LKML Archive on lore.kernel.org
 help / color / Atom feed
* [PATCH 5.8 000/633] 5.8.17-rc1 review
@ 2020-10-27 13:45 Greg Kroah-Hartman
  2020-10-27 13:45 ` [PATCH 5.8 001/633] xgb4: handle 4-tuple PEDIT to NAT mode translation Greg Kroah-Hartman
                   ` (635 more replies)
  0 siblings, 636 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, torvalds, akpm, linux, shuah, patches,
	lkft-triage, pavel, stable

This is the start of the stable review cycle for the 5.8.17 release.
There are 633 patches in this series, all will be posted as a response
to this one.  If anyone has any issues with these being applied, please
let me know.

Responses should be made by Thu, 29 Oct 2020 13:53:43 +0000.
Anything received after that time might be too late.

The whole patch series can be found in one patch at:
	https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.8.17-rc1.gz
or in the git tree and branch at:
	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.8.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Linux 5.8.17-rc1

Lorenzo Colitti <lorenzo@google.com>
    usb: gadget: f_ncm: allow using NCM in SuperSpeed Plus gadgets.

Christian Eggers <ceggers@arri.de>
    eeprom: at25: set minimum read/write access stride to 1

Peter Chen <peter.chen@nxp.com>
    usb: cdns3: gadget: free interrupt after gadget has deleted

Oliver Neukum <oneukum@suse.com>
    USB: cdc-wdm: Make wdm_flush() interruptible and add wdm_fsync().

Vincent Mailhol <mailhol.vincent@wanadoo.fr>
    usb: cdc-acm: add quirk to blacklist ETAS ES58X devices

Chunfeng Yun <chunfeng.yun@mediatek.com>
    usb: gadget: bcm63xx_udc: fix up the error of undeclared usb_debug_root

Peng Fan <peng.fan@nxp.com>
    tty: serial: fsl_lpuart: fix lpuart32_poll_get_char

Peng Fan <peng.fan@nxp.com>
    tty: serial: lpuart: fix lpuart32_write usage

Julian Wiedmann <jwi@linux.ibm.com>
    s390/qeth: don't let HW override the configured port role

Valentin Vidic <vvidic@valentin-vidic.from.hr>
    net: korina: cast KSEG0 address to pointer in kfree

Zekun Shen <bruceshenzk@gmail.com>
    ath10k: check idx validity in __ath10k_htt_rx_ring_fill_n()

Serge Semin <Sergey.Semin@baikalelectronics.ru>
    dmaengine: dw: Activate FIFO-mode for memory peripherals only

Serge Semin <Sergey.Semin@baikalelectronics.ru>
    dmaengine: dw: Add DMA-channels mask cell support

Qingqing Zhuo <qingqing.zhuo@amd.com>
    drm/amd/display: Screen corruption on dual displays (DP+USB-C)

Can Guo <cang@codeaurora.org>
    scsi: ufs: ufs-qcom: Fix race conditions caused by ufs_qcom_testbus_config()

Eli Billauer <eli.billauer@gmail.com>
    usb: core: Solve race condition in anchor cleanup functions

Wang Yufen <wangyufen@huawei.com>
    brcm80211: fix possible memleak in brcmf_proto_msgbuf_attach

Kevin Barnett <kevin.barnett@microsemi.com>
    scsi: smartpqi: Avoid crashing kernel for controller issues

Sathyanarayana Nujella <sathyanarayana.nujella@intel.com>
    ASoC: Intel: sof_rt5682: override quirk data for tgl_max98373_rt5682

Sathyanarayana Nujella <sathyanarayana.nujella@intel.com>
    ASoC: SOF: Add topology filename override based on dmi data match

Connor McAdams <conmanx360@gmail.com>
    ALSA: hda/ca0132 - Add new quirk ID for SoundBlaster AE-7.

Connor McAdams <conmanx360@gmail.com>
    ALSA: hda/ca0132 - Add AE-7 microphone selection commands.

Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
    mwifiex: don't call del_timer_sync() on uninitialized timer

Julian Wiedmann <jwi@linux.ibm.com>
    s390/qeth: strictly order bridge address events

Jan Kara <jack@suse.cz>
    reiserfs: Fix memory leak in reiserfs_parse_options()

Peilin Ye <yepeilin.cs@gmail.com>
    ipvs: Fix uninit-value in do_ip_vs_set_ctl()

Dinghao Liu <dinghao.liu@zju.edu.cn>
    Bluetooth: btusb: Fix memleak in btusb_mtk_submit_wmt_recv_urb

Tong Zhang <ztong0001@gmail.com>
    tty: ipwireless: fix error handling

George Kennedy <george.kennedy@oracle.com>
    fbmem: add margin check to fb_check_caps()

Nilesh Javali <njavali@marvell.com>
    scsi: qedi: Fix list_del corruption while removing active I/O

Nilesh Javali <njavali@marvell.com>
    scsi: qedi: Protect active command list to avoid list corruption

Nilesh Javali <njavali@marvell.com>
    scsi: qedi: Mark all connections for recovery on link down event

Saurav Kashyap <skashyap@marvell.com>
    scsi: qedf: Return SUCCESS if stale rport is encountered

Hans de Goede <hdegoede@redhat.com>
    HID: ite: Add USB id match for Acer One S1003 keyboard dock

Doug Horn <doughorn@google.com>
    Fix use after free in get_capset_info callback.

Chris Chiu <chiu@endlessm.com>
    rtl8xxxu: prevent potential memory leak

Keita Suzuki <keitasuzuki.park@sslab.ics.keio.ac.jp>
    brcmsmac: fix memory leak in wlc_phy_attach_lcnphy

Yonghong Song <yhs@fb.com>
    selftests/bpf: Fix test_sysctl_loop{1, 2} failure due to clang change

Daniel Wagner <dwagner@suse.de>
    scsi: qla2xxx: Warn if done() or free() are called on an already freed srb

Jing Xiangfeng <jingxiangfeng@huawei.com>
    scsi: ibmvfc: Fix error return in ibmvfc_probe()

Qian Cai <cai@lca.pw>
    iomap: fix WARN_ON_ONCE() from unprivileged users

Zhenzhong Duan <zhenzhong.duan@gmail.com>
    drm/msm/a6xx: fix a potential overflow issue

Abhishek Pandit-Subedi <abhishekpandit@chromium.org>
    Bluetooth: Only mark socket zapped after unlocking

Jia Yang <jiayang5@huawei.com>
    drm: fix double free for gbo in drm_gem_vram_init and drm_gem_vram_create

Hamish Martin <hamish.martin@alliedtelesis.co.nz>
    usb: ohci: Default to per-port over-current protection

Darrick J. Wong <darrick.wong@oracle.com>
    xfs: make sure the rt allocator doesn't run off the end

Viresh Kumar <viresh.kumar@linaro.org>
    opp: Prevent memory leak in dev_pm_opp_attach_genpd()

Eric Biggers <ebiggers@google.com>
    reiserfs: only call unlock_new_inode() if I_NEW

Keita Suzuki <keitasuzuki.park@sslab.ics.keio.ac.jp>
    misc: rtsx: Fix memory leak in rtsx_pci_probe

Maciej Fijalkowski <maciej.fijalkowski@intel.com>
    bpf: Limit caller's stack depth 256 for subprogs with tailcalls

Neil Armstrong <narmstrong@baylibre.com>
    drm/panfrost: add support for vendor quirk

Neil Armstrong <narmstrong@baylibre.com>
    drm/panfrost: add amlogic reset quirk callback

Neil Armstrong <narmstrong@baylibre.com>
    drm/panfrost: add Amlogic GPU integration quirks

Brooke Basile <brookebasile@gmail.com>
    ath9k: hif_usb: fix race condition between usb_get_urb() and usb_kill_anchored_urbs()

Mikael Wikström <leakim.wikstrom@gmail.com>
    HID: multitouch: Lenovo X1 Tablet Gen3 trackpoint and buttons

Joakim Zhang <qiangqing.zhang@nxp.com>
    can: flexcan: flexcan_chip_stop(): add error handling and propagate error value

Oded Gabbay <oded.gabbay@gmail.com>
    habanalabs: cast to u64 before shift > 31 bits

Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
    usb: dwc3: simple: add support for Hikey 970

Johan Hovold <johan@kernel.org>
    USB: cdc-acm: handle broken union descriptors

Alan Maguire <alan.maguire@oracle.com>
    selftests/bpf: Fix overflow tests to reflect iter size increase

Tzu-En Huang <tehuang@realtek.com>
    rtw88: increse the size of rx buffer size

Jan Kara <jack@suse.cz>
    udf: Avoid accessing uninitialized data on failed inode read

Jan Kara <jack@suse.cz>
    udf: Limit sparing table size

Kai-Heng Feng <kai.heng.feng@canonical.com>
    rtw88: pci: Power cycle device during shutdown

Zqiang <qiang.zhang@windriver.com>
    usb: gadget: function: printer: fix use-after-free in __lock_acquire

Yu Chen <chenyu56@huawei.com>
    usb: dwc3: Add splitdisable quirk for Hisilicon Kirin Soc

Sherry Sun <sherry.sun@nxp.com>
    misc: vop: add round_up(x,4) for vring_size to avoid kernel panic

Sherry Sun <sherry.sun@nxp.com>
    mic: vop: copy data to kernel space then write to io memory

Roman Bolshakov <r.bolshakov@yadro.com>
    scsi: target: core: Add CONTROL field for trace events

Jing Xiangfeng <jingxiangfeng@huawei.com>
    scsi: mvumi: Fix error return in mvumi_io_attach()

Christoph Hellwig <hch@lst.de>
    PM: hibernate: remove the bogus call to get_gendisk() in software_resume()

Song Liu <songliubraving@fb.com>
    bpf: Use raw_spin_trylock() for pcpu_freelist_push/pop in NMI

Hangbin Liu <liuhangbin@gmail.com>
    libbpf: Close map fd if init map slots failed

Jérôme Pouiller <jerome.pouiller@silabs.com>
    staging: wfx: fix handling of MMIC error

Thomas Pedersen <thomas@adapt-ip.com>
    mac80211: handle lack of sband->bitrates in rates

Cong Wang <xiyou.wangcong@gmail.com>
    ip_gre: set dev->hard_header_len and dev->needed_headroom properly

Rustam Kovhaev <rkovhaev@gmail.com>
    ntfs: add check for mft record size in superblock

Dinghao Liu <dinghao.liu@zju.edu.cn>
    media: venus: core: Fix runtime PM imbalance in venus_probe

Rajendra Nayak <rnayak@codeaurora.org>
    media: venus: core: Fix error handling in probe

Alexander Aring <aahringo@redhat.com>
    fs: dlm: fix configfs memory leak

Vikash Garodia <vgarodia@codeaurora.org>
    media: venus: fixes for list corruption

Dinghao Liu <dinghao.liu@zju.edu.cn>
    media: atomisp: fix memleak in ia_css_stream_create

Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
    media: saa7134: avoid a shift overflow

Pali Rohár <pali@kernel.org>
    mmc: sdio: Check for CISTPL_VERS_1 buffer size

Adam Goode <agoode@google.com>
    media: uvcvideo: Ensure all probed info is returned to v4l2

Borislav Petkov <bp@suse.de>
    x86/mce: Make mce_rdmsrl() panic on an inaccessible MSR

Brad Bishop <bradleyb@fuzziesquirrel.com>
    spi: fsi: Fix clock running too fast

Longfang Liu <liulongfang@huawei.com>
    crypto: hisilicon - fixed memory allocation error

Borislav Petkov <bp@suse.de>
    x86/mce: Annotate mce_rd/wrmsrl() with noinstr

Xiaolong Huang <butterflyhuangxx@gmail.com>
    media: media/pci: prevent memory leak in bttv_probe

Dinghao Liu <dinghao.liu@zju.edu.cn>
    media: bdisp: Fix runtime PM imbalance on error

Dinghao Liu <dinghao.liu@zju.edu.cn>
    media: platform: sti: hva: Fix runtime PM imbalance on error

Dinghao Liu <dinghao.liu@zju.edu.cn>
    media: platform: s3c-camif: Fix runtime PM imbalance on error

Dinghao Liu <dinghao.liu@zju.edu.cn>
    media: vsp1: Fix runtime PM imbalance on error

Qiushi Wu <wu000273@umn.edu>
    media: exynos4-is: Fix a reference count leak

Qiushi Wu <wu000273@umn.edu>
    media: exynos4-is: Fix a reference count leak due to pm_runtime_get_sync

Qiushi Wu <wu000273@umn.edu>
    media: exynos4-is: Fix several reference count leaks due to pm_runtime_get_sync

Qiushi Wu <wu000273@umn.edu>
    media: sti: Fix reference count leaks

Aditya Pakki <pakki001@umn.edu>
    media: st-delta: Fix reference count leak in delta_run_work

Oliver Neukum <oneukum@suse.com>
    media: ati_remote: sanity check for both endpoints

Pavel Machek <pavel@ucw.cz>
    media: firewire: fix memory leak

Borislav Petkov <bp@suse.de>
    x86/mce: Add Skylake quirk for patrol scrub reported errors

Arvind Sankar <nivedita@alum.mit.edu>
    x86/asm: Replace __force_order with a memory clobber

Pavel Machek <pavel@denx.de>
    crypto: ccp - fix error handling

Mark Mossberg <mark.mossberg@gmail.com>
    x86/dumpstack: Fix misleading instruction pointer error message

Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
    block: ratelimit handle_bad_sector() message

Zhao Heming <heming.zhao@suse.com>
    md/bitmap: fix memory leak of temporary bitmap

Hans de Goede <hdegoede@redhat.com>
    i2c: core: Restore acpi_walk_dep_device_list() getting called after registering the ACPI i2c devs

Al Grant <al.grant@foss.arm.com>
    perf: correct SNOOPX field offset

Juri Lelli <juri.lelli@redhat.com>
    sched/features: Fix !CONFIG_JUMP_LABEL case

Dinghao Liu <dinghao.liu@zju.edu.cn>
    ntb: intel: Fix memleak in intel_ntb_pci_probe

Kaige Li <likaige@loongson.cn>
    NTB: hw: amd: fix an issue about leak system resources

Vitaly Kuznetsov <vkuznets@redhat.com>
    KVM: ioapic: break infinite recursion on lazy EOI

zhenwei pi <pizhenwei@bytedance.com>
    nvmet: fix uninitialized work for zero kato

Ganesh Goudar <ganeshgr@linux.ibm.com>
    powerpc/pseries: Avoid using addr_to_pfn in real mode

Vasant Hegde <hegdevasant@linux.vnet.ibm.com>
    powerpc/powernv/dump: Fix race while processing OPAL dump

Colin Ian King <colin.king@canonical.com>
    lightnvm: fix out-of-bounds write to array devices->info[]

Martin Blumenstingl <martin.blumenstingl@googlemail.com>
    ARM: dts: meson8: remove two invalid interrupt lines from the GPU node

Michal Simek <michal.simek@xilinx.com>
    arm64: dts: zynqmp: Remove additional compatible string for i2c IPs

Dennis YC Hsieh <dennis-yc.hsieh@mediatek.com>
    drm/mediatek: reduce clear event

Dennis YC Hsieh <dennis-yc.hsieh@mediatek.com>
    soc: mediatek: cmdq: add clear option in cmdq_pkt_wfe api

Biju Das <biju.das.jz@bp.renesas.com>
    ARM: dts: iwg20d-q7-common: Fix touch controller probe failure

Marek Vasut <marex@denx.de>
    ARM: dts: stm32: Fix DH PDK2 display PWM channel

Marek Vasut <marex@denx.de>
    ARM: dts: stm32: Swap PHY reset GPIO and TSC2004 IRQ on DHCOM SOM

Marek Vasut <marex@denx.de>
    ARM: dts: stm32: Move ethernet PHY into DH SoM DT

Holger Assmann <h.assmann@pengutronix.de>
    ARM: dts: stm32: lxa-mc1: Fix kernel warning about PHY delays

Marek Vasut <marex@denx.de>
    ARM: dts: stm32: Fix sdmmc2 pins on AV96

Tony Lindgren <tony@atomide.com>
    ARM: OMAP2+: Restore MPU power domain if cpu_cluster_pm_enter() fails

Krzysztof Kozlowski <krzk@kernel.org>
    soc: fsl: qbman: Fix return value on success

Cristian Ciocaltea <cristian.ciocaltea@gmail.com>
    ARM: dts: owl-s500: Fix incorrect PPI interrupt specifiers

Amit Singh Tomar <amittomer25@gmail.com>
    arm64: dts: actions: limit address range for pinctrl node

Hsin-Yi Wang <hsinyi@chromium.org>
    arm64: dts: mt8173: elm: Fix nor_flash node property

Geert Uytterhoeven <geert+renesas@glider.be>
    arm64: dts: renesas: r8a774c0: Fix MSIOF1 DMA channels

Geert Uytterhoeven <geert+renesas@glider.be>
    arm64: dts: renesas: r8a77990: Fix MSIOF1 DMA channels

Corentin Labbe <clabbe.montjoie@gmail.com>
    dt-bindings: crypto: Specify that allwinner, sun8i-a33-crypto needs reset

Sibi Sankar <sibis@codeaurora.org>
    soc: qcom: apr: Fixup the error displayed on lookup failure

Stephan Gerhold <stephan@gerhold.net>
    arm64: dts: qcom: msm8916: Fix MDP/DSI interrupts

Stephan Gerhold <stephan@gerhold.net>
    arm64: dts: qcom: pm8916: Remove invalid reg size from wcd_codec

Stephan Gerhold <stephan@gerhold.net>
    arm64: dts: qcom: msm8916: Remove one more thermal trip point unit name

Sibi Sankar <sibis@codeaurora.org>
    soc: qcom: pdr: Fixup array type of get_domain_list_resp message

Stephen Boyd <swboyd@chromium.org>
    arm64: dts: qcom: sc7180: Drop flags on mdss irqs

Krzysztof Kozlowski <krzk@kernel.org>
    arm64: dts: imx8mq: Add missing interrupts to GPC

Sudeep Holla <sudeep.holla@arm.com>
    firmware: arm_scmi: Fix NULL pointer dereference in mailbox_chan_free

Krzysztof Kozlowski <krzk@kernel.org>
    memory: fsl-corenet-cf: Fix handling of platform_get_irq() error

Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
    arm64: dts: qcom: sc7180: Fix the LLCC base register size

YueHaibing <yuehaibing@huawei.com>
    memory: omap-gpmc: Fix build error without CONFIG_OF

Dan Carpenter <dan.carpenter@oracle.com>
    memory: omap-gpmc: Fix a couple off by ones

Qiang Yu <yuq825@gmail.com>
    arm64: dts: allwinner: h5: remove Mali GPU PMU module

Jernej Skrabec <jernej.skrabec@siol.net>
    ARM: dts: sun8i: r40: bananapi-m2-ultra: Fix dcdc1 regulator

Arnd Bergmann <arnd@arndb.de>
    ARM: s3c24xx: fix mmc gpio lookup tables

Claudiu Beznea <claudiu.beznea@microchip.com>
    ARM: at91: pm: of_node_put() after its usage

Horia Geantă <horia.geanta@nxp.com>
    ARM: dts: imx6sl: fix rng node

Jerome Brunet <jbrunet@baylibre.com>
    arm64: dts: meson: vim3: correct led polarity

Dan Carpenter <dan.carpenter@oracle.com>
    soc: xilinx: Fix error code in zynqmp_pm_probe()

Pablo Neira Ayuso <pablo@netfilter.org>
    netfilter: nf_fwd_netdev: clear timestamp in forwarding path

Ard Biesheuvel <ardb@kernel.org>
    netsec: ignore 'phy-mode' device property on ACPI systems

Timothée COCAULT <timothee.cocault@orange.com>
    netfilter: ebtables: Fixes dropping of small packets in bridge nat

Francesco Ruggeri <fruggeri@arista.com>
    netfilter: conntrack: connection timeout after re-register

Ard Biesheuvel <ardb@kernel.org>
    arm64: mm: use single quantity to represent the PA to VA translation

Jing Xiangfeng <jingxiangfeng@huawei.com>
    scsi: bfa: Fix error return in bfad_pci_init()

Robert Hoo <robert.hu@linux.intel.com>
    KVM: x86: emulating RDPID failure shall return #UD rather than #GP

Krzysztof Kozlowski <krzk@kernel.org>
    Input: sun4i-ps2 - fix handling of platform_get_irq() error

Krzysztof Kozlowski <krzk@kernel.org>
    Input: twl4030_keypad - fix handling of platform_get_irq() error

Krzysztof Kozlowski <krzk@kernel.org>
    Input: omap4-keypad - fix handling of platform_get_irq() error

Krzysztof Kozlowski <krzk@kernel.org>
    Input: ep93xx_keypad - fix handling of platform_get_irq() error

YueHaibing <yuehaibing@huawei.com>
    Input: stmfts - fix a & vs && typo

Dan Carpenter <dan.carpenter@oracle.com>
    Input: imx6ul_tsc - clean up some errors in imx6ul_tsc_resume()

Johnny Chuang <johnny.chuang.emc@gmail.com>
    Input: elants_i2c - fix typo for an attribute to show calibration count

Gwendal Grignou <gwendal@chromium.org>
    platform/chrome: cros_ec_lightbar: Reduce ligthbar get version command

Martijn de Gouw <martijn.de.gouw@prodrive-technologies.com>
    SUNRPC: fix copying of multiple pages in gss_read_proxy_verf()

Abel Vesa <abel.vesa@nxp.com>
    clk: imx8mq: Fix usdhc parents order

Xiaoyang Xu <xuxiaoyang2@huawei.com>
    vfio iommu type1: Fix memory leak in vfio_iommu_type1_pin_pages

Alex Williamson <alex.williamson@redhat.com>
    vfio/pci: Clear token on bypass registration failure

Darrick J. Wong <darrick.wong@oracle.com>
    ext4: limit entries returned when counting fsmap records

Xiao Yang <yangx.jy@cn.fujitsu.com>
    ext4: disallow modifying DAX inode flag if inline_data has been set

Jan Kara <jack@suse.cz>
    ext4: discard preallocations before releasing group lock

Ye Bin <yebin10@huawei.com>
    ext4: fix dead loop in ext4_mb_new_blocks

Dan Aloni <dan@kernelim.com>
    svcrdma: fix bounce buffers for unaligned offsets and multiple pages

Guenter Roeck <linux@roeck-us.net>
    watchdog: sp5100: Fix definition of EFCH_PM_DECODEEN3

Dinghao Liu <dinghao.liu@zju.edu.cn>
    watchdog: Use put_device on error

Dinghao Liu <dinghao.liu@zju.edu.cn>
    watchdog: Fix memleak in watchdog_cdev_register

Masahiro Yamada <masahiroy@kernel.org>
    kbuild: deb-pkg: do not build linux-headers package if CONFIG_MODULES=n

Navid Emamdoost <navid.emamdoost@gmail.com>
    clk: bcm2835: add missing release if devm_clk_hw_register fails

Claudiu Beznea <claudiu.beznea@microchip.com>
    clk: at91: clk-main: update key before writing AT91_CKGR_MOR

Daniel Jordan <daniel.m.jordan@oracle.com>
    module: statically initialize init section freeing data

Hanks Chen <hanks.chen@mediatek.com>
    clk: mediatek: add UART0 clock support

Stephen Boyd <sboyd@kernel.org>
    clk: rockchip: Initialize hw to error to avoid undefined behavior

Dexuan Cui <decui@microsoft.com>
    PCI: hv: Fix hibernation in case interrupts are not re-created

Colin Ian King <colin.king@canonical.com>
    remoteproc/mediatek: fix null pointer dereference on null scp pointer

Hauke Mehrtens <hauke@hauke-m.de>
    pwm: img: Fix null pointer access in probe

Simon South <simon@simonsouth.net>
    pwm: rockchip: Keep enabled PWMs running while probing

Tero Kristo <t-kristo@ti.com>
    clk: keystone: sci-clk: fix parsing assigned-clock data during probe

Konrad Dybcio <konradybcio@gmail.com>
    clk: qcom: gcc-sdm660: Fix wrong parent_map

Yan Zhao <yan.y.zhao@intel.com>
    vfio/type1: fix dirty bitmap calculation in vfio_dma_rw

Yan Zhao <yan.y.zhao@intel.com>
    vfio: fix a missed vfio group put in vfio_pin_pages

Matthew Rosato <mjrosato@linux.ibm.com>
    vfio/pci: Decouple PCI_COMMAND_MEMORY bit checks from is_virtfn

Matthew Rosato <mjrosato@linux.ibm.com>
    s390/pci: Mark all VFs as not implementing PCI_COMMAND_MEMORY

