(&lowpan_frags);
 	lowpan_frags_sysctl_unregister();
 	unregister_pernet_subsys(&lowpan_frags_ops);
+	inet_frags_fini(&lowpan_frags);
 }
diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
index 4aed9c45a91ad..3f488555999e3 100644
--- a/net/ipv6/reassembly.c
+++ b/net/ipv6/reassembly.c
@@ -592,8 +592,8 @@ err_protocol:
 
 void ipv6_frag_exit(void)
 {
-	inet_frags_fini(&ip6_frags);
 	ip6_frags_sysctl_unregister();
 	unregister_pernet_subsys(&ip6_frags_ops);
 	inet6_del_protocol(&frag_protocol, IPPROTO_FRAGMENT);
+	inet_frags_fini(&ip6_frags);
 }
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 152/271] media: vivid: fix incorrect assignment operation when setting video mode
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (150 preceding siblings ...)
  2020-01-28 14:05 ` [PATCH 4.9 151/271] inet: frags: call inet_frags_fini() after unregister_pernet_subsys() Greg Kroah-Hartman
@ 2020-01-28 14:05 ` Greg Kroah-Hartman
  2020-01-28 14:05 ` [PATCH 4.9 153/271] powerpc/cacheinfo: add cacheinfo_teardown, cacheinfo_rebuild Greg Kroah-Hartman
                   ` (123 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Colin Ian King, Hans Verkuil,
	Mauro Carvalho Chehab, Sasha Levin

From: Colin Ian King <colin.king@canonical.com>

[ Upstream commit d4ec9550e4b2d2e357a46fdc65d8ef3d4d15984c ]

The assigment of FB_VMODE_NONINTERLACE to var->vmode should be a
bit-wise or of FB_VMODE_NONINTERLACE instead of an assignment,
otherwise the previous clearing of the FB_VMODE_MASK bits of
var->vmode makes no sense and is redundant.

Addresses-Coverity: ("Unused value")
Fixes: ad4e02d5081d ("[media] vivid: add a simple framebuffer device for overlay testing")

Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/vivid/vivid-osd.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/platform/vivid/vivid-osd.c b/drivers/media/platform/vivid/vivid-osd.c
index bdc380b14e0c4..a95b7c56569e3 100644
--- a/drivers/media/platform/vivid/vivid-osd.c
+++ b/drivers/media/platform/vivid/vivid-osd.c
@@ -167,7 +167,7 @@ static int _vivid_fb_check_var(struct fb_var_screeninfo *var, struct vivid_dev *
 	var->nonstd = 0;
 
 	var->vmode &= ~FB_VMODE_MASK;
-	var->vmode = FB_VMODE_NONINTERLACED;
+	var->vmode |= FB_VMODE_NONINTERLACED;
 
 	/* Dummy values */
 	var->hsync_len = 24;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 153/271] powerpc/cacheinfo: add cacheinfo_teardown, cacheinfo_rebuild
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (151 preceding siblings ...)
  2020-01-28 14:05 ` [PATCH 4.9 152/271] media: vivid: fix incorrect assignment operation when setting video mode Greg Kroah-Hartman
@ 2020-01-28 14:05 ` Greg Kroah-Hartman
  2020-01-28 14:05 ` [PATCH 4.9 154/271] drm/msm/mdp5: Fix mdp5_cfg_init error return Greg Kroah-Hartman
                   ` (122 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Nathan Lynch, Gautham R. Shenoy,
	Michael Ellerman, Sasha Levin

From: Nathan Lynch <nathanl@linux.ibm.com>

[ Upstream commit d4aa219a074a5abaf95a756b9f0d190b5c03a945 ]

Allow external callers to force the cacheinfo code to release all its
references to cache nodes, e.g. before processing device tree updates
post-migration, and to rebuild the hierarchy afterward.

CPU online/offline must be blocked by callers; enforce this.

Fixes: 410bccf97881 ("powerpc/pseries: Partition migration in the kernel")
Signed-off-by: Nathan Lynch <nathanl@linux.ibm.com>
Reviewed-by: Gautham R. Shenoy <ego@linux.vnet.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/kernel/cacheinfo.c | 21 +++++++++++++++++++++
 arch/powerpc/kernel/cacheinfo.h |  4 ++++
 2 files changed, 25 insertions(+)

diff --git a/arch/powerpc/kernel/cacheinfo.c b/arch/powerpc/kernel/cacheinfo.c
index c641983bbdd68..0122d5ce0637d 100644
--- a/arch/powerpc/kernel/cacheinfo.c
+++ b/arch/powerpc/kernel/cacheinfo.c
@@ -867,4 +867,25 @@ void cacheinfo_cpu_offline(unsigned int cpu_id)
 	if (cache)
 		cache_cpu_clear(cache, cpu_id);
 }
+
+void cacheinfo_teardown(void)
+{
+	unsigned int cpu;
+
+	lockdep_assert_cpus_held();
+
+	for_each_online_cpu(cpu)
+		cacheinfo_cpu_offline(cpu);
+}
+
+void cacheinfo_rebuild(void)
+{
+	unsigned int cpu;
+
+	lockdep_assert_cpus_held();
+
+	for_each_online_cpu(cpu)
+		cacheinfo_cpu_online(cpu);
+}
+
 #endif /* (CONFIG_PPC_PSERIES && CONFIG_SUSPEND) || CONFIG_HOTPLUG_CPU */
diff --git a/arch/powerpc/kernel/cacheinfo.h b/arch/powerpc/kernel/cacheinfo.h
index a7b74d36acd71..2cdee87a482c5 100644
--- a/arch/powerpc/kernel/cacheinfo.h
+++ b/arch/powerpc/kernel/cacheinfo.h
@@ -5,4 +5,8 @@
 extern void cacheinfo_cpu_online(unsigned int cpu_id);
 extern void cacheinfo_cpu_offline(unsigned int cpu_id);
 
+/* Allow migration/suspend to tear down and rebuild the hierarchy. */
+extern void cacheinfo_teardown(void);
+extern void cacheinfo_rebuild(void);
+
 #endif /* _PPC_CACHEINFO_H */
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 154/271] drm/msm/mdp5: Fix mdp5_cfg_init error return
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (152 preceding siblings ...)
  2020-01-28 14:05 ` [PATCH 4.9 153/271] powerpc/cacheinfo: add cacheinfo_teardown, cacheinfo_rebuild Greg Kroah-Hartman
@ 2020-01-28 14:05 ` Greg Kroah-Hartman
  2020-01-28 14:05 ` [PATCH 4.9 155/271] net: netem: fix backlog accounting for corrupted GSO frames Greg Kroah-Hartman
                   ` (121 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jeffrey Hugo, Bjorn Andersson,
	Rob Clark, Sasha Levin

From: Jeffrey Hugo <jeffrey.l.hugo@gmail.com>

[ Upstream commit fc19cbb785d7bbd1a1af26229b5240a3ab332744 ]

If mdp5_cfg_init fails because of an unknown major version, a null pointer
dereference occurs.  This is because the caller of init expects error
pointers, but init returns NULL on error.  Fix this by returning the
expected values on error.

Fixes: 2e362e1772b8 (drm/msm/mdp5: introduce mdp5_cfg module)
Signed-off-by: Jeffrey Hugo <jeffrey.l.hugo@gmail.com>
Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Rob Clark <robdclark@chromium.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/msm/mdp/mdp5/mdp5_cfg.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_cfg.c b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_cfg.c
index 8b4e3004f4518..86b0448d2ce58 100644
--- a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_cfg.c
+++ b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_cfg.c
@@ -542,7 +542,7 @@ fail:
 	if (cfg_handler)
 		mdp5_cfg_destroy(cfg_handler);
 
-	return NULL;
+	return ERR_PTR(ret);
 }
 
 static struct mdp5_cfg_platform *mdp5_get_config(struct platform_device *dev)
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 155/271] net: netem: fix backlog accounting for corrupted GSO frames
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (153 preceding siblings ...)
  2020-01-28 14:05 ` [PATCH 4.9 154/271] drm/msm/mdp5: Fix mdp5_cfg_init error return Greg Kroah-Hartman
@ 2020-01-28 14:05 ` Greg Kroah-Hartman
  2020-01-28 14:05 ` [PATCH 4.9 156/271] net/af_iucv: always register net_device notifier Greg Kroah-Hartman
                   ` (120 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jakub Kicinski, Dirk van der Merwe,
	Cong Wang, David S. Miller, Sasha Levin

From: Jakub Kicinski <jakub.kicinski@netronome.com>

[ Upstream commit 177b8007463c4f36c9a2c7ce7aa9875a4cad9bd5 ]

When GSO frame has to be corrupted netem uses skb_gso_segment()
to produce the list of frames, and re-enqueues the segments one
by one.  The backlog length has to be adjusted to account for
new frames.

The current calculation is incorrect, leading to wrong backlog
lengths in the parent qdisc (both bytes and packets), and
incorrect packet backlog count in netem itself.

Parent backlog goes negative, netem's packet backlog counts
all non-first segments twice (thus remaining non-zero even
after qdisc is emptied).

Move the variables used to count the adjustment into local
scope to make 100% sure they aren't used at any stage in
backports.

Fixes: 6071bd1aa13e ("netem: Segment GSO packets on enqueue")
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Reviewed-by: Dirk van der Merwe <dirk.vandermerwe@netronome.com>
Acked-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/sched/sch_netem.c | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
index 95002e56fa48b..308d92491757e 100644
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -437,8 +437,7 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch,
 	struct netem_skb_cb *cb;
 	struct sk_buff *skb2;
 	struct sk_buff *segs = NULL;
-	unsigned int len = 0, last_len, prev_len = qdisc_pkt_len(skb);
-	int nb = 0;
+	unsigned int prev_len = qdisc_pkt_len(skb);
 	int count = 1;
 	int rc = NET_XMIT_SUCCESS;
 	int rc_drop = NET_XMIT_DROP;
@@ -495,6 +494,7 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch,
 			segs = netem_segment(skb, sch, to_free);
 			if (!segs)
 				return rc_drop;
+			qdisc_skb_cb(segs)->pkt_len = segs->len;
 		} else {
 			segs = skb;
 		}
@@ -585,6 +585,11 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch,
 
 finish_segs:
 	if (segs) {
+		unsigned int len, last_len;
+		int nb = 0;
+
+		len = skb->len;
+
 		while (segs) {
 			skb2 = segs->next;
 			segs->next = NULL;
@@ -600,9 +605,7 @@ finish_segs:
 			}
 			segs = skb2;
 		}
-		sch->q.qlen += nb;
-		if (nb > 1)
-			qdisc_tree_reduce_backlog(sch, 1 - nb, prev_len - len);
+		qdisc_tree_reduce_backlog(sch, -nb, prev_len - len);
 	}
 	return NET_XMIT_SUCCESS;
 }
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 156/271] net/af_iucv: always register net_device notifier
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (154 preceding siblings ...)
  2020-01-28 14:05 ` [PATCH 4.9 155/271] net: netem: fix backlog accounting for corrupted GSO frames Greg Kroah-Hartman
@ 2020-01-28 14:05 ` Greg Kroah-Hartman
  2020-01-28 14:05 ` [PATCH 4.9 157/271] ASoC: ti: davinci-mcasp: Fix slot mask settings when using multiple AXRs Greg Kroah-Hartman
                   ` (119 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Julian Wiedmann, Ursula Braun,
	David S. Miller, Sasha Levin

From: Julian Wiedmann <jwi@linux.ibm.com>

[ Upstream commit 06996c1d4088a0d5f3e7789d7f96b4653cc947cc ]

Even when running as VM guest (ie pr_iucv != NULL), af_iucv can still
open HiperTransport-based connections. For robust operation these
connections require the af_iucv_netdev_notifier, so register it
unconditionally.

Also handle any error that register_netdevice_notifier() returns.

Fixes: 9fbd87d41392 ("af_iucv: handle netdev events")
Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com>
Reviewed-by: Ursula Braun <ubraun@linux.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/iucv/af_iucv.c | 27 ++++++++++++++++++++-------
 1 file changed, 20 insertions(+), 7 deletions(-)

diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
index c2dfc32eb9f21..02e10deef5b45 100644
--- a/net/iucv/af_iucv.c
+++ b/net/iucv/af_iucv.c
@@ -2431,6 +2431,13 @@ out:
 	return err;
 }
 
+static void afiucv_iucv_exit(void)
+{
+	device_unregister(af_iucv_dev);
+	driver_unregister(&af_iucv_driver);
+	pr_iucv->iucv_unregister(&af_iucv_handler, 0);
+}
+
 static int __init afiucv_init(void)
 {
 	int err;
@@ -2464,11 +2471,18 @@ static int __init afiucv_init(void)
 		err = afiucv_iucv_init();
 		if (err)
 			goto out_sock;
-	} else
-		register_netdevice_notifier(&afiucv_netdev_notifier);
+	}
+
+	err = register_netdevice_notifier(&afiucv_netdev_notifier);
+	if (err)
+		goto out_notifier;
+
 	dev_add_pack(&iucv_packet_type);
 	return 0;
 
+out_notifier:
+	if (pr_iucv)
+		afiucv_iucv_exit();
 out_sock:
 	sock_unregister(PF_IUCV);
 out_proto:
@@ -2482,12 +2496,11 @@ out:
 static void __exit afiucv_exit(void)
 {
 	if (pr_iucv) {
-		device_unregister(af_iucv_dev);
-		driver_unregister(&af_iucv_driver);
-		pr_iucv->iucv_unregister(&af_iucv_handler, 0);
+		afiucv_iucv_exit();
 		symbol_put(iucv_if);
-	} else
-		unregister_netdevice_notifier(&afiucv_netdev_notifier);
+	}
+
+	unregister_netdevice_notifier(&afiucv_netdev_notifier);
 	dev_remove_pack(&iucv_packet_type);
 	sock_unregister(PF_IUCV);
 	proto_unregister(&iucv_proto);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 157/271] ASoC: ti: davinci-mcasp: Fix slot mask settings when using multiple AXRs
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (155 preceding siblings ...)
  2020-01-28 14:05 ` [PATCH 4.9 156/271] net/af_iucv: always register net_device notifier Greg Kroah-Hartman
@ 2020-01-28 14:05 ` Greg Kroah-Hartman
  2020-01-28 14:05 ` [PATCH 4.9 158/271] rtc: pcf8563: Clear event flags and disable interrupts before requesting irq Greg Kroah-Hartman
                   ` (118 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Peter Ujfalusi, Mark Brown, Sasha Levin

From: Peter Ujfalusi <peter.ujfalusi@ti.com>

[ Upstream commit fd14f4436fd47d5418023c90e933e66d3645552e ]

If multiple serializers are connected in the system and the number of
channels will need to use more than one serializer the mask to enable the
serializers were left to 0 if tdm_mask is provided

Fixes: dd55ff8346a97 ("ASoC: davinci-mcasp: Add set_tdm_slots() support")

Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/davinci/davinci-mcasp.c | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/sound/soc/davinci/davinci-mcasp.c b/sound/soc/davinci/davinci-mcasp.c
index 624c209c94981..d1935c5c3602b 100644
--- a/sound/soc/davinci/davinci-mcasp.c
+++ b/sound/soc/davinci/davinci-mcasp.c
@@ -882,14 +882,13 @@ static int mcasp_i2s_hw_param(struct davinci_mcasp *mcasp, int stream,
 		active_slots = hweight32(mcasp->tdm_mask[stream]);
 		active_serializers = (channels + active_slots - 1) /
 			active_slots;
-		if (active_serializers == 1) {
+		if (active_serializers == 1)
 			active_slots = channels;
-			for (i = 0; i < total_slots; i++) {
-				if ((1 << i) & mcasp->tdm_mask[stream]) {
-					mask |= (1 << i);
-					if (--active_slots <= 0)
-						break;
-				}
+		for (i = 0; i < total_slots; i++) {
+			if ((1 << i) & mcasp->tdm_mask[stream]) {
+				mask |= (1 << i);
+				if (--active_slots <= 0)
+					break;
 			}
 		}
 	} else {
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 158/271] rtc: pcf8563: Clear event flags and disable interrupts before requesting irq
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (156 preceding siblings ...)
  2020-01-28 14:05 ` [PATCH 4.9 157/271] ASoC: ti: davinci-mcasp: Fix slot mask settings when using multiple AXRs Greg Kroah-Hartman
@ 2020-01-28 14:05 ` Greg Kroah-Hartman
  2020-01-28 14:05 ` [PATCH 4.9 159/271] drm/msm/a3xx: remove TPL1 regs from snapshot Greg Kroah-Hartman
                   ` (117 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chen-Yu Tsai, Alexandre Belloni, Sasha Levin

From: Chen-Yu Tsai <wens@csie.org>

[ Upstream commit 3572e8aea3bf925dac1dbf86127657c39fe5c254 ]

Besides the alarm, the PCF8563 also has a timer triggered interrupt.
In cases where the previous system left the timer and interrupts on,
or somehow the bits got enabled, the interrupt would keep triggering
as the kernel doesn't know about it.

Clear both the alarm and timer event flags, and disable the interrupts,
before requesting the interrupt line.

Fixes: ede3e9d47cca ("drivers/rtc/rtc-pcf8563.c: add alarm support")
Fixes: a45d528aab8b ("rtc: pcf8563: clear expired alarm at boot time")
Signed-off-by: Chen-Yu Tsai <wens@csie.org>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/rtc/rtc-pcf8563.c | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/drivers/rtc/rtc-pcf8563.c b/drivers/rtc/rtc-pcf8563.c
index a4b8b603c807d..533fb7027f0cc 100644
--- a/drivers/rtc/rtc-pcf8563.c
+++ b/drivers/rtc/rtc-pcf8563.c
@@ -563,7 +563,6 @@ static int pcf8563_probe(struct i2c_client *client,
 	struct pcf8563 *pcf8563;
 	int err;
 	unsigned char buf;
-	unsigned char alm_pending;
 
 	dev_dbg(&client->dev, "%s\n", __func__);
 
@@ -587,13 +586,13 @@ static int pcf8563_probe(struct i2c_client *client,
 		return err;
 	}
 
-	err = pcf8563_get_alarm_mode(client, NULL, &alm_pending);
-	if (err) {
-		dev_err(&client->dev, "%s: read error\n", __func__);
+	/* Clear flags and disable interrupts */
+	buf = 0;
+	err = pcf8563_write_block_data(client, PCF8563_REG_ST2, 1, &buf);
+	if (err < 0) {
+		dev_err(&client->dev, "%s: write error\n", __func__);
 		return err;
 	}
-	if (alm_pending)
-		pcf8563_set_alarm_mode(client, 0);
 
 	pcf8563->rtc = devm_rtc_device_register(&client->dev,
 				pcf8563_driver.driver.name,
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 159/271] drm/msm/a3xx: remove TPL1 regs from snapshot
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (157 preceding siblings ...)
  2020-01-28 14:05 ` [PATCH 4.9 158/271] rtc: pcf8563: Clear event flags and disable interrupts before requesting irq Greg Kroah-Hartman
@ 2020-01-28 14:05 ` Greg Kroah-Hartman
  2020-01-28 14:05 ` [PATCH 4.9 160/271] perf/ioctl: Add check for the sample_period value Greg Kroah-Hartman
                   ` (116 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Rob Clark, Jordan Crouse, Sasha Levin

From: Rob Clark <robdclark@chromium.org>

[ Upstream commit f47bee2ba447bebc304111c16ef1e1a73a9744dd ]

These regs are write-only, and the hw throws a hissy-fit (ie. reboots)
when we try to read them for GPU state snapshot, in response to a GPU
hang.  It is rather impolite when GPU recovery triggers an insta-
reboot, so lets remove the TPL1 registers from the snapshot.

Fixes: 7198e6b03155 drm/msm: add a3xx gpu support
Signed-off-by: Rob Clark <robdclark@chromium.org>
Reviewed-by: Jordan Crouse <jcrouse@codeaurora.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/msm/adreno/a3xx_gpu.c | 24 +++++++++++-------------
 1 file changed, 11 insertions(+), 13 deletions(-)

diff --git a/drivers/gpu/drm/msm/adreno/a3xx_gpu.c b/drivers/gpu/drm/msm/adreno/a3xx_gpu.c
index fd266ed963b6c..25a0e7d133405 100644
--- a/drivers/gpu/drm/msm/adreno/a3xx_gpu.c
+++ b/drivers/gpu/drm/msm/adreno/a3xx_gpu.c
@@ -383,19 +383,17 @@ static const unsigned int a3xx_registers[] = {
 	0x2200, 0x2212, 0x2214, 0x2217, 0x221a, 0x221a, 0x2240, 0x227e,
 	0x2280, 0x228b, 0x22c0, 0x22c0, 0x22c4, 0x22ce, 0x22d0, 0x22d8,
 	0x22df, 0x22e6, 0x22e8, 0x22e9, 0x22ec, 0x22ec, 0x22f0, 0x22f7,
-	0x22ff, 0x22ff, 0x2340, 0x2343, 0x2348, 0x2349, 0x2350, 0x2356,
-	0x2360, 0x2360, 0x2440, 0x2440, 0x2444, 0x2444, 0x2448, 0x244d,
-	0x2468, 0x2469, 0x246c, 0x246d, 0x2470, 0x2470, 0x2472, 0x2472,
-	0x2474, 0x2475, 0x2479, 0x247a, 0x24c0, 0x24d3, 0x24e4, 0x24ef,
-	0x2500, 0x2509, 0x250c, 0x250c, 0x250e, 0x250e, 0x2510, 0x2511,
-	0x2514, 0x2515, 0x25e4, 0x25e4, 0x25ea, 0x25ea, 0x25ec, 0x25ed,
-	0x25f0, 0x25f0, 0x2600, 0x2612, 0x2614, 0x2617, 0x261a, 0x261a,
-	0x2640, 0x267e, 0x2680, 0x268b, 0x26c0, 0x26c0, 0x26c4, 0x26ce,
-	0x26d0, 0x26d8, 0x26df, 0x26e6, 0x26e8, 0x26e9, 0x26ec, 0x26ec,
-	0x26f0, 0x26f7, 0x26ff, 0x26ff, 0x2740, 0x2743, 0x2748, 0x2749,
-	0x2750, 0x2756, 0x2760, 0x2760, 0x300c, 0x300e, 0x301c, 0x301d,
-	0x302a, 0x302a, 0x302c, 0x302d, 0x3030, 0x3031, 0x3034, 0x3036,
-	0x303c, 0x303c, 0x305e, 0x305f,
+	0x22ff, 0x22ff, 0x2340, 0x2343, 0x2440, 0x2440, 0x2444, 0x2444,
+	0x2448, 0x244d, 0x2468, 0x2469, 0x246c, 0x246d, 0x2470, 0x2470,
+	0x2472, 0x2472, 0x2474, 0x2475, 0x2479, 0x247a, 0x24c0, 0x24d3,
+	0x24e4, 0x24ef, 0x2500, 0x2509, 0x250c, 0x250c, 0x250e, 0x250e,
+	0x2510, 0x2511, 0x2514, 0x2515, 0x25e4, 0x25e4, 0x25ea, 0x25ea,
+	0x25ec, 0x25ed, 0x25f0, 0x25f0, 0x2600, 0x2612, 0x2614, 0x2617,
+	0x261a, 0x261a, 0x2640, 0x267e, 0x2680, 0x268b, 0x26c0, 0x26c0,
+	0x26c4, 0x26ce, 0x26d0, 0x26d8, 0x26df, 0x26e6, 0x26e8, 0x26e9,
+	0x26ec, 0x26ec, 0x26f0, 0x26f7, 0x26ff, 0x26ff, 0x2740, 0x2743,
+	0x300c, 0x300e, 0x301c, 0x301d, 0x302a, 0x302a, 0x302c, 0x302d,
+	0x3030, 0x3031, 0x3034, 0x3036, 0x303c, 0x303c, 0x305e, 0x305f,
 	~0   /* sentinel */
 };
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 160/271] perf/ioctl: Add check for the sample_period value
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (158 preceding siblings ...)
  2020-01-28 14:05 ` [PATCH 4.9 159/271] drm/msm/a3xx: remove TPL1 regs from snapshot Greg Kroah-Hartman
@ 2020-01-28 14:05 ` Greg Kroah-Hartman
  2020-01-28 14:05 ` [PATCH 4.9 161/271] dmaengine: hsu: Revert "set HSU_CH_MTSR to memory width" Greg Kroah-Hartman
                   ` (115 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ravi Bangoria, Peter Zijlstra (Intel),
	Alexander Shishkin, Arnaldo Carvalho de Melo, Jiri Olsa,
	Linus Torvalds, Stephane Eranian, Thomas Gleixner, Vince Weaver,
	acme, linuxppc-dev, maddy, mpe, Ingo Molnar, Sasha Levin

From: Ravi Bangoria <ravi.bangoria@linux.ibm.com>

[ Upstream commit 913a90bc5a3a06b1f04c337320e9aeee2328dd77 ]

perf_event_open() limits the sample_period to 63 bits. See:

  0819b2e30ccb ("perf: Limit perf_event_attr::sample_period to 63 bits")

Make ioctl() consistent with it.

Also on PowerPC, negative sample_period could cause a recursive
PMIs leading to a hang (reported when running perf-fuzzer).

Signed-off-by: Ravi Bangoria <ravi.bangoria@linux.ibm.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Stephane Eranian <eranian@google.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Vince Weaver <vincent.weaver@maine.edu>
Cc: acme@kernel.org
Cc: linuxppc-dev@lists.ozlabs.org
Cc: maddy@linux.vnet.ibm.com
Cc: mpe@ellerman.id.au
Fixes: 0819b2e30ccb ("perf: Limit perf_event_attr::sample_period to 63 bits")
Link: https://lkml.kernel.org/r/20190604042953.914-1-ravi.bangoria@linux.ibm.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/events/core.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/kernel/events/core.c b/kernel/events/core.c
index 5bbf7537a6121..64ace5e9af2a0 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -4624,6 +4624,9 @@ static int perf_event_period(struct perf_event *event, u64 __user *arg)
 	if (perf_event_check_period(event, value))
 		return -EINVAL;
 
+	if (!event->attr.freq && (value & (1ULL << 63)))
+		return -EINVAL;
+
 	event_function_call(event, __perf_event_period, &value);
 
 	return 0;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 161/271] dmaengine: hsu: Revert "set HSU_CH_MTSR to memory width"
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (159 preceding siblings ...)
  2020-01-28 14:05 ` [PATCH 4.9 160/271] perf/ioctl: Add check for the sample_period value Greg Kroah-Hartman
@ 2020-01-28 14:05 ` Greg Kroah-Hartman
  2020-01-28 14:05 ` [PATCH 4.9 162/271] clk: qcom: Fix -Wunused-const-variable Greg Kroah-Hartman
                   ` (114 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Andy Shevchenko, Vinod Koul, Sasha Levin

From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>

[ Upstream commit c24a5c735f87d0549060de31367c095e8810b895 ]

The commit

  080edf75d337 ("dmaengine: hsu: set HSU_CH_MTSR to memory width")

has been mistakenly submitted. The further investigations show that
the original code does better job since the memory side transfer size
has never been configured by DMA users.

As per latest revision of documentation: "Channel minimum transfer size
(CHnMTSR)... For IOSF UART, maximum value that can be programmed is 64 and
minimum value that can be programmed is 1."

This reverts commit 080edf75d337d35faa6fc3df99342b10d2848d16.

Fixes: 080edf75d337 ("dmaengine: hsu: set HSU_CH_MTSR to memory width")
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/dma/hsu/hsu.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/dma/hsu/hsu.c b/drivers/dma/hsu/hsu.c
index 29d04ca71d52e..15525a2b8ebd7 100644
--- a/drivers/dma/hsu/hsu.c
+++ b/drivers/dma/hsu/hsu.c
@@ -64,10 +64,10 @@ static void hsu_dma_chan_start(struct hsu_dma_chan *hsuc)
 
 	if (hsuc->direction == DMA_MEM_TO_DEV) {
 		bsr = config->dst_maxburst;
-		mtsr = config->src_addr_width;
+		mtsr = config->dst_addr_width;
 	} else if (hsuc->direction == DMA_DEV_TO_MEM) {
 		bsr = config->src_maxburst;
-		mtsr = config->dst_addr_width;
+		mtsr = config->src_addr_width;
 	}
 
 	hsu_chan_disable(hsuc);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 162/271] clk: qcom: Fix -Wunused-const-variable
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (160 preceding siblings ...)
  2020-01-28 14:05 ` [PATCH 4.9 161/271] dmaengine: hsu: Revert "set HSU_CH_MTSR to memory width" Greg Kroah-Hartman
@ 2020-01-28 14:05 ` Greg Kroah-Hartman
  2020-01-28 14:05 ` [PATCH 4.9 163/271] iommu/amd: Make iommu_disable safer Greg Kroah-Hartman
                   ` (113 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, clang-built-linux, Nathan Chancellor,
	Nathan Huckleberry, Stephen Boyd, Sasha Levin

From: Nathan Huckleberry <nhuck@google.com>

[ Upstream commit da642427bd7710ec4f4140f693f59aa8521a358c ]

Clang produces the following warning

drivers/clk/qcom/gcc-msm8996.c:133:32: warning: unused variable
'gcc_xo_gpll0_gpll2_gpll3_gpll0_early_div_map' [-Wunused-const-variable]
static const struct
parent_map gcc_xo_gpll0_gpll2_gpll3_gpll0_early_div_map[] =
{ ^drivers/clk/qcom/gcc-msm8996.c:141:27: warning: unused variable
'gcc_xo_gpll0_gpll2_gpll3_gpll0_early_div' [-Wunused-const-variable] static
const char * const gcc_xo_gpll0_gpll2_gpll3_gpll0_early_div[] = { ^
drivers/clk/qcom/gcc-msm8996.c:187:32: warning: unused variable
'gcc_xo_gpll0_gpll2_gpll3_gpll1_gpll4_gpll0_early_div_map'
[-Wunused-const-variable] static const struct parent_map
gcc_xo_gpll0_gpll2_gpll3_gpll1_gpll4_gpll0_early_div_map[] = { ^
drivers/clk/qcom/gcc-msm8996.c:197:27: warning: unused variable
'gcc_xo_gpll0_gpll2_gpll3_gpll1_gpll4_gpll0_early_div'
[-Wunused-const-variable] static const char * const
gcc_xo_gpll0_gpll2_gpll3_gpll1_gpll4_gpll0_early_div[] = {

It looks like these were never used.

Fixes: b1e010c0730a ("clk: qcom: Add MSM8996 Global Clock Control (GCC) driver")
Cc: clang-built-linux@googlegroups.com
Link: https://github.com/ClangBuiltLinux/linux/issues/518
Suggested-by: Nathan Chancellor <natechancellor@gmail.com>
Signed-off-by: Nathan Huckleberry <nhuck@google.com>
Reviewed-by: Nathan Chancellor <natechancellor@gmail.com>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/qcom/gcc-msm8996.c | 36 ----------------------------------
 1 file changed, 36 deletions(-)

diff --git a/drivers/clk/qcom/gcc-msm8996.c b/drivers/clk/qcom/gcc-msm8996.c
index fe03e6fbc7df5..ea6c227331fcf 100644
--- a/drivers/clk/qcom/gcc-msm8996.c
+++ b/drivers/clk/qcom/gcc-msm8996.c
@@ -140,22 +140,6 @@ static const char * const gcc_xo_gpll0_gpll4_gpll0_early_div[] = {
 	"gpll0_early_div"
 };
 
-static const struct parent_map gcc_xo_gpll0_gpll2_gpll3_gpll0_early_div_map[] = {
-	{ P_XO, 0 },
-	{ P_GPLL0, 1 },
-	{ P_GPLL2, 2 },
-	{ P_GPLL3, 3 },
-	{ P_GPLL0_EARLY_DIV, 6 }
-};
-
-static const char * const gcc_xo_gpll0_gpll2_gpll3_gpll0_early_div[] = {
-	"xo",
-	"gpll0",
-	"gpll2",
-	"gpll3",
-	"gpll0_early_div"
-};
-
 static const struct parent_map gcc_xo_gpll0_gpll1_early_div_gpll1_gpll4_gpll0_early_div_map[] = {
 	{ P_XO, 0 },
 	{ P_GPLL0, 1 },
@@ -194,26 +178,6 @@ static const char * const gcc_xo_gpll0_gpll2_gpll3_gpll1_gpll2_early_gpll0_early
 	"gpll0_early_div"
 };
 
-static const struct parent_map gcc_xo_gpll0_gpll2_gpll3_gpll1_gpll4_gpll0_early_div_map[] = {
-	{ P_XO, 0 },
-	{ P_GPLL0, 1 },
-	{ P_GPLL2, 2 },
-	{ P_GPLL3, 3 },
-	{ P_GPLL1, 4 },
-	{ P_GPLL4, 5 },
-	{ P_GPLL0_EARLY_DIV, 6 }
-};
-
-static const char * const gcc_xo_gpll0_gpll2_gpll3_gpll1_gpll4_gpll0_early_div[] = {
-	"xo",
-	"gpll0",
-	"gpll2",
-	"gpll3",
-	"gpll1",
-	"gpll4",
-	"gpll0_early_div"
-};
-
 static struct clk_fixed_factor xo = {
 	.mult = 1,
 	.div = 1,
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 163/271] iommu/amd: Make iommu_disable safer
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (161 preceding siblings ...)
  2020-01-28 14:05 ` [PATCH 4.9 162/271] clk: qcom: Fix -Wunused-const-variable Greg Kroah-Hartman
@ 2020-01-28 14:05 ` Greg Kroah-Hartman
  2020-01-28 14:05 ` [PATCH 4.9 164/271] mfd: intel-lpss: Release IDA resources Greg Kroah-Hartman
                   ` (112 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Kevin Mitchell, Joerg Roedel, Sasha Levin

From: Kevin Mitchell <kevmitch@arista.com>

[ Upstream commit 3ddbe913e55516d3e2165d43d4d5570761769878 ]

Make it safe to call iommu_disable during early init error conditions
before mmio_base is set, but after the struct amd_iommu has been added
to the amd_iommu_list. For example, this happens if firmware fails to
fill in mmio_phys in the ACPI table leading to a NULL pointer
dereference in iommu_feature_disable.

Fixes: 2c0ae1720c09c ('iommu/amd: Convert iommu initialization to state machine')
Signed-off-by: Kevin Mitchell <kevmitch@arista.com>
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iommu/amd_iommu_init.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c
index 9bb8d64b6f947..c113e46fdc3ab 100644
--- a/drivers/iommu/amd_iommu_init.c
+++ b/drivers/iommu/amd_iommu_init.c
@@ -383,6 +383,9 @@ static void iommu_enable(struct amd_iommu *iommu)
 
 static void iommu_disable(struct amd_iommu *iommu)
 {
+	if (!iommu->mmio_base)
+		return;
+
 	/* Disable command buffer */
 	iommu_feature_disable(iommu, CONTROL_CMDBUF_EN);
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 164/271] mfd: intel-lpss: Release IDA resources
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (162 preceding siblings ...)
  2020-01-28 14:05 ` [PATCH 4.9 163/271] iommu/amd: Make iommu_disable safer Greg Kroah-Hartman
@ 2020-01-28 14:05 ` Greg Kroah-Hartman
  2020-01-28 14:05 ` [PATCH 4.9 165/271] rxrpc: Fix uninitialized error code in rxrpc_send_data_packet() Greg Kroah-Hartman
                   ` (111 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Andy Shevchenko, Lee Jones, Sasha Levin

From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>

[ Upstream commit 02f36911c1b41fcd8779fa0c135aab0554333fa5 ]

ida instances allocate some internal memory for ->free_bitmap
in addition to the base 'struct ida'. Use ida_destroy() to release
that memory at module_exit().

Fixes: 4b45efe85263 ("mfd: Add support for Intel Sunrisepoint LPSS devices")
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mfd/intel-lpss.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/mfd/intel-lpss.c b/drivers/mfd/intel-lpss.c
index 22dd8c055048c..71cecd7aeea0c 100644
--- a/drivers/mfd/intel-lpss.c
+++ b/drivers/mfd/intel-lpss.c
@@ -533,6 +533,7 @@ module_init(intel_lpss_init);
 
 static void __exit intel_lpss_exit(void)
 {
+	ida_destroy(&intel_lpss_devid_ida);
 	debugfs_remove(intel_lpss_debugfs);
 }
 module_exit(intel_lpss_exit);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 165/271] rxrpc: Fix uninitialized error code in rxrpc_send_data_packet()
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (163 preceding siblings ...)
  2020-01-28 14:05 ` [PATCH 4.9 164/271] mfd: intel-lpss: Release IDA resources Greg Kroah-Hartman
@ 2020-01-28 14:05 ` Greg Kroah-Hartman
  2020-01-28 14:05 ` [PATCH 4.9 166/271] devres: allow const resource arguments Greg Kroah-Hartman
                   ` (110 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Geert Uytterhoeven, David Howells,
	David S. Miller, Sasha Levin

From: David Howells <dhowells@redhat.com>

[ Upstream commit 3427beb6375d04e9627c67343872e79341a684ea ]

With gcc 4.1:

    net/rxrpc/output.c: In function ‘rxrpc_send_data_packet’:
    net/rxrpc/output.c:338: warning: ‘ret’ may be used uninitialized in this function

Indeed, if the first jump to the send_fragmentable label is made, and
the address family is not handled in the switch() statement, ret will be
used uninitialized.

Fix this by BUG()'ing as is done in other places in rxrpc where internal
support for future address families will need adding.  It should not be
possible to reach this normally as the address families are checked
up-front.

Fixes: 5a924b8951f835b5 ("rxrpc: Don't store the rxrpc header in the Tx queue sk_buffs")
Reported-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/rxrpc/output.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/rxrpc/output.c b/net/rxrpc/output.c
index 59d3286033120..64389f493bb28 100644
--- a/net/rxrpc/output.c
+++ b/net/rxrpc/output.c
@@ -400,6 +400,9 @@ send_fragmentable:
 		}
 		break;
 #endif
+
+	default:
+		BUG();
 	}
 
 	up_write(&conn->params.local->defrag_sem);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 166/271] devres: allow const resource arguments
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (164 preceding siblings ...)
  2020-01-28 14:05 ` [PATCH 4.9 165/271] rxrpc: Fix uninitialized error code in rxrpc_send_data_packet() Greg Kroah-Hartman
@ 2020-01-28 14:05 ` Greg Kroah-Hartman
  2020-01-28 14:05 ` [PATCH 4.9 167/271] RDMA/hns: Fixs hw access invalid dma memory error Greg Kroah-Hartman
                   ` (109 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Arnd Bergmann, Linus Walleij,
	Sasha Levin, Enrico Weigelt

From: Arnd Bergmann <arnd@arndb.de>

[ Upstream commit 9dea44c91469512d346e638694c22c30a5273992 ]

devm_ioremap_resource() does not currently take 'const' arguments,
which results in a warning from the first driver trying to do it
anyway:

drivers/gpio/gpio-amd-fch.c: In function 'amd_fch_gpio_probe':
drivers/gpio/gpio-amd-fch.c:171:49: error: passing argument 2 of 'devm_ioremap_resource' discards 'const' qualifier from pointer target type [-Werror=discarded-qualifiers]
  priv->base = devm_ioremap_resource(&pdev->dev, &amd_fch_gpio_iores);
                                                 ^~~~~~~~~~~~~~~~~~~

Change the prototype to allow it, as there is no real reason not to.

Fixes: 9bb2e0452508 ("gpio: amd: Make resource struct const")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Link: https://lore.kernel.org/r/20190628150049.1108048-1-arnd@arndb.de
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Reviwed-By: Enrico Weigelt <info@metux.net>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/device.h | 3 ++-
 lib/devres.c           | 3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/include/linux/device.h b/include/linux/device.h
index 8d732965fab77..eb865b461acc4 100644
--- a/include/linux/device.h
+++ b/include/linux/device.h
@@ -682,7 +682,8 @@ extern unsigned long devm_get_free_pages(struct device *dev,
 					 gfp_t gfp_mask, unsigned int order);
 extern void devm_free_pages(struct device *dev, unsigned long addr);
 
-void __iomem *devm_ioremap_resource(struct device *dev, struct resource *res);
+void __iomem *devm_ioremap_resource(struct device *dev,
+				    const struct resource *res);
 
 /* allows to add/remove a custom action to devres stack */
 int devm_add_action(struct device *dev, void (*action)(void *), void *data);
diff --git a/lib/devres.c b/lib/devres.c
index cb1464c411a2b..38912892053c0 100644
--- a/lib/devres.c
+++ b/lib/devres.c
@@ -131,7 +131,8 @@ EXPORT_SYMBOL(devm_iounmap);
  *	if (IS_ERR(base))
  *		return PTR_ERR(base);
  */
-void __iomem *devm_ioremap_resource(struct device *dev, struct resource *res)
+void __iomem *devm_ioremap_resource(struct device *dev,
+				    const struct resource *res)
 {
 	resource_size_t size;
 	const char *name;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 167/271] RDMA/hns: Fixs hw access invalid dma memory error
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (165 preceding siblings ...)
  2020-01-28 14:05 ` [PATCH 4.9 166/271] devres: allow const resource arguments Greg Kroah-Hartman
@ 2020-01-28 14:05 ` Greg Kroah-Hartman
  2020-01-28 14:05 ` [PATCH 4.9 168/271] net: pasemi: fix an use-after-free in pasemi_mac_phy_init() Greg Kroah-Hartman
                   ` (108 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Xi Wang, Jason Gunthorpe, Sasha Levin

From: Xi Wang <wangxi11@huawei.com>

[ Upstream commit ec5bc2cc69b4fc494e04d10fc5226f6f9cf67c56 ]

When smmu is enable, if execute the perftest command and then use 'kill
-9' to exit, follow this operation repeatedly, the kernel will have a high
probability to print the following smmu event:

  arm-smmu-v3 arm-smmu-v3.1.auto: event 0x10 received:
  arm-smmu-v3 arm-smmu-v3.1.auto:  0x00007d0000000010
  arm-smmu-v3 arm-smmu-v3.1.auto:  0x0000020900000080
  arm-smmu-v3 arm-smmu-v3.1.auto:  0x00000000f47cf000
  arm-smmu-v3 arm-smmu-v3.1.auto:  0x00000000f47cf000

This is because the hw will periodically refresh the qpc cache until the
next reset.

This patch fixed it by removing the action that release qpc memory in the
'hns_roce_qp_free' function.

Fixes: 9a4435375cd1 ("IB/hns: Add driver files for hns RoCE driver")
Signed-off-by: Xi Wang <wangxi11@huawei.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/hw/hns/hns_roce_qp.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/infiniband/hw/hns/hns_roce_qp.c b/drivers/infiniband/hw/hns/hns_roce_qp.c
index 33cf1035030b5..6f3c0ea99dd05 100644
--- a/drivers/infiniband/hw/hns/hns_roce_qp.c
+++ b/drivers/infiniband/hw/hns/hns_roce_qp.c
@@ -241,7 +241,6 @@ void hns_roce_qp_free(struct hns_roce_dev *hr_dev, struct hns_roce_qp *hr_qp)
 
 	if ((hr_qp->ibqp.qp_type) != IB_QPT_GSI) {
 		hns_roce_table_put(hr_dev, &qp_table->irrl_table, hr_qp->qpn);
-		hns_roce_table_put(hr_dev, &qp_table->qp_table, hr_qp->qpn);
 	}
 }
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 168/271] net: pasemi: fix an use-after-free in pasemi_mac_phy_init()
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (166 preceding siblings ...)
  2020-01-28 14:05 ` [PATCH 4.9 167/271] RDMA/hns: Fixs hw access invalid dma memory error Greg Kroah-Hartman
@ 2020-01-28 14:05 ` Greg Kroah-Hartman
  2020-01-28 14:05 ` [PATCH 4.9 169/271] scsi: libfc: fix null pointer dereference on a null lport Greg Kroah-Hartman
                   ` (107 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Wen Yang, David S. Miller,
	Thomas Gleixner, Luis Chamberlain, Michael Ellerman, netdev,
	Sasha Levin

From: Wen Yang <wen.yang99@zte.com.cn>

[ Upstream commit faf5577f2498cea23011b5c785ef853ded22700b ]

The phy_dn variable is still being used in of_phy_connect() after the
of_node_put() call, which may result in use-after-free.

Fixes: 1dd2d06c0459 ("net: Rework pasemi_mac driver to use of_mdio infrastructure")
Signed-off-by: Wen Yang <wen.yang99@zte.com.cn>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Luis Chamberlain <mcgrof@kernel.org>
Cc: Michael Ellerman <mpe@ellerman.id.au>
Cc: netdev@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/pasemi/pasemi_mac.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/pasemi/pasemi_mac.c b/drivers/net/ethernet/pasemi/pasemi_mac.c
index 2f4a837f0d6ad..dcd56ac687482 100644
--- a/drivers/net/ethernet/pasemi/pasemi_mac.c
+++ b/drivers/net/ethernet/pasemi/pasemi_mac.c
@@ -1053,7 +1053,6 @@ static int pasemi_mac_phy_init(struct net_device *dev)
 
 	dn = pci_device_to_OF_node(mac->pdev);
 	phy_dn = of_parse_phandle(dn, "phy-handle", 0);
-	of_node_put(phy_dn);
 
 	mac->link = 0;
 	mac->speed = 0;
@@ -1062,6 +1061,7 @@ static int pasemi_mac_phy_init(struct net_device *dev)
 	phydev = of_phy_connect(dev, phy_dn, &pasemi_adjust_link, 0,
 				PHY_INTERFACE_MODE_SGMII);
 
+	of_node_put(phy_dn);
 	if (!phydev) {
 		printk(KERN_ERR "%s: Could not attach to phy\n", dev->name);
 		return -ENODEV;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 169/271] scsi: libfc: fix null pointer dereference on a null lport
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (167 preceding siblings ...)
  2020-01-28 14:05 ` [PATCH 4.9 168/271] net: pasemi: fix an use-after-free in pasemi_mac_phy_init() Greg Kroah-Hartman
@ 2020-01-28 14:05 ` Greg Kroah-Hartman
  2020-01-28 14:05 ` [PATCH 4.9 170/271] libertas_tf: Use correct channel range in lbtf_geo_init Greg Kroah-Hartman
                   ` (106 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Colin Ian King, Hannes Reinecke,
	Martin K. Petersen, Sasha Levin

From: Colin Ian King <colin.king@canonical.com>

[ Upstream commit 41a6bf6529edd10a6def42e3b2c34a7474bcc2f5 ]

Currently if lport is null then the null lport pointer is dereference when
printing out debug via the FC_LPORT_DB macro. Fix this by using the more
generic FC_LIBFC_DBG debug macro instead that does not use lport.

Addresses-Coverity: ("Dereference after null check")
Fixes: 7414705ea4ae ("libfc: Add runtime debugging with debug_logging module parameter")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/libfc/fc_exch.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/scsi/libfc/fc_exch.c b/drivers/scsi/libfc/fc_exch.c
index 16ca31ad5ec0a..d0a86ef806522 100644
--- a/drivers/scsi/libfc/fc_exch.c
+++ b/drivers/scsi/libfc/fc_exch.c
@@ -2506,7 +2506,7 @@ void fc_exch_recv(struct fc_lport *lport, struct fc_frame *fp)
 
 	/* lport lock ? */
 	if (!lport || lport->state == LPORT_ST_DISABLED) {
-		FC_LPORT_DBG(lport, "Receiving frames for an lport that "
+		FC_LIBFC_DBG("Receiving frames for an lport that "
 			     "has not been initialized correctly\n");
 		fc_frame_free(fp);
 		return;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 170/271] libertas_tf: Use correct channel range in lbtf_geo_init
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (168 preceding siblings ...)
  2020-01-28 14:05 ` [PATCH 4.9 169/271] scsi: libfc: fix null pointer dereference on a null lport Greg Kroah-Hartman
@ 2020-01-28 14:05 ` Greg Kroah-Hartman
  2020-01-28 14:05 ` [PATCH 4.9 171/271] qed: reduce maximum stack frame size Greg Kroah-Hartman
                   ` (105 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, YueHaibing, Kalle Valo,
	Sasha Levin

From: YueHaibing <yuehaibing@huawei.com>

[ Upstream commit 2ec4ad49b98e4a14147d04f914717135eca7c8b1 ]

It seems we should use 'range' instead of 'priv->range'
in lbtf_geo_init(), because 'range' is the corret one
related to current regioncode.

Reported-by: Hulk Robot <hulkci@huawei.com>
Fixes: 691cdb49388b ("libertas_tf: command helper functions for libertas_tf")
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/marvell/libertas_tf/cmd.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/marvell/libertas_tf/cmd.c b/drivers/net/wireless/marvell/libertas_tf/cmd.c
index 909ac3685010f..2b193f1257a5a 100644
--- a/drivers/net/wireless/marvell/libertas_tf/cmd.c
+++ b/drivers/net/wireless/marvell/libertas_tf/cmd.c
@@ -69,7 +69,7 @@ static void lbtf_geo_init(struct lbtf_private *priv)
 			break;
 		}
 
-	for (ch = priv->range.start; ch < priv->range.end; ch++)
+	for (ch = range->start; ch < range->end; ch++)
 		priv->channels[CHAN_TO_IDX(ch)].flags = 0;
 }
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 171/271] qed: reduce maximum stack frame size
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (169 preceding siblings ...)
  2020-01-28 14:05 ` [PATCH 4.9 170/271] libertas_tf: Use correct channel range in lbtf_geo_init Greg Kroah-Hartman
@ 2020-01-28 14:05 ` Greg Kroah-Hartman
  2020-01-28 14:05 ` [PATCH 4.9 172/271] usb: host: xhci-hub: fix extra endianness conversion Greg Kroah-Hartman
                   ` (104 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Arnd Bergmann, David S. Miller, Sasha Levin

From: Arnd Bergmann <arnd@arndb.de>

[ Upstream commit 7c116e02a4a7575c8c62bfd2106e3e3ec8fb99dc ]

clang warns about an overly large stack frame in one function
when it decides to inline all __qed_get_vport_*() functions into
__qed_get_vport_stats():

drivers/net/ethernet/qlogic/qed/qed_l2.c:1889:13: error: stack frame size of 1128 bytes in function '_qed_get_vport_stats' [-Werror,-Wframe-larger-than=]

Use a noinline_for_stack annotation to prevent clang from inlining
these, which keeps the maximum stack usage at around half of that
in the worst case, similar to what we get with gcc.

Fixes: 86622ee75312 ("qed: Move statistics to L2 code")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/qlogic/qed/qed_l2.c | 34 +++++++++++-------------
 1 file changed, 15 insertions(+), 19 deletions(-)

diff --git a/drivers/net/ethernet/qlogic/qed/qed_l2.c b/drivers/net/ethernet/qlogic/qed/qed_l2.c
index 715776e2cfe50..2d198f6ee21d9 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_l2.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_l2.c
@@ -1328,10 +1328,9 @@ static void __qed_get_vport_pstats_addrlen(struct qed_hwfn *p_hwfn,
 	}
 }
 
-static void __qed_get_vport_pstats(struct qed_hwfn *p_hwfn,
-				   struct qed_ptt *p_ptt,
-				   struct qed_eth_stats *p_stats,
-				   u16 statistics_bin)
+static noinline_for_stack void
+__qed_get_vport_pstats(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt,
+		       struct qed_eth_stats *p_stats, u16 statistics_bin)
 {
 	struct eth_pstorm_per_queue_stat pstats;
 	u32 pstats_addr = 0, pstats_len = 0;
@@ -1351,10 +1350,9 @@ static void __qed_get_vport_pstats(struct qed_hwfn *p_hwfn,
 	p_stats->tx_err_drop_pkts += HILO_64_REGPAIR(pstats.error_drop_pkts);
 }
 
-static void __qed_get_vport_tstats(struct qed_hwfn *p_hwfn,
-				   struct qed_ptt *p_ptt,
-				   struct qed_eth_stats *p_stats,
-				   u16 statistics_bin)
+static noinline_for_stack void
+__qed_get_vport_tstats(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt,
+		       struct qed_eth_stats *p_stats, u16 statistics_bin)
 {
 	struct tstorm_per_port_stat tstats;
 	u32 tstats_addr, tstats_len;
@@ -1397,10 +1395,9 @@ static void __qed_get_vport_ustats_addrlen(struct qed_hwfn *p_hwfn,
 	}
 }
 
-static void __qed_get_vport_ustats(struct qed_hwfn *p_hwfn,
-				   struct qed_ptt *p_ptt,
-				   struct qed_eth_stats *p_stats,
-				   u16 statistics_bin)
+static noinline_for_stack
+void __qed_get_vport_ustats(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt,
+			    struct qed_eth_stats *p_stats, u16 statistics_bin)
 {
 	struct eth_ustorm_per_queue_stat ustats;
 	u32 ustats_addr = 0, ustats_len = 0;
@@ -1436,10 +1433,9 @@ static void __qed_get_vport_mstats_addrlen(struct qed_hwfn *p_hwfn,
 	}
 }
 
-static void __qed_get_vport_mstats(struct qed_hwfn *p_hwfn,
-				   struct qed_ptt *p_ptt,
-				   struct qed_eth_stats *p_stats,
-				   u16 statistics_bin)
+static noinline_for_stack void
+__qed_get_vport_mstats(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt,
+		       struct qed_eth_stats *p_stats, u16 statistics_bin)
 {
 	struct eth_mstorm_per_queue_stat mstats;
 	u32 mstats_addr = 0, mstats_len = 0;
@@ -1463,9 +1459,9 @@ static void __qed_get_vport_mstats(struct qed_hwfn *p_hwfn,
 		HILO_64_REGPAIR(mstats.tpa_coalesced_bytes);
 }
 
-static void __qed_get_vport_port_stats(struct qed_hwfn *p_hwfn,
-				       struct qed_ptt *p_ptt,
-				       struct qed_eth_stats *p_stats)
+static noinline_for_stack void
+__qed_get_vport_port_stats(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt,
+			   struct qed_eth_stats *p_stats)
 {
 	struct port_stats port_stats;
 	int j;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 172/271] usb: host: xhci-hub: fix extra endianness conversion
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (170 preceding siblings ...)
  2020-01-28 14:05 ` [PATCH 4.9 171/271] qed: reduce maximum stack frame size Greg Kroah-Hartman
@ 2020-01-28 14:05 ` Greg Kroah-Hartman
  2020-01-28 14:05 ` [PATCH 4.9 173/271] mic: avoid statically declaring a struct device Greg Kroah-Hartman
                   ` (103 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Mathias Nyman, Ruslan Bilovol, Sasha Levin

From: Ruslan Bilovol <ruslan.bilovol@gmail.com>

[ Upstream commit 6269e4c76eacabaea0d0099200ae1a455768d208 ]

Don't do extra cpu_to_le32 conversion for
put_unaligned_le32 because it is already implemented
in this function.

Fixes sparse error:
xhci-hub.c:1152:44: warning: incorrect type in argument 1 (different base types)
xhci-hub.c:1152:44:    expected unsigned int [usertype] val
xhci-hub.c:1152:44:    got restricted __le32 [usertype]

Fixes: 395f540 "xhci: support new USB 3.1 hub request to get extended port status"
Cc: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Ruslan Bilovol <ruslan.bilovol@gmail.com>
Link: https://lore.kernel.org/r/1562501839-26522-1-git-send-email-ruslan.bilovol@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/host/xhci-hub.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
index 5cf5f3d9c1e59..04d36fa607342 100644
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -989,7 +989,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
 			}
 			port_li = readl(port_array[wIndex] + PORTLI);
 			status = xhci_get_ext_port_status(temp, port_li);
-			put_unaligned_le32(cpu_to_le32(status), &buf[4]);
+			put_unaligned_le32(status, &buf[4]);
 		}
 		break;
 	case SetPortFeature:
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 173/271] mic: avoid statically declaring a struct device.
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (171 preceding siblings ...)
  2020-01-28 14:05 ` [PATCH 4.9 172/271] usb: host: xhci-hub: fix extra endianness conversion Greg Kroah-Hartman
@ 2020-01-28 14:05 ` Greg Kroah-Hartman
  2020-01-28 14:05 ` [PATCH 4.9 174/271] x86/kgbd: Use NMI_VECTOR not APIC_DM_NMI Greg Kroah-Hartman
                   ` (102 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:05 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Arnd Bergmann, Sasha Levin

From: Arnd Bergmann <arnd@arndb.de>

[ Upstream commit bc83f79bd2119230888fb8574639d5a51b38f903 ]

Generally, declaring a platform device as a static variable is
a bad idea and can cause all kinds of problems, in particular
with the DMA configuration and lifetime rules.

A specific problem we hit here is from a bug in clang that warns
about certain (otherwise valid) macros when used in static variables:

drivers/misc/mic/card/mic_x100.c:285:27: warning: shift count >= width of type [-Wshift-count-overflow]
static u64 mic_dma_mask = DMA_BIT_MASK(64);
                          ^~~~~~~~~~~~~~~~
include/linux/dma-mapping.h:141:54: note: expanded from macro 'DMA_BIT_MASK'
 #define DMA_BIT_MASK(n) (((n) == 64) ? ~0ULL : ((1ULL<<(n))-1))
                                                     ^ ~~~

A slightly better way here is to create the platform device dynamically
and set the dma mask in the probe function.
This avoids the warning and some other problems, but is still not ideal
because the device creation should really be separated from the driver,
and the fact that the device has no parent means we have to force
the dma mask rather than having it set up from the bus that the device
is actually on.

Fixes: dd8d8d44df64 ("misc: mic: MIC card driver specific changes to enable SCIF")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Link: https://lore.kernel.org/r/20190712092426.872625-1-arnd@arndb.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/misc/mic/card/mic_x100.c | 28 ++++++++++++----------------
 1 file changed, 12 insertions(+), 16 deletions(-)

diff --git a/drivers/misc/mic/card/mic_x100.c b/drivers/misc/mic/card/mic_x100.c
index b9f0710ffa6b0..4007adc666f37 100644
--- a/drivers/misc/mic/card/mic_x100.c
+++ b/drivers/misc/mic/card/mic_x100.c
@@ -249,6 +249,9 @@ static int __init mic_probe(struct platform_device *pdev)
 	mdrv->dev = &pdev->dev;
 	snprintf(mdrv->name, sizeof(mic_driver_name), mic_driver_name);
 
+	/* FIXME: use dma_set_mask_and_coherent() and check result */
+	dma_coerce_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(64));
+
 	mdev->mmio.pa = MIC_X100_MMIO_BASE;
 	mdev->mmio.len = MIC_X100_MMIO_LEN;
 	mdev->mmio.va = devm_ioremap(&pdev->dev, MIC_X100_MMIO_BASE,
@@ -294,18 +297,6 @@ static void mic_platform_shutdown(struct platform_device *pdev)
 	mic_remove(pdev);
 }
 
-static u64 mic_dma_mask = DMA_BIT_MASK(64);
-
-static struct platform_device mic_platform_dev = {
-	.name = mic_driver_name,
-	.id   = 0,
-	.num_resources = 0,
-	.dev = {
-		.dma_mask = &mic_dma_mask,
-		.coherent_dma_mask = DMA_BIT_MASK(64),
-	},
-};
-
 static struct platform_driver __refdata mic_platform_driver = {
 	.probe = mic_probe,
 	.remove = mic_remove,
@@ -315,6 +306,8 @@ static struct platform_driver __refdata mic_platform_driver = {
 	},
 };
 
+static struct platform_device *mic_platform_dev;
+
 static int __init mic_init(void)
 {
 	int ret;
@@ -328,9 +321,12 @@ static int __init mic_init(void)
 
 	request_module("mic_x100_dma");
 	mic_init_card_debugfs();
-	ret = platform_device_register(&mic_platform_dev);
+
+	mic_platform_dev = platform_device_register_simple(mic_driver_name,
+							   0, NULL, 0);
+	ret = PTR_ERR_OR_ZERO(mic_platform_dev);
 	if (ret) {
-		pr_err("platform_device_register ret %d\n", ret);
+		pr_err("platform_device_register_full ret %d\n", ret);
 		goto cleanup_debugfs;
 	}
 	ret = platform_driver_register(&mic_platform_driver);
@@ -341,7 +337,7 @@ static int __init mic_init(void)
 	return ret;
 
 device_unregister:
-	platform_device_unregister(&mic_platform_dev);
+	platform_device_unregister(mic_platform_dev);
 cleanup_debugfs:
 	mic_exit_card_debugfs();
 done:
@@ -351,7 +347,7 @@ done:
 static void __exit mic_exit(void)
 {
 	platform_driver_unregister(&mic_platform_driver);
-	platform_device_unregister(&mic_platform_dev);
+	platform_device_unregister(mic_platform_dev);
 	mic_exit_card_debugfs();
 }
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 174/271] x86/kgbd: Use NMI_VECTOR not APIC_DM_NMI
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (172 preceding siblings ...)
  2020-01-28 14:05 ` [PATCH 4.9 173/271] mic: avoid statically declaring a struct device Greg Kroah-Hartman
@ 2020-01-28 14:05 ` Greg Kroah-Hartman
  2020-01-28 14:05 ` [PATCH 4.9 175/271] ALSA: aoa: onyx: always initialize register read value Greg Kroah-Hartman
                   ` (101 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Thomas Gleixner,
	Peter Zijlstra (Intel),
	Sasha Levin

From: Thomas Gleixner <tglx@linutronix.de>

[ Upstream commit 2591bc4e8d70b4e1330d327fb7e3921f4e070a51 ]

apic->send_IPI_allbutself() takes a vector number as argument.

APIC_DM_NMI is clearly not a vector number. It's defined to 0x400 which is
outside the vector space.

Use NMI_VECTOR instead as that's what it is intended to be.

Fixes: 82da3ff89dc2 ("x86: kgdb support")
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/20190722105218.855189979@linutronix.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/kernel/kgdb.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/kernel/kgdb.c b/arch/x86/kernel/kgdb.c
index 8e36f249646e2..904e18bb38c52 100644
--- a/arch/x86/kernel/kgdb.c
+++ b/arch/x86/kernel/kgdb.c
@@ -438,7 +438,7 @@ static void kgdb_disable_hw_debug(struct pt_regs *regs)
  */
 void kgdb_roundup_cpus(unsigned long flags)
 {
-	apic->send_IPI_allbutself(APIC_DM_NMI);
+	apic->send_IPI_allbutself(NMI_VECTOR);
 }
 #endif
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 175/271] ALSA: aoa: onyx: always initialize register read value
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (173 preceding siblings ...)
  2020-01-28 14:05 ` [PATCH 4.9 174/271] x86/kgbd: Use NMI_VECTOR not APIC_DM_NMI Greg Kroah-Hartman
@ 2020-01-28 14:05 ` Greg Kroah-Hartman
  2020-01-28 14:05 ` [PATCH 4.9 176/271] net/mlx5: Fix mlx5_ifc_query_lag_out_bits Greg Kroah-Hartman
                   ` (100 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Stephen Rothwell, Johannes Berg,
	Takashi Iwai, Sasha Levin

From: Johannes Berg <johannes@sipsolutions.net>

[ Upstream commit f474808acb3c4b30552d9c59b181244e0300d218 ]

A lot of places in the driver use onyx_read_register() without
checking the return value, and it's been working OK for ~10 years
or so, so probably never fails ... Rather than trying to check the
return value everywhere, which would be relatively intrusive, at
least make sure we don't use an uninitialized value.

Fixes: f3d9478b2ce4 ("[ALSA] snd-aoa: add snd-aoa")
Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/aoa/codecs/onyx.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/sound/aoa/codecs/onyx.c b/sound/aoa/codecs/onyx.c
index a04edff8b729e..ae50d59fb810f 100644
--- a/sound/aoa/codecs/onyx.c
+++ b/sound/aoa/codecs/onyx.c
@@ -74,8 +74,10 @@ static int onyx_read_register(struct onyx *onyx, u8 reg, u8 *value)
 		return 0;
 	}
 	v = i2c_smbus_read_byte_data(onyx->i2c, reg);
-	if (v < 0)
+	if (v < 0) {
+		*value = 0;
 		return -1;
+	}
 	*value = (u8)v;
 	onyx->cache[ONYX_REG_CONTROL-FIRSTREGISTER] = *value;
 	return 0;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 176/271] net/mlx5: Fix mlx5_ifc_query_lag_out_bits
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (174 preceding siblings ...)
  2020-01-28 14:05 ` [PATCH 4.9 175/271] ALSA: aoa: onyx: always initialize register read value Greg Kroah-Hartman
@ 2020-01-28 14:05 ` Greg Kroah-Hartman
  2020-01-28 14:05 ` [PATCH 4.9 177/271] cifs: fix rmmod regression in cifs.ko caused by force_sig changes Greg Kroah-Hartman
                   ` (99 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Mark Zhang, Yishai Hadas,
	Leon Romanovsky, Sasha Levin

From: Mark Zhang <markz@mellanox.com>

[ Upstream commit ea77388b02270b0af8dc57f668f311235ea068f0 ]

Remove the "reserved_at_40" field to match the device specification.

Fixes: 84df61ebc69b ("net/mlx5: Add HW interfaces used by LAG")
Signed-off-by: Mark Zhang <markz@mellanox.com>
Reviewed-by: Yishai Hadas <yishaih@mellanox.com>
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/mlx5/mlx5_ifc.h | 2 --
 1 file changed, 2 deletions(-)

diff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h
index 20ee90c47cd50..6dd276227217e 100644
--- a/include/linux/mlx5/mlx5_ifc.h
+++ b/include/linux/mlx5/mlx5_ifc.h
@@ -7909,8 +7909,6 @@ struct mlx5_ifc_query_lag_out_bits {
 
 	u8         syndrome[0x20];
 
-	u8         reserved_at_40[0x40];
-
 	struct mlx5_ifc_lagc_bits ctx;
 };
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 177/271] cifs: fix rmmod regression in cifs.ko caused by force_sig changes
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (175 preceding siblings ...)
  2020-01-28 14:05 ` [PATCH 4.9 176/271] net/mlx5: Fix mlx5_ifc_query_lag_out_bits Greg Kroah-Hartman
@ 2020-01-28 14:05 ` Greg Kroah-Hartman
  2020-01-28 14:05 ` [PATCH 4.9 178/271] crypto: caam - free resources in case caam_rng registration failed Greg Kroah-Hartman
                   ` (98 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Steve French, Ronnie Sahlberg,
	Eric W. Biederman, Sasha Levin

From: Steve French <stfrench@microsoft.com>

[ Upstream commit 247bc9470b1eeefc7b58cdf2c39f2866ba651509 ]

Fixes: 72abe3bcf091 ("signal/cifs: Fix cifs_put_tcp_session to call send_sig instead of force_sig")

The global change from force_sig caused module unloading of cifs.ko
to fail (since the cifsd process could not be killed, "rmmod cifs"
now would always fail)

Signed-off-by: Steve French <stfrench@microsoft.com>
Reviewed-by: Ronnie Sahlberg <lsahlber@redhat.com>
CC: Eric W. Biederman <ebiederm@xmission.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/cifs/connect.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index 110febd697379..7d46025d5e899 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -885,6 +885,7 @@ cifs_demultiplex_thread(void *p)
 		mempool_resize(cifs_req_poolp, length + cifs_min_rcv);
 
 	set_freezable();
+	allow_signal(SIGKILL);
 	while (server->tcpStatus != CifsExiting) {
 		if (try_to_freeze())
 			continue;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 178/271] crypto: caam - free resources in case caam_rng registration failed
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (176 preceding siblings ...)
  2020-01-28 14:05 ` [PATCH 4.9 177/271] cifs: fix rmmod regression in cifs.ko caused by force_sig changes Greg Kroah-Hartman
@ 2020-01-28 14:05 ` Greg Kroah-Hartman
  2020-01-28 14:05 ` [PATCH 4.9 179/271] ext4: set error return correctly when ext4_htree_store_dirent fails Greg Kroah-Hartman
                   ` (97 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Iuliana Prodan, Horia Geanta,
	Herbert Xu, Sasha Levin

From: Iuliana Prodan <iuliana.prodan@nxp.com>

[ Upstream commit c59a1d41672a89b5cac49db1a472ff889e35a2d2 ]

Check the return value of the hardware registration for caam_rng and free
resources in case of failure.

Fixes: e24f7c9e87d4 ("crypto: caam - hwrng support")
Signed-off-by: Iuliana Prodan <iuliana.prodan@nxp.com>
Reviewed-by: Horia Geanta <horia.geanta@nxp.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/caam/caamrng.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/crypto/caam/caamrng.c b/drivers/crypto/caam/caamrng.c
index 9b92af2c72412..a77319bf221d8 100644
--- a/drivers/crypto/caam/caamrng.c
+++ b/drivers/crypto/caam/caamrng.c
@@ -361,7 +361,10 @@ static int __init caam_rng_init(void)
 		goto free_rng_ctx;
 
 	dev_info(dev, "registering rng-caam\n");
-	return hwrng_register(&caam_rng);
+
+	err = hwrng_register(&caam_rng);
+	if (!err)
+		return err;
 
 free_rng_ctx:
 	kfree(rng_ctx);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 179/271] ext4: set error return correctly when ext4_htree_store_dirent fails
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (177 preceding siblings ...)
  2020-01-28 14:05 ` [PATCH 4.9 178/271] crypto: caam - free resources in case caam_rng registration failed Greg Kroah-Hartman
@ 2020-01-28 14:05 ` Greg Kroah-Hartman
  2020-01-28 14:05 ` [PATCH 4.9 180/271] ASoC: es8328: Fix copy-paste error in es8328_right_line_controls Greg Kroah-Hartman
                   ` (96 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Colin Ian King, Theodore Tso, Sasha Levin

From: Colin Ian King <colin.king@canonical.com>

[ Upstream commit 7a14826ede1d714f0bb56de8167c0e519041eeda ]

Currently when the call to ext4_htree_store_dirent fails the error return
variable 'ret' is is not being set to the error code and variable count is
instead, hence the error code is not being returned.  Fix this by assigning
ret to the error return code.

Addresses-Coverity: ("Unused value")
Fixes: 8af0f0822797 ("ext4: fix readdir error in the case of inline_data+dir_index")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ext4/inline.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c
index 9a13f86fed626..4df4d31057b36 100644
--- a/fs/ext4/inline.c
+++ b/fs/ext4/inline.c
@@ -1417,7 +1417,7 @@ int htree_inlinedir_to_tree(struct file *dir_file,
 		err = ext4_htree_store_dirent(dir_file, hinfo->hash,
 					      hinfo->minor_hash, de, &tmp_str);
 		if (err) {
-			count = err;
+			ret = err;
 			goto out;
 		}
 		count++;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 180/271] ASoC: es8328: Fix copy-paste error in es8328_right_line_controls
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (178 preceding siblings ...)
  2020-01-28 14:05 ` [PATCH 4.9 179/271] ext4: set error return correctly when ext4_htree_store_dirent fails Greg Kroah-Hartman
@ 2020-01-28 14:05 ` Greg Kroah-Hartman
  2020-01-28 14:05 ` [PATCH 4.9 181/271] ASoC: cs4349: Use PM ops cs4349_runtime_pm Greg Kroah-Hartman
                   ` (95 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, YueHaibing, Mark Brown, Sasha Levin

From: YueHaibing <yuehaibing@huawei.com>

[ Upstream commit 630742c296341a8cfe00dfd941392025ba8dd4e8 ]

It seems 'es8328_rline_enum' should be used
in es8328_right_line_controls

Fixes: 567e4f98922c ("ASoC: add es8328 codec driver")
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Link: https://lore.kernel.org/r/20190815092300.68712-1-yuehaibing@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/codecs/es8328.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sound/soc/codecs/es8328.c b/sound/soc/codecs/es8328.c
index 37722194b107e..6b22700842e26 100644
--- a/sound/soc/codecs/es8328.c
+++ b/sound/soc/codecs/es8328.c
@@ -234,7 +234,7 @@ static const struct soc_enum es8328_rline_enum =
 			      ARRAY_SIZE(es8328_line_texts),
 			      es8328_line_texts);
 static const struct snd_kcontrol_new es8328_right_line_controls =
-	SOC_DAPM_ENUM("Route", es8328_lline_enum);
+	SOC_DAPM_ENUM("Route", es8328_rline_enum);
 
 /* Left Mixer */
 static const struct snd_kcontrol_new es8328_left_mixer_controls[] = {
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 181/271] ASoC: cs4349: Use PM ops cs4349_runtime_pm
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (179 preceding siblings ...)
  2020-01-28 14:05 ` [PATCH 4.9 180/271] ASoC: es8328: Fix copy-paste error in es8328_right_line_controls Greg Kroah-Hartman
@ 2020-01-28 14:05 ` Greg Kroah-Hartman
  2020-01-28 14:05 ` [PATCH 4.9 182/271] ASoC: wm8737: Fix copy-paste error in wm8737_snd_controls Greg Kroah-Hartman
                   ` (94 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, YueHaibing, Mark Brown,
	Sasha Levin

From: YueHaibing <yuehaibing@huawei.com>

[ Upstream commit 9b4275c415acca6264a3d7f1182589959c93d530 ]

sound/soc/codecs/cs4349.c:358:32: warning:
 cs4349_runtime_pm defined but not used [-Wunused-const-variable=]

cs4349_runtime_pm ops already defined, it seems
we should enable it.

Reported-by: Hulk Robot <hulkci@huawei.com>
Fixes: e40da86 ("ASoC: cs4349: Add support for Cirrus Logic CS4349")
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Link: https://lore.kernel.org/r/20190815090157.70036-1-yuehaibing@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/codecs/cs4349.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sound/soc/codecs/cs4349.c b/sound/soc/codecs/cs4349.c
index 231ca935cdf3b..c232c42ccead0 100644
--- a/sound/soc/codecs/cs4349.c
+++ b/sound/soc/codecs/cs4349.c
@@ -380,6 +380,7 @@ static struct i2c_driver cs4349_i2c_driver = {
 	.driver = {
 		.name		= "cs4349",
 		.of_match_table	= cs4349_of_match,
+		.pm = &cs4349_runtime_pm,
 	},
 	.id_table	= cs4349_i2c_id,
 	.probe		= cs4349_i2c_probe,
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 182/271] ASoC: wm8737: Fix copy-paste error in wm8737_snd_controls
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (180 preceding siblings ...)
  2020-01-28 14:05 ` [PATCH 4.9 181/271] ASoC: cs4349: Use PM ops cs4349_runtime_pm Greg Kroah-Hartman
@ 2020-01-28 14:05 ` Greg Kroah-Hartman
  2020-01-28 14:05 ` [PATCH 4.9 183/271] signal: Allow cifs and drbd to receive their terminating signals Greg Kroah-Hartman
                   ` (93 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, YueHaibing,
	Charles Keepax, Mark Brown, Sasha Levin

From: YueHaibing <yuehaibing@huawei.com>

[ Upstream commit 554b75bde64bcad9662530726d1483f7ef012069 ]

sound/soc/codecs/wm8737.c:112:29: warning:
 high_3d defined but not used [-Wunused-const-variable=]

'high_3d' should be used for 3D High Cut-off.

Reported-by: Hulk Robot <hulkci@huawei.com>
Fixes: 2a9ae13a2641 ("ASoC: Add initial WM8737 driver")
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Link: https://lore.kernel.org/r/20190815091920.64480-1-yuehaibing@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/codecs/wm8737.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sound/soc/codecs/wm8737.c b/sound/soc/codecs/wm8737.c
index f0cb1c4afe3ce..c5a8d758f58b8 100644
--- a/sound/soc/codecs/wm8737.c
+++ b/sound/soc/codecs/wm8737.c
@@ -170,7 +170,7 @@ SOC_DOUBLE("Polarity Invert Switch", WM8737_ADC_CONTROL, 5, 6, 1, 0),
 SOC_SINGLE("3D Switch", WM8737_3D_ENHANCE, 0, 1, 0),
 SOC_SINGLE("3D Depth", WM8737_3D_ENHANCE, 1, 15, 0),
 SOC_ENUM("3D Low Cut-off", low_3d),
-SOC_ENUM("3D High Cut-off", low_3d),
+SOC_ENUM("3D High Cut-off", high_3d),
 SOC_SINGLE_TLV("3D ADC Volume", WM8737_3D_ENHANCE, 7, 1, 1, adc_tlv),
 
 SOC_SINGLE("Noise Gate Switch", WM8737_NOISE_GATE, 0, 1, 0),
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 183/271] signal: Allow cifs and drbd to receive their terminating signals
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (181 preceding siblings ...)
  2020-01-28 14:05 ` [PATCH 4.9 182/271] ASoC: wm8737: Fix copy-paste error in wm8737_snd_controls Greg Kroah-Hartman
@ 2020-01-28 14:05 ` Greg Kroah-Hartman
  2020-01-29 11:10   ` Thomas Voegtle
  2020-01-28 14:05 ` [PATCH 4.9 184/271] ASoC: sun4i-i2s: RX and TX counter registers are swapped Greg Kroah-Hartman
                   ` (92 subsequent siblings)
  275 siblings, 1 reply; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, ronnie sahlberg,
	Christoph Böhmwalder, Steve French, Philipp Reisner,
	David Laight, Eric W. Biederman, Sasha Levin

From: Eric W. Biederman <ebiederm@xmission.com>

[ Upstream commit 33da8e7c814f77310250bb54a9db36a44c5de784 ]

My recent to change to only use force_sig for a synchronous events
wound up breaking signal reception cifs and drbd.  I had overlooked
the fact that by default kthreads start out with all signals set to
SIG_IGN.  So a change I thought was safe turned out to have made it
impossible for those kernel thread to catch their signals.

Reverting the work on force_sig is a bad idea because what the code
was doing was very much a misuse of force_sig.  As the way force_sig
ultimately allowed the signal to happen was to change the signal
handler to SIG_DFL.  Which after the first signal will allow userspace
to send signals to these kernel threads.  At least for
wake_ack_receiver in drbd that does not appear actively wrong.

So correct this problem by adding allow_kernel_signal that will allow
signals whose siginfo reports they were sent by the kernel through,
but will not allow userspace generated signals, and update cifs and
drbd to call allow_kernel_signal in an appropriate place so that their
thread can receive this signal.

Fixing things this way ensures that userspace won't be able to send
signals and cause problems, that it is clear which signals the
threads are expecting to receive, and it guarantees that nothing
else in the system will be affected.

This change was partly inspired by similar cifs and drbd patches that
added allow_signal.

Reported-by: ronnie sahlberg <ronniesahlberg@gmail.com>
Reported-by: Christoph Böhmwalder <christoph.boehmwalder@linbit.com>
Tested-by: Christoph Böhmwalder <christoph.boehmwalder@linbit.com>
Cc: Steve French <smfrench@gmail.com>
Cc: Philipp Reisner <philipp.reisner@linbit.com>
Cc: David Laight <David.Laight@ACULAB.COM>
Fixes: 247bc9470b1e ("cifs: fix rmmod regression in cifs.ko caused by force_sig changes")
Fixes: 72abe3bcf091 ("signal/cifs: Fix cifs_put_tcp_session to call send_sig instead of force_sig")
Fixes: fee109901f39 ("signal/drbd: Use send_sig not force_sig")
Fixes: 3cf5d076fb4d ("signal: Remove task parameter from force_sig")
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/block/drbd/drbd_main.c |  2 ++
 fs/cifs/connect.c              |  2 +-
 include/linux/signal.h         | 15 ++++++++++++++-
 kernel/signal.c                |  5 +++++
 4 files changed, 22 insertions(+), 2 deletions(-)

diff --git a/drivers/block/drbd/drbd_main.c b/drivers/block/drbd/drbd_main.c
index f5c24459fc5c1..daa9cef96ec66 100644
--- a/drivers/block/drbd/drbd_main.c
+++ b/drivers/block/drbd/drbd_main.c
@@ -332,6 +332,8 @@ static int drbd_thread_setup(void *arg)
 		 thi->name[0],
 		 resource->name);
 
+	allow_kernel_signal(DRBD_SIGKILL);
+	allow_kernel_signal(SIGXCPU);
 restart:
 	retval = thi->function(thi);
 
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index 7d46025d5e899..751bdde6515d5 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -885,7 +885,7 @@ cifs_demultiplex_thread(void *p)
 		mempool_resize(cifs_req_poolp, length + cifs_min_rcv);
 
 	set_freezable();
-	allow_signal(SIGKILL);
+	allow_kernel_signal(SIGKILL);
 	while (server->tcpStatus != CifsExiting) {
 		if (try_to_freeze())
 			continue;
diff --git a/include/linux/signal.h b/include/linux/signal.h
index 5308304993bea..ffa58ff53e225 100644
--- a/include/linux/signal.h
+++ b/include/linux/signal.h
@@ -313,6 +313,9 @@ extern void signal_setup_done(int failed, struct ksignal *ksig, int stepping);
 extern void exit_signals(struct task_struct *tsk);
 extern void kernel_sigaction(int, __sighandler_t);
 
+#define SIG_KTHREAD ((__force __sighandler_t)2)
+#define SIG_KTHREAD_KERNEL ((__force __sighandler_t)3)
+
 static inline void allow_signal(int sig)
 {
 	/*
@@ -320,7 +323,17 @@ static inline void allow_signal(int sig)
 	 * know it'll be handled, so that they don't get converted to
 	 * SIGKILL or just silently dropped.
 	 */
-	kernel_sigaction(sig, (__force __sighandler_t)2);
+	kernel_sigaction(sig, SIG_KTHREAD);
+}
+
+static inline void allow_kernel_signal(int sig)
+{
+	/*
+	 * Kernel threads handle their own signals. Let the signal code
+	 * know signals sent by the kernel will be handled, so that they
+	 * don't get silently dropped.
+	 */
+	kernel_sigaction(sig, SIG_KTHREAD_KERNEL);
 }
 
 static inline void disallow_signal(int sig)
diff --git a/kernel/signal.c b/kernel/signal.c
index 30914b3c76b21..57fadbe69c2e6 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -79,6 +79,11 @@ static int sig_task_ignored(struct task_struct *t, int sig, bool force)
 	    handler == SIG_DFL && !(force && sig_kernel_only(sig)))
 		return 1;
 
+	/* Only allow kernel generated signals to this kthread */
+	if (unlikely((t->flags & PF_KTHREAD) &&
+		     (handler == SIG_KTHREAD_KERNEL) && !force))
+		return true;
+
 	return sig_handler_ignored(handler, sig);
 }
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 184/271] ASoC: sun4i-i2s: RX and TX counter registers are swapped
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (182 preceding siblings ...)
  2020-01-28 14:05 ` [PATCH 4.9 183/271] signal: Allow cifs and drbd to receive their terminating signals Greg Kroah-Hartman
@ 2020-01-28 14:05 ` Greg Kroah-Hartman
  2020-01-28 14:05 ` [PATCH 4.9 185/271] dmaengine: dw: platform: Switch to acpi_dma_controller_register() Greg Kroah-Hartman
                   ` (91 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Maxime Ripard, Mark Brown, Sasha Levin

From: Maxime Ripard <maxime.ripard@bootlin.com>

[ Upstream commit cf2c0e1ce9544df42170fb921f12da82dc0cc8d6 ]

The RX and TX counters registers offset have been swapped, fix that.

Fixes: fa7c0d13cb26 ("ASoC: sunxi: Add Allwinner A10 Digital Audio driver")
Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
Link: https://lore.kernel.org/r/8b26477560ad5fd8f69e037b167c5e61de5c26a3.1566242458.git-series.maxime.ripard@bootlin.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/sunxi/sun4i-i2s.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/sound/soc/sunxi/sun4i-i2s.c b/sound/soc/sunxi/sun4i-i2s.c
index 15c92400cea42..02c373c65e194 100644
--- a/sound/soc/sunxi/sun4i-i2s.c
+++ b/sound/soc/sunxi/sun4i-i2s.c
@@ -78,8 +78,8 @@
 #define SUN4I_I2S_CLK_DIV_MCLK_MASK		GENMASK(3, 0)
 #define SUN4I_I2S_CLK_DIV_MCLK(mclk)			((mclk) << 0)
 
-#define SUN4I_I2S_RX_CNT_REG		0x28
-#define SUN4I_I2S_TX_CNT_REG		0x2c
+#define SUN4I_I2S_TX_CNT_REG		0x28
+#define SUN4I_I2S_RX_CNT_REG		0x2c
 
 #define SUN4I_I2S_TX_CHAN_SEL_REG	0x30
 #define SUN4I_I2S_TX_CHAN_SEL(num_chan)		(((num_chan) - 1) << 0)
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 185/271] dmaengine: dw: platform: Switch to acpi_dma_controller_register()
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (183 preceding siblings ...)
  2020-01-28 14:05 ` [PATCH 4.9 184/271] ASoC: sun4i-i2s: RX and TX counter registers are swapped Greg Kroah-Hartman
@ 2020-01-28 14:05 ` Greg Kroah-Hartman
  2020-01-28 14:05 ` [PATCH 4.9 186/271] mac80211: minstrel_ht: fix per-group max throughput rate initialization Greg Kroah-Hartman
                   ` (90 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Andy Shevchenko, Vinod Koul, Sasha Levin

From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>

[ Upstream commit e7b8514e4d68bec21fc6385fa0a66797ddc34ac9 ]

There is a possibility to have registered ACPI DMA controller
while it has been gone already.

To avoid the potential crash, move to non-managed
acpi_dma_controller_register().

Fixes: 42c91ee71d6d ("dw_dmac: add ACPI support")
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://lore.kernel.org/r/20190820131546.75744-8-andriy.shevchenko@linux.intel.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/dma/dw/platform.c | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/drivers/dma/dw/platform.c b/drivers/dma/dw/platform.c
index 5bda0eb9f393f..7536fe80bc33f 100644
--- a/drivers/dma/dw/platform.c
+++ b/drivers/dma/dw/platform.c
@@ -87,13 +87,20 @@ static void dw_dma_acpi_controller_register(struct dw_dma *dw)
 	dma_cap_set(DMA_SLAVE, info->dma_cap);
 	info->filter_fn = dw_dma_acpi_filter;
 
-	ret = devm_acpi_dma_controller_register(dev, acpi_dma_simple_xlate,
-						info);
+	ret = acpi_dma_controller_register(dev, acpi_dma_simple_xlate, info);
 	if (ret)
 		dev_err(dev, "could not register acpi_dma_controller\n");
 }
+
+static void dw_dma_acpi_controller_free(struct dw_dma *dw)
+{
+	struct device *dev = dw->dma.dev;
+
+	acpi_dma_controller_free(dev);
+}
 #else /* !CONFIG_ACPI */
 static inline void dw_dma_acpi_controller_register(struct dw_dma *dw) {}
+static inline void dw_dma_acpi_controller_free(struct dw_dma *dw) {}
 #endif /* !CONFIG_ACPI */
 
 #ifdef CONFIG_OF
@@ -226,6 +233,9 @@ static int dw_remove(struct platform_device *pdev)
 {
 	struct dw_dma_chip *chip = platform_get_drvdata(pdev);
 
+	if (ACPI_HANDLE(&pdev->dev))
+		dw_dma_acpi_controller_free(chip->dw);
+
 	if (pdev->dev.of_node)
 		of_dma_controller_free(pdev->dev.of_node);
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 186/271] mac80211: minstrel_ht: fix per-group max throughput rate initialization
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (184 preceding siblings ...)
  2020-01-28 14:05 ` [PATCH 4.9 185/271] dmaengine: dw: platform: Switch to acpi_dma_controller_register() Greg Kroah-Hartman
@ 2020-01-28 14:05 ` Greg Kroah-Hartman
  2020-01-28 14:05 ` [PATCH 4.9 187/271] mips: avoid explicit UB in assignment of mips_io_port_base Greg Kroah-Hartman
                   ` (89 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Felix Fietkau, Johannes Berg, Sasha Levin

From: Felix Fietkau <nbd@nbd.name>

[ Upstream commit 56dd918ff06e3ee24d8067e93ed12b2a39e71394 ]

The group number needs to be multiplied by the number of rates per group
to get the full rate index

Fixes: 5935839ad735 ("mac80211: improve minstrel_ht rate sorting by throughput & probability")
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Link: https://lore.kernel.org/r/20190820095449.45255-1-nbd@nbd.name
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/mac80211/rc80211_minstrel_ht.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/mac80211/rc80211_minstrel_ht.c b/net/mac80211/rc80211_minstrel_ht.c
index 593184d14b3ef..e1b0e26c1f174 100644
--- a/net/mac80211/rc80211_minstrel_ht.c
+++ b/net/mac80211/rc80211_minstrel_ht.c
@@ -547,7 +547,7 @@ minstrel_ht_update_stats(struct minstrel_priv *mp, struct minstrel_ht_sta *mi)
 
 		/* (re)Initialize group rate indexes */
 		for(j = 0; j < MAX_THR_RATES; j++)
-			tmp_group_tp_rate[j] = group;
+			tmp_group_tp_rate[j] = MCS_GROUP_RATES * group;
 
 		for (i = 0; i < MCS_GROUP_RATES; i++) {
 			if (!(mg->supported & BIT(i)))
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 187/271] mips: avoid explicit UB in assignment of mips_io_port_base
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (185 preceding siblings ...)
  2020-01-28 14:05 ` [PATCH 4.9 186/271] mac80211: minstrel_ht: fix per-group max throughput rate initialization Greg Kroah-Hartman
@ 2020-01-28 14:05 ` Greg Kroah-Hartman
  2020-01-28 14:05 ` [PATCH 4.9 188/271] ahci: Do not export local variable ahci_em_messages Greg Kroah-Hartman
                   ` (88 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Nathan Chancellor, Eli Friedman,
	Nick Desaulniers, Paul Burton, ralf, jhogan, Maciej W. Rozycki,
	Hassan Naveed, Stephen Kitt, Serge Semin, Mike Rapoport,
	Andrew Morton, Michal Hocko, linux-mips, clang-built-linux,
	Sasha Levin

From: Nick Desaulniers <ndesaulniers@google.com>

[ Upstream commit 12051b318bc3ce5b42d6d786191008284b067d83 ]

The code in question is modifying a variable declared const through
pointer manipulation.  Such code is explicitly undefined behavior, and
is the lone issue preventing malta_defconfig from booting when built
with Clang:

If an attempt is made to modify an object defined with a const-qualified
type through use of an lvalue with non-const-qualified type, the
behavior is undefined.

LLVM is removing such assignments. A simple fix is to not declare
variables const that you plan on modifying.  Limiting the scope would be
a better method of preventing unwanted writes to such a variable.

Further, the code in question mentions "compiler bugs" without any links
to bug reports, so it is difficult to know if the issue is resolved in
GCC. The patch was authored in 2006, which would have been GCC 4.0.3 or
4.1.1. The minimal supported version of GCC in the Linux kernel is
currently 4.6.

For what its worth, there was UB before the commit in question, it just
added a barrier and got lucky IRT codegen. I don't think there's any
actual compiler bugs related, just runtime bugs due to UB.

Link: https://github.com/ClangBuiltLinux/linux/issues/610
Fixes: 966f4406d903 ("[MIPS] Work around bad code generation for <asm/io.h>.")
Reported-by: Nathan Chancellor <natechancellor@gmail.com>
Debugged-by: Nathan Chancellor <natechancellor@gmail.com>
Suggested-by: Eli Friedman <efriedma@quicinc.com>
Signed-off-by: Nick Desaulniers <ndesaulniers@google.com>
Reviewed-by: Nathan Chancellor <natechancellor@gmail.com>
Tested-by: Nathan Chancellor <natechancellor@gmail.com>
Signed-off-by: Paul Burton <paul.burton@mips.com>
Cc: ralf@linux-mips.org
Cc: jhogan@kernel.org
Cc: Maciej W. Rozycki <macro@linux-mips.org>
Cc: Hassan Naveed <hnaveed@wavecomp.com>
Cc: Stephen Kitt <steve@sk2.org>
Cc: Serge Semin <fancer.lancer@gmail.com>
Cc: Mike Rapoport <rppt@linux.ibm.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Michal Hocko <mhocko@suse.com>
Cc: linux-mips@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Cc: clang-built-linux@googlegroups.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/mips/include/asm/io.h | 14 ++------------
 arch/mips/kernel/setup.c   |  2 +-
 2 files changed, 3 insertions(+), 13 deletions(-)

diff --git a/arch/mips/include/asm/io.h b/arch/mips/include/asm/io.h
index 06049b6b3dddb..5dfae80264b9b 100644
--- a/arch/mips/include/asm/io.h
+++ b/arch/mips/include/asm/io.h
@@ -60,21 +60,11 @@
  * instruction, so the lower 16 bits must be zero.  Should be true on
  * on any sane architecture; generic code does not use this assumption.
  */
-extern const unsigned long mips_io_port_base;
+extern unsigned long mips_io_port_base;
 
-/*
- * Gcc will generate code to load the value of mips_io_port_base after each
- * function call which may be fairly wasteful in some cases.  So we don't
- * play quite by the book.  We tell gcc mips_io_port_base is a long variable
- * which solves the code generation issue.  Now we need to violate the
- * aliasing rules a little to make initialization possible and finally we
- * will need the barrier() to fight side effects of the aliasing chat.
- * This trickery will eventually collapse under gcc's optimizer.  Oh well.
- */
 static inline void set_io_port_base(unsigned long base)
 {
-	* (unsigned long *) &mips_io_port_base = base;
-	barrier();
+	mips_io_port_base = base;
 }
 
 /*
diff --git a/arch/mips/kernel/setup.c b/arch/mips/kernel/setup.c
index 695950361d2a7..7cc1d29334ee1 100644
--- a/arch/mips/kernel/setup.c
+++ b/arch/mips/kernel/setup.c
@@ -74,7 +74,7 @@ static char __initdata builtin_cmdline[COMMAND_LINE_SIZE] = CONFIG_CMDLINE;
  * mips_io_port_base is the begin of the address space to which x86 style
  * I/O ports are mapped.
  */
-const unsigned long mips_io_port_base = -1;
+unsigned long mips_io_port_base = -1;
 EXPORT_SYMBOL(mips_io_port_base);
 
 static struct resource code_resource = { .name = "Kernel code", };
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 188/271] ahci: Do not export local variable ahci_em_messages
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (186 preceding siblings ...)
  2020-01-28 14:05 ` [PATCH 4.9 187/271] mips: avoid explicit UB in assignment of mips_io_port_base Greg Kroah-Hartman
@ 2020-01-28 14:05 ` Greg Kroah-Hartman
  2020-01-28 14:05 ` [PATCH 4.9 189/271] Partially revert "kfifo: fix kfifo_alloc() and kfifo_init()" Greg Kroah-Hartman
                   ` (87 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chuansheng Liu, Andy Shevchenko,
	Jens Axboe, Sasha Levin

From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>

[ Upstream commit 60fc35f327e0a9e60b955c0f3c3ed623608d1baa ]

The commit ed08d40cdec4
  ("ahci: Changing two module params with static and __read_mostly")
moved ahci_em_messages to be static while missing the fact of exporting it.

WARNING: "ahci_em_messages" [vmlinux] is a static EXPORT_SYMBOL_GPL

Drop export for the local variable ahci_em_messages.

Fixes: ed08d40cdec4 ("ahci: Changing two module params with static and __read_mostly")
Cc: Chuansheng Liu <chuansheng.liu@intel.com>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/ata/libahci.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
index f233ce60a6781..1610fff19bb39 100644
--- a/drivers/ata/libahci.c
+++ b/drivers/ata/libahci.c
@@ -190,7 +190,6 @@ struct ata_port_operations ahci_pmp_retry_srst_ops = {
 EXPORT_SYMBOL_GPL(ahci_pmp_retry_srst_ops);
 
 static bool ahci_em_messages __read_mostly = true;
-EXPORT_SYMBOL_GPL(ahci_em_messages);
 module_param(ahci_em_messages, bool, 0444);
 /* add other LED protocol types when they become supported */
 MODULE_PARM_DESC(ahci_em_messages,
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 189/271] Partially revert "kfifo: fix kfifo_alloc() and kfifo_init()"
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (187 preceding siblings ...)
  2020-01-28 14:05 ` [PATCH 4.9 188/271] ahci: Do not export local variable ahci_em_messages Greg Kroah-Hartman
@ 2020-01-28 14:05 ` Greg Kroah-Hartman
  2020-01-28 14:05 ` [PATCH 4.9 190/271] hwmon: (lm75) Fix write operations for negative temperatures Greg Kroah-Hartman
                   ` (86 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, laokz, Stefani Seibold,
	Andrew Morton, Dan Carpenter, Greg KH, Kees Cook, Will Deacon,
	Linus Torvalds, Sasha Levin

From: Linus Torvalds <torvalds@linux-foundation.org>

[ Upstream commit ab9bb6318b0967671e0c9b6537c1537d51ca4f45 ]

Commit dfe2a77fd243 ("kfifo: fix kfifo_alloc() and kfifo_init()") made
the kfifo code round the number of elements up.  That was good for
__kfifo_alloc(), but it's actually wrong for __kfifo_init().

The difference? __kfifo_alloc() will allocate the rounded-up number of
elements, but __kfifo_init() uses an allocation done by the caller.  We
can't just say "use more elements than the caller allocated", and have
to round down.

The good news? All the normal cases will be using power-of-two arrays
anyway, and most users of kfifo's don't use kfifo_init() at all, but one
of the helper macros to declare a KFIFO that enforce the proper
power-of-two behavior.  But it looks like at least ibmvscsis might be
affected.

The bad news? Will Deacon refers to an old thread and points points out
that the memory ordering in kfifo's is questionable.  See

  https://lore.kernel.org/lkml/20181211034032.32338-1-yuleixzhang@tencent.com/

for more.

Fixes: dfe2a77fd243 ("kfifo: fix kfifo_alloc() and kfifo_init()")
Reported-by: laokz <laokz@foxmail.com>
Cc: Stefani Seibold <stefani@seibold.net>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Dan Carpenter <dan.carpenter@oracle.com>
Cc: Greg KH <greg@kroah.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Will Deacon <will@kernel.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 lib/kfifo.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/lib/kfifo.c b/lib/kfifo.c
index 90ba1eb1df06e..a94227c555510 100644
--- a/lib/kfifo.c
+++ b/lib/kfifo.c
@@ -82,7 +82,8 @@ int __kfifo_init(struct __kfifo *fifo, void *buffer,
 {
 	size /= esize;
 
-	size = roundup_pow_of_two(size);
+	if (!is_power_of_2(size))
+		size = rounddown_pow_of_two(size);
 
 	fifo->in = 0;
 	fifo->out = 0;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 190/271] hwmon: (lm75) Fix write operations for negative temperatures
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (188 preceding siblings ...)
  2020-01-28 14:05 ` [PATCH 4.9 189/271] Partially revert "kfifo: fix kfifo_alloc() and kfifo_init()" Greg Kroah-Hartman
@ 2020-01-28 14:05 ` Greg Kroah-Hartman
  2020-01-28 14:05 ` [PATCH 4.9 191/271] power: supply: Init device wakeup after device_add() Greg Kroah-Hartman
                   ` (85 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Iker Perez del Palomar Sustatxa,
	Guenter Roeck, Sasha Levin

From: Guenter Roeck <linux@roeck-us.net>

[ Upstream commit 7d82fcc9d9e81241778aaa22fda7be753e237d86 ]

Writes into limit registers fail if the temperature written is negative.
The regmap write operation checks the value range, regmap_write accepts
an unsigned int as parameter, and the temperature value passed to
regmap_write is kept in a variable declared as long. Negative values
are converted large unsigned integers, which fails the range check.
Fix by type casting the temperature to u16 when calling regmap_write().

Cc: Iker Perez del Palomar Sustatxa <iker.perez@codethink.co.uk>
Fixes: e65365fed87f ("hwmon: (lm75) Convert to use regmap")
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hwmon/lm75.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/hwmon/lm75.c b/drivers/hwmon/lm75.c
index eff3b24d84737..fc31669a86ba8 100644
--- a/drivers/hwmon/lm75.c
+++ b/drivers/hwmon/lm75.c
@@ -164,7 +164,7 @@ static int lm75_write(struct device *dev, enum hwmon_sensor_types type,
 	temp = DIV_ROUND_CLOSEST(temp  << (resolution - 8),
 				 1000) << (16 - resolution);
 
-	return regmap_write(data->regmap, reg, temp);
+	return regmap_write(data->regmap, reg, (u16)temp);
 }
 
 static umode_t lm75_is_visible(const void *data, enum hwmon_sensor_types type,
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 191/271] power: supply: Init device wakeup after device_add()
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (189 preceding siblings ...)
  2020-01-28 14:05 ` [PATCH 4.9 190/271] hwmon: (lm75) Fix write operations for negative temperatures Greg Kroah-Hartman
@ 2020-01-28 14:05 ` Greg Kroah-Hartman
  2020-01-28 14:05 ` [PATCH 4.9 192/271] x86, perf: Fix the dependency of the x86 insn decoder selftest Greg Kroah-Hartman
                   ` (84 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Tri Vo, Kalesh Singh,
	Ravi Chandra Sadineni, Viresh Kumar, Stephen Boyd,
	Rafael J. Wysocki, Sebastian Reichel, Sasha Levin

From: Stephen Boyd <swboyd@chromium.org>

[ Upstream commit 8288022284859acbcc3cf1a073a1e2692d6c2543 ]

We may want to use the device pointer in device_init_wakeup() with
functions that expect the device to already be added with device_add().
For example, if we were to link the device initializing wakeup to
something in sysfs such as a class for wakeups we'll run into an error.
It looks like this code was written with the assumption that the device
would be added before initializing wakeup due to the order of operations
in power_supply_unregister().

Let's change the order of operations so we don't run into problems here.

Fixes: 948dcf966228 ("power_supply: Prevent suspend until power supply events are processed")
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Tri Vo <trong@android.com>
Cc: Kalesh Singh <kaleshsingh@google.com>
Cc: Ravi Chandra Sadineni <ravisadineni@chromium.org>
Cc: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Stephen Boyd <swboyd@chromium.org>
Acked-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/power/supply/power_supply_core.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/power/supply/power_supply_core.c b/drivers/power/supply/power_supply_core.c
index 9e05ae0430a99..cb0b3d3d132fc 100644
--- a/drivers/power/supply/power_supply_core.c
+++ b/drivers/power/supply/power_supply_core.c
@@ -764,14 +764,14 @@ __power_supply_register(struct device *parent,
 	}
 
 	spin_lock_init(&psy->changed_lock);
-	rc = device_init_wakeup(dev, ws);
-	if (rc)
-		goto wakeup_init_failed;
-
 	rc = device_add(dev);
 	if (rc)
 		goto device_add_failed;
 
+	rc = device_init_wakeup(dev, ws);
+	if (rc)
+		goto wakeup_init_failed;
+
 	rc = psy_register_thermal(psy);
 	if (rc)
 		goto register_thermal_failed;
@@ -808,8 +808,8 @@ register_cooler_failed:
 	psy_unregister_thermal(psy);
 register_thermal_failed:
 	device_del(dev);
-device_add_failed:
 wakeup_init_failed:
+device_add_failed:
 check_supplies_failed:
 dev_set_name_failed:
 	put_device(dev);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 192/271] x86, perf: Fix the dependency of the x86 insn decoder selftest
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (190 preceding siblings ...)
  2020-01-28 14:05 ` [PATCH 4.9 191/271] power: supply: Init device wakeup after device_add() Greg Kroah-Hartman
@ 2020-01-28 14:05 ` Greg Kroah-Hartman
  2020-01-28 14:05 ` [PATCH 4.9 193/271] staging: greybus: light: fix a couple double frees Greg Kroah-Hartman
                   ` (83 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Masami Hiramatsu, Linus Torvalds,
	Peter Zijlstra, Thomas Gleixner, Ingo Molnar, Sasha Levin

From: Masami Hiramatsu <mhiramat@kernel.org>

[ Upstream commit 7720804a2ae46c90265a32c81c45fb6f8d2f4e8b ]

Since x86 instruction decoder is not only for kprobes,
it should be tested when the insn.c is compiled.
(e.g. perf is enabled but kprobes is disabled)

Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Fixes: cbe5c34c8c1f ("x86: Compile insn.c and inat.c only for KPROBES")
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/Kconfig.debug | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/Kconfig.debug b/arch/x86/Kconfig.debug
index 4386440fe4635..f09a192260f8e 100644
--- a/arch/x86/Kconfig.debug
+++ b/arch/x86/Kconfig.debug
@@ -192,7 +192,7 @@ config HAVE_MMIOTRACE_SUPPORT
 
 config X86_DECODER_SELFTEST
 	bool "x86 instruction decoder selftest"
-	depends on DEBUG_KERNEL && KPROBES
+	depends on DEBUG_KERNEL && INSTRUCTION_DECODER
 	depends on !COMPILE_TEST
 	---help---
 	 Perform x86 instruction decoder selftests at build time.
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 193/271] staging: greybus: light: fix a couple double frees
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (191 preceding siblings ...)
  2020-01-28 14:05 ` [PATCH 4.9 192/271] x86, perf: Fix the dependency of the x86 insn decoder selftest Greg Kroah-Hartman
@ 2020-01-28 14:05 ` Greg Kroah-Hartman
  2020-01-28 14:05 ` [PATCH 4.9 194/271] bcma: fix incorrect update of BCMA_CORE_PCI_MDIO_DATA Greg Kroah-Hartman
                   ` (82 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Rui Miguel Silva, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit 329101244f214952606359d254ae883b7109e1a5 ]

The problem is in gb_lights_request_handler().  If we get a request to
change the config then we release the light with gb_lights_light_release()
and re-allocated it.  However, if the allocation fails part way through
then we call gb_lights_light_release() again.  This can lead to a couple
different double frees where we haven't cleared out the original values:

	gb_lights_light_v4l2_unregister(light);
	...
	kfree(light->channels);
	kfree(light->name);

I also made a small change to how we set "light->channels_count = 0;".
The original code handled this part fine and did not cause a use after
free but it was sort of complicated to read.

Fixes: 2870b52bae4c ("greybus: lights: add lights implementation")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Rui Miguel Silva <rmfrfs@gmail.com>
Link: https://lore.kernel.org/r/20190829122839.GA20116@mwanda
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/staging/greybus/light.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/staging/greybus/light.c b/drivers/staging/greybus/light.c
index 9f01427f35f91..1cb82cc28aa76 100644
--- a/drivers/staging/greybus/light.c
+++ b/drivers/staging/greybus/light.c
@@ -1102,21 +1102,21 @@ static void gb_lights_channel_release(struct gb_channel *channel)
 static void gb_lights_light_release(struct gb_light *light)
 {
 	int i;
-	int count;
 
 	light->ready = false;
 
-	count = light->channels_count;
-
 	if (light->has_flash)
 		gb_lights_light_v4l2_unregister(light);
+	light->has_flash = false;
 
-	for (i = 0; i < count; i++) {
+	for (i = 0; i < light->channels_count; i++)
 		gb_lights_channel_release(&light->channels[i]);
-		light->channels_count--;
-	}
+	light->channels_count = 0;
+
 	kfree(light->channels);
+	light->channels = NULL;
 	kfree(light->name);
+	light->name = NULL;
 }
 
 static void gb_lights_release(struct gb_lights *glights)
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 194/271] bcma: fix incorrect update of BCMA_CORE_PCI_MDIO_DATA
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (192 preceding siblings ...)
  2020-01-28 14:05 ` [PATCH 4.9 193/271] staging: greybus: light: fix a couple double frees Greg Kroah-Hartman
@ 2020-01-28 14:05 ` Greg Kroah-Hartman
  2020-01-28 14:05 ` [PATCH 4.9 195/271] iio: dac: ad5380: fix incorrect assignment to val Greg Kroah-Hartman
                   ` (81 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Colin Ian King, Kalle Valo, Sasha Levin

From: Colin Ian King <colin.king@canonical.com>

[ Upstream commit 420c20be08a4597404d272ae9793b642401146eb ]

An earlier commit re-worked the setting of the bitmask and is now
assigning v with some bit flags rather than bitwise or-ing them
into v, consequently the earlier bit-settings of v are being lost.
Fix this by replacing an assignment with the bitwise or instead.

Addresses-Coverity: ("Unused value")
Fixes: 2be25cac8402 ("bcma: add constants for PCI and use them")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/bcma/driver_pci.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/bcma/driver_pci.c b/drivers/bcma/driver_pci.c
index f499a469e66d0..12b2cc9a3fbe8 100644
--- a/drivers/bcma/driver_pci.c
+++ b/drivers/bcma/driver_pci.c
@@ -78,7 +78,7 @@ static u16 bcma_pcie_mdio_read(struct bcma_drv_pci *pc, u16 device, u8 address)
 		v |= (address << BCMA_CORE_PCI_MDIODATA_REGADDR_SHF_OLD);
 	}
 
-	v = BCMA_CORE_PCI_MDIODATA_START;
+	v |= BCMA_CORE_PCI_MDIODATA_START;
 	v |= BCMA_CORE_PCI_MDIODATA_READ;
 	v |= BCMA_CORE_PCI_MDIODATA_TA;
 
@@ -121,7 +121,7 @@ static void bcma_pcie_mdio_write(struct bcma_drv_pci *pc, u16 device,
 		v |= (address << BCMA_CORE_PCI_MDIODATA_REGADDR_SHF_OLD);
 	}
 
-	v = BCMA_CORE_PCI_MDIODATA_START;
+	v |= BCMA_CORE_PCI_MDIODATA_START;
 	v |= BCMA_CORE_PCI_MDIODATA_WRITE;
 	v |= BCMA_CORE_PCI_MDIODATA_TA;
 	v |= data;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 195/271] iio: dac: ad5380: fix incorrect assignment to val
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (193 preceding siblings ...)
  2020-01-28 14:05 ` [PATCH 4.9 194/271] bcma: fix incorrect update of BCMA_CORE_PCI_MDIO_DATA Greg Kroah-Hartman
@ 2020-01-28 14:05 ` Greg Kroah-Hartman
  2020-01-28 14:05 ` [PATCH 4.9 196/271] ath9k: dynack: fix possible deadlock in ath_dynack_node_{de}init Greg Kroah-Hartman
                   ` (80 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Colin Ian King, Alexandru Ardelean,
	Jonathan Cameron, Sasha Levin

From: Colin Ian King <colin.king@canonical.com>

[ Upstream commit b1e18768ef1214c0a8048327918a182cabe09f9d ]

Currently the pointer val is being incorrectly incremented
instead of the value pointed to by val. Fix this by adding
in the missing * indirection operator.