Yan Zhao <yan.y.zhao@intel.com>
    vfio: add a singleton check for vfio_group_pin_pages

Matthew Rosato <mjrosato@linux.ibm.com>
    PCI/IOV: Mark VFs as not implementing PCI_COMMAND_MEMORY

Nicolas Boichat <drinkcat@chromium.org>
    rpmsg: Avoid double-free in mtk_rpmsg_register_device

Dan Carpenter <dan.carpenter@oracle.com>
    rpmsg: smd: Fix a kobj leak in in qcom_smd_parse_edge()

Mark Tomlinson <mark.tomlinson@alliedtelesis.co.nz>
    PCI: iproc: Set affinity mask on MSI interrupts

Pali Rohár <pali@kernel.org>
    PCI: aardvark: Check for errors from pci_bridge_emul_init() call

Pali Rohár <pali@kernel.org>
    PCI: aardvark: Fix compilation on s390

Hou Zhiqiang <Zhiqiang.Hou@nxp.com>
    PCI: designware-ep: Fix the Header Type check

Stefan Agner <stefan@agner.ch>
    clk: meson: g12a: mark fclk_div2 as critical

Dirk Behme <dirk.behme@de.bosch.com>
    i2c: rcar: Auto select RESET_CONTROLLER

Chris Packham <chris.packham@alliedtelesis.co.nz>
    rtc: ds1307: Clear OSF flag on DS1388 when setting time

Jerome Brunet <jbrunet@baylibre.com>
    clk: meson: axg-audio: separate axg and g12a regmap tables

Jassi Brar <jaswinder.singh@linaro.org>
    mailbox: avoid timer start from callback

Jing Xiangfeng <jingxiangfeng@huawei.com>
    rapidio: fix the missed put_device() for rio_mport_add_riodev

Souptick Joarder <jrdr.linux@gmail.com>
    rapidio: fix error handling path

Matthew Wilcox (Oracle) <willy@infradead.org>
    ramfs: fix nommu mmap with gaps in the page cache

Tobias Jordan <kernel@cdqe.de>
    lib/crc32.c: fix trivial typo in preprocessor condition

Matthew Wilcox (Oracle) <willy@infradead.org>
    mm/page_owner: change split_page_owner to take a count

Bob Pearson <rpearsonhpe@gmail.com>
    RDMA/rxe: Handle skb_clone() failure in rxe_recv.c

David Howells <dhowells@redhat.com>
    afs: Fix cell removal

David Howells <dhowells@redhat.com>
    afs: Fix cell purging with aliases

David Howells <dhowells@redhat.com>
    afs: Fix cell refcounting by splitting the usage counter

David Howells <dhowells@redhat.com>
    afs: Fix rapid cell addition/removal by not using RCU on cells tree

Jamie Iles <jamie@nuviainc.com>
    f2fs: wait for sysfs kobject removal before freeing f2fs_sb_info

Oliver O'Halloran <oohall@gmail.com>
    selftests/powerpc: Fix eeh-basic.sh exit codes

Jiri Slaby <jslaby@suse.cz>
    perf trace: Fix off by ones in memset() after realloc() in arches using libaudit

Krzysztof Kozlowski <krzk@kernel.org>
    maiblox: mediatek: Fix handling of platform_get_irq() error

Johannes Berg <johannes.berg@intel.com>
    um: time-travel: Fix IRQ handling in time_travel_handle_message()

Tiezhu Yang <yangtiezhu@loongson.cn>
    um: vector: Use GFP_ATOMIC under spin lock

Eric Biggers <ebiggers@google.com>
    f2fs: reject CASEFOLD inode flag without casefold feature

Bob Pearson <rpearsonhpe@gmail.com>
    RDMA/rxe: Fix skb lifetime in rxe_rcv_mcast_pkt()

Colin Ian King <colin.king@canonical.com>
    IB/rdmavt: Fix sizeof mismatch

Srikar Dronamraju <srikar@linux.vnet.ibm.com>
    cpufreq: powernv: Fix frame-size-overflow in powernv_cpufreq_reboot_notifier

Vaibhav Jain <vaibhav@linux.ibm.com>
    powerpc/papr_scm: Add PAPR command family to pass-through command-set

Jing Xiangfeng <jingxiangfeng@huawei.com>
    i3c: master: Fix error return in cdns_i3c_master_probe()

Namhyung Kim <namhyung@kernel.org>
    perf stat: Fix out of bounds CPU map access when handling armv8_pmu events

Kajol Jain <kjain@linux.ibm.com>
    powerpc/perf/hv-gpci: Fix starting index value

Athira Rajeev <atrajeev@linux.vnet.ibm.com>
    powerpc/perf: Exclude pmc5/6 from the irrelevant PMU group constraints

Nicholas Piggin <npiggin@gmail.com>
    powerpc/64: fix irq replay pt_regs->softe value

Nicholas Piggin <npiggin@gmail.com>
    powerpc/64: fix irq replay missing preempt

Kamal Heib <kamalheib1@gmail.com>
    RDMA/ipoib: Set rtnl_link_ops for ipoib interfaces

Leon Romanovsky <leonro@nvidia.com>
    overflow: Include header file with SIZE_MAX declaration

Daniel Thompson <daniel.thompson@linaro.org>
    kdb: Fix pager search for multi-line strings

Janusz Krzysztofik <jmkrzyszt@gmail.com>
    mtd: rawnand: ams-delta: Fix non-OF build warning

Hauke Mehrtens <hauke@hauke-m.de>
    mtd: spinand: gigadevice: Add QE Bit

Hauke Mehrtens <hauke@hauke-m.de>
    mtd: spinand: gigadevice: Only one dummy byte in QUADIO

Evgeny Novikov <novikov@ispras.ru>
    mtd: rawnand: vf610: disable clk on error handling path in probe

Christophe Kerello <christophe.kerello@st.com>
    mtd: rawnand: stm32_fmc2: fix a buffer overflow

Vignesh Raghavendra <vigneshr@ti.com>
    mtd: hyperbus: hbmc-am654: Fix direct mapping setup flash access

Weihang Li <liweihang@huawei.com>
    RDMA/hns: Fix missing sq_sig_type when querying QP

Weihang Li <liweihang@huawei.com>
    RDMA/hns: Fix configuration of ack_req_freq in QPC

Wenpeng Liang <liangwenpeng@huawei.com>
    RDMA/hns: Fix the wrong value of rnr_retry when querying qp

Jiaran Zhang <zhangjiaran@huawei.com>
    RDMA/hns: Solve the overflow of the calc_pg_sz()

Jiaran Zhang <zhangjiaran@huawei.com>
    RDMA/hns: Add check for the validity of sl configuration

Jin Yao <yao.jin@linux.intel.com>
    perf stat: Skip duration_time in setup_system_wide

Sindhu, Devale <sindhu.devale@intel.com>
    i40iw: Add support to make destroy QP synchronous

Jason Gunthorpe <jgg@nvidia.com>
    RDMA/mlx5: Disable IB_DEVICE_MEM_MGT_EXTENSIONS if IB_WR_REG_MR can't work

Jason Gunthorpe <jgg@nvidia.com>
    RDMA/mlx5: Make mkeys always owned by the kernel's PD when not enabled

Jason Gunthorpe <jgg@nvidia.com>
    RDMA/mlx5: Use set_mkc_access_pd_addr_fields() in reg_create()

Lijun Ou <oulijun@huawei.com>
    RDMA/hns: Set the unsupported wr opcode

Keita Suzuki <keitasuzuki.park@sslab.ics.keio.ac.jp>
    RDMA/qedr: Fix resource leak in qedr_create_qp

Adrian Hunter <adrian.hunter@intel.com>
    perf intel-pt: Fix "context_switch event has no tid" error

Jason Gunthorpe <jgg@nvidia.com>
    RDMA/cma: Fix use after free race in roce multicast join

Jason Gunthorpe <jgg@nvidia.com>
    RDMA/cma: Consolidate the destruction of a cma_multicast in one place

Jason Gunthorpe <jgg@nvidia.com>
    RDMA/cma: Remove dead code for kernel rdmacm multicast

Jason Gunthorpe <jgg@nvidia.com>
    RDMA/cma: Combine cma_ndev_work with cma_work

Nicholas Piggin <npiggin@gmail.com>
    powerpc/64s/radix: Fix mm_cpumask trimming race vs kthread_use_mm

Christophe Leroy <christophe.leroy@csgroup.eu>
    powerpc/kasan: Fix CONFIG_KASAN_VMALLOC for 8xx

Finn Thain <fthain@telegraphics.com.au>
    powerpc/tau: Disable TAU between measurements

Finn Thain <fthain@telegraphics.com.au>
    powerpc/tau: Check processor type before enabling TAU interrupt

Finn Thain <fthain@telegraphics.com.au>
    powerpc/tau: Remove duplicated set_thresholds() call

Finn Thain <fthain@telegraphics.com.au>
    powerpc/tau: Convert from timer to workqueue

Finn Thain <fthain@telegraphics.com.au>
    powerpc/tau: Use appropriate temperature sample interval

Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
    powerpc/book3s64/hash/4k: Support large linear mapping range with 4K

Ravi Bangoria <ravi.bangoria@linux.ibm.com>
    powerpc/watchpoint: Add hw_len wherever missing

Ravi Bangoria <ravi.bangoria@linux.ibm.com>
    powerpc/watchpoint: Fix handling of vector instructions

Ravi Bangoria <ravi.bangoria@linux.ibm.com>
    powerpc/watchpoint: Fix quadword instruction handling on p10 predecessors

Thiago Jung Bauermann <bauerman@linux.ibm.com>
    powerpc/pseries/svm: Allocate SWIOTLB buffer anywhere in memory

Michal Kalderon <michal.kalderon@marvell.com>
    RDMA/qedr: Fix inline size returned for iWARP

Michal Kalderon <michal.kalderon@marvell.com>
    RDMA/qedr: Fix return code if accept is called on a destroyed qp

Michal Kalderon <michal.kalderon@marvell.com>
    RDMA/qedr: Fix use of uninitialized field

Michal Kalderon <michal.kalderon@marvell.com>
    RDMA/qedr: Fix doorbell setting

Michal Kalderon <michal.kalderon@marvell.com>
    RDMA/qedr: Fix qp structure memory leak

Jason Gunthorpe <jgg@nvidia.com>
    RDMA/umem: Prevent small pages from being returned by ib_umem_find_best_pgsz()

Jason Gunthorpe <jgg@nvidia.com>
    RDMA/umem: Fix ib_umem_find_best_pgsz() for mappings that cross a page boundary

Leon Romanovsky <leon@kernel.org>
    RDMA: Allow fail of destroy CQ

Leon Romanovsky <leon@kernel.org>
    RDMA/core: Delete function indirection for alloc/free kernel CQ

Md Haris Iqbal <haris.iqbal@cloud.ionos.com>
    RDMA/rtrs-srv: Incorporate ib_register_client into rtrs server init

Darrick J. Wong <darrick.wong@oracle.com>
    xfs: fix high key handling in the rt allocator's query_range function

Scott Mayhew <smayhew@redhat.com>
    nfs: add missing "posix" local_lock constant table definition

Darrick J. Wong <darrick.wong@oracle.com>
    xfs: fix deadlock and streamline xfs_getfsmap performance

Darrick J. Wong <darrick.wong@oracle.com>
    xfs: limit entries returned when counting fsmap records

Matthew Wilcox (Oracle) <willy@infradead.org>
    ida: Free allocated bitmap in error path

Necip Fazil Yildiran <fazilyildiran@gmail.com>
    arc: plat-hsdk: fix kconfig dependency warning when !RESET_CONTROLLER

Greg Ungerer <gerg@linux-m68k.org>
    m68knommu: include SDHC support only when hardware has it

Dave Chinner <dchinner@redhat.com>
    xfs: fix finobt btree block recovery ordering

Guillaume Tucker <guillaume.tucker@collabora.com>
    ARM: 9007/1: l2c: fix prefetch bits init in L2X0_AUX_CTRL using DT values

Arnaldo Carvalho de Melo <acme@redhat.com>
    tools feature: Add missing -lzstd to the fast path feature detection

Arnaldo Carvalho de Melo <acme@redhat.com>
    perf tools: Make GTK2 support opt-in

Mark Tomlinson <mark.tomlinson@alliedtelesis.co.nz>
    mtd: mtdoops: Don't write panic data twice

Leon Romanovsky <leon@kernel.org>
    RDMA/mlx5: Fix potential race between destroy and CQE poll

Scott Cheloha <cheloha@linux.ibm.com>
    pseries/drmem: don't cache node id in drmem_lmb struct

Nathan Lynch <nathanl@linux.ibm.com>
    powerpc/pseries: explicitly reschedule during drmem_lmb list traversal

Jason Gunthorpe <jgg@nvidia.com>
    RDMA/umem: Fix signature of stub ib_umem_find_best_pgsz()

Lang Cheng <chenglang@huawei.com>
    RDMA/hns: Add a check for current state before modifying QP

Arnd Bergmann <arnd@arndb.de>
    mtd: lpddr: fix excessive stack usage with clang

Jason Gunthorpe <jgg@nvidia.com>
    RDMA/ucma: Add missing locking around rdma_leave_multicast()

Jason Gunthorpe <jgg@nvidia.com>
    RDMA/ucma: Fix locking for ctx->events_reported

Paul E. McKenney <paulmck@kernel.org>
    rcutorture: Properly set rcu_fwds for OOM handling

Neeraj Upadhyay <neeraju@codeaurora.org>
    rcu/tree: Force quiescent state on callback overload

Nicholas Mc Guire <hofrat@osadl.org>
    powerpc/icp-hv: Fix missing of_node_put() in success path

Nicholas Mc Guire <hofrat@osadl.org>
    powerpc/pseries: Fix missing of_node_put() in rng_init()

Håkon Bugge <haakon.bugge@oracle.com>
    IB/mlx4: Adjust delayed work when a dup is observed

Håkon Bugge <haakon.bugge@oracle.com>
    IB/mlx4: Fix starvation in paravirt mux/demux

Parshuram Thombare <pthombar@cadence.com>
    i3c: master add i3c_master_attach_boardinfo to preserve boardinfo

Tom Zanussi <zanussi@kernel.org>
    tracing: Handle synthetic event array field type checking correctly

Tom Zanussi <zanussi@kernel.org>
    selftests/ftrace: Change synthetic event name for inter-event-combined test

Andrii Nakryiko <andrii@kernel.org>
    fs: fix NULL dereference due to data race in prepend_path()

Suren Baghdasaryan <surenb@google.com>
    mm, oom_adj: don't loop through tasks in __set_oom_adj when not necessary

Ralph Campbell <rcampbell@nvidia.com>
    mm/memcg: fix device private memcg accounting

Miaohe Lin <linmiaohe@huawei.com>
    mm/swapfile.c: fix potential memory leak in sys_swapon

Pablo Neira Ayuso <pablo@netfilter.org>
    netfilter: nf_log: missing vlan offload tag and proto

Valentin Vidic <vvidic@valentin-vidic.from.hr>
    net: korina: fix kfree of rx/tx descriptor array

John Fastabend <john.fastabend@gmail.com>
    bpf, sockmap: Remove skb_orphan and let normal skb_kfree do cleanup

Julian Anastasov <ja@ssi.bg>
    ipvs: clear skb->tstamp in forwarding path

Christian Hewitt <christianshewitt@gmail.com>
    drm/panfrost: increase readl_relaxed_poll_timeout values

Tom Rix <trix@redhat.com>
    mwifiex: fix double free

Vadim Pasternak <vadimp@nvidia.com>
    platform/x86: mlx-platform: Remove PSU EEPROM configuration

Tom Zanussi <zanussi@kernel.org>
    tracing: Fix parse_synth_field() error handling

Tianjia Zhang <tianjia.zhang@linux.alibaba.com>
    ipmi_si: Fix wrong return value in try_smi_init()

Logan Gunthorpe <logang@deltatee.com>
    dmaengine: ioat: Allocate correct size for descriptor chunk

Dan Carpenter <dan.carpenter@oracle.com>
    scsi: be2iscsi: Fix a theoretical leak in beiscsi_create_eqs()

John Donnelly <john.p.donnelly@oracle.com>
    scsi: target: tcmu: Fix warning: 'page' may be used uninitialized

Minas Harutyunyan <Minas.Harutyunyan@synopsys.com>
    usb: dwc2: Fix INTR OUT transfers in DDMA mode.

Johannes Berg <johannes.berg@intel.com>
    nl80211: fix non-split wiphy information

Necip Fazil Yildiran <fazilyildiran@gmail.com>
    ocxl: fix kconfig dependency warning for OCXL

Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
    bus: mhi: core: Fix the building of MHI module

Lorenzo Colitti <lorenzo@google.com>
    usb: gadget: u_ether: enable qmult on SuperSpeed Plus as well

Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
    usb: gadget: u_serial: clear suspended flag when disconnecting

Lorenzo Colitti <lorenzo@google.com>
    usb: gadget: f_ncm: fix ncm_bitrate for SuperSpeed and above.

Mordechay Goodstein <mordechay.goodstein@intel.com>
    iwlwifi: dbg: run init_cfg function once per driver load

Mordechay Goodstein <mordechay.goodstein@intel.com>
    iwlwifi: dbg: remove no filter condition

Emmanuel Grumbach <emmanuel.grumbach@intel.com>
    iwlwifi: mvm: split a print to avoid a WARNING in ROC

Adam Brickman <Adam.Brickman@cirrus.com>
    ASoC: wm_adsp: Pass full name to snd_ctl_notify

Dan Carpenter <dan.carpenter@oracle.com>
    mfd: sm501: Fix leaks in probe()

Thomas Gleixner <tglx@linutronix.de>
    net: enic: Cure the enic api locking trainwreck

Fabrice Gasnier <fabrice.gasnier@st.com>
    iio: adc: stm32-adc: fix runtime autosuspend delay when slow polling

Yu Kuai <yukuai3@huawei.com>
    iommu/qcom: add missing put_device() call in qcom_iommu_of_xlate()

Andrew Jeffery <andrew@aj.id.au>
    pinctrl: aspeed: Use the right pinconf mask

Colin Ian King <colin.king@canonical.com>
    qtnfmac: fix resource leaks on unsupported iftype error return path

Toke Høiland-Jørgensen <toke@redhat.com>
    selftests: Remove fmod_ret from test_overhead

Toke Høiland-Jørgensen <toke@redhat.com>
    bpf: disallow attaching modify_return tracing functions to other BPF programs

Lijun Pan <ljp@linux.ibm.com>
    ibmvnic: set up 200GBPS speed

Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
    coresight: etm4x: Fix save and restore of TRCVMIDCCTLR1 register

Mike Leach <mike.leach@linaro.org>
    coresight: cti: Fix bug clearing sysfs links on callback

Mike Leach <mike.leach@linaro.org>
    coresight: cti: Fix remove sysfs link error

Tingwei Zhang <tingwei@codeaurora.org>
    coresight: etm: perf: Fix warning caused by etm_setup_aux failure

Matthew Wilcox (Oracle) <willy@infradead.org>
    iomap: Use kzalloc to allocate iomap_page

Rajkumar Manoharan <rmanohar@codeaurora.org>
    nl80211: fix OBSS PD min and max offset validation

Mohammed Gamal <mgamal@redhat.com>
    hv: clocksource: Add notrace attribute to read_hv_sched_clock_*() functions

Vadym Kochan <vadym.kochan@plvision.eu>
    nvmem: core: fix possibly memleak when use nvmem_cell_info_to_nvmem_cell()

Yang Yingliang <yangyingliang@huawei.com>
    tty: hvc: fix link error with CONFIG_SERIAL_CORE_CONSOLE=n

Dmitry Torokhov <dmitry.torokhov@gmail.com>
    HID: hid-input: fix stylus battery reporting

Shengjiu Wang <shengjiu.wang@nxp.com>
    ASoC: fsl_sai: Instantiate snd_soc_dai_driver

Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
    slimbus: qcom-ngd-ctrl: disable ngd in qmi server down callback

Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
    slimbus: core: do not enter to clock pause mode in core

Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
    slimbus: core: check get_addr before removing laddr ida

Eric Dumazet <edumazet@google.com>
    quota: clear padding in v2r1_mem2diskdqb()

Lorenzo Bianconi <lorenzo@kernel.org>
    mt76: mt7915: fix possible memory leak in mt7915_mcu_add_beacon

Andreas Färber <afaerber@suse.de>
    rtw88: Fix potential probe error handling race with wow firmware loading

Andreas Färber <afaerber@suse.de>
    rtw88: Fix probe error handling race with firmware loading

Martin Blumenstingl <martin.blumenstingl@googlemail.com>
    usb: dwc2: Add missing cleanups when usb_add_gadget_udc() fails

Thinh Nguyen <Thinh.Nguyen@synopsys.com>
    usb: dwc3: core: Properly default unspecified speed

Nathan Chancellor <natechancellor@gmail.com>
    usb: dwc2: Fix parameter type in function pointer prototype

Takashi Iwai <tiwai@suse.de>
    ALSA: seq: oss: Avoid mutex lock for a long-time ioctl

Souptick Joarder <jrdr.linux@gmail.com>
    misc: mic: scif: Fix error handling path

Necip Fazil Yildiran <fazilyildiran@gmail.com>
    ASoC: cros_ec_codec: fix kconfig dependency warning for SND_SOC_CROS_EC_CODEC

Andy Shevchenko <andriy.shevchenko@linux.intel.com>
    dmaengine: dmatest: Check list for emptiness before access its last entry

Tomasz Figa <tfiga@chromium.org>
    phy: rockchip-dphy-rx0: Include linux/delay.h

Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
    drm: rcar-du: Put reference to VSP device

Dan Carpenter <dan.carpenter@oracle.com>
    ath6kl: wmi: prevent a shift wrapping bug in ath6kl_wmi_delete_pstream_cmd()

Bo YU <tsu.yubo@gmail.com>
    ath11k: Add checked value for ath11k_ahb_remove

Aswath Govindraju <a-govindraju@ti.com>
    spi: omap2-mcspi: Improve performance waiting for CHSTAT

Dan Murphy <dmurphy@ti.com>
    ASoC: tas2770: Fix unbalanced calls to pm_runtime

Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
    ASoC: SOF: control: add size checks for ext_bytes control .put()

Linus Walleij <linus.walleij@linaro.org>
    net: dsa: rtl8366rb: Support all 4096 VLANs

Miquel Raynal <miquel.raynal@bootlin.com>
    ASoC: tlv320aic32x4: Fix bdiv clock rate derivation

Dan Murphy <dmurphy@ti.com>
    ASoC: tas2770: Fix error handling with update_bits

Dan Murphy <dmurphy@ti.com>
    ASoC: tas2770: Fix required DT properties in the code

Dan Murphy <dmurphy@ti.com>
    ASoC: tas2770: Add missing bias level power states

Dan Murphy <dmurphy@ti.com>
    ASoC: tas2770: Fix calling reset in probe

Huang Guobin <huangguobin4@huawei.com>
    net: wilc1000: clean up resource in error path of init mon interface

Linus Walleij <linus.walleij@linaro.org>
    net: dsa: rtl8366: Skip PVID setting if not requested

Linus Walleij <linus.walleij@linaro.org>
    net: dsa: rtl8366: Refactor VLAN/PVID init

Linus Walleij <linus.walleij@linaro.org>
    net: dsa: rtl8366: Check validity of passed VLANs

Mathias Nyman <mathias.nyman@linux.intel.com>
    xhci: don't create endpoint debugfs entry before ring buffer is set.