Addresses-Coverity: ("Unused value")
Fixes: c03f2c536818 ("staging:iio:dac: Add AD5380 driver")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Reviewed-by: Alexandru Ardelean <alexandru.ardelean@analog.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iio/dac/ad5380.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/iio/dac/ad5380.c b/drivers/iio/dac/ad5380.c
index 97d2c5111f438..8bf7fc626a9d4 100644
--- a/drivers/iio/dac/ad5380.c
+++ b/drivers/iio/dac/ad5380.c
@@ -221,7 +221,7 @@ static int ad5380_read_raw(struct iio_dev *indio_dev,
 		if (ret)
 			return ret;
 		*val >>= chan->scan_type.shift;
-		val -= (1 << chan->scan_type.realbits) / 2;
+		*val -= (1 << chan->scan_type.realbits) / 2;
 		return IIO_VAL_INT;
 	case IIO_CHAN_INFO_SCALE:
 		*val = 2 * st->vref;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 196/271] ath9k: dynack: fix possible deadlock in ath_dynack_node_{de}init
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (194 preceding siblings ...)
  2020-01-28 14:05 ` [PATCH 4.9 195/271] iio: dac: ad5380: fix incorrect assignment to val Greg Kroah-Hartman
@ 2020-01-28 14:05 ` Greg Kroah-Hartman
  2020-01-28 14:05 ` [PATCH 4.9 197/271] net: sonic: return NETDEV_TX_OK if failed to map buffer Greg Kroah-Hartman
                   ` (79 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lorenzo Bianconi, Koen Vandeputte,
	Kalle Valo, Sasha Levin

From: Lorenzo Bianconi <lorenzo@kernel.org>

[ Upstream commit e1aa1a1db3b01c9890e82cf065cee99962ba1ed9 ]

Fix following lockdep warning disabling bh in
ath_dynack_node_init/ath_dynack_node_deinit

[   75.955878] --------------------------------
[   75.955880] inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage.
[   75.955884] swapper/0/0 [HC0[0]:SC1[3]:HE1:SE0] takes:
[   75.955888] 00000000792a7ee0 (&(&da->qlock)->rlock){+.?.}, at: ath_dynack_sample_ack_ts+0x4d/0xa0 [ath9k_hw]
[   75.955905] {SOFTIRQ-ON-W} state was registered at:
[   75.955912]   lock_acquire+0x9a/0x160
[   75.955917]   _raw_spin_lock+0x2c/0x70
[   75.955927]   ath_dynack_node_init+0x2a/0x60 [ath9k_hw]
[   75.955934]   ath9k_sta_state+0xec/0x160 [ath9k]
[   75.955976]   drv_sta_state+0xb2/0x740 [mac80211]
[   75.956008]   sta_info_insert_finish+0x21a/0x420 [mac80211]
[   75.956039]   sta_info_insert_rcu+0x12b/0x2c0 [mac80211]
[   75.956069]   sta_info_insert+0x7/0x70 [mac80211]
[   75.956093]   ieee80211_prep_connection+0x42e/0x730 [mac80211]
[   75.956120]   ieee80211_mgd_auth.cold+0xb9/0x15c [mac80211]
[   75.956152]   cfg80211_mlme_auth+0x143/0x350 [cfg80211]
[   75.956169]   nl80211_authenticate+0x25e/0x2b0 [cfg80211]
[   75.956172]   genl_family_rcv_msg+0x198/0x400
[   75.956174]   genl_rcv_msg+0x42/0x90
[   75.956176]   netlink_rcv_skb+0x35/0xf0
[   75.956178]   genl_rcv+0x1f/0x30
[   75.956180]   netlink_unicast+0x154/0x200
[   75.956182]   netlink_sendmsg+0x1bf/0x3d0
[   75.956186]   ___sys_sendmsg+0x2c2/0x2f0
[   75.956187]   __sys_sendmsg+0x44/0x80
[   75.956190]   do_syscall_64+0x55/0x1a0
[   75.956192]   entry_SYSCALL_64_after_hwframe+0x49/0xbe
[   75.956194] irq event stamp: 2357092
[   75.956196] hardirqs last  enabled at (2357092): [<ffffffff818c62de>] _raw_spin_unlock_irqrestore+0x3e/0x50
[   75.956199] hardirqs last disabled at (2357091): [<ffffffff818c60b1>] _raw_spin_lock_irqsave+0x11/0x80
[   75.956202] softirqs last  enabled at (2357072): [<ffffffff8106dc09>] irq_enter+0x59/0x60
[   75.956204] softirqs last disabled at (2357073): [<ffffffff8106dcbe>] irq_exit+0xae/0xc0
[   75.956206]
               other info that might help us debug this:
[   75.956207]  Possible unsafe locking scenario:

[   75.956208]        CPU0
[   75.956209]        ----
[   75.956210]   lock(&(&da->qlock)->rlock);
[   75.956213]   <Interrupt>
[   75.956214]     lock(&(&da->qlock)->rlock);
[   75.956216]
                *** DEADLOCK ***

[   75.956217] 1 lock held by swapper/0/0:
[   75.956219]  #0: 000000003bb5675c (&(&sc->sc_pcu_lock)->rlock){+.-.}, at: ath9k_tasklet+0x55/0x240 [ath9k]
[   75.956225]
               stack backtrace:
[   75.956228] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.3.0-rc1-wdn+ #13
[   75.956229] Hardware name: Dell Inc. Studio XPS 1340/0K183D, BIOS A11 09/08/2009
[   75.956231] Call Trace:
[   75.956233]  <IRQ>
[   75.956236]  dump_stack+0x67/0x90
[   75.956239]  mark_lock+0x4c1/0x640
[   75.956242]  ? check_usage_backwards+0x130/0x130
[   75.956245]  ? sched_clock_local+0x12/0x80
[   75.956247]  __lock_acquire+0x484/0x7a0
[   75.956250]  ? __lock_acquire+0x3b9/0x7a0
[   75.956252]  lock_acquire+0x9a/0x160
[   75.956259]  ? ath_dynack_sample_ack_ts+0x4d/0xa0 [ath9k_hw]
[   75.956262]  _raw_spin_lock_bh+0x34/0x80
[   75.956268]  ? ath_dynack_sample_ack_ts+0x4d/0xa0 [ath9k_hw]
[   75.956275]  ath_dynack_sample_ack_ts+0x4d/0xa0 [ath9k_hw]
[   75.956280]  ath_rx_tasklet+0xd09/0xe90 [ath9k]
[   75.956286]  ath9k_tasklet+0x102/0x240 [ath9k]
[   75.956288]  tasklet_action_common.isra.0+0x6d/0x170
[   75.956291]  __do_softirq+0xcc/0x425
[   75.956294]  irq_exit+0xae/0xc0
[   75.956296]  do_IRQ+0x8a/0x110
[   75.956298]  common_interrupt+0xf/0xf
[   75.956300]  </IRQ>
[   75.956303] RIP: 0010:cpuidle_enter_state+0xb2/0x400
[   75.956308] RSP: 0018:ffffffff82203e70 EFLAGS: 00000202 ORIG_RAX: ffffffffffffffd7
[   75.956310] RAX: ffffffff82219800 RBX: ffffffff822bd0a0 RCX: 0000000000000000
[   75.956312] RDX: 0000000000000046 RSI: 0000000000000006 RDI: ffffffff82219800
[   75.956314] RBP: ffff888155a01c00 R08: 00000011af51aabe R09: 0000000000000000
[   75.956315] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000002
[   75.956317] R13: 00000011af51aabe R14: 0000000000000003 R15: ffffffff82219800
[   75.956321]  cpuidle_enter+0x24/0x40
[   75.956323]  do_idle+0x1ac/0x220
[   75.956326]  cpu_startup_entry+0x14/0x20
[   75.956329]  start_kernel+0x482/0x489
[   75.956332]  secondary_startup_64+0xa4/0xb0

Fixes: c774d57fd47c ("ath9k: add dynamic ACK timeout estimation")
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Tested-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath9k/dynack.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/net/wireless/ath/ath9k/dynack.c b/drivers/net/wireless/ath/ath9k/dynack.c
index 6e236a4854311..71b4888b30e71 100644
--- a/drivers/net/wireless/ath/ath9k/dynack.c
+++ b/drivers/net/wireless/ath/ath9k/dynack.c
@@ -300,9 +300,9 @@ void ath_dynack_node_init(struct ath_hw *ah, struct ath_node *an)
 
 	an->ackto = ackto;
 
-	spin_lock(&da->qlock);
+	spin_lock_bh(&da->qlock);
 	list_add_tail(&an->list, &da->nodes);
-	spin_unlock(&da->qlock);
+	spin_unlock_bh(&da->qlock);
 }
 EXPORT_SYMBOL(ath_dynack_node_init);
 
@@ -316,9 +316,9 @@ void ath_dynack_node_deinit(struct ath_hw *ah, struct ath_node *an)
 {
 	struct ath_dynack *da = &ah->dynack;
 
-	spin_lock(&da->qlock);
+	spin_lock_bh(&da->qlock);
 	list_del(&an->list);
-	spin_unlock(&da->qlock);
+	spin_unlock_bh(&da->qlock);
 }
 EXPORT_SYMBOL(ath_dynack_node_deinit);
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 197/271] net: sonic: return NETDEV_TX_OK if failed to map buffer
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (195 preceding siblings ...)
  2020-01-28 14:05 ` [PATCH 4.9 196/271] ath9k: dynack: fix possible deadlock in ath_dynack_node_{de}init Greg Kroah-Hartman
@ 2020-01-28 14:05 ` Greg Kroah-Hartman
  2020-01-28 14:05 ` [PATCH 4.9 198/271] Btrfs: fix hang when loading existing inode cache off disk Greg Kroah-Hartman
                   ` (78 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Mao Wenan, David S. Miller, Sasha Levin

From: Mao Wenan <maowenan@huawei.com>

[ Upstream commit 6e1cdedcf0362fed3aedfe051d46bd7ee2a85fe1 ]

NETDEV_TX_BUSY really should only be used by drivers that call
netif_tx_stop_queue() at the wrong moment. If dma_map_single() is
failed to map tx DMA buffer, it might trigger an infinite loop.
This patch use NETDEV_TX_OK instead of NETDEV_TX_BUSY, and change
printk to pr_err_ratelimited.

Fixes: d9fb9f384292 ("*sonic/natsemi/ns83829: Move the National Semi-conductor drivers")
Signed-off-by: Mao Wenan <maowenan@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/natsemi/sonic.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/natsemi/sonic.c b/drivers/net/ethernet/natsemi/sonic.c
index 23821540ab078..11f472fd5d477 100644
--- a/drivers/net/ethernet/natsemi/sonic.c
+++ b/drivers/net/ethernet/natsemi/sonic.c
@@ -221,9 +221,9 @@ static int sonic_send_packet(struct sk_buff *skb, struct net_device *dev)
 
 	laddr = dma_map_single(lp->device, skb->data, length, DMA_TO_DEVICE);
 	if (!laddr) {
-		printk(KERN_ERR "%s: failed to map tx DMA buffer.\n", dev->name);
+		pr_err_ratelimited("%s: failed to map tx DMA buffer.\n", dev->name);
 		dev_kfree_skb(skb);
-		return NETDEV_TX_BUSY;
+		return NETDEV_TX_OK;
 	}
 
 	sonic_tda_put(dev, entry, SONIC_TD_STATUS, 0);       /* clear status */
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 198/271] Btrfs: fix hang when loading existing inode cache off disk
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (196 preceding siblings ...)
  2020-01-28 14:05 ` [PATCH 4.9 197/271] net: sonic: return NETDEV_TX_OK if failed to map buffer Greg Kroah-Hartman
@ 2020-01-28 14:05 ` Greg Kroah-Hartman
  2020-01-28 14:05 ` [PATCH 4.9 199/271] hwmon: (shtc1) fix shtc1 and shtw1 id mask Greg Kroah-Hartman
                   ` (77 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Nikolay Borisov, Filipe Manana,
	David Sterba, Sasha Levin

From: Filipe Manana <fdmanana@suse.com>

[ Upstream commit 7764d56baa844d7f6206394f21a0e8c1f303c476 ]

If we are able to load an existing inode cache off disk, we set the state
of the cache to BTRFS_CACHE_FINISHED, but we don't wake up any one waiting
for the cache to be available. This means that anyone waiting for the
cache to be available, waiting on the condition that either its state is
BTRFS_CACHE_FINISHED or its available free space is greather than zero,
can hang forever.

This could be observed running fstests with MOUNT_OPTIONS="-o inode_cache",
in particular test case generic/161 triggered it very frequently for me,
producing a trace like the following:

  [63795.739712] BTRFS info (device sdc): enabling inode map caching
  [63795.739714] BTRFS info (device sdc): disk space caching is enabled
  [63795.739716] BTRFS info (device sdc): has skinny extents
  [64036.653886] INFO: task btrfs-transacti:3917 blocked for more than 120 seconds.
  [64036.654079]       Not tainted 5.2.0-rc4-btrfs-next-50 #1
  [64036.654143] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
  [64036.654232] btrfs-transacti D    0  3917      2 0x80004000
  [64036.654239] Call Trace:
  [64036.654258]  ? __schedule+0x3ae/0x7b0
  [64036.654271]  schedule+0x3a/0xb0
  [64036.654325]  btrfs_commit_transaction+0x978/0xae0 [btrfs]
  [64036.654339]  ? remove_wait_queue+0x60/0x60
  [64036.654395]  transaction_kthread+0x146/0x180 [btrfs]
  [64036.654450]  ? btrfs_cleanup_transaction+0x620/0x620 [btrfs]
  [64036.654456]  kthread+0x103/0x140
  [64036.654464]  ? kthread_create_worker_on_cpu+0x70/0x70
  [64036.654476]  ret_from_fork+0x3a/0x50
  [64036.654504] INFO: task xfs_io:3919 blocked for more than 120 seconds.
  [64036.654568]       Not tainted 5.2.0-rc4-btrfs-next-50 #1
  [64036.654617] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
  [64036.654685] xfs_io          D    0  3919   3633 0x00000000
  [64036.654691] Call Trace:
  [64036.654703]  ? __schedule+0x3ae/0x7b0
  [64036.654716]  schedule+0x3a/0xb0
  [64036.654756]  btrfs_find_free_ino+0xa9/0x120 [btrfs]
  [64036.654764]  ? remove_wait_queue+0x60/0x60
  [64036.654809]  btrfs_create+0x72/0x1f0 [btrfs]
  [64036.654822]  lookup_open+0x6bc/0x790
  [64036.654849]  path_openat+0x3bc/0xc00
  [64036.654854]  ? __lock_acquire+0x331/0x1cb0
  [64036.654869]  do_filp_open+0x99/0x110
  [64036.654884]  ? __alloc_fd+0xee/0x200
  [64036.654895]  ? do_raw_spin_unlock+0x49/0xc0
  [64036.654909]  ? do_sys_open+0x132/0x220
  [64036.654913]  do_sys_open+0x132/0x220
  [64036.654926]  do_syscall_64+0x60/0x1d0
  [64036.654933]  entry_SYSCALL_64_after_hwframe+0x49/0xbe

Fix this by adding a wake_up() call right after setting the cache state to
BTRFS_CACHE_FINISHED, at start_caching(), when we are able to load the
cache from disk.

Fixes: 82d5902d9c681b ("Btrfs: Support reading/writing on disk free ino cache")
Reviewed-by: Nikolay Borisov <nborisov@suse.com>
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/btrfs/inode-map.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/btrfs/inode-map.c b/fs/btrfs/inode-map.c
index d27014b8bf727..075b59516c8c0 100644
--- a/fs/btrfs/inode-map.c
+++ b/fs/btrfs/inode-map.c
@@ -159,6 +159,7 @@ static void start_caching(struct btrfs_root *root)
 		spin_lock(&root->ino_cache_lock);
 		root->ino_cache_state = BTRFS_CACHE_FINISHED;
 		spin_unlock(&root->ino_cache_lock);
+		wake_up(&root->ino_cache_wait);
 		return;
 	}
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 199/271] hwmon: (shtc1) fix shtc1 and shtw1 id mask
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (197 preceding siblings ...)
  2020-01-28 14:05 ` [PATCH 4.9 198/271] Btrfs: fix hang when loading existing inode cache off disk Greg Kroah-Hartman
@ 2020-01-28 14:05 ` Greg Kroah-Hartman
  2020-01-28 14:05 ` [PATCH 4.9 200/271] net: sonic: replace dev_kfree_skb in sonic_send_packet Greg Kroah-Hartman
                   ` (76 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Robertson, Guenter Roeck, Sasha Levin

From: Dan Robertson <dan@dlrobertson.com>

[ Upstream commit fdc7d8e829ec755c5cfb2f5a8d8c0cdfb664f895 ]

Fix an error in the bitmaskfor the shtc1 and shtw1 bitmask used to
retrieve the chip ID from the ID register. See section 5.7 of the shtw1
or shtc1 datasheet for details.

Fixes: 1a539d372edd9832444e7a3daa710c444c014dc9 ("hwmon: add support for Sensirion SHTC1 sensor")
Signed-off-by: Dan Robertson <dan@dlrobertson.com>
Link: https://lore.kernel.org/r/20190905014554.21658-3-dan@dlrobertson.com
[groeck: Reordered to be first in series and adjusted accordingly]
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hwmon/shtc1.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/hwmon/shtc1.c b/drivers/hwmon/shtc1.c
index decd7df995abf..2a18539591eaf 100644
--- a/drivers/hwmon/shtc1.c
+++ b/drivers/hwmon/shtc1.c
@@ -38,7 +38,7 @@ static const unsigned char shtc1_cmd_read_id_reg[]	       = { 0xef, 0xc8 };
 
 /* constants for reading the ID register */
 #define SHTC1_ID	  0x07
-#define SHTC1_ID_REG_MASK 0x1f
+#define SHTC1_ID_REG_MASK 0x3f
 
 /* delays for non-blocking i2c commands, both in us */
 #define SHTC1_NONBLOCKING_WAIT_TIME_HPM  14400
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 200/271] net: sonic: replace dev_kfree_skb in sonic_send_packet
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (198 preceding siblings ...)
  2020-01-28 14:05 ` [PATCH 4.9 199/271] hwmon: (shtc1) fix shtc1 and shtw1 id mask Greg Kroah-Hartman
@ 2020-01-28 14:05 ` Greg Kroah-Hartman
  2020-01-28 14:05 ` [PATCH 4.9 201/271] net/rds: Fix ib_evt_handler_call element in rds_ib_stat_names Greg Kroah-Hartman
                   ` (75 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Mao Wenan, David S. Miller, Sasha Levin

From: Mao Wenan <maowenan@huawei.com>

[ Upstream commit 49f6c90bf6805948b597eabb499e500a47cf24be ]

sonic_send_packet will be processed in irq or non-irq
context, so it would better use dev_kfree_skb_any
instead of dev_kfree_skb.

Fixes: d9fb9f384292 ("*sonic/natsemi/ns83829: Move the National Semi-conductor drivers")
Signed-off-by: Mao Wenan <maowenan@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/natsemi/sonic.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/natsemi/sonic.c b/drivers/net/ethernet/natsemi/sonic.c
index 11f472fd5d477..a051dddcbd768 100644
--- a/drivers/net/ethernet/natsemi/sonic.c
+++ b/drivers/net/ethernet/natsemi/sonic.c
@@ -222,7 +222,7 @@ static int sonic_send_packet(struct sk_buff *skb, struct net_device *dev)
 	laddr = dma_map_single(lp->device, skb->data, length, DMA_TO_DEVICE);
 	if (!laddr) {
 		pr_err_ratelimited("%s: failed to map tx DMA buffer.\n", dev->name);
-		dev_kfree_skb(skb);
+		dev_kfree_skb_any(skb);
 		return NETDEV_TX_OK;
 	}
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 201/271] net/rds: Fix ib_evt_handler_call element in rds_ib_stat_names
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (199 preceding siblings ...)
  2020-01-28 14:05 ` [PATCH 4.9 200/271] net: sonic: replace dev_kfree_skb in sonic_send_packet Greg Kroah-Hartman
@ 2020-01-28 14:05 ` Greg Kroah-Hartman
  2020-01-28 14:05 ` [PATCH 4.9 202/271] iommu/amd: Wait for completion of IOTLB flush in attach_device Greg Kroah-Hartman
                   ` (74 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Gerd Rausch, Santosh Shilimkar,
	David S. Miller, Sasha Levin

From: Gerd Rausch <gerd.rausch@oracle.com>

[ Upstream commit 05a82481a3024b94db00b8c816bb3d526b5209e0 ]

All entries in 'rds_ib_stat_names' are stringified versions
of the corresponding "struct rds_ib_statistics" element
without the "s_"-prefix.

Fix entry 'ib_evt_handler_call' to do the same.

Fixes: f4f943c958a2 ("RDS: IB: ack more receive completions to improve performance")
Signed-off-by: Gerd Rausch <gerd.rausch@oracle.com>
Acked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/rds/ib_stats.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/rds/ib_stats.c b/net/rds/ib_stats.c
index 7e78dca1f252c..aaf4b3d102039 100644
--- a/net/rds/ib_stats.c
+++ b/net/rds/ib_stats.c
@@ -42,7 +42,7 @@ DEFINE_PER_CPU_SHARED_ALIGNED(struct rds_ib_statistics, rds_ib_stats);
 static const char *const rds_ib_stat_names[] = {
 	"ib_connect_raced",
 	"ib_listen_closed_stale",
-	"s_ib_evt_handler_call",
+	"ib_evt_handler_call",
 	"ib_tasklet_call",
 	"ib_tx_cq_event",
 	"ib_tx_ring_full",
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 202/271] iommu/amd: Wait for completion of IOTLB flush in attach_device
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (200 preceding siblings ...)
  2020-01-28 14:05 ` [PATCH 4.9 201/271] net/rds: Fix ib_evt_handler_call element in rds_ib_stat_names Greg Kroah-Hartman
@ 2020-01-28 14:05 ` Greg Kroah-Hartman
  2020-01-28 14:05 ` [PATCH 4.9 203/271] net: hisilicon: Fix signedness bug in hix5hd2_dev_probe() Greg Kroah-Hartman
                   ` (73 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Filippo Sironi, Joerg Roedel, Sasha Levin

From: Filippo Sironi <sironi@amazon.de>

[ Upstream commit 0b15e02f0cc4fb34a9160de7ba6db3a4013dc1b7 ]

To make sure the domain tlb flush completes before the
function returns, explicitly wait for its completion.

Signed-off-by: Filippo Sironi <sironi@amazon.de>
Fixes: 42a49f965a8d ("amd-iommu: flush domain tlb when attaching a new device")
[joro: Added commit message and fixes tag]
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iommu/amd_iommu.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
index c898c70472bb2..bb0448c91f672 100644
--- a/drivers/iommu/amd_iommu.c
+++ b/drivers/iommu/amd_iommu.c
@@ -2113,6 +2113,8 @@ skip_ats_check:
 	 */
 	domain_flush_tlb_pde(domain);
 
+	domain_flush_complete(domain);
+
 	return ret;
 }
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 203/271] net: hisilicon: Fix signedness bug in hix5hd2_dev_probe()
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (201 preceding siblings ...)
  2020-01-28 14:05 ` [PATCH 4.9 202/271] iommu/amd: Wait for completion of IOTLB flush in attach_device Greg Kroah-Hartman
@ 2020-01-28 14:05 ` Greg Kroah-Hartman
  2020-01-28 14:05 ` [PATCH 4.9 204/271] net: broadcom/bcmsysport: Fix signedness in bcm_sysport_probe() Greg Kroah-Hartman
                   ` (72 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, David S. Miller, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit 002dfe8085255b7bf1e0758c3d195c5412d35be9 ]

The "priv->phy_mode" variable is an enum and in this context GCC will
treat it as unsigned to the error handling will never trigger.

Fixes: 57c5bc9ad7d7 ("net: hisilicon: add hix5hd2 mac driver")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/hisilicon/hix5hd2_gmac.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/hisilicon/hix5hd2_gmac.c b/drivers/net/ethernet/hisilicon/hix5hd2_gmac.c
index e69a6bed31a95..dd24c352b2000 100644
--- a/drivers/net/ethernet/hisilicon/hix5hd2_gmac.c
+++ b/drivers/net/ethernet/hisilicon/hix5hd2_gmac.c
@@ -929,7 +929,7 @@ static int hix5hd2_dev_probe(struct platform_device *pdev)
 		goto err_free_mdio;
 
 	priv->phy_mode = of_get_phy_mode(node);
-	if (priv->phy_mode < 0) {
+	if ((int)priv->phy_mode < 0) {
 		netdev_err(ndev, "not find phy-mode\n");
 		ret = -EINVAL;
 		goto err_mdiobus;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 204/271] net: broadcom/bcmsysport: Fix signedness in bcm_sysport_probe()
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (202 preceding siblings ...)
  2020-01-28 14:05 ` [PATCH 4.9 203/271] net: hisilicon: Fix signedness bug in hix5hd2_dev_probe() Greg Kroah-Hartman
@ 2020-01-28 14:05 ` Greg Kroah-Hartman
  2020-01-28 14:05 ` [PATCH 4.9 205/271] net: stmmac: dwmac-meson8b: Fix signedness bug in probe Greg Kroah-Hartman
                   ` (71 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Florian Fainelli,
	David S. Miller, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit 25a584955f020d6ec499c513923fb220f3112d2b ]

The "priv->phy_interface" variable is an enum and in this context GCC
will treat it as unsigned so the error handling will never be
triggered.

Fixes: 80105befdb4b ("net: systemport: add Broadcom SYSTEMPORT Ethernet MAC driver")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/broadcom/bcmsysport.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
index 95874c10c23b6..e3b41af65d188 100644
--- a/drivers/net/ethernet/broadcom/bcmsysport.c
+++ b/drivers/net/ethernet/broadcom/bcmsysport.c
@@ -1773,7 +1773,7 @@ static int bcm_sysport_probe(struct platform_device *pdev)
 
 	priv->phy_interface = of_get_phy_mode(dn);
 	/* Default to GMII interface mode */
-	if (priv->phy_interface < 0)
+	if ((int)priv->phy_interface < 0)
 		priv->phy_interface = PHY_INTERFACE_MODE_GMII;
 
 	/* In the case of a fixed PHY, the DT node associated
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 205/271] net: stmmac: dwmac-meson8b: Fix signedness bug in probe
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (203 preceding siblings ...)
  2020-01-28 14:05 ` [PATCH 4.9 204/271] net: broadcom/bcmsysport: Fix signedness in bcm_sysport_probe() Greg Kroah-Hartman
@ 2020-01-28 14:05 ` Greg Kroah-Hartman
  2020-01-28 14:05 ` [PATCH 4.9 206/271] of: mdio: Fix a signedness bug in of_phy_get_and_connect() Greg Kroah-Hartman
                   ` (70 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Martin Blumenstingl,
	David S. Miller, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit f10210517a2f37feea2edf85eb34c98977265c16 ]

The "dwmac->phy_mode" is an enum and in this context GCC treats it as
an unsigned int so the error handling is never triggered.

Fixes: 566e82516253 ("net: stmmac: add a glue driver for the Amlogic Meson 8b / GXBB DWMAC")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c
index f356a44bcb811..6704d3e0392dc 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c
@@ -280,7 +280,7 @@ static int meson8b_dwmac_probe(struct platform_device *pdev)
 
 	dwmac->pdev = pdev;
 	dwmac->phy_mode = of_get_phy_mode(pdev->dev.of_node);
-	if (dwmac->phy_mode < 0) {
+	if ((int)dwmac->phy_mode < 0) {
 		dev_err(&pdev->dev, "missing phy-mode property\n");
 		ret = -EINVAL;
 		goto err_remove_config_dt;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 206/271] of: mdio: Fix a signedness bug in of_phy_get_and_connect()
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (204 preceding siblings ...)
  2020-01-28 14:05 ` [PATCH 4.9 205/271] net: stmmac: dwmac-meson8b: Fix signedness bug in probe Greg Kroah-Hartman
@ 2020-01-28 14:05 ` Greg Kroah-Hartman
  2020-01-28 14:05 ` [PATCH 4.9 207/271] net: ethernet: stmmac: Fix signedness bug in ipq806x_gmac_of_parse() Greg Kroah-Hartman
                   ` (69 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, David S. Miller, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit d7eb651212fdbafa82d485d8e76095ac3b14c193 ]

The "iface" variable is an enum and in this context GCC treats it as
an unsigned int so the error handling is never triggered.

Fixes: b78624125304 ("of_mdio: Abstract a general interface for phy connect")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/of/of_mdio.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/of/of_mdio.c b/drivers/of/of_mdio.c
index 262281bd68fa3..1e70851b15308 100644
--- a/drivers/of/of_mdio.c
+++ b/drivers/of/of_mdio.c
@@ -353,7 +353,7 @@ struct phy_device *of_phy_get_and_connect(struct net_device *dev,
 	struct phy_device *phy;
 
 	iface = of_get_phy_mode(np);
-	if (iface < 0)
+	if ((int)iface < 0)
 		return NULL;
 
 	phy_np = of_parse_phandle(np, "phy-handle", 0);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 207/271] net: ethernet: stmmac: Fix signedness bug in ipq806x_gmac_of_parse()
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (205 preceding siblings ...)
  2020-01-28 14:05 ` [PATCH 4.9 206/271] of: mdio: Fix a signedness bug in of_phy_get_and_connect() Greg Kroah-Hartman
@ 2020-01-28 14:05 ` Greg Kroah-Hartman
  2020-01-28 14:05 ` [PATCH 4.9 208/271] nvme: retain split access workaround for capability reads Greg Kroah-Hartman
                   ` (68 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, David S. Miller, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit 231042181dc9d6122c6faba64e99ccb25f13cc6c ]

The "gmac->phy_mode" variable is an enum and in this context GCC will
treat it as an unsigned int so the error handling will never be
triggered.

Fixes: b1c17215d718 ("stmmac: add ipq806x glue layer")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c
index 866444b6c82fa..11a4a81b0397c 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c
@@ -203,7 +203,7 @@ static int ipq806x_gmac_of_parse(struct ipq806x_gmac *gmac)
 	struct device *dev = &gmac->pdev->dev;
 
 	gmac->phy_mode = of_get_phy_mode(dev->of_node);
-	if (gmac->phy_mode < 0) {
+	if ((int)gmac->phy_mode < 0) {
 		dev_err(dev, "missing phy mode property\n");
 		return -EINVAL;
 	}
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 208/271] nvme: retain split access workaround for capability reads
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (206 preceding siblings ...)
  2020-01-28 14:05 ` [PATCH 4.9 207/271] net: ethernet: stmmac: Fix signedness bug in ipq806x_gmac_of_parse() Greg Kroah-Hartman
@ 2020-01-28 14:05 ` Greg Kroah-Hartman
  2020-01-28 14:05 ` [PATCH 4.9 209/271] net: stmmac: gmac4+: Not all Unicast addresses may be available Greg Kroah-Hartman
                   ` (67 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ard Biesheuvel, Sagi Grimberg, Sasha Levin

From: Ard Biesheuvel <ard.biesheuvel@linaro.org>

[ Upstream commit 3a8ecc935efabdad106b5e06d07b150c394b4465 ]

Commit 7fd8930f26be4

  "nvme: add a common helper to read Identify Controller data"

has re-introduced an issue that we have attempted to work around in the
past, in commit a310acd7a7ea ("NVMe: use split lo_hi_{read,write}q").

The problem is that some PCIe NVMe controllers do not implement 64-bit
outbound accesses correctly, which is why the commit above switched
to using lo_hi_[read|write]q for all 64-bit BAR accesses occuring in
the code.

In the mean time, the NVMe subsystem has been refactored, and now calls
into the PCIe support layer for NVMe via a .reg_read64() method, which
fails to use lo_hi_readq(), and thus reintroduces the problem that the
workaround above aimed to address.

Given that, at the moment, .reg_read64() is only used to read the
capability register [which is known to tolerate split reads], let's
switch .reg_read64() to lo_hi_readq() as well.

This fixes a boot issue on some ARM boxes with NVMe behind a Synopsys
DesignWare PCIe host controller.

Fixes: 7fd8930f26be4 ("nvme: add a common helper to read Identify Controller data")
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nvme/host/pci.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index 1ac4cec5f4f7c..e2bce9385eda6 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -1863,7 +1863,7 @@ static int nvme_pci_reg_write32(struct nvme_ctrl *ctrl, u32 off, u32 val)
 
 static int nvme_pci_reg_read64(struct nvme_ctrl *ctrl, u32 off, u64 *val)
 {
-	*val = readq(to_nvme_dev(ctrl)->bar + off);
+	*val = lo_hi_readq(to_nvme_dev(ctrl)->bar + off);
 	return 0;
 }
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 209/271] net: stmmac: gmac4+: Not all Unicast addresses may be available
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (207 preceding siblings ...)
  2020-01-28 14:05 ` [PATCH 4.9 208/271] nvme: retain split access workaround for capability reads Greg Kroah-Hartman
@ 2020-01-28 14:05 ` Greg Kroah-Hartman
  2020-01-28 14:05 ` [PATCH 4.9 210/271] mac80211: accept deauth frames in IBSS mode Greg Kroah-Hartman
                   ` (66 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jose Abreu, David S. Miller, Sasha Levin

From: Jose Abreu <Jose.Abreu@synopsys.com>

[ Upstream commit 25683bab09a70542b9f8e3e28f79b3369e56701f ]

Some setups may not have all Unicast addresses filters available. Check
the number of available filters before trying to setup it.

Fixes: 477286b53f55 ("stmmac: add GMAC4 core support")
Signed-off-by: Jose Abreu <Jose.Abreu@synopsys.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
index f46f2bfc2cc09..4216c0a5eaf5a 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
@@ -168,7 +168,7 @@ static void dwmac4_set_filter(struct mac_device_info *hw,
 	}
 
 	/* Handle multiple unicast addresses */
-	if (netdev_uc_count(dev) > GMAC_MAX_PERFECT_ADDRESSES) {
+	if (netdev_uc_count(dev) > hw->unicast_filter_entries) {
 		/* Switch to promiscuous mode if more than 128 addrs
 		 * are required
 		 */
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 210/271] mac80211: accept deauth frames in IBSS mode
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (208 preceding siblings ...)
  2020-01-28 14:05 ` [PATCH 4.9 209/271] net: stmmac: gmac4+: Not all Unicast addresses may be available Greg Kroah-Hartman
@ 2020-01-28 14:05 ` Greg Kroah-Hartman
  2020-01-28 14:06 ` [PATCH 4.9 211/271] llc: fix another potential sk_buff leak in llc_ui_sendmsg() Greg Kroah-Hartman
                   ` (65 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:05 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Johannes Berg, Luca Coelho, Sasha Levin

From: Johannes Berg <johannes.berg@intel.com>

[ Upstream commit 95697f9907bfe3eab0ef20265a766b22e27dde64 ]

We can process deauth frames and all, but we drop them very
early in the RX path today - this could never have worked.

Fixes: 2cc59e784b54 ("mac80211: reply to AUTH with DEAUTH if sta allocation fails in IBSS")
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/20191004123706.15768-2-luca@coelho.fi
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/mac80211/rx.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 3b423c50ec8fa..74652eb2f90fd 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -3205,9 +3205,18 @@ ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx)
 	case cpu_to_le16(IEEE80211_STYPE_PROBE_RESP):
 		/* process for all: mesh, mlme, ibss */
 		break;
+	case cpu_to_le16(IEEE80211_STYPE_DEAUTH):
+		if (is_multicast_ether_addr(mgmt->da) &&
+		    !is_broadcast_ether_addr(mgmt->da))
+			return RX_DROP_MONITOR;
+
+		/* process only for station/IBSS */
+		if (sdata->vif.type != NL80211_IFTYPE_STATION &&
+		    sdata->vif.type != NL80211_IFTYPE_ADHOC)
+			return RX_DROP_MONITOR;
+		break;
 	case cpu_to_le16(IEEE80211_STYPE_ASSOC_RESP):
 	case cpu_to_le16(IEEE80211_STYPE_REASSOC_RESP):
-	case cpu_to_le16(IEEE80211_STYPE_DEAUTH):
 	case cpu_to_le16(IEEE80211_STYPE_DISASSOC):
 		if (is_multicast_ether_addr(mgmt->da) &&
 		    !is_broadcast_ether_addr(mgmt->da))
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 211/271] llc: fix another potential sk_buff leak in llc_ui_sendmsg()
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (209 preceding siblings ...)
  2020-01-28 14:05 ` [PATCH 4.9 210/271] mac80211: accept deauth frames in IBSS mode Greg Kroah-Hartman
@ 2020-01-28 14:06 ` Greg Kroah-Hartman
  2020-01-28 14:06 ` [PATCH 4.9 212/271] llc: fix sk_buff refcounting in llc_conn_state_process() Greg Kroah-Hartman
                   ` (64 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Eric Biggers, Jakub Kicinski, Sasha Levin

From: Eric Biggers <ebiggers@google.com>

[ Upstream commit fc8d5db10cbe1338a52ebc74e7feab9276721774 ]

All callers of llc_conn_state_process() except llc_build_and_send_pkt()
(via llc_ui_sendmsg() -> llc_ui_send_data()) assume that it always
consumes a reference to the skb.  Fix this caller to do the same.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/llc/af_llc.c   | 34 ++++++++++++++++++++--------------
 net/llc/llc_conn.c |  2 ++
 net/llc/llc_if.c   | 12 ++++++++----
 3 files changed, 30 insertions(+), 18 deletions(-)

diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
index 789e66b0187a4..2a859f967c8af 100644
--- a/net/llc/af_llc.c
+++ b/net/llc/af_llc.c
@@ -111,22 +111,26 @@ static inline u8 llc_ui_header_len(struct sock *sk, struct sockaddr_llc *addr)
  *
  *	Send data via reliable llc2 connection.
  *	Returns 0 upon success, non-zero if action did not succeed.
+ *
+ *	This function always consumes a reference to the skb.
  */
 static int llc_ui_send_data(struct sock* sk, struct sk_buff *skb, int noblock)
 {
 	struct llc_sock* llc = llc_sk(sk);
-	int rc = 0;
 
 	if (unlikely(llc_data_accept_state(llc->state) ||
 		     llc->remote_busy_flag ||
 		     llc->p_flag)) {
 		long timeout = sock_sndtimeo(sk, noblock);
+		int rc;
 
 		rc = llc_ui_wait_for_busy_core(sk, timeout);
+		if (rc) {
+			kfree_skb(skb);
+			return rc;
+		}
 	}
-	if (unlikely(!rc))
-		rc = llc_build_and_send_pkt(sk, skb);
-	return rc;
+	return llc_build_and_send_pkt(sk, skb);
 }
 
 static void llc_ui_sk_init(struct socket *sock, struct sock *sk)
@@ -896,7 +900,7 @@ static int llc_ui_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
 	DECLARE_SOCKADDR(struct sockaddr_llc *, addr, msg->msg_name);
 	int flags = msg->msg_flags;
 	int noblock = flags & MSG_DONTWAIT;
-	struct sk_buff *skb;
+	struct sk_buff *skb = NULL;
 	size_t size = 0;
 	int rc = -EINVAL, copied = 0, hdrlen;
 
@@ -905,10 +909,10 @@ static int llc_ui_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
 	lock_sock(sk);
 	if (addr) {
 		if (msg->msg_namelen < sizeof(*addr))
-			goto release;
+			goto out;
 	} else {
 		if (llc_ui_addr_null(&llc->addr))
-			goto release;
+			goto out;
 		addr = &llc->addr;
 	}
 	/* must bind connection to sap if user hasn't done it. */
@@ -916,7 +920,7 @@ static int llc_ui_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
 		/* bind to sap with null dev, exclusive. */
 		rc = llc_ui_autobind(sock, addr);
 		if (rc)
-			goto release;
+			goto out;
 	}
 	hdrlen = llc->dev->hard_header_len + llc_ui_header_len(sk, addr);
 	size = hdrlen + len;
@@ -925,12 +929,12 @@ static int llc_ui_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
 	copied = size - hdrlen;
 	rc = -EINVAL;
 	if (copied < 0)
-		goto release;
+		goto out;
 	release_sock(sk);
 	skb = sock_alloc_send_skb(sk, size, noblock, &rc);
 	lock_sock(sk);
 	if (!skb)
-		goto release;
+		goto out;
 	skb->dev      = llc->dev;
 	skb->protocol = llc_proto_type(addr->sllc_arphrd);
 	skb_reserve(skb, hdrlen);
@@ -940,29 +944,31 @@ static int llc_ui_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
 	if (sk->sk_type == SOCK_DGRAM || addr->sllc_ua) {
 		llc_build_and_send_ui_pkt(llc->sap, skb, addr->sllc_mac,
 					  addr->sllc_sap);
+		skb = NULL;
 		goto out;
 	}
 	if (addr->sllc_test) {
 		llc_build_and_send_test_pkt(llc->sap, skb, addr->sllc_mac,
 					    addr->sllc_sap);
+		skb = NULL;
 		goto out;
 	}
 	if (addr->sllc_xid) {
 		llc_build_and_send_xid_pkt(llc->sap, skb, addr->sllc_mac,
 					   addr->sllc_sap);
+		skb = NULL;
 		goto out;
 	}
 	rc = -ENOPROTOOPT;
 	if (!(sk->sk_type == SOCK_STREAM && !addr->sllc_ua))
 		goto out;
 	rc = llc_ui_send_data(sk, skb, noblock);
+	skb = NULL;
 out:
-	if (rc) {
-		kfree_skb(skb);
-release:
+	kfree_skb(skb);
+	if (rc)
 		dprintk("%s: failed sending from %02X to %02X: %d\n",
 			__func__, llc->laddr.lsap, llc->daddr.lsap, rc);
-	}
 	release_sock(sk);
 	return rc ? : copied;
 }
diff --git a/net/llc/llc_conn.c b/net/llc/llc_conn.c
index 94c78cc49d3e0..2689e95471dc4 100644
--- a/net/llc/llc_conn.c
+++ b/net/llc/llc_conn.c
@@ -55,6 +55,8 @@ int sysctl_llc2_busy_timeout = LLC2_BUSY_TIME * HZ;
  *	(executing it's actions and changing state), upper layer will be
  *	indicated or confirmed, if needed. Returns 0 for success, 1 for
  *	failure. The socket lock has to be held before calling this function.
+ *
+ *	This function always consumes a reference to the skb.
  */
 int llc_conn_state_process(struct sock *sk, struct sk_buff *skb)
 {
diff --git a/net/llc/llc_if.c b/net/llc/llc_if.c
index 6daf391b3e847..fc4d2bd8816f5 100644
--- a/net/llc/llc_if.c
+++ b/net/llc/llc_if.c
@@ -38,6 +38,8 @@
  *	closed and -EBUSY when sending data is not permitted in this state or
  *	LLC has send an I pdu with p bit set to 1 and is waiting for it's
  *	response.
+ *
+ *	This function always consumes a reference to the skb.
  */
 int llc_build_and_send_pkt(struct sock *sk, struct sk_buff *skb)
 {
@@ -46,20 +48,22 @@ int llc_build_and_send_pkt(struct sock *sk, struct sk_buff *skb)
 	struct llc_sock *llc = llc_sk(sk);
 
 	if (unlikely(llc->state == LLC_CONN_STATE_ADM))
-		goto out;
+		goto out_free;
 	rc = -EBUSY;
 	if (unlikely(llc_data_accept_state(llc->state) || /* data_conn_refuse */
 		     llc->p_flag)) {
 		llc->failed_data_req = 1;
-		goto out;
+		goto out_free;
 	}
 	ev = llc_conn_ev(skb);
 	ev->type      = LLC_CONN_EV_TYPE_PRIM;
 	ev->prim      = LLC_DATA_PRIM;
 	ev->prim_type = LLC_PRIM_TYPE_REQ;
 	skb->dev      = llc->dev;
-	rc = llc_conn_state_process(sk, skb);
-out:
+	return llc_conn_state_process(sk, skb);
+
+out_free:
+	kfree_skb(skb);
 	return rc;
 }
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 212/271] llc: fix sk_buff refcounting in llc_conn_state_process()
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (210 preceding siblings ...)
  2020-01-28 14:06 ` [PATCH 4.9 211/271] llc: fix another potential sk_buff leak in llc_ui_sendmsg() Greg Kroah-Hartman
@ 2020-01-28 14:06 ` Greg Kroah-Hartman
  2020-01-28 14:06 ` [PATCH 4.9 213/271] net: stmmac: fix length of PTP clocks name string Greg Kroah-Hartman
                   ` (63 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Eric Biggers, Jakub Kicinski, Sasha Levin

From: Eric Biggers <ebiggers@google.com>

[ Upstream commit 36453c852816f19947ca482a595dffdd2efa4965 ]

If llc_conn_state_process() sees that llc_conn_service() put the skb on
a list, it will drop one fewer references to it.  This is wrong because
the current behavior is that llc_conn_service() never consumes a
reference to the skb.

The code also makes the number of skb references being dropped
conditional on which of ind_prim and cfm_prim are nonzero, yet neither
of these affects how many references are *acquired*.  So there is extra
code that tries to fix this up by sometimes taking another reference.

Remove the unnecessary/broken refcounting logic and instead just add an
skb_get() before the only two places where an extra reference is
actually consumed.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/llc/llc_conn.c | 33 ++++++---------------------------
 1 file changed, 6 insertions(+), 27 deletions(-)

diff --git a/net/llc/llc_conn.c b/net/llc/llc_conn.c
index 2689e95471dc4..1bdbd134bd7a8 100644
--- a/net/llc/llc_conn.c
+++ b/net/llc/llc_conn.c
@@ -64,12 +64,6 @@ int llc_conn_state_process(struct sock *sk, struct sk_buff *skb)
 	struct llc_sock *llc = llc_sk(skb->sk);
 	struct llc_conn_state_ev *ev = llc_conn_ev(skb);
 
-	/*
-	 * We have to hold the skb, because llc_conn_service will kfree it in
-	 * the sending path and we need to look at the skb->cb, where we encode
-	 * llc_conn_state_ev.
-	 */
-	skb_get(skb);
 	ev->ind_prim = ev->cfm_prim = 0;
 	/*
 	 * Send event to state machine
@@ -77,21 +71,12 @@ int llc_conn_state_process(struct sock *sk, struct sk_buff *skb)
 	rc = llc_conn_service(skb->sk, skb);
 	if (unlikely(rc != 0)) {
 		printk(KERN_ERR "%s: llc_conn_service failed\n", __func__);
-		goto out_kfree_skb;
-	}
-
-	if (unlikely(!ev->ind_prim && !ev->cfm_prim)) {
-		/* indicate or confirm not required */
-		if (!skb->next)
-			goto out_kfree_skb;
 		goto out_skb_put;
 	}
 
-	if (unlikely(ev->ind_prim && ev->cfm_prim)) /* Paranoia */
-		skb_get(skb);
-
 	switch (ev->ind_prim) {
 	case LLC_DATA_PRIM:
+		skb_get(skb);
 		llc_save_primitive(sk, skb, LLC_DATA_PRIM);
 		if (unlikely(sock_queue_rcv_skb(sk, skb))) {
 			/*
@@ -108,6 +93,7 @@ int llc_conn_state_process(struct sock *sk, struct sk_buff *skb)
 		 * skb->sk pointing to the newly created struct sock in
 		 * llc_conn_handler. -acme
 		 */
+		skb_get(skb);
 		skb_queue_tail(&sk->sk_receive_queue, skb);
 		sk->sk_state_change(sk);
 		break;
@@ -123,7 +109,6 @@ int llc_conn_state_process(struct sock *sk, struct sk_buff *skb)
 				sk->sk_state_change(sk);
 			}
 		}
-		kfree_skb(skb);
 		sock_put(sk);
 		break;
 	case LLC_RESET_PRIM:
@@ -132,14 +117,11 @@ int llc_conn_state_process(struct sock *sk, struct sk_buff *skb)
 		 * RESET is not being notified to upper layers for now
 		 */
 		printk(KERN_INFO "%s: received a reset ind!\n", __func__);
-		kfree_skb(skb);
 		break;
 	default:
-		if (ev->ind_prim) {
+		if (ev->ind_prim)
 			printk(KERN_INFO "%s: received unknown %d prim!\n",
 				__func__, ev->ind_prim);
-			kfree_skb(skb);
-		}
 		/* No indication */
 		break;
 	}
@@ -181,15 +163,12 @@ int llc_conn_state_process(struct sock *sk, struct sk_buff *skb)
 		printk(KERN_INFO "%s: received a reset conf!\n", __func__);
 		break;
 	default:
-		if (ev->cfm_prim) {
+		if (ev->cfm_prim)
 			printk(KERN_INFO "%s: received unknown %d prim!\n",
 					__func__, ev->cfm_prim);
-			break;
-		}
-		goto out_skb_put; /* No confirmation */
+		/* No confirmation */
+		break;
 	}
-out_kfree_skb:
-	kfree_skb(skb);
 out_skb_put:
 	kfree_skb(skb);
 	return rc;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 213/271] net: stmmac: fix length of PTP clocks name string
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (211 preceding siblings ...)
  2020-01-28 14:06 ` [PATCH 4.9 212/271] llc: fix sk_buff refcounting in llc_conn_state_process() Greg Kroah-Hartman
@ 2020-01-28 14:06 ` Greg Kroah-Hartman
  2020-01-28 14:06 ` [PATCH 4.9 214/271] act_mirred: Fix mirred_init_module error handling Greg Kroah-Hartman
                   ` (62 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Antonio Borneo, Jakub Kicinski, Sasha Levin

From: Antonio Borneo <antonio.borneo@st.com>

[ Upstream commit 5da202c88f8c355ad79bc2e8eb582e6d433060e7 ]

The field "name" in struct ptp_clock_info has a fixed size of 16
chars and is used as zero terminated string by clock_name_show()
in drivers/ptp/ptp_sysfs.c
The current initialization value requires 17 chars to fit also the
null termination, and this causes overflow to the next bytes in
the struct when the string is read as null terminated:
	hexdump -C /sys/class/ptp/ptp0/clock_name
	00000000  73 74 6d 6d 61 63 5f 70  74 70 5f 63 6c 6f 63 6b  |stmmac_ptp_clock|
	00000010  a0 ac b9 03 0a                                    |.....|
where the extra 4 bytes (excluding the newline) after the string
represent the integer 0x03b9aca0 = 62500000 assigned to the field
"max_adj" that follows "name" in the same struct.

There is no strict requirement for the "name" content and in the
comment in ptp_clock_kernel.h it's reported it should just be 'A
short "friendly name" to identify the clock'.
Replace it with "stmmac ptp".

Signed-off-by: Antonio Borneo <antonio.borneo@st.com>
Fixes: 92ba6888510c ("stmmac: add the support for PTP hw clock driver")
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c
index 3eb281d1db08a..2313308090370 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c
@@ -158,7 +158,7 @@ static int stmmac_enable(struct ptp_clock_info *ptp,
 /* structure describing a PTP hardware clock */
 static struct ptp_clock_info stmmac_ptp_clock_ops = {
 	.owner = THIS_MODULE,
-	.name = "stmmac_ptp_clock",
+	.name = "stmmac ptp",
 	.max_adj = 62500000,
 	.n_alarm = 0,
 	.n_ext_ts = 0,
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 214/271] act_mirred: Fix mirred_init_module error handling
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (212 preceding siblings ...)
  2020-01-28 14:06 ` [PATCH 4.9 213/271] net: stmmac: fix length of PTP clocks name string Greg Kroah-Hartman
@ 2020-01-28 14:06 ` Greg Kroah-Hartman
  2020-01-28 14:06 ` [PATCH 4.9 215/271] drm/msm/dsi: Implement reset correctly Greg Kroah-Hartman
                   ` (61 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, YueHaibing, Jakub Kicinski, Sasha Levin

From: YueHaibing <yuehaibing@huawei.com>

[ Upstream commit 11c9a7d38af524217efb7a176ad322b97ac2f163 ]

If tcf_register_action failed, mirred_device_notifier
should be unregistered.

Fixes: 3b87956ea645 ("net sched: fix race in mirred device removal")
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/sched/act_mirred.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c
index fc3650b061924..9b4c7c42c932d 100644
--- a/net/sched/act_mirred.c
+++ b/net/sched/act_mirred.c
@@ -332,7 +332,11 @@ static int __init mirred_init_module(void)
 		return err;
 
 	pr_info("Mirror/redirect action on\n");
-	return tcf_register_action(&act_mirred_ops, &mirred_net_ops);
+	err = tcf_register_action(&act_mirred_ops, &mirred_net_ops);
+	if (err)
+		unregister_netdevice_notifier(&mirred_device_notifier);
+
+	return err;
 }
 
 static void __exit mirred_cleanup_module(void)
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 215/271] drm/msm/dsi: Implement reset correctly
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (213 preceding siblings ...)
  2020-01-28 14:06 ` [PATCH 4.9 214/271] act_mirred: Fix mirred_init_module error handling Greg Kroah-Hartman
@ 2020-01-28 14:06 ` Greg Kroah-Hartman
  2020-01-28 14:06 ` [PATCH 4.9 216/271] dmaengine: imx-sdma: fix size check for sdma script_number Greg Kroah-Hartman
                   ` (60 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hai Li, Rob Clark, Jeffrey Hugo,
	Sean Paul, Sean Paul, Sasha Levin

From: Jeffrey Hugo <jeffrey.l.hugo@gmail.com>

[ Upstream commit 78e31c42261779a01bc73472d0f65f15378e9de3 ]

On msm8998, vblank timeouts are observed because the DSI controller is not
reset properly, which ends up stalling the MDP.  This is because the reset
logic is not correct per the hardware documentation.

The documentation states that after asserting reset, software should wait
some time (no indication of how long), or poll the status register until it
returns 0 before deasserting reset.

wmb() is insufficient for this purpose since it just ensures ordering, not
timing between writes.  Since asserting and deasserting reset occurs on the
same register, ordering is already guaranteed by the architecture, making
the wmb extraneous.

Since we would define a timeout for polling the status register to avoid a
possible infinite loop, lets just use a static delay of 20 ms, since 16.666
ms is the time available to process one frame at 60 fps.

Fixes: a689554ba6ed ("drm/msm: Initial add DSI connector support")
Cc: Hai Li <hali@codeaurora.org>
Cc: Rob Clark <robdclark@gmail.com>
Signed-off-by: Jeffrey Hugo <jeffrey.l.hugo@gmail.com>
Reviewed-by: Sean Paul <sean@poorly.run>
[seanpaul renamed RESET_DELAY to DSI_RESET_TOGGLE_DELAY_MS]
Signed-off-by: Sean Paul <seanpaul@chromium.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20191011133939.16551-1-jeffrey.l.hugo@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/msm/dsi/dsi_host.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/msm/dsi/dsi_host.c b/drivers/gpu/drm/msm/dsi/dsi_host.c
index 6f240021705b0..e49b414c012c6 100644
--- a/drivers/gpu/drm/msm/dsi/dsi_host.c
+++ b/drivers/gpu/drm/msm/dsi/dsi_host.c
@@ -33,6 +33,8 @@
 #include "sfpb.xml.h"
 #include "dsi_cfg.h"
 
+#define DSI_RESET_TOGGLE_DELAY_MS 20
+
 static int dsi_get_version(const void __iomem *base, u32 *major, u32 *minor)
 {
 	u32 ver;
@@ -909,7 +911,7 @@ static void dsi_sw_reset(struct msm_dsi_host *msm_host)
 	wmb(); /* clocks need to be enabled before reset */
 
 	dsi_write(msm_host, REG_DSI_RESET, 1);
-	wmb(); /* make sure reset happen */
+	msleep(DSI_RESET_TOGGLE_DELAY_MS); /* make sure reset happen */
 	dsi_write(msm_host, REG_DSI_RESET, 0);
 }
 
@@ -1288,7 +1290,7 @@ static void dsi_sw_reset_restore(struct msm_dsi_host *msm_host)
 
 	/* dsi controller can only be reset while clocks are running */
 	dsi_write(msm_host, REG_DSI_RESET, 1);
-	wmb();	/* make sure reset happen */
+	msleep(DSI_RESET_TOGGLE_DELAY_MS); /* make sure reset happen */
 	dsi_write(msm_host, REG_DSI_RESET, 0);
 	wmb();	/* controller out of reset */
 	dsi_write(msm_host, REG_DSI_CTRL, data0);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 216/271] dmaengine: imx-sdma: fix size check for sdma script_number
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (214 preceding siblings ...)
  2020-01-28 14:06 ` [PATCH 4.9 215/271] drm/msm/dsi: Implement reset correctly Greg Kroah-Hartman
@ 2020-01-28 14:06 ` Greg Kroah-Hartman
  2020-01-28 14:06 ` [PATCH 4.9 217/271] net: netem: fix error path for corrupted GSO frames Greg Kroah-Hartman
                   ` (59 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, stable, Robin Gong, Jurgen Lambrecht,
	Vinod Koul, Sasha Levin

From: Robin Gong <yibin.gong@nxp.com>

[ Upstream commit bd73dfabdda280fc5f05bdec79b6721b4b2f035f ]

Illegal memory will be touch if SDMA_SCRIPT_ADDRS_ARRAY_SIZE_V3
(41) exceed the size of structure sdma_script_start_addrs(40),
thus cause memory corrupt such as slob block header so that kernel
trap into while() loop forever in slob_free(). Please refer to below
code piece in imx-sdma.c:
for (i = 0; i < sdma->script_number; i++)
	if (addr_arr[i] > 0)
		saddr_arr[i] = addr_arr[i]; /* memory corrupt here */
That issue was brought by commit a572460be9cf ("dmaengine: imx-sdma: Add
support for version 3 firmware") because SDMA_SCRIPT_ADDRS_ARRAY_SIZE_V3
(38->41 3 scripts added) not align with script number added in
sdma_script_start_addrs(2 scripts).

Fixes: a572460be9cf ("dmaengine: imx-sdma: Add support for version 3 firmware")
Cc: stable@vger.kernel
Link: https://www.spinics.net/lists/arm-kernel/msg754895.html
Signed-off-by: Robin Gong <yibin.gong@nxp.com>
Reported-by: Jurgen Lambrecht <J.Lambrecht@TELEVIC.com>
Link: https://lore.kernel.org/r/1569347584-3478-1-git-send-email-yibin.gong@nxp.com
[vkoul: update the patch title]
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/dma/imx-sdma.c                     | 8 ++++++++
 include/linux/platform_data/dma-imx-sdma.h | 3 +++
 2 files changed, 11 insertions(+)

diff --git a/drivers/dma/imx-sdma.c b/drivers/dma/imx-sdma.c
index 9f240b2d85a54..558d509b7d855 100644
--- a/drivers/dma/imx-sdma.c
+++ b/drivers/dma/imx-sdma.c
@@ -1441,6 +1441,14 @@ static void sdma_add_scripts(struct sdma_engine *sdma,
 	if (!sdma->script_number)
 		sdma->script_number = SDMA_SCRIPT_ADDRS_ARRAY_SIZE_V1;
 
+	if (sdma->script_number > sizeof(struct sdma_script_start_addrs)
+				  / sizeof(s32)) {
+		dev_err(sdma->dev,
+			"SDMA script number %d not match with firmware.\n",
+			sdma->script_number);
+		return;
+	}
+
 	for (i = 0; i < sdma->script_number; i++)
 		if (addr_arr[i] > 0)
 			saddr_arr[i] = addr_arr[i];
diff --git a/include/linux/platform_data/dma-imx-sdma.h b/include/linux/platform_data/dma-imx-sdma.h
index 2d08816720f6d..5bb0a119f39a3 100644
--- a/include/linux/platform_data/dma-imx-sdma.h
+++ b/include/linux/platform_data/dma-imx-sdma.h
@@ -50,7 +50,10 @@ struct sdma_script_start_addrs {
 	/* End of v2 array */
 	s32 zcanfd_2_mcu_addr;
 	s32 zqspi_2_mcu_addr;
+	s32 mcu_2_ecspi_addr;
 	/* End of v3 array */
+	s32 mcu_2_zqspi_addr;
+	/* End of v4 array */
 };
 
 /**
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 217/271] net: netem: fix error path for corrupted GSO frames
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (215 preceding siblings ...)
  2020-01-28 14:06 ` [PATCH 4.9 216/271] dmaengine: imx-sdma: fix size check for sdma script_number Greg Kroah-Hartman
@ 2020-01-28 14:06 ` Greg Kroah-Hartman
  2020-01-28 14:06 ` [PATCH 4.9 218/271] net: netem: correct the parents backlog when corrupted packet was dropped Greg Kroah-Hartman
                   ` (58 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, kbuild test robot, Dan Carpenter,
	Ben Hutchings, Jakub Kicinski, Simon Horman, David S. Miller,
	Sasha Levin

From: Jakub Kicinski <jakub.kicinski@netronome.com>

[ Upstream commit a7fa12d15855904aff1716e1fc723c03ba38c5cc ]

To corrupt a GSO frame we first perform segmentation.  We then
proceed using the first segment instead of the full GSO skb and
requeue the rest of the segments as separate packets.

If there are any issues with processing the first segment we
still want to process the rest, therefore we jump to the
finish_segs label.

Commit 177b8007463c ("net: netem: fix backlog accounting for
corrupted GSO frames") started using the pointer to the first
segment in the "rest of segments processing", but as mentioned
above the first segment may had already been freed at this point.

Backlog corrections for parent qdiscs have to be adjusted.

Fixes: 177b8007463c ("net: netem: fix backlog accounting for corrupted GSO frames")
Reported-by: kbuild test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Reported-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Reviewed-by: Simon Horman <simon.horman@netronome.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/sched/sch_netem.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
index 308d92491757e..11c4c93f5ded7 100644
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -510,6 +510,7 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch,
 		if (skb->ip_summed == CHECKSUM_PARTIAL &&
 		    skb_checksum_help(skb)) {
 			qdisc_drop(skb, sch, to_free);
+			skb = NULL;
 			goto finish_segs;
 		}
 
@@ -586,9 +587,10 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch,
 finish_segs:
 	if (segs) {
 		unsigned int len, last_len;
-		int nb = 0;
+		int nb;
 
-		len = skb->len;
+		len = skb ? skb->len : 0;
+		nb = skb ? 1 : 0;
 
 		while (segs) {
 			skb2 = segs->next;
@@ -605,7 +607,8 @@ finish_segs:
 			}
 			segs = skb2;
 		}
-		qdisc_tree_reduce_backlog(sch, -nb, prev_len - len);
+		/* Parent qdiscs accounted for 1 skb of size @prev_len */
+		qdisc_tree_reduce_backlog(sch, -(nb - 1), -(len - prev_len));
 	}
 	return NET_XMIT_SUCCESS;
 }
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 218/271] net: netem: correct the parents backlog when corrupted packet was dropped
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (216 preceding siblings ...)
  2020-01-28 14:06 ` [PATCH 4.9 217/271] net: netem: fix error path for corrupted GSO frames Greg Kroah-Hartman
@ 2020-01-28 14:06 ` Greg Kroah-Hartman
  2020-01-28 14:06 ` [PATCH 4.9 219/271] net: qca_spi: Move reset_count to struct qcaspi Greg Kroah-Hartman
                   ` (57 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jakub Kicinski, Simon Horman,
	David S. Miller, Sasha Levin

From: Jakub Kicinski <jakub.kicinski@netronome.com>

[ Upstream commit e0ad032e144731a5928f2d75e91c2064ba1a764c ]

If packet corruption failed we jump to finish_segs and return
NET_XMIT_SUCCESS. Seeing success will make the parent qdisc
increment its backlog, that's incorrect - we need to return
NET_XMIT_DROP.

Fixes: 6071bd1aa13e ("netem: Segment GSO packets on enqueue")
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Reviewed-by: Simon Horman <simon.horman@netronome.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/sched/sch_netem.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
index 11c4c93f5ded7..e06491314d592 100644
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -609,6 +609,8 @@ finish_segs:
 		}
 		/* Parent qdiscs accounted for 1 skb of size @prev_len */
 		qdisc_tree_reduce_backlog(sch, -(nb - 1), -(len - prev_len));
+	} else if (!skb) {
+		return NET_XMIT_DROP;
 	}
 	return NET_XMIT_SUCCESS;
 }
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 219/271] net: qca_spi: Move reset_count to struct qcaspi
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (217 preceding siblings ...)
  2020-01-28 14:06 ` [PATCH 4.9 218/271] net: netem: correct the parents backlog when corrupted packet was dropped Greg Kroah-Hartman
@ 2020-01-28 14:06 ` Greg Kroah-Hartman
  2020-01-28 14:06 ` [PATCH 4.9 220/271] afs: Fix large file support Greg Kroah-Hartman
                   ` (56 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Stefan Wahren, Stefan Wahren,
	David S. Miller, Sasha Levin

From: Stefan Wahren <stefan.wahren@in-tech.com>

[ Upstream commit bc19c32904e36548335b35fdce6ce734e20afc0a ]

The reset counter is specific for every QCA700x chip. So move this
into the private driver struct. Otherwise we get unpredictable reset
behavior in setups with multiple QCA700x chips.

Fixes: 291ab06ecf67 (net: qualcomm: new Ethernet over SPI driver for QCA7000)
Signed-off-by: Stefan Wahren <stefan.wahren@in-tech.com>
Signed-off-by: Stefan Wahren <wahrenst@gmx.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/qualcomm/qca_spi.c | 9 ++++-----
 drivers/net/ethernet/qualcomm/qca_spi.h | 1 +
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/net/ethernet/qualcomm/qca_spi.c b/drivers/net/ethernet/qualcomm/qca_spi.c
index 21f546587e3d5..31583d6f044f4 100644
--- a/drivers/net/ethernet/qualcomm/qca_spi.c
+++ b/drivers/net/ethernet/qualcomm/qca_spi.c
@@ -438,7 +438,6 @@ qcaspi_qca7k_sync(struct qcaspi *qca, int event)
 	u16 signature = 0;
 	u16 spi_config;
 	u16 wrbuf_space = 0;
-	static u16 reset_count;
 
 	if (event == QCASPI_EVENT_CPUON) {
 		/* Read signature twice, if not valid
@@ -491,13 +490,13 @@ qcaspi_qca7k_sync(struct qcaspi *qca, int event)
 
 		qca->sync = QCASPI_SYNC_RESET;
 		qca->stats.trig_reset++;
-		reset_count = 0;
+		qca->reset_count = 0;
 		break;
 	case QCASPI_SYNC_RESET:
-		reset_count++;
+		qca->reset_count++;
 		netdev_dbg(qca->net_dev, "sync: waiting for CPU on, count %u.\n",
-			   reset_count);
-		if (reset_count >= QCASPI_RESET_TIMEOUT) {
+			   qca->reset_count);
+		if (qca->reset_count >= QCASPI_RESET_TIMEOUT) {
 			/* reset did not seem to take place, try again */
 			qca->sync = QCASPI_SYNC_UNKNOWN;
 			qca->stats.reset_timeout++;
diff --git a/drivers/net/ethernet/qualcomm/qca_spi.h b/drivers/net/ethernet/qualcomm/qca_spi.h
index 6e31a0e744a45..c48c314ca4dfa 100644
--- a/drivers/net/ethernet/qualcomm/qca_spi.h
+++ b/drivers/net/ethernet/qualcomm/qca_spi.h
@@ -97,6 +97,7 @@ struct qcaspi {
 
 	unsigned int intr_req;
 	unsigned int intr_svc;
+	u16 reset_count;
 
 #ifdef CONFIG_DEBUG_FS
 	struct dentry *device_root;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 220/271] afs: Fix large file support
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (218 preceding siblings ...)
  2020-01-28 14:06 ` [PATCH 4.9 219/271] net: qca_spi: Move reset_count to struct qcaspi Greg Kroah-Hartman
@ 2020-01-28 14:06 ` Greg Kroah-Hartman
  2020-01-28 14:06 ` [PATCH 4.9 221/271] media: ov6650: Fix incorrect use of JPEG colorspace Greg Kroah-Hartman
                   ` (55 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Marc Dionne, David Howells,
	Linus Torvalds, Sasha Levin

From: Marc Dionne <marc.dionne@auristor.com>

[ Upstream commit b485275f1aca8a9da37fd35e4fad673935e827da ]

By default s_maxbytes is set to MAX_NON_LFS, which limits the usable
file size to 2GB, enforced by the vfs.

Commit b9b1f8d5930a ("AFS: write support fixes") added support for the
64-bit fetch and store server operations, but did not change this value.
As a result, attempts to write past the 2G mark result in EFBIG errors:

 $ dd if=/dev/zero of=foo bs=1M count=1 seek=2048
 dd: error writing 'foo': File too large

Set s_maxbytes to MAX_LFS_FILESIZE.

Fixes: b9b1f8d5930a ("AFS: write support fixes")
Signed-off-by: Marc Dionne <marc.dionne@auristor.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/afs/super.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/afs/super.c b/fs/afs/super.c
index fbdb022b75a27..65389394e2028 100644
--- a/fs/afs/super.c
+++ b/fs/afs/super.c
@@ -317,6 +317,7 @@ static int afs_fill_super(struct super_block *sb,
 	/* fill in the superblock */
 	sb->s_blocksize		= PAGE_SIZE;
 	sb->s_blocksize_bits	= PAGE_SHIFT;
+	sb->s_maxbytes		= MAX_LFS_FILESIZE;
 	sb->s_magic		= AFS_FS_MAGIC;
 	sb->s_op		= &afs_super_ops;
 	sb->s_bdi		= &as->volume->bdi;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 221/271] media: ov6650: Fix incorrect use of JPEG colorspace
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (219 preceding siblings ...)
  2020-01-28 14:06 ` [PATCH 4.9 220/271] afs: Fix large file support Greg Kroah-Hartman
@ 2020-01-28 14:06 ` Greg Kroah-Hartman
  2020-01-28 14:06 ` [PATCH 4.9 222/271] media: ov6650: Fix some format attributes not under control Greg Kroah-Hartman
                   ` (54 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Janusz Krzysztofik, Sakari Ailus,
	Mauro Carvalho Chehab, Sasha Levin

From: Janusz Krzysztofik <jmkrzyszt@gmail.com>

[ Upstream commit 12500731895ef09afc5b66b86b76c0884fb9c7bf ]

Since its initial submission, the driver selects V4L2_COLORSPACE_JPEG
for supported formats other than V4L2_MBUS_FMT_SBGGR8_1X8.  According
to v4l2-compliance test program, V4L2_COLORSPACE_JPEG applies
exclusively to V4L2_PIX_FMT_JPEG.  Since the sensor does not support
JPEG format, fix it to always select V4L2_COLORSPACE_SRGB.

Fixes: 2f6e2404799a ("[media] SoC Camera: add driver for OV6650 sensor")
Signed-off-by: Janusz Krzysztofik <jmkrzyszt@gmail.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/i2c/soc_camera/ov6650.c | 13 ++-----------
 1 file changed, 2 insertions(+), 11 deletions(-)

diff --git a/drivers/media/i2c/soc_camera/ov6650.c b/drivers/media/i2c/soc_camera/ov6650.c
index 7a119466f9734..e9271ad9ee4c1 100644
--- a/drivers/media/i2c/soc_camera/ov6650.c
+++ b/drivers/media/i2c/soc_camera/ov6650.c
@@ -203,7 +203,6 @@ struct ov6650 {
 	unsigned long		pclk_max;	/* from resolution and format */
 	struct v4l2_fract	tpf;		/* as requested with s_parm */
 	u32 code;
-	enum v4l2_colorspace	colorspace;
 };
 
 
@@ -515,7 +514,7 @@ static int ov6650_get_fmt(struct v4l2_subdev *sd,
 	mf->width	= priv->rect.width >> priv->half_scale;
 	mf->height	= priv->rect.height >> priv->half_scale;
 	mf->code	= priv->code;
-	mf->colorspace	= priv->colorspace;
+	mf->colorspace	= V4L2_COLORSPACE_SRGB;
 	mf->field	= V4L2_FIELD_NONE;
 
 	return 0;
@@ -624,11 +623,6 @@ static int ov6650_s_fmt(struct v4l2_subdev *sd, struct v4l2_mbus_framefmt *mf)
 		priv->pclk_max = 8000000;
 	}
 
-	if (code == MEDIA_BUS_FMT_SBGGR8_1X8)
-		priv->colorspace = V4L2_COLORSPACE_SRGB;
-	else if (code != 0)
-		priv->colorspace = V4L2_COLORSPACE_JPEG;
-
 	if (half_scale) {
 		dev_dbg(&client->dev, "max resolution: QCIF\n");
 		coma_set |= COMA_QCIF;
@@ -685,7 +679,6 @@ static int ov6650_s_fmt(struct v4l2_subdev *sd, struct v4l2_mbus_framefmt *mf)
 		priv->code = code;
 
 	if (!ret) {
-		mf->colorspace	= priv->colorspace;
 		mf->width = priv->rect.width >> half_scale;
 		mf->height = priv->rect.height >> half_scale;
 	}
@@ -708,6 +701,7 @@ static int ov6650_set_fmt(struct v4l2_subdev *sd,
 				&mf->height, 2, H_CIF, 1, 0);
 
 	mf->field = V4L2_FIELD_NONE;
+	mf->colorspace = V4L2_COLORSPACE_SRGB;
 
 	switch (mf->code) {
 	case MEDIA_BUS_FMT_Y10_1X10:
@@ -717,12 +711,10 @@ static int ov6650_set_fmt(struct v4l2_subdev *sd,
 	case MEDIA_BUS_FMT_YUYV8_2X8:
 	case MEDIA_BUS_FMT_VYUY8_2X8:
 	case MEDIA_BUS_FMT_UYVY8_2X8:
-		mf->colorspace = V4L2_COLORSPACE_JPEG;
 		break;
 	default:
 		mf->code = MEDIA_BUS_FMT_SBGGR8_1X8;
 	case MEDIA_BUS_FMT_SBGGR8_1X8:
-		mf->colorspace = V4L2_COLORSPACE_SRGB;
 		break;
 	}
 
@@ -1048,7 +1040,6 @@ static int ov6650_probe(struct i2c_client *client,
 	priv->rect.height = H_CIF;
 	priv->half_scale  = false;
 	priv->code	  = MEDIA_BUS_FMT_YUYV8_2X8;
-	priv->colorspace  = V4L2_COLORSPACE_JPEG;
 
 	ret = ov6650_video_probe(client);
 	if (ret)
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 222/271] media: ov6650: Fix some format attributes not under control
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (220 preceding siblings ...)
  2020-01-28 14:06 ` [PATCH 4.9 221/271] media: ov6650: Fix incorrect use of JPEG colorspace Greg Kroah-Hartman
@ 2020-01-28 14:06 ` Greg Kroah-Hartman
  2020-01-28 14:06 ` [PATCH 4.9 223/271] media: ov6650: Fix .get_fmt() V4L2_SUBDEV_FORMAT_TRY support Greg Kroah-Hartman
                   ` (53 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Janusz Krzysztofik, Sakari Ailus,
	Mauro Carvalho Chehab, Sasha Levin

From: Janusz Krzysztofik <jmkrzyszt@gmail.com>

[ Upstream commit 1c6a2b63095154bbf9e8f38d79487a728331bf65 ]

User arguments passed to .get/set_fmt() pad operation callbacks may
contain unsupported values.  The driver takes control over frame size
and pixel code as well as colorspace and field attributes but has never
cared for remainig format attributes, i.e., ycbcr_enc, quantization
and xfer_func, introduced by commit 11ff030c7365 ("[media]
v4l2-mediabus: improve colorspace support").  Fix it.

Set up a static v4l2_mbus_framefmt structure with attributes
initialized to reasonable defaults and use it for updating content of
user provided arguments.  In case of V4L2_SUBDEV_FORMAT_ACTIVE,
postpone frame size update, now performed from inside ov6650_s_fmt()
helper, util the user argument is first updated in ov6650_set_fmt() with
default frame format content.  For V4L2_SUBDEV_FORMAT_TRY, don't copy
all attributes to pad config, only those handled by the driver, then
fill the response with the default frame format updated with resulting
pad config format code and frame size.

Fixes: 11ff030c7365 ("[media] v4l2-mediabus: improve colorspace support")
Signed-off-by: Janusz Krzysztofik <jmkrzyszt@gmail.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/i2c/soc_camera/ov6650.c | 51 ++++++++++++++++++++-------
 1 file changed, 39 insertions(+), 12 deletions(-)

diff --git a/drivers/media/i2c/soc_camera/ov6650.c b/drivers/media/i2c/soc_camera/ov6650.c
index e9271ad9ee4c1..3b118d45d433b 100644
--- a/drivers/media/i2c/soc_camera/ov6650.c
+++ b/drivers/media/i2c/soc_camera/ov6650.c
@@ -215,6 +215,17 @@ static u32 ov6650_codes[] = {
 	MEDIA_BUS_FMT_Y8_1X8,
 };
 
+static const struct v4l2_mbus_framefmt ov6650_def_fmt = {
+	.width		= W_CIF,
+	.height		= H_CIF,
+	.code		= MEDIA_BUS_FMT_SBGGR8_1X8,
+	.colorspace	= V4L2_COLORSPACE_SRGB,
+	.field		= V4L2_FIELD_NONE,
+	.ycbcr_enc	= V4L2_YCBCR_ENC_DEFAULT,
+	.quantization	= V4L2_QUANTIZATION_DEFAULT,
+	.xfer_func	= V4L2_XFER_FUNC_DEFAULT,
+};
+
 /* read a register */
 static int ov6650_reg_read(struct i2c_client *client, u8 reg, u8 *val)
 {
@@ -511,11 +522,13 @@ static int ov6650_get_fmt(struct v4l2_subdev *sd,
 	if (format->pad)
 		return -EINVAL;
 
+	/* initialize response with default media bus frame format */
+	*mf = ov6650_def_fmt;
+
+	/* update media bus format code and frame size */
 	mf->width	= priv->rect.width >> priv->half_scale;
 	mf->height	= priv->rect.height >> priv->half_scale;
 	mf->code	= priv->code;
-	mf->colorspace	= V4L2_COLORSPACE_SRGB;
-	mf->field	= V4L2_FIELD_NONE;
 
 	return 0;
 }
@@ -678,10 +691,6 @@ static int ov6650_s_fmt(struct v4l2_subdev *sd, struct v4l2_mbus_framefmt *mf)
 	if (!ret)
 		priv->code = code;
 
-	if (!ret) {
-		mf->width = priv->rect.width >> half_scale;
-		mf->height = priv->rect.height >> half_scale;
-	}
 	return ret;
 }
 
@@ -700,9 +709,6 @@ static int ov6650_set_fmt(struct v4l2_subdev *sd,
 		v4l_bound_align_image(&mf->width, 2, W_CIF, 1,
 				&mf->height, 2, H_CIF, 1, 0);
 
-	mf->field = V4L2_FIELD_NONE;
-	mf->colorspace = V4L2_COLORSPACE_SRGB;
-
 	switch (mf->code) {
 	case MEDIA_BUS_FMT_Y10_1X10:
 		mf->code = MEDIA_BUS_FMT_Y8_1X8;
@@ -718,10 +724,31 @@ static int ov6650_set_fmt(struct v4l2_subdev *sd,
 		break;
 	}
 
-	if (format->which == V4L2_SUBDEV_FORMAT_ACTIVE)
-		return ov6650_s_fmt(sd, mf);
-	cfg->try_fmt = *mf;
+	if (format->which == V4L2_SUBDEV_FORMAT_TRY) {
+		/* store media bus format code and frame size in pad config */
+		cfg->try_fmt.width = mf->width;
+		cfg->try_fmt.height = mf->height;
+		cfg->try_fmt.code = mf->code;
 
+		/* return default mbus frame format updated with pad config */
+		*mf = ov6650_def_fmt;
+		mf->width = cfg->try_fmt.width;
+		mf->height = cfg->try_fmt.height;
+		mf->code = cfg->try_fmt.code;
+
+	} else {
+		/* apply new media bus format code and frame size */
+		int ret = ov6650_s_fmt(sd, mf);
+
+		if (ret)
+			return ret;
+
+		/* return default format updated with active size and code */
+		*mf = ov6650_def_fmt;
+		mf->width = priv->rect.width >> priv->half_scale;
+		mf->height = priv->rect.height >> priv->half_scale;
+		mf->code = priv->code;
+	}
 	return 0;
 }
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 223/271] media: ov6650: Fix .get_fmt() V4L2_SUBDEV_FORMAT_TRY support
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (221 preceding siblings ...)
  2020-01-28 14:06 ` [PATCH 4.9 222/271] media: ov6650: Fix some format attributes not under control Greg Kroah-Hartman
@ 2020-01-28 14:06 ` Greg Kroah-Hartman
  2020-01-28 14:06 ` [PATCH 4.9 224/271] MIPS: Loongson: Fix return value of loongson_hwmon_init Greg Kroah-Hartman
                   ` (52 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Janusz Krzysztofik, Sakari Ailus,
	Mauro Carvalho Chehab, Sasha Levin

From: Janusz Krzysztofik <jmkrzyszt@gmail.com>

[ Upstream commit 39034bb0c26b76a2c3abc54aa28c185f18b40c2f ]

Commit da298c6d98d5 ("[media] v4l2: replace video op g_mbus_fmt by pad
op get_fmt") converted a former ov6650_g_fmt() video operation callback
to an ov6650_get_fmt() pad operation callback.  However, the converted
function disregards a format->which flag that pad operations should
obey and always returns active frame format settings.

That can be fixed by always responding to V4L2_SUBDEV_FORMAT_TRY with
-EINVAL, or providing the response from a pad config argument, likely
updated by a former user call to V4L2_SUBDEV_FORMAT_TRY .set_fmt().
Since implementation of the latter is trivial, go for it.

Fixes: da298c6d98d5 ("[media] v4l2: replace video op g_mbus_fmt by pad op get_fmt")
Signed-off-by: Janusz Krzysztofik <jmkrzyszt@gmail.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/i2c/soc_camera/ov6650.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/drivers/media/i2c/soc_camera/ov6650.c b/drivers/media/i2c/soc_camera/ov6650.c
index 3b118d45d433b..3c959e48855c3 100644
--- a/drivers/media/i2c/soc_camera/ov6650.c
+++ b/drivers/media/i2c/soc_camera/ov6650.c
@@ -526,10 +526,16 @@ static int ov6650_get_fmt(struct v4l2_subdev *sd,
 	*mf = ov6650_def_fmt;
 
 	/* update media bus format code and frame size */
-	mf->width	= priv->rect.width >> priv->half_scale;
-	mf->height	= priv->rect.height >> priv->half_scale;
-	mf->code	= priv->code;
+	if (format->which == V4L2_SUBDEV_FORMAT_TRY) {
+		mf->width = cfg->try_fmt.width;
+		mf->height = cfg->try_fmt.height;
+		mf->code = cfg->try_fmt.code;
 
+	} else {
+		mf->width = priv->rect.width >> priv->half_scale;
+		mf->height = priv->rect.height >> priv->half_scale;
+		mf->code = priv->code;
+	}
 	return 0;
 }
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 224/271] MIPS: Loongson: Fix return value of loongson_hwmon_init
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (222 preceding siblings ...)
  2020-01-28 14:06 ` [PATCH 4.9 223/271] media: ov6650: Fix .get_fmt() V4L2_SUBDEV_FORMAT_TRY support Greg Kroah-Hartman
@ 2020-01-28 14:06 ` Greg Kroah-Hartman
  2020-01-28 14:06 ` [PATCH 4.9 225/271] net: neigh: use long type to store jiffies delta Greg Kroah-Hartman
                   ` (51 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Tiezhu Yang, Paul Burton,
	Ralf Baechle, James Hogan, Huacai Chen, Jiaxun Yang, linux-mips,
	Sasha Levin

From: Tiezhu Yang <yangtiezhu@loongson.cn>

[ Upstream commit dece3c2a320b0a6d891da6ff774ab763969b6860 ]

When call function hwmon_device_register failed, use the actual
return value instead of always -ENOMEM.

Fixes: 64f09aa967e1 ("MIPS: Loongson-3: Add CPU Hwmon platform driver")
Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
Signed-off-by: Paul Burton <paulburton@kernel.org>
Cc: Ralf Baechle <ralf@linux-mips.org>
Cc: James Hogan <jhogan@kernel.org>
Cc: Huacai Chen <chenhc@lemote.com>
Cc: Jiaxun Yang <jiaxun.yang@flygoat.com>
Cc: linux-mips@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/mips/cpu_hwmon.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/platform/mips/cpu_hwmon.c b/drivers/platform/mips/cpu_hwmon.c
index 4300a558d0f39..d02214a3f8e3f 100644
--- a/drivers/platform/mips/cpu_hwmon.c
+++ b/drivers/platform/mips/cpu_hwmon.c
@@ -155,7 +155,7 @@ static int __init loongson_hwmon_init(void)
 
 	cpu_hwmon_dev = hwmon_device_register(NULL);
 	if (IS_ERR(cpu_hwmon_dev)) {
-		ret = -ENOMEM;
+		ret = PTR_ERR(cpu_hwmon_dev);
 		pr_err("hwmon_device_register fail!\n");
 		goto fail_hwmon_device_register;
 	}
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 225/271] net: neigh: use long type to store jiffies delta
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (223 preceding siblings ...)
  2020-01-28 14:06 ` [PATCH 4.9 224/271] MIPS: Loongson: Fix return value of loongson_hwmon_init Greg Kroah-Hartman
@ 2020-01-28 14:06 ` Greg Kroah-Hartman
  2020-01-28 14:06 ` [PATCH 4.9 226/271] packet: fix data-race in fanout_flow_is_huge() Greg Kroah-Hartman
                   ` (50 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Eric Dumazet, David S. Miller, Sasha Levin

From: Eric Dumazet <edumazet@google.com>

[ Upstream commit 9d027e3a83f39b819e908e4e09084277a2e45e95 ]

A difference of two unsigned long needs long storage.

Fixes: c7fb64db001f ("[NETLINK]: Neighbour table configuration and statistics via rtnetlink")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/core/neighbour.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index cd85cee14bd03..6578d1f8e6c4a 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -1834,8 +1834,8 @@ static int neightbl_fill_info(struct sk_buff *skb, struct neigh_table *tbl,
 		goto nla_put_failure;
 	{
 		unsigned long now = jiffies;
-		unsigned int flush_delta = now - tbl->last_flush;
-		unsigned int rand_delta = now - tbl->last_rand;
+		long flush_delta = now - tbl->last_flush;
+		long rand_delta = now - tbl->last_rand;
 		struct neigh_hash_table *nht;
 		struct ndt_config ndc = {
 			.ndtc_key_len		= tbl->key_len,
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 226/271] packet: fix data-race in fanout_flow_is_huge()
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (224 preceding siblings ...)
  2020-01-28 14:06 ` [PATCH 4.9 225/271] net: neigh: use long type to store jiffies delta Greg Kroah-Hartman
@ 2020-01-28 14:06 ` Greg Kroah-Hartman
  2020-01-28 14:06 ` [PATCH 4.9 227/271] dmaengine: ti: edma: fix missed failure handling Greg Kroah-Hartman
                   ` (49 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Eric Dumazet, Willem de Bruijn,
	David S. Miller, Sasha Levin

From: Eric Dumazet <edumazet@google.com>

[ Upstream commit b756ad928d98e5ef0b74af7546a6a31a8dadde00 ]

KCSAN reported the following data-race [1]

Adding a couple of READ_ONCE()/WRITE_ONCE() should silence it.

Since the report hinted about multiple cpus using the history
concurrently, I added a test avoiding writing on it if the
victim slot already contains the desired value.

[1]

BUG: KCSAN: data-race in fanout_demux_rollover / fanout_demux_rollover

read to 0xffff8880b01786cc of 4 bytes by task 18921 on cpu 1:
 fanout_flow_is_huge net/packet/af_packet.c:1303 [inline]
 fanout_demux_rollover+0x33e/0x3f0 net/packet/af_packet.c:1353
 packet_rcv_fanout+0x34e/0x490 net/packet/af_packet.c:1453
 deliver_skb net/core/dev.c:1888 [inline]
 dev_queue_xmit_nit+0x15b/0x540 net/core/dev.c:1958
 xmit_one net/core/dev.c:3195 [inline]
 dev_hard_start_xmit+0x3f5/0x430 net/core/dev.c:3215
 __dev_queue_xmit+0x14ab/0x1b40 net/core/dev.c:3792
 dev_queue_xmit+0x21/0x30 net/core/dev.c:3825
 neigh_direct_output+0x1f/0x30 net/core/neighbour.c:1530
 neigh_output include/net/neighbour.h:511 [inline]
 ip6_finish_output2+0x7a2/0xec0 net/ipv6/ip6_output.c:116
 __ip6_finish_output net/ipv6/ip6_output.c:142 [inline]
 __ip6_finish_output+0x2d7/0x330 net/ipv6/ip6_output.c:127
 ip6_finish_output+0x41/0x160 net/ipv6/ip6_output.c:152
 NF_HOOK_COND include/linux/netfilter.h:294 [inline]
 ip6_output+0xf2/0x280 net/ipv6/ip6_output.c:175
 dst_output include/net/dst.h:436 [inline]
 ip6_local_out+0x74/0x90 net/ipv6/output_core.c:179
 ip6_send_skb+0x53/0x110 net/ipv6/ip6_output.c:1795
 udp_v6_send_skb.isra.0+0x3ec/0xa70 net/ipv6/udp.c:1173
 udpv6_sendmsg+0x1906/0x1c20 net/ipv6/udp.c:1471
 inet6_sendmsg+0x6d/0x90 net/ipv6/af_inet6.c:576
 sock_sendmsg_nosec net/socket.c:637 [inline]
 sock_sendmsg+0x9f/0xc0 net/socket.c:657
 ___sys_sendmsg+0x2b7/0x5d0 net/socket.c:2311
 __sys_sendmmsg+0x123/0x350 net/socket.c:2413
 __do_sys_sendmmsg net/socket.c:2442 [inline]
 __se_sys_sendmmsg net/socket.c:2439 [inline]
 __x64_sys_sendmmsg+0x64/0x80 net/socket.c:2439
 do_syscall_64+0xcc/0x370 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

write to 0xffff8880b01786cc of 4 bytes by task 18922 on cpu 0:
 fanout_flow_is_huge net/packet/af_packet.c:1306 [inline]
 fanout_demux_rollover+0x3a4/0x3f0 net/packet/af_packet.c:1353
 packet_rcv_fanout+0x34e/0x490 net/packet/af_packet.c:1453
 deliver_skb net/core/dev.c:1888 [inline]
 dev_queue_xmit_nit+0x15b/0x540 net/core/dev.c:1958
 xmit_one net/core/dev.c:3195 [inline]
 dev_hard_start_xmit+0x3f5/0x430 net/core/dev.c:3215
 __dev_queue_xmit+0x14ab/0x1b40 net/core/dev.c:3792
 dev_queue_xmit+0x21/0x30 net/core/dev.c:3825
 neigh_direct_output+0x1f/0x30 net/core/neighbour.c:1530
 neigh_output include/net/neighbour.h:511 [inline]
 ip6_finish_output2+0x7a2/0xec0 net/ipv6/ip6_output.c:116
 __ip6_finish_output net/ipv6/ip6_output.c:142 [inline]
 __ip6_finish_output+0x2d7/0x330 net/ipv6/ip6_output.c:127
 ip6_finish_output+0x41/0x160 net/ipv6/ip6_output.c:152
 NF_HOOK_COND include/linux/netfilter.h:294 [inline]
 ip6_output+0xf2/0x280 net/ipv6/ip6_output.c:175
 dst_output include/net/dst.h:436 [inline]
 ip6_local_out+0x74/0x90 net/ipv6/output_core.c:179
 ip6_send_skb+0x53/0x110 net/ipv6/ip6_output.c:1795
 udp_v6_send_skb.isra.0+0x3ec/0xa70 net/ipv6/udp.c:1173
 udpv6_sendmsg+0x1906/0x1c20 net/ipv6/udp.c:1471
 inet6_sendmsg+0x6d/0x90 net/ipv6/af_inet6.c:576
 sock_sendmsg_nosec net/socket.c:637 [inline]
 sock_sendmsg+0x9f/0xc0 net/socket.c:657
 ___sys_sendmsg+0x2b7/0x5d0 net/socket.c:2311
 __sys_sendmmsg+0x123/0x350 net/socket.c:2413
 __do_sys_sendmmsg net/socket.c:2442 [inline]
 __se_sys_sendmmsg net/socket.c:2439 [inline]
 __x64_sys_sendmmsg+0x64/0x80 net/socket.c:2439
 do_syscall_64+0xcc/0x370 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 18922 Comm: syz-executor.3 Not tainted 5.4.0-rc6+ #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011

Fixes: 3b3a5b0aab5b ("packet: rollover huge flows before small flows")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/packet/af_packet.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 47a862cc7b349..fb643945e4244 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -1332,15 +1332,21 @@ static void packet_sock_destruct(struct sock *sk)
 
 static bool fanout_flow_is_huge(struct packet_sock *po, struct sk_buff *skb)
 {
-	u32 rxhash;
+	u32 *history = po->rollover->history;
+	u32 victim, rxhash;
 	int i, count = 0;
 
 	rxhash = skb_get_hash(skb);
 	for (i = 0; i < ROLLOVER_HLEN; i++)
-		if (po->rollover->history[i] == rxhash)
+		if (READ_ONCE(history[i]) == rxhash)
 			count++;
 
-	po->rollover->history[prandom_u32() % ROLLOVER_HLEN] = rxhash;
+	victim = prandom_u32() % ROLLOVER_HLEN;
+
+	/* Avoid dirtying the cache line if possible */
+	if (READ_ONCE(history[victim]) != rxhash)
+		WRITE_ONCE(history[victim], rxhash);
+
 	return count > (ROLLOVER_HLEN >> 1);
 }
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 227/271] dmaengine: ti: edma: fix missed failure handling
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (225 preceding siblings ...)
  2020-01-28 14:06 ` [PATCH 4.9 226/271] packet: fix data-race in fanout_flow_is_huge() Greg Kroah-Hartman
@ 2020-01-28 14:06 ` Greg Kroah-Hartman
  2020-01-28 14:06 ` [PATCH 4.9 228/271] drm/radeon: fix bad DMA from INTERRUPT_CNTL2 Greg Kroah-Hartman
                   ` (48 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chuhong Yuan, Vinod Koul, Sasha Levin

From: Chuhong Yuan <hslester96@gmail.com>

[ Upstream commit 340049d453682a9fe8d91fe794dd091730f4bb25 ]

When devm_kcalloc fails, it forgets to call edma_free_slot.
Replace direct return with failure handler to fix it.

Fixes: 1be5336bc7ba ("dmaengine: edma: New device tree binding")
Signed-off-by: Chuhong Yuan <hslester96@gmail.com>
Link: https://lore.kernel.org/r/20191118073802.28424-1-hslester96@gmail.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/dma/edma.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/dma/edma.c b/drivers/dma/edma.c
index 72f31e837b1d5..56ec724687456 100644
--- a/drivers/dma/edma.c
+++ b/drivers/dma/edma.c
@@ -2340,8 +2340,10 @@ static int edma_probe(struct platform_device *pdev)
 
 		ecc->tc_list = devm_kcalloc(dev, ecc->num_tc,
 					    sizeof(*ecc->tc_list), GFP_KERNEL);
-		if (!ecc->tc_list)
-			return -ENOMEM;
+		if (!ecc->tc_list) {
+			ret = -ENOMEM;
+			goto err_reg1;
+		}
 
 		for (i = 0;; i++) {
 			ret = of_parse_phandle_with_fixed_args(node, "ti,tptcs",
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 228/271] drm/radeon: fix bad DMA from INTERRUPT_CNTL2
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (226 preceding siblings ...)
  2020-01-28 14:06 ` [PATCH 4.9 227/271] dmaengine: ti: edma: fix missed failure handling Greg Kroah-Hartman
@ 2020-01-28 14:06 ` Greg Kroah-Hartman
  2020-01-28 14:06 ` [PATCH 4.9 229/271] arm64: dts: juno: Fix UART frequency Greg Kroah-Hartman
                   ` (47 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sam Bobroff, Alex Deucher, Sasha Levin

From: Sam Bobroff <sbobroff@linux.ibm.com>

[ Upstream commit 62d91dd2851e8ae2ca552f1b090a3575a4edf759 ]

The INTERRUPT_CNTL2 register expects a valid DMA address, but is
currently set with a GPU MC address.  This can cause problems on
systems that detect the resulting DMA read from an invalid address
(found on a Power8 guest).

Instead, use the DMA address of the dummy page because it will always
be safe.

Fixes: d8f60cfc9345 ("drm/radeon/kms: Add support for interrupts on r6xx/r7xx chips (v3)")
Fixes: 25a857fbe973 ("drm/radeon/kms: add support for interrupts on SI")
Fixes: a59781bbe528 ("drm/radeon: add support for interrupts on CIK (v5)")
Signed-off-by: Sam Bobroff <sbobroff@linux.ibm.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/radeon/cik.c  | 4 ++--
 drivers/gpu/drm/radeon/r600.c | 4 ++--
 drivers/gpu/drm/radeon/si.c   | 4 ++--
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c
index b99f3e59011c1..5fcb5869a4891 100644
--- a/drivers/gpu/drm/radeon/cik.c
+++ b/drivers/gpu/drm/radeon/cik.c
@@ -7026,8 +7026,8 @@ static int cik_irq_init(struct radeon_device *rdev)
 	}
 
 	/* setup interrupt control */
-	/* XXX this should actually be a bus address, not an MC address. same on older asics */
-	WREG32(INTERRUPT_CNTL2, rdev->ih.gpu_addr >> 8);
+	/* set dummy read address to dummy page address */
+	WREG32(INTERRUPT_CNTL2, rdev->dummy_page.addr >> 8);
 	interrupt_cntl = RREG32(INTERRUPT_CNTL);
 	/* IH_DUMMY_RD_OVERRIDE=0 - dummy read disabled with msi, enabled without msi
 	 * IH_DUMMY_RD_OVERRIDE=1 - dummy read controlled by IH_DUMMY_RD_EN
diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
index f2eac6b6c46a3..9569c35f8766a 100644
--- a/drivers/gpu/drm/radeon/r600.c
+++ b/drivers/gpu/drm/radeon/r600.c
@@ -3697,8 +3697,8 @@ int r600_irq_init(struct radeon_device *rdev)
 	}
 
 	/* setup interrupt control */
-	/* set dummy read address to ring address */
-	WREG32(INTERRUPT_CNTL2, rdev->ih.gpu_addr >> 8);
+	/* set dummy read address to dummy page address */
+	WREG32(INTERRUPT_CNTL2, rdev->dummy_page.addr >> 8);
 	interrupt_cntl = RREG32(INTERRUPT_CNTL);
 	/* IH_DUMMY_RD_OVERRIDE=0 - dummy read disabled with msi, enabled without msi
 	 * IH_DUMMY_RD_OVERRIDE=1 - dummy read controlled by IH_DUMMY_RD_EN
diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
index b75d809c292e3..919d389869ceb 100644
--- a/drivers/gpu/drm/radeon/si.c
+++ b/drivers/gpu/drm/radeon/si.c
@@ -6018,8 +6018,8 @@ static int si_irq_init(struct radeon_device *rdev)
 	}
 
 	/* setup interrupt control */
-	/* set dummy read address to ring address */
-	WREG32(INTERRUPT_CNTL2, rdev->ih.gpu_addr >> 8);
+	/* set dummy read address to dummy page address */
+	WREG32(INTERRUPT_CNTL2, rdev->dummy_page.addr >> 8);
 	interrupt_cntl = RREG32(INTERRUPT_CNTL);
 	/* IH_DUMMY_RD_OVERRIDE=0 - dummy read disabled with msi, enabled without msi
 	 * IH_DUMMY_RD_OVERRIDE=1 - dummy read controlled by IH_DUMMY_RD_EN
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 229/271] arm64: dts: juno: Fix UART frequency
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (227 preceding siblings ...)
  2020-01-28 14:06 ` [PATCH 4.9 228/271] drm/radeon: fix bad DMA from INTERRUPT_CNTL2 Greg Kroah-Hartman
@ 2020-01-28 14:06 ` Greg Kroah-Hartman
  2020-01-28 14:06 ` [PATCH 4.9 230/271] IB/iser: Fix dma_nents type definition Greg Kroah-Hartman
                   ` (46 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Andre Przywara, Liviu Dudau,
	Sudeep Holla, Sasha Levin

From: Andre Przywara <andre.przywara@arm.com>

[ Upstream commit 39a1a8941b27c37f79508426e27a2ec29829d66c ]

Older versions of the Juno *SoC* TRM [1] recommended that the UART clock
source should be 7.2738 MHz, whereas the *system* TRM [2] stated a more
correct value of 7.3728 MHz. Somehow the wrong value managed to end up in
our DT.

Doing a prime factorisation, a modulo divide by 115200 and trying
to buy a 7.2738 MHz crystal at your favourite electronics dealer suggest
that the old value was actually a typo. The actual UART clock is driven
by a PLL, configured via a parameter in some board.txt file in the
firmware, which reads 7.37 MHz (sic!).

Fix this to correct the baud rate divisor calculation on the Juno board.

[1] http://infocenter.arm.com/help/topic/com.arm.doc.ddi0515b.b/DDI0515B_b_juno_arm_development_platform_soc_trm.pdf
[2] http://infocenter.arm.com/help/topic/com.arm.doc.100113_0000_07_en/arm_versatile_express_juno_development_platform_(v2m_juno)_technical_reference_manual_100113_0000_07_en.pdf

Fixes: 71f867ec130e ("arm64: Add Juno board device tree.")
Signed-off-by: Andre Przywara <andre.przywara@arm.com>
Acked-by: Liviu Dudau <liviu.dudau@arm.com>
Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/arm/juno-clocks.dtsi | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm64/boot/dts/arm/juno-clocks.dtsi b/arch/arm64/boot/dts/arm/juno-clocks.dtsi
index 25352ed943e6e..00bcbf7688c77 100644
--- a/arch/arm64/boot/dts/arm/juno-clocks.dtsi
+++ b/arch/arm64/boot/dts/arm/juno-clocks.dtsi
@@ -8,10 +8,10 @@
  */
 
 	/* SoC fixed clocks */
-	soc_uartclk: refclk7273800hz {
+	soc_uartclk: refclk7372800hz {
 		compatible = "fixed-clock";
 		#clock-cells = <0>;
-		clock-frequency = <7273800>;
+		clock-frequency = <7372800>;
 		clock-output-names = "juno:uartclk";
 	};
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 230/271] IB/iser: Fix dma_nents type definition
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (228 preceding siblings ...)
  2020-01-28 14:06 ` [PATCH 4.9 229/271] arm64: dts: juno: Fix UART frequency Greg Kroah-Hartman
@ 2020-01-28 14:06 ` Greg Kroah-Hartman
  2020-01-28 14:06 ` [PATCH 4.9 231/271] m68k: Call timer_interrupt() with interrupts disabled Greg Kroah-Hartman
                   ` (45 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Israel Rukshin,
	Max Gurtovoy, Sagi Grimberg, Jason Gunthorpe, Sasha Levin

From: Max Gurtovoy <maxg@mellanox.com>

[ Upstream commit c1545f1a200f4adc4ef8dd534bf33e2f1aa22c2f ]

The retured value from ib_dma_map_sg saved in dma_nents variable. To avoid
future mismatch between types, define dma_nents as an integer instead of
unsigned.

Fixes: 57b26497fabe ("IB/iser: Pass the correct number of entries for dma mapped SGL")
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Israel Rukshin <israelr@mellanox.com>
Signed-off-by: Max Gurtovoy <maxg@mellanox.com>
Acked-by: Sagi Grimberg <sagi@grimberg.me>
Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/ulp/iser/iscsi_iser.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/infiniband/ulp/iser/iscsi_iser.h b/drivers/infiniband/ulp/iser/iscsi_iser.h
index cb48e22afff72..a3614f7f00073 100644
--- a/drivers/infiniband/ulp/iser/iscsi_iser.h
+++ b/drivers/infiniband/ulp/iser/iscsi_iser.h
@@ -197,7 +197,7 @@ struct iser_data_buf {
 	struct scatterlist *sg;
 	int                size;
 	unsigned long      data_len;
-	unsigned int       dma_nents;
+	int                dma_nents;
 };
 
 /* fwd declarations */
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 231/271] m68k: Call timer_interrupt() with interrupts disabled
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (229 preceding siblings ...)
  2020-01-28 14:06 ` [PATCH 4.9 230/271] IB/iser: Fix dma_nents type definition Greg Kroah-Hartman
@ 2020-01-28 14:06 ` Greg Kroah-Hartman
  2020-01-28 14:06 ` [PATCH 4.9 232/271] net: ethtool: Add back transceiver type Greg Kroah-Hartman
                   ` (44 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Thomas Gleixner, Finn Thain,
	Geert Uytterhoeven, Sasha Levin

From: Finn Thain <fthain@telegraphics.com.au>

[ Upstream commit 1efdd4bd254311498123a15fa0acd565f454da97 ]

Some platforms execute their timer handler with the interrupt priority
level set below 6. That means the handler could be interrupted by another
driver and this could lead to re-entry of the timer core.

Avoid this by use of local_irq_save/restore for timer interrupt dispatch.
This provides mutual exclusion around the timer interrupt flag access
which is needed later in this series for the clocksource conversion.