Ilya Leoshkevich <iii@linux.ibm.com>
    selftests/bpf: Fix endianness issue in test_sockopt_sk

Ilya Leoshkevich <iii@linux.ibm.com>
    selftests/bpf: Fix endianness issue in sk_assign

Matthieu Baerts <matthieu.baerts@tessares.net>
    selftests: mptcp: interpret \n as a new line

Vadym Kochan <vadym.kochan@plvision.eu>
    nvmem: core: fix missing of_node_put() in of_nvmem_device_get()

Jonathan Zhou <jonathan.zhouwen@huawei.com>
    coresight: etm4x: Fix issues on trcseqevr access

Suzuki K Poulose <suzuki.poulose@arm.com>
    coresight: etm4x: Handle unreachable sink in perf mode

Tingwei Zhang <tingwei@codeaurora.org>
    coresight: cti: Write regsiters directly in cti_enable_hw()

Jonathan Zhou <jonathan.zhouwen@huawei.com>
    coresight: etm4x: Fix issues within reset interface of sysfs

Mike Leach <mike.leach@linaro.org>
    coresight: etm4x: Ensure default perf settings filter user/kernel

Tingwei Zhang <tingwei@codeaurora.org>
    coresight: cti: remove pm_runtime_get_sync() from CPU hotplug

Tingwei Zhang <tingwei@codeaurora.org>
    coresight: cti: disclaim device only when it's claimed

Mian Yousaf Kaukab <ykaukab@suse.de>
    coresight: fix offset by one error in counting ports

Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
    coresight: etm4x: Fix etm4_count race by moving cpuhp callbacks to init

Camel Guo <camelg@axis.com>
    ASoC: tlv320adcx140: Fix digital gain range

Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
    ASoC: topology: disable size checks for bytes_ext controls if needed

KP Singh <kpsingh@google.com>
    ima: Fix NULL pointer dereference in ima_file_hash

Stefan Agner <stefan@agner.ch>
    drm: mxsfb: check framebuffer pitch

Pali Rohár <pali@kernel.org>
    cpufreq: armada-37xx: Add missing MODULE_DEVICE_TABLE

Darrick J. Wong <darrick.wong@oracle.com>
    xfs: force the log after remapping a synchronous-writes file

Ong Boon Leong <boon.leong.ong@intel.com>
    net: stmmac: use netif_tx_start|stop_all_queues() function

Aashish Verma <aashishx.verma@intel.com>
    net: stmmac: Fix incorrect location to set real_num_rx|tx_queues

Tomas Henzl <thenzl@redhat.com>
    scsi: mpt3sas: Fix sync irqs

Eran Ben Elisha <eranbe@mellanox.com>
    net/mlx5: Don't call timecounter cyc2time directly from 1PPS flow

Moshe Tal <moshet@mellanox.com>
    net/mlx5: Fix uninitialized variable warning

Luca Weiss <luca@z3ntu.xyz>
    drm/msm/adreno: fix probe without iommu

Thierry Reding <treding@nvidia.com>
    pinctrl: devicetree: Keep deferring even on timeout

Thomas Preston <thomas.preston@codethink.co.uk>
    pinctrl: mcp23s08: Fix mcp23x17 precious range

Thomas Preston <thomas.preston@codethink.co.uk>
    pinctrl: mcp23s08: Fix mcp23x17_regmap initialiser

Abhishek Pandit-Subedi <abhishekpandit@chromium.org>
    Bluetooth: Re-order clearing suspend tasks

Kees Cook <keescook@chromium.org>
    selftests/lkdtm: Use "comm" instead of "diff" for dmesg

Matthew Wilcox (Oracle) <willy@infradead.org>
    iomap: Mark read blocks uptodate in write_begin

Matthew Wilcox (Oracle) <willy@infradead.org>
    iomap: Clear page error before beginning a write

Steven Price <steven.price@arm.com>
    drm/panfrost: Ensure GPU quirks are always initialised

Stephen Boyd <swboyd@chromium.org>
    drm/msm: Avoid div-by-zero in dpu_crtc_atomic_check()

Dan Carpenter <dan.carpenter@oracle.com>
    HID: roccat: add bounds checking in kone_sysfs_write_settings()

Stanley Chu <stanley.chu@mediatek.com>
    scsi: ufs: ufs-mediatek: Fix HOST_PA_TACTIVATE quirk

Yu Kuai <yukuai3@huawei.com>
    ASoC: fsl: imx-es8328: add missing put_device() call in imx_es8328_probe()

Dinghao Liu <dinghao.liu@zju.edu.cn>
    video: fbdev: radeon: Fix memleak in radeonfb_pci_register

Tom Rix <trix@redhat.com>
    video: fbdev: sis: fix null ptr dereference

Colin Ian King <colin.king@canonical.com>
    video: fbdev: vga16fb: fix setting of pixclock because a pass-by-value error

Tom Rix <trix@redhat.com>
    ath11k: fix a double free and a memory leak

Souptick Joarder <jrdr.linux@gmail.com>
    drivers/virt/fsl_hypervisor: Fix error handling path

Hans de Goede <hdegoede@redhat.com>
    pwm: lpss: Add range limit check for the base_unit register value

Hans de Goede <hdegoede@redhat.com>
    pwm: lpss: Fix off by one error in base_unit math in pwm_lpss_prepare()

Artem Savkov <asavkov@redhat.com>
    pty: do tty_flip_buffer_push without port->lock in pty_write

Tyrel Datwyler <tyreld@linux.ibm.com>
    tty: hvcs: Don't NULL tty->driver_data until hvcs_cleanup()

Tong Zhang <ztong0001@gmail.com>
    tty: serial: earlycon dependency

Jann Horn <jannh@google.com>
    binder: Remove bogus warning on failed same-process transaction

Eric Biggers <ebiggers@google.com>
    scsi: ufs: Make ufshcd_print_trs() consider UFSHCD_QUIRK_PRDT_BYTE_GRAN

Anatoly Pugachev <matorola@gmail.com>
    selftests: vm: add fragment CONFIG_GUP_BENCHMARK

Abhishek Pandit-Subedi <abhishekpandit@chromium.org>
    Bluetooth: Clear suspend tasks on unregister

Dinghao Liu <dinghao.liu@zju.edu.cn>
    drm/crc-debugfs: Fix memleak in crc_control_write

Weqaar Janjua <weqaar.a.janjua@intel.com>
    samples/bpf: Fix to xdpsock to avoid recycling frames

Laurent Pinchart <laurent.pinchart@ideasonboard.com>
    drm: panel: Fix bpc for OrtusTech COM43H4M85ULC panel

Alexei Starovoitov <ast@kernel.org>
    mm/error_inject: Fix allow_error_inject function signatures.

Alex Dewar <alex.dewar90@gmail.com>
    VMCI: check return value of get_user_pages_fast() for errors

Alex Dewar <alex.dewar90@gmail.com>
    staging: emxx_udc: Fix passing of NULL to dma_alloc_coherent()

dinghao.liu@zju.edu.cn <dinghao.liu@zju.edu.cn>
    backlight: sky81452-backlight: Fix refcount imbalance on error

Brian Norris <briannorris@chromium.org>
    rtw88: don't treat NULL pointer as an array

Dinghao Liu <dinghao.liu@zju.edu.cn>
    wilc1000: Fix memleak in wilc_bus_probe

Dinghao Liu <dinghao.liu@zju.edu.cn>
    wilc1000: Fix memleak in wilc_sdio_probe

Alex Gartrell <alexgartrell@gmail.com>
    libbpf: Fix unintentional success return code in bpf_object__load

Tianjia Zhang <tianjia.zhang@linux.alibaba.com>
    scsi: csiostor: Fix wrong return value in csio_hw_prep_fw()

Tianjia Zhang <tianjia.zhang@linux.alibaba.com>
    scsi: qla2xxx: Fix wrong return value in qla_nvme_register_hba()

Tianjia Zhang <tianjia.zhang@linux.alibaba.com>
    scsi: qla2xxx: Fix wrong return value in qlt_chk_unresolv_exchg()

Christophe JAILLET <christophe.jaillet@wanadoo.fr>
    scsi: qla2xxx: Fix the size used in a 'dma_free_coherent()' call

Christophe JAILLET <christophe.jaillet@wanadoo.fr>
    scsi: qla4xxx: Fix an error handling path in 'qla4xxx_get_host_stats()'

Tom Rix <trix@redhat.com>
    drm/gma500: fix error check

Andrii Nakryiko <andriin@fb.com>
    selftests/bpf: Fix test_vmlinux test to use bpf_probe_read_user()

Colin Ian King <colin.king@canonical.com>
    drm/amd/display: fix potential integer overflow when shifting 32 bit variable bl_pwm

Christophe JAILLET <christophe.jaillet@wanadoo.fr>
    staging: rtl8192u: Do not use GFP_KERNEL in atomic context

Christophe JAILLET <christophe.jaillet@wanadoo.fr>
    mwifiex: Do not use GFP_KERNEL in atomic context

Tom Rix <trix@redhat.com>
    brcmfmac: check ndev pointer

Wang Yufen <wangyufen@huawei.com>
    ath11k: Fix possible memleak in ath11k_qmi_init_service

Rohit kumar <rohitkr@codeaurora.org>
    ASoC: qcom: lpass-cpu: fix concurrency issue

Rohit kumar <rohitkr@codeaurora.org>
    ASoC: qcom: lpass-platform: fix memory leak

Bryan O'Donoghue <bryan.odonoghue@linaro.org>
    wcn36xx: Fix reported 802.11n rx_highest rate wcn3660/wcn3680

Christophe JAILLET <christophe.jaillet@wanadoo.fr>
    ath10k: Fix the size used in a 'dma_free_coherent()' call in an error handling path

Dan Carpenter <dan.carpenter@oracle.com>
    ath9k: Fix potential out of bounds in ath9k_htc_txcompletion_cb()

Dan Carpenter <dan.carpenter@oracle.com>
    ath6kl: prevent potential array overflow in ath6kl_add_new_sta()

Laurent Pinchart <laurent.pinchart@ideasonboard.com>
    drm: panel: Fix bus format for OrtusTech COM43H4M85ULC panel

Qinglang Miao <miaoqinglang@huawei.com>
    drm/vkms: add missing platform_device_unregister() in vkms_init()

Qinglang Miao <miaoqinglang@huawei.com>
    drm/vgem: add missing platform_device_unregister() in vgem_init()

Tianjia Zhang <tianjia.zhang@linux.alibaba.com>
    drm/amd/display: Fix wrong return value in dm_update_plane_state()

Samuel Holland <samuel@sholland.org>
    Bluetooth: hci_uart: Cancel init work before unregistering

Melissa Wen <melissa.srw@gmail.com>
    drm/vkms: fix xrgb on compute crc

Venkateswara Naralasetty <vnaralas@codeaurora.org>
    ath10k: provide survey info as accumulated data

Yang Yang <yang.yang@vivo.com>
    blk-mq: move cancel of hctx->run_work to the front of blk_exit_queue

Qu Wenruo <wqu@suse.com>
    btrfs: add owner and fs_info to alloc_state io_tree

Serge Semin <Sergey.Semin@baikalelectronics.ru>
    hwmon: (bt1-pvt) Wait for the completion with timeout

Serge Semin <Sergey.Semin@baikalelectronics.ru>
    hwmon: (bt1-pvt) Cache current update timeout

Serge Semin <Sergey.Semin@baikalelectronics.ru>
    hwmon: (bt1-pvt) Test sensor power supply on probe

Łukasz Stelmach <l.stelmach@samsung.com>
    spi: spi-s3c64xx: Check return values

Łukasz Stelmach <l.stelmach@samsung.com>
    spi: spi-s3c64xx: swap s3c64xx_spi_set_cs() and s3c64xx_enable_datapath()

Necip Fazil Yildiran <fazilyildiran@gmail.com>
    pinctrl: bcm: fix kconfig dependency warning when !GPIOLIB

Michał Mirosław <mirq-linux@rere.qmqm.pl>
    regulator: resolve supply after creating regulator

Qiushi Wu <wu000273@umn.edu>
    media: ti-vpe: Fix a missing check and reference count leak

Qiushi Wu <wu000273@umn.edu>
    media: stm32-dcmi: Fix a reference count leak

Qiushi Wu <wu000273@umn.edu>
    media: s5p-mfc: Fix a reference count leak

Qiushi Wu <wu000273@umn.edu>
    media: camss: Fix a reference count leak.

Qiushi Wu <wu000273@umn.edu>
    media: platform: fcp: Fix a reference count leak.

Qiushi Wu <wu000273@umn.edu>
    media: rockchip/rga: Fix a reference count leak.

Qiushi Wu <wu000273@umn.edu>
    media: rcar-vin: Fix a reference count leak.

Tom Rix <trix@redhat.com>
    media: tc358743: cleanup tc358743_cec_isr

Tom Rix <trix@redhat.com>
    media: tc358743: initialize variable

Dinghao Liu <dinghao.liu@zju.edu.cn>
    media: mx2_emmaprp: Fix memleak in emmaprp_probe

Corentin Labbe <clabbe@baylibre.com>
    crypto: sun8i-ce - handle endianness of t_common_ctl

Nicolas Toromanoff <nicolas.toromanoff@st.com>
    crypto: stm32/crc32 - Avoid lock if hardware is already used

Xiaoliang Pang <dawning.pang@gmail.com>
    cypto: mediatek - fix leaks in mtk_desc_ring_alloc

Dan Carpenter <dan.carpenter@oracle.com>
    hwmon: (w83627ehf) Fix a resource leak in probe

Guenter Roeck <linux@roeck-us.net>
    hwmon: (pmbus/max34440) Fix status register reads for MAX344{51,60,61}

Tero Kristo <t-kristo@ti.com>
    crypto: omap-sham - fix digcnt register handling with export/import

Jay Fang <f.fangjian@huawei.com>
    spi: dw-pci: free previously allocated IRQs if desc->setup() fails

Eddie James <eajames@linux.ibm.com>
    spi: fsi: Implement restricted size for certain controllers

Brad Bishop <bradleyb@fuzziesquirrel.com>
    spi: fsi: Fix use of the bneq+ sequencer instruction

Brad Bishop <bradleyb@fuzziesquirrel.com>
    spi: fsi: Handle 9 to 15 byte transfers lengths

Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
    media: rcar-csi2: Allocate v4l2_async_subdev dynamically

Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
    media: rcar_drif: Allocate v4l2_async_subdev dynamically

Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
    media: rcar_drif: Fix fwnode reference leak when parsing DT

Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
    media: i2c: ov5640: Enable data pins on poweron for DVP mode

Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
    media: i2c: ov5640: Separate out mipi configuration from s_power

Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
    media: i2c: ov5640: Remain in power down for DVP mode unless streaming

Dinghao Liu <dinghao.liu@zju.edu.cn>
    media: omap3isp: Fix memleak in isp_probe

Christophe JAILLET <christophe.jaillet@wanadoo.fr>
    media: staging/intel-ipu3: css: Correctly reset some memory

Laurent Pinchart <laurent.pinchart@ideasonboard.com>
    media: uvcvideo: Silence shift-out-of-bounds warning

Laurent Pinchart <laurent.pinchart@ideasonboard.com>
    media: uvcvideo: Set media controller entity functions

Eric Biggers <ebiggers@google.com>
    fscrypt: restrict IV_INO_LBLK_32 to ino_bits <= 32

Tom Rix <trix@redhat.com>
    media: m5mols: Check function pointer in m5mols_sensor_power

Paul Kocialkowski <paul.kocialkowski@bootlin.com>
    media: ov5640: Correct Bit Div register in clock tree diagram

Ezequiel Garcia <ezequiel@collabora.com>
    media: hantro: postproc: Fix motion vector space allocation

Ezequiel Garcia <ezequiel@collabora.com>
    media: hantro: h264: Get the correct fallback reference buffer

Sylwester Nawrocki <s.nawrocki@samsung.com>
    media: Revert "media: exynos4-is: Add missed check for pinctrl_lookup_state()"

dinghao.liu@zju.edu.cn <dinghao.liu@zju.edu.cn>
    crypto: ccree - fix runtime PM imbalance on error

Tom Rix <trix@redhat.com>
    media: tuner-simple: fix regression in simple_set_radio_freq

Peilin Ye <yepeilin.cs@gmail.com>
    media: vivid: Fix global-out-of-bounds read in precalculate_color()

Madhuparna Bhowmik <madhuparnabhowmik10@gmail.com>
    crypto: picoxcell - Fix potential race condition bug

Christophe JAILLET <christophe.jaillet@wanadoo.fr>
    crypto: ixp4xx - Fix the size used in a 'dma_free_coherent()' call

Tianjia Zhang <tianjia.zhang@linux.alibaba.com>
    crypto: mediatek - Fix wrong return value in mtk_desc_ring_alloc()

Herbert Xu <herbert@gondor.apana.org.au>
    crypto: algif_skcipher - EBUSY on aio should be an error

Jiri Olsa <jolsa@redhat.com>
    perf/core: Fix race in the perf_mmap_close() function

Sasha Levin <sashal@kernel.org>
    perf/x86: Fix n_pair for cancelled txn

Maulik Shah <mkshah@codeaurora.org>
    pinctrl: qcom: Use return value from irq_set_wake() call

Maulik Shah <mkshah@codeaurora.org>
    pinctrl: qcom: Set IRQCHIP_SET_TYPE_MASKED and IRQCHIP_MASK_ON_SUSPEND flags

Colin Ian King <colin.king@canonical.com>
    x86/events/amd/iommu: Fix sizeof mismatch

Libing Zhou <libing.zhou@nokia-sbell.com>
    x86/nmi: Fix nmi_handle() duration miscalculation

Kan Liang <kan.liang@linux.intel.com>
    perf/x86/intel/uncore: Fix the scale of the IMC free-running events

Kan Liang <kan.liang@linux.intel.com>
    perf/x86/intel/uncore: Reduce the number of CBOX counters

Kan Liang <kan.liang@linux.intel.com>
    perf/x86/intel/uncore: Update Ice Lake uncore units

Alexandru Elisei <alexandru.elisei@arm.com>
    arm64: perf: Add missing ISB in armv8pmu_enable_counter()

Barry Song <song.bao.hua@hisilicon.com>
    sched/fair: Use dst group while checking imbalance for NUMA balancer

Xunlei Pang <xlpang@linux.alibaba.com>
    sched/fair: Fix wrong cpu selecting from isolated domain

Mark Salter <msalter@redhat.com>
    drivers/perf: thunderx2_pmu: Fix memory resource error handling

Mark Salter <msalter@redhat.com>
    drivers/perf: xgene_pmu: Fix uninitialized resource struct

Amit Daniel Kachhap <amit.kachhap@arm.com>
    arm64: kprobe: add checks for ARMv8.3-PAuth combined instructions

Arvind Sankar <nivedita@alum.mit.edu>
    x86/fpu: Allow multiple bits in clearcpuid= parameter

Kan Liang <kan.liang@linux.intel.com>
    perf/x86/intel/ds: Fix x86_pmu_stop warning for large PEBS

Krzysztof Kozlowski <krzk@kernel.org>
    EDAC/ti: Fix handling of platform_get_irq() error

Krzysztof Kozlowski <krzk@kernel.org>
    EDAC/aspeed: Fix handling of platform_get_irq() error

Dinghao Liu <dinghao.liu@zju.edu.cn>
    EDAC/i5100: Fix error handling order in i5100_init_one()

Randy Dunlap <rdunlap@infradead.org>
    microblaze: fix kbuild redundant file warning

Lukasz Luba <lukasz.luba@arm.com>
    sched/fair: Fix wrong negative conversion in find_energy_efficient_cpu()

Luca Stefani <luca.stefani.ge1@gmail.com>
    RAS/CEC: Fix cec_init() prototype

Andrei Botila <andrei.botila@nxp.com>
    crypto: caam/qi - add support for more XTS key lengths

Andrei Botila <andrei.botila@nxp.com>
    crypto: caam/qi - add fallback for XTS with more than 8B IV

Herbert Xu <herbert@gondor.apana.org.au>
    crypto: algif_aead - Do not set MAY_BACKLOG on the async path

Roberto Sassu <roberto.sassu@huawei.com>
    ima: Don't ignore errors from crypto_shash_update()

Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
    KVM: SVM: Initialize prev_ga_tag before use

Lai Jiangshan <laijs@linux.alibaba.com>
    KVM: x86: Intercept LA57 to inject #GP fault when it's reserved

Sean Christopherson <sean.j.christopherson@intel.com>
    KVM: x86/mmu: Commit zap of remaining invalid pages when recovering lpages

Sean Christopherson <sean.j.christopherson@intel.com>
    KVM: nVMX: Reload vmcs01 if getting vmcs12's pages fails

Sean Christopherson <sean.j.christopherson@intel.com>
    KVM: nVMX: Reset the segment cache when stuffing guest segs

Sean Christopherson <sean.j.christopherson@intel.com>
    KVM: nVMX: Morph notification vector IRQ on nested VM-Enter to pending PI

Marc Zyngier <maz@kernel.org>
    arm64: Make use of ARCH_WORKAROUND_1 even when KVM is not enabled

Steve French <stfrench@microsoft.com>
    smb3: fix stat when special device file and mounted with modefromsid

Steve French <stfrench@microsoft.com>
    smb3: do not try to cache root directory if dir leases not supported

Steve French <stfrench@microsoft.com>
    SMB3.1.1: Fix ids returned in POSIX query dir

Rohith Surabattula <rohiths@microsoft.com>
    SMB3: Resolve data corruption of TCP server info fields

Shyam Prasad N <sprasad@microsoft.com>
    cifs: Return the error from crypt_message when enc/dec key not found.

Dan Carpenter <dan.carpenter@oracle.com>
    cifs: remove bogus debug code

Jian-Hong Pan <jhp@endlessos.org>
    ALSA: hda/realtek: Enable audio jacks of ASUS D700SA with ALC887

Qiu Wenbo <qiuwenbo@kylinos.com.cn>
    ALSA: hda/realtek - Add mute Led support for HP Elitebook 845 G7

Hui Wang <hui.wang@canonical.com>
    ALSA: hda/realtek - set mic to auto detect on a HP AIO machine

Jeremy Szu <jeremy.szu@canonical.com>
    ALSA: hda/realtek - The front Mic on a HP machine doesn't work

Lukasz Halman <lukasz.halman@gmail.com>
    ALSA: usb-audio: Line6 Pod Go interface requires static clock rate quirk

Hui Wang <hui.wang@canonical.com>
    ALSA: hda - Fix the return value if cb func is already registered

Hui Wang <hui.wang@canonical.com>
    ALSA: hda - Don't register a cb func if it is registered already

Guillaume Nault <gnault@redhat.com>
    net/sched: act_gate: Unlock ->tcfa_lock in tc_setup_flow_action()

Bartosz Golaszewski <bgolaszewski@baylibre.com>
    net: ethernet: mtk-star-emac: select REGMAP_MMIO

Neal Cardwell <ncardwell@google.com>
    tcp: fix to update snd_wl1 in bulk receiver fast path

Po-Hsu Lin <po-hsu.lin@canonical.com>
    selftests: rtnetlink: load fou module for kci_test_encap_fou() test

Ido Schimmel <idosch@nvidia.com>
    selftests: forwarding: Add missing 'rp_filter' configuration

Heiner Kallweit <hkallweit1@gmail.com>
    r8169: fix operation under forced interrupt threading

Defang Bo <bodefang@126.com>
    nfc: Ensure presence of NFC_ATTR_FIRMWARE_NAME attribute in nfc_genl_fw_download()

Ido Schimmel <idosch@nvidia.com>
    nexthop: Fix performance regression in nexthop deletion

Davide Caratti <dcaratti@redhat.com>
    net/sched: act_tunnel_key: fix OOB write in case of IPv6 ERSPAN tunnels

Roi Dayan <roid@nvidia.com>
    net/sched: act_ct: Fix adding udp port mangle operation

Ke Li <keli@akamai.com>
    net: Properly typecast int values to set sk_max_pacing_rate

Xie He <xie.he.0141@gmail.com>
    net: hdlc_raw_eth: Clear the IFF_TX_SKB_SHARING flag after calling ether_setup

Xie He <xie.he.0141@gmail.com>
    net: hdlc: In hdlc_rcv, check to make sure dev is an HDLC device

Dylan Hung <dylan_hung@aspeedtech.com>
    net: ftgmac100: Fix Aspeed ast2600 TX hang issue

Geliang Tang <geliangtang@gmail.com>
    mptcp: initialize mptcp_options_received's ahmac

Eric Dumazet <edumazet@google.com>
    icmp: randomize the global rate limiter

Lijun Pan <ljp@linux.ibm.com>
    ibmvnic: save changed mac address to adapter->mac_addr

Vinay Kumar Yadav <vinay.yadav@chelsio.com>
    chelsio/chtls: fix writing freed memory

Vinay Kumar Yadav <vinay.yadav@chelsio.com>
    chelsio/chtls: correct function return and return type

Vinay Kumar Yadav <vinay.yadav@chelsio.com>
    chelsio/chtls: Fix panic when listen on multiadapter

Vinay Kumar Yadav <vinay.yadav@chelsio.com>
    chelsio/chtls: fix panic when server is on ipv6

Vinay Kumar Yadav <vinay.yadav@chelsio.com>
    chelsio/chtls: correct netdevice for vlan interface

Vinay Kumar Yadav <vinay.yadav@chelsio.com>
    chelsio/chtls: fix socket lock

Hoang Huu Le <hoang.h.le@dektech.com.au>
    tipc: fix incorrect setting window for bcast link

Hoang Huu Le <hoang.h.le@dektech.com.au>
    tipc: re-configure queue limit for broadcast link

Kai Vehmanen <kai.vehmanen@linux.intel.com>
    ALSA: hda/hdmi: fix incorrect locking in hdmi_pcm_close

Kai Vehmanen <kai.vehmanen@linux.intel.com>
    ALSA: hda: fix jack detection with Realtek codecs when in D3

Dan Carpenter <dan.carpenter@oracle.com>
    ALSA: bebob: potential info leak in hwdep_read()

Todd Kjos <tkjos@google.com>
    binder: fix UAF when releasing todo list

Heiner Kallweit <hkallweit1@gmail.com>
    r8169: fix data corruption issue on RTL8402

Cong Wang <xiyou.wangcong@gmail.com>
    net_sched: remove a redundant goto chain check

Maciej Żenczykowski <maze@google.com>
    net/ipv4: always honour route mtu during forwarding

Marc Kleine-Budde <mkl@pengutronix.de>
    net: j1939: j1939_session_fresh_new(): fix missing initialization of skbcnt

Cong Wang <xiyou.wangcong@gmail.com>
    can: j1935: j1939_tp_tx_dat_new(): fix missing initialization of skbcnt

Lucas Stach <l.stach@pengutronix.de>
    can: m_can_platform: don't call m_can_class_suspend in runtime suspend

Christian Eggers <ceggers@arri.de>
    socket: don't clear SOCK_TSTAMP_NEW when SO_TIMESTAMPNS is disabled

Christian Eggers <ceggers@arri.de>
    socket: fix option SO_TIMESTAMPING_NEW

Cong Wang <xiyou.wangcong@gmail.com>
    tipc: fix the skb_unshare() in tipc_buf_append()

Wilken Gottwalt <wilken.gottwalt@mailbox.org>
    net: usb: qmi_wwan: add Cellient MPL200 card

Rohit Maheshwari <rohitm@chelsio.com>
    net/tls: sendfile fails with ktls offload

Karsten Graul <kgraul@linux.ibm.com>
    net/smc: fix valid DMBE buffer sizes

Karsten Graul <kgraul@linux.ibm.com>
    net/smc: fix use-after-free of delayed events

Leon Romanovsky <leonro@nvidia.com>
    net: sched: Fix suspicious RCU usage while accessing tcf_tunnel_info

Davide Caratti <dcaratti@redhat.com>
    net: mptcp: make DACK4/DACK8 usage consistent among all subflows

Alex Elder <elder@linaro.org>
    net: ipa: skip suspend/resume activities if not set up

Yonghong Song <yhs@fb.com>
    net: fix pos incrementment in ipv6_route_seq_next

Marek Vasut <marex@denx.de>
    net: fec: Fix PHY init after phy_reset_after_clk_enable()

Marek Vasut <marex@denx.de>
    net: fec: Fix phy_device lookup for phy_reset_after_clk_enable()

Christian Eggers <ceggers@arri.de>
    net: dsa: microchip: fix race condition

Jonathan Lemon <bsd@fb.com>
    mlx4: handle non-napi callers to napi_poll

David Ahern <dsahern@kernel.org>
    ipv4: Restore flowi4_oif update before call to xfrm_lookup_route

David Wilder <dwilder@us.ibm.com>
    ibmveth: Identify ingress large send packets.

David Wilder <dwilder@us.ibm.com>
    ibmveth: Switch order of ibmveth_helper calls.

Herat Ramani <herat@chelsio.com>
    xgb4: handle 4-tuple PEDIT to NAT mode translation


-------------

Diffstat:

 Documentation/admin-guide/kernel-parameters.txt    |   2 +-
 .../crypto/allwinner,sun4i-a10-crypto.yaml         |   7 +-
 .../devicetree/bindings/net/socionext-netsec.txt   |   4 +-
 Documentation/networking/ip-sysctl.rst             |   4 +-
 Makefile                                           |   4 +-
 arch/arc/plat-hsdk/Kconfig                         |   1 +
 arch/arm/boot/dts/imx6sl.dtsi                      |   2 +
 arch/arm/boot/dts/iwg20d-q7-common.dtsi            |  15 +-
 arch/arm/boot/dts/meson8.dtsi                      |   2 -
 arch/arm/boot/dts/owl-s500.dtsi                    |   6 +-
 arch/arm/boot/dts/stm32mp157c-lxa-mc1.dts          |   2 -
 arch/arm/boot/dts/stm32mp15xx-dhcom-pdk2.dtsi      |  35 +--
 arch/arm/boot/dts/stm32mp15xx-dhcom-som.dtsi       |  38 ++-
 arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi |   6 +-
 arch/arm/boot/dts/sun8i-r40-bananapi-m2-ultra.dts  |  10 +-
 arch/arm/mach-at91/pm.c                            |   1 +
 arch/arm/mach-omap2/cpuidle44xx.c                  |   4 +-
 arch/arm/mach-s3c24xx/mach-at2440evb.c             |   2 +-
 arch/arm/mach-s3c24xx/mach-h1940.c                 |   4 +-
 arch/arm/mach-s3c24xx/mach-mini2440.c              |   4 +-
 arch/arm/mach-s3c24xx/mach-n30.c                   |   4 +-
 arch/arm/mach-s3c24xx/mach-rx1950.c                |   4 +-
 arch/arm/mm/cache-l2x0.c                           |  16 +-
 arch/arm64/boot/dts/actions/s700.dtsi              |   2 +-
 arch/arm64/boot/dts/allwinner/sun50i-h5.dtsi       |   6 +-
 arch/arm64/boot/dts/amlogic/meson-khadas-vim3.dtsi |   4 +-
 arch/arm64/boot/dts/freescale/imx8mq.dtsi          |   1 +
 arch/arm64/boot/dts/mediatek/mt8173-elm.dtsi       |   5 +-
 arch/arm64/boot/dts/qcom/msm8916.dtsi              |  10 +-
 arch/arm64/boot/dts/qcom/pm8916.dtsi               |   2 +-
 arch/arm64/boot/dts/qcom/sc7180.dtsi               |   6 +-
 arch/arm64/boot/dts/renesas/r8a774c0.dtsi          |   5 +-
 arch/arm64/boot/dts/renesas/r8a77990.dtsi          |   5 +-
 arch/arm64/boot/dts/xilinx/zynqmp.dtsi             |   4 +-
 arch/arm64/include/asm/insn.h                      |   4 +
 arch/arm64/include/asm/memory.h                    |   5 +-
 arch/arm64/include/asm/pgtable.h                   |   4 +-
 arch/arm64/kernel/cpu_errata.c                     |   7 +-
 arch/arm64/kernel/insn.c                           |   5 +-
 arch/arm64/kernel/perf_event.c                     |   5 +
 arch/arm64/kernel/probes/decode-insn.c             |   3 +-
 arch/arm64/mm/init.c                               |  30 +--
 arch/m68k/coldfire/device.c                        |   6 +-
 arch/microblaze/include/asm/Kbuild                 |   1 -
 arch/powerpc/include/asm/book3s/64/hash-4k.h       |  13 +-
 arch/powerpc/include/asm/drmem.h                   |  39 ++-
 arch/powerpc/include/asm/hw_breakpoint.h           |   1 +
 arch/powerpc/include/asm/reg.h                     |   2 +-
 arch/powerpc/include/asm/svm.h                     |   4 +
 arch/powerpc/include/asm/tlb.h                     |  13 -
 arch/powerpc/kernel/hw_breakpoint.c                |  14 +-
 arch/powerpc/kernel/irq.c                          |   9 +-
 arch/powerpc/kernel/ptrace/ptrace-noadv.c          |   1 +
 arch/powerpc/kernel/tau_6xx.c                      | 147 ++++------
 arch/powerpc/mm/book3s64/radix_tlb.c               |  23 +-
 arch/powerpc/mm/drmem.c                            |   6 +-
 arch/powerpc/mm/kasan/kasan_init_32.c              |  12 +-
 arch/powerpc/mm/mem.c                              |   6 +-
 arch/powerpc/perf/hv-gpci-requests.h               |   6 +-
 arch/powerpc/perf/isa207-common.c                  |  10 +
 arch/powerpc/platforms/Kconfig                     |  14 +-
 arch/powerpc/platforms/powernv/opal-dump.c         |  41 ++-
 arch/powerpc/platforms/pseries/hotplug-memory.c    |  24 +-
 arch/powerpc/platforms/pseries/papr_scm.c          |   3 +
 arch/powerpc/platforms/pseries/ras.c               | 118 ++++----
 arch/powerpc/platforms/pseries/rng.c               |   1 +
 arch/powerpc/platforms/pseries/svm.c               |  26 ++
 arch/powerpc/sysdev/xics/icp-hv.c                  |   1 +
 arch/powerpc/xmon/xmon.c                           |   1 +
 arch/s390/pci/pci_bus.c                            |   5 +-
 arch/um/drivers/vector_kern.c                      |   4 +-
 arch/um/kernel/time.c                              |  14 +-
 arch/x86/boot/compressed/pgtable_64.c              |   9 -
 arch/x86/events/amd/iommu.c                        |   2 +-
 arch/x86/events/core.c                             |   6 +-
 arch/x86/events/intel/ds.c                         |  32 ++-
 arch/x86/events/intel/uncore_snb.c                 |  31 ++-
 arch/x86/events/intel/uncore_snbep.c               |  12 +-
 arch/x86/events/perf_event.h                       |   1 +
 arch/x86/include/asm/special_insns.h               |  28 +-
 arch/x86/kernel/cpu/common.c                       |   4 +-
 arch/x86/kernel/cpu/mce/core.c                     |  99 +++++--
 arch/x86/kernel/cpu/mce/internal.h                 |  10 +
 arch/x86/kernel/cpu/mce/severity.c                 |  28 +-
 arch/x86/kernel/dumpstack.c                        |   3 +-
 arch/x86/kernel/fpu/init.c                         |  30 ++-
 arch/x86/kernel/nmi.c                              |   5 +-
 arch/x86/kvm/emulate.c                             |   2 +-
 arch/x86/kvm/ioapic.c                              |   5 +-
 arch/x86/kvm/kvm_cache_regs.h                      |   2 +-
 arch/x86/kvm/lapic.c                               |   7 +
 arch/x86/kvm/lapic.h                               |   1 +
 arch/x86/kvm/mmu/mmu.c                             |   1 +
 arch/x86/kvm/svm/avic.c                            |   1 +
 arch/x86/kvm/vmx/nested.c                          |  14 +-
 block/blk-core.c                                   |   9 +-
 block/blk-mq-sysfs.c                               |   2 -
 block/blk-sysfs.c                                  |   9 +-
 crypto/algif_aead.c                                |   7 +-
 crypto/algif_skcipher.c                            |   2 +-
 drivers/android/binder.c                           |  37 +--
 drivers/bluetooth/btusb.c                          |   1 +
 drivers/bluetooth/hci_ldisc.c                      |   1 +
 drivers/bluetooth/hci_serdev.c                     |   2 +
 drivers/bus/mhi/core/Makefile                      |   2 +-
 drivers/char/ipmi/ipmi_si_intf.c                   |   2 +-
 drivers/clk/at91/clk-main.c                        |  11 +-
 drivers/clk/bcm/clk-bcm2835.c                      |   4 +-
 drivers/clk/imx/clk-imx8mq.c                       |   4 +-
 drivers/clk/keystone/sci-clk.c                     |   2 +-
 drivers/clk/mediatek/clk-mt6779.c                  |   2 +
 drivers/clk/meson/axg-audio.c                      | 135 +++++++++-
 drivers/clk/meson/g12a.c                           |  11 +
 drivers/clk/qcom/gcc-sdm660.c                      |   2 +-
 drivers/clk/rockchip/clk-half-divider.c            |   2 +-
 drivers/clocksource/hyperv_timer.c                 |   4 +-
 drivers/cpufreq/armada-37xx-cpufreq.c              |   6 +
 drivers/cpufreq/powernv-cpufreq.c                  |   9 +-
 drivers/crypto/allwinner/sun8i-ce/sun8i-ce-core.c  |   5 +-
 drivers/crypto/caam/Kconfig                        |   1 +
 drivers/crypto/caam/caamalg_qi.c                   |  81 +++++-
 drivers/crypto/ccp/ccp-ops.c                       |   2 +-
 drivers/crypto/ccree/cc_pm.c                       |   6 +-
 drivers/crypto/chelsio/chtls/chtls_cm.c            |  19 +-
 drivers/crypto/chelsio/chtls/chtls_io.c            |   5 +-
 drivers/crypto/hisilicon/sec2/sec_crypto.c         |  16 +-
 drivers/crypto/ixp4xx_crypto.c                     |   2 +-
 drivers/crypto/mediatek/mtk-platform.c             |   8 +-
 drivers/crypto/omap-sham.c                         |   3 +
 drivers/crypto/picoxcell_crypto.c                  |   9 +-
 drivers/crypto/stm32/Kconfig                       |   1 +
 drivers/crypto/stm32/stm32-crc32.c                 |  15 +-
 drivers/dma/dmatest.c                              |   5 +-
 drivers/dma/dw/core.c                              |   4 +
 drivers/dma/dw/dw.c                                |   2 +-
 drivers/dma/dw/of.c                                |   7 +-
 drivers/dma/ioat/dma.c                             |   2 +-
 drivers/edac/aspeed_edac.c                         |   4 +-
 drivers/edac/i5100_edac.c                          |  11 +-
 drivers/edac/ti_edac.c                             |   3 +-
 drivers/firmware/arm_scmi/mailbox.c                |   2 +-
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c  |   3 +-
 drivers/gpu/drm/amd/display/dc/core/dc.c           |   2 +-
 .../gpu/drm/amd/display/dc/dce/dce_panel_cntl.c    |   2 +-
 .../gpu/drm/amd/display/dc/dcn20/dcn20_resource.c  |   3 +
 .../gpu/drm/amd/display/dc/dcn21/dcn21_resource.c  |   3 +
 drivers/gpu/drm/drm_debugfs_crc.c                  |   4 +-
 drivers/gpu/drm/drm_gem_vram_helper.c              |  28 +-
 drivers/gpu/drm/gma500/cdv_intel_dp.c              |   2 +-
 drivers/gpu/drm/mediatek/mtk_drm_crtc.c            |   2 +-
 drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c        |   2 +-
 drivers/gpu/drm/msm/adreno/adreno_gpu.c            |  10 +-
 drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c           |   8 +-
 drivers/gpu/drm/mxsfb/mxsfb_drv.c                  |  21 +-
 drivers/gpu/drm/panel/panel-simple.c               |   4 +-
 drivers/gpu/drm/panfrost/panfrost_device.h         |   3 +
 drivers/gpu/drm/panfrost/panfrost_drv.c            |  11 +
 drivers/gpu/drm/panfrost/panfrost_gpu.c            |  22 +-
 drivers/gpu/drm/panfrost/panfrost_gpu.h            |   2 +
 drivers/gpu/drm/panfrost/panfrost_regs.h           |   4 +
 drivers/gpu/drm/rcar-du/rcar_du_vsp.c              |  12 +
 drivers/gpu/drm/vgem/vgem_drv.c                    |   2 +-
 drivers/gpu/drm/virtio/virtgpu_kms.c               |   2 +
 drivers/gpu/drm/virtio/virtgpu_vq.c                |  10 +-
 drivers/gpu/drm/vkms/vkms_composer.c               |   2 +-
 drivers/gpu/drm/vkms/vkms_drv.c                    |   2 +-
 drivers/hid/hid-ids.h                              |   2 +
 drivers/hid/hid-input.c                            |   4 +-
 drivers/hid/hid-ite.c                              |   4 +
 drivers/hid/hid-multitouch.c                       |   6 +
 drivers/hid/hid-roccat-kone.c                      |  23 +-
 drivers/hwmon/bt1-pvt.c                            | 138 +++++++---
 drivers/hwmon/bt1-pvt.h                            |   3 +
 drivers/hwmon/pmbus/max34440.c                     |   3 -
 drivers/hwmon/w83627ehf.c                          |   6 +-
 drivers/hwtracing/coresight/coresight-cti.c        |  41 +--
 drivers/hwtracing/coresight/coresight-etm-perf.c   |  14 +-
 .../hwtracing/coresight/coresight-etm4x-sysfs.c    |   2 +-
 drivers/hwtracing/coresight/coresight-etm4x.c      | 105 ++++----
 drivers/hwtracing/coresight/coresight-etm4x.h      |   3 +
 drivers/hwtracing/coresight/coresight-platform.c   |  10 +-
 drivers/hwtracing/coresight/coresight.c            |   2 +-
 drivers/i2c/busses/Kconfig                         |   1 +
 drivers/i2c/i2c-core-acpi.c                        |  11 +-
 drivers/i3c/master.c                               |  19 +-
 drivers/i3c/master/i3c-master-cdns.c               |   4 +-
 drivers/iio/adc/stm32-adc-core.c                   |   9 +-
 drivers/infiniband/core/cma.c                      | 300 +++++++++------------
 drivers/infiniband/core/cq.c                       |  30 +--
 drivers/infiniband/core/ucma.c                     |   6 +-
 drivers/infiniband/core/umem.c                     |  15 +-
 drivers/infiniband/core/verbs.c                    |   9 +-
 drivers/infiniband/hw/bnxt_re/ib_verbs.c           |   3 +-
 drivers/infiniband/hw/bnxt_re/ib_verbs.h           |   2 +-
 drivers/infiniband/hw/cxgb4/cq.c                   |   3 +-
 drivers/infiniband/hw/cxgb4/iw_cxgb4.h             |   2 +-
 drivers/infiniband/hw/efa/efa.h                    |   2 +-
 drivers/infiniband/hw/efa/efa_verbs.c              |   3 +-
 drivers/infiniband/hw/hns/hns_roce_cq.c            |   3 +-
 drivers/infiniband/hw/hns/hns_roce_device.h        |   4 +-
 drivers/infiniband/hw/hns/hns_roce_hw_v1.c         |   4 +-
 drivers/infiniband/hw/hns/hns_roce_hw_v2.c         |  41 ++-
 drivers/infiniband/hw/hns/hns_roce_hw_v2.h         |   2 +
 drivers/infiniband/hw/hns/hns_roce_qp.c            |   6 +-
 drivers/infiniband/hw/i40iw/i40iw.h                |   9 +-
 drivers/infiniband/hw/i40iw/i40iw_cm.c             |  10 +-
 drivers/infiniband/hw/i40iw/i40iw_hw.c             |   4 +-
 drivers/infiniband/hw/i40iw/i40iw_utils.c          |  59 +---
 drivers/infiniband/hw/i40iw/i40iw_verbs.c          |  34 ++-
 drivers/infiniband/hw/i40iw/i40iw_verbs.h          |   3 +-
 drivers/infiniband/hw/mlx4/cm.c                    |   3 +
 drivers/infiniband/hw/mlx4/cq.c                    |   3 +-
 drivers/infiniband/hw/mlx4/mad.c                   |  34 ++-
 drivers/infiniband/hw/mlx4/mlx4_ib.h               |   4 +-
 drivers/infiniband/hw/mlx5/cq.c                    |  14 +-
 drivers/infiniband/hw/mlx5/main.c                  |   4 +-
 drivers/infiniband/hw/mlx5/mlx5_ib.h               |   2 +-
 drivers/infiniband/hw/mlx5/mr.c                    |  64 ++---
 drivers/infiniband/hw/mthca/mthca_provider.c       |   3 +-
 drivers/infiniband/hw/ocrdma/ocrdma_verbs.c        |   3 +-
 drivers/infiniband/hw/ocrdma/ocrdma_verbs.h        |   2 +-
 drivers/infiniband/hw/qedr/main.c                  |   2 +-
 drivers/infiniband/hw/qedr/qedr_iw_cm.c            |   6 +-
 drivers/infiniband/hw/qedr/verbs.c                 |  63 +++--
 drivers/infiniband/hw/qedr/verbs.h                 |   2 +-
 drivers/infiniband/hw/usnic/usnic_ib_verbs.c       |   4 +-
 drivers/infiniband/hw/usnic/usnic_ib_verbs.h       |   2 +-
 drivers/infiniband/hw/vmw_pvrdma/pvrdma_cq.c       |   3 +-
 drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.h    |   2 +-
 drivers/infiniband/sw/rdmavt/cq.c                  |   3 +-
 drivers/infiniband/sw/rdmavt/cq.h                  |   2 +-
 drivers/infiniband/sw/rdmavt/vt.c                  |   4 +-
 drivers/infiniband/sw/rxe/rxe_recv.c               |  20 +-
 drivers/infiniband/sw/rxe/rxe_verbs.c              |   3 +-
 drivers/infiniband/sw/siw/siw_verbs.c              |   3 +-
 drivers/infiniband/sw/siw/siw_verbs.h              |   2 +-
 drivers/infiniband/ulp/ipoib/ipoib_main.c          |   2 +
 drivers/infiniband/ulp/ipoib/ipoib_netlink.c       |  11 +
 drivers/infiniband/ulp/ipoib/ipoib_vlan.c          |   2 +
 drivers/infiniband/ulp/rtrs/rtrs-srv.c             |  76 +++++-
 drivers/infiniband/ulp/rtrs/rtrs-srv.h             |   7 +
 drivers/input/keyboard/ep93xx_keypad.c             |   4 +-
 drivers/input/keyboard/omap4-keypad.c              |   6 +-
 drivers/input/keyboard/twl4030_keypad.c            |   8 +-
 drivers/input/serio/sun4i-ps2.c                    |   9 +-
 drivers/input/touchscreen/elants_i2c.c             |   2 +-
 drivers/input/touchscreen/imx6ul_tsc.c             |  27 +-
 drivers/input/touchscreen/stmfts.c                 |   2 +-
 drivers/iommu/qcom_iommu.c                         |   8 +-
 drivers/lightnvm/core.c                            |   5 +-
 drivers/mailbox/mailbox.c                          |  12 +-
 drivers/mailbox/mtk-cmdq-mailbox.c                 |   8 +-
 drivers/md/md-bitmap.c                             |   3 +-
 drivers/md/md-cluster.c                            |   1 +
 drivers/media/firewire/firedtv-fw.c                |   6 +-
 drivers/media/i2c/m5mols/m5mols_core.c             |   3 +-
 drivers/media/i2c/ov5640.c                         | 196 ++++++++------
 drivers/media/i2c/tc358743.c                       |  14 +-
 drivers/media/pci/bt8xx/bttv-driver.c              |  13 +-
 drivers/media/pci/saa7134/saa7134-tvaudio.c        |   3 +-
 drivers/media/platform/exynos4-is/fimc-isp.c       |   4 +-
 drivers/media/platform/exynos4-is/fimc-lite.c      |   2 +-
 drivers/media/platform/exynos4-is/media-dev.c      |   8 +-
 drivers/media/platform/exynos4-is/mipi-csis.c      |   4 +-
 drivers/media/platform/mx2_emmaprp.c               |   7 +-
 drivers/media/platform/omap3isp/isp.c              |   6 +-
 drivers/media/platform/qcom/camss/camss-csiphy.c   |   4 +-
 drivers/media/platform/qcom/venus/core.c           |  20 +-
 drivers/media/platform/qcom/venus/vdec.c           |  10 +-
 drivers/media/platform/rcar-fcp.c                  |   4 +-
 drivers/media/platform/rcar-vin/rcar-csi2.c        |  24 +-
 drivers/media/platform/rcar-vin/rcar-dma.c         |   4 +-
 drivers/media/platform/rcar_drif.c                 |  30 +--
 drivers/media/platform/rockchip/rga/rga-buf.c      |   1 +
 drivers/media/platform/s3c-camif/camif-core.c      |   5 +-
 drivers/media/platform/s5p-mfc/s5p_mfc_pm.c        |   4 +-
 drivers/media/platform/sti/bdisp/bdisp-v4l2.c      |   3 +-
 drivers/media/platform/sti/delta/delta-v4l2.c      |   4 +-
 drivers/media/platform/sti/hva/hva-hw.c            |   4 +-
 drivers/media/platform/stm32/stm32-dcmi.c          |   4 +-
 drivers/media/platform/ti-vpe/vpe.c                |   2 +
 drivers/media/platform/vsp1/vsp1_drv.c             |  11 +-
 drivers/media/rc/ati_remote.c                      |   4 +
 drivers/media/test-drivers/vivid/vivid-meta-out.c  |   9 +-
 drivers/media/tuners/tuner-simple.c                |   5 +-
 drivers/media/usb/uvc/uvc_ctrl.c                   |   6 +-
 drivers/media/usb/uvc/uvc_entity.c                 |  35 +++
 drivers/media/usb/uvc/uvc_v4l2.c                   |  30 +++
 drivers/memory/fsl-corenet-cf.c                    |   6 +-
 drivers/memory/omap-gpmc.c                         |   8 +-
 drivers/mfd/sm501.c                                |   8 +-
 drivers/misc/cardreader/rtsx_pcr.c                 |   4 +-
 drivers/misc/eeprom/at25.c                         |   2 +-
 drivers/misc/habanalabs/gaudi/gaudi.c              |   8 +-
 drivers/misc/habanalabs/goya/goya.c                |   8 +-
 drivers/misc/mic/scif/scif_rma.c                   |   4 +-
 drivers/misc/mic/vop/vop_main.c                    |   2 +-
 drivers/misc/mic/vop/vop_vringh.c                  |  24 +-
 drivers/misc/ocxl/Kconfig                          |   3 +-
 drivers/misc/vmw_vmci/vmci_queue_pair.c            |  10 +-
 drivers/mmc/core/sdio_cis.c                        |   3 +
 drivers/mtd/hyperbus/hbmc-am654.c                  |   4 +-
 drivers/mtd/lpddr/lpddr2_nvm.c                     |  35 +--
 drivers/mtd/mtdoops.c                              |  11 +-
 drivers/mtd/nand/raw/ams-delta.c                   |   2 +
 drivers/mtd/nand/raw/stm32_fmc2_nand.c             |   2 +-
 drivers/mtd/nand/raw/vf610_nfc.c                   |   6 +-
 drivers/mtd/nand/spi/gigadevice.c                  |  14 +-
 drivers/net/can/flexcan.c                          |  34 ++-
 drivers/net/can/m_can/m_can_platform.c             |   2 -
 drivers/net/dsa/microchip/ksz_common.c             |  16 +-
 drivers/net/dsa/realtek-smi-core.h                 |   4 +-
 drivers/net/dsa/rtl8366.c                          | 280 ++++++++++---------
 drivers/net/dsa/rtl8366rb.c                        |   2 +-
 .../net/ethernet/chelsio/cxgb4/cxgb4_tc_flower.c   | 175 +++++++++++-
 .../net/ethernet/chelsio/cxgb4/cxgb4_tc_flower.h   |  15 ++
 drivers/net/ethernet/cisco/enic/enic.h             |   1 +
 drivers/net/ethernet/cisco/enic/enic_api.c         |   6 +
 drivers/net/ethernet/cisco/enic/enic_main.c        |  27 +-
 drivers/net/ethernet/faraday/ftgmac100.c           |   5 +
 drivers/net/ethernet/faraday/ftgmac100.h           |   8 +
 drivers/net/ethernet/freescale/fec_main.c          |  35 ++-
 drivers/net/ethernet/ibm/ibmveth.c                 |  19 +-
 drivers/net/ethernet/ibm/ibmvnic.c                 |  10 +-
 drivers/net/ethernet/ibm/ibmvnic.h                 |   2 +-
 drivers/net/ethernet/korina.c                      |   3 +-
 drivers/net/ethernet/mediatek/Kconfig              |   1 +
 drivers/net/ethernet/mellanox/mlx4/en_rx.c         |   3 +
 drivers/net/ethernet/mellanox/mlx4/en_tx.c         |   2 +-
 .../net/ethernet/mellanox/mlx5/core/en/health.c    |   2 +-
 .../net/ethernet/mellanox/mlx5/core/lib/clock.c    |   5 +-
 drivers/net/ethernet/realtek/r8169_main.c          |  12 +-
 drivers/net/ethernet/socionext/netsec.c            |  24 +-
 drivers/net/ethernet/stmicro/stmmac/stmmac_main.c  |  41 +--
 drivers/net/ipa/ipa_endpoint.c                     |   6 +
 drivers/net/usb/qmi_wwan.c                         |   1 +
 drivers/net/wan/hdlc.c                             |  10 +-