Reported-by: Thomas Gleixner <tglx@linutronix.de>
Link: http://lkml.kernel.org/r/alpine.DEB.2.21.1811131407120.2697@nanos.tec.linutronix.de
Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/m68k/amiga/cia.c       |  9 +++++++++
 arch/m68k/atari/ataints.c   |  4 ++--
 arch/m68k/atari/time.c      | 15 ++++++++++++++-
 arch/m68k/bvme6000/config.c | 20 ++++++++++----------
 arch/m68k/hp300/time.c      | 10 ++++++++--
 arch/m68k/mac/via.c         | 17 +++++++++++++++++
 arch/m68k/mvme147/config.c  | 18 ++++++++++--------
 arch/m68k/mvme16x/config.c  | 21 +++++++++++----------
 arch/m68k/q40/q40ints.c     | 19 +++++++++++--------
 arch/m68k/sun3/sun3ints.c   |  3 +++
 arch/m68k/sun3x/time.c      | 16 ++++++++++------
 11 files changed, 105 insertions(+), 47 deletions(-)

diff --git a/arch/m68k/amiga/cia.c b/arch/m68k/amiga/cia.c
index 2081b8cd5591c..b9aee983e6f4c 100644
--- a/arch/m68k/amiga/cia.c
+++ b/arch/m68k/amiga/cia.c
@@ -88,10 +88,19 @@ static irqreturn_t cia_handler(int irq, void *dev_id)
 	struct ciabase *base = dev_id;
 	int mach_irq;
 	unsigned char ints;
+	unsigned long flags;
 
+	/* Interrupts get disabled while the timer irq flag is cleared and
+	 * the timer interrupt serviced.
+	 */
 	mach_irq = base->cia_irq;
+	local_irq_save(flags);
 	ints = cia_set_irq(base, CIA_ICR_ALL);
 	amiga_custom.intreq = base->int_mask;
+	if (ints & 1)
+		generic_handle_irq(mach_irq);
+	local_irq_restore(flags);
+	mach_irq++, ints >>= 1;
 	for (; ints; mach_irq++, ints >>= 1) {
 		if (ints & 1)
 			generic_handle_irq(mach_irq);
diff --git a/arch/m68k/atari/ataints.c b/arch/m68k/atari/ataints.c
index 3d2b63bedf058..56f02ea2c248d 100644
--- a/arch/m68k/atari/ataints.c
+++ b/arch/m68k/atari/ataints.c
@@ -142,7 +142,7 @@ struct mfptimerbase {
 	.name		= "MFP Timer D"
 };
 
-static irqreturn_t mfptimer_handler(int irq, void *dev_id)
+static irqreturn_t mfp_timer_d_handler(int irq, void *dev_id)
 {
 	struct mfptimerbase *base = dev_id;
 	int mach_irq;
@@ -344,7 +344,7 @@ void __init atari_init_IRQ(void)
 	st_mfp.tim_ct_cd = (st_mfp.tim_ct_cd & 0xf0) | 0x6;
 
 	/* request timer D dispatch handler */
-	if (request_irq(IRQ_MFP_TIMD, mfptimer_handler, IRQF_SHARED,
+	if (request_irq(IRQ_MFP_TIMD, mfp_timer_d_handler, IRQF_SHARED,
 			stmfp_base.name, &stmfp_base))
 		pr_err("Couldn't register %s interrupt\n", stmfp_base.name);
 
diff --git a/arch/m68k/atari/time.c b/arch/m68k/atari/time.c
index c549b48174ec8..972181c1fe4b7 100644
--- a/arch/m68k/atari/time.c
+++ b/arch/m68k/atari/time.c
@@ -24,6 +24,18 @@
 DEFINE_SPINLOCK(rtc_lock);
 EXPORT_SYMBOL_GPL(rtc_lock);
 
+static irqreturn_t mfp_timer_c_handler(int irq, void *dev_id)
+{
+	irq_handler_t timer_routine = dev_id;
+	unsigned long flags;
+
+	local_irq_save(flags);
+	timer_routine(0, NULL);
+	local_irq_restore(flags);
+
+	return IRQ_HANDLED;
+}
+
 void __init
 atari_sched_init(irq_handler_t timer_routine)
 {
@@ -32,7 +44,8 @@ atari_sched_init(irq_handler_t timer_routine)
     /* start timer C, div = 1:100 */
     st_mfp.tim_ct_cd = (st_mfp.tim_ct_cd & 15) | 0x60;
     /* install interrupt service routine for MFP Timer C */
-    if (request_irq(IRQ_MFP_TIMC, timer_routine, 0, "timer", timer_routine))
+    if (request_irq(IRQ_MFP_TIMC, mfp_timer_c_handler, 0, "timer",
+                    timer_routine))
 	pr_err("Couldn't register timer interrupt\n");
 }
 
diff --git a/arch/m68k/bvme6000/config.c b/arch/m68k/bvme6000/config.c
index 611d4d9ea2bd8..3978d71d250b4 100644
--- a/arch/m68k/bvme6000/config.c
+++ b/arch/m68k/bvme6000/config.c
@@ -45,11 +45,6 @@ extern int bvme6000_set_clock_mmss (unsigned long);
 extern void bvme6000_reset (void);
 void bvme6000_set_vectors (void);
 
-/* Save tick handler routine pointer, will point to xtime_update() in
- * kernel/timer/timekeeping.c, called via bvme6000_process_int() */
-
-static irq_handler_t tick_handler;
-
 
 int __init bvme6000_parse_bootinfo(const struct bi_record *bi)
 {
@@ -159,12 +154,18 @@ irqreturn_t bvme6000_abort_int (int irq, void *dev_id)
 
 static irqreturn_t bvme6000_timer_int (int irq, void *dev_id)
 {
+    irq_handler_t timer_routine = dev_id;
+    unsigned long flags;
     volatile RtcPtr_t rtc = (RtcPtr_t)BVME_RTC_BASE;
-    unsigned char msr = rtc->msr & 0xc0;
+    unsigned char msr;
 
+    local_irq_save(flags);
+    msr = rtc->msr & 0xc0;
     rtc->msr = msr | 0x20;		/* Ack the interrupt */
+    timer_routine(0, NULL);
+    local_irq_restore(flags);
 
-    return tick_handler(irq, dev_id);
+    return IRQ_HANDLED;
 }
 
 /*
@@ -183,9 +184,8 @@ void bvme6000_sched_init (irq_handler_t timer_routine)
 
     rtc->msr = 0;	/* Ensure timer registers accessible */
 
-    tick_handler = timer_routine;
-    if (request_irq(BVME_IRQ_RTC, bvme6000_timer_int, 0,
-				"timer", bvme6000_timer_int))
+    if (request_irq(BVME_IRQ_RTC, bvme6000_timer_int, 0, "timer",
+                    timer_routine))
 	panic ("Couldn't register timer int");
 
     rtc->t1cr_omr = 0x04;	/* Mode 2, ext clk */
diff --git a/arch/m68k/hp300/time.c b/arch/m68k/hp300/time.c
index 749543b425a4b..03c83b8f90328 100644
--- a/arch/m68k/hp300/time.c
+++ b/arch/m68k/hp300/time.c
@@ -37,13 +37,19 @@
 
 static irqreturn_t hp300_tick(int irq, void *dev_id)
 {
+	irq_handler_t timer_routine = dev_id;
+	unsigned long flags;
 	unsigned long tmp;
-	irq_handler_t vector = dev_id;
+
+	local_irq_save(flags);
 	in_8(CLOCKBASE + CLKSR);
 	asm volatile ("movpw %1@(5),%0" : "=d" (tmp) : "a" (CLOCKBASE));
+	timer_routine(0, NULL);
+	local_irq_restore(flags);
+
 	/* Turn off the network and SCSI leds */
 	blinken_leds(0, 0xe0);
-	return vector(irq, NULL);
+	return IRQ_HANDLED;
 }
 
 u32 hp300_gettimeoffset(void)
diff --git a/arch/m68k/mac/via.c b/arch/m68k/mac/via.c
index c27bf9a906be4..a435aced6e439 100644
--- a/arch/m68k/mac/via.c
+++ b/arch/m68k/mac/via.c
@@ -397,6 +397,8 @@ void via_nubus_irq_shutdown(int irq)
  * via6522.c :-), disable/pending masks added.
  */
 
+#define VIA_TIMER_1_INT BIT(6)
+
 void via1_irq(struct irq_desc *desc)
 {
 	int irq_num;
@@ -406,6 +408,21 @@ void via1_irq(struct irq_desc *desc)
 	if (!events)
 		return;
 
+	irq_num = IRQ_MAC_TIMER_1;
+	irq_bit = VIA_TIMER_1_INT;
+	if (events & irq_bit) {
+		unsigned long flags;
+
+		local_irq_save(flags);
+		via1[vIFR] = irq_bit;
+		generic_handle_irq(irq_num);
+		local_irq_restore(flags);
+
+		events &= ~irq_bit;
+		if (!events)
+			return;
+	}
+
 	irq_num = VIA1_SOURCE_BASE;
 	irq_bit = 1;
 	do {
diff --git a/arch/m68k/mvme147/config.c b/arch/m68k/mvme147/config.c
index c11d38dfad08f..1a095443790b9 100644
--- a/arch/m68k/mvme147/config.c
+++ b/arch/m68k/mvme147/config.c
@@ -46,11 +46,6 @@ extern void mvme147_reset (void);
 
 static int bcd2int (unsigned char b);
 
-/* Save tick handler routine pointer, will point to xtime_update() in
- * kernel/time/timekeeping.c, called via mvme147_process_int() */
-
-irq_handler_t tick_handler;
-
 
 int __init mvme147_parse_bootinfo(const struct bi_record *bi)
 {
@@ -106,16 +101,23 @@ void __init config_mvme147(void)
 
 static irqreturn_t mvme147_timer_int (int irq, void *dev_id)
 {
+	irq_handler_t timer_routine = dev_id;
+	unsigned long flags;
+
+	local_irq_save(flags);
 	m147_pcc->t1_int_cntrl = PCC_TIMER_INT_CLR;
 	m147_pcc->t1_int_cntrl = PCC_INT_ENAB|PCC_LEVEL_TIMER1;
-	return tick_handler(irq, dev_id);
+	timer_routine(0, NULL);
+	local_irq_restore(flags);
+
+	return IRQ_HANDLED;
 }
 
 
 void mvme147_sched_init (irq_handler_t timer_routine)
 {
-	tick_handler = timer_routine;
-	if (request_irq(PCC_IRQ_TIMER1, mvme147_timer_int, 0, "timer 1", NULL))
+	if (request_irq(PCC_IRQ_TIMER1, mvme147_timer_int, 0, "timer 1",
+			timer_routine))
 		pr_err("Couldn't register timer interrupt\n");
 
 	/* Init the clock with a value */
diff --git a/arch/m68k/mvme16x/config.c b/arch/m68k/mvme16x/config.c
index 58e240939d265..ac49fa7ec46b4 100644
--- a/arch/m68k/mvme16x/config.c
+++ b/arch/m68k/mvme16x/config.c
@@ -51,11 +51,6 @@ extern void mvme16x_reset (void);
 
 int bcd2int (unsigned char b);
 
-/* Save tick handler routine pointer, will point to xtime_update() in
- * kernel/time/timekeeping.c, called via mvme16x_process_int() */
-
-static irq_handler_t tick_handler;
-
 
 unsigned short mvme16x_config;
 EXPORT_SYMBOL(mvme16x_config);
@@ -354,8 +349,15 @@ static irqreturn_t mvme16x_abort_int (int irq, void *dev_id)
 
 static irqreturn_t mvme16x_timer_int (int irq, void *dev_id)
 {
-    *(volatile unsigned char *)0xfff4201b |= 8;
-    return tick_handler(irq, dev_id);
+	irq_handler_t timer_routine = dev_id;
+	unsigned long flags;
+
+	local_irq_save(flags);
+	*(volatile unsigned char *)0xfff4201b |= 8;
+	timer_routine(0, NULL);
+	local_irq_restore(flags);
+
+	return IRQ_HANDLED;
 }
 
 void mvme16x_sched_init (irq_handler_t timer_routine)
@@ -363,14 +365,13 @@ void mvme16x_sched_init (irq_handler_t timer_routine)
     uint16_t brdno = be16_to_cpu(mvme_bdid.brdno);
     int irq;
 
-    tick_handler = timer_routine;
     /* Using PCCchip2 or MC2 chip tick timer 1 */
     *(volatile unsigned long *)0xfff42008 = 0;
     *(volatile unsigned long *)0xfff42004 = 10000;	/* 10ms */
     *(volatile unsigned char *)0xfff42017 |= 3;
     *(volatile unsigned char *)0xfff4201b = 0x16;
-    if (request_irq(MVME16x_IRQ_TIMER, mvme16x_timer_int, 0,
-				"timer", mvme16x_timer_int))
+    if (request_irq(MVME16x_IRQ_TIMER, mvme16x_timer_int, 0, "timer",
+                    timer_routine))
 	panic ("Couldn't register timer int");
 
     if (brdno == 0x0162 || brdno == 0x172)
diff --git a/arch/m68k/q40/q40ints.c b/arch/m68k/q40/q40ints.c
index 513f9bb17b9cf..60b51f5b9cfc0 100644
--- a/arch/m68k/q40/q40ints.c
+++ b/arch/m68k/q40/q40ints.c
@@ -126,10 +126,10 @@ void q40_mksound(unsigned int hz, unsigned int ticks)
 	sound_ticks = ticks << 1;
 }
 
-static irq_handler_t q40_timer_routine;
-
-static irqreturn_t q40_timer_int (int irq, void * dev)
+static irqreturn_t q40_timer_int(int irq, void *dev_id)
 {
+	irq_handler_t timer_routine = dev_id;
+
 	ql_ticks = ql_ticks ? 0 : 1;
 	if (sound_ticks) {
 		unsigned char sval=(sound_ticks & 1) ? 128-SVOL : 128+SVOL;
@@ -138,8 +138,13 @@ static irqreturn_t q40_timer_int (int irq, void * dev)
 		*DAC_RIGHT=sval;
 	}
 
-	if (!ql_ticks)
-		q40_timer_routine(irq, dev);
+	if (!ql_ticks) {
+		unsigned long flags;
+
+		local_irq_save(flags);
+		timer_routine(0, NULL);
+		local_irq_restore(flags);
+	}
 	return IRQ_HANDLED;
 }
 
@@ -147,11 +152,9 @@ void q40_sched_init (irq_handler_t timer_routine)
 {
 	int timer_irq;
 
-	q40_timer_routine = timer_routine;
 	timer_irq = Q40_IRQ_FRAME;
 
-	if (request_irq(timer_irq, q40_timer_int, 0,
-				"timer", q40_timer_int))
+	if (request_irq(timer_irq, q40_timer_int, 0, "timer", timer_routine))
 		panic("Couldn't register timer int");
 
 	master_outb(-1, FRAME_CLEAR_REG);
diff --git a/arch/m68k/sun3/sun3ints.c b/arch/m68k/sun3/sun3ints.c
index 6bbca30c91884..a5824abb4a39c 100644
--- a/arch/m68k/sun3/sun3ints.c
+++ b/arch/m68k/sun3/sun3ints.c
@@ -61,8 +61,10 @@ static irqreturn_t sun3_int7(int irq, void *dev_id)
 
 static irqreturn_t sun3_int5(int irq, void *dev_id)
 {
+	unsigned long flags;
 	unsigned int cnt;
 
+	local_irq_save(flags);
 #ifdef CONFIG_SUN3
 	intersil_clear();
 #endif
@@ -76,6 +78,7 @@ static irqreturn_t sun3_int5(int irq, void *dev_id)
 	cnt = kstat_irqs_cpu(irq, 0);
 	if (!(cnt % 20))
 		sun3_leds(led_pattern[cnt % 160 / 20]);
+	local_irq_restore(flags);
 	return IRQ_HANDLED;
 }
 
diff --git a/arch/m68k/sun3x/time.c b/arch/m68k/sun3x/time.c
index 431d3c4306dd8..a4f6a44d34189 100644
--- a/arch/m68k/sun3x/time.c
+++ b/arch/m68k/sun3x/time.c
@@ -77,15 +77,19 @@ u32 sun3x_gettimeoffset(void)
 }
 
 #if 0
-static void sun3x_timer_tick(int irq, void *dev_id, struct pt_regs *regs)
+static irqreturn_t sun3x_timer_tick(int irq, void *dev_id)
 {
-    void (*vector)(int, void *, struct pt_regs *) = dev_id;
+	irq_handler_t timer_routine = dev_id;
+	unsigned long flags;
 
-    /* Clear the pending interrupt - pulse the enable line low */
-    disable_irq(5);
-    enable_irq(5);
+	local_irq_save(flags);
+	/* Clear the pending interrupt - pulse the enable line low */
+	disable_irq(5);
+	enable_irq(5);
+	timer_routine(0, NULL);
+	local_irq_restore(flags);
 
-    vector(irq, NULL, regs);
+	return IRQ_HANDLED;
 }
 #endif
 
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 283+ messages in thread

* [PATCH 4.9 232/271] net: ethtool: Add back transceiver type
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (230 preceding siblings ...)
  2020-01-28 14:06 ` [PATCH 4.9 231/271] m68k: Call timer_interrupt() with interrupts disabled Greg Kroah-Hartman
@ 2020-01-28 14:06 ` Greg Kroah-Hartman
  2020-01-28 14:06 ` [PATCH 4.9 233/271] net: phy: Keep reporting " Greg Kroah-Hartman
                   ` (43 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Florian Fainelli, David S. Miller

From: Florian Fainelli <f.fainelli@gmail.com>

commit 19cab8872692960535aa6d12e3a295ac51d1a648 upstream.

Commit 3f1ac7a700d0 ("net: ethtool: add new ETHTOOL_xLINKSETTINGS API")
deprecated the ethtool_cmd::transceiver field, which was fine in
premise, except that the PHY library was actually using it to report the
type of transceiver: internal or external.

Use the first word of the reserved field to put this __u8 transceiver
field back in. It is made read-only, and we don't expect the
ETHTOOL_xLINKSETTINGS API to be doing anything with this anyway, so this
is mostly for the legacy path where we do:

ethtool_get_settings()
-> dev->ethtool_ops->get_link_ksettings()
   -> convert_link_ksettings_to_legacy_settings()

to have no information loss compared to the legacy get_settings API.

Fixes: 3f1ac7a700d0 ("net: ethtool: add new ETHTOOL_xLINKSETTINGS API")
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 include/uapi/linux/ethtool.h |    6 +++++-
 net/core/ethtool.c           |    2 ++
 2 files changed, 7 insertions(+), 1 deletion(-)

--- a/include/uapi/linux/ethtool.h
+++ b/include/uapi/linux/ethtool.h
@@ -1687,6 +1687,8 @@ enum ethtool_reset_flags {
  *	%ethtool_link_mode_bit_indices for the link modes, and other
  *	link features that the link partner advertised through
  *	autonegotiation; 0 if unknown or not applicable.  Read-only.
+ * @transceiver: Used to distinguish different possible PHY types,
+ *	reported consistently by PHYLIB.  Read-only.
  *
  * If autonegotiation is disabled, the speed and @duplex represent the
  * fixed link mode and are writable if the driver supports multiple
@@ -1738,7 +1740,9 @@ struct ethtool_link_settings {
 	__u8	eth_tp_mdix;
 	__u8	eth_tp_mdix_ctrl;
 	__s8	link_mode_masks_nwords;
-	__u32	reserved[8];
+	__u8	transceiver;
+	__u8	reserved1[3];
+	__u32	reserved[7];
 	__u32	link_mode_masks[0];
 	/* layout of link_mode_masks fields:
 	 * __u32 map_supported[link_mode_masks_nwords];
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -514,6 +514,8 @@ convert_link_ksettings_to_legacy_setting
 		= link_ksettings->base.eth_tp_mdix;
 	legacy_settings->eth_tp_mdix_ctrl
 		= link_ksettings->base.eth_tp_mdix_ctrl;
+	legacy_settings->transceiver
+		= link_ksettings->base.transceiver;
 	return retval;
 }
 



^ permalink raw reply	[flat|nested] 283+ messages in thread

* [PATCH 4.9 233/271] net: phy: Keep reporting transceiver type
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (231 preceding siblings ...)
  2020-01-28 14:06 ` [PATCH 4.9 232/271] net: ethtool: Add back transceiver type Greg Kroah-Hartman
@ 2020-01-28 14:06 ` Greg Kroah-Hartman
  2020-01-28 14:06 ` [PATCH 4.9 234/271] can, slip: Protect tty->disc_data in write_wakeup and close with RCU Greg Kroah-Hartman
                   ` (42 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Florian Fainelli, David S. Miller

From: Florian Fainelli <f.fainelli@gmail.com>

commit ceb628134a75564d7bfa8e4ef902e6e588339e11 upstream.

With commit 2d55173e71b0 ("phy: add generic function to support
ksetting support"), we lost the ability to report the transceiver type
like we used to. Now that we have added back the transceiver type to
ethtool_link_settings, we can report it back like we used to and have no
loss of information.

Fixes: 3f1ac7a700d0 ("net: ethtool: add new ETHTOOL_xLINKSETTINGS API")
Fixes: 2d55173e71b0 ("phy: add generic function to support ksetting support")
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/phy/phy.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/net/phy/phy.c
+++ b/drivers/net/phy/phy.c
@@ -463,7 +463,8 @@ int phy_ethtool_ksettings_get(struct phy
 		cmd->base.port = PORT_BNC;
 	else
 		cmd->base.port = PORT_MII;
-
+	cmd->base.transceiver = phy_is_internal(phydev) ?
+				XCVR_INTERNAL : XCVR_EXTERNAL;
 	cmd->base.phy_address = phydev->mdio.addr;
 	cmd->base.autoneg = phydev->autoneg;
 	cmd->base.eth_tp_mdix_ctrl = phydev->mdix;



^ permalink raw reply	[flat|nested] 283+ messages in thread

* [PATCH 4.9 234/271] can, slip: Protect tty->disc_data in write_wakeup and close with RCU
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (232 preceding siblings ...)
  2020-01-28 14:06 ` [PATCH 4.9 233/271] net: phy: Keep reporting " Greg Kroah-Hartman
@ 2020-01-28 14:06 ` Greg Kroah-Hartman
  2020-01-28 14:06 ` [PATCH 4.9 235/271] firestream: fix memory leaks Greg Kroah-Hartman
                   ` (41 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, syzbot+017e491ae13c0068598a,
	Richard Palethorpe, Wolfgang Grandegger, Marc Kleine-Budde,
	David S. Miller, Tyler Hall, linux-can, netdev, syzkaller

From: Richard Palethorpe <rpalethorpe@suse.com>

[ Upstream commit 0ace17d56824165c7f4c68785d6b58971db954dd ]

write_wakeup can happen in parallel with close/hangup where tty->disc_data
is set to NULL and the netdevice is freed thus also freeing
disc_data. write_wakeup accesses disc_data so we must prevent close from
freeing the netdev while write_wakeup has a non-NULL view of
tty->disc_data.

We also need to make sure that accesses to disc_data are atomic. Which can
all be done with RCU.

This problem was found by Syzkaller on SLCAN, but the same issue is
reproducible with the SLIP line discipline using an LTP test based on the
Syzkaller reproducer.

A fix which didn't use RCU was posted by Hillf Danton.

Fixes: 661f7fda21b1 ("slip: Fix deadlock in write_wakeup")
Fixes: a8e83b17536a ("slcan: Port write_wakeup deadlock fix from slip")
Reported-by: syzbot+017e491ae13c0068598a@syzkaller.appspotmail.com
Signed-off-by: Richard Palethorpe <rpalethorpe@suse.com>
Cc: Wolfgang Grandegger <wg@grandegger.com>
Cc: Marc Kleine-Budde <mkl@pengutronix.de>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Tyler Hall <tylerwhall@gmail.com>
Cc: linux-can@vger.kernel.org
Cc: netdev@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Cc: syzkaller@googlegroups.com
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/can/slcan.c |   12 ++++++++++--
 drivers/net/slip/slip.c |   12 ++++++++++--
 2 files changed, 20 insertions(+), 4 deletions(-)

--- a/drivers/net/can/slcan.c
+++ b/drivers/net/can/slcan.c
@@ -344,9 +344,16 @@ static void slcan_transmit(struct work_s
  */
 static void slcan_write_wakeup(struct tty_struct *tty)
 {
-	struct slcan *sl = tty->disc_data;
+	struct slcan *sl;
+
+	rcu_read_lock();
+	sl = rcu_dereference(tty->disc_data);
+	if (!sl)
+		goto out;
 
 	schedule_work(&sl->tx_work);
+out:
+	rcu_read_unlock();
 }
 
 /* Send a can_frame to a TTY queue. */
@@ -640,10 +647,11 @@ static void slcan_close(struct tty_struc
 		return;
 
 	spin_lock_bh(&sl->lock);
-	tty->disc_data = NULL;
+	rcu_assign_pointer(tty->disc_data, NULL);
 	sl->tty = NULL;
 	spin_unlock_bh(&sl->lock);
 
+	synchronize_rcu();
 	flush_work(&sl->tx_work);
 
 	/* Flush network side */
--- a/drivers/net/slip/slip.c
+++ b/drivers/net/slip/slip.c
@@ -452,9 +452,16 @@ static void slip_transmit(struct work_st
  */
 static void slip_write_wakeup(struct tty_struct *tty)
 {
-	struct slip *sl = tty->disc_data;
+	struct slip *sl;
+
+	rcu_read_lock();
+	sl = rcu_dereference(tty->disc_data);
+	if (!sl)
+		goto out;
 
 	schedule_work(&sl->tx_work);
+out:
+	rcu_read_unlock();
 }
 
 static void sl_tx_timeout(struct net_device *dev)
@@ -887,10 +894,11 @@ static void slip_close(struct tty_struct
 		return;
 
 	spin_lock_bh(&sl->lock);
-	tty->disc_data = NULL;
+	rcu_assign_pointer(tty->disc_data, NULL);
 	sl->tty = NULL;
 	spin_unlock_bh(&sl->lock);
 
+	synchronize_rcu();
 	flush_work(&sl->tx_work);
 
 	/* VSV = very important to remove timers */



^ permalink raw reply	[flat|nested] 283+ messages in thread

* [PATCH 4.9 235/271] firestream: fix memory leaks
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (233 preceding siblings ...)
  2020-01-28 14:06 ` [PATCH 4.9 234/271] can, slip: Protect tty->disc_data in write_wakeup and close with RCU Greg Kroah-Hartman
@ 2020-01-28 14:06 ` Greg Kroah-Hartman
  2020-01-28 14:06 ` [PATCH 4.9 236/271] net: cxgb3_main: Add CAP_NET_ADMIN check to CHELSIO_GET_MEM Greg Kroah-Hartman
                   ` (40 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:06 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Wenwen Wang, David S. Miller

From: Wenwen Wang <wenwen@cs.uga.edu>

[ Upstream commit fa865ba183d61c1ec8cbcab8573159c3b72b89a4 ]

In fs_open(), 'vcc' is allocated through kmalloc() and assigned to
'atm_vcc->dev_data.' In the following execution, if an error occurs, e.g.,
there is no more free channel, an error code EBUSY or ENOMEM will be
returned. However, 'vcc' is not deallocated, leading to memory leaks. Note
that, in normal cases where fs_open() returns 0, 'vcc' will be deallocated
in fs_close(). But, if fs_open() fails, there is no guarantee that
fs_close() will be invoked.

To fix this issue, deallocate 'vcc' before the error code is returned.

Signed-off-by: Wenwen Wang <wenwen@cs.uga.edu>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/atm/firestream.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/drivers/atm/firestream.c
+++ b/drivers/atm/firestream.c
@@ -927,6 +927,7 @@ static int fs_open(struct atm_vcc *atm_v
 			}
 			if (!to) {
 				printk ("No more free channels for FS50..\n");
+				kfree(vcc);
 				return -EBUSY;
 			}
 			vcc->channo = dev->channo;
@@ -937,6 +938,7 @@ static int fs_open(struct atm_vcc *atm_v
 			if (((DO_DIRECTION(rxtp) && dev->atm_vccs[vcc->channo])) ||
 			    ( DO_DIRECTION(txtp) && test_bit (vcc->channo, dev->tx_inuse))) {
 				printk ("Channel is in use for FS155.\n");
+				kfree(vcc);
 				return -EBUSY;
 			}
 		}
@@ -950,6 +952,7 @@ static int fs_open(struct atm_vcc *atm_v
 			    tc, sizeof (struct fs_transmit_config));
 		if (!tc) {
 			fs_dprintk (FS_DEBUG_OPEN, "fs: can't alloc transmit_config.\n");
+			kfree(vcc);
 			return -ENOMEM;
 		}
 



^ permalink raw reply	[flat|nested] 283+ messages in thread

* [PATCH 4.9 236/271] net: cxgb3_main: Add CAP_NET_ADMIN check to CHELSIO_GET_MEM
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (234 preceding siblings ...)
  2020-01-28 14:06 ` [PATCH 4.9 235/271] firestream: fix memory leaks Greg Kroah-Hartman
@ 2020-01-28 14:06 ` Greg Kroah-Hartman
  2020-01-28 14:06 ` [PATCH 4.9 237/271] net, ip6_tunnel: fix namespaces move Greg Kroah-Hartman
                   ` (39 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ilja Van Sprundel, Michael Ellerman,
	David S. Miller

From: Michael Ellerman <mpe@ellerman.id.au>

[ Upstream commit 3546d8f1bbe992488ed91592cf6bf76e7114791a =

The cxgb3 driver for "Chelsio T3-based gigabit and 10Gb Ethernet
adapters" implements a custom ioctl as SIOCCHIOCTL/SIOCDEVPRIVATE in
cxgb_extension_ioctl().

One of the subcommands of the ioctl is CHELSIO_GET_MEM, which appears
to read memory directly out of the adapter and return it to userspace.
It's not entirely clear what the contents of the adapter memory
contains, but the assumption is that it shouldn't be accessible to all
users.

So add a CAP_NET_ADMIN check to the CHELSIO_GET_MEM case. Put it after
the is_offload() check, which matches two of the other subcommands in
the same function which also check for is_offload() and CAP_NET_ADMIN.

Found by Ilja by code inspection, not tested as I don't have the
required hardware.

Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c
@@ -2440,6 +2440,8 @@ static int cxgb_extension_ioctl(struct n
 
 		if (!is_offload(adapter))
 			return -EOPNOTSUPP;
+		if (!capable(CAP_NET_ADMIN))
+			return -EPERM;
 		if (!(adapter->flags & FULL_INIT_DONE))
 			return -EIO;	/* need the memory controllers */
 		if (copy_from_user(&t, useraddr, sizeof(t)))



^ permalink raw reply	[flat|nested] 283+ messages in thread

* [PATCH 4.9 237/271] net, ip6_tunnel: fix namespaces move
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (235 preceding siblings ...)
  2020-01-28 14:06 ` [PATCH 4.9 236/271] net: cxgb3_main: Add CAP_NET_ADMIN check to CHELSIO_GET_MEM Greg Kroah-Hartman
@ 2020-01-28 14:06 ` Greg Kroah-Hartman
  2020-01-28 14:06 ` [PATCH 4.9 238/271] net, ip_tunnel: " Greg Kroah-Hartman
                   ` (38 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, William Dauchy, Nicolas Dichtel,
	David S. Miller

From: William Dauchy <w.dauchy@criteo.com>

[ Upstream commit 5311a69aaca30fa849c3cc46fb25f75727fb72d0 ]

in the same manner as commit d0f418516022 ("net, ip_tunnel: fix
namespaces move"), fix namespace moving as it was broken since commit
8d79266bc48c ("ip6_tunnel: add collect_md mode to IPv6 tunnel"), but for
ipv6 this time; there is no reason to keep it for ip6_tunnel.

Fixes: 8d79266bc48c ("ip6_tunnel: add collect_md mode to IPv6 tunnel")
Signed-off-by: William Dauchy <w.dauchy@criteo.com>
Acked-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv6/ip6_tunnel.c |    4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -1861,10 +1861,8 @@ static int ip6_tnl_dev_init(struct net_d
 	if (err)
 		return err;
 	ip6_tnl_link_config(t);
-	if (t->parms.collect_md) {
-		dev->features |= NETIF_F_NETNS_LOCAL;
+	if (t->parms.collect_md)
 		netif_keep_dst(dev);
-	}
 	return 0;
 }
 



^ permalink raw reply	[flat|nested] 283+ messages in thread

* [PATCH 4.9 238/271] net, ip_tunnel: fix namespaces move
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (236 preceding siblings ...)
  2020-01-28 14:06 ` [PATCH 4.9 237/271] net, ip6_tunnel: fix namespaces move Greg Kroah-Hartman
@ 2020-01-28 14:06 ` Greg Kroah-Hartman
  2020-01-28 14:06 ` [PATCH 4.9 239/271] net_sched: fix datalen for ematch Greg Kroah-Hartman
                   ` (37 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, William Dauchy, Nicolas Dichtel,
	David S. Miller

From: William Dauchy <w.dauchy@criteo.com>

[ Upstream commit d0f418516022c32ecceaf4275423e5bd3f8743a9 ]

in the same manner as commit 690afc165bb3 ("net: ip6_gre: fix moving
ip6gre between namespaces"), fix namespace moving as it was broken since
commit 2e15ea390e6f ("ip_gre: Add support to collect tunnel metadata.").
Indeed, the ip6_gre commit removed the local flag for collect_md
condition, so there is no reason to keep it for ip_gre/ip_tunnel.

this patch will fix both ip_tunnel and ip_gre modules.

Fixes: 2e15ea390e6f ("ip_gre: Add support to collect tunnel metadata.")
Signed-off-by: William Dauchy <w.dauchy@criteo.com>
Acked-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv4/ip_tunnel.c |    4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

--- a/net/ipv4/ip_tunnel.c
+++ b/net/ipv4/ip_tunnel.c
@@ -1184,10 +1184,8 @@ int ip_tunnel_init(struct net_device *de
 	iph->version		= 4;
 	iph->ihl		= 5;
 
-	if (tunnel->collect_md) {
-		dev->features |= NETIF_F_NETNS_LOCAL;
+	if (tunnel->collect_md)
 		netif_keep_dst(dev);
-	}
 	return 0;
 }
 EXPORT_SYMBOL_GPL(ip_tunnel_init);



^ permalink raw reply	[flat|nested] 283+ messages in thread

* [PATCH 4.9 239/271] net_sched: fix datalen for ematch
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (237 preceding siblings ...)
  2020-01-28 14:06 ` [PATCH 4.9 238/271] net, ip_tunnel: " Greg Kroah-Hartman
@ 2020-01-28 14:06 ` Greg Kroah-Hartman
  2020-01-28 14:06 ` [PATCH 4.9 240/271] tcp_bbr: improve arithmetic division in bbr_update_bw() Greg Kroah-Hartman
                   ` (36 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, syzbot+2f07903a5b05e7f36410,
	Eric Dumazet, Cong Wang, Eric Dumazet, David S. Miller,
	syzbot+5af9a90dad568aa9f611

From: Cong Wang <xiyou.wangcong@gmail.com>

[ Upstream commit 61678d28d4a45ef376f5d02a839cc37509ae9281 ]

syzbot reported an out-of-bound access in em_nbyte. As initially
analyzed by Eric, this is because em_nbyte sets its own em->datalen
in em_nbyte_change() other than the one specified by user, but this
value gets overwritten later by its caller tcf_em_validate().
We should leave em->datalen untouched to respect their choices.

I audit all the in-tree ematch users, all of those implement
->change() set em->datalen, so we can just avoid setting it twice
in this case.

Reported-and-tested-by: syzbot+5af9a90dad568aa9f611@syzkaller.appspotmail.com
Reported-by: syzbot+2f07903a5b05e7f36410@syzkaller.appspotmail.com
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/sched/ematch.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/net/sched/ematch.c
+++ b/net/sched/ematch.c
@@ -267,12 +267,12 @@ static int tcf_em_validate(struct tcf_pr
 				}
 				em->data = (unsigned long) v;
 			}
+			em->datalen = data_len;
 		}
 	}
 
 	em->matchid = em_hdr->matchid;
 	em->flags = em_hdr->flags;
-	em->datalen = data_len;
 	em->net = net;
 
 	err = 0;



^ permalink raw reply	[flat|nested] 283+ messages in thread

* [PATCH 4.9 240/271] tcp_bbr: improve arithmetic division in bbr_update_bw()
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (238 preceding siblings ...)
  2020-01-28 14:06 ` [PATCH 4.9 239/271] net_sched: fix datalen for ematch Greg Kroah-Hartman
@ 2020-01-28 14:06 ` Greg Kroah-Hartman
  2020-01-28 14:06 ` [PATCH 4.9 241/271] net: usb: lan78xx: Add .ndo_features_check Greg Kroah-Hartman
                   ` (35 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Wen Yang, Eric Dumazet,
	David S. Miller, Alexey Kuznetsov, Hideaki YOSHIFUJI, netdev

From: Wen Yang <wenyang@linux.alibaba.com>

[ Upstream commit 5b2f1f3070b6447b76174ea8bfb7390dc6253ebd ]

do_div() does a 64-by-32 division. Use div64_long() instead of it
if the divisor is long, to avoid truncation to 32-bit.
And as a nice side effect also cleans up the function a bit.

Signed-off-by: Wen Yang <wenyang@linux.alibaba.com>
Cc: Eric Dumazet <edumazet@google.com>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>
Cc: Hideaki YOSHIFUJI <yoshfuji@linux-ipv6.org>
Cc: netdev@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv4/tcp_bbr.c |    3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

--- a/net/ipv4/tcp_bbr.c
+++ b/net/ipv4/tcp_bbr.c
@@ -649,8 +649,7 @@ static void bbr_update_bw(struct sock *s
 	 * bandwidth sample. Delivered is in packets and interval_us in uS and
 	 * ratio will be <<1 for most connections. So delivered is first scaled.
 	 */
-	bw = (u64)rs->delivered * BW_UNIT;
-	do_div(bw, rs->interval_us);
+	bw = div64_long((u64)rs->delivered * BW_UNIT, rs->interval_us);
 
 	/* If this sample is application-limited, it is likely to have a very
 	 * low delivered count that represents application behavior rather than



^ permalink raw reply	[flat|nested] 283+ messages in thread

* [PATCH 4.9 241/271] net: usb: lan78xx: Add .ndo_features_check
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (239 preceding siblings ...)
  2020-01-28 14:06 ` [PATCH 4.9 240/271] tcp_bbr: improve arithmetic division in bbr_update_bw() Greg Kroah-Hartman
@ 2020-01-28 14:06 ` Greg Kroah-Hartman
  2020-01-28 14:06 ` [PATCH 4.9 242/271] gtp: make sure only SOCK_DGRAM UDP sockets are accepted Greg Kroah-Hartman
                   ` (34 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, James Hughes, Eric Dumazet, David S. Miller

From: James Hughes <james.hughes@raspberrypi.org>

[ Upstream commit ce896476c65d72b4b99fa09c2f33436b4198f034 ]

As reported by Eric Dumazet, there are still some outstanding
cases where the driver does not handle TSO correctly when skb's
are over a certain size. Most cases have been fixed, this patch
should ensure that forwarded SKB's that are greater than
MAX_SINGLE_PACKET_SIZE - TX_OVERHEAD are software segmented
and handled correctly.

Signed-off-by: James Hughes <james.hughes@raspberrypi.org>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/usb/lan78xx.c |   15 +++++++++++++++
 1 file changed, 15 insertions(+)

--- a/drivers/net/usb/lan78xx.c
+++ b/drivers/net/usb/lan78xx.c
@@ -30,6 +30,7 @@
 #include <linux/ipv6.h>
 #include <linux/mdio.h>
 #include <net/ip6_checksum.h>
+#include <net/vxlan.h>
 #include <linux/microchipphy.h>
 #include <linux/of_net.h>
 #include "lan78xx.h"
@@ -3291,6 +3292,19 @@ static void lan78xx_tx_timeout(struct ne
 	tasklet_schedule(&dev->bh);
 }
 
+static netdev_features_t lan78xx_features_check(struct sk_buff *skb,
+						struct net_device *netdev,
+						netdev_features_t features)
+{
+	if (skb->len + TX_OVERHEAD > MAX_SINGLE_PACKET_SIZE)
+		features &= ~NETIF_F_GSO_MASK;
+
+	features = vlan_features_check(skb, features);
+	features = vxlan_features_check(skb, features);
+
+	return features;
+}
+
 static const struct net_device_ops lan78xx_netdev_ops = {
 	.ndo_open		= lan78xx_open,
 	.ndo_stop		= lan78xx_stop,
@@ -3304,6 +3318,7 @@ static const struct net_device_ops lan78
 	.ndo_set_features	= lan78xx_set_features,
 	.ndo_vlan_rx_add_vid	= lan78xx_vlan_rx_add_vid,
 	.ndo_vlan_rx_kill_vid	= lan78xx_vlan_rx_kill_vid,
+	.ndo_features_check	= lan78xx_features_check,
 };
 
 static void lan78xx_stat_monitor(unsigned long param)



^ permalink raw reply	[flat|nested] 283+ messages in thread

* [PATCH 4.9 242/271] gtp: make sure only SOCK_DGRAM UDP sockets are accepted
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (240 preceding siblings ...)
  2020-01-28 14:06 ` [PATCH 4.9 241/271] net: usb: lan78xx: Add .ndo_features_check Greg Kroah-Hartman
@ 2020-01-28 14:06 ` Greg Kroah-Hartman
  2020-01-28 14:06 ` [PATCH 4.9 243/271] hwmon: (adt7475) Make volt2reg return same reg as reg2volt input Greg Kroah-Hartman
                   ` (33 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Eric Dumazet, Pablo Neira, syzbot,
	David S. Miller

From: Eric Dumazet <edumazet@google.com>

[ Upstream commit 940ba14986657a50c15f694efca1beba31fa568f ]

A malicious user could use RAW sockets and fool
GTP using them as standard SOCK_DGRAM UDP sockets.

BUG: KMSAN: uninit-value in udp_tunnel_encap_enable include/net/udp_tunnel.h:174 [inline]
BUG: KMSAN: uninit-value in setup_udp_tunnel_sock+0x45e/0x6f0 net/ipv4/udp_tunnel.c:85
CPU: 0 PID: 11262 Comm: syz-executor613 Not tainted 5.5.0-rc5-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1c9/0x220 lib/dump_stack.c:118
 kmsan_report+0xf7/0x1e0 mm/kmsan/kmsan_report.c:118
 __msan_warning+0x58/0xa0 mm/kmsan/kmsan_instr.c:215
 udp_tunnel_encap_enable include/net/udp_tunnel.h:174 [inline]
 setup_udp_tunnel_sock+0x45e/0x6f0 net/ipv4/udp_tunnel.c:85
 gtp_encap_enable_socket+0x37f/0x5a0 drivers/net/gtp.c:827
 gtp_encap_enable drivers/net/gtp.c:844 [inline]
 gtp_newlink+0xfb/0x1e50 drivers/net/gtp.c:666
 __rtnl_newlink net/core/rtnetlink.c:3305 [inline]
 rtnl_newlink+0x2973/0x3920 net/core/rtnetlink.c:3363
 rtnetlink_rcv_msg+0x1153/0x1570 net/core/rtnetlink.c:5424
 netlink_rcv_skb+0x451/0x650 net/netlink/af_netlink.c:2477
 rtnetlink_rcv+0x50/0x60 net/core/rtnetlink.c:5442
 netlink_unicast_kernel net/netlink/af_netlink.c:1302 [inline]
 netlink_unicast+0xf9e/0x1100 net/netlink/af_netlink.c:1328
 netlink_sendmsg+0x1248/0x14d0 net/netlink/af_netlink.c:1917
 sock_sendmsg_nosec net/socket.c:639 [inline]
 sock_sendmsg net/socket.c:659 [inline]
 ____sys_sendmsg+0x12b6/0x1350 net/socket.c:2330
 ___sys_sendmsg net/socket.c:2384 [inline]
 __sys_sendmsg+0x451/0x5f0 net/socket.c:2417
 __do_sys_sendmsg net/socket.c:2426 [inline]
 __se_sys_sendmsg+0x97/0xb0 net/socket.c:2424
 __x64_sys_sendmsg+0x4a/0x70 net/socket.c:2424
 do_syscall_64+0xb8/0x160 arch/x86/entry/common.c:296
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x441359
Code: e8 ac e8 ff ff 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb 08 fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007fff1cd0ac28 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000441359
RDX: 0000000000000000 RSI: 0000000020000100 RDI: 0000000000000003
RBP: 00000000006cb018 R08: 00000000004002c8 R09: 00000000004002c8
R10: 00000000004002c8 R11: 0000000000000246 R12: 00000000004020d0
R13: 0000000000402160 R14: 0000000000000000 R15: 0000000000000000

Uninit was created at:
 kmsan_save_stack_with_flags+0x3c/0x90 mm/kmsan/kmsan.c:144
 kmsan_internal_alloc_meta_for_pages mm/kmsan/kmsan_shadow.c:307 [inline]
 kmsan_alloc_page+0x12a/0x310 mm/kmsan/kmsan_shadow.c:336
 __alloc_pages_nodemask+0x57f2/0x5f60 mm/page_alloc.c:4800
 alloc_pages_current+0x67d/0x990 mm/mempolicy.c:2207
 alloc_pages include/linux/gfp.h:534 [inline]
 alloc_slab_page+0x111/0x12f0 mm/slub.c:1511
 allocate_slab mm/slub.c:1656 [inline]
 new_slab+0x2bc/0x1130 mm/slub.c:1722
 new_slab_objects mm/slub.c:2473 [inline]
 ___slab_alloc+0x1533/0x1f30 mm/slub.c:2624
 __slab_alloc mm/slub.c:2664 [inline]
 slab_alloc_node mm/slub.c:2738 [inline]
 slab_alloc mm/slub.c:2783 [inline]
 kmem_cache_alloc+0xb23/0xd70 mm/slub.c:2788
 sk_prot_alloc+0xf2/0x620 net/core/sock.c:1597
 sk_alloc+0xf0/0xbe0 net/core/sock.c:1657
 inet_create+0x7c7/0x1370 net/ipv4/af_inet.c:321
 __sock_create+0x8eb/0xf00 net/socket.c:1420
 sock_create net/socket.c:1471 [inline]
 __sys_socket+0x1a1/0x600 net/socket.c:1513
 __do_sys_socket net/socket.c:1522 [inline]
 __se_sys_socket+0x8d/0xb0 net/socket.c:1520
 __x64_sys_socket+0x4a/0x70 net/socket.c:1520
 do_syscall_64+0xb8/0x160 arch/x86/entry/common.c:296
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Fixes: 459aa660eb1d ("gtp: add initial driver for datapath of GPRS Tunneling Protocol (GTP-U)")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Pablo Neira <pablo@netfilter.org>
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/gtp.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/drivers/net/gtp.c
+++ b/drivers/net/gtp.c
@@ -836,7 +836,9 @@ static int gtp_encap_enable(struct net_d
 		return -ENOENT;
 	}
 
-	if (sock0->sk->sk_protocol != IPPROTO_UDP) {
+	if (sock0->sk->sk_protocol != IPPROTO_UDP ||
+	    sock0->sk->sk_type != SOCK_DGRAM ||
+	    (sock0->sk->sk_family != AF_INET && sock0->sk->sk_family != AF_INET6)) {
 		netdev_dbg(dev, "socket fd=%d not UDP\n", fd_gtp0);
 		err = -EINVAL;
 		goto err1;



^ permalink raw reply	[flat|nested] 283+ messages in thread

* [PATCH 4.9 243/271] hwmon: (adt7475) Make volt2reg return same reg as reg2volt input
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (241 preceding siblings ...)
  2020-01-28 14:06 ` [PATCH 4.9 242/271] gtp: make sure only SOCK_DGRAM UDP sockets are accepted Greg Kroah-Hartman
@ 2020-01-28 14:06 ` Greg Kroah-Hartman
  2020-01-28 14:06 ` [PATCH 4.9 244/271] hwmon: (core) Simplify sysfs attribute name allocation Greg Kroah-Hartman
                   ` (32 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:06 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Luuk Paulussen, Guenter Roeck

From: Luuk Paulussen <luuk.paulussen@alliedtelesis.co.nz>

commit cf3ca1877574a306c0207cbf7fdf25419d9229df upstream.

reg2volt returns the voltage that matches a given register value.
Converting this back the other way with volt2reg didn't return the same
register value because it used truncation instead of rounding.

This meant that values read from sysfs could not be written back to sysfs
to set back the same register value.

With this change, volt2reg will return the same value for every voltage
previously returned by reg2volt (for the set of possible input values)

Signed-off-by: Luuk Paulussen <luuk.paulussen@alliedtelesis.co.nz>
Link: https://lore.kernel.org/r/20191205231659.1301-1-luuk.paulussen@alliedtelesis.co.nz
cc: stable@vger.kernel.org
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/hwmon/adt7475.c |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

--- a/drivers/hwmon/adt7475.c
+++ b/drivers/hwmon/adt7475.c
@@ -268,9 +268,10 @@ static inline u16 volt2reg(int channel,
 	long reg;
 
 	if (bypass_attn & (1 << channel))
-		reg = (volt * 1024) / 2250;
+		reg = DIV_ROUND_CLOSEST(volt * 1024, 2250);
 	else
-		reg = (volt * r[1] * 1024) / ((r[0] + r[1]) * 2250);
+		reg = DIV_ROUND_CLOSEST(volt * r[1] * 1024,
+					(r[0] + r[1]) * 2250);
 	return clamp_val(reg, 0, 1023) & (0xff << 2);
 }
 



^ permalink raw reply	[flat|nested] 283+ messages in thread

* [PATCH 4.9 244/271] hwmon: (core) Simplify sysfs attribute name allocation
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (242 preceding siblings ...)
  2020-01-28 14:06 ` [PATCH 4.9 243/271] hwmon: (adt7475) Make volt2reg return same reg as reg2volt input Greg Kroah-Hartman
@ 2020-01-28 14:06 ` Greg Kroah-Hartman
  2020-01-28 14:06 ` [PATCH 4.9 245/271] hwmon: Deal with errors from the thermal subsystem Greg Kroah-Hartman
                   ` (31 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:06 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Guenter Roeck

From: Guenter Roeck <linux@roeck-us.net>

commit 3a412d5e4a1c831723d0aaf305f1cf9a78ad9c90 upstream.

Allocating the sysfs attribute name only if needed and only with the
required minimum length looks optimal, but does not take the additional
overhead for both devm_ data structures and the allocation header itself
into account. This also results in unnecessary memory fragmentation.
Move the sysfs name string into struct hwmon_device_attribute and give it
a sufficient length to reduce this overhead.

Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/hwmon/hwmon.c |   17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

--- a/drivers/hwmon/hwmon.c
+++ b/drivers/hwmon/hwmon.c
@@ -38,12 +38,15 @@ struct hwmon_device {
 
 #define to_hwmon_device(d) container_of(d, struct hwmon_device, dev)
 
+#define MAX_SYSFS_ATTR_NAME_LENGTH	32
+
 struct hwmon_device_attribute {
 	struct device_attribute dev_attr;
 	const struct hwmon_ops *ops;
 	enum hwmon_sensor_types type;
 	u32 attr;
 	int index;
+	char name[MAX_SYSFS_ATTR_NAME_LENGTH];
 };
 
 #define to_hwmon_attr(d) \
@@ -232,20 +235,18 @@ static struct attribute *hwmon_genattr(s
 	if ((mode & S_IWUGO) && !ops->write)
 		return ERR_PTR(-EINVAL);
 
+	hattr = devm_kzalloc(dev, sizeof(*hattr), GFP_KERNEL);
+	if (!hattr)
+		return ERR_PTR(-ENOMEM);
+
 	if (type == hwmon_chip) {
 		name = (char *)template;
 	} else {
-		name = devm_kzalloc(dev, strlen(template) + 16, GFP_KERNEL);
-		if (!name)
-			return ERR_PTR(-ENOMEM);
-		scnprintf(name, strlen(template) + 16, template,
+		scnprintf(hattr->name, sizeof(hattr->name), template,
 			  index + hwmon_attr_base(type));
+		name = hattr->name;
 	}
 
-	hattr = devm_kzalloc(dev, sizeof(*hattr), GFP_KERNEL);
-	if (!hattr)
-		return ERR_PTR(-ENOMEM);
-
 	hattr->type = type;
 	hattr->attr = attr;
 	hattr->index = index;



^ permalink raw reply	[flat|nested] 283+ messages in thread

* [PATCH 4.9 245/271] hwmon: Deal with errors from the thermal subsystem
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (243 preceding siblings ...)
  2020-01-28 14:06 ` [PATCH 4.9 244/271] hwmon: (core) Simplify sysfs attribute name allocation Greg Kroah-Hartman
@ 2020-01-28 14:06 ` Greg Kroah-Hartman
  2020-01-28 14:06 ` [PATCH 4.9 246/271] hwmon: (core) Fix double-free in __hwmon_device_register() Greg Kroah-Hartman
                   ` (30 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:06 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Linus Walleij, Guenter Roeck

From: Linus Walleij <linus.walleij@linaro.org>

commit 47c332deb8e89f6c59b0bb2615945c6e7fad1a60 upstream.

If the thermal subsystem returne -EPROBE_DEFER or any other error
when hwmon calls devm_thermal_zone_of_sensor_register(), this is
silently ignored.

I ran into this with an incorrectly defined thermal zone, making
it non-existing and thus this call failed with -EPROBE_DEFER
assuming it would appear later. The sensor was still added
which is incorrect: sensors must strictly be added after the
thermal zones, so deferred probe must be respected.

Fixes: d560168b5d0f ("hwmon: (core) New hwmon registration API")
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/hwmon/hwmon.c |   21 +++++++++++++++++----
 1 file changed, 17 insertions(+), 4 deletions(-)

--- a/drivers/hwmon/hwmon.c
+++ b/drivers/hwmon/hwmon.c
@@ -143,6 +143,7 @@ static int hwmon_thermal_add_sensor(stru
 				    struct hwmon_device *hwdev, int index)
 {
 	struct hwmon_thermal_data *tdata;
+	struct thermal_zone_device *tzd;
 
 	tdata = devm_kzalloc(dev, sizeof(*tdata), GFP_KERNEL);
 	if (!tdata)
@@ -151,8 +152,14 @@ static int hwmon_thermal_add_sensor(stru
 	tdata->hwdev = hwdev;
 	tdata->index = index;
 
-	devm_thermal_zone_of_sensor_register(&hwdev->dev, index, tdata,
-					     &hwmon_thermal_ops);
+	tzd = devm_thermal_zone_of_sensor_register(&hwdev->dev, index, tdata,
+						   &hwmon_thermal_ops);
+	/*
+	 * If CONFIG_THERMAL_OF is disabled, this returns -ENODEV,
+	 * so ignore that error but forward any other error.
+	 */
+	if (IS_ERR(tzd) && (PTR_ERR(tzd) != -ENODEV))
+		return PTR_ERR(tzd);
 
 	return 0;
 }
@@ -586,14 +593,20 @@ __hwmon_device_register(struct device *d
 				if (!chip->ops->is_visible(drvdata, hwmon_temp,
 							   hwmon_temp_input, j))
 					continue;
-				if (info[i]->config[j] & HWMON_T_INPUT)
-					hwmon_thermal_add_sensor(dev, hwdev, j);
+				if (info[i]->config[j] & HWMON_T_INPUT) {
+					err = hwmon_thermal_add_sensor(dev,
+								hwdev, j);
+					if (err)
+						goto free_device;
+				}
 			}
 		}
 	}
 
 	return hdev;
 
+free_device:
+	device_unregister(hdev);
 free_hwmon:
 	kfree(hwdev);
 ida_remove:



^ permalink raw reply	[flat|nested] 283+ messages in thread

* [PATCH 4.9 246/271] hwmon: (core) Fix double-free in __hwmon_device_register()
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (244 preceding siblings ...)
  2020-01-28 14:06 ` [PATCH 4.9 245/271] hwmon: Deal with errors from the thermal subsystem Greg Kroah-Hartman
@ 2020-01-28 14:06 ` Greg Kroah-Hartman
  2020-01-28 14:06 ` [PATCH 4.9 247/271] hwmon: (core) Do not use device managed functions for memory allocations Greg Kroah-Hartman
                   ` (29 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:06 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Dmitry Osipenko, Guenter Roeck

From: Dmitry Osipenko <digetx@gmail.com>

commit 74e3512731bd5c9673176425a76a7cc5efa8ddb6 upstream.

Fix double-free that happens when thermal zone setup fails, see KASAN log
below.

==================================================================
BUG: KASAN: double-free or invalid-free in __hwmon_device_register+0x5dc/0xa7c

CPU: 0 PID: 132 Comm: kworker/0:2 Tainted: G    B             4.19.0-rc8-next-20181016-00042-gb52cd80401e9-dirty #41
Hardware name: NVIDIA Tegra SoC (Flattened Device Tree)
Workqueue: events deferred_probe_work_func
Backtrace:
[<c0110540>] (dump_backtrace) from [<c0110944>] (show_stack+0x20/0x24)
[<c0110924>] (show_stack) from [<c105cb08>] (dump_stack+0x9c/0xb0)
[<c105ca6c>] (dump_stack) from [<c02fdaec>] (print_address_description+0x68/0x250)
[<c02fda84>] (print_address_description) from [<c02fd4ac>] (kasan_report_invalid_free+0x68/0x88)
[<c02fd444>] (kasan_report_invalid_free) from [<c02fc85c>] (__kasan_slab_free+0x1f4/0x200)
[<c02fc668>] (__kasan_slab_free) from [<c02fd0c0>] (kasan_slab_free+0x14/0x18)
[<c02fd0ac>] (kasan_slab_free) from [<c02f9c6c>] (kfree+0x90/0x294)
[<c02f9bdc>] (kfree) from [<c0b41bbc>] (__hwmon_device_register+0x5dc/0xa7c)
[<c0b415e0>] (__hwmon_device_register) from [<c0b421e8>] (hwmon_device_register_with_info+0xa0/0xa8)
[<c0b42148>] (hwmon_device_register_with_info) from [<c0b42324>] (devm_hwmon_device_register_with_info+0x74/0xb4)
[<c0b422b0>] (devm_hwmon_device_register_with_info) from [<c0b4481c>] (lm90_probe+0x414/0x578)
[<c0b44408>] (lm90_probe) from [<c0aeeff4>] (i2c_device_probe+0x35c/0x384)
[<c0aeec98>] (i2c_device_probe) from [<c08776cc>] (really_probe+0x290/0x3e4)
[<c087743c>] (really_probe) from [<c0877a2c>] (driver_probe_device+0x80/0x1c4)
[<c08779ac>] (driver_probe_device) from [<c0877da8>] (__device_attach_driver+0x104/0x11c)
[<c0877ca4>] (__device_attach_driver) from [<c0874dd8>] (bus_for_each_drv+0xa4/0xc8)
[<c0874d34>] (bus_for_each_drv) from [<c08773b0>] (__device_attach+0xf0/0x15c)
[<c08772c0>] (__device_attach) from [<c0877e24>] (device_initial_probe+0x1c/0x20)
[<c0877e08>] (device_initial_probe) from [<c08762f4>] (bus_probe_device+0xdc/0xec)
[<c0876218>] (bus_probe_device) from [<c0876a08>] (deferred_probe_work_func+0xa8/0xd4)
[<c0876960>] (deferred_probe_work_func) from [<c01527c4>] (process_one_work+0x3dc/0x96c)
[<c01523e8>] (process_one_work) from [<c01541e0>] (worker_thread+0x4ec/0x8bc)
[<c0153cf4>] (worker_thread) from [<c015b238>] (kthread+0x230/0x240)
[<c015b008>] (kthread) from [<c01010bc>] (ret_from_fork+0x14/0x38)
Exception stack(0xcf743fb0 to 0xcf743ff8)
3fa0:                                     00000000 00000000 00000000 00000000
3fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
3fe0: 00000000 00000000 00000000 00000000 00000013 00000000

Allocated by task 132:
 kasan_kmalloc.part.1+0x58/0xf4
 kasan_kmalloc+0x90/0xa4
 kmem_cache_alloc_trace+0x90/0x2a0
 __hwmon_device_register+0xbc/0xa7c
 hwmon_device_register_with_info+0xa0/0xa8
 devm_hwmon_device_register_with_info+0x74/0xb4
 lm90_probe+0x414/0x578
 i2c_device_probe+0x35c/0x384
 really_probe+0x290/0x3e4
 driver_probe_device+0x80/0x1c4
 __device_attach_driver+0x104/0x11c
 bus_for_each_drv+0xa4/0xc8
 __device_attach+0xf0/0x15c
 device_initial_probe+0x1c/0x20
 bus_probe_device+0xdc/0xec
 deferred_probe_work_func+0xa8/0xd4
 process_one_work+0x3dc/0x96c
 worker_thread+0x4ec/0x8bc
 kthread+0x230/0x240
 ret_from_fork+0x14/0x38
   (null)

Freed by task 132:
 __kasan_slab_free+0x12c/0x200
 kasan_slab_free+0x14/0x18
 kfree+0x90/0x294
 hwmon_dev_release+0x1c/0x20
 device_release+0x4c/0xe8
 kobject_put+0xac/0x11c
 device_unregister+0x2c/0x30
 __hwmon_device_register+0xa58/0xa7c
 hwmon_device_register_with_info+0xa0/0xa8
 devm_hwmon_device_register_with_info+0x74/0xb4
 lm90_probe+0x414/0x578
 i2c_device_probe+0x35c/0x384
 really_probe+0x290/0x3e4
 driver_probe_device+0x80/0x1c4
 __device_attach_driver+0x104/0x11c
 bus_for_each_drv+0xa4/0xc8
 __device_attach+0xf0/0x15c
 device_initial_probe+0x1c/0x20
 bus_probe_device+0xdc/0xec
 deferred_probe_work_func+0xa8/0xd4
 process_one_work+0x3dc/0x96c
 worker_thread+0x4ec/0x8bc
 kthread+0x230/0x240
 ret_from_fork+0x14/0x38
   (null)

Cc: <stable@vger.kernel.org> # v4.15+
Fixes: 47c332deb8e8 ("hwmon: Deal with errors from the thermal subsystem")
Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/hwmon/hwmon.c |    8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

--- a/drivers/hwmon/hwmon.c
+++ b/drivers/hwmon/hwmon.c
@@ -596,8 +596,10 @@ __hwmon_device_register(struct device *d
 				if (info[i]->config[j] & HWMON_T_INPUT) {
 					err = hwmon_thermal_add_sensor(dev,
 								hwdev, j);
-					if (err)
-						goto free_device;
+					if (err) {
+						device_unregister(hdev);
+						goto ida_remove;
+					}
 				}
 			}
 		}
@@ -605,8 +607,6 @@ __hwmon_device_register(struct device *d
 
 	return hdev;
 
-free_device:
-	device_unregister(hdev);
 free_hwmon:
 	kfree(hwdev);
 ida_remove:



^ permalink raw reply	[flat|nested] 283+ messages in thread

* [PATCH 4.9 247/271] hwmon: (core) Do not use device managed functions for memory allocations
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (245 preceding siblings ...)
  2020-01-28 14:06 ` [PATCH 4.9 246/271] hwmon: (core) Fix double-free in __hwmon_device_register() Greg Kroah-Hartman
@ 2020-01-28 14:06 ` Greg Kroah-Hartman
  2020-01-28 14:06 ` [PATCH 4.9 248/271] Input: keyspan-remote - fix control-message timeouts Greg Kroah-Hartman
                   ` (28 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Martin K. Petersen, Guenter Roeck

From: Guenter Roeck <linux@roeck-us.net>

commit 3bf8bdcf3bada771eb12b57f2a30caee69e8ab8d upstream.

The hwmon core uses device managed functions, tied to the hwmon parent
device, for various internal memory allocations. This is problematic
since hwmon device lifetime does not necessarily match its parent's
device lifetime. If there is a mismatch, memory leaks will accumulate
until the parent device is released.

Fix the problem by managing all memory allocations internally. The only
exception is memory allocation for thermal device registration, which
can be tied to the hwmon device, along with thermal device registration
itself.

Fixes: d560168b5d0f ("hwmon: (core) New hwmon registration API")
Cc: stable@vger.kernel.org # v4.14.x: 47c332deb8e8: hwmon: Deal with errors from the thermal subsystem
Cc: stable@vger.kernel.org # v4.14.x: 74e3512731bd: hwmon: (core) Fix double-free in __hwmon_device_register()
Cc: stable@vger.kernel.org # v4.9.x: 3a412d5e4a1c: hwmon: (core) Simplify sysfs attribute name allocation
Cc: stable@vger.kernel.org # v4.9.x: 47c332deb8e8: hwmon: Deal with errors from the thermal subsystem
Cc: stable@vger.kernel.org # v4.9.x: 74e3512731bd: hwmon: (core) Fix double-free in __hwmon_device_register()
Cc: stable@vger.kernel.org # v4.9+
Cc: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/hwmon/hwmon.c |   68 ++++++++++++++++++++++++++++++--------------------
 1 file changed, 41 insertions(+), 27 deletions(-)

--- a/drivers/hwmon/hwmon.c
+++ b/drivers/hwmon/hwmon.c
@@ -51,6 +51,7 @@ struct hwmon_device_attribute {
 
 #define to_hwmon_attr(d) \
 	container_of(d, struct hwmon_device_attribute, dev_attr)
+#define to_dev_attr(a) container_of(a, struct device_attribute, attr)
 
 /*
  * Thermal zone information
@@ -58,7 +59,7 @@ struct hwmon_device_attribute {
  * also provides the sensor index.
  */
 struct hwmon_thermal_data {
-	struct hwmon_device *hwdev;	/* Reference to hwmon device */
+	struct device *dev;		/* Reference to hwmon device */
 	int index;			/* sensor index */
 };
 
@@ -95,9 +96,27 @@ static const struct attribute_group *hwm
 	NULL
 };
 
+static void hwmon_free_attrs(struct attribute **attrs)
+{
+	int i;
+
+	for (i = 0; attrs[i]; i++) {
+		struct device_attribute *dattr = to_dev_attr(attrs[i]);
+		struct hwmon_device_attribute *hattr = to_hwmon_attr(dattr);
+
+		kfree(hattr);
+	}
+	kfree(attrs);
+}
+
 static void hwmon_dev_release(struct device *dev)
 {
-	kfree(to_hwmon_device(dev));
+	struct hwmon_device *hwdev = to_hwmon_device(dev);
+
+	if (hwdev->group.attrs)
+		hwmon_free_attrs(hwdev->group.attrs);
+	kfree(hwdev->groups);
+	kfree(hwdev);
 }
 
 static struct class hwmon_class = {
@@ -121,11 +140,11 @@ static DEFINE_IDA(hwmon_ida);
 static int hwmon_thermal_get_temp(void *data, int *temp)
 {
 	struct hwmon_thermal_data *tdata = data;
-	struct hwmon_device *hwdev = tdata->hwdev;
+	struct hwmon_device *hwdev = to_hwmon_device(tdata->dev);
 	int ret;
 	long t;
 
-	ret = hwdev->chip->ops->read(&hwdev->dev, hwmon_temp, hwmon_temp_input,
+	ret = hwdev->chip->ops->read(tdata->dev, hwmon_temp, hwmon_temp_input,
 				     tdata->index, &t);
 	if (ret < 0)
 		return ret;
@@ -139,8 +158,7 @@ static struct thermal_zone_of_device_ops
 	.get_temp = hwmon_thermal_get_temp,
 };
 
-static int hwmon_thermal_add_sensor(struct device *dev,
-				    struct hwmon_device *hwdev, int index)
+static int hwmon_thermal_add_sensor(struct device *dev, int index)
 {
 	struct hwmon_thermal_data *tdata;
 	struct thermal_zone_device *tzd;
@@ -149,10 +167,10 @@ static int hwmon_thermal_add_sensor(stru
 	if (!tdata)
 		return -ENOMEM;
 
-	tdata->hwdev = hwdev;
+	tdata->dev = dev;
 	tdata->index = index;
 
-	tzd = devm_thermal_zone_of_sensor_register(&hwdev->dev, index, tdata,
+	tzd = devm_thermal_zone_of_sensor_register(dev, index, tdata,
 						   &hwmon_thermal_ops);
 	/*
 	 * If CONFIG_THERMAL_OF is disabled, this returns -ENODEV,
@@ -164,8 +182,7 @@ static int hwmon_thermal_add_sensor(stru
 	return 0;
 }
 #else
-static int hwmon_thermal_add_sensor(struct device *dev,
-				    struct hwmon_device *hwdev, int index)
+static int hwmon_thermal_add_sensor(struct device *dev, int index)
 {
 	return 0;
 }
@@ -215,8 +232,7 @@ static int hwmon_attr_base(enum hwmon_se
 	return 1;
 }
 
-static struct attribute *hwmon_genattr(struct device *dev,
-				       const void *drvdata,
+static struct attribute *hwmon_genattr(const void *drvdata,
 				       enum hwmon_sensor_types type,
 				       u32 attr,
 				       int index,
@@ -242,7 +258,7 @@ static struct attribute *hwmon_genattr(s
 	if ((mode & S_IWUGO) && !ops->write)
 		return ERR_PTR(-EINVAL);
 
-	hattr = devm_kzalloc(dev, sizeof(*hattr), GFP_KERNEL);
+	hattr = kzalloc(sizeof(*hattr), GFP_KERNEL);
 	if (!hattr)
 		return ERR_PTR(-ENOMEM);
 
@@ -441,8 +457,7 @@ static int hwmon_num_channel_attrs(const
 	return n;
 }
 
-static int hwmon_genattrs(struct device *dev,
-			  const void *drvdata,
+static int hwmon_genattrs(const void *drvdata,
 			  struct attribute **attrs,
 			  const struct hwmon_ops *ops,
 			  const struct hwmon_channel_info *info)
@@ -468,7 +483,7 @@ static int hwmon_genattrs(struct device
 			attr_mask &= ~BIT(attr);
 			if (attr >= template_size)
 				return -EINVAL;
-			a = hwmon_genattr(dev, drvdata, info->type, attr, i,
+			a = hwmon_genattr(drvdata, info->type, attr, i,
 					  templates[attr], ops);
 			if (IS_ERR(a)) {
 				if (PTR_ERR(a) != -ENOENT)
@@ -482,8 +497,7 @@ static int hwmon_genattrs(struct device
 }
 
 static struct attribute **
-__hwmon_create_attrs(struct device *dev, const void *drvdata,
-		     const struct hwmon_chip_info *chip)
+__hwmon_create_attrs(const void *drvdata, const struct hwmon_chip_info *chip)
 {
 	int ret, i, aindex = 0, nattrs = 0;
 	struct attribute **attrs;
@@ -494,15 +508,17 @@ __hwmon_create_attrs(struct device *dev,
 	if (nattrs == 0)
 		return ERR_PTR(-EINVAL);
 
-	attrs = devm_kcalloc(dev, nattrs + 1, sizeof(*attrs), GFP_KERNEL);
+	attrs = kcalloc(nattrs + 1, sizeof(*attrs), GFP_KERNEL);
 	if (!attrs)
 		return ERR_PTR(-ENOMEM);
 
 	for (i = 0; chip->info[i]; i++) {
-		ret = hwmon_genattrs(dev, drvdata, &attrs[aindex], chip->ops,
+		ret = hwmon_genattrs(drvdata, &attrs[aindex], chip->ops,
 				     chip->info[i]);
-		if (ret < 0)
+		if (ret < 0) {
+			hwmon_free_attrs(attrs);
 			return ERR_PTR(ret);
+		}
 		aindex += ret;
 	}
 
@@ -542,14 +558,13 @@ __hwmon_device_register(struct device *d
 			for (i = 0; groups[i]; i++)
 				ngroups++;
 
-		hwdev->groups = devm_kcalloc(dev, ngroups, sizeof(*groups),
-					     GFP_KERNEL);
+		hwdev->groups = kcalloc(ngroups, sizeof(*groups), GFP_KERNEL);
 		if (!hwdev->groups) {
 			err = -ENOMEM;
 			goto free_hwmon;
 		}
 
-		attrs = __hwmon_create_attrs(dev, drvdata, chip);
+		attrs = __hwmon_create_attrs(drvdata, chip);
 		if (IS_ERR(attrs)) {
 			err = PTR_ERR(attrs);
 			goto free_hwmon;
@@ -594,8 +609,7 @@ __hwmon_device_register(struct device *d
 							   hwmon_temp_input, j))
 					continue;
 				if (info[i]->config[j] & HWMON_T_INPUT) {
-					err = hwmon_thermal_add_sensor(dev,
-								hwdev, j);
+					err = hwmon_thermal_add_sensor(hdev, j);
 					if (err) {
 						device_unregister(hdev);
 						goto ida_remove;
@@ -608,7 +622,7 @@ __hwmon_device_register(struct device *d
 	return hdev;
 
 free_hwmon:
-	kfree(hwdev);
+	hwmon_dev_release(hdev);
 ida_remove:
 	ida_simple_remove(&hwmon_ida, id);
 	return ERR_PTR(err);



^ permalink raw reply	[flat|nested] 283+ messages in thread

* [PATCH 4.9 248/271] Input: keyspan-remote - fix control-message timeouts
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (246 preceding siblings ...)
  2020-01-28 14:06 ` [PATCH 4.9 247/271] hwmon: (core) Do not use device managed functions for memory allocations Greg Kroah-Hartman
@ 2020-01-28 14:06 ` Greg Kroah-Hartman
  2020-01-28 14:06 ` [PATCH 4.9 249/271] ARM: 8950/1: ftrace/recordmcount: filter relocation types Greg Kroah-Hartman
                   ` (27 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:06 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Johan Hovold, Dmitry Torokhov

From: Johan Hovold <johan@kernel.org>

commit ba9a103f40fc4a3ec7558ec9b0b97d4f92034249 upstream.

The driver was issuing synchronous uninterruptible control requests
without using a timeout. This could lead to the driver hanging on probe
due to a malfunctioning (or malicious) device until the device is
physically disconnected. While sleeping in probe the driver prevents
other devices connected to the same hub from being added to (or removed
from) the bus.

The USB upper limit of five seconds per request should be more than
enough.

Fixes: 99f83c9c9ac9 ("[PATCH] USB: add driver for Keyspan Digital Remote")
Signed-off-by: Johan Hovold <johan@kernel.org>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: stable <stable@vger.kernel.org>     # 2.6.13
Link: https://lore.kernel.org/r/20200113171715.30621-1-johan@kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/input/misc/keyspan_remote.c |    9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

--- a/drivers/input/misc/keyspan_remote.c
+++ b/drivers/input/misc/keyspan_remote.c
@@ -344,7 +344,8 @@ static int keyspan_setup(struct usb_devi
 	int retval = 0;
 
 	retval = usb_control_msg(dev, usb_sndctrlpipe(dev, 0),
-				 0x11, 0x40, 0x5601, 0x0, NULL, 0, 0);
+				 0x11, 0x40, 0x5601, 0x0, NULL, 0,
+				 USB_CTRL_SET_TIMEOUT);
 	if (retval) {
 		dev_dbg(&dev->dev, "%s - failed to set bit rate due to error: %d\n",
 			__func__, retval);
@@ -352,7 +353,8 @@ static int keyspan_setup(struct usb_devi
 	}
 
 	retval = usb_control_msg(dev, usb_sndctrlpipe(dev, 0),
-				 0x44, 0x40, 0x0, 0x0, NULL, 0, 0);
+				 0x44, 0x40, 0x0, 0x0, NULL, 0,
+				 USB_CTRL_SET_TIMEOUT);
 	if (retval) {
 		dev_dbg(&dev->dev, "%s - failed to set resume sensitivity due to error: %d\n",
 			__func__, retval);
@@ -360,7 +362,8 @@ static int keyspan_setup(struct usb_devi
 	}
 
 	retval = usb_control_msg(dev, usb_sndctrlpipe(dev, 0),
-				 0x22, 0x40, 0x0, 0x0, NULL, 0, 0);
+				 0x22, 0x40, 0x0, 0x0, NULL, 0,
+				 USB_CTRL_SET_TIMEOUT);
 	if (retval) {
 		dev_dbg(&dev->dev, "%s - failed to turn receive on due to error: %d\n",
 			__func__, retval);



^ permalink raw reply	[flat|nested] 283+ messages in thread

* [PATCH 4.9 249/271] ARM: 8950/1: ftrace/recordmcount: filter relocation types
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (247 preceding siblings ...)
  2020-01-28 14:06 ` [PATCH 4.9 248/271] Input: keyspan-remote - fix control-message timeouts Greg Kroah-Hartman
@ 2020-01-28 14:06 ` Greg Kroah-Hartman
  2020-01-28 14:06 ` [PATCH 4.9 250/271] mmc: tegra: fix SDR50 tuning override Greg Kroah-Hartman
                   ` (26 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Alexander Sverdlin,
	Steven Rostedt (VMware),
	Russell King

From: Alex Sverdlin <alexander.sverdlin@nokia.com>

commit 927d780ee371d7e121cea4fc7812f6ef2cea461c upstream.

Scenario 1, ARMv7
=================

If code in arch/arm/kernel/ftrace.c would operate on mcount() pointer
the following may be generated:

00000230 <prealloc_fixed_plts>:
 230:   b5f8            push    {r3, r4, r5, r6, r7, lr}
 232:   b500            push    {lr}
 234:   f7ff fffe       bl      0 <__gnu_mcount_nc>
                        234: R_ARM_THM_CALL     __gnu_mcount_nc
 238:   f240 0600       movw    r6, #0
                        238: R_ARM_THM_MOVW_ABS_NC      __gnu_mcount_nc
 23c:   f8d0 1180       ldr.w   r1, [r0, #384]  ; 0x180

FTRACE currently is not able to deal with it:

WARNING: CPU: 0 PID: 0 at .../kernel/trace/ftrace.c:1979 ftrace_bug+0x1ad/0x230()
...
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.4.116-... #1
...
[<c0314e3d>] (unwind_backtrace) from [<c03115e9>] (show_stack+0x11/0x14)
[<c03115e9>] (show_stack) from [<c051a7f1>] (dump_stack+0x81/0xa8)
[<c051a7f1>] (dump_stack) from [<c0321c5d>] (warn_slowpath_common+0x69/0x90)
[<c0321c5d>] (warn_slowpath_common) from [<c0321cf3>] (warn_slowpath_null+0x17/0x1c)
[<c0321cf3>] (warn_slowpath_null) from [<c038ee9d>] (ftrace_bug+0x1ad/0x230)
[<c038ee9d>] (ftrace_bug) from [<c038f1f9>] (ftrace_process_locs+0x27d/0x444)
[<c038f1f9>] (ftrace_process_locs) from [<c08915bd>] (ftrace_init+0x91/0xe8)
[<c08915bd>] (ftrace_init) from [<c0885a67>] (start_kernel+0x34b/0x358)
[<c0885a67>] (start_kernel) from [<00308095>] (0x308095)
---[ end trace cb88537fdc8fa200 ]---
ftrace failed to modify [<c031266c>] prealloc_fixed_plts+0x8/0x60
 actual: 44:f2:e1:36
ftrace record flags: 0
 (0)   expected tramp: c03143e9

Scenario 2, ARMv4T
==================

ftrace: allocating 14435 entries in 43 pages
------------[ cut here ]------------
WARNING: CPU: 0 PID: 0 at kernel/trace/ftrace.c:2029 ftrace_bug+0x204/0x310
CPU: 0 PID: 0 Comm: swapper Not tainted 4.19.5 #1
Hardware name: Cirrus Logic EDB9302 Evaluation Board
[<c0010a24>] (unwind_backtrace) from [<c000ecb0>] (show_stack+0x20/0x2c)
[<c000ecb0>] (show_stack) from [<c03c72e8>] (dump_stack+0x20/0x30)
[<c03c72e8>] (dump_stack) from [<c0021c18>] (__warn+0xdc/0x104)
[<c0021c18>] (__warn) from [<c0021d7c>] (warn_slowpath_null+0x4c/0x5c)
[<c0021d7c>] (warn_slowpath_null) from [<c0095360>] (ftrace_bug+0x204/0x310)
[<c0095360>] (ftrace_bug) from [<c04dabac>] (ftrace_init+0x3b4/0x4d4)
[<c04dabac>] (ftrace_init) from [<c04cef4c>] (start_kernel+0x20c/0x410)
[<c04cef4c>] (start_kernel) from [<00000000>] (  (null))
---[ end trace 0506a2f5dae6b341 ]---
ftrace failed to modify
[<c000c350>] perf_trace_sys_exit+0x5c/0xe8
 actual:   1e:ff:2f:e1
Initializing ftrace call sites
ftrace record flags: 0
 (0)
 expected tramp: c000fb24

The analysis for this problem has been already performed previously,
refer to the link below.

Fix the above problems by allowing only selected reloc types in
__mcount_loc. The list itself comes from the legacy recordmcount.pl
script.

Link: https://lore.kernel.org/lkml/56961010.6000806@pengutronix.de/
Cc: stable@vger.kernel.org
Fixes: ed60453fa8f8 ("ARM: 6511/1: ftrace: add ARM support for C version of recordmcount")
Signed-off-by: Alexander Sverdlin <alexander.sverdlin@nokia.com>
Acked-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 scripts/recordmcount.c |   17 +++++++++++++++++
 1 file changed, 17 insertions(+)

--- a/scripts/recordmcount.c
+++ b/scripts/recordmcount.c
@@ -53,6 +53,10 @@
 #define R_AARCH64_ABS64	257
 #endif
 
+#define R_ARM_PC24		1
+#define R_ARM_THM_CALL		10
+#define R_ARM_CALL		28
+
 static int fd_map;	/* File descriptor for file being modified. */
 static int mmap_failed; /* Boolean flag. */
 static char gpfx;	/* prefix for global symbol name (sometimes '_') */
@@ -374,6 +378,18 @@ is_mcounted_section_name(char const *con
 #define RECORD_MCOUNT_64
 #include "recordmcount.h"
 
+static int arm_is_fake_mcount(Elf32_Rel const *rp)
+{
+	switch (ELF32_R_TYPE(w(rp->r_info))) {
+	case R_ARM_THM_CALL:
+	case R_ARM_CALL:
+	case R_ARM_PC24:
+		return 0;
+	}
+
+	return 1;
+}
+
 /* 64-bit EM_MIPS has weird ELF64_Rela.r_info.
  * http://techpubs.sgi.com/library/manuals/4000/007-4658-001/pdf/007-4658-001.pdf
  * We interpret Table 29 Relocation Operation (Elf64_Rel, Elf64_Rela) [p.40]
@@ -463,6 +479,7 @@ do_file(char const *const fname)
 		break;
 	case EM_ARM:	 reltype = R_ARM_ABS32;
 			 altmcount = "__gnu_mcount_nc";
+			 is_fake_mcount32 = arm_is_fake_mcount;
 			 break;
 	case EM_AARCH64:
 			reltype = R_AARCH64_ABS64;



^ permalink raw reply	[flat|nested] 283+ messages in thread

* [PATCH 4.9 250/271] mmc: tegra: fix SDR50 tuning override
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (248 preceding siblings ...)
  2020-01-28 14:06 ` [PATCH 4.9 249/271] ARM: 8950/1: ftrace/recordmcount: filter relocation types Greg Kroah-Hartman
@ 2020-01-28 14:06 ` Greg Kroah-Hartman
  2020-01-28 14:06 ` [PATCH 4.9 251/271] mmc: sdhci: fix minimum clock rate for v3 controller Greg Kroah-Hartman
                   ` (25 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Adrian Hunter, Thierry Reding,
	Michał Mirosław, Ulf Hansson

From: Michał Mirosław <mirq-linux@rere.qmqm.pl>

commit f571389c0b015e76f91c697c4c1700aba860d34f upstream.

Commit 7ad2ed1dfcbe inadvertently mixed up a quirk flag's name and
broke SDR50 tuning override. Use correct NVQUIRK_ name.

Fixes: 7ad2ed1dfcbe ("mmc: tegra: enable UHS-I modes")
Cc: <stable@vger.kernel.org>
Acked-by: Adrian Hunter <adrian.hunter@intel.com>
Reviewed-by: Thierry Reding <treding@nvidia.com>
Tested-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
Link: https://lore.kernel.org/r/9aff1d859935e59edd81e4939e40d6c55e0b55f6.1578390388.git.mirq-linux@rere.qmqm.pl
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/mmc/host/sdhci-tegra.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/mmc/host/sdhci-tegra.c
+++ b/drivers/mmc/host/sdhci-tegra.c
@@ -174,7 +174,7 @@ static void tegra_sdhci_reset(struct sdh
 			misc_ctrl |= SDHCI_MISC_CTRL_ENABLE_DDR50;
 		if (soc_data->nvquirks & NVQUIRK_ENABLE_SDR104)
 			misc_ctrl |= SDHCI_MISC_CTRL_ENABLE_SDR104;
-		if (soc_data->nvquirks & SDHCI_MISC_CTRL_ENABLE_SDR50)
+		if (soc_data->nvquirks & NVQUIRK_ENABLE_SDR50)
 			clk_ctrl |= SDHCI_CLOCK_CTRL_SDR50_TUNING_OVERRIDE;
 	}
 



^ permalink raw reply	[flat|nested] 283+ messages in thread

* [PATCH 4.9 251/271] mmc: sdhci: fix minimum clock rate for v3 controller
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (249 preceding siblings ...)
  2020-01-28 14:06 ` [PATCH 4.9 250/271] mmc: tegra: fix SDR50 tuning override Greg Kroah-Hartman
@ 2020-01-28 14:06 ` Greg Kroah-Hartman
  2020-01-28 14:06 ` [PATCH 4.9 252/271] Input: sur40 - fix interface sanity checks Greg Kroah-Hartman
                   ` (24 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Michał Mirosław,
	Adrian Hunter, Ulf Hansson

From: Michał Mirosław <mirq-linux@rere.qmqm.pl>

commit 2a187d03352086e300daa2044051db00044cd171 upstream.

For SDHCIv3+ with programmable clock mode, minimal clock frequency is
still base clock / max(divider). Minimal programmable clock frequency is
always greater than minimal divided clock frequency. Without this patch,
SDHCI uses out-of-spec initial frequency when multiplier is big enough:

mmc1: mmc_rescan_try_freq: trying to init card at 468750 Hz
[for 480 MHz source clock divided by 1024]

The code in sdhci_calc_clk() already chooses a correct SDCLK clock mode.

Fixes: c3ed3877625f ("mmc: sdhci: add support for programmable clock mode")
Cc: <stable@vger.kernel.org> # 4f6aa3264af4: mmc: tegra: Only advertise UHS modes if IO regulator is present
Cc: <stable@vger.kernel.org>
Signed-off-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
Acked-by: Adrian Hunter <adrian.hunter@intel.com>
Link: https://lore.kernel.org/r/ffb489519a446caffe7a0a05c4b9372bd52397bb.1579082031.git.mirq-linux@rere.qmqm.pl
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/mmc/host/sdhci.c |   10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

--- a/drivers/mmc/host/sdhci.c
+++ b/drivers/mmc/host/sdhci.c
@@ -3243,11 +3243,13 @@ int sdhci_setup_host(struct sdhci_host *
 	if (host->ops->get_min_clock)
 		mmc->f_min = host->ops->get_min_clock(host);
 	else if (host->version >= SDHCI_SPEC_300) {
-		if (host->clk_mul) {
-			mmc->f_min = (host->max_clk * host->clk_mul) / 1024;
+		if (host->clk_mul)
 			max_clk = host->max_clk * host->clk_mul;
-		} else
-			mmc->f_min = host->max_clk / SDHCI_MAX_DIV_SPEC_300;
+		/*
+		 * Divided Clock Mode minimum clock rate is always less than
+		 * Programmable Clock Mode minimum clock rate.
+		 */
+		mmc->f_min = host->max_clk / SDHCI_MAX_DIV_SPEC_300;
 	} else
 		mmc->f_min = host->max_clk / SDHCI_MAX_DIV_SPEC_200;
 



^ permalink raw reply	[flat|nested] 283+ messages in thread

* [PATCH 4.9 252/271] Input: sur40 - fix interface sanity checks
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (250 preceding siblings ...)
  2020-01-28 14:06 ` [PATCH 4.9 251/271] mmc: sdhci: fix minimum clock rate for v3 controller Greg Kroah-Hartman
@ 2020-01-28 14:06 ` Greg Kroah-Hartman
  2020-01-28 14:06 ` [PATCH 4.9 253/271] Input: gtco - fix endpoint sanity check Greg Kroah-Hartman
                   ` (23 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Johan Hovold, Vladis Dronov, Dmitry Torokhov

From: Johan Hovold <johan@kernel.org>

commit 6b32391ed675827f8425a414abbc6fbd54ea54fe upstream.

Make sure to use the current alternate setting when verifying the
interface descriptors to avoid binding to an invalid interface.

This in turn could cause the driver to misbehave or trigger a WARN() in
usb_submit_urb() that kernels with panic_on_warn set would choke on.

Fixes: bdb5c57f209c ("Input: add sur40 driver for Samsung SUR40 (aka MS Surface 2.0/Pixelsense)")
Signed-off-by: Johan Hovold <johan@kernel.org>
Acked-by: Vladis Dronov <vdronov@redhat.com>
Link: https://lore.kernel.org/r/20191210113737.4016-8-johan@kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/input/touchscreen/sur40.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/input/touchscreen/sur40.c
+++ b/drivers/input/touchscreen/sur40.c
@@ -523,7 +523,7 @@ static int sur40_probe(struct usb_interf
 	int error;
 
 	/* Check if we really have the right interface. */
-	iface_desc = &interface->altsetting[0];
+	iface_desc = interface->cur_altsetting;
 	if (iface_desc->desc.bInterfaceClass != 0xFF)
 		return -ENODEV;
 



^ permalink raw reply	[flat|nested] 283+ messages in thread

* [PATCH 4.9 253/271] Input: gtco - fix endpoint sanity check
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (251 preceding siblings ...)
  2020-01-28 14:06 ` [PATCH 4.9 252/271] Input: sur40 - fix interface sanity checks Greg Kroah-Hartman
@ 2020-01-28 14:06 ` Greg Kroah-Hartman
  2020-01-28 14:06 ` [PATCH 4.9 254/271] Input: aiptek " Greg Kroah-Hartman
                   ` (22 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Johan Hovold, Vladis Dronov, Dmitry Torokhov

From: Johan Hovold <johan@kernel.org>

commit a8eeb74df5a6bdb214b2b581b14782c5f5a0cf83 upstream.

The driver was checking the number of endpoints of the first alternate
setting instead of the current one, something which could lead to the
driver binding to an invalid interface.

This in turn could cause the driver to misbehave or trigger a WARN() in
usb_submit_urb() that kernels with panic_on_warn set would choke on.

Fixes: 162f98dea487 ("Input: gtco - fix crash on detecting device without endpoints")
Signed-off-by: Johan Hovold <johan@kernel.org>
Acked-by: Vladis Dronov <vdronov@redhat.com>
Link: https://lore.kernel.org/r/20191210113737.4016-5-johan@kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/input/tablet/gtco.c |   10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)

--- a/drivers/input/tablet/gtco.c
+++ b/drivers/input/tablet/gtco.c
@@ -875,18 +875,14 @@ static int gtco_probe(struct usb_interfa
 	}
 
 	/* Sanity check that a device has an endpoint */
-	if (usbinterface->altsetting[0].desc.bNumEndpoints < 1) {
+	if (usbinterface->cur_altsetting->desc.bNumEndpoints < 1) {
 		dev_err(&usbinterface->dev,
 			"Invalid number of endpoints\n");
 		error = -EINVAL;
 		goto err_free_urb;
 	}
 
-	/*
-	 * The endpoint is always altsetting 0, we know this since we know
-	 * this device only has one interrupt endpoint
-	 */
-	endpoint = &usbinterface->altsetting[0].endpoint[0].desc;
+	endpoint = &usbinterface->cur_altsetting->endpoint[0].desc;
 
 	/* Some debug */
 	dev_dbg(&usbinterface->dev, "gtco # interfaces: %d\n", usbinterface->num_altsetting);
@@ -973,7 +969,7 @@ static int gtco_probe(struct usb_interfa
 	input_dev->dev.parent = &usbinterface->dev;
 
 	/* Setup the URB, it will be posted later on open of input device */
-	endpoint = &usbinterface->altsetting[0].endpoint[0].desc;
+	endpoint = &usbinterface->cur_altsetting->endpoint[0].desc;
 
 	usb_fill_int_urb(gtco->urbinfo,
 			 udev,



^ permalink raw reply	[flat|nested] 283+ messages in thread

* [PATCH 4.9 254/271] Input: aiptek - fix endpoint sanity check
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (252 preceding siblings ...)
  2020-01-28 14:06 ` [PATCH 4.9 253/271] Input: gtco - fix endpoint sanity check Greg Kroah-Hartman
@ 2020-01-28 14:06 ` Greg Kroah-Hartman
  2020-01-28 14:06 ` [PATCH 4.9 255/271] Input: pegasus_notetaker " Greg Kroah-Hartman
                   ` (21 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Johan Hovold, Vladis Dronov, Dmitry Torokhov

From: Johan Hovold <johan@kernel.org>

commit 3111491fca4f01764e0c158c5e0f7ced808eef51 upstream.

The driver was checking the number of endpoints of the first alternate
setting instead of the current one, something which could lead to the
driver binding to an invalid interface.

This in turn could cause the driver to misbehave or trigger a WARN() in
usb_submit_urb() that kernels with panic_on_warn set would choke on.

Fixes: 8e20cf2bce12 ("Input: aiptek - fix crash on detecting device without endpoints")
Signed-off-by: Johan Hovold <johan@kernel.org>
Acked-by: Vladis Dronov <vdronov@redhat.com>
Link: https://lore.kernel.org/r/20191210113737.4016-3-johan@kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/input/tablet/aiptek.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- a/drivers/input/tablet/aiptek.c
+++ b/drivers/input/tablet/aiptek.c
@@ -1822,14 +1822,14 @@ aiptek_probe(struct usb_interface *intf,
 	input_set_abs_params(inputdev, ABS_WHEEL, AIPTEK_WHEEL_MIN, AIPTEK_WHEEL_MAX - 1, 0, 0);
 
 	/* Verify that a device really has an endpoint */
-	if (intf->altsetting[0].desc.bNumEndpoints < 1) {
+	if (intf->cur_altsetting->desc.bNumEndpoints < 1) {
 		dev_err(&intf->dev,
 			"interface has %d endpoints, but must have minimum 1\n",
-			intf->altsetting[0].desc.bNumEndpoints);
+			intf->cur_altsetting->desc.bNumEndpoints);
 		err = -EINVAL;
 		goto fail3;
 	}
-	endpoint = &intf->altsetting[0].endpoint[0].desc;
+	endpoint = &intf->cur_altsetting->endpoint[0].desc;
 
 	/* Go set up our URB, which is called when the tablet receives
 	 * input.



^ permalink raw reply	[flat|nested] 283+ messages in thread

* [PATCH 4.9 255/271] Input: pegasus_notetaker - fix endpoint sanity check
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (253 preceding siblings ...)
  2020-01-28 14:06 ` [PATCH 4.9 254/271] Input: aiptek " Greg Kroah-Hartman
@ 2020-01-28 14:06 ` Greg Kroah-Hartman
  2020-01-28 14:06 ` [PATCH 4.9 256/271] Input: sun4i-ts - add a check for devm_thermal_zone_of_sensor_register Greg Kroah-Hartman
                   ` (20 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Johan Hovold, Martin Kepplinger,
	Vladis Dronov, Dmitry Torokhov

From: Johan Hovold <johan@kernel.org>

commit bcfcb7f9b480dd0be8f0df2df17340ca92a03b98 upstream.

The driver was checking the number of endpoints of the first alternate
setting instead of the current one, something which could be used by a
malicious device (or USB descriptor fuzzer) to trigger a NULL-pointer
dereference.

Fixes: 1afca2b66aac ("Input: add Pegasus Notetaker tablet driver")
Signed-off-by: Johan Hovold <johan@kernel.org>
Acked-by: Martin Kepplinger <martink@posteo.de>
Acked-by: Vladis Dronov <vdronov@redhat.com>
Link: https://lore.kernel.org/r/20191210113737.4016-2-johan@kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/input/tablet/pegasus_notetaker.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/input/tablet/pegasus_notetaker.c
+++ b/drivers/input/tablet/pegasus_notetaker.c
@@ -260,7 +260,7 @@ static int pegasus_probe(struct usb_inte
 		return -ENODEV;
 
 	/* Sanity check that the device has an endpoint */
-	if (intf->altsetting[0].desc.bNumEndpoints < 1) {
+	if (intf->cur_altsetting->desc.bNumEndpoints < 1) {
 		dev_err(&intf->dev, "Invalid number of endpoints\n");
 		return -EINVAL;
 	}



^ permalink raw reply	[flat|nested] 283+ messages in thread

* [PATCH 4.9 256/271] Input: sun4i-ts - add a check for devm_thermal_zone_of_sensor_register
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (254 preceding siblings ...)
  2020-01-28 14:06 ` [PATCH 4.9 255/271] Input: pegasus_notetaker " Greg Kroah-Hartman
@ 2020-01-28 14:06 ` Greg Kroah-Hartman
  2020-01-28 14:06 ` [PATCH 4.9 257/271] hwmon: (nct7802) Fix voltage limits to wrong registers Greg Kroah-Hartman
                   ` (19 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:06 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Chuhong Yuan, Dmitry Torokhov

From: Chuhong Yuan <hslester96@gmail.com>

commit 97e24b095348a15ec08c476423c3b3b939186ad7 upstream.

The driver misses a check for devm_thermal_zone_of_sensor_register().
Add a check to fix it.

Fixes: e28d0c9cd381 ("input: convert sun4i-ts to use devm_thermal_zone_of_sensor_register")
Signed-off-by: Chuhong Yuan <hslester96@gmail.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/input/touchscreen/sun4i-ts.c |    6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

--- a/drivers/input/touchscreen/sun4i-ts.c
+++ b/drivers/input/touchscreen/sun4i-ts.c
@@ -246,6 +246,7 @@ static int sun4i_ts_probe(struct platfor
 	struct device *dev = &pdev->dev;
 	struct device_node *np = dev->of_node;
 	struct device *hwmon;
+	struct thermal_zone_device *thermal;
 	int error;
 	u32 reg;
 	bool ts_attached;
@@ -365,7 +366,10 @@ static int sun4i_ts_probe(struct platfor
 	if (IS_ERR(hwmon))
 		return PTR_ERR(hwmon);
 
-	devm_thermal_zone_of_sensor_register(ts->dev, 0, ts, &sun4i_ts_tz_ops);
+	thermal = devm_thermal_zone_of_sensor_register(ts->dev, 0, ts,
+						       &sun4i_ts_tz_ops);
+	if (IS_ERR(thermal))
+		return PTR_ERR(thermal);
 
 	writel(TEMP_IRQ_EN(1), ts->base + TP_INT_FIFOC);
 



^ permalink raw reply	[flat|nested] 283+ messages in thread

* [PATCH 4.9 257/271] hwmon: (nct7802) Fix voltage limits to wrong registers
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (255 preceding siblings ...)
  2020-01-28 14:06 ` [PATCH 4.9 256/271] Input: sun4i-ts - add a check for devm_thermal_zone_of_sensor_register Greg Kroah-Hartman
@ 2020-01-28 14:06 ` Greg Kroah-Hartman
  2020-01-28 14:06 ` [PATCH 4.9 258/271] scsi: RDMA/isert: Fix a recently introduced regression related to logout Greg Kroah-Hartman
                   ` (18 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:06 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Gilles Buloz, Guenter Roeck

From: Gilles Buloz <gilles.buloz@kontron.com>

commit 7713e62c8623c54dac88d1fa724aa487a38c3efb upstream.

in0 thresholds are written to the in2 thresholds registers
in2 thresholds to in3 thresholds
in3 thresholds to in4 thresholds
in4 thresholds to in0 thresholds

Signed-off-by: Gilles Buloz <gilles.buloz@kontron.com>
Link: https://lore.kernel.org/r/5de0f509.rc0oEvPOMjbfPW1w%gilles.buloz@kontron.com
Fixes: 3434f3783580 ("hwmon: Driver for Nuvoton NCT7802Y")
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/hwmon/nct7802.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/hwmon/nct7802.c
+++ b/drivers/hwmon/nct7802.c
@@ -32,8 +32,8 @@
 static const u8 REG_VOLTAGE[5] = { 0x09, 0x0a, 0x0c, 0x0d, 0x0e };
 
 static const u8 REG_VOLTAGE_LIMIT_LSB[2][5] = {
-	{ 0x40, 0x00, 0x42, 0x44, 0x46 },
-	{ 0x3f, 0x00, 0x41, 0x43, 0x45 },
+	{ 0x46, 0x00, 0x40, 0x42, 0x44 },
+	{ 0x45, 0x00, 0x3f, 0x41, 0x43 },
 };
 
 static const u8 REG_VOLTAGE_LIMIT_MSB[5] = { 0x48, 0x00, 0x47, 0x47, 0x48 };



^ permalink raw reply	[flat|nested] 283+ messages in thread

* [PATCH 4.9 258/271] scsi: RDMA/isert: Fix a recently introduced regression related to logout
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (256 preceding siblings ...)
  2020-01-28 14:06 ` [PATCH 4.9 257/271] hwmon: (nct7802) Fix voltage limits to wrong registers Greg Kroah-Hartman
@ 2020-01-28 14:06 ` Greg Kroah-Hartman
  2020-01-28 14:06 ` [PATCH 4.9 259/271] tracing: xen: Ordered comparison of function pointers Greg Kroah-Hartman
                   ` (17 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Rahul Kundu, Bart Van Assche,
	Mike Marciniszyn, Sagi Grimberg, Martin K. Petersen

From: Bart Van Assche <bvanassche@acm.org>

commit 04060db41178c7c244f2c7dcd913e7fd331de915 upstream.

iscsit_close_connection() calls isert_wait_conn(). Due to commit
e9d3009cb936 both functions call target_wait_for_sess_cmds() although that
last function should be called only once. Fix this by removing the
target_wait_for_sess_cmds() call from isert_wait_conn() and by only calling
isert_wait_conn() after target_wait_for_sess_cmds().

Fixes: e9d3009cb936 ("scsi: target: iscsi: Wait for all commands to finish before freeing a session").
Link: https://lore.kernel.org/r/20200116044737.19507-1-bvanassche@acm.org
Reported-by: Rahul Kundu <rahul.kundu@chelsio.com>
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Tested-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
Acked-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/infiniband/ulp/isert/ib_isert.c |   12 ------------
 drivers/target/iscsi/iscsi_target.c     |    6 +++---
 2 files changed, 3 insertions(+), 15 deletions(-)

--- a/drivers/infiniband/ulp/isert/ib_isert.c
+++ b/drivers/infiniband/ulp/isert/ib_isert.c
@@ -2555,17 +2555,6 @@ isert_wait4logout(struct isert_conn *ise
 	}
 }
 
-static void
-isert_wait4cmds(struct iscsi_conn *conn)
-{
-	isert_info("iscsi_conn %p\n", conn);
-
-	if (conn->sess) {
-		target_sess_cmd_list_set_waiting(conn->sess->se_sess);
-		target_wait_for_sess_cmds(conn->sess->se_sess);
-	}
-}
-
 /**
  * isert_put_unsol_pending_cmds() - Drop commands waiting for
  *     unsolicitate dataout
@@ -2613,7 +2602,6 @@ static void isert_wait_conn(struct iscsi
 
 	ib_drain_qp(isert_conn->qp);
 	isert_put_unsol_pending_cmds(conn);
-	isert_wait4cmds(conn);
 	isert_wait4logout(isert_conn);
 
 	queue_work(isert_release_wq, &isert_conn->release_work);
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -4162,9 +4162,6 @@ int iscsit_close_connection(
 	iscsit_stop_nopin_response_timer(conn);
 	iscsit_stop_nopin_timer(conn);
 
-	if (conn->conn_transport->iscsit_wait_conn)
-		conn->conn_transport->iscsit_wait_conn(conn);
-
 	/*
 	 * During Connection recovery drop unacknowledged out of order
 	 * commands for this connection, and prepare the other commands
@@ -4250,6 +4247,9 @@ int iscsit_close_connection(
 	target_sess_cmd_list_set_waiting(sess->se_sess);
 	target_wait_for_sess_cmds(sess->se_sess);
 
+	if (conn->conn_transport->iscsit_wait_conn)
+		conn->conn_transport->iscsit_wait_conn(conn);
+
 	ahash_request_free(conn->conn_tx_hash);
 	if (conn->conn_rx_hash) {
 		struct crypto_ahash *tfm;



^ permalink raw reply	[flat|nested] 283+ messages in thread

* [PATCH 4.9 259/271] tracing: xen: Ordered comparison of function pointers
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (257 preceding siblings ...)
  2020-01-28 14:06 ` [PATCH 4.9 258/271] scsi: RDMA/isert: Fix a recently introduced regression related to logout Greg Kroah-Hartman
@ 2020-01-28 14:06 ` Greg Kroah-Hartman
  2020-01-28 14:06 ` [PATCH 4.9 260/271] do_last(): fetch directory ->i_mode and ->i_uid before its too late Greg Kroah-Hartman
                   ` (16 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Changbin Du, Steven Rostedt (VMware)

From: Changbin Du <changbin.du@gmail.com>

commit d0695e2351102affd8efae83989056bc4b275917 upstream.

Just as commit 0566e40ce7 ("tracing: initcall: Ordered comparison of
function pointers"), this patch fixes another remaining one in xen.h
found by clang-9.

In file included from arch/x86/xen/trace.c:21:
In file included from ./include/trace/events/xen.h:475:
In file included from ./include/trace/define_trace.h:102:
In file included from ./include/trace/trace_events.h:473:
./include/trace/events/xen.h:69:7: warning: ordered comparison of function \
pointers ('xen_mc_callback_fn_t' (aka 'void (*)(void *)') and 'xen_mc_callback_fn_t') [-Wordered-compare-function-pointers]
                    __field(xen_mc_callback_fn_t, fn)
                    ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
./include/trace/trace_events.h:421:29: note: expanded from macro '__field'
                                ^
./include/trace/trace_events.h:407:6: note: expanded from macro '__field_ext'
                                 is_signed_type(type), filter_type);    \
                                 ^
./include/linux/trace_events.h:554:44: note: expanded from macro 'is_signed_type'
                                              ^

Fixes: c796f213a6934 ("xen/trace: add multicall tracing")
Signed-off-by: Changbin Du <changbin.du@gmail.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 include/trace/events/xen.h |    6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

--- a/include/trace/events/xen.h
+++ b/include/trace/events/xen.h
@@ -63,7 +63,11 @@ TRACE_EVENT(xen_mc_callback,
 	    TP_PROTO(xen_mc_callback_fn_t fn, void *data),
 	    TP_ARGS(fn, data),
 	    TP_STRUCT__entry(
-		    __field(xen_mc_callback_fn_t, fn)
+		    /*
+		     * Use field_struct to avoid is_signed_type()
+		     * comparison of a function pointer.
+		     */
+		    __field_struct(xen_mc_callback_fn_t, fn)
 		    __field(void *, data)
 		    ),
 	    TP_fast_assign(



^ permalink raw reply	[flat|nested] 283+ messages in thread

* [PATCH 4.9 260/271] do_last(): fetch directory ->i_mode and ->i_uid before its too late
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (258 preceding siblings ...)
  2020-01-28 14:06 ` [PATCH 4.9 259/271] tracing: xen: Ordered comparison of function pointers Greg Kroah-Hartman
@ 2020-01-28 14:06 ` Greg Kroah-Hartman
  2020-01-28 14:06 ` [PATCH 4.9 261/271] Documentation: Document arm64 kpti control Greg Kroah-Hartman
                   ` (15 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:06 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Al Viro

From: Al Viro <viro@zeniv.linux.org.uk>

commit d0cb50185ae942b03c4327be322055d622dc79f6 upstream.

may_create_in_sticky() call is done when we already have dropped the
reference to dir.

Fixes: 30aba6656f61e (namei: allow restricted O_CREAT of FIFOs and regular files)
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/namei.c |   17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

--- a/fs/namei.c
+++ b/fs/namei.c
@@ -1011,7 +1011,8 @@ static int may_linkat(struct path *link)
  * may_create_in_sticky - Check whether an O_CREAT open in a sticky directory
  *			  should be allowed, or not, on files that already
  *			  exist.
- * @dir: the sticky parent directory
+ * @dir_mode: mode bits of directory
+ * @dir_uid: owner of directory
  * @inode: the inode of the file to open
  *
  * Block an O_CREAT open of a FIFO (or a regular file) when:
@@ -1027,18 +1028,18 @@ static int may_linkat(struct path *link)
  *
  * Returns 0 if the open is allowed, -ve on error.
  */
-static int may_create_in_sticky(struct dentry * const dir,
+static int may_create_in_sticky(umode_t dir_mode, kuid_t dir_uid,
 				struct inode * const inode)
 {
 	if ((!sysctl_protected_fifos && S_ISFIFO(inode->i_mode)) ||
 	    (!sysctl_protected_regular && S_ISREG(inode->i_mode)) ||
-	    likely(!(dir->d_inode->i_mode & S_ISVTX)) ||
-	    uid_eq(inode->i_uid, dir->d_inode->i_uid) ||
+	    likely(!(dir_mode & S_ISVTX)) ||
+	    uid_eq(inode->i_uid, dir_uid) ||
 	    uid_eq(current_fsuid(), inode->i_uid))
 		return 0;
 
-	if (likely(dir->d_inode->i_mode & 0002) ||
-	    (dir->d_inode->i_mode & 0020 &&
+	if (likely(dir_mode & 0002) ||
+	    (dir_mode & 0020 &&
 	     ((sysctl_protected_fifos >= 2 && S_ISFIFO(inode->i_mode)) ||
 	      (sysctl_protected_regular >= 2 && S_ISREG(inode->i_mode))))) {
 		return -EACCES;
@@ -3259,6 +3260,8 @@ static int do_last(struct nameidata *nd,
 		   int *opened)
 {
 	struct dentry *dir = nd->path.dentry;
+	kuid_t dir_uid = dir->d_inode->i_uid;
+	umode_t dir_mode = dir->d_inode->i_mode;
 	int open_flag = op->open_flag;
 	bool will_truncate = (open_flag & O_TRUNC) != 0;
 	bool got_write = false;
@@ -3401,7 +3404,7 @@ finish_open:
 		error = -EISDIR;
 		if (d_is_dir(nd->path.dentry))
 			goto out;
-		error = may_create_in_sticky(dir,
+		error = may_create_in_sticky(dir_mode, dir_uid,
 					     d_backing_inode(nd->path.dentry));
 		if (unlikely(error))
 			goto out;



^ permalink raw reply	[flat|nested] 283+ messages in thread

* [PATCH 4.9 261/271] Documentation: Document arm64 kpti control
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (259 preceding siblings ...)
  2020-01-28 14:06 ` [PATCH 4.9 260/271] do_last(): fetch directory ->i_mode and ->i_uid before its too late Greg Kroah-Hartman
@ 2020-01-28 14:06 ` Greg Kroah-Hartman
  2020-01-28 14:06 ` [PATCH 4.9 262/271] arm64: kpti: Whitelist Cortex-A CPUs that dont implement the CSV3 field Greg Kroah-Hartman
                   ` (14 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jeremy Linton, Andre Przywara,
	Jonathan Corbet, Florian Fainelli

From: Jeremy Linton <jeremy.linton@arm.com>

commit de19055564c8f8f9d366f8db3395836da0b2176c upstream.

For a while Arm64 has been capable of force enabling
or disabling the kpti mitigations. Lets make sure the
documentation reflects that.