 drivers/net/wan/hdlc_raw_eth.c                     |   1 +
 drivers/net/wireless/ath/ath10k/ce.c               |   2 +-
 drivers/net/wireless/ath/ath10k/htt_rx.c           |   8 +
 drivers/net/wireless/ath/ath10k/mac.c              |   2 +-
 drivers/net/wireless/ath/ath11k/ahb.c              |  10 +-
 drivers/net/wireless/ath/ath11k/mac.c              |   4 +-
 drivers/net/wireless/ath/ath11k/qmi.c              |   1 +
 drivers/net/wireless/ath/ath6kl/main.c             |   3 +
 drivers/net/wireless/ath/ath6kl/wmi.c              |   5 +
 drivers/net/wireless/ath/ath9k/hif_usb.c           |  19 ++
 drivers/net/wireless/ath/ath9k/htc_hst.c           |   2 +
 drivers/net/wireless/ath/wcn36xx/main.c            |   2 +-
 .../wireless/broadcom/brcm80211/brcmfmac/core.c    |   2 +-
 .../wireless/broadcom/brcm80211/brcmfmac/msgbuf.c  |   2 +
 .../broadcom/brcm80211/brcmsmac/phy/phy_lcn.c      |   4 +-
 drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c   |   8 +-
 drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c  |   9 +-
 drivers/net/wireless/marvell/mwifiex/scan.c        |   2 +-
 drivers/net/wireless/marvell/mwifiex/sdio.c        |   2 +
 drivers/net/wireless/marvell/mwifiex/usb.c         |   3 +-
 drivers/net/wireless/mediatek/mt76/mt7915/mcu.c    |  18 +-
 drivers/net/wireless/quantenna/qtnfmac/commands.c  |   2 +
 .../net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c  |  10 +-
 drivers/net/wireless/realtek/rtw88/main.c          |   5 +
 drivers/net/wireless/realtek/rtw88/pci.c           |   2 +
 drivers/net/wireless/realtek/rtw88/pci.h           |   4 +-
 drivers/net/wireless/realtek/rtw88/phy.c           |   5 +-
 drivers/ntb/hw/amd/ntb_hw_amd.c                    |   1 +
 drivers/ntb/hw/intel/ntb_hw_gen1.c                 |   2 +-
 drivers/nvme/target/core.c                         |   3 +-
 drivers/nvmem/core.c                               |  38 ++-
 drivers/opp/core.c                                 |   6 +
 drivers/pci/controller/dwc/pcie-designware-ep.c    |   3 +-
 drivers/pci/controller/pci-aardvark.c              |  13 +-
 drivers/pci/controller/pci-hyperv.c                |  50 +++-
 drivers/pci/controller/pcie-iproc-msi.c            |  13 +-
 drivers/pci/iov.c                                  |   1 +
 drivers/perf/thunderx2_pmu.c                       |   7 +-
 drivers/perf/xgene_pmu.c                           |  32 +--
 drivers/pinctrl/aspeed/pinctrl-aspeed.c            |   2 +-
 drivers/pinctrl/bcm/Kconfig                        |   1 +
 drivers/pinctrl/devicetree.c                       |   5 +-
 drivers/pinctrl/pinctrl-mcp23s08.c                 |  24 +-
 drivers/pinctrl/qcom/pinctrl-msm.c                 |  10 +-
 drivers/platform/chrome/cros_ec_lightbar.c         |   2 +
 drivers/platform/x86/mlx-platform.c                |  15 +-
 drivers/pwm/pwm-img.c                              |   3 +-
 drivers/pwm/pwm-lpss.c                             |   7 +-
 drivers/pwm/pwm-rockchip.c                         |   5 +-
 drivers/rapidio/devices/rio_mport_cdev.c           |  18 +-
 drivers/ras/cec.c                                  |   9 +-
 drivers/regulator/core.c                           |  21 +-
 drivers/remoteproc/mtk_scp_ipi.c                   |   4 +-
 drivers/rpmsg/mtk_rpmsg.c                          |   9 +-
 drivers/rpmsg/qcom_smd.c                           |  32 ++-
 drivers/rtc/rtc-ds1307.c                           |   4 +
 drivers/s390/net/qeth_core.h                       |   6 +
 drivers/s390/net/qeth_l2_main.c                    |  59 +++-
 drivers/s390/net/qeth_l2_sys.c                     |   1 +
 drivers/scsi/be2iscsi/be_main.c                    |   4 +-
 drivers/scsi/bfa/bfad.c                            |   1 +
 drivers/scsi/csiostor/csio_hw.c                    |   2 +-
 drivers/scsi/ibmvscsi/ibmvfc.c                     |   1 +
 drivers/scsi/mpt3sas/mpt3sas_base.c                |  14 +-
 drivers/scsi/mvumi.c                               |   1 +
 drivers/scsi/qedf/qedf_main.c                      |   2 +-
 drivers/scsi/qedi/qedi_fw.c                        |  23 +-
 drivers/scsi/qedi/qedi_iscsi.c                     |   2 +
 drivers/scsi/qedi/qedi_main.c                      |  10 +
 drivers/scsi/qla2xxx/qla_init.c                    |  10 +
 drivers/scsi/qla2xxx/qla_inline.h                  |   5 +
 drivers/scsi/qla2xxx/qla_mbx.c                     |   2 +-
 drivers/scsi/qla2xxx/qla_nvme.c                    |   2 +-
 drivers/scsi/qla2xxx/qla_target.c                  |   2 +-
 drivers/scsi/qla4xxx/ql4_os.c                      |   2 +-
 drivers/scsi/smartpqi/smartpqi.h                   |   2 +-
 drivers/scsi/smartpqi/smartpqi_init.c              | 101 ++++---
 drivers/scsi/ufs/ufs-mediatek.c                    |   6 -
 drivers/scsi/ufs/ufs-qcom.c                        |   5 -
 drivers/scsi/ufs/ufshcd.c                          |   3 +
 drivers/slimbus/core.c                             |   6 +-
 drivers/slimbus/qcom-ngd-ctrl.c                    |   4 +
 drivers/soc/fsl/qbman/bman.c                       |   2 +-
 drivers/soc/mediatek/mtk-cmdq-helper.c             |   5 +-
 drivers/soc/qcom/apr.c                             |   2 +-
 drivers/soc/qcom/pdr_internal.h                    |   2 +-
 drivers/soc/xilinx/zynqmp_power.c                  |   2 +-
 drivers/spi/spi-dw-pci.c                           |  16 +-
 drivers/spi/spi-fsi.c                              |  99 +++++--
 drivers/spi/spi-omap2-mcspi.c                      |  17 +-
 drivers/spi/spi-s3c64xx.c                          |  52 +++-
 drivers/staging/emxx_udc/emxx_udc.c                |   4 +-
 drivers/staging/media/atomisp/pci/sh_css.c         |   2 +-
 drivers/staging/media/hantro/hantro_h264.c         |   2 +-
 drivers/staging/media/hantro/hantro_postproc.c     |   4 +-
 drivers/staging/media/ipu3/ipu3-css-params.c       |   2 +-
 .../phy-rockchip-dphy-rx0/phy-rockchip-dphy-rx0.c  |   1 +
 drivers/staging/rtl8192u/ieee80211/ieee80211_rx.c  |   2 +-
 drivers/staging/wfx/data_rx.c                      |   2 +-
 drivers/staging/wilc1000/mon.c                     |   3 +-
 drivers/staging/wilc1000/sdio.c                    |   5 +-
 drivers/staging/wilc1000/spi.c                     |   5 +-
 drivers/target/target_core_user.c                  |   2 +-
 drivers/tty/hvc/Kconfig                            |   1 +
 drivers/tty/hvc/hvcs.c                             |  14 +-
 drivers/tty/ipwireless/network.c                   |   4 +-
 drivers/tty/ipwireless/tty.c                       |   2 +-
 drivers/tty/pty.c                                  |   2 +-
 drivers/tty/serial/Kconfig                         |   1 +
 drivers/tty/serial/fsl_lpuart.c                    |  16 +-
 drivers/usb/cdns3/gadget.c                         |   2 +-
 drivers/usb/class/cdc-acm.c                        |  23 ++
 drivers/usb/class/cdc-wdm.c                        |  72 +++--
 drivers/usb/core/urb.c                             |  89 +++---
 drivers/usb/dwc2/gadget.c                          |  40 ++-
 drivers/usb/dwc2/params.c                          |   2 +-
 drivers/usb/dwc2/platform.c                        |   6 +-
 drivers/usb/dwc3/core.c                            |  60 +++--
 drivers/usb/dwc3/core.h                            |   7 +
 drivers/usb/dwc3/dwc3-of-simple.c                  |   1 +
 drivers/usb/gadget/function/f_ncm.c                |   8 +-
 drivers/usb/gadget/function/f_printer.c            |  16 +-
 drivers/usb/gadget/function/u_ether.c              |   2 +-
 drivers/usb/gadget/function/u_serial.c             |   1 +
 drivers/usb/gadget/udc/bcm63xx_udc.c               |   1 +
 drivers/usb/host/ohci-hcd.c                        |  16 +-
 drivers/usb/host/xhci.c                            |   3 +-
 drivers/vfio/pci/vfio_pci_config.c                 |  24 +-
 drivers/vfio/pci/vfio_pci_intrs.c                  |   4 +-
 drivers/vfio/vfio.c                                |   9 +-
 drivers/vfio/vfio_iommu_type1.c                    |   6 +-
 drivers/video/backlight/sky81452-backlight.c       |   1 +
 drivers/video/fbdev/aty/radeon_base.c              |   2 +-
 drivers/video/fbdev/core/fbmem.c                   |   4 +
 drivers/video/fbdev/sis/init.c                     |  11 +-
 drivers/video/fbdev/vga16fb.c                      |  14 +-
 drivers/virt/fsl_hypervisor.c                      |  17 +-
 drivers/watchdog/sp5100_tco.h                      |   2 +-
 drivers/watchdog/watchdog_dev.c                    |   6 +-
 fs/afs/cell.c                                      | 283 +++++++++++--------
 fs/afs/dynroot.c                                   |  23 +-
 fs/afs/internal.h                                  |  15 +-
 fs/afs/main.c                                      |   2 +-
 fs/afs/mntpt.c                                     |   4 +-
 fs/afs/proc.c                                      |  23 +-
 fs/afs/super.c                                     |  16 +-
 fs/afs/vl_alias.c                                  |   8 +-
 fs/afs/vl_rotate.c                                 |   2 +-
 fs/afs/volume.c                                    |   4 +-
 fs/btrfs/extent-io-tree.h                          |   1 +
 fs/btrfs/volumes.c                                 |   7 +-
 fs/cifs/asn1.c                                     |  16 +-
 fs/cifs/cifsacl.c                                  |   5 +-
 fs/cifs/cifsproto.h                                |   2 +
 fs/cifs/connect.c                                  |   5 +-
 fs/cifs/readdir.c                                  |   5 +-
 fs/cifs/smb2ops.c                                  |  21 +-
 fs/crypto/policy.c                                 |   9 +-
 fs/d_path.c                                        |   6 +-
 fs/dlm/config.c                                    |   3 +
 fs/ext4/ext4.h                                     |   2 +-
 fs/ext4/fsmap.c                                    |   3 +
 fs/ext4/mballoc.c                                  |  37 ++-
 fs/f2fs/inode.c                                    |   7 +
 fs/f2fs/sysfs.c                                    |   1 +
 fs/iomap/buffered-io.c                             |  25 +-
 fs/iomap/direct-io.c                               |  10 +
 fs/nfs/fs_context.c                                |   1 +
 fs/ntfs/inode.c                                    |   6 +
 fs/proc/base.c                                     |   3 +-
 fs/quota/quota_v2.c                                |   1 +
 fs/ramfs/file-nommu.c                              |   2 +-
 fs/reiserfs/inode.c                                |   3 +-
 fs/reiserfs/super.c                                |   8 +-
 fs/udf/inode.c                                     |  25 +-
 fs/udf/super.c                                     |   6 +
 fs/xfs/libxfs/xfs_rtbitmap.c                       |  11 +-
 fs/xfs/xfs_buf_item_recover.c                      |   2 +
 fs/xfs/xfs_file.c                                  |  17 +-
 fs/xfs/xfs_fsmap.c                                 |  48 ++--
 fs/xfs/xfs_fsmap.h                                 |   6 +-
 fs/xfs/xfs_ioctl.c                                 | 144 ++++++----
 fs/xfs/xfs_rtalloc.c                               |  11 +
 include/linux/bpf_verifier.h                       |   1 +
 include/linux/mailbox/mtk-cmdq-mailbox.h           |   3 +-
 include/linux/oom.h                                |   1 +
 include/linux/overflow.h                           |   1 +
 include/linux/page_owner.h                         |   6 +-
 include/linux/pci.h                                |   1 +
 include/linux/platform_data/dma-dw.h               |   2 +
 include/linux/sched/coredump.h                     |   1 +
 include/linux/soc/mediatek/mtk-cmdq.h              |   5 +-
 include/net/ip.h                                   |   6 +
 include/net/netfilter/nf_log.h                     |   1 +
 include/net/tc_act/tc_tunnel_key.h                 |   5 +-
 include/rdma/ib_umem.h                             |   9 +-
 include/rdma/ib_verbs.h                            |  68 +----
 include/scsi/scsi_common.h                         |   7 +
 include/sound/hda_codec.h                          |   1 +
 include/trace/events/target.h                      |  12 +-
 include/uapi/linux/pci_regs.h                      |   1 +
 include/uapi/linux/perf_event.h                    |   2 +-
 kernel/bpf/percpu_freelist.c                       | 101 ++++++-
 kernel/bpf/percpu_freelist.h                       |   1 +
 kernel/bpf/verifier.c                              |  34 +++
 kernel/debug/kdb/kdb_io.c                          |   8 +-
 kernel/events/core.c                               |   7 +-
 kernel/fork.c                                      |  21 ++
 kernel/module.c                                    |  13 +-
 kernel/power/hibernate.c                           |  11 -
 kernel/rcu/rcutorture.c                            |  13 +-
 kernel/rcu/tree.c                                  |   2 +-
 kernel/sched/core.c                                |   2 +-
 kernel/sched/fair.c                                |  20 +-
 kernel/sched/sched.h                               |  13 +-
 kernel/trace/trace_events_synth.c                  |  18 +-
 lib/crc32.c                                        |   2 +-
 lib/idr.c                                          |   1 +
 mm/filemap.c                                       |   8 +-
 mm/huge_memory.c                                   |   2 +-
 mm/memcontrol.c                                    |   5 +-
 mm/oom_kill.c                                      |   2 +
 mm/page_alloc.c                                    |   4 +-
 mm/page_owner.c                                    |   4 +-
 mm/swapfile.c                                      |   4 +-
 net/bluetooth/hci_core.c                           |  11 +
 net/bluetooth/l2cap_sock.c                         |   7 +-
 net/bridge/netfilter/ebt_dnat.c                    |   2 +-
 net/bridge/netfilter/ebt_redirect.c                |   2 +-
 net/bridge/netfilter/ebt_snat.c                    |   2 +-
 net/can/j1939/transport.c                          |   2 +
 net/core/filter.c                                  |   3 +-
 net/core/skmsg.c                                   |  14 +-
 net/core/sock.c                                    |  13 +-
 net/ipv4/icmp.c                                    |   7 +-
 net/ipv4/ip_gre.c                                  |  15 +-
 net/ipv4/netfilter/nf_log_arp.c                    |  19 +-
 net/ipv4/netfilter/nf_log_ipv4.c                   |   6 +-
 net/ipv4/nexthop.c                                 |   2 +-
 net/ipv4/route.c                                   |   4 +-
 net/ipv4/tcp_input.c                               |   2 +
 net/ipv6/ip6_fib.c                                 |   4 +-
 net/ipv6/netfilter/nf_log_ipv6.c                   |   8 +-
 net/mac80211/cfg.c                                 |   3 +-
 net/mac80211/sta_info.c                            |   4 +
 net/mptcp/options.c                                |   3 +-
 net/mptcp/protocol.h                               |   2 +-
 net/mptcp/subflow.c                                |   3 +-
 net/netfilter/ipvs/ip_vs_ctl.c                     |   7 +-
 net/netfilter/ipvs/ip_vs_xmit.c                    |   6 +
 net/netfilter/nf_conntrack_proto_tcp.c             |  19 +-
 net/netfilter/nf_dup_netdev.c                      |   1 +
 net/netfilter/nf_log_common.c                      |  12 +
 net/netfilter/nft_fwd_netdev.c                     |   1 +
 net/nfc/netlink.c                                  |   2 +-
 net/sched/act_api.c                                |  14 -
 net/sched/act_ct.c                                 |   4 +-
 net/sched/act_tunnel_key.c                         |   2 +-
 net/sched/cls_api.c                                |   2 +-
 net/smc/smc_core.c                                 |   2 +-
 net/smc/smc_llc.c                                  |  13 +-
 net/sunrpc/auth_gss/svcauth_gss.c                  |  27 +-
 net/sunrpc/xprtrdma/svc_rdma_sendto.c              |   3 +-
 net/tipc/bcast.c                                   |  10 +-
 net/tipc/msg.c                                     |   3 +-
 net/tls/tls_device.c                               |  11 +-
 net/wireless/nl80211.c                             |  21 +-
 samples/bpf/xdpsock_user.c                         |  10 +-
 samples/mic/mpssd/mpssd.c                          |   4 +-
 scripts/package/builddeb                           |   6 +-
 scripts/package/mkdebian                           |  19 +-
 security/integrity/ima/ima_crypto.c                |   2 +
 security/integrity/ima/ima_main.c                  |  10 +
 sound/core/seq/oss/seq_oss.c                       |   7 +-
 sound/firewire/bebob/bebob_hwdep.c                 |   3 +-
 sound/pci/hda/hda_intel.c                          |  14 +-
 sound/pci/hda/hda_jack.c                           |  22 +-
 sound/pci/hda/patch_ca0132.c                       |  24 +-
 sound/pci/hda/patch_hdmi.c                         |  20 +-
 sound/pci/hda/patch_realtek.c                      |  56 ++++
 sound/soc/codecs/Kconfig                           |   1 +
 sound/soc/codecs/tas2770.c                         |  93 +++----
 sound/soc/codecs/tlv320adcx140.c                   |   2 +-
 sound/soc/codecs/tlv320aic32x4.c                   |   9 +-
 sound/soc/codecs/wm_adsp.c                         |  20 +-
 sound/soc/fsl/fsl_sai.c                            |  19 +-
 sound/soc/fsl/fsl_sai.h                            |   1 +
 sound/soc/fsl/imx-es8328.c                         |  12 +-
 sound/soc/intel/boards/sof_rt5682.c                |  13 +
 sound/soc/qcom/lpass-cpu.c                         |  16 --
 sound/soc/qcom/lpass-platform.c                    |   3 +-
 sound/soc/soc-topology.c                           |  11 +
 sound/soc/sof/control.c                            |  11 +
 sound/soc/sof/intel/hda.c                          |   8 +-
 sound/soc/sof/sof-pci-dev.c                        |  24 ++
 sound/usb/format.c                                 |   1 +
 tools/build/Makefile.feature                       |   5 +-
 tools/build/feature/Makefile                       |   2 +-
 tools/build/feature/test-all.c                     |  10 -
 tools/lib/bpf/libbpf.c                             |  57 ++--
 tools/lib/perf/evlist.c                            |   3 +
 tools/perf/Makefile.config                         |   4 +-
 tools/perf/Makefile.perf                           |   6 +-
 tools/perf/builtin-stat.c                          |   4 +-
 tools/perf/builtin-trace.c                         |   6 +-
 tools/perf/builtin-version.c                       |   1 -
 tools/perf/util/intel-pt.c                         |   8 +-
 tools/testing/radix-tree/idr-test.c                |  29 ++
 tools/testing/selftests/bpf/bench.c                |   3 -
 tools/testing/selftests/bpf/benchs/bench_rename.c  |  17 --
 tools/testing/selftests/bpf/prog_tests/bpf_iter.c  |  14 +-
 tools/testing/selftests/bpf/prog_tests/sk_assign.c |   2 +-
 .../testing/selftests/bpf/prog_tests/sockopt_sk.c  |   4 +-
 .../selftests/bpf/prog_tests/test_overhead.c       |  14 +-
 tools/testing/selftests/bpf/progs/test_overhead.c  |   6 -
 .../selftests/bpf/progs/test_sysctl_loop1.c        |   4 +-
 .../selftests/bpf/progs/test_sysctl_loop2.c        |   4 +-
 tools/testing/selftests/bpf/progs/test_vmlinux.c   |  12 +-
 .../trigger-inter-event-combined-hist.tc           |   8 +-
 tools/testing/selftests/lkdtm/run.sh               |   2 +-
 tools/testing/selftests/net/config                 |   1 +
 .../selftests/net/forwarding/vxlan_asymmetric.sh   |  10 +
 .../selftests/net/forwarding/vxlan_symmetric.sh    |  10 +
 tools/testing/selftests/net/mptcp/mptcp_connect.sh |   4 +-
 tools/testing/selftests/net/mptcp/mptcp_join.sh    |   4 +-
 tools/testing/selftests/net/rtnetlink.sh           |   5 +
 tools/testing/selftests/powerpc/eeh/eeh-basic.sh   |   9 +-
 tools/testing/selftests/vm/config                  |   1 +
 665 files changed, 5459 insertions(+), 2941 deletions(-)



^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 001/633] xgb4: handle 4-tuple PEDIT to NAT mode translation
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
@ 2020-10-27 13:45 ` Greg Kroah-Hartman
  2020-10-27 13:45 ` [PATCH 5.8 002/633] ibmveth: Switch order of ibmveth_helper calls Greg Kroah-Hartman
                   ` (634 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:45 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Herat Ramani, Jakub Kicinski

From: Herat Ramani <herat@chelsio.com>

[ Upstream commit 2ef813b8f405db3f72202b6fcae40a628ab80a53 ]

The 4-tuple NAT offload via PEDIT always overwrites all the 4-tuple
fields even if they had not been explicitly enabled. If any fields in
the 4-tuple are not enabled, then the hardware overwrites the
disabled fields with zeros, instead of ignoring them.