Signed-off-by: Jeremy Linton <jeremy.linton@arm.com>
Reviewed-by: Andre Przywara <andre.przywara@arm.com>
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
[florian: patch the correct file]
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 Documentation/kernel-parameters.txt |    6 ++++++
 1 file changed, 6 insertions(+)

--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -1965,6 +1965,12 @@ bytes respectively. Such letter suffixes
 			kmemcheck=2 (one-shot mode)
 			Default: 2 (one-shot mode)
 
+	kpti=		[ARM64] Control page table isolation of user
+			and kernel address spaces.
+			Default: enabled on cores which need mitigation.
+			0: force disabled
+			1: force enabled
+
 	kstack=N	[X86] Print N words from the kernel stack
 			in oops dumps.
 



^ permalink raw reply	[flat|nested] 283+ messages in thread

* [PATCH 4.9 262/271] arm64: kpti: Whitelist Cortex-A CPUs that dont implement the CSV3 field
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (260 preceding siblings ...)
  2020-01-28 14:06 ` [PATCH 4.9 261/271] Documentation: Document arm64 kpti control Greg Kroah-Hartman
@ 2020-01-28 14:06 ` Greg Kroah-Hartman
  2020-01-28 14:06 ` [PATCH 4.9 263/271] coresight: etb10: Do not call smp_processor_id from preemptible Greg Kroah-Hartman
                   ` (13 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:06 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Will Deacon, Florian Fainelli

From: Will Deacon <will.deacon@arm.com>

commit 2a355ec25729053bb9a1a89b6c1d1cdd6c3b3fb1 upstream.

While the CSV3 field of the ID_AA64_PFR0 CPU ID register can be checked
to see if a CPU is susceptible to Meltdown and therefore requires kpti
to be enabled, existing CPUs do not implement this field.

We therefore whitelist all unaffected Cortex-A CPUs that do not implement
the CSV3 field.

Signed-off-by: Will Deacon <will.deacon@arm.com>
[florian: adjust whilelist location and table to stable-4.9.y]
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/arm64/kernel/cpufeature.c |    5 +++++
 1 file changed, 5 insertions(+)

--- a/arch/arm64/kernel/cpufeature.c
+++ b/arch/arm64/kernel/cpufeature.c
@@ -789,6 +789,11 @@ static bool unmap_kernel_at_el0(const st
 	switch (read_cpuid_id() & MIDR_CPU_MODEL_MASK) {
 	case MIDR_CAVIUM_THUNDERX2:
 	case MIDR_BRCM_VULCAN:
+	case MIDR_CORTEX_A53:
+	case MIDR_CORTEX_A55:
+	case MIDR_CORTEX_A57:
+	case MIDR_CORTEX_A72:
+	case MIDR_CORTEX_A73:
 		return false;
 	}
 



^ permalink raw reply	[flat|nested] 283+ messages in thread

* [PATCH 4.9 263/271] coresight: etb10: Do not call smp_processor_id from preemptible
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (261 preceding siblings ...)
  2020-01-28 14:06 ` [PATCH 4.9 262/271] arm64: kpti: Whitelist Cortex-A CPUs that dont implement the CSV3 field Greg Kroah-Hartman
@ 2020-01-28 14:06 ` Greg Kroah-Hartman
  2020-01-28 14:06 ` [PATCH 4.9 264/271] coresight: tmc-etf: " Greg Kroah-Hartman
                   ` (12 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Mathieu Poirier, Suzuki K Poulose

From: Suzuki K Poulose <suzuki.poulose@arm.com>

commit 730766bae3280a25d40ea76a53dc6342e84e6513 upstream.

During a perf session we try to allocate buffers on the "node" associated
with the CPU the event is bound to. If it is not bound to a CPU, we
use the current CPU node, using smp_processor_id(). However this is unsafe
in a pre-emptible context and could generate the splats as below :

 BUG: using smp_processor_id() in preemptible [00000000] code: perf/2544

Use NUMA_NO_NODE hint instead of using the current node for events
not bound to CPUs.

Fixes: 2997aa4063d97fdb39 ("coresight: etb10: implementing AUX API")
Cc: Mathieu Poirier <mathieu.poirier@linaro.org>
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Cc: stable <stable@vger.kernel.org> # 4.6+
Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
Link: https://lore.kernel.org/r/20190620221237.3536-5-mathieu.poirier@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>


---
 drivers/hwtracing/coresight/coresight-etb10.c |    4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

--- a/drivers/hwtracing/coresight/coresight-etb10.c
+++ b/drivers/hwtracing/coresight/coresight-etb10.c
@@ -279,9 +279,7 @@ static void *etb_alloc_buffer(struct cor
 	int node;
 	struct cs_buffers *buf;
 
-	if (cpu == -1)
-		cpu = smp_processor_id();
-	node = cpu_to_node(cpu);
+	node = (cpu == -1) ? NUMA_NO_NODE : cpu_to_node(cpu);
 
 	buf = kzalloc_node(sizeof(struct cs_buffers), GFP_KERNEL, node);
 	if (!buf)



^ permalink raw reply	[flat|nested] 283+ messages in thread

* [PATCH 4.9 264/271] coresight: tmc-etf: Do not call smp_processor_id from preemptible
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (262 preceding siblings ...)
  2020-01-28 14:06 ` [PATCH 4.9 263/271] coresight: etb10: Do not call smp_processor_id from preemptible Greg Kroah-Hartman
@ 2020-01-28 14:06 ` Greg Kroah-Hartman
  2020-01-28 14:06 ` [PATCH 4.9 265/271] libertas: Fix two buffer overflows at parsing bss descriptor Greg Kroah-Hartman
                   ` (11 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Mathieu Poirier, Suzuki K Poulose

From: Suzuki K Poulose <suzuki.poulose@arm.com>

commit 024c1fd9dbcc1d8a847f1311f999d35783921b7f upstream.

During a perf session we try to allocate buffers on the "node" associated
with the CPU the event is bound to. If it is not bound to a CPU, we
use the current CPU node, using smp_processor_id(). However this is unsafe
in a pre-emptible context and could generate the splats as below :

 BUG: using smp_processor_id() in preemptible [00000000] code: perf/2544
 caller is tmc_alloc_etf_buffer+0x5c/0x60
 CPU: 2 PID: 2544 Comm: perf Not tainted 5.1.0-rc6-147786-g116841e #344
 Hardware name: ARM LTD ARM Juno Development Platform/ARM Juno Development Platform, BIOS EDK II Feb  1 2019
 Call trace:
  dump_backtrace+0x0/0x150
  show_stack+0x14/0x20
  dump_stack+0x9c/0xc4
  debug_smp_processor_id+0x10c/0x110
  tmc_alloc_etf_buffer+0x5c/0x60
  etm_setup_aux+0x1c4/0x230
  rb_alloc_aux+0x1b8/0x2b8
  perf_mmap+0x35c/0x478
  mmap_region+0x34c/0x4f0
  do_mmap+0x2d8/0x418
  vm_mmap_pgoff+0xd0/0xf8
  ksys_mmap_pgoff+0x88/0xf8
  __arm64_sys_mmap+0x28/0x38
  el0_svc_handler+0xd8/0x138
  el0_svc+0x8/0xc

Use NUMA_NO_NODE hint instead of using the current node for events
not bound to CPUs.

Fixes: 2e499bbc1a929ac ("coresight: tmc: implementing TMC-ETF AUX space API")
Cc: Mathieu Poirier <mathieu.poirier@linaro.org>
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Cc: stable <stable@vger.kernel.org> # 4.7+
Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
Link: https://lore.kernel.org/r/20190620221237.3536-4-mathieu.poirier@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/hwtracing/coresight/coresight-tmc-etf.c |    4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

--- a/drivers/hwtracing/coresight/coresight-tmc-etf.c
+++ b/drivers/hwtracing/coresight/coresight-tmc-etf.c
@@ -292,9 +292,7 @@ static void *tmc_alloc_etf_buffer(struct
 	int node;
 	struct cs_buffers *buf;
 
-	if (cpu == -1)
-		cpu = smp_processor_id();
-	node = cpu_to_node(cpu);
+	node = (cpu == -1) ? NUMA_NO_NODE : cpu_to_node(cpu);
 
 	/* Allocate memory structure for interaction with Perf */
 	buf = kzalloc_node(sizeof(struct cs_buffers), GFP_KERNEL, node);



^ permalink raw reply	[flat|nested] 283+ messages in thread

* [PATCH 4.9 265/271] libertas: Fix two buffer overflows at parsing bss descriptor
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (263 preceding siblings ...)
  2020-01-28 14:06 ` [PATCH 4.9 264/271] coresight: tmc-etf: " Greg Kroah-Hartman
@ 2020-01-28 14:06 ` Greg Kroah-Hartman
  2020-01-28 14:06 ` [PATCH 4.9 266/271] bcache: silence static checker warning Greg Kroah-Hartman
                   ` (10 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, kbuild test robot, Wen Huang, Kalle Valo

From: Wen Huang <huangwenabc@gmail.com>

commit e5e884b42639c74b5b57dc277909915c0aefc8bb upstream.

add_ie_rates() copys rates without checking the length
in bss descriptor from remote AP.when victim connects to
remote attacker, this may trigger buffer overflow.
lbs_ibss_join_existing() copys rates without checking the length
in bss descriptor from remote IBSS node.when victim connects to
remote attacker, this may trigger buffer overflow.
Fix them by putting the length check before performing copy.

This fix addresses CVE-2019-14896 and CVE-2019-14897.
This also fix build warning of mixed declarations and code.

Reported-by: kbuild test robot <lkp@intel.com>
Signed-off-by: Wen Huang <huangwenabc@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/wireless/marvell/libertas/cfg.c |   16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

--- a/drivers/net/wireless/marvell/libertas/cfg.c
+++ b/drivers/net/wireless/marvell/libertas/cfg.c
@@ -272,6 +272,10 @@ add_ie_rates(u8 *tlv, const u8 *ie, int
 	int hw, ap, ap_max = ie[1];
 	u8 hw_rate;
 
+	if (ap_max > MAX_RATES) {
+		lbs_deb_assoc("invalid rates\n");
+		return tlv;
+	}
 	/* Advance past IE header */
 	ie += 2;
 
@@ -1789,6 +1793,9 @@ static int lbs_ibss_join_existing(struct
 	struct cmd_ds_802_11_ad_hoc_join cmd;
 	u8 preamble = RADIO_PREAMBLE_SHORT;
 	int ret = 0;
+	int hw, i;
+	u8 rates_max;
+	u8 *rates;
 
 	lbs_deb_enter(LBS_DEB_CFG80211);
 
@@ -1849,9 +1856,12 @@ static int lbs_ibss_join_existing(struct
 	if (!rates_eid) {
 		lbs_add_rates(cmd.bss.rates);
 	} else {
-		int hw, i;
-		u8 rates_max = rates_eid[1];
-		u8 *rates = cmd.bss.rates;
+		rates_max = rates_eid[1];
+		if (rates_max > MAX_RATES) {
+			lbs_deb_join("invalid rates");
+			goto out;
+		}
+		rates = cmd.bss.rates;
 		for (hw = 0; hw < ARRAY_SIZE(lbs_rates); hw++) {
 			u8 hw_rate = lbs_rates[hw].bitrate / 5;
 			for (i = 0; i < rates_max; i++) {



^ permalink raw reply	[flat|nested] 283+ messages in thread

* [PATCH 4.9 266/271] bcache: silence static checker warning
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (264 preceding siblings ...)
  2020-01-28 14:06 ` [PATCH 4.9 265/271] libertas: Fix two buffer overflows at parsing bss descriptor Greg Kroah-Hartman
@ 2020-01-28 14:06 ` Greg Kroah-Hartman
  2020-01-28 14:06 ` [PATCH 4.9 267/271] scsi: iscsi: Avoid potential deadlock in iscsi_if_rx func Greg Kroah-Hartman
                   ` (9 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Coly Li, Jens Axboe,
	Lee Jones

From: Dan Carpenter <dan.carpenter@oracle.com>

commit da22f0eea555baf9b0a84b52afe56db2052cfe8d upstream.

In olden times, closure_return() used to have a hidden return built in.
We removed the hidden return but forgot to add a new return here.  If
"c" were NULL we would oops on the next line, but fortunately "c" is
never NULL.  Let's just remove the if statement.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Coly Li <colyli@suse.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/md/bcache/super.c |    3 ---
 1 file changed, 3 deletions(-)

--- a/drivers/md/bcache/super.c
+++ b/drivers/md/bcache/super.c
@@ -1398,9 +1398,6 @@ static void cache_set_flush(struct closu
 	struct btree *b;
 	unsigned i;
 
-	if (!c)
-		closure_return(cl);
-
 	bch_cache_accounting_destroy(&c->accounting);
 
 	kobject_put(&c->internal);



^ permalink raw reply	[flat|nested] 283+ messages in thread

* [PATCH 4.9 267/271] scsi: iscsi: Avoid potential deadlock in iscsi_if_rx func
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (265 preceding siblings ...)
  2020-01-28 14:06 ` [PATCH 4.9 266/271] bcache: silence static checker warning Greg Kroah-Hartman
@ 2020-01-28 14:06 ` Greg Kroah-Hartman
  2020-01-28 14:06 ` [PATCH 4.9 268/271] md: Avoid namespace collision with bitmap API Greg Kroah-Hartman
                   ` (8 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Bo Wu, Zhiqiang Liu, Lee Duncan,
	Martin K. Petersen

From: Bo Wu <wubo40@huawei.com>

commit bba340c79bfe3644829db5c852fdfa9e33837d6d upstream.

In iscsi_if_rx func, after receiving one request through
iscsi_if_recv_msg func, iscsi_if_send_reply will be called to try to
reply to the request in a do-while loop.  If the iscsi_if_send_reply
function keeps returning -EAGAIN, a deadlock will occur.

For example, a client only send msg without calling recvmsg func, then
it will result in the watchdog soft lockup.  The details are given as
follows:

	sock_fd = socket(AF_NETLINK, SOCK_RAW, NETLINK_ISCSI);
	retval = bind(sock_fd, (struct sock addr*) & src_addr, sizeof(src_addr);
	while (1) {
		state_msg = sendmsg(sock_fd, &msg, 0);
		//Note: recvmsg(sock_fd, &msg, 0) is not processed here.
	}
	close(sock_fd);

watchdog: BUG: soft lockup - CPU#7 stuck for 22s! [netlink_test:253305] Sample time: 4000897528 ns(HZ: 250) Sample stat:
curr: user: 675503481560, nice: 321724050, sys: 448689506750, idle: 4654054240530, iowait: 40885550700, irq: 14161174020, softirq: 8104324140, st: 0
deta: user: 0, nice: 0, sys: 3998210100, idle: 0, iowait: 0, irq: 1547170, softirq: 242870, st: 0 Sample softirq:
         TIMER:        992
         SCHED:          8
Sample irqstat:
         irq    2: delta       1003, curr:    3103802, arch_timer
CPU: 7 PID: 253305 Comm: netlink_test Kdump: loaded Tainted: G           OE
Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015
pstate: 40400005 (nZcv daif +PAN -UAO)
pc : __alloc_skb+0x104/0x1b0
lr : __alloc_skb+0x9c/0x1b0
sp : ffff000033603a30
x29: ffff000033603a30 x28: 00000000000002dd
x27: ffff800b34ced810 x26: ffff800ba7569f00
x25: 00000000ffffffff x24: 0000000000000000
x23: ffff800f7c43f600 x22: 0000000000480020
x21: ffff0000091d9000 x20: ffff800b34eff200
x19: ffff800ba7569f00 x18: 0000000000000000
x17: 0000000000000000 x16: 0000000000000000
x15: 0000000000000000 x14: 0001000101000100
x13: 0000000101010000 x12: 0101000001010100
x11: 0001010101010001 x10: 00000000000002dd
x9 : ffff000033603d58 x8 : ffff800b34eff400
x7 : ffff800ba7569200 x6 : ffff800b34eff400
x5 : 0000000000000000 x4 : 00000000ffffffff
x3 : 0000000000000000 x2 : 0000000000000001
x1 : ffff800b34eff2c0 x0 : 0000000000000300 Call trace:
__alloc_skb+0x104/0x1b0
iscsi_if_rx+0x144/0x12bc [scsi_transport_iscsi]
netlink_unicast+0x1e0/0x258
netlink_sendmsg+0x310/0x378
sock_sendmsg+0x4c/0x70
sock_write_iter+0x90/0xf0
__vfs_write+0x11c/0x190
vfs_write+0xac/0x1c0
ksys_write+0x6c/0xd8
__arm64_sys_write+0x24/0x30
el0_svc_common+0x78/0x130
el0_svc_handler+0x38/0x78
el0_svc+0x8/0xc

Link: https://lore.kernel.org/r/EDBAAA0BBBA2AC4E9C8B6B81DEEE1D6915E3D4D2@dggeml505-mbx.china.huawei.com
Signed-off-by: Bo Wu <wubo40@huawei.com>
Reviewed-by: Zhiqiang Liu <liuzhiqiang26@huawei.com>
Reviewed-by: Lee Duncan <lduncan@suse.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/scsi/scsi_transport_iscsi.c |    7 +++++++
 1 file changed, 7 insertions(+)

--- a/drivers/scsi/scsi_transport_iscsi.c
+++ b/drivers/scsi/scsi_transport_iscsi.c
@@ -37,6 +37,8 @@
 
 #define ISCSI_TRANSPORT_VERSION "2.0-870"
 
+#define ISCSI_SEND_MAX_ALLOWED  10
+
 static int dbg_session;
 module_param_named(debug_session, dbg_session, int,
 		   S_IRUGO | S_IWUSR);
@@ -3694,6 +3696,7 @@ iscsi_if_rx(struct sk_buff *skb)
 		struct nlmsghdr	*nlh;
 		struct iscsi_uevent *ev;
 		uint32_t group;
+		int retries = ISCSI_SEND_MAX_ALLOWED;
 
 		nlh = nlmsg_hdr(skb);
 		if (nlh->nlmsg_len < sizeof(*nlh) + sizeof(*ev) ||
@@ -3724,6 +3727,10 @@ iscsi_if_rx(struct sk_buff *skb)
 				break;
 			err = iscsi_if_send_reply(group, nlh->nlmsg_seq,
 				nlh->nlmsg_type, 0, 0, ev, sizeof(*ev));
+			if (err == -EAGAIN && --retries < 0) {
+				printk(KERN_WARNING "Send reply failed, error %d\n", err);
+				break;
+			}
 		} while (err < 0 && err != -ECONNREFUSED && err != -ESRCH);
 		skb_pull(skb, rlen);
 	}



^ permalink raw reply	[flat|nested] 283+ messages in thread

* [PATCH 4.9 268/271] md: Avoid namespace collision with bitmap API
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (266 preceding siblings ...)
  2020-01-28 14:06 ` [PATCH 4.9 267/271] scsi: iscsi: Avoid potential deadlock in iscsi_if_rx func Greg Kroah-Hartman
@ 2020-01-28 14:06 ` Greg Kroah-Hartman
  2020-01-28 14:06 ` [PATCH 4.9 269/271] bitmap: Add bitmap_alloc(), bitmap_zalloc() and bitmap_free() Greg Kroah-Hartman
                   ` (7 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Andy Shevchenko, Shaohua Li, Dmitry Torokhov

From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>

commit e64e4018d572710c44f42c923d4ac059f0a23320 upstream.

bitmap API (include/linux/bitmap.h) has 'bitmap' prefix for its methods.

On the other hand MD bitmap API is special case.
Adding 'md' prefix to it to avoid name space collision.

No functional changes intended.

Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Acked-by: Shaohua Li <shli@kernel.org>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
[only take the bitmap_free change for stable - gregkh]
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/md/bitmap.c |    8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

--- a/drivers/md/bitmap.c
+++ b/drivers/md/bitmap.c
@@ -1699,7 +1699,7 @@ void bitmap_flush(struct mddev *mddev)
 /*
  * free memory that was allocated
  */
-static void bitmap_free(struct bitmap *bitmap)
+static void md_bitmap_free(struct bitmap *bitmap)
 {
 	unsigned long k, pages;
 	struct bitmap_page *bp;
@@ -1749,7 +1749,7 @@ void bitmap_destroy(struct mddev *mddev)
 	if (mddev->thread)
 		mddev->thread->timeout = MAX_SCHEDULE_TIMEOUT;
 
-	bitmap_free(bitmap);
+	md_bitmap_free(bitmap);
 }
 
 /*
@@ -1834,7 +1834,7 @@ struct bitmap *bitmap_create(struct mdde
 
 	return bitmap;
  error:
-	bitmap_free(bitmap);
+	md_bitmap_free(bitmap);
 	return ERR_PTR(err);
 }
 
@@ -1936,7 +1936,7 @@ int bitmap_copy_from_slot(struct mddev *
 	*low = lo;
 	*high = hi;
 err:
-	bitmap_free(bitmap);
+	md_bitmap_free(bitmap);
 	return rv;
 }
 EXPORT_SYMBOL_GPL(bitmap_copy_from_slot);



^ permalink raw reply	[flat|nested] 283+ messages in thread

* [PATCH 4.9 269/271] bitmap: Add bitmap_alloc(), bitmap_zalloc() and bitmap_free()
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (267 preceding siblings ...)
  2020-01-28 14:06 ` [PATCH 4.9 268/271] md: Avoid namespace collision with bitmap API Greg Kroah-Hartman
@ 2020-01-28 14:06 ` Greg Kroah-Hartman
  2020-01-28 14:06 ` [PATCH 4.9 270/271] netfilter: ipset: use bitmap infrastructure completely Greg Kroah-Hartman
                   ` (6 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:06 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Andy Shevchenko, Dmitry Torokhov

From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>

commit c42b65e363ce97a828f81b59033c3558f8fa7f70 upstream.

A lot of code become ugly because of open coding allocations for bitmaps.

Introduce three helpers to allow users be more clear of intention
and keep their code neat.

Note, due to multiple circular dependencies we may not provide
the helpers as inliners. For now we keep them exported and, perhaps,
at some point in the future we will sort out header inclusion and
inheritance.

Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 include/linux/bitmap.h |    8 ++++++++
 lib/bitmap.c           |   20 ++++++++++++++++++++
 2 files changed, 28 insertions(+)

--- a/include/linux/bitmap.h
+++ b/include/linux/bitmap.h
@@ -86,6 +86,14 @@
  */
 
 /*
+ * Allocation and deallocation of bitmap.
+ * Provided in lib/bitmap.c to avoid circular dependency.
+ */
+extern unsigned long *bitmap_alloc(unsigned int nbits, gfp_t flags);
+extern unsigned long *bitmap_zalloc(unsigned int nbits, gfp_t flags);
+extern void bitmap_free(const unsigned long *bitmap);
+
+/*
  * lib/bitmap.c provides these functions:
  */
 
--- a/lib/bitmap.c
+++ b/lib/bitmap.c
@@ -13,6 +13,7 @@
 #include <linux/bitops.h>
 #include <linux/bug.h>
 #include <linux/kernel.h>
+#include <linux/slab.h>
 #include <linux/string.h>
 #include <linux/uaccess.h>
 
@@ -1212,3 +1213,22 @@ void bitmap_copy_le(unsigned long *dst,
 }
 EXPORT_SYMBOL(bitmap_copy_le);
 #endif
+
+unsigned long *bitmap_alloc(unsigned int nbits, gfp_t flags)
+{
+	return kmalloc_array(BITS_TO_LONGS(nbits), sizeof(unsigned long),
+			     flags);
+}
+EXPORT_SYMBOL(bitmap_alloc);
+
+unsigned long *bitmap_zalloc(unsigned int nbits, gfp_t flags)
+{
+	return bitmap_alloc(nbits, flags | __GFP_ZERO);
+}
+EXPORT_SYMBOL(bitmap_zalloc);
+
+void bitmap_free(const unsigned long *bitmap)
+{
+	kfree(bitmap);
+}
+EXPORT_SYMBOL(bitmap_free);



^ permalink raw reply	[flat|nested] 283+ messages in thread

* [PATCH 4.9 270/271] netfilter: ipset: use bitmap infrastructure completely
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (268 preceding siblings ...)
  2020-01-28 14:06 ` [PATCH 4.9 269/271] bitmap: Add bitmap_alloc(), bitmap_zalloc() and bitmap_free() Greg Kroah-Hartman
@ 2020-01-28 14:06 ` Greg Kroah-Hartman
  2020-01-28 14:07 ` [PATCH 4.9 271/271] net/x25: fix nonblocking connect Greg Kroah-Hartman
                   ` (5 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:06 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, syzbot+fabca5cbf5e54f3fe2de,
	syzbot+827ced406c9a1d9570ed, syzbot+190d63957b22ef673ea5,
	syzbot+dfccdb2bdb4a12ad425e, syzbot+df0d0f5895ef1f41a65b,
	syzbot+b08bd19bb37513357fd4, syzbot+53cdd0ec0bbabd53370a,
	Jozsef Kadlecsik, Pablo Neira Ayuso

From: Kadlecsik József <kadlec@blackhole.kfki.hu>

commit 32c72165dbd0e246e69d16a3ad348a4851afd415 upstream.

The bitmap allocation did not use full unsigned long sizes
when calculating the required size and that was triggered by KASAN
as slab-out-of-bounds read in several places. The patch fixes all
of them.

Reported-by: syzbot+fabca5cbf5e54f3fe2de@syzkaller.appspotmail.com
Reported-by: syzbot+827ced406c9a1d9570ed@syzkaller.appspotmail.com
Reported-by: syzbot+190d63957b22ef673ea5@syzkaller.appspotmail.com
Reported-by: syzbot+dfccdb2bdb4a12ad425e@syzkaller.appspotmail.com
Reported-by: syzbot+df0d0f5895ef1f41a65b@syzkaller.appspotmail.com
Reported-by: syzbot+b08bd19bb37513357fd4@syzkaller.appspotmail.com
Reported-by: syzbot+53cdd0ec0bbabd53370a@syzkaller.appspotmail.com
Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 include/linux/netfilter/ipset/ip_set.h    |    7 -------
 net/netfilter/ipset/ip_set_bitmap_gen.h   |    2 +-
 net/netfilter/ipset/ip_set_bitmap_ip.c    |    6 +++---
 net/netfilter/ipset/ip_set_bitmap_ipmac.c |    6 +++---
 net/netfilter/ipset/ip_set_bitmap_port.c  |    6 +++---
 5 files changed, 10 insertions(+), 17 deletions(-)

--- a/include/linux/netfilter/ipset/ip_set.h
+++ b/include/linux/netfilter/ipset/ip_set.h
@@ -537,13 +537,6 @@ ip6addrptr(const struct sk_buff *skb, bo
 	       sizeof(*addr));
 }
 
-/* Calculate the bytes required to store the inclusive range of a-b */
-static inline int
-bitmap_bytes(u32 a, u32 b)
-{
-	return 4 * ((((b - a + 8) / 8) + 3) / 4);
-}
-
 #include <linux/netfilter/ipset/ip_set_timeout.h>
 #include <linux/netfilter/ipset/ip_set_comment.h>
 
--- a/net/netfilter/ipset/ip_set_bitmap_gen.h
+++ b/net/netfilter/ipset/ip_set_bitmap_gen.h
@@ -81,7 +81,7 @@ mtype_flush(struct ip_set *set)
 
 	if (set->extensions & IPSET_EXT_DESTROY)
 		mtype_ext_cleanup(set);
-	memset(map->members, 0, map->memsize);
+	bitmap_zero(map->members, map->elements);
 }
 
 static int
--- a/net/netfilter/ipset/ip_set_bitmap_ip.c
+++ b/net/netfilter/ipset/ip_set_bitmap_ip.c
@@ -40,7 +40,7 @@ MODULE_ALIAS("ip_set_bitmap:ip");
 
 /* Type structure */
 struct bitmap_ip {
-	void *members;		/* the set members */
+	unsigned long *members;	/* the set members */
 	u32 first_ip;		/* host byte order, included in range */
 	u32 last_ip;		/* host byte order, included in range */
 	u32 elements;		/* number of max elements in the set */
@@ -222,7 +222,7 @@ init_map_ip(struct ip_set *set, struct b
 	    u32 first_ip, u32 last_ip,
 	    u32 elements, u32 hosts, u8 netmask)
 {
-	map->members = ip_set_alloc(map->memsize);
+	map->members = bitmap_zalloc(elements, GFP_KERNEL | __GFP_NOWARN);
 	if (!map->members)
 		return false;
 	map->first_ip = first_ip;
@@ -315,7 +315,7 @@ bitmap_ip_create(struct net *net, struct
 	if (!map)
 		return -ENOMEM;
 
-	map->memsize = bitmap_bytes(0, elements - 1);
+	map->memsize = BITS_TO_LONGS(elements) * sizeof(unsigned long);
 	set->variant = &bitmap_ip;
 	if (!init_map_ip(set, map, first_ip, last_ip,
 			 elements, hosts, netmask)) {
--- a/net/netfilter/ipset/ip_set_bitmap_ipmac.c
+++ b/net/netfilter/ipset/ip_set_bitmap_ipmac.c
@@ -46,7 +46,7 @@ enum {
 
 /* Type structure */
 struct bitmap_ipmac {
-	void *members;		/* the set members */
+	unsigned long *members;	/* the set members */
 	u32 first_ip;		/* host byte order, included in range */
 	u32 last_ip;		/* host byte order, included in range */
 	u32 elements;		/* number of max elements in the set */
@@ -299,7 +299,7 @@ static bool
 init_map_ipmac(struct ip_set *set, struct bitmap_ipmac *map,
 	       u32 first_ip, u32 last_ip, u32 elements)
 {
-	map->members = ip_set_alloc(map->memsize);
+	map->members = bitmap_zalloc(elements, GFP_KERNEL | __GFP_NOWARN);
 	if (!map->members)
 		return false;
 	map->first_ip = first_ip;
@@ -363,7 +363,7 @@ bitmap_ipmac_create(struct net *net, str
 	if (!map)
 		return -ENOMEM;
 
-	map->memsize = bitmap_bytes(0, elements - 1);
+	map->memsize = BITS_TO_LONGS(elements) * sizeof(unsigned long);
 	set->variant = &bitmap_ipmac;
 	if (!init_map_ipmac(set, map, first_ip, last_ip, elements)) {
 		kfree(map);
--- a/net/netfilter/ipset/ip_set_bitmap_port.c
+++ b/net/netfilter/ipset/ip_set_bitmap_port.c
@@ -34,7 +34,7 @@ MODULE_ALIAS("ip_set_bitmap:port");
 
 /* Type structure */
 struct bitmap_port {
-	void *members;		/* the set members */
+	unsigned long *members;	/* the set members */
 	u16 first_port;		/* host byte order, included in range */
 	u16 last_port;		/* host byte order, included in range */
 	u32 elements;		/* number of max elements in the set */
@@ -207,7 +207,7 @@ static bool
 init_map_port(struct ip_set *set, struct bitmap_port *map,
 	      u16 first_port, u16 last_port)
 {
-	map->members = ip_set_alloc(map->memsize);
+	map->members = bitmap_zalloc(map->elements, GFP_KERNEL | __GFP_NOWARN);
 	if (!map->members)
 		return false;
 	map->first_port = first_port;
@@ -250,7 +250,7 @@ bitmap_port_create(struct net *net, stru
 		return -ENOMEM;
 
 	map->elements = elements;
-	map->memsize = bitmap_bytes(0, map->elements);
+	map->memsize = BITS_TO_LONGS(elements) * sizeof(unsigned long);
 	set->variant = &bitmap_port;
 	if (!init_map_port(set, map, first_port, last_port)) {
 		kfree(map);



^ permalink raw reply	[flat|nested] 283+ messages in thread

* [PATCH 4.9 271/271] net/x25: fix nonblocking connect
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (269 preceding siblings ...)
  2020-01-28 14:06 ` [PATCH 4.9 270/271] netfilter: ipset: use bitmap infrastructure completely Greg Kroah-Hartman
@ 2020-01-28 14:07 ` Greg Kroah-Hartman
  2020-01-28 17:53 ` [PATCH 4.9 000/271] 4.9.212-stable review Guenter Roeck
                   ` (4 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-28 14:07 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Martin Schiller,
	syzbot+429c200ffc8772bfe070, syzbot+eec0c87f31a7c3b66f7b,
	David S. Miller

From: Martin Schiller <ms@dev.tdt.de>

commit e21dba7a4df4d93da237da65a096084b4f2e87b4 upstream.

This patch fixes 2 issues in x25_connect():

1. It makes absolutely no sense to reset the neighbour and the
connection state after a (successful) nonblocking call of x25_connect.
This prevents any connection from being established, since the response
(call accept) cannot be processed.

2. Any further calls to x25_connect() while a call is pending should
simply return, instead of creating new Call Request (on different
logical channels).

This patch should also fix the "KASAN: null-ptr-deref Write in
x25_connect" and "BUG: unable to handle kernel NULL pointer dereference
in x25_connect" bugs reported by syzbot.

Signed-off-by: Martin Schiller <ms@dev.tdt.de>
Reported-by: syzbot+429c200ffc8772bfe070@syzkaller.appspotmail.com
Reported-by: syzbot+eec0c87f31a7c3b66f7b@syzkaller.appspotmail.com
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/x25/af_x25.c |    6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

--- a/net/x25/af_x25.c
+++ b/net/x25/af_x25.c
@@ -764,6 +764,10 @@ static int x25_connect(struct socket *so
 	if (sk->sk_state == TCP_ESTABLISHED)
 		goto out;
 
+	rc = -EALREADY;	/* Do nothing if call is already in progress */
+	if (sk->sk_state == TCP_SYN_SENT)
+		goto out;
+
 	sk->sk_state   = TCP_CLOSE;
 	sock->state = SS_UNCONNECTED;
 
@@ -810,7 +814,7 @@ static int x25_connect(struct socket *so
 	/* Now the loop */
 	rc = -EINPROGRESS;
 	if (sk->sk_state != TCP_ESTABLISHED && (flags & O_NONBLOCK))
-		goto out_put_neigh;
+		goto out;
 
 	rc = x25_wait_for_connection_establishment(sk);
 	if (rc)



^ permalink raw reply	[flat|nested] 283+ messages in thread

* Re: [PATCH 4.9 000/271] 4.9.212-stable review
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (270 preceding siblings ...)
  2020-01-28 14:07 ` [PATCH 4.9 271/271] net/x25: fix nonblocking connect Greg Kroah-Hartman
@ 2020-01-28 17:53 ` Guenter Roeck
  2020-01-28 20:42 ` Guenter Roeck
                   ` (3 subsequent siblings)
  275 siblings, 0 replies; 283+ messages in thread
From: Guenter Roeck @ 2020-01-28 17:53 UTC (permalink / raw)
  To: Greg Kroah-Hartman
  Cc: linux-kernel, torvalds, akpm, shuah, patches, ben.hutchings,
	lkft-triage, stable

On Tue, Jan 28, 2020 at 03:02:29PM +0100, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 4.9.212 release.
> There are 271 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.
> 
> Responses should be made by Thu, 30 Jan 2020 13:57:09 +0000.
> Anything received after that time might be too late.
> 

v4.9.211-272-g8329c702312a:

arch/powerpc/kernel/cacheinfo.c: In function ‘cacheinfo_teardown’:
arch/powerpc/kernel/cacheinfo.c:875:2: error: implicit declaration of function ‘lockdep_assert_cpus_held’

Guenter

^ permalink raw reply	[flat|nested] 283+ messages in thread

* Re: [PATCH 4.9 000/271] 4.9.212-stable review
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (271 preceding siblings ...)
  2020-01-28 17:53 ` [PATCH 4.9 000/271] 4.9.212-stable review Guenter Roeck
@ 2020-01-28 20:42 ` Guenter Roeck
  2020-01-29  7:31   ` Greg Kroah-Hartman
  2020-01-28 23:11 ` shuah
                   ` (2 subsequent siblings)
  275 siblings, 1 reply; 283+ messages in thread
From: Guenter Roeck @ 2020-01-28 20:42 UTC (permalink / raw)
  To: Greg Kroah-Hartman
  Cc: linux-kernel, torvalds, akpm, shuah, patches, ben.hutchings,
	lkft-triage, stable

On Tue, Jan 28, 2020 at 03:02:29PM +0100, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 4.9.212 release.
> There are 271 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.
> 
> Responses should be made by Thu, 30 Jan 2020 13:57:09 +0000.
> Anything received after that time might be too late.
> 

For v4.9.211-272-g91ff8226a074:

Build results:
	total: 172 pass: 172 fail: 0
Qemu test results:
	total: 357 pass: 357 fail: 0

Guenter

^ permalink raw reply	[flat|nested] 283+ messages in thread

* Re: [PATCH 4.9 000/271] 4.9.212-stable review
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (272 preceding siblings ...)
  2020-01-28 20:42 ` Guenter Roeck
@ 2020-01-28 23:11 ` shuah
  2020-01-29  4:50 ` Naresh Kamboju
  2020-01-29 13:13 ` Jon Hunter
  275 siblings, 0 replies; 283+ messages in thread
From: shuah @ 2020-01-28 23:11 UTC (permalink / raw)
  To: Greg Kroah-Hartman, linux-kernel
  Cc: torvalds, akpm, linux, patches, ben.hutchings, lkft-triage,
	stable, shuah

On 1/28/20 7:02 AM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 4.9.212 release.
> There are 271 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.
> 
> Responses should be made by Thu, 30 Jan 2020 13:57:09 +0000.
> Anything received after that time might be too late.
> 
> The whole patch series can be found in one patch at:
> 	https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.212-rc1.gz
> or in the git tree and branch at:
> 	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y
> and the diffstat can be found below.
> 
> thanks,
> 
> greg k-h
> 

Compiled and booted on my test system. No dmesg regressions.

thanks,
-- Shuah


^ permalink raw reply	[flat|nested] 283+ messages in thread

* Re: [PATCH 4.9 000/271] 4.9.212-stable review
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (273 preceding siblings ...)
  2020-01-28 23:11 ` shuah
@ 2020-01-29  4:50 ` Naresh Kamboju
  2020-01-29 13:13 ` Jon Hunter
  275 siblings, 0 replies; 283+ messages in thread
From: Naresh Kamboju @ 2020-01-29  4:50 UTC (permalink / raw)
  To: Greg Kroah-Hartman
  Cc: open list, Linus Torvalds, Andrew Morton, Guenter Roeck,
	Shuah Khan, patches, Ben Hutchings, lkft-triage, linux- stable,
	LTP List, Jan Stancek, rpalethorpe

On Tue, 28 Jan 2020 at 19:46, Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
>
> This is the start of the stable review cycle for the 4.9.212 release.
> There are 271 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Thu, 30 Jan 2020 13:57:09 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
>         https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.212-rc1.gz
> or in the git tree and branch at:
>         git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h

This is 4.9.212-rc2 test report.

Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.


NOTE:
LTP fs test read_all_proc fails intermittently on 4.9 and 4.14 branches.

Summary
------------------------------------------------------------------------

kernel: 4.9.212-rc2
git repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
git branch: linux-4.9.y
git commit: 91ff8226a074449fcd2b96214d1927fd3e8d8114
git describe: v4.9.211-272-g91ff8226a074
Test details: https://qa-reports.linaro.org/lkft/linux-stable-rc-4.9-oe/build/v4.9.211-272-g91ff8226a074

No regressions (compared to build v4.9.211)

No fixes (compared to build v4.9.211)

Ran 23560 total tests in the following environments and test suites.

Environments
--------------
- dragonboard-410c - arm64
- hi6220-hikey - arm64
- i386
- juno-r2 - arm64
- qemu_arm
- qemu_arm64
- qemu_i386
- qemu_x86_64
- x15 - arm
- x86_64

Test Suites
-----------
* build
* install-android-platform-tools-r2600
* kselftest
* libhugetlbfs
* linux-log-parser
* ltp-cap_bounds-tests
* ltp-commands-tests
* ltp-containers-tests
* ltp-cpuhotplug-tests
* ltp-cve-tests
* ltp-dio-tests
* ltp-fcntl-locktests-tests
* ltp-filecaps-tests
* ltp-fs-tests
* ltp-fs_bind-tests
* ltp-fs_perms_simple-tests
* ltp-fsx-tests
* ltp-hugetlb-tests
* ltp-io-tests
* ltp-ipc-tests
* ltp-math-tests
* ltp-mm-tests
* ltp-nptl-tests
* ltp-pty-tests
* ltp-sched-tests
* ltp-securebits-tests
* ltp-syscalls-tests
* perf
* spectre-meltdown-checker-test
* v4l2-compliance
* network-basic-tests
* ltp-open-posix-tests
* prep-tmp-disk
* kvm-unit-tests
* kselftest-vsyscall-mode-native
* kselftest-vsyscall-mode-none
* ssuite

-- 
Linaro LKFT
https://lkft.linaro.org

^ permalink raw reply	[flat|nested] 283+ messages in thread

* Re: [PATCH 4.9 000/271] 4.9.212-stable review
  2020-01-28 20:42 ` Guenter Roeck
@ 2020-01-29  7:31   ` Greg Kroah-Hartman
  0 siblings, 0 replies; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-29  7:31 UTC (permalink / raw)
  To: Guenter Roeck
  Cc: linux-kernel, torvalds, akpm, shuah, patches, ben.hutchings,
	lkft-triage, stable

On Tue, Jan 28, 2020 at 12:42:21PM -0800, Guenter Roeck wrote:
> On Tue, Jan 28, 2020 at 03:02:29PM +0100, Greg Kroah-Hartman wrote:
> > This is the start of the stable review cycle for the 4.9.212 release.
> > There are 271 patches in this series, all will be posted as a response
> > to this one.  If anyone has any issues with these being applied, please
> > let me know.
> > 
> > Responses should be made by Thu, 30 Jan 2020 13:57:09 +0000.
> > Anything received after that time might be too late.
> > 
> 
> For v4.9.211-272-g91ff8226a074:
> 
> Build results:
> 	total: 172 pass: 172 fail: 0
> Qemu test results:
> 	total: 357 pass: 357 fail: 0

Thanks for testing these two so quickly and letting me know they worked.

greg k-h

^ permalink raw reply	[flat|nested] 283+ messages in thread

* Re: [PATCH 4.9 183/271] signal: Allow cifs and drbd to receive their terminating signals
  2020-01-28 14:05 ` [PATCH 4.9 183/271] signal: Allow cifs and drbd to receive their terminating signals Greg Kroah-Hartman
@ 2020-01-29 11:10   ` Thomas Voegtle
  2020-01-29 11:36     ` Greg Kroah-Hartman
  0 siblings, 1 reply; 283+ messages in thread
From: Thomas Voegtle @ 2020-01-29 11:10 UTC (permalink / raw)
  To: Greg Kroah-Hartman
  Cc: linux-kernel, stable, ronnie sahlberg, Christoph Böhmwalder,
	Steve French, Philipp Reisner, David Laight, Eric W. Biederman,
	Sasha Levin

[-- Attachment #1: Type: text/plain, Size: 5317 bytes --]

On Tue, 28 Jan 2020, Greg Kroah-Hartman wrote:

> From: Eric W. Biederman <ebiederm@xmission.com>
>
> [ Upstream commit 33da8e7c814f77310250bb54a9db36a44c5de784 ]
>
> My recent to change to only use force_sig for a synchronous events
> wound up breaking signal reception cifs and drbd.  I had overlooked
> the fact that by default kthreads start out with all signals set to
> SIG_IGN.  So a change I thought was safe turned out to have made it
> impossible for those kernel thread to catch their signals.
>
> Reverting the work on force_sig is a bad idea because what the code
> was doing was very much a misuse of force_sig.  As the way force_sig
> ultimately allowed the signal to happen was to change the signal
> handler to SIG_DFL.  Which after the first signal will allow userspace
> to send signals to these kernel threads.  At least for
> wake_ack_receiver in drbd that does not appear actively wrong.
>
> So correct this problem by adding allow_kernel_signal that will allow
> signals whose siginfo reports they were sent by the kernel through,
> but will not allow userspace generated signals, and update cifs and
> drbd to call allow_kernel_signal in an appropriate place so that their
> thread can receive this signal.
>
> Fixing things this way ensures that userspace won't be able to send
> signals and cause problems, that it is clear which signals the
> threads are expecting to receive, and it guarantees that nothing
> else in the system will be affected.
>
> This change was partly inspired by similar cifs and drbd patches that
> added allow_signal.
>
> Reported-by: ronnie sahlberg <ronniesahlberg@gmail.com>
> Reported-by: Christoph Böhmwalder <christoph.boehmwalder@linbit.com>
> Tested-by: Christoph Böhmwalder <christoph.boehmwalder@linbit.com>
> Cc: Steve French <smfrench@gmail.com>
> Cc: Philipp Reisner <philipp.reisner@linbit.com>
> Cc: David Laight <David.Laight@ACULAB.COM>
> Fixes: 247bc9470b1e ("cifs: fix rmmod regression in cifs.ko caused by force_sig changes")
> Fixes: 72abe3bcf091 ("signal/cifs: Fix cifs_put_tcp_session to call send_sig instead of force_sig")

These two commits come with that release, but...

> Fixes: fee109901f39 ("signal/drbd: Use send_sig not force_sig")
> Fixes: 3cf5d076fb4d ("signal: Remove task parameter from force_sig")

...these two commits not and were never added to 4.9.y.

Are these both really not needed?


     Thomas



> Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
> Signed-off-by: Sasha Levin <sashal@kernel.org>
> ---
> drivers/block/drbd/drbd_main.c |  2 ++
> fs/cifs/connect.c              |  2 +-
> include/linux/signal.h         | 15 ++++++++++++++-
> kernel/signal.c                |  5 +++++
> 4 files changed, 22 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/block/drbd/drbd_main.c b/drivers/block/drbd/drbd_main.c
> index f5c24459fc5c1..daa9cef96ec66 100644
> --- a/drivers/block/drbd/drbd_main.c
> +++ b/drivers/block/drbd/drbd_main.c
> @@ -332,6 +332,8 @@ static int drbd_thread_setup(void *arg)
> 		 thi->name[0],
> 		 resource->name);
>
> +	allow_kernel_signal(DRBD_SIGKILL);
> +	allow_kernel_signal(SIGXCPU);
> restart:
> 	retval = thi->function(thi);
>
> diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
> index 7d46025d5e899..751bdde6515d5 100644
> --- a/fs/cifs/connect.c
> +++ b/fs/cifs/connect.c
> @@ -885,7 +885,7 @@ cifs_demultiplex_thread(void *p)
> 		mempool_resize(cifs_req_poolp, length + cifs_min_rcv);
>
> 	set_freezable();
> -	allow_signal(SIGKILL);
> +	allow_kernel_signal(SIGKILL);
> 	while (server->tcpStatus != CifsExiting) {
> 		if (try_to_freeze())
> 			continue;
> diff --git a/include/linux/signal.h b/include/linux/signal.h
> index 5308304993bea..ffa58ff53e225 100644
> --- a/include/linux/signal.h
> +++ b/include/linux/signal.h
> @@ -313,6 +313,9 @@ extern void signal_setup_done(int failed, struct ksignal *ksig, int stepping);
> extern void exit_signals(struct task_struct *tsk);
> extern void kernel_sigaction(int, __sighandler_t);
>
> +#define SIG_KTHREAD ((__force __sighandler_t)2)
> +#define SIG_KTHREAD_KERNEL ((__force __sighandler_t)3)
> +
> static inline void allow_signal(int sig)
> {
> 	/*
> @@ -320,7 +323,17 @@ static inline void allow_signal(int sig)
> 	 * know it'll be handled, so that they don't get converted to
> 	 * SIGKILL or just silently dropped.
> 	 */
> -	kernel_sigaction(sig, (__force __sighandler_t)2);
> +	kernel_sigaction(sig, SIG_KTHREAD);
> +}
> +
> +static inline void allow_kernel_signal(int sig)
> +{
> +	/*
> +	 * Kernel threads handle their own signals. Let the signal code
> +	 * know signals sent by the kernel will be handled, so that they
> +	 * don't get silently dropped.
> +	 */
> +	kernel_sigaction(sig, SIG_KTHREAD_KERNEL);
> }
>
> static inline void disallow_signal(int sig)
> diff --git a/kernel/signal.c b/kernel/signal.c
> index 30914b3c76b21..57fadbe69c2e6 100644
> --- a/kernel/signal.c
> +++ b/kernel/signal.c
> @@ -79,6 +79,11 @@ static int sig_task_ignored(struct task_struct *t, int sig, bool force)
> 	    handler == SIG_DFL && !(force && sig_kernel_only(sig)))
> 		return 1;
>
> +	/* Only allow kernel generated signals to this kthread */
> +	if (unlikely((t->flags & PF_KTHREAD) &&
> +		     (handler == SIG_KTHREAD_KERNEL) && !force))
> +		return true;
> +
> 	return sig_handler_ignored(handler, sig);
> }
>
>

^ permalink raw reply	[flat|nested] 283+ messages in thread

* Re: [PATCH 4.9 183/271] signal: Allow cifs and drbd to receive their terminating signals
  2020-01-29 11:10   ` Thomas Voegtle
@ 2020-01-29 11:36     ` Greg Kroah-Hartman
  2020-01-29 19:12       ` Sasha Levin
  0 siblings, 1 reply; 283+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-29 11:36 UTC (permalink / raw)
  To: Thomas Voegtle
  Cc: linux-kernel, stable, ronnie sahlberg, Christoph Böhmwalder,
	Steve French, Philipp Reisner, David Laight, Eric W. Biederman,
	Sasha Levin

On Wed, Jan 29, 2020 at 12:10:47PM +0100, Thomas Voegtle wrote:
> On Tue, 28 Jan 2020, Greg Kroah-Hartman wrote:
> 
> > From: Eric W. Biederman <ebiederm@xmission.com>
> > 
> > [ Upstream commit 33da8e7c814f77310250bb54a9db36a44c5de784 ]
> > 
> > My recent to change to only use force_sig for a synchronous events
> > wound up breaking signal reception cifs and drbd.  I had overlooked
> > the fact that by default kthreads start out with all signals set to
> > SIG_IGN.  So a change I thought was safe turned out to have made it
> > impossible for those kernel thread to catch their signals.
> > 
> > Reverting the work on force_sig is a bad idea because what the code
> > was doing was very much a misuse of force_sig.  As the way force_sig
> > ultimately allowed the signal to happen was to change the signal
> > handler to SIG_DFL.  Which after the first signal will allow userspace
> > to send signals to these kernel threads.  At least for
> > wake_ack_receiver in drbd that does not appear actively wrong.
> > 
> > So correct this problem by adding allow_kernel_signal that will allow
> > signals whose siginfo reports they were sent by the kernel through,
> > but will not allow userspace generated signals, and update cifs and
> > drbd to call allow_kernel_signal in an appropriate place so that their
> > thread can receive this signal.
> > 
> > Fixing things this way ensures that userspace won't be able to send
> > signals and cause problems, that it is clear which signals the
> > threads are expecting to receive, and it guarantees that nothing
> > else in the system will be affected.
> > 
> > This change was partly inspired by similar cifs and drbd patches that
> > added allow_signal.
> > 
> > Reported-by: ronnie sahlberg <ronniesahlberg@gmail.com>
> > Reported-by: Christoph Böhmwalder <christoph.boehmwalder@linbit.com>
> > Tested-by: Christoph Böhmwalder <christoph.boehmwalder@linbit.com>
> > Cc: Steve French <smfrench@gmail.com>
> > Cc: Philipp Reisner <philipp.reisner@linbit.com>
> > Cc: David Laight <David.Laight@ACULAB.COM>
> > Fixes: 247bc9470b1e ("cifs: fix rmmod regression in cifs.ko caused by force_sig changes")
> > Fixes: 72abe3bcf091 ("signal/cifs: Fix cifs_put_tcp_session to call send_sig instead of force_sig")
> 
> These two commits come with that release, but...
> 
> > Fixes: fee109901f39 ("signal/drbd: Use send_sig not force_sig")
> > Fixes: 3cf5d076fb4d ("signal: Remove task parameter from force_sig")
> 
> ...these two commits not and were never added to 4.9.y.
> 
> Are these both really not needed?

I don't think so, do you feel otherwise?

thanks,

greg k-h

^ permalink raw reply	[flat|nested] 283+ messages in thread

* Re: [PATCH 4.9 000/271] 4.9.212-stable review
  2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
                   ` (274 preceding siblings ...)
  2020-01-29  4:50 ` Naresh Kamboju
@ 2020-01-29 13:13 ` Jon Hunter
  275 siblings, 0 replies; 283+ messages in thread
From: Jon Hunter @ 2020-01-29 13:13 UTC (permalink / raw)
  To: Greg Kroah-Hartman, linux-kernel
  Cc: torvalds, akpm, linux, shuah, patches, ben.hutchings,
	lkft-triage, stable, linux-tegra


On 28/01/2020 14:02, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 4.9.212 release.
> There are 271 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.
> 
> Responses should be made by Thu, 30 Jan 2020 13:57:09 +0000.
> Anything received after that time might be too late.
> 
> The whole patch series can be found in one patch at:
> 	https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.212-rc1.gz
> or in the git tree and branch at:
> 	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y
> and the diffstat can be found below.
> 
> thanks,
> 
> greg k-h

All tests are passing for Tegra ...