So, add a parser that can translate the enabled 4-tuple PEDIT fields
to one of the NAT mode combinations supported by the hardware and
hence avoid overwriting disabled fields to 0. Any rule with
unsupported NAT mode combination is rejected.

Signed-off-by: Herat Ramani <herat@chelsio.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_flower.c |  175 +++++++++++++++++--
 drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_flower.h |   15 +
 2 files changed, 177 insertions(+), 13 deletions(-)

--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_flower.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_flower.c
@@ -60,6 +60,89 @@ static struct ch_tc_pedit_fields pedits[
 	PEDIT_FIELDS(IP6_, DST_127_96, 4, nat_lip, 12),
 };
 
+static const struct cxgb4_natmode_config cxgb4_natmode_config_array[] = {
+	/* Default supported NAT modes */
+	{
+		.chip = CHELSIO_T5,
+		.flags = CXGB4_ACTION_NATMODE_NONE,
+		.natmode = NAT_MODE_NONE,
+	},
+	{
+		.chip = CHELSIO_T5,
+		.flags = CXGB4_ACTION_NATMODE_DIP,
+		.natmode = NAT_MODE_DIP,
+	},
+	{
+		.chip = CHELSIO_T5,
+		.flags = CXGB4_ACTION_NATMODE_DIP | CXGB4_ACTION_NATMODE_DPORT,
+		.natmode = NAT_MODE_DIP_DP,
+	},
+	{
+		.chip = CHELSIO_T5,
+		.flags = CXGB4_ACTION_NATMODE_DIP | CXGB4_ACTION_NATMODE_DPORT |
+			 CXGB4_ACTION_NATMODE_SIP,
+		.natmode = NAT_MODE_DIP_DP_SIP,
+	},
+	{
+		.chip = CHELSIO_T5,
+		.flags = CXGB4_ACTION_NATMODE_DIP | CXGB4_ACTION_NATMODE_DPORT |
+			 CXGB4_ACTION_NATMODE_SPORT,
+		.natmode = NAT_MODE_DIP_DP_SP,
+	},
+	{
+		.chip = CHELSIO_T5,
+		.flags = CXGB4_ACTION_NATMODE_SIP | CXGB4_ACTION_NATMODE_SPORT,
+		.natmode = NAT_MODE_SIP_SP,
+	},
+	{
+		.chip = CHELSIO_T5,
+		.flags = CXGB4_ACTION_NATMODE_DIP | CXGB4_ACTION_NATMODE_SIP |
+			 CXGB4_ACTION_NATMODE_SPORT,
+		.natmode = NAT_MODE_DIP_SIP_SP,
+	},
+	{
+		.chip = CHELSIO_T5,
+		.flags = CXGB4_ACTION_NATMODE_DIP | CXGB4_ACTION_NATMODE_SIP |
+			 CXGB4_ACTION_NATMODE_DPORT |
+			 CXGB4_ACTION_NATMODE_SPORT,
+		.natmode = NAT_MODE_ALL,
+	},
+	/* T6+ can ignore L4 ports when they're disabled. */
+	{
+		.chip = CHELSIO_T6,
+		.flags = CXGB4_ACTION_NATMODE_SIP,
+		.natmode = NAT_MODE_SIP_SP,
+	},
+	{
+		.chip = CHELSIO_T6,
+		.flags = CXGB4_ACTION_NATMODE_DIP | CXGB4_ACTION_NATMODE_SPORT,
+		.natmode = NAT_MODE_DIP_DP_SP,
+	},
+	{
+		.chip = CHELSIO_T6,
+		.flags = CXGB4_ACTION_NATMODE_DIP | CXGB4_ACTION_NATMODE_SIP,
+		.natmode = NAT_MODE_ALL,
+	},
+};
+
+static void cxgb4_action_natmode_tweak(struct ch_filter_specification *fs,
+				       u8 natmode_flags)
+{
+	u8 i = 0;
+
+	/* Translate the enabled NAT 4-tuple fields to one of the
+	 * hardware supported NAT mode configurations. This ensures
+	 * that we pick a valid combination, where the disabled fields
+	 * do not get overwritten to 0.
+	 */
+	for (i = 0; i < ARRAY_SIZE(cxgb4_natmode_config_array); i++) {
+		if (cxgb4_natmode_config_array[i].flags == natmode_flags) {
+			fs->nat_mode = cxgb4_natmode_config_array[i].natmode;
+			return;
+		}
+	}
+}
+
 static struct ch_tc_flower_entry *allocate_flower_entry(void)
 {
 	struct ch_tc_flower_entry *new = kzalloc(sizeof(*new), GFP_KERNEL);
@@ -287,7 +370,8 @@ static void offload_pedit(struct ch_filt
 }
 
 static void process_pedit_field(struct ch_filter_specification *fs, u32 val,
-				u32 mask, u32 offset, u8 htype)
+				u32 mask, u32 offset, u8 htype,
+				u8 *natmode_flags)
 {
 	switch (htype) {
 	case FLOW_ACT_MANGLE_HDR_TYPE_ETH:
@@ -312,67 +396,102 @@ static void process_pedit_field(struct c
 		switch (offset) {
 		case PEDIT_IP4_SRC:
 			offload_pedit(fs, val, mask, IP4_SRC);
+			*natmode_flags |= CXGB4_ACTION_NATMODE_SIP;
 			break;
 		case PEDIT_IP4_DST:
 			offload_pedit(fs, val, mask, IP4_DST);
+			*natmode_flags |= CXGB4_ACTION_NATMODE_DIP;
 		}
-		fs->nat_mode = NAT_MODE_ALL;
 		break;
 	case FLOW_ACT_MANGLE_HDR_TYPE_IP6:
 		switch (offset) {
 		case PEDIT_IP6_SRC_31_0:
 			offload_pedit(fs, val, mask, IP6_SRC_31_0);
+			*natmode_flags |= CXGB4_ACTION_NATMODE_SIP;
 			break;
 		case PEDIT_IP6_SRC_63_32:
 			offload_pedit(fs, val, mask, IP6_SRC_63_32);
+			*natmode_flags |=  CXGB4_ACTION_NATMODE_SIP;
 			break;
 		case PEDIT_IP6_SRC_95_64:
 			offload_pedit(fs, val, mask, IP6_SRC_95_64);
+			*natmode_flags |= CXGB4_ACTION_NATMODE_SIP;
 			break;
 		case PEDIT_IP6_SRC_127_96:
 			offload_pedit(fs, val, mask, IP6_SRC_127_96);
+			*natmode_flags |= CXGB4_ACTION_NATMODE_SIP;
 			break;
 		case PEDIT_IP6_DST_31_0:
 			offload_pedit(fs, val, mask, IP6_DST_31_0);
+			*natmode_flags |= CXGB4_ACTION_NATMODE_DIP;
 			break;
 		case PEDIT_IP6_DST_63_32:
 			offload_pedit(fs, val, mask, IP6_DST_63_32);
+			*natmode_flags |= CXGB4_ACTION_NATMODE_DIP;
 			break;
 		case PEDIT_IP6_DST_95_64:
 			offload_pedit(fs, val, mask, IP6_DST_95_64);
+			*natmode_flags |= CXGB4_ACTION_NATMODE_DIP;
 			break;
 		case PEDIT_IP6_DST_127_96:
 			offload_pedit(fs, val, mask, IP6_DST_127_96);
+			*natmode_flags |= CXGB4_ACTION_NATMODE_DIP;
 		}
-		fs->nat_mode = NAT_MODE_ALL;
 		break;
 	case FLOW_ACT_MANGLE_HDR_TYPE_TCP:
 		switch (offset) {
 		case PEDIT_TCP_SPORT_DPORT:
-			if (~mask & PEDIT_TCP_UDP_SPORT_MASK)
+			if (~mask & PEDIT_TCP_UDP_SPORT_MASK) {
 				fs->nat_fport = val;
-			else
+				*natmode_flags |= CXGB4_ACTION_NATMODE_SPORT;
+			} else {
 				fs->nat_lport = val >> 16;
+				*natmode_flags |= CXGB4_ACTION_NATMODE_DPORT;
+			}
 		}
-		fs->nat_mode = NAT_MODE_ALL;
 		break;
 	case FLOW_ACT_MANGLE_HDR_TYPE_UDP:
 		switch (offset) {
 		case PEDIT_UDP_SPORT_DPORT:
-			if (~mask & PEDIT_TCP_UDP_SPORT_MASK)
+			if (~mask & PEDIT_TCP_UDP_SPORT_MASK) {
 				fs->nat_fport = val;
-			else
+				*natmode_flags |= CXGB4_ACTION_NATMODE_SPORT;
+			} else {
 				fs->nat_lport = val >> 16;
+				*natmode_flags |= CXGB4_ACTION_NATMODE_DPORT;
+			}
 		}
-		fs->nat_mode = NAT_MODE_ALL;
+		break;
 	}
 }
 
+static int cxgb4_action_natmode_validate(struct adapter *adap, u8 natmode_flags,
+					 struct netlink_ext_ack *extack)
+{
+	u8 i = 0;
+
+	/* Extract the NAT mode to enable based on what 4-tuple fields
+	 * are enabled to be overwritten. This ensures that the
+	 * disabled fields don't get overwritten to 0.
+	 */
+	for (i = 0; i < ARRAY_SIZE(cxgb4_natmode_config_array); i++) {
+		const struct cxgb4_natmode_config *c;
+
+		c = &cxgb4_natmode_config_array[i];
+		if (CHELSIO_CHIP_VERSION(adap->params.chip) >= c->chip &&
+		    natmode_flags == c->flags)
+			return 0;
+	}
+	NL_SET_ERR_MSG_MOD(extack, "Unsupported NAT mode 4-tuple combination");
+	return -EOPNOTSUPP;
+}
+
 void cxgb4_process_flow_actions(struct net_device *in,
 				struct flow_action *actions,
 				struct ch_filter_specification *fs)
 {
 	struct flow_action_entry *act;
+	u8 natmode_flags = 0;
 	int i;
 
 	flow_action_for_each(i, act, actions) {
@@ -423,13 +542,17 @@ void cxgb4_process_flow_actions(struct n
 			val = act->mangle.val;
 			offset = act->mangle.offset;
 
-			process_pedit_field(fs, val, mask, offset, htype);
+			process_pedit_field(fs, val, mask, offset, htype,
+					    &natmode_flags);
 			}
 			break;
 		default:
 			break;
 		}
 	}
+	if (natmode_flags)
+		cxgb4_action_natmode_tweak(fs, natmode_flags);
+
 }
 
 static bool valid_l4_mask(u32 mask)
@@ -446,7 +569,8 @@ static bool valid_l4_mask(u32 mask)
 }
 
 static bool valid_pedit_action(struct net_device *dev,
-			       const struct flow_action_entry *act)
+			       const struct flow_action_entry *act,
+			       u8 *natmode_flags)
 {
 	u32 mask, offset;
 	u8 htype;
@@ -471,7 +595,10 @@ static bool valid_pedit_action(struct ne
 	case FLOW_ACT_MANGLE_HDR_TYPE_IP4:
 		switch (offset) {
 		case PEDIT_IP4_SRC:
+			*natmode_flags |= CXGB4_ACTION_NATMODE_SIP;
+			break;
 		case PEDIT_IP4_DST:
+			*natmode_flags |= CXGB4_ACTION_NATMODE_DIP;
 			break;
 		default:
 			netdev_err(dev, "%s: Unsupported pedit field\n",
@@ -485,10 +612,13 @@ static bool valid_pedit_action(struct ne
 		case PEDIT_IP6_SRC_63_32:
 		case PEDIT_IP6_SRC_95_64:
 		case PEDIT_IP6_SRC_127_96:
+			*natmode_flags |= CXGB4_ACTION_NATMODE_SIP;
+			break;
 		case PEDIT_IP6_DST_31_0:
 		case PEDIT_IP6_DST_63_32:
 		case PEDIT_IP6_DST_95_64:
 		case PEDIT_IP6_DST_127_96:
+			*natmode_flags |= CXGB4_ACTION_NATMODE_DIP;
 			break;
 		default:
 			netdev_err(dev, "%s: Unsupported pedit field\n",
@@ -504,6 +634,10 @@ static bool valid_pedit_action(struct ne
 					   __func__);
 				return false;
 			}
+			if (~mask & PEDIT_TCP_UDP_SPORT_MASK)
+				*natmode_flags |= CXGB4_ACTION_NATMODE_SPORT;
+			else
+				*natmode_flags |= CXGB4_ACTION_NATMODE_DPORT;
 			break;
 		default:
 			netdev_err(dev, "%s: Unsupported pedit field\n",
@@ -519,6 +653,10 @@ static bool valid_pedit_action(struct ne
 					   __func__);
 				return false;
 			}
+			if (~mask & PEDIT_TCP_UDP_SPORT_MASK)
+				*natmode_flags |= CXGB4_ACTION_NATMODE_SPORT;
+			else
+				*natmode_flags |= CXGB4_ACTION_NATMODE_DPORT;
 			break;
 		default:
 			netdev_err(dev, "%s: Unsupported pedit field\n",
@@ -537,10 +675,12 @@ int cxgb4_validate_flow_actions(struct n
 				struct flow_action *actions,
 				struct netlink_ext_ack *extack)
 {
+	struct adapter *adap = netdev2adap(dev);
 	struct flow_action_entry *act;
 	bool act_redir = false;
 	bool act_pedit = false;
 	bool act_vlan = false;
+	u8 natmode_flags = 0;
 	int i;
 
 	if (!flow_action_basic_hw_stats_check(actions, extack))
@@ -553,7 +693,6 @@ int cxgb4_validate_flow_actions(struct n
 			/* Do nothing */
 			break;
 		case FLOW_ACTION_REDIRECT: {
-			struct adapter *adap = netdev2adap(dev);
 			struct net_device *n_dev, *target_dev;
 			unsigned int i;
 			bool found = false;
@@ -603,7 +742,8 @@ int cxgb4_validate_flow_actions(struct n
 			}
 			break;
 		case FLOW_ACTION_MANGLE: {
-			bool pedit_valid = valid_pedit_action(dev, act);
+			bool pedit_valid = valid_pedit_action(dev, act,
+							      &natmode_flags);
 
 			if (!pedit_valid)
 				return -EOPNOTSUPP;
@@ -622,6 +762,15 @@ int cxgb4_validate_flow_actions(struct n
 		return -EINVAL;
 	}
 
+	if (act_pedit) {
+		int ret;
+
+		ret = cxgb4_action_natmode_validate(adap, natmode_flags,
+						    extack);
+		if (ret)
+			return ret;
+	}
+
 	return 0;
 }
 
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_flower.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_flower.h
@@ -108,6 +108,21 @@ struct ch_tc_pedit_fields {
 #define PEDIT_TCP_SPORT_DPORT		0x0
 #define PEDIT_UDP_SPORT_DPORT		0x0
 
+enum cxgb4_action_natmode_flags {
+	CXGB4_ACTION_NATMODE_NONE = 0,
+	CXGB4_ACTION_NATMODE_DIP = (1 << 0),
+	CXGB4_ACTION_NATMODE_SIP = (1 << 1),
+	CXGB4_ACTION_NATMODE_DPORT = (1 << 2),
+	CXGB4_ACTION_NATMODE_SPORT = (1 << 3),
+};
+
+/* TC PEDIT action to NATMODE translation entry */
+struct cxgb4_natmode_config {
+	enum chip_type chip;
+	u8 flags;
+	u8 natmode;
+};
+
 void cxgb4_process_flow_actions(struct net_device *in,
 				struct flow_action *actions,
 				struct ch_filter_specification *fs);



^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 002/633] ibmveth: Switch order of ibmveth_helper calls.
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
  2020-10-27 13:45 ` [PATCH 5.8 001/633] xgb4: handle 4-tuple PEDIT to NAT mode translation Greg Kroah-Hartman
@ 2020-10-27 13:45 ` Greg Kroah-Hartman
  2020-10-27 13:45 ` [PATCH 5.8 003/633] ibmveth: Identify ingress large send packets Greg Kroah-Hartman
                   ` (633 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, David Wilder, Thomas Falcon,
	Cristobal Forno, Pradeep Satyanarayana, Willem de Bruijn,
	Jakub Kicinski

From: David Wilder <dwilder@us.ibm.com>

[ Upstream commit 5ce9ad815a296374ca21f43f3b1ab5083d202ee1 ]

ibmveth_rx_csum_helper() must be called after ibmveth_rx_mss_helper()
as ibmveth_rx_csum_helper() may alter ip and tcp checksum values.

Fixes: 66aa0678efc2 ("ibmveth: Support to enable LSO/CSO for Trunk VEA.")
Signed-off-by: David Wilder <dwilder@us.ibm.com>
Reviewed-by: Thomas Falcon <tlfalcon@linux.ibm.com>
Reviewed-by: Cristobal Forno <cris.forno@ibm.com>
Reviewed-by: Pradeep Satyanarayana <pradeeps@linux.vnet.ibm.com>
Acked-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/ibm/ibmveth.c |   10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

--- a/drivers/net/ethernet/ibm/ibmveth.c
+++ b/drivers/net/ethernet/ibm/ibmveth.c
@@ -1385,16 +1385,16 @@ static int ibmveth_poll(struct napi_stru
 			skb_put(skb, length);
 			skb->protocol = eth_type_trans(skb, netdev);
 
-			if (csum_good) {
-				skb->ip_summed = CHECKSUM_UNNECESSARY;
-				ibmveth_rx_csum_helper(skb, adapter);
-			}
-
 			if (length > netdev->mtu + ETH_HLEN) {
 				ibmveth_rx_mss_helper(skb, mss, lrg_pkt);
 				adapter->rx_large_packets++;
 			}
 
+			if (csum_good) {
+				skb->ip_summed = CHECKSUM_UNNECESSARY;
+				ibmveth_rx_csum_helper(skb, adapter);
+			}
+
 			napi_gro_receive(napi, skb);	/* send it up */
 
 			netdev->stats.rx_packets++;



^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 003/633] ibmveth: Identify ingress large send packets.
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
  2020-10-27 13:45 ` [PATCH 5.8 001/633] xgb4: handle 4-tuple PEDIT to NAT mode translation Greg Kroah-Hartman
  2020-10-27 13:45 ` [PATCH 5.8 002/633] ibmveth: Switch order of ibmveth_helper calls Greg Kroah-Hartman
@ 2020-10-27 13:45 ` Greg Kroah-Hartman
  2020-10-27 13:45 ` [PATCH 5.8 004/633] ipv4: Restore flowi4_oif update before call to xfrm_lookup_route Greg Kroah-Hartman
                   ` (632 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, David Wilder, Thomas Falcon,
	Cristobal Forno, Pradeep Satyanarayana, Willem de Bruijn,
	Jakub Kicinski

From: David Wilder <dwilder@us.ibm.com>

[ Upstream commit 413f142cc05cb03f2d1ea83388e40c1ddc0d74e9 ]

Ingress large send packets are identified by either:
The IBMVETH_RXQ_LRG_PKT flag in the receive buffer
or with a -1 placed in the ip header checksum.
The method used depends on firmware version. Frame
geometry and sufficient header validation is performed by the
hypervisor eliminating the need for further header checks here.

Fixes: 7b5967389f5a ("ibmveth: set correct gso_size and gso_type")
Signed-off-by: David Wilder <dwilder@us.ibm.com>
Reviewed-by: Thomas Falcon <tlfalcon@linux.ibm.com>
Reviewed-by: Cristobal Forno <cris.forno@ibm.com>
Reviewed-by: Pradeep Satyanarayana <pradeeps@linux.vnet.ibm.com>
Acked-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/ibm/ibmveth.c |   13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

--- a/drivers/net/ethernet/ibm/ibmveth.c
+++ b/drivers/net/ethernet/ibm/ibmveth.c
@@ -1349,6 +1349,7 @@ static int ibmveth_poll(struct napi_stru
 			int offset = ibmveth_rxq_frame_offset(adapter);
 			int csum_good = ibmveth_rxq_csum_good(adapter);
 			int lrg_pkt = ibmveth_rxq_large_packet(adapter);
+			__sum16 iph_check = 0;
 
 			skb = ibmveth_rxq_get_buffer(adapter);
 
@@ -1385,7 +1386,17 @@ static int ibmveth_poll(struct napi_stru
 			skb_put(skb, length);
 			skb->protocol = eth_type_trans(skb, netdev);
 
-			if (length > netdev->mtu + ETH_HLEN) {
+			/* PHYP without PLSO support places a -1 in the ip
+			 * checksum for large send frames.
+			 */
+			if (skb->protocol == cpu_to_be16(ETH_P_IP)) {
+				struct iphdr *iph = (struct iphdr *)skb->data;
+
+				iph_check = iph->check;
+			}
+
+			if ((length > netdev->mtu + ETH_HLEN) ||
+			    lrg_pkt || iph_check == 0xffff) {
 				ibmveth_rx_mss_helper(skb, mss, lrg_pkt);
 				adapter->rx_large_packets++;
 			}



^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 004/633] ipv4: Restore flowi4_oif update before call to xfrm_lookup_route
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (2 preceding siblings ...)
  2020-10-27 13:45 ` [PATCH 5.8 003/633] ibmveth: Identify ingress large send packets Greg Kroah-Hartman
@ 2020-10-27 13:45 ` Greg Kroah-Hartman
  2020-10-27 13:45 ` [PATCH 5.8 005/633] mlx4: handle non-napi callers to napi_poll Greg Kroah-Hartman
                   ` (631 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Tobias Brunner, David Ahern, Jakub Kicinski

From: David Ahern <dsahern@kernel.org>

[ Upstream commit 874fb9e2ca949b443cc419a4f2227cafd4381d39 ]

Tobias reported regressions in IPsec tests following the patch
referenced by the Fixes tag below. The root cause is dropping the
reset of the flowi4_oif after the fib_lookup. Apparently it is
needed for xfrm cases, so restore the oif update to ip_route_output_flow
right before the call to xfrm_lookup_route.

Fixes: 2fbc6e89b2f1 ("ipv4: Update exception handling for multipath routes via same device")
Reported-by: Tobias Brunner <tobias@strongswan.org>
Signed-off-by: David Ahern <dsahern@kernel.org>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv4/route.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -2764,10 +2764,12 @@ struct rtable *ip_route_output_flow(stru
 	if (IS_ERR(rt))
 		return rt;
 
-	if (flp4->flowi4_proto)
+	if (flp4->flowi4_proto) {
+		flp4->flowi4_oif = rt->dst.dev->ifindex;
 		rt = (struct rtable *)xfrm_lookup_route(net, &rt->dst,
 							flowi4_to_flowi(flp4),
 							sk, 0);
+	}
 
 	return rt;
 }



^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 005/633] mlx4: handle non-napi callers to napi_poll
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (3 preceding siblings ...)
  2020-10-27 13:45 ` [PATCH 5.8 004/633] ipv4: Restore flowi4_oif update before call to xfrm_lookup_route Greg Kroah-Hartman
@ 2020-10-27 13:45 ` Greg Kroah-Hartman
  2020-10-27 13:45 ` [PATCH 5.8 006/633] net: dsa: microchip: fix race condition Greg Kroah-Hartman
                   ` (630 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jonathan Lemon, Tariq Toukan, Jakub Kicinski

From: Jonathan Lemon <bsd@fb.com>

[ Upstream commit b2b8a92733b288128feb57ffa694758cf475106c ]

netcons calls napi_poll with a budget of 0 to transmit packets.
Handle this by:
 - skipping RX processing
 - do not try to recycle TX packets to the RX cache

Signed-off-by: Jonathan Lemon <jonathan.lemon@gmail.com>
Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/mellanox/mlx4/en_rx.c |    3 +++
 drivers/net/ethernet/mellanox/mlx4/en_tx.c |    2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

--- a/drivers/net/ethernet/mellanox/mlx4/en_rx.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_rx.c
@@ -943,6 +943,9 @@ int mlx4_en_poll_rx_cq(struct napi_struc
 	bool clean_complete = true;
 	int done;
 
+	if (!budget)
+		return 0;
+
 	if (priv->tx_ring_num[TX_XDP]) {
 		xdp_tx_cq = priv->tx_cq[TX_XDP][cq->ring];
 		if (xdp_tx_cq->xdp_busy) {
--- a/drivers/net/ethernet/mellanox/mlx4/en_tx.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
@@ -350,7 +350,7 @@ u32 mlx4_en_recycle_tx_desc(struct mlx4_
 		.dma = tx_info->map0_dma,
 	};
 
-	if (!mlx4_en_rx_recycle(ring->recycle_ring, &frame)) {
+	if (!napi_mode || !mlx4_en_rx_recycle(ring->recycle_ring, &frame)) {
 		dma_unmap_page(priv->ddev, tx_info->map0_dma,
 			       PAGE_SIZE, priv->dma_dir);
 		put_page(tx_info->page);



^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 006/633] net: dsa: microchip: fix race condition
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (4 preceding siblings ...)
  2020-10-27 13:45 ` [PATCH 5.8 005/633] mlx4: handle non-napi callers to napi_poll Greg Kroah-Hartman
@ 2020-10-27 13:45 ` Greg Kroah-Hartman
  2020-10-27 13:45 ` [PATCH 5.8 007/633] net: fec: Fix phy_device lookup for phy_reset_after_clk_enable() Greg Kroah-Hartman
                   ` (629 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christian Eggers, Florian Fainelli,
	Vladimir Oltean, Jakub Kicinski

From: Christian Eggers <ceggers@arri.de>

[ Upstream commit 8098bd69bc4e925070313b1b95d03510f4f24738 ]

Between queuing the delayed work and finishing the setup of the dsa
ports, the process may sleep in request_module() (via
phy_device_create()) and the queued work may be executed prior to the
switch net devices being registered. In ksz_mib_read_work(), a NULL
dereference will happen within netof_carrier_ok(dp->slave).

Not queuing the delayed work in ksz_init_mib_timer() makes things even
worse because the work will now be queued for immediate execution
(instead of 2000 ms) in ksz_mac_link_down() via
dsa_port_link_register_of().

Call tree:
ksz9477_i2c_probe()
\--ksz9477_switch_register()
   \--ksz_switch_register()
      +--dsa_register_switch()
      |  \--dsa_switch_probe()
      |     \--dsa_tree_setup()
      |        \--dsa_tree_setup_switches()
      |           +--dsa_switch_setup()
      |           |  +--ksz9477_setup()
      |           |  |  \--ksz_init_mib_timer()
      |           |  |     |--/* Start the timer 2 seconds later. */
      |           |  |     \--schedule_delayed_work(&dev->mib_read, msecs_to_jiffies(2000));
      |           |  \--__mdiobus_register()
      |           |     \--mdiobus_scan()
      |           |        \--get_phy_device()
      |           |           +--get_phy_id()
      |           |           \--phy_device_create()
      |           |              |--/* sleeping, ksz_mib_read_work() can be called meanwhile */
      |           |              \--request_module()
      |           |
      |           \--dsa_port_setup()
      |              +--/* Called for non-CPU ports */
      |              +--dsa_slave_create()
      |              |  +--/* Too late, ksz_mib_read_work() may be called beforehand */
      |              |  \--port->slave = ...
      |             ...
      |              +--Called for CPU port */
      |              \--dsa_port_link_register_of()
      |                 \--ksz_mac_link_down()
      |                    +--/* mib_read must be initialized here */
      |                    +--/* work is already scheduled, so it will be executed after 2000 ms */
      |                    \--schedule_delayed_work(&dev->mib_read, 0);
      \-- /* here port->slave is setup properly, scheduling the delayed work should be safe */

Solution:
1. Do not queue (only initialize) delayed work in ksz_init_mib_timer().
2. Only queue delayed work in ksz_mac_link_down() if init is completed.
3. Queue work once in ksz_switch_register(), after dsa_register_switch()
has completed.

Fixes: 7c6ff470aa86 ("net: dsa: microchip: add MIB counter reading support")
Signed-off-by: Christian Eggers <ceggers@arri.de>
Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
Reviewed-by: Vladimir Oltean <olteanv@gmail.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/dsa/microchip/ksz_common.c |   16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

--- a/drivers/net/dsa/microchip/ksz_common.c
+++ b/drivers/net/dsa/microchip/ksz_common.c
@@ -103,14 +103,8 @@ void ksz_init_mib_timer(struct ksz_devic
 
 	INIT_DELAYED_WORK(&dev->mib_read, ksz_mib_read_work);
 
-	/* Read MIB counters every 30 seconds to avoid overflow. */
-	dev->mib_read_interval = msecs_to_jiffies(30000);
-
 	for (i = 0; i < dev->mib_port_cnt; i++)
 		dev->dev_ops->port_init_cnt(dev, i);
-
-	/* Start the timer 2 seconds later. */
-	schedule_delayed_work(&dev->mib_read, msecs_to_jiffies(2000));
 }
 EXPORT_SYMBOL_GPL(ksz_init_mib_timer);
 
@@ -144,7 +138,9 @@ void ksz_adjust_link(struct dsa_switch *
 	/* Read all MIB counters when the link is going down. */
 	if (!phydev->link) {
 		p->read = true;
-		schedule_delayed_work(&dev->mib_read, 0);
+		/* timer started */
+		if (dev->mib_read_interval)
+			schedule_delayed_work(&dev->mib_read, 0);
 	}
 	mutex_lock(&dev->dev_mutex);
 	if (!phydev->link)
@@ -460,6 +456,12 @@ int ksz_switch_register(struct ksz_devic
 		return ret;
 	}
 
+	/* Read MIB counters every 30 seconds to avoid overflow. */
+	dev->mib_read_interval = msecs_to_jiffies(30000);
+
+	/* Start the MIB timer. */
+	schedule_delayed_work(&dev->mib_read, 0);
+
 	return 0;
 }
 EXPORT_SYMBOL(ksz_switch_register);



^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 007/633] net: fec: Fix phy_device lookup for phy_reset_after_clk_enable()
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (5 preceding siblings ...)
  2020-10-27 13:45 ` [PATCH 5.8 006/633] net: dsa: microchip: fix race condition Greg Kroah-Hartman
@ 2020-10-27 13:45 ` Greg Kroah-Hartman
  2020-10-27 13:45 ` [PATCH 5.8 008/633] net: fec: Fix PHY init after phy_reset_after_clk_enable() Greg Kroah-Hartman
                   ` (628 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Marek Vasut, Christoph Niedermaier,
	David S. Miller, NXP Linux Team, Richard Leitner, Shawn Guo,
	Jakub Kicinski

From: Marek Vasut <marex@denx.de>

[ Upstream commit 64a632da538a6827fad0ea461925cedb9899ebe2 ]

The phy_reset_after_clk_enable() is always called with ndev->phydev,
however that pointer may be NULL even though the PHY device instance
already exists and is sufficient to perform the PHY reset.

This condition happens in fec_open(), where the clock must be enabled
first, then the PHY must be reset, and then the PHY IDs can be read
out of the PHY.

If the PHY still is not bound to the MAC, but there is OF PHY node
and a matching PHY device instance already, use the OF PHY node to
obtain the PHY device instance, and then use that PHY device instance
when triggering the PHY reset.

Fixes: 1b0a83ac04e3 ("net: fec: add phy_reset_after_clk_enable() support")
Signed-off-by: Marek Vasut <marex@denx.de>
Cc: Christoph Niedermaier <cniedermaier@dh-electronics.com>
Cc: David S. Miller <davem@davemloft.net>
Cc: NXP Linux Team <linux-imx@nxp.com>
Cc: Richard Leitner <richard.leitner@skidata.com>
Cc: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/freescale/fec_main.c |   25 +++++++++++++++++++++++--
 1 file changed, 23 insertions(+), 2 deletions(-)

--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -1913,6 +1913,27 @@ out:
 	return ret;
 }
 
+static void fec_enet_phy_reset_after_clk_enable(struct net_device *ndev)
+{
+	struct fec_enet_private *fep = netdev_priv(ndev);
+	struct phy_device *phy_dev = ndev->phydev;
+
+	if (phy_dev) {
+		phy_reset_after_clk_enable(phy_dev);
+	} else if (fep->phy_node) {
+		/*
+		 * If the PHY still is not bound to the MAC, but there is
+		 * OF PHY node and a matching PHY device instance already,
+		 * use the OF PHY node to obtain the PHY device instance,
+		 * and then use that PHY device instance when triggering
+		 * the PHY reset.
+		 */
+		phy_dev = of_phy_find_device(fep->phy_node);
+		phy_reset_after_clk_enable(phy_dev);
+		put_device(&phy_dev->mdio.dev);
+	}
+}
+
 static int fec_enet_clk_enable(struct net_device *ndev, bool enable)
 {
 	struct fec_enet_private *fep = netdev_priv(ndev);
@@ -1939,7 +1960,7 @@ static int fec_enet_clk_enable(struct ne
 		if (ret)
 			goto failed_clk_ref;
 
-		phy_reset_after_clk_enable(ndev->phydev);
+		fec_enet_phy_reset_after_clk_enable(ndev);
 	} else {
 		clk_disable_unprepare(fep->clk_enet_out);
 		if (fep->clk_ptp) {
@@ -2994,7 +3015,7 @@ fec_enet_open(struct net_device *ndev)
 	 * phy_reset_after_clk_enable() before because the PHY wasn't probed.
 	 */
 	if (reset_again)
-		phy_reset_after_clk_enable(ndev->phydev);
+		fec_enet_phy_reset_after_clk_enable(ndev);
 
 	if (fep->quirks & FEC_QUIRK_ERR006687)
 		imx6q_cpuidle_fec_irqs_used();



^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 008/633] net: fec: Fix PHY init after phy_reset_after_clk_enable()
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (6 preceding siblings ...)
  2020-10-27 13:45 ` [PATCH 5.8 007/633] net: fec: Fix phy_device lookup for phy_reset_after_clk_enable() Greg Kroah-Hartman
@ 2020-10-27 13:45 ` Greg Kroah-Hartman
  2020-10-27 13:45 ` [PATCH 5.8 009/633] net: fix pos incrementment in ipv6_route_seq_next Greg Kroah-Hartman
                   ` (627 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Andrew Lunn, Richard Leitner,
	Marek Vasut, Christoph Niedermaier, David S. Miller,
	NXP Linux Team, Shawn Guo, Jakub Kicinski

From: Marek Vasut <marex@denx.de>

[ Upstream commit 0da1ccbbefb662915228bc17e1c7d4ad28b3ddab ]

The phy_reset_after_clk_enable() does a PHY reset, which means the PHY
loses its register settings. The fec_enet_mii_probe() starts the PHY
and does the necessary calls to configure the PHY via PHY framework,
and loads the correct register settings into the PHY. Therefore,
fec_enet_mii_probe() should be called only after the PHY has been
reset, not before as it is now.

Fixes: 1b0a83ac04e3 ("net: fec: add phy_reset_after_clk_enable() support")
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Tested-by: Richard Leitner <richard.leitner@skidata.com>
Signed-off-by: Marek Vasut <marex@denx.de>
Cc: Christoph Niedermaier <cniedermaier@dh-electronics.com>
Cc: David S. Miller <davem@davemloft.net>
Cc: NXP Linux Team <linux-imx@nxp.com>
Cc: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/freescale/fec_main.c |   10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -3006,17 +3006,17 @@ fec_enet_open(struct net_device *ndev)
 	/* Init MAC prior to mii bus probe */
 	fec_restart(ndev);
 
-	/* Probe and connect to PHY when open the interface */
-	ret = fec_enet_mii_probe(ndev);
-	if (ret)
-		goto err_enet_mii_probe;
-
 	/* Call phy_reset_after_clk_enable() again if it failed during
 	 * phy_reset_after_clk_enable() before because the PHY wasn't probed.
 	 */
 	if (reset_again)
 		fec_enet_phy_reset_after_clk_enable(ndev);
 
+	/* Probe and connect to PHY when open the interface */
+	ret = fec_enet_mii_probe(ndev);
+	if (ret)
+		goto err_enet_mii_probe;
+
 	if (fep->quirks & FEC_QUIRK_ERR006687)
 		imx6q_cpuidle_fec_irqs_used();
 



^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 009/633] net: fix pos incrementment in ipv6_route_seq_next
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (7 preceding siblings ...)
  2020-10-27 13:45 ` [PATCH 5.8 008/633] net: fec: Fix PHY init after phy_reset_after_clk_enable() Greg Kroah-Hartman
@ 2020-10-27 13:45 ` Greg Kroah-Hartman
  2020-10-27 13:45 ` [PATCH 5.8 010/633] net: ipa: skip suspend/resume activities if not set up Greg Kroah-Hartman
                   ` (626 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Alexei Starovoitov, Vasily Averin,
	Yonghong Song, Martin KaFai Lau, Andrii Nakryiko, Jakub Kicinski

From: Yonghong Song <yhs@fb.com>

[ Upstream commit 6617dfd440149e42ce4d2be615eb31a4755f4d30 ]

Commit 4fc427e05158 ("ipv6_route_seq_next should increase position index")
tried to fix the issue where seq_file pos is not increased
if a NULL element is returned with seq_ops->next(). See bug
  https://bugzilla.kernel.org/show_bug.cgi?id=206283
The commit effectively does:
  - increase pos for all seq_ops->start()
  - increase pos for all seq_ops->next()

For ipv6_route, increasing pos for all seq_ops->next() is correct.
But increasing pos for seq_ops->start() is not correct
since pos is used to determine how many items to skip during
seq_ops->start():
  iter->skip = *pos;
seq_ops->start() just fetches the *current* pos item.
The item can be skipped only after seq_ops->show() which essentially
is the beginning of seq_ops->next().

For example, I have 7 ipv6 route entries,
  root@arch-fb-vm1:~/net-next dd if=/proc/net/ipv6_route bs=4096
  00000000000000000000000000000000 40 00000000000000000000000000000000 00 00000000000000000000000000000000 00000400 00000001 00000000 00000001     eth0
  fe800000000000000000000000000000 40 00000000000000000000000000000000 00 00000000000000000000000000000000 00000100 00000001 00000000 00000001     eth0
  00000000000000000000000000000000 00 00000000000000000000000000000000 00 00000000000000000000000000000000 ffffffff 00000001 00000000 00200200       lo
  00000000000000000000000000000001 80 00000000000000000000000000000000 00 00000000000000000000000000000000 00000000 00000003 00000000 80200001       lo
  fe800000000000002050e3fffebd3be8 80 00000000000000000000000000000000 00 00000000000000000000000000000000 00000000 00000002 00000000 80200001     eth0
  ff000000000000000000000000000000 08 00000000000000000000000000000000 00 00000000000000000000000000000000 00000100 00000004 00000000 00000001     eth0
  00000000000000000000000000000000 00 00000000000000000000000000000000 00 00000000000000000000000000000000 ffffffff 00000001 00000000 00200200       lo
  0+1 records in
  0+1 records out
  1050 bytes (1.0 kB, 1.0 KiB) copied, 0.00707908 s, 148 kB/s
  root@arch-fb-vm1:~/net-next

In the above, I specify buffer size 4096, so all records can be returned
to user space with a single trip to the kernel.

If I use buffer size 128, since each record size is 149, internally
kernel seq_read() will read 149 into its internal buffer and return the data
to user space in two read() syscalls. Then user read() syscall will trigger
next seq_ops->start(). Since the current implementation increased pos even
for seq_ops->start(), it will skip record #2, #4 and #6, assuming the first
record is #1.

  root@arch-fb-vm1:~/net-next dd if=/proc/net/ipv6_route bs=128
  00000000000000000000000000000000 40 00000000000000000000000000000000 00 00000000000000000000000000000000 00000400 00000001 00000000 00000001     eth0
  00000000000000000000000000000000 00 00000000000000000000000000000000 00 00000000000000000000000000000000 ffffffff 00000001 00000000 00200200       lo
  fe800000000000002050e3fffebd3be8 80 00000000000000000000000000000000 00 00000000000000000000000000000000 00000000 00000002 00000000 80200001     eth0
  00000000000000000000000000000000 00 00000000000000000000000000000000 00 00000000000000000000000000000000 ffffffff 00000001 00000000 00200200       lo
4+1 records in
4+1 records out
600 bytes copied, 0.00127758 s, 470 kB/s

To fix the problem, create a fake pos pointer so seq_ops->start()
won't actually increase seq_file pos. With this fix, the
above `dd` command with `bs=128` will show correct result.

Fixes: 4fc427e05158 ("ipv6_route_seq_next should increase position index")
Cc: Alexei Starovoitov <ast@kernel.org>
Suggested-by: Vasily Averin <vvs@virtuozzo.com>
Reviewed-by: Vasily Averin <vvs@virtuozzo.com>
Signed-off-by: Yonghong Song <yhs@fb.com>
Acked-by: Martin KaFai Lau <kafai@fb.com>
Acked-by: Andrii Nakryiko <andrii@kernel.org>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv6/ip6_fib.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -2617,8 +2617,10 @@ static void *ipv6_route_seq_start(struct
 	iter->skip = *pos;
 
 	if (iter->tbl) {
+		loff_t p = 0;
+
 		ipv6_route_seq_setup_walk(iter, net);
-		return ipv6_route_seq_next(seq, NULL, pos);
+		return ipv6_route_seq_next(seq, NULL, &p);
 	} else {
 		return NULL;
 	}



^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 010/633] net: ipa: skip suspend/resume activities if not set up
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (8 preceding siblings ...)
  2020-10-27 13:45 ` [PATCH 5.8 009/633] net: fix pos incrementment in ipv6_route_seq_next Greg Kroah-Hartman
@ 2020-10-27 13:45 ` Greg Kroah-Hartman
  2020-10-27 13:45 ` [PATCH 5.8 011/633] net: mptcp: make DACK4/DACK8 usage consistent among all subflows Greg Kroah-Hartman
                   ` (625 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Matthias Kaehlcke, Alex Elder,
	Jakub Kicinski

From: Alex Elder <elder@linaro.org>

[ Upstream commit d1704382821032fede445b816f4296fd379baacf ]

When processing a system suspend request we suspend modem endpoints
if they are enabled, and call ipa_cmd_tag_process() (which issues
IPA commands) to ensure the IPA pipeline is cleared.  It is an error
to attempt to issue an IPA command before setup is complete, so this
is clearly a bug.  But we also shouldn't suspend or resume any
endpoints that have not been set up.

Have ipa_endpoint_suspend() and ipa_endpoint_resume() immediately
return if setup hasn't completed, to avoid any attempt to configure
endpoints or issue IPA commands in that case.

Fixes: 84f9bd12d46d ("soc: qcom: ipa: IPA endpoints")
Tested-by: Matthias Kaehlcke <mka@chromium.org>
Signed-off-by: Alex Elder <elder@linaro.org>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ipa/ipa_endpoint.c |    6 ++++++
 1 file changed, 6 insertions(+)

--- a/drivers/net/ipa/ipa_endpoint.c
+++ b/drivers/net/ipa/ipa_endpoint.c
@@ -1447,6 +1447,9 @@ void ipa_endpoint_resume_one(struct ipa_
 
 void ipa_endpoint_suspend(struct ipa *ipa)
 {
+	if (!ipa->setup_complete)
+		return;
+
 	if (ipa->modem_netdev)
 		ipa_modem_suspend(ipa->modem_netdev);
 
@@ -1458,6 +1461,9 @@ void ipa_endpoint_suspend(struct ipa *ip
 
 void ipa_endpoint_resume(struct ipa *ipa)
 {
+	if (!ipa->setup_complete)
+		return;
+
 	ipa_endpoint_resume_one(ipa->name_map[IPA_ENDPOINT_AP_COMMAND_TX]);
 	ipa_endpoint_resume_one(ipa->name_map[IPA_ENDPOINT_AP_LAN_RX]);
 



^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 011/633] net: mptcp: make DACK4/DACK8 usage consistent among all subflows
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (9 preceding siblings ...)
  2020-10-27 13:45 ` [PATCH 5.8 010/633] net: ipa: skip suspend/resume activities if not set up Greg Kroah-Hartman
@ 2020-10-27 13:45 ` Greg Kroah-Hartman
  2020-10-27 13:45 ` [PATCH 5.8 012/633] net: sched: Fix suspicious RCU usage while accessing tcf_tunnel_info Greg Kroah-Hartman
                   ` (624 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Paolo Abeni, Davide Caratti,
	Mat Martineau, Jakub Kicinski

From: Davide Caratti <dcaratti@redhat.com>

[ Upstream commit 37198e93ced70733f0b993dff28b7c33857e254f ]

using packetdrill it's possible to observe the same MPTCP DSN being acked
by different subflows with DACK4 and DACK8. This is in contrast with what
specified in RFC8684 §3.3.2: if an MPTCP endpoint transmits a 64-bit wide
DSN, it MUST be acknowledged with a 64-bit wide DACK. Fix 'use_64bit_ack'
variable to make it a property of MPTCP sockets, not TCP subflows.

Fixes: a0c1d0eafd1e ("mptcp: Use 32-bit DATA_ACK when possible")
Acked-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Davide Caratti <dcaratti@redhat.com>
Reviewed-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/mptcp/options.c  |    2 +-
 net/mptcp/protocol.h |    2 +-
 net/mptcp/subflow.c  |    3 +--
 3 files changed, 3 insertions(+), 4 deletions(-)

--- a/net/mptcp/options.c
+++ b/net/mptcp/options.c
@@ -517,7 +517,7 @@ static bool mptcp_established_options_ds
 		return ret;
 	}
 
-	if (subflow->use_64bit_ack) {
+	if (READ_ONCE(msk->use_64bit_ack)) {
 		ack_size = TCPOLEN_MPTCP_DSS_ACK64;
 		opts->ext_copy.data_ack = msk->ack_seq;
 		opts->ext_copy.ack64 = 1;
--- a/net/mptcp/protocol.h
+++ b/net/mptcp/protocol.h
@@ -199,6 +199,7 @@ struct mptcp_sock {
 	u32		token;
 	unsigned long	flags;
 	bool		can_ack;
+	bool		use_64bit_ack; /* Set when we received a 64-bit DSN */
 	spinlock_t	join_list_lock;
 	struct work_struct work;
 	struct list_head conn_list;
@@ -285,7 +286,6 @@ struct mptcp_subflow_context {
 		data_avail : 1,
 		rx_eof : 1,
 		data_fin_tx_enable : 1,
-		use_64bit_ack : 1, /* Set when we received a 64-bit DSN */
 		can_ack : 1;	    /* only after processing the remote a key */
 	u64	data_fin_tx_seq;
 	u32	remote_nonce;
--- a/net/mptcp/subflow.c
+++ b/net/mptcp/subflow.c
@@ -682,12 +682,11 @@ static enum mapping_status get_mapping_s
 	if (!mpext->dsn64) {
 		map_seq = expand_seq(subflow->map_seq, subflow->map_data_len,
 				     mpext->data_seq);
-		subflow->use_64bit_ack = 0;
 		pr_debug("expanded seq=%llu", subflow->map_seq);
 	} else {
 		map_seq = mpext->data_seq;
-		subflow->use_64bit_ack = 1;
 	}
+	WRITE_ONCE(mptcp_sk(subflow->conn)->use_64bit_ack, !!mpext->dsn64);
 
 	if (subflow->map_valid) {
 		/* Allow replacing only with an identical map */



^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 012/633] net: sched: Fix suspicious RCU usage while accessing tcf_tunnel_info
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (10 preceding siblings ...)
  2020-10-27 13:45 ` [PATCH 5.8 011/633] net: mptcp: make DACK4/DACK8 usage consistent among all subflows Greg Kroah-Hartman
@ 2020-10-27 13:45 ` Greg Kroah-Hartman
  2020-10-27 13:45 ` [PATCH 5.8 013/633] net/smc: fix use-after-free of delayed events Greg Kroah-Hartman
                   ` (623 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Leon Romanovsky, Cong Wang, Jakub Kicinski

From: Leon Romanovsky <leonro@nvidia.com>

[ Upstream commit d086a1c65aabb5a4e1edc580ca583e2964c62b44 ]

The access of tcf_tunnel_info() produces the following splat, so fix it
by dereferencing the tcf_tunnel_key_params pointer with marker that
internal tcfa_liock is held.