Test results for stable-v4.9:
    8 builds:	8 pass, 0 fail
    16 boots:	16 pass, 0 fail
    24 tests:	24 pass, 0 fail

Linux version:	4.9.212-rc2-g91ff8226a074
Boards tested:	tegra124-jetson-tk1, tegra20-ventana,
                tegra210-p2371-2180, tegra30-cardhu-a04

Cheers
Jon

-- 
nvpublic

^ permalink raw reply	[flat|nested] 283+ messages in thread

* Re: [PATCH 4.9 183/271] signal: Allow cifs and drbd to receive their terminating signals
  2020-01-29 11:36     ` Greg Kroah-Hartman
@ 2020-01-29 19:12       ` Sasha Levin
  2020-01-29 21:18         ` Eric W. Biederman
  0 siblings, 1 reply; 283+ messages in thread
From: Sasha Levin @ 2020-01-29 19:12 UTC (permalink / raw)
  To: Greg Kroah-Hartman
  Cc: Thomas Voegtle, linux-kernel, stable, ronnie sahlberg,
	Christoph Böhmwalder, Steve French, Philipp Reisner,
	David Laight, Eric W. Biederman

On Wed, Jan 29, 2020 at 12:36:43PM +0100, Greg Kroah-Hartman wrote:
>On Wed, Jan 29, 2020 at 12:10:47PM +0100, Thomas Voegtle wrote:
>> On Tue, 28 Jan 2020, Greg Kroah-Hartman wrote:
>>
>> > From: Eric W. Biederman <ebiederm@xmission.com>
>> >
>> > [ Upstream commit 33da8e7c814f77310250bb54a9db36a44c5de784 ]
>> >
>> > My recent to change to only use force_sig for a synchronous events
>> > wound up breaking signal reception cifs and drbd.  I had overlooked
>> > the fact that by default kthreads start out with all signals set to
>> > SIG_IGN.  So a change I thought was safe turned out to have made it
>> > impossible for those kernel thread to catch their signals.
>> >
>> > Reverting the work on force_sig is a bad idea because what the code
>> > was doing was very much a misuse of force_sig.  As the way force_sig
>> > ultimately allowed the signal to happen was to change the signal
>> > handler to SIG_DFL.  Which after the first signal will allow userspace
>> > to send signals to these kernel threads.  At least for
>> > wake_ack_receiver in drbd that does not appear actively wrong.
>> >
>> > So correct this problem by adding allow_kernel_signal that will allow
>> > signals whose siginfo reports they were sent by the kernel through,
>> > but will not allow userspace generated signals, and update cifs and
>> > drbd to call allow_kernel_signal in an appropriate place so that their
>> > thread can receive this signal.
>> >
>> > Fixing things this way ensures that userspace won't be able to send
>> > signals and cause problems, that it is clear which signals the
>> > threads are expecting to receive, and it guarantees that nothing
>> > else in the system will be affected.
>> >
>> > This change was partly inspired by similar cifs and drbd patches that
>> > added allow_signal.
>> >
>> > Reported-by: ronnie sahlberg <ronniesahlberg@gmail.com>
>> > Reported-by: Christoph Böhmwalder <christoph.boehmwalder@linbit.com>
>> > Tested-by: Christoph Böhmwalder <christoph.boehmwalder@linbit.com>
>> > Cc: Steve French <smfrench@gmail.com>
>> > Cc: Philipp Reisner <philipp.reisner@linbit.com>
>> > Cc: David Laight <David.Laight@ACULAB.COM>
>> > Fixes: 247bc9470b1e ("cifs: fix rmmod regression in cifs.ko caused by force_sig changes")
>> > Fixes: 72abe3bcf091 ("signal/cifs: Fix cifs_put_tcp_session to call send_sig instead of force_sig")
>>
>> These two commits come with that release, but...
>>
>> > Fixes: fee109901f39 ("signal/drbd: Use send_sig not force_sig")
>> > Fixes: 3cf5d076fb4d ("signal: Remove task parameter from force_sig")
>>
>> ...these two commits not and were never added to 4.9.y.
>>
>> Are these both really not needed?
>
>I don't think so, do you feel otherwise?

Both of those commits read as a cleanup to me. I've actually slightly
modified to patch to not need those commits (they were less than trivial
to backport as is).

-- 
Thanks,
Sasha

^ permalink raw reply	[flat|nested] 283+ messages in thread

* Re: [PATCH 4.9 183/271] signal: Allow cifs and drbd to receive their terminating signals
  2020-01-29 19:12       ` Sasha Levin
@ 2020-01-29 21:18         ` Eric W. Biederman
  2020-01-29 22:35           ` Thomas Voegtle
  0 siblings, 1 reply; 283+ messages in thread
From: Eric W. Biederman @ 2020-01-29 21:18 UTC (permalink / raw)
  To: Sasha Levin
  Cc: Greg Kroah-Hartman, Thomas Voegtle, linux-kernel, stable,
	ronnie sahlberg, Christoph Böhmwalder, Steve French,
	Philipp Reisner, David Laight

Sasha Levin <sashal@kernel.org> writes:

> On Wed, Jan 29, 2020 at 12:36:43PM +0100, Greg Kroah-Hartman wrote:
>>On Wed, Jan 29, 2020 at 12:10:47PM +0100, Thomas Voegtle wrote:
>>> On Tue, 28 Jan 2020, Greg Kroah-Hartman wrote:
>>>
>>> > From: Eric W. Biederman <ebiederm@xmission.com>
>>> >
>>> > [ Upstream commit 33da8e7c814f77310250bb54a9db36a44c5de784 ]
>>> >
>>> > My recent to change to only use force_sig for a synchronous events
>>> > wound up breaking signal reception cifs and drbd.  I had overlooked
>>> > the fact that by default kthreads start out with all signals set to
>>> > SIG_IGN.  So a change I thought was safe turned out to have made it
>>> > impossible for those kernel thread to catch their signals.
>>> >
>>> > Reverting the work on force_sig is a bad idea because what the code
>>> > was doing was very much a misuse of force_sig.  As the way force_sig
>>> > ultimately allowed the signal to happen was to change the signal
>>> > handler to SIG_DFL.  Which after the first signal will allow userspace
>>> > to send signals to these kernel threads.  At least for
>>> > wake_ack_receiver in drbd that does not appear actively wrong.
>>> >
>>> > So correct this problem by adding allow_kernel_signal that will allow
>>> > signals whose siginfo reports they were sent by the kernel through,
>>> > but will not allow userspace generated signals, and update cifs and
>>> > drbd to call allow_kernel_signal in an appropriate place so that their
>>> > thread can receive this signal.
>>> >
>>> > Fixing things this way ensures that userspace won't be able to send
>>> > signals and cause problems, that it is clear which signals the
>>> > threads are expecting to receive, and it guarantees that nothing
>>> > else in the system will be affected.
>>> >
>>> > This change was partly inspired by similar cifs and drbd patches that
>>> > added allow_signal.
>>> >
>>> > Reported-by: ronnie sahlberg <ronniesahlberg@gmail.com>
>>> > Reported-by: Christoph Böhmwalder <christoph.boehmwalder@linbit.com>
>>> > Tested-by: Christoph Böhmwalder <christoph.boehmwalder@linbit.com>
>>> > Cc: Steve French <smfrench@gmail.com>
>>> > Cc: Philipp Reisner <philipp.reisner@linbit.com>
>>> > Cc: David Laight <David.Laight@ACULAB.COM>
>>> > Fixes: 247bc9470b1e ("cifs: fix rmmod regression in cifs.ko caused by force_sig changes")
>>> > Fixes: 72abe3bcf091 ("signal/cifs: Fix cifs_put_tcp_session to call send_sig instead of force_sig")
>>>
>>> These two commits come with that release, but...
>>>
>>> > Fixes: fee109901f39 ("signal/drbd: Use send_sig not force_sig")
>>> > Fixes: 3cf5d076fb4d ("signal: Remove task parameter from force_sig")
>>>
>>> ...these two commits not and were never added to 4.9.y.
>>>
>>> Are these both really not needed?
>>
>>I don't think so, do you feel otherwise?
>
> Both of those commits read as a cleanup to me. I've actually slightly
> modified to patch to not need those commits (they were less than trivial
> to backport as is).

All of these changes were cleanup.  Which is why I didn't tag any of
them for stable.

Not to say that there weren't real problems using force_sig instead
of send_sig.  force_sig does nothing to ensure the task it is sending
signals to won't, and hasn't gone away.  Which is why it is a bad
idea to use force_sig on anything but current.  As I recall drbd used
force_sig on a kernel_thread which didn't go away.

When fixing the force_sig vs send_sig confusion I didn't realize that
some places were using force_sig because they had not enabled receiving
the signals they depended on.  Which is where allow_kernel_signal comes
from.  But while using force_sig allow_kernel_signal is not necessary.

Eric


^ permalink raw reply	[flat|nested] 283+ messages in thread

* Re: [PATCH 4.9 183/271] signal: Allow cifs and drbd to receive their terminating signals
  2020-01-29 21:18         ` Eric W. Biederman
@ 2020-01-29 22:35           ` Thomas Voegtle
  0 siblings, 0 replies; 283+ messages in thread
From: Thomas Voegtle @ 2020-01-29 22:35 UTC (permalink / raw)
  To: Eric W. Biederman
  Cc: Sasha Levin, Greg Kroah-Hartman, Thomas Voegtle, linux-kernel,
	stable, ronnie sahlberg, Christoph Böhmwalder, Steve French,
	Philipp Reisner, David Laight

[-- Attachment #1: Type: text/plain, Size: 3817 bytes --]

On Wed, 29 Jan 2020, Eric W. Biederman wrote:

> Sasha Levin <sashal@kernel.org> writes:
>
>> On Wed, Jan 29, 2020 at 12:36:43PM +0100, Greg Kroah-Hartman wrote:
>>> On Wed, Jan 29, 2020 at 12:10:47PM +0100, Thomas Voegtle wrote:
>>>> On Tue, 28 Jan 2020, Greg Kroah-Hartman wrote:
>>>>
>>>>> From: Eric W. Biederman <ebiederm@xmission.com>
>>>>>
>>>>> [ Upstream commit 33da8e7c814f77310250bb54a9db36a44c5de784 ]
>>>>>
>>>>> My recent to change to only use force_sig for a synchronous events
>>>>> wound up breaking signal reception cifs and drbd.  I had overlooked
>>>>> the fact that by default kthreads start out with all signals set to
>>>>> SIG_IGN.  So a change I thought was safe turned out to have made it
>>>>> impossible for those kernel thread to catch their signals.
>>>>>
>>>>> Reverting the work on force_sig is a bad idea because what the code
>>>>> was doing was very much a misuse of force_sig.  As the way force_sig
>>>>> ultimately allowed the signal to happen was to change the signal
>>>>> handler to SIG_DFL.  Which after the first signal will allow userspace
>>>>> to send signals to these kernel threads.  At least for
>>>>> wake_ack_receiver in drbd that does not appear actively wrong.
>>>>>
>>>>> So correct this problem by adding allow_kernel_signal that will allow
>>>>> signals whose siginfo reports they were sent by the kernel through,
>>>>> but will not allow userspace generated signals, and update cifs and
>>>>> drbd to call allow_kernel_signal in an appropriate place so that their
>>>>> thread can receive this signal.
>>>>>
>>>>> Fixing things this way ensures that userspace won't be able to send
>>>>> signals and cause problems, that it is clear which signals the
>>>>> threads are expecting to receive, and it guarantees that nothing
>>>>> else in the system will be affected.
>>>>>
>>>>> This change was partly inspired by similar cifs and drbd patches that
>>>>> added allow_signal.
>>>>>
>>>>> Reported-by: ronnie sahlberg <ronniesahlberg@gmail.com>
>>>>> Reported-by: Christoph Böhmwalder <christoph.boehmwalder@linbit.com>
>>>>> Tested-by: Christoph Böhmwalder <christoph.boehmwalder@linbit.com>
>>>>> Cc: Steve French <smfrench@gmail.com>
>>>>> Cc: Philipp Reisner <philipp.reisner@linbit.com>
>>>>> Cc: David Laight <David.Laight@ACULAB.COM>
>>>>> Fixes: 247bc9470b1e ("cifs: fix rmmod regression in cifs.ko caused by force_sig changes")
>>>>> Fixes: 72abe3bcf091 ("signal/cifs: Fix cifs_put_tcp_session to call send_sig instead of force_sig")
>>>>
>>>> These two commits come with that release, but...
>>>>
>>>>> Fixes: fee109901f39 ("signal/drbd: Use send_sig not force_sig")
>>>>> Fixes: 3cf5d076fb4d ("signal: Remove task parameter from force_sig")
>>>>
>>>> ...these two commits not and were never added to 4.9.y.
>>>>
>>>> Are these both really not needed?
>>>
>>> I don't think so, do you feel otherwise?
>>
>> Both of those commits read as a cleanup to me. I've actually slightly
>> modified to patch to not need those commits (they were less than trivial
>> to backport as is).
>
> All of these changes were cleanup.  Which is why I didn't tag any of
> them for stable.
>
> Not to say that there weren't real problems using force_sig instead
> of send_sig.  force_sig does nothing to ensure the task it is sending
> signals to won't, and hasn't gone away.  Which is why it is a bad
> idea to use force_sig on anything but current.  As I recall drbd used
> force_sig on a kernel_thread which didn't go away.
>
> When fixing the force_sig vs send_sig confusion I didn't realize that
> some places were using force_sig because they had not enabled receiving
> the signals they depended on.  Which is where allow_kernel_signal comes
> from.  But while using force_sig allow_kernel_signal is not necessary.
>
> Eric


Thanks for clarification.


       Thomas

^ permalink raw reply	[flat|nested] 283+ messages in thread

end of thread, other threads:[~2020-01-29 22:35 UTC | newest]

Thread overview: 283+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-01-28 14:02 [PATCH 4.9 000/271] 4.9.212-stable review Greg Kroah-Hartman
2020-01-28 14:02 ` [PATCH 4.9 001/271] xfs: Sanity check flags of Q_XQUOTARM call Greg Kroah-Hartman
2020-01-28 14:02 ` [PATCH 4.9 002/271] powerpc/archrandom: fix arch_get_random_seed_int() Greg Kroah-Hartman
2020-01-28 14:02 ` [PATCH 4.9 003/271] mt7601u: fix bbp version check in mt7601u_wait_bbp_ready Greg Kroah-Hartman
2020-01-28 14:02 ` [PATCH 4.9 004/271] drm/sti: do not remove the drm_bridge that was never added Greg Kroah-Hartman
2020-01-28 14:02 ` [PATCH 4.9 005/271] drm/virtio: fix bounds check in virtio_gpu_cmd_get_capset() Greg Kroah-Hartman
2020-01-28 14:02 ` [PATCH 4.9 006/271] ALSA: hda: fix unused variable warning Greg Kroah-Hartman
2020-01-28 14:02 ` [PATCH 4.9 007/271] IB/rxe: replace kvfree with vfree Greg Kroah-Hartman
2020-01-28 14:02 ` [PATCH 4.9 008/271] ALSA: usb-audio: update quirk for B&W PX to remove microphone Greg Kroah-Hartman
2020-01-28 14:02 ` [PATCH 4.9 009/271] staging: comedi: ni_mio_common: protect register write overflow Greg Kroah-Hartman
2020-01-28 14:02 ` [PATCH 4.9 010/271] pwm: lpss: Release runtime-pm reference from the drivers remove callback Greg Kroah-Hartman
2020-01-28 14:02 ` [PATCH 4.9 011/271] mlxsw: reg: QEEC: Add minimum shaper fields Greg Kroah-Hartman
2020-01-28 14:02 ` [PATCH 4.9 012/271] pcrypt: use format specifier in kobject_add Greg Kroah-Hartman
2020-01-28 14:02 ` [PATCH 4.9 013/271] exportfs: fix passing zero to ERR_PTR() warning Greg Kroah-Hartman
2020-01-28 14:02 ` [PATCH 4.9 014/271] drm/dp_mst: Skip validating ports during destruction, just ref Greg Kroah-Hartman
2020-01-28 14:02 ` [PATCH 4.9 015/271] net: phy: Fix not to call phy_resume() if PHY is not attached Greg Kroah-Hartman
2020-01-28 14:02 ` [PATCH 4.9 016/271] pinctrl: sh-pfc: r8a7740: Add missing REF125CK pin to gether_gmii group Greg Kroah-Hartman
2020-01-28 14:02 ` [PATCH 4.9 017/271] pinctrl: sh-pfc: r8a7740: Add missing LCD0 marks to lcd0_data24_1 group Greg Kroah-Hartman
2020-01-28 14:02 ` [PATCH 4.9 018/271] pinctrl: sh-pfc: r8a7791: Remove bogus ctrl marks from qspi_data4_b group Greg Kroah-Hartman
2020-01-28 14:02 ` [PATCH 4.9 019/271] pinctrl: sh-pfc: r8a7791: Remove bogus marks from vin1_b_data18 group Greg Kroah-Hartman
2020-01-28 14:02 ` [PATCH 4.9 020/271] pinctrl: sh-pfc: sh73a0: Add missing TO pin to tpu4_to3 group Greg Kroah-Hartman
2020-01-28 14:02 ` [PATCH 4.9 021/271] pinctrl: sh-pfc: r8a7794: Remove bogus IPSR9 field Greg Kroah-Hartman
2020-01-28 14:02 ` [PATCH 4.9 022/271] pinctrl: sh-pfc: sh7734: Add missing IPSR11 field Greg Kroah-Hartman
2020-01-28 14:02 ` [PATCH 4.9 023/271] pinctrl: sh-pfc: sh7269: Add missing PCIOR0 field Greg Kroah-Hartman
2020-01-28 14:02 ` [PATCH 4.9 024/271] pinctrl: sh-pfc: sh7734: Remove bogus IPSR10 value Greg Kroah-Hartman
2020-01-28 14:02 ` [PATCH 4.9 025/271] Input: nomadik-ske-keypad - fix a loop timeout test Greg Kroah-Hartman
2020-01-28 14:02 ` [PATCH 4.9 026/271] clk: highbank: fix refcount leak in hb_clk_init() Greg Kroah-Hartman
2020-01-28 14:02 ` [PATCH 4.9 027/271] clk: qoriq: fix refcount leak in clockgen_init() Greg Kroah-Hartman
2020-01-28 14:02 ` [PATCH 4.9 028/271] clk: socfpga: fix refcount leak Greg Kroah-Hartman
2020-01-28 14:02 ` [PATCH 4.9 029/271] clk: samsung: exynos4: fix refcount leak in exynos4_get_xom() Greg Kroah-Hartman
2020-01-28 14:02 ` [PATCH 4.9 030/271] clk: imx6q: fix refcount leak in imx6q_clocks_init() Greg Kroah-Hartman
2020-01-28 14:03 ` [PATCH 4.9 031/271] clk: imx6sx: fix refcount leak in imx6sx_clocks_init() Greg Kroah-Hartman
2020-01-28 14:03 ` [PATCH 4.9 032/271] clk: imx7d: fix refcount leak in imx7d_clocks_init() Greg Kroah-Hartman
2020-01-28 14:03 ` [PATCH 4.9 033/271] clk: vf610: fix refcount leak in vf610_clocks_init() Greg Kroah-Hartman
2020-01-28 14:03 ` [PATCH 4.9 034/271] clk: armada-370: fix refcount leak in a370_clk_init() Greg Kroah-Hartman
2020-01-28 14:03 ` [PATCH 4.9 035/271] clk: kirkwood: fix refcount leak in kirkwood_clk_init() Greg Kroah-Hartman
2020-01-28 14:03 ` [PATCH 4.9 036/271] clk: armada-xp: fix refcount leak in axp_clk_init() Greg Kroah-Hartman
2020-01-28 14:03 ` [PATCH 4.9 037/271] clk: dove: fix refcount leak in dove_clk_init() Greg Kroah-Hartman
2020-01-28 14:03 ` [PATCH 4.9 038/271] IB/usnic: Fix out of bounds index check in query pkey Greg Kroah-Hartman
2020-01-28 14:03 ` [PATCH 4.9 039/271] RDMA/ocrdma: " Greg Kroah-Hartman
2020-01-28 14:03 ` [PATCH 4.9 040/271] RDMA/qedr: " Greg Kroah-Hartman
2020-01-28 14:03 ` [PATCH 4.9 041/271] arm64: dts: apq8016-sbc: Increase load on l11 for SDCARD Greg Kroah-Hartman
2020-01-28 14:03 ` [PATCH 4.9 042/271] drm/etnaviv: NULL vs IS_ERR() buf in etnaviv_core_dump() Greg Kroah-Hartman
2020-01-28 14:03 ` [PATCH 4.9 043/271] media: s5p-jpeg: Correct step and max values for V4L2_CID_JPEG_RESTART_INTERVAL Greg Kroah-Hartman
2020-01-28 14:03 ` [PATCH 4.9 044/271] crypto: tgr192 - fix unaligned memory access Greg Kroah-Hartman
2020-01-28 14:03 ` [PATCH 4.9 045/271] ASoC: imx-sgtl5000: put of nodes if finding codec fails Greg Kroah-Hartman
2020-01-28 14:03 ` [PATCH 4.9 046/271] IB/iser: Pass the correct number of entries for dma mapped SGL Greg Kroah-Hartman
2020-01-28 14:03 ` [PATCH 4.9 047/271] rtc: cmos: ignore bogus century byte Greg Kroah-Hartman
2020-01-28 14:03 ` [PATCH 4.9 048/271] clk: sunxi-ng: sun8i-a23: Enable PLL-MIPI LDOs when ungating it Greg Kroah-Hartman
2020-01-28 14:03 ` [PATCH 4.9 049/271] iwlwifi: mvm: fix A-MPDU reference assignment Greg Kroah-Hartman
2020-01-28 14:03 ` [PATCH 4.9 050/271] tty: ipwireless: Fix potential NULL pointer dereference Greg Kroah-Hartman
2020-01-28 14:03 ` [PATCH 4.9 051/271] crypto: crypto4xx - Fix wrong ppc4xx_trng_probe()/ppc4xx_trng_remove() arguments Greg Kroah-Hartman
2020-01-28 14:03 ` [PATCH 4.9 052/271] ARM: dts: lpc32xx: add required clocks property to keypad device node Greg Kroah-Hartman
2020-01-28 14:03 ` [PATCH 4.9 053/271] ARM: dts: lpc32xx: reparent keypad controller to SIC1 Greg Kroah-Hartman
2020-01-28 14:03 ` [PATCH 4.9 054/271] ARM: dts: lpc32xx: fix ARM PrimeCell LCD controller variant Greg Kroah-Hartman
2020-01-28 14:03 ` [PATCH 4.9 055/271] ARM: dts: lpc32xx: fix ARM PrimeCell LCD controller clocks property Greg Kroah-Hartman
2020-01-28 14:03 ` [PATCH 4.9 056/271] ARM: dts: lpc32xx: phy3250: fix SD card regulator voltage Greg Kroah-Hartman
2020-01-28 14:03 ` [PATCH 4.9 057/271] iwlwifi: mvm: fix RSS config command Greg Kroah-Hartman
2020-01-28 14:03 ` [PATCH 4.9 058/271] staging: most: cdev: add missing check for cdev_add failure Greg Kroah-Hartman
2020-01-28 14:03 ` [PATCH 4.9 059/271] rtc: ds1672: fix unintended sign extension Greg Kroah-Hartman
2020-01-28 14:03 ` [PATCH 4.9 060/271] thermal: mediatek: fix register index error Greg Kroah-Hartman
2020-01-28 14:03 ` [PATCH 4.9 061/271] net: phy: fixed_phy: Fix fixed_phy not checking GPIO Greg Kroah-Hartman
2020-01-28 14:03 ` [PATCH 4.9 062/271] rtc: 88pm860x: fix unintended sign extension Greg Kroah-Hartman
2020-01-28 14:03 ` [PATCH 4.9 063/271] rtc: 88pm80x: " Greg Kroah-Hartman
2020-01-28 14:03 ` [PATCH 4.9 064/271] rtc: pm8xxx: " Greg Kroah-Hartman
2020-01-28 14:03 ` [PATCH 4.9 065/271] fbdev: chipsfb: remove set but not used variable size Greg Kroah-Hartman
2020-01-28 14:03 ` [PATCH 4.9 066/271] iw_cxgb4: use tos when importing the endpoint Greg Kroah-Hartman
2020-01-28 14:03 ` [PATCH 4.9 067/271] iw_cxgb4: use tos when finding ipv6 routes Greg Kroah-Hartman
2020-01-28 14:03 ` [PATCH 4.9 068/271] pinctrl: sh-pfc: emev2: Add missing pinmux functions Greg Kroah-Hartman
2020-01-28 14:03 ` [PATCH 4.9 069/271] pinctrl: sh-pfc: r8a7791: Fix scifb2_data_c pin group Greg Kroah-Hartman
2020-01-28 14:03 ` [PATCH 4.9 070/271] pinctrl: sh-pfc: r8a7792: Fix vin1_data18_b " Greg Kroah-Hartman
2020-01-28 14:03 ` [PATCH 4.9 071/271] pinctrl: sh-pfc: sh73a0: Fix fsic_spdif pin groups Greg Kroah-Hartman
2020-01-28 14:03 ` [PATCH 4.9 072/271] usb: phy: twl6030-usb: fix possible use-after-free on remove Greg Kroah-Hartman
2020-01-28 14:03 ` [PATCH 4.9 073/271] block: dont use bio->bi_vcnt to figure out segment number Greg Kroah-Hartman
2020-01-28 14:03 ` [PATCH 4.9 074/271] keys: Timestamp new keys Greg Kroah-Hartman
2020-01-28 14:03 ` [PATCH 4.9 075/271] vfio_pci: Enable memory accesses before calling pci_map_rom Greg Kroah-Hartman
2020-01-28 14:03 ` [PATCH 4.9 076/271] dmaengine: mv_xor: Use correct device for DMA API Greg Kroah-Hartman
2020-01-28 14:03 ` [PATCH 4.9 077/271] cdc-wdm: pass return value of recover_from_urb_loss Greg Kroah-Hartman
2020-01-28 14:03 ` [PATCH 4.9 078/271] regulator: pv88060: Fix array out-of-bounds access Greg Kroah-Hartman
2020-01-28 14:03 ` [PATCH 4.9 079/271] regulator: pv88080: " Greg Kroah-Hartman
2020-01-28 14:03 ` [PATCH 4.9 080/271] regulator: pv88090: " Greg Kroah-Hartman
2020-01-28 14:03 ` [PATCH 4.9 081/271] net: dsa: qca8k: Enable delay for RGMII_ID mode Greg Kroah-Hartman
2020-01-28 14:03 ` [PATCH 4.9 082/271] drm/nouveau/bios/ramcfg: fix missing parentheses when calculating RON Greg Kroah-Hartman
2020-01-28 14:03 ` [PATCH 4.9 083/271] drm/nouveau/pmu: dont print reply values if exec is false Greg Kroah-Hartman
2020-01-28 14:03 ` [PATCH 4.9 084/271] ASoC: qcom: Fix of-node refcount unbalance in apq8016_sbc_parse_of() Greg Kroah-Hartman
2020-01-28 14:03 ` [PATCH 4.9 085/271] fs/nfs: Fix nfs_parse_devname to not modify its argument Greg Kroah-Hartman
2020-01-28 14:03 ` [PATCH 4.9 086/271] NFS: Fix a soft lockup in the delegation recovery code Greg Kroah-Hartman
2020-01-28 14:03 ` [PATCH 4.9 087/271] clocksource/drivers/sun5i: Fail gracefully when clock rate is unavailable Greg Kroah-Hartman
2020-01-28 14:03 ` [PATCH 4.9 088/271] clocksource/drivers/exynos_mct: Fix error path in timer resources initialization Greg Kroah-Hartman
2020-01-28 14:03 ` [PATCH 4.9 089/271] mmc: sdhci-brcmstb: handle mmc_of_parse() errors during probe Greg Kroah-Hartman
2020-01-28 14:03 ` [PATCH 4.9 090/271] ARM: 8847/1: pm: fix HYP/SVC mode mismatch when MCPM is used Greg Kroah-Hartman
2020-01-28 14:04 ` [PATCH 4.9 091/271] ARM: 8848/1: virt: Align GIC version check with arm64 counterpart Greg Kroah-Hartman
2020-01-28 14:04 ` [PATCH 4.9 092/271] regulator: wm831x-dcdc: Fix list of wm831x_dcdc_ilim from mA to uA Greg Kroah-Hartman
2020-01-28 14:04 ` [PATCH 4.9 093/271] nios2: ksyms: Add missing symbol exports Greg Kroah-Hartman
2020-01-28 14:04 ` [PATCH 4.9 094/271] scsi: megaraid_sas: reduce module load time Greg Kroah-Hartman
2020-01-28 14:04 ` [PATCH 4.9 095/271] drivers/rapidio/rio_cm.c: fix potential oops in riocm_ch_listen() Greg Kroah-Hartman
2020-01-28 14:04 ` [PATCH 4.9 096/271] xen, cpu_hotplug: Prevent an out of bounds access Greg Kroah-Hartman
2020-01-28 14:04 ` [PATCH 4.9 097/271] net: sh_eth: fix a missing check of of_get_phy_mode Greg Kroah-Hartman
2020-01-28 14:04 ` [PATCH 4.9 098/271] media: ivtv: update *pos correctly in ivtv_read_pos() Greg Kroah-Hartman
2020-01-28 14:04 ` [PATCH 4.9 099/271] media: cx18: update *pos correctly in cx18_read_pos() Greg Kroah-Hartman
2020-01-28 14:04 ` [PATCH 4.9 100/271] media: wl128x: Fix an error code in fm_download_firmware() Greg Kroah-Hartman
2020-01-28 14:04 ` [PATCH 4.9 101/271] media: cx23885: check allocation return Greg Kroah-Hartman
2020-01-28 14:04 ` [PATCH 4.9 102/271] regulator: tps65086: Fix tps65086_ldoa1_ranges for selector 0xB Greg Kroah-Hartman
2020-01-28 14:04 ` [PATCH 4.9 103/271] jfs: fix bogus variable self-initialization Greg Kroah-Hartman
2020-01-28 14:04 ` [PATCH 4.9 104/271] tipc: tipc clang warning Greg Kroah-Hartman
2020-01-28 14:04 ` [PATCH 4.9 105/271] m68k: mac: Fix VIA timer counter accesses Greg Kroah-Hartman
2020-01-28 14:04 ` [PATCH 4.9 106/271] ARM: OMAP2+: Fix potentially uninitialized return value for _setup_reset() Greg Kroah-Hartman
2020-01-28 14:04 ` [PATCH 4.9 107/271] media: davinci-isif: avoid uninitialized variable use Greg Kroah-Hartman
2020-01-28 14:04 ` [PATCH 4.9 108/271] media: tw5864: Fix possible NULL pointer dereference in tw5864_handle_frame Greg Kroah-Hartman
2020-01-28 14:04 ` [PATCH 4.9 109/271] spi: tegra114: clear packed bit for unpacked mode Greg Kroah-Hartman
2020-01-28 14:04 ` [PATCH 4.9 110/271] spi: tegra114: fix for unpacked mode transfers Greg Kroah-Hartman
2020-01-28 14:04 ` [PATCH 4.9 111/271] soc/fsl/qe: Fix an error code in qe_pin_request() Greg Kroah-Hartman
2020-01-28 14:04 ` [PATCH 4.9 112/271] spi: bcm2835aux: fix driver to not allow 65535 (=-1) cs-gpios Greg Kroah-Hartman
2020-01-28 14:04 ` [PATCH 4.9 113/271] ehea: Fix a copy-paste err in ehea_init_port_res Greg Kroah-Hartman
2020-01-28 14:04 ` [PATCH 4.9 114/271] scsi: qla2xxx: Unregister chrdev if module initialization fails Greg Kroah-Hartman
2020-01-28 14:04 ` [PATCH 4.9 115/271] ARM: pxa: ssp: Fix "WARNING: invalid free of devm_ allocated data" Greg Kroah-Hartman
2020-01-28 14:04 ` [PATCH 4.9 116/271] hwmon: (w83627hf) Use request_muxed_region for Super-IO accesses Greg Kroah-Hartman
2020-01-28 14:04 ` [PATCH 4.9 117/271] tipc: set sysctl_tipc_rmem and named_timeout right range Greg Kroah-Hartman
2020-01-28 14:04 ` [PATCH 4.9 118/271] powerpc: vdso: Make vdso32 installation conditional in vdso_install Greg Kroah-Hartman
2020-01-28 14:04 ` [PATCH 4.9 119/271] ARM: dts: ls1021: Fix SGMII PCS link remaining down after PHY disconnect Greg Kroah-Hartman
2020-01-28 14:04 ` [PATCH 4.9 120/271] media: ov2659: fix unbalanced mutex_lock/unlock Greg Kroah-Hartman
2020-01-28 14:04 ` [PATCH 4.9 121/271] 6lowpan: Off by one handling ->nexthdr Greg Kroah-Hartman
2020-01-28 14:04 ` [PATCH 4.9 122/271] dmaengine: axi-dmac: Dont check the number of frames for alignment Greg Kroah-Hartman
2020-01-28 14:04 ` [PATCH 4.9 123/271] ALSA: usb-audio: Handle the error from snd_usb_mixer_apply_create_quirk() Greg Kroah-Hartman
2020-01-28 14:04 ` [PATCH 4.9 124/271] packet: in recvmsg msg_name return at least sizeof sockaddr_ll Greg Kroah-Hartman
2020-01-28 14:04 ` [PATCH 4.9 125/271] ASoC: fix valid stream condition Greg Kroah-Hartman
2020-01-28 14:04 ` [PATCH 4.9 126/271] usb: gadget: fsl: fix link error against usb-gadget module Greg Kroah-Hartman
2020-01-28 14:04 ` [PATCH 4.9 127/271] IB/mlx5: Add missing XRC options to QP optional params mask Greg Kroah-Hartman
2020-01-28 14:04 ` [PATCH 4.9 128/271] iommu/vt-d: Make kernel parameter igfx_off work with vIOMMU Greg Kroah-Hartman
2020-01-28 14:04 ` [PATCH 4.9 129/271] net: ena: fix swapped parameters when calling ena_com_indirect_table_fill_entry Greg Kroah-Hartman
2020-01-28 14:04 ` [PATCH 4.9 130/271] net: ena: fix: Free napi resources when ena_up() fails Greg Kroah-Hartman
2020-01-28 14:04 ` [PATCH 4.9 131/271] net: ena: fix incorrect test of supported hash function Greg Kroah-Hartman
2020-01-28 14:04 ` [PATCH 4.9 132/271] net: ena: fix ena_com_fill_hash_function() implementation Greg Kroah-Hartman
2020-01-28 14:04 ` [PATCH 4.9 133/271] dmaengine: tegra210-adma: restore channel status Greg Kroah-Hartman
2020-01-28 14:04 ` [PATCH 4.9 134/271] l2tp: Fix possible NULL pointer dereference Greg Kroah-Hartman
2020-01-28 14:04 ` [PATCH 4.9 135/271] media: omap_vout: potential buffer overflow in vidioc_dqbuf() Greg Kroah-Hartman
2020-01-28 14:04 ` [PATCH 4.9 136/271] media: davinci/vpbe: array underflow in vpbe_enum_outputs() Greg Kroah-Hartman
2020-01-28 14:04 ` [PATCH 4.9 137/271] platform/x86: alienware-wmi: printing the wrong error code Greg Kroah-Hartman
2020-01-28 14:04 ` [PATCH 4.9 138/271] netfilter: ebtables: CONFIG_COMPAT: reject trailing data after last rule Greg Kroah-Hartman
2020-01-28 14:04 ` [PATCH 4.9 139/271] pwm: meson: Dont disable PWM when setting duty repeatedly Greg Kroah-Hartman
2020-01-28 14:04 ` [PATCH 4.9 140/271] ARM: riscpc: fix lack of keyboard interrupts after irq conversion Greg Kroah-Hartman
2020-01-28 14:04 ` [PATCH 4.9 141/271] kdb: do a sanity check on the cpu in kdb_per_cpu() Greg Kroah-Hartman
2020-01-28 14:04 ` [PATCH 4.9 142/271] backlight: lm3630a: Return 0 on success in update_status functions Greg Kroah-Hartman
2020-01-28 14:04 ` [PATCH 4.9 143/271] thermal: cpu_cooling: Actually trace CPU load in thermal_power_cpu_get_power Greg Kroah-Hartman
2020-01-28 14:04 ` [PATCH 4.9 144/271] dmaengine: tegra210-adma: Fix crash during probe Greg Kroah-Hartman
2020-01-28 14:04 ` [PATCH 4.9 145/271] spi: spi-fsl-spi: call spi_finalize_current_message() at the end Greg Kroah-Hartman
2020-01-28 14:04 ` [PATCH 4.9 146/271] crypto: ccp - fix AES CFB error exposed by new test vectors Greg Kroah-Hartman
2020-01-28 14:04 ` [PATCH 4.9 147/271] serial: stm32: fix transmit_chars when tx is stopped Greg Kroah-Hartman
2020-01-28 14:04 ` [PATCH 4.9 148/271] misc: sgi-xp: Properly initialize buf in xpc_get_rsvd_page_pa Greg Kroah-Hartman
2020-01-28 14:04 ` [PATCH 4.9 149/271] iommu: Use right function to get group for device Greg Kroah-Hartman
2020-01-28 14:04 ` [PATCH 4.9 150/271] signal/cifs: Fix cifs_put_tcp_session to call send_sig instead of force_sig Greg Kroah-Hartman
2020-01-28 14:05 ` [PATCH 4.9 151/271] inet: frags: call inet_frags_fini() after unregister_pernet_subsys() Greg Kroah-Hartman
2020-01-28 14:05 ` [PATCH 4.9 152/271] media: vivid: fix incorrect assignment operation when setting video mode Greg Kroah-Hartman
2020-01-28 14:05 ` [PATCH 4.9 153/271] powerpc/cacheinfo: add cacheinfo_teardown, cacheinfo_rebuild Greg Kroah-Hartman
2020-01-28 14:05 ` [PATCH 4.9 154/271] drm/msm/mdp5: Fix mdp5_cfg_init error return Greg Kroah-Hartman
2020-01-28 14:05 ` [PATCH 4.9 155/271] net: netem: fix backlog accounting for corrupted GSO frames Greg Kroah-Hartman
2020-01-28 14:05 ` [PATCH 4.9 156/271] net/af_iucv: always register net_device notifier Greg Kroah-Hartman
2020-01-28 14:05 ` [PATCH 4.9 157/271] ASoC: ti: davinci-mcasp: Fix slot mask settings when using multiple AXRs Greg Kroah-Hartman
2020-01-28 14:05 ` [PATCH 4.9 158/271] rtc: pcf8563: Clear event flags and disable interrupts before requesting irq Greg Kroah-Hartman
2020-01-28 14:05 ` [PATCH 4.9 159/271] drm/msm/a3xx: remove TPL1 regs from snapshot Greg Kroah-Hartman
2020-01-28 14:05 ` [PATCH 4.9 160/271] perf/ioctl: Add check for the sample_period value Greg Kroah-Hartman
2020-01-28 14:05 ` [PATCH 4.9 161/271] dmaengine: hsu: Revert "set HSU_CH_MTSR to memory width" Greg Kroah-Hartman
2020-01-28 14:05 ` [PATCH 4.9 162/271] clk: qcom: Fix -Wunused-const-variable Greg Kroah-Hartman
2020-01-28 14:05 ` [PATCH 4.9 163/271] iommu/amd: Make iommu_disable safer Greg Kroah-Hartman
2020-01-28 14:05 ` [PATCH 4.9 164/271] mfd: intel-lpss: Release IDA resources Greg Kroah-Hartman
2020-01-28 14:05 ` [PATCH 4.9 165/271] rxrpc: Fix uninitialized error code in rxrpc_send_data_packet() Greg Kroah-Hartman
2020-01-28 14:05 ` [PATCH 4.9 166/271] devres: allow const resource arguments Greg Kroah-Hartman
2020-01-28 14:05 ` [PATCH 4.9 167/271] RDMA/hns: Fixs hw access invalid dma memory error Greg Kroah-Hartman
2020-01-28 14:05 ` [PATCH 4.9 168/271] net: pasemi: fix an use-after-free in pasemi_mac_phy_init() Greg Kroah-Hartman
2020-01-28 14:05 ` [PATCH 4.9 169/271] scsi: libfc: fix null pointer dereference on a null lport Greg Kroah-Hartman
2020-01-28 14:05 ` [PATCH 4.9 170/271] libertas_tf: Use correct channel range in lbtf_geo_init Greg Kroah-Hartman
2020-01-28 14:05 ` [PATCH 4.9 171/271] qed: reduce maximum stack frame size Greg Kroah-Hartman
2020-01-28 14:05 ` [PATCH 4.9 172/271] usb: host: xhci-hub: fix extra endianness conversion Greg Kroah-Hartman
2020-01-28 14:05 ` [PATCH 4.9 173/271] mic: avoid statically declaring a struct device Greg Kroah-Hartman
2020-01-28 14:05 ` [PATCH 4.9 174/271] x86/kgbd: Use NMI_VECTOR not APIC_DM_NMI Greg Kroah-Hartman
2020-01-28 14:05 ` [PATCH 4.9 175/271] ALSA: aoa: onyx: always initialize register read value Greg Kroah-Hartman
2020-01-28 14:05 ` [PATCH 4.9 176/271] net/mlx5: Fix mlx5_ifc_query_lag_out_bits Greg Kroah-Hartman
2020-01-28 14:05 ` [PATCH 4.9 177/271] cifs: fix rmmod regression in cifs.ko caused by force_sig changes Greg Kroah-Hartman
2020-01-28 14:05 ` [PATCH 4.9 178/271] crypto: caam - free resources in case caam_rng registration failed Greg Kroah-Hartman
2020-01-28 14:05 ` [PATCH 4.9 179/271] ext4: set error return correctly when ext4_htree_store_dirent fails Greg Kroah-Hartman
2020-01-28 14:05 ` [PATCH 4.9 180/271] ASoC: es8328: Fix copy-paste error in es8328_right_line_controls Greg Kroah-Hartman
2020-01-28 14:05 ` [PATCH 4.9 181/271] ASoC: cs4349: Use PM ops cs4349_runtime_pm Greg Kroah-Hartman
2020-01-28 14:05 ` [PATCH 4.9 182/271] ASoC: wm8737: Fix copy-paste error in wm8737_snd_controls Greg Kroah-Hartman
2020-01-28 14:05 ` [PATCH 4.9 183/271] signal: Allow cifs and drbd to receive their terminating signals Greg Kroah-Hartman
2020-01-29 11:10   ` Thomas Voegtle
2020-01-29 11:36     ` Greg Kroah-Hartman
2020-01-29 19:12       ` Sasha Levin
2020-01-29 21:18         ` Eric W. Biederman
2020-01-29 22:35           ` Thomas Voegtle
2020-01-28 14:05 ` [PATCH 4.9 184/271] ASoC: sun4i-i2s: RX and TX counter registers are swapped Greg Kroah-Hartman
2020-01-28 14:05 ` [PATCH 4.9 185/271] dmaengine: dw: platform: Switch to acpi_dma_controller_register() Greg Kroah-Hartman
2020-01-28 14:05 ` [PATCH 4.9 186/271] mac80211: minstrel_ht: fix per-group max throughput rate initialization Greg Kroah-Hartman
2020-01-28 14:05 ` [PATCH 4.9 187/271] mips: avoid explicit UB in assignment of mips_io_port_base Greg Kroah-Hartman
2020-01-28 14:05 ` [PATCH 4.9 188/271] ahci: Do not export local variable ahci_em_messages Greg Kroah-Hartman
2020-01-28 14:05 ` [PATCH 4.9 189/271] Partially revert "kfifo: fix kfifo_alloc() and kfifo_init()" Greg Kroah-Hartman
2020-01-28 14:05 ` [PATCH 4.9 190/271] hwmon: (lm75) Fix write operations for negative temperatures Greg Kroah-Hartman
2020-01-28 14:05 ` [PATCH 4.9 191/271] power: supply: Init device wakeup after device_add() Greg Kroah-Hartman
2020-01-28 14:05 ` [PATCH 4.9 192/271] x86, perf: Fix the dependency of the x86 insn decoder selftest Greg Kroah-Hartman
2020-01-28 14:05 ` [PATCH 4.9 193/271] staging: greybus: light: fix a couple double frees Greg Kroah-Hartman
2020-01-28 14:05 ` [PATCH 4.9 194/271] bcma: fix incorrect update of BCMA_CORE_PCI_MDIO_DATA Greg Kroah-Hartman
2020-01-28 14:05 ` [PATCH 4.9 195/271] iio: dac: ad5380: fix incorrect assignment to val Greg Kroah-Hartman
2020-01-28 14:05 ` [PATCH 4.9 196/271] ath9k: dynack: fix possible deadlock in ath_dynack_node_{de}init Greg Kroah-Hartman
2020-01-28 14:05 ` [PATCH 4.9 197/271] net: sonic: return NETDEV_TX_OK if failed to map buffer Greg Kroah-Hartman
2020-01-28 14:05 ` [PATCH 4.9 198/271] Btrfs: fix hang when loading existing inode cache off disk Greg Kroah-Hartman
2020-01-28 14:05 ` [PATCH 4.9 199/271] hwmon: (shtc1) fix shtc1 and shtw1 id mask Greg Kroah-Hartman
2020-01-28 14:05 ` [PATCH 4.9 200/271] net: sonic: replace dev_kfree_skb in sonic_send_packet Greg Kroah-Hartman
2020-01-28 14:05 ` [PATCH 4.9 201/271] net/rds: Fix ib_evt_handler_call element in rds_ib_stat_names Greg Kroah-Hartman
2020-01-28 14:05 ` [PATCH 4.9 202/271] iommu/amd: Wait for completion of IOTLB flush in attach_device Greg Kroah-Hartman
2020-01-28 14:05 ` [PATCH 4.9 203/271] net: hisilicon: Fix signedness bug in hix5hd2_dev_probe() Greg Kroah-Hartman
2020-01-28 14:05 ` [PATCH 4.9 204/271] net: broadcom/bcmsysport: Fix signedness in bcm_sysport_probe() Greg Kroah-Hartman
2020-01-28 14:05 ` [PATCH 4.9 205/271] net: stmmac: dwmac-meson8b: Fix signedness bug in probe Greg Kroah-Hartman
2020-01-28 14:05 ` [PATCH 4.9 206/271] of: mdio: Fix a signedness bug in of_phy_get_and_connect() Greg Kroah-Hartman
2020-01-28 14:05 ` [PATCH 4.9 207/271] net: ethernet: stmmac: Fix signedness bug in ipq806x_gmac_of_parse() Greg Kroah-Hartman
2020-01-28 14:05 ` [PATCH 4.9 208/271] nvme: retain split access workaround for capability reads Greg Kroah-Hartman
2020-01-28 14:05 ` [PATCH 4.9 209/271] net: stmmac: gmac4+: Not all Unicast addresses may be available Greg Kroah-Hartman
2020-01-28 14:05 ` [PATCH 4.9 210/271] mac80211: accept deauth frames in IBSS mode Greg Kroah-Hartman
2020-01-28 14:06 ` [PATCH 4.9 211/271] llc: fix another potential sk_buff leak in llc_ui_sendmsg() Greg Kroah-Hartman
2020-01-28 14:06 ` [PATCH 4.9 212/271] llc: fix sk_buff refcounting in llc_conn_state_process() Greg Kroah-Hartman
2020-01-28 14:06 ` [PATCH 4.9 213/271] net: stmmac: fix length of PTP clocks name string Greg Kroah-Hartman
2020-01-28 14:06 ` [PATCH 4.9 214/271] act_mirred: Fix mirred_init_module error handling Greg Kroah-Hartman
2020-01-28 14:06 ` [PATCH 4.9 215/271] drm/msm/dsi: Implement reset correctly Greg Kroah-Hartman
2020-01-28 14:06 ` [PATCH 4.9 216/271] dmaengine: imx-sdma: fix size check for sdma script_number Greg Kroah-Hartman
2020-01-28 14:06 ` [PATCH 4.9 217/271] net: netem: fix error path for corrupted GSO frames Greg Kroah-Hartman
2020-01-28 14:06 ` [PATCH 4.9 218/271] net: netem: correct the parents backlog when corrupted packet was dropped Greg Kroah-Hartman
2020-01-28 14:06 ` [PATCH 4.9 219/271] net: qca_spi: Move reset_count to struct qcaspi Greg Kroah-Hartman
2020-01-28 14:06 ` [PATCH 4.9 220/271] afs: Fix large file support Greg Kroah-Hartman
2020-01-28 14:06 ` [PATCH 4.9 221/271] media: ov6650: Fix incorrect use of JPEG colorspace Greg Kroah-Hartman
2020-01-28 14:06 ` [PATCH 4.9 222/271] media: ov6650: Fix some format attributes not under control Greg Kroah-Hartman
2020-01-28 14:06 ` [PATCH 4.9 223/271] media: ov6650: Fix .get_fmt() V4L2_SUBDEV_FORMAT_TRY support Greg Kroah-Hartman
2020-01-28 14:06 ` [PATCH 4.9 224/271] MIPS: Loongson: Fix return value of loongson_hwmon_init Greg Kroah-Hartman
2020-01-28 14:06 ` [PATCH 4.9 225/271] net: neigh: use long type to store jiffies delta Greg Kroah-Hartman
2020-01-28 14:06 ` [PATCH 4.9 226/271] packet: fix data-race in fanout_flow_is_huge() Greg Kroah-Hartman
2020-01-28 14:06 ` [PATCH 4.9 227/271] dmaengine: ti: edma: fix missed failure handling Greg Kroah-Hartman
2020-01-28 14:06 ` [PATCH 4.9 228/271] drm/radeon: fix bad DMA from INTERRUPT_CNTL2 Greg Kroah-Hartman
2020-01-28 14:06 ` [PATCH 4.9 229/271] arm64: dts: juno: Fix UART frequency Greg Kroah-Hartman
2020-01-28 14:06 ` [PATCH 4.9 230/271] IB/iser: Fix dma_nents type definition Greg Kroah-Hartman
2020-01-28 14:06 ` [PATCH 4.9 231/271] m68k: Call timer_interrupt() with interrupts disabled Greg Kroah-Hartman
2020-01-28 14:06 ` [PATCH 4.9 232/271] net: ethtool: Add back transceiver type Greg Kroah-Hartman
2020-01-28 14:06 ` [PATCH 4.9 233/271] net: phy: Keep reporting " Greg Kroah-Hartman
2020-01-28 14:06 ` [PATCH 4.9 234/271] can, slip: Protect tty->disc_data in write_wakeup and close with RCU Greg Kroah-Hartman
2020-01-28 14:06 ` [PATCH 4.9 235/271] firestream: fix memory leaks Greg Kroah-Hartman
2020-01-28 14:06 ` [PATCH 4.9 236/271] net: cxgb3_main: Add CAP_NET_ADMIN check to CHELSIO_GET_MEM Greg Kroah-Hartman
2020-01-28 14:06 ` [PATCH 4.9 237/271] net, ip6_tunnel: fix namespaces move Greg Kroah-Hartman
2020-01-28 14:06 ` [PATCH 4.9 238/271] net, ip_tunnel: " Greg Kroah-Hartman
2020-01-28 14:06 ` [PATCH 4.9 239/271] net_sched: fix datalen for ematch Greg Kroah-Hartman
2020-01-28 14:06 ` [PATCH 4.9 240/271] tcp_bbr: improve arithmetic division in bbr_update_bw() Greg Kroah-Hartman
2020-01-28 14:06 ` [PATCH 4.9 241/271] net: usb: lan78xx: Add .ndo_features_check Greg Kroah-Hartman
2020-01-28 14:06 ` [PATCH 4.9 242/271] gtp: make sure only SOCK_DGRAM UDP sockets are accepted Greg Kroah-Hartman
2020-01-28 14:06 ` [PATCH 4.9 243/271] hwmon: (adt7475) Make volt2reg return same reg as reg2volt input Greg Kroah-Hartman
2020-01-28 14:06 ` [PATCH 4.9 244/271] hwmon: (core) Simplify sysfs attribute name allocation Greg Kroah-Hartman
2020-01-28 14:06 ` [PATCH 4.9 245/271] hwmon: Deal with errors from the thermal subsystem Greg Kroah-Hartman
2020-01-28 14:06 ` [PATCH 4.9 246/271] hwmon: (core) Fix double-free in __hwmon_device_register() Greg Kroah-Hartman
2020-01-28 14:06 ` [PATCH 4.9 247/271] hwmon: (core) Do not use device managed functions for memory allocations Greg Kroah-Hartman
2020-01-28 14:06 ` [PATCH 4.9 248/271] Input: keyspan-remote - fix control-message timeouts Greg Kroah-Hartman
2020-01-28 14:06 ` [PATCH 4.9 249/271] ARM: 8950/1: ftrace/recordmcount: filter relocation types Greg Kroah-Hartman
2020-01-28 14:06 ` [PATCH 4.9 250/271] mmc: tegra: fix SDR50 tuning override Greg Kroah-Hartman
2020-01-28 14:06 ` [PATCH 4.9 251/271] mmc: sdhci: fix minimum clock rate for v3 controller Greg Kroah-Hartman
2020-01-28 14:06 ` [PATCH 4.9 252/271] Input: sur40 - fix interface sanity checks Greg Kroah-Hartman
2020-01-28 14:06 ` [PATCH 4.9 253/271] Input: gtco - fix endpoint sanity check Greg Kroah-Hartman
2020-01-28 14:06 ` [PATCH 4.9 254/271] Input: aiptek " Greg Kroah-Hartman
2020-01-28 14:06 ` [PATCH 4.9 255/271] Input: pegasus_notetaker " Greg Kroah-Hartman
2020-01-28 14:06 ` [PATCH 4.9 256/271] Input: sun4i-ts - add a check for devm_thermal_zone_of_sensor_register Greg Kroah-Hartman
2020-01-28 14:06 ` [PATCH 4.9 257/271] hwmon: (nct7802) Fix voltage limits to wrong registers Greg Kroah-Hartman
2020-01-28 14:06 ` [PATCH 4.9 258/271] scsi: RDMA/isert: Fix a recently introduced regression related to logout Greg Kroah-Hartman
2020-01-28 14:06 ` [PATCH 4.9 259/271] tracing: xen: Ordered comparison of function pointers Greg Kroah-Hartman
2020-01-28 14:06 ` [PATCH 4.9 260/271] do_last(): fetch directory ->i_mode and ->i_uid before its too late Greg Kroah-Hartman
2020-01-28 14:06 ` [PATCH 4.9 261/271] Documentation: Document arm64 kpti control Greg Kroah-Hartman
2020-01-28 14:06 ` [PATCH 4.9 262/271] arm64: kpti: Whitelist Cortex-A CPUs that dont implement the CSV3 field Greg Kroah-Hartman
2020-01-28 14:06 ` [PATCH 4.9 263/271] coresight: etb10: Do not call smp_processor_id from preemptible Greg Kroah-Hartman
2020-01-28 14:06 ` [PATCH 4.9 264/271] coresight: tmc-etf: " Greg Kroah-Hartman
2020-01-28 14:06 ` [PATCH 4.9 265/271] libertas: Fix two buffer overflows at parsing bss descriptor Greg Kroah-Hartman
2020-01-28 14:06 ` [PATCH 4.9 266/271] bcache: silence static checker warning Greg Kroah-Hartman
2020-01-28 14:06 ` [PATCH 4.9 267/271] scsi: iscsi: Avoid potential deadlock in iscsi_if_rx func Greg Kroah-Hartman
2020-01-28 14:06 ` [PATCH 4.9 268/271] md: Avoid namespace collision with bitmap API Greg Kroah-Hartman
2020-01-28 14:06 ` [PATCH 4.9 269/271] bitmap: Add bitmap_alloc(), bitmap_zalloc() and bitmap_free() Greg Kroah-Hartman
2020-01-28 14:06 ` [PATCH 4.9 270/271] netfilter: ipset: use bitmap infrastructure completely Greg Kroah-Hartman
2020-01-28 14:07 ` [PATCH 4.9 271/271] net/x25: fix nonblocking connect Greg Kroah-Hartman
2020-01-28 17:53 ` [PATCH 4.9 000/271] 4.9.212-stable review Guenter Roeck
2020-01-28 20:42 ` Guenter Roeck
2020-01-29  7:31   ` Greg Kroah-Hartman
2020-01-28 23:11 ` shuah
2020-01-29  4:50 ` Naresh Kamboju
2020-01-29 13:13 ` Jon Hunter

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).