 =============================
 WARNING: suspicious RCU usage
 5.9.0+ #1 Not tainted
 -----------------------------
 include/net/tc_act/tc_tunnel_key.h:59 suspicious rcu_dereference_protected() usage!
 other info that might help us debug this:

 rcu_scheduler_active = 2, debug_locks = 1
 1 lock held by tc/34839:
  #0: ffff88828572c2a0 (&p->tcfa_lock){+...}-{2:2}, at: tc_setup_flow_action+0xb3/0x48b5
 stack backtrace:
 CPU: 1 PID: 34839 Comm: tc Not tainted 5.9.0+ #1
 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014
 Call Trace:
  dump_stack+0x9a/0xd0
  tc_setup_flow_action+0x14cb/0x48b5
  fl_hw_replace_filter+0x347/0x690 [cls_flower]
  fl_change+0x2bad/0x4875 [cls_flower]
  tc_new_tfilter+0xf6f/0x1ba0
  rtnetlink_rcv_msg+0x5f2/0x870
  netlink_rcv_skb+0x124/0x350
  netlink_unicast+0x433/0x700
  netlink_sendmsg+0x6f1/0xbd0
  sock_sendmsg+0xb0/0xe0
  ____sys_sendmsg+0x4fa/0x6d0
  ___sys_sendmsg+0x12e/0x1b0
  __sys_sendmsg+0xa4/0x120
  do_syscall_64+0x2d/0x40
  entry_SYSCALL_64_after_hwframe+0x44/0xa9
 RIP: 0033:0x7f1f8cd4fe57
 Code: 0c 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10
 RSP: 002b:00007ffdc1e193b8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f1f8cd4fe57
 RDX: 0000000000000000 RSI: 00007ffdc1e19420 RDI: 0000000000000003
 RBP: 000000005f85aafa R08: 0000000000000001 R09: 00007ffdc1e1936c
 R10: 000000000040522d R11: 0000000000000246 R12: 0000000000000001
 R13: 0000000000000000 R14: 00007ffdc1e1d6f0 R15: 0000000000482420

Fixes: 3ebaf6da0716 ("net: sched: Do not assume RTNL is held in tunnel key action helpers")
Fixes: 7a47281439ba ("net: sched: lock action when translating it to flow_action infra")
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Acked-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/net/tc_act/tc_tunnel_key.h |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

--- a/include/net/tc_act/tc_tunnel_key.h
+++ b/include/net/tc_act/tc_tunnel_key.h
@@ -56,7 +56,10 @@ static inline struct ip_tunnel_info *tcf
 {
 #ifdef CONFIG_NET_CLS_ACT
 	struct tcf_tunnel_key *t = to_tunnel_key(a);
-	struct tcf_tunnel_key_params *params = rtnl_dereference(t->params);
+	struct tcf_tunnel_key_params *params;
+
+	params = rcu_dereference_protected(t->params,
+					   lockdep_is_held(&a->tcfa_lock));
 
 	return &params->tcft_enc_metadata->u.tun_info;
 #else



^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 013/633] net/smc: fix use-after-free of delayed events
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (11 preceding siblings ...)
  2020-10-27 13:45 ` [PATCH 5.8 012/633] net: sched: Fix suspicious RCU usage while accessing tcf_tunnel_info Greg Kroah-Hartman
@ 2020-10-27 13:45 ` Greg Kroah-Hartman
  2020-10-27 13:45 ` [PATCH 5.8 014/633] net/smc: fix valid DMBE buffer sizes Greg Kroah-Hartman
                   ` (622 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:45 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Karsten Graul, Jakub Kicinski

From: Karsten Graul <kgraul@linux.ibm.com>

[ Upstream commit d535ca1367787ddc8bff22d679a11f864c8228bc ]

When a delayed event is enqueued then the event worker will send this
event the next time it is running and no other flow is currently
active. The event handler is called for the delayed event, and the
pointer to the event keeps set in lgr->delayed_event. This pointer is
cleared later in the processing by smc_llc_flow_start().
This can lead to a use-after-free condition when the processing does not
reach smc_llc_flow_start(), but frees the event because of an error
situation. Then the delayed_event pointer is still set but the event is
freed.
Fix this by always clearing the delayed event pointer when the event is
provided to the event handler for processing, and remove the code to
clear it in smc_llc_flow_start().

Fixes: 555da9af827d ("net/smc: add event-based llc_flow framework")
Signed-off-by: Karsten Graul <kgraul@linux.ibm.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/smc/smc_llc.c |   13 +++++--------
 1 file changed, 5 insertions(+), 8 deletions(-)

--- a/net/smc/smc_llc.c
+++ b/net/smc/smc_llc.c
@@ -233,8 +233,6 @@ static bool smc_llc_flow_start(struct sm
 	default:
 		flow->type = SMC_LLC_FLOW_NONE;
 	}
-	if (qentry == lgr->delayed_event)
-		lgr->delayed_event = NULL;
 	smc_llc_flow_qentry_set(flow, qentry);
 	spin_unlock_bh(&lgr->llc_flow_lock);
 	return true;
@@ -1590,13 +1588,12 @@ static void smc_llc_event_work(struct wo
 	struct smc_llc_qentry *qentry;
 
 	if (!lgr->llc_flow_lcl.type && lgr->delayed_event) {
-		if (smc_link_usable(lgr->delayed_event->link)) {
-			smc_llc_event_handler(lgr->delayed_event);
-		} else {
-			qentry = lgr->delayed_event;
-			lgr->delayed_event = NULL;
+		qentry = lgr->delayed_event;
+		lgr->delayed_event = NULL;
+		if (smc_link_usable(qentry->link))
+			smc_llc_event_handler(qentry);
+		else
 			kfree(qentry);
-		}
 	}
 
 again:



^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 014/633] net/smc: fix valid DMBE buffer sizes
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (12 preceding siblings ...)
  2020-10-27 13:45 ` [PATCH 5.8 013/633] net/smc: fix use-after-free of delayed events Greg Kroah-Hartman
@ 2020-10-27 13:45 ` Greg Kroah-Hartman
  2020-10-27 13:45 ` [PATCH 5.8 015/633] net/tls: sendfile fails with ktls offload Greg Kroah-Hartman
                   ` (621 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:45 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Karsten Graul, Jakub Kicinski

From: Karsten Graul <kgraul@linux.ibm.com>

[ Upstream commit ef12ad45880b696eb993d86c481ca891836ab593 ]

The SMCD_DMBE_SIZES should include all valid DMBE buffer sizes, so the
correct value is 6 which means 1MB. With 7 the registration of an ISM
buffer would always fail because of the invalid size requested.
Fix that and set the value to 6.

Fixes: c6ba7c9ba43d ("net/smc: add base infrastructure for SMC-D and ISM")
Signed-off-by: Karsten Graul <kgraul@linux.ibm.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/smc/smc_core.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/net/smc/smc_core.c
+++ b/net/smc/smc_core.c
@@ -1595,7 +1595,7 @@ out:
 	return rc;
 }
 
-#define SMCD_DMBE_SIZES		7 /* 0 -> 16KB, 1 -> 32KB, .. 6 -> 1MB */
+#define SMCD_DMBE_SIZES		6 /* 0 -> 16KB, 1 -> 32KB, .. 6 -> 1MB */
 
 static struct smc_buf_desc *smcd_new_buf_create(struct smc_link_group *lgr,
 						bool is_dmb, int bufsize)



^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 015/633] net/tls: sendfile fails with ktls offload
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (13 preceding siblings ...)
  2020-10-27 13:45 ` [PATCH 5.8 014/633] net/smc: fix valid DMBE buffer sizes Greg Kroah-Hartman
@ 2020-10-27 13:45 ` Greg Kroah-Hartman
  2020-10-27 13:45 ` [PATCH 5.8 016/633] net: usb: qmi_wwan: add Cellient MPL200 card Greg Kroah-Hartman
                   ` (620 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:45 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Rohit Maheshwari, Jakub Kicinski

From: Rohit Maheshwari <rohitm@chelsio.com>

[ Upstream commit ea1dd3e9d080c961b9a451130b61c72dc9a5397b ]

At first when sendpage gets called, if there is more data, 'more' in
tls_push_data() gets set which later sets pending_open_record_frags, but
when there is no more data in file left, and last time tls_push_data()
gets called, pending_open_record_frags doesn't get reset. And later when
2 bytes of encrypted alert comes as sendmsg, it first checks for
pending_open_record_frags, and since this is set, it creates a record with
0 data bytes to encrypt, meaning record length is prepend_size + tag_size
only, which causes problem.
 We should set/reset pending_open_record_frags based on more bit.

Fixes: e8f69799810c ("net/tls: Add generic NIC offload infrastructure")
Signed-off-by: Rohit Maheshwari <rohitm@chelsio.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/tls/tls_device.c |   11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

--- a/net/tls/tls_device.c
+++ b/net/tls/tls_device.c
@@ -418,14 +418,14 @@ static int tls_push_data(struct sock *sk
 	struct tls_context *tls_ctx = tls_get_ctx(sk);
 	struct tls_prot_info *prot = &tls_ctx->prot_info;
 	struct tls_offload_context_tx *ctx = tls_offload_ctx_tx(tls_ctx);
-	int more = flags & (MSG_SENDPAGE_NOTLAST | MSG_MORE);
 	struct tls_record_info *record = ctx->open_record;
 	int tls_push_record_flags;
 	struct page_frag *pfrag;
 	size_t orig_size = size;
 	u32 max_open_record_len;
-	int copy, rc = 0;
+	bool more = false;
 	bool done = false;
+	int copy, rc = 0;
 	long timeo;
 
 	if (flags &
@@ -492,9 +492,8 @@ handle_error:
 		if (!size) {
 last_record:
 			tls_push_record_flags = flags;
-			if (more) {
-				tls_ctx->pending_open_record_frags =
-						!!record->num_frags;
+			if (flags & (MSG_SENDPAGE_NOTLAST | MSG_MORE)) {
+				more = true;
 				break;
 			}
 
@@ -526,6 +525,8 @@ last_record:
 		}
 	} while (!done);
 
+	tls_ctx->pending_open_record_frags = more;
+
 	if (orig_size - size > 0)
 		rc = orig_size - size;
 



^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 016/633] net: usb: qmi_wwan: add Cellient MPL200 card
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (14 preceding siblings ...)
  2020-10-27 13:45 ` [PATCH 5.8 015/633] net/tls: sendfile fails with ktls offload Greg Kroah-Hartman
@ 2020-10-27 13:45 ` Greg Kroah-Hartman
  2020-10-27 13:46 ` [PATCH 5.8 017/633] tipc: fix the skb_unshare() in tipc_buf_append() Greg Kroah-Hartman
                   ` (619 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:45 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Wilken Gottwalt, Bjørn Mork,
	Jakub Kicinski

From: Wilken Gottwalt <wilken.gottwalt@mailbox.org>

[ Upstream commit 28802e7c0c9954218d1830f7507edc9d49b03a00 ]

Add usb ids of the Cellient MPL200 card.

Signed-off-by: Wilken Gottwalt <wilken.gottwalt@mailbox.org>
Acked-by: Bjørn Mork <bjorn@mork.no>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/usb/qmi_wwan.c |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -1375,6 +1375,7 @@ static const struct usb_device_id produc
 	{QMI_QUIRK_SET_DTR(0x2cb7, 0x0104, 4)},	/* Fibocom NL678 series */
 	{QMI_FIXED_INTF(0x0489, 0xe0b4, 0)},	/* Foxconn T77W968 LTE */
 	{QMI_FIXED_INTF(0x0489, 0xe0b5, 0)},	/* Foxconn T77W968 LTE with eSIM support*/
+	{QMI_FIXED_INTF(0x2692, 0x9025, 4)},    /* Cellient MPL200 (rebranded Qualcomm 05c6:9025) */
 
 	/* 4. Gobi 1000 devices */
 	{QMI_GOBI1K_DEVICE(0x05c6, 0x9212)},	/* Acer Gobi Modem Device */



^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 017/633] tipc: fix the skb_unshare() in tipc_buf_append()
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (15 preceding siblings ...)
  2020-10-27 13:45 ` [PATCH 5.8 016/633] net: usb: qmi_wwan: add Cellient MPL200 card Greg Kroah-Hartman
@ 2020-10-27 13:46 ` Greg Kroah-Hartman
  2020-10-27 13:46 ` [PATCH 5.8 018/633] socket: fix option SO_TIMESTAMPING_NEW Greg Kroah-Hartman
                   ` (618 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jon Maloy, Ying Xue, Cong Wang,
	Xin Long, Jakub Kicinski, syzbot+e96a7ba46281824cc46a

From: Cong Wang <xiyou.wangcong@gmail.com>

[ Upstream commit ed42989eab57d619667d7e87dfbd8fe207db54fe ]

skb_unshare() drops a reference count on the old skb unconditionally,
so in the failure case, we end up freeing the skb twice here.
And because the skb is allocated in fclone and cloned by caller
tipc_msg_reassemble(), the consequence is actually freeing the
original skb too, thus triggered the UAF by syzbot.

Fix this by replacing this skb_unshare() with skb_cloned()+skb_copy().

Fixes: ff48b6222e65 ("tipc: use skb_unshare() instead in tipc_buf_append()")
Reported-and-tested-by: syzbot+e96a7ba46281824cc46a@syzkaller.appspotmail.com
Cc: Jon Maloy <jmaloy@redhat.com>
Cc: Ying Xue <ying.xue@windriver.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Reviewed-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/tipc/msg.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/net/tipc/msg.c
+++ b/net/tipc/msg.c
@@ -150,7 +150,8 @@ int tipc_buf_append(struct sk_buff **hea
 	if (fragid == FIRST_FRAGMENT) {
 		if (unlikely(head))
 			goto err;
-		frag = skb_unshare(frag, GFP_ATOMIC);
+		if (skb_cloned(frag))
+			frag = skb_copy(frag, GFP_ATOMIC);
 		if (unlikely(!frag))
 			goto err;
 		head = *headbuf = frag;



^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 018/633] socket: fix option SO_TIMESTAMPING_NEW
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (16 preceding siblings ...)
  2020-10-27 13:46 ` [PATCH 5.8 017/633] tipc: fix the skb_unshare() in tipc_buf_append() Greg Kroah-Hartman
@ 2020-10-27 13:46 ` Greg Kroah-Hartman
  2020-10-27 13:46 ` [PATCH 5.8 019/633] socket: dont clear SOCK_TSTAMP_NEW when SO_TIMESTAMPNS is disabled Greg Kroah-Hartman
                   ` (617 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christian Eggers, Willem de Bruijn,
	Deepa Dinamani, Willem de Bruijn, Jakub Kicinski

From: Christian Eggers <ceggers@arri.de>

[ Upstream commit 59e611a566e7cd48cf54b6777a11fe3f9c2f9db5 ]

The comparison of optname with SO_TIMESTAMPING_NEW is wrong way around,
so SOCK_TSTAMP_NEW will first be set and than reset again. Additionally
move it out of the test for SOF_TIMESTAMPING_RX_SOFTWARE as this seems
unrelated.

This problem happens on 32 bit platforms were the libc has already
switched to struct timespec64 (from SO_TIMExxx_OLD to SO_TIMExxx_NEW
socket options). ptp4l complains with "missing timestamp on transmitted
peer delay request" because the wrong format is received (and
discarded).

Fixes: 9718475e6908 ("socket: Add SO_TIMESTAMPING_NEW")
Signed-off-by: Christian Eggers <ceggers@arri.de>
Reviewed-by: Willem de Bruijn <willemdebruijn.kernel@gmail.com>
Reviewed-by: Deepa Dinamani <deepa.kernel@gmail.com>
Acked-by: Willem de Bruijn <willemb@google.com>
Acked-by: Deepa Dinamani <deepa.kernel@gmail.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/core/sock.c |   10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)

--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -1007,8 +1007,6 @@ set_sndbuf:
 		__sock_set_timestamps(sk, valbool, true, true);
 		break;
 	case SO_TIMESTAMPING_NEW:
-		sock_set_flag(sk, SOCK_TSTAMP_NEW);
-		/* fall through */
 	case SO_TIMESTAMPING_OLD:
 		if (val & ~SOF_TIMESTAMPING_MASK) {
 			ret = -EINVAL;
@@ -1037,16 +1035,14 @@ set_sndbuf:
 		}
 
 		sk->sk_tsflags = val;
+		sock_valbool_flag(sk, SOCK_TSTAMP_NEW, optname == SO_TIMESTAMPING_NEW);
+
 		if (val & SOF_TIMESTAMPING_RX_SOFTWARE)
 			sock_enable_timestamp(sk,
 					      SOCK_TIMESTAMPING_RX_SOFTWARE);
-		else {
-			if (optname == SO_TIMESTAMPING_NEW)
-				sock_reset_flag(sk, SOCK_TSTAMP_NEW);
-
+		else
 			sock_disable_timestamp(sk,
 					       (1UL << SOCK_TIMESTAMPING_RX_SOFTWARE));
-		}
 		break;
 
 	case SO_RCVLOWAT:



^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 019/633] socket: dont clear SOCK_TSTAMP_NEW when SO_TIMESTAMPNS is disabled
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (17 preceding siblings ...)
  2020-10-27 13:46 ` [PATCH 5.8 018/633] socket: fix option SO_TIMESTAMPING_NEW Greg Kroah-Hartman
@ 2020-10-27 13:46 ` Greg Kroah-Hartman
  2020-10-27 13:46 ` [PATCH 5.8 020/633] can: m_can_platform: dont call m_can_class_suspend in runtime suspend Greg Kroah-Hartman
                   ` (616 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christian Eggers, Willem de Bruijn,
	Deepa Dinamani, Jakub Kicinski

From: Christian Eggers <ceggers@arri.de>

[ Upstream commit 4e3bbb33e6f36e4b05be1b1b9b02e3dd5aaa3e69 ]

SOCK_TSTAMP_NEW (timespec64 instead of timespec) is also used for
hardware time stamps (configured via SO_TIMESTAMPING_NEW).

User space (ptp4l) first configures hardware time stamping via
SO_TIMESTAMPING_NEW which sets SOCK_TSTAMP_NEW. In the next step, ptp4l
disables SO_TIMESTAMPNS(_NEW) (software time stamps), but this must not
switch hardware time stamps back to "32 bit mode".

This problem happens on 32 bit platforms were the libc has already
switched to struct timespec64 (from SO_TIMExxx_OLD to SO_TIMExxx_NEW
socket options). ptp4l complains with "missing timestamp on transmitted
peer delay request" because the wrong format is received (and
discarded).

Fixes: 887feae36aee ("socket: Add SO_TIMESTAMP[NS]_NEW")
Fixes: 783da70e8396 ("net: add sock_enable_timestamps")
Signed-off-by: Christian Eggers <ceggers@arri.de>
Acked-by: Willem de Bruijn <willemb@google.com>
Acked-by: Deepa Dinamani <deepa.kernel@gmail.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/core/sock.c |    1 -
 1 file changed, 1 deletion(-)

--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -777,7 +777,6 @@ static void __sock_set_timestamps(struct
 	} else {
 		sock_reset_flag(sk, SOCK_RCVTSTAMP);
 		sock_reset_flag(sk, SOCK_RCVTSTAMPNS);
-		sock_reset_flag(sk, SOCK_TSTAMP_NEW);
 	}
 }
 



^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 020/633] can: m_can_platform: dont call m_can_class_suspend in runtime suspend
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (18 preceding siblings ...)
  2020-10-27 13:46 ` [PATCH 5.8 019/633] socket: dont clear SOCK_TSTAMP_NEW when SO_TIMESTAMPNS is disabled Greg Kroah-Hartman
@ 2020-10-27 13:46 ` Greg Kroah-Hartman
  2020-10-27 13:46 ` [PATCH 5.8 021/633] can: j1935: j1939_tp_tx_dat_new(): fix missing initialization of skbcnt Greg Kroah-Hartman
                   ` (615 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lucas Stach, Dan Murphy, Marc Kleine-Budde

From: Lucas Stach <l.stach@pengutronix.de>

[ Upstream commit 81f1f5ae8b3cbd54fdd994c9e9aacdb7b414a802 ]

    0704c5743694 can: m_can_platform: remove unnecessary m_can_class_resume() call

removed the m_can_class_resume() call in the runtime resume path to get
rid of a infinite recursion, so the runtime resume now only handles the device
clocks.

Unfortunately it did not remove the complementary m_can_class_suspend() call in
the runtime suspend function, so those paths are now unbalanced, which causes
the pinctrl state to get stuck on the "sleep" state, which breaks all CAN
functionality on SoCs where this state is defined. Remove the
m_can_class_suspend() call to fix this.

Fixes: 0704c5743694 can: m_can_platform: remove unnecessary m_can_class_resume() call
Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
Link: https://lore.kernel.org/r/20200811081545.19921-1-l.stach@pengutronix.de
Acked-by: Dan Murphy <dmurphy@ti.com>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/can/m_can/m_can_platform.c |    2 --
 1 file changed, 2 deletions(-)

--- a/drivers/net/can/m_can/m_can_platform.c
+++ b/drivers/net/can/m_can/m_can_platform.c
@@ -144,8 +144,6 @@ static int __maybe_unused m_can_runtime_
 	struct net_device *ndev = dev_get_drvdata(dev);
 	struct m_can_classdev *mcan_class = netdev_priv(ndev);
 
-	m_can_class_suspend(dev);
-
 	clk_disable_unprepare(mcan_class->cclk);
 	clk_disable_unprepare(mcan_class->hclk);
 



^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 021/633] can: j1935: j1939_tp_tx_dat_new(): fix missing initialization of skbcnt
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (19 preceding siblings ...)
  2020-10-27 13:46 ` [PATCH 5.8 020/633] can: m_can_platform: dont call m_can_class_suspend in runtime suspend Greg Kroah-Hartman
@ 2020-10-27 13:46 ` Greg Kroah-Hartman
  2020-10-27 13:46 ` [PATCH 5.8 022/633] net: j1939: j1939_session_fresh_new(): " Greg Kroah-Hartman
                   ` (614 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Robin van der Gracht, Oleksij Rempel,
	Pengutronix Kernel Team, Oliver Hartkopp, Marc Kleine-Budde,
	Cong Wang, syzbot+3f3837e61a48d32b495f

From: Cong Wang <xiyou.wangcong@gmail.com>

[ Upstream commit e009f95b1543e26606dca2f7e6e9f0f9174538e5 ]

This fixes an uninit-value warning:
BUG: KMSAN: uninit-value in can_receive+0x26b/0x630 net/can/af_can.c:650

Reported-and-tested-by: syzbot+3f3837e61a48d32b495f@syzkaller.appspotmail.com
Fixes: 9d71dd0c7009 ("can: add support of SAE J1939 protocol")
Cc: Robin van der Gracht <robin@protonic.nl>
Cc: Oleksij Rempel <linux@rempel-privat.de>
Cc: Pengutronix Kernel Team <kernel@pengutronix.de>
Cc: Oliver Hartkopp <socketcan@hartkopp.net>
Cc: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Link: https://lore.kernel.org/r/20201008061821.24663-1-xiyou.wangcong@gmail.com
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/can/j1939/transport.c |    1 +
 1 file changed, 1 insertion(+)

--- a/net/can/j1939/transport.c
+++ b/net/can/j1939/transport.c
@@ -580,6 +580,7 @@ sk_buff *j1939_tp_tx_dat_new(struct j193
 	skb->dev = priv->ndev;
 	can_skb_reserve(skb);
 	can_skb_prv(skb)->ifindex = priv->ndev->ifindex;
+	can_skb_prv(skb)->skbcnt = 0;
 	/* reserve CAN header */
 	skb_reserve(skb, offsetof(struct can_frame, data));
 



^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 022/633] net: j1939: j1939_session_fresh_new(): fix missing initialization of skbcnt
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (20 preceding siblings ...)
  2020-10-27 13:46 ` [PATCH 5.8 021/633] can: j1935: j1939_tp_tx_dat_new(): fix missing initialization of skbcnt Greg Kroah-Hartman
@ 2020-10-27 13:46 ` Greg Kroah-Hartman
  2020-10-27 13:46 ` [PATCH 5.8 023/633] net/ipv4: always honour route mtu during forwarding Greg Kroah-Hartman
                   ` (613 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jakub Kicinski, Marc Kleine-Budde

From: Marc Kleine-Budde <mkl@pengutronix.de>

[ Upstream commit 13ba4c434422837d7c8c163f9c8d854e67bf3c99 ]

This patch add the initialization of skbcnt, similar to:

    e009f95b1543 can: j1935: j1939_tp_tx_dat_new(): fix missing initialization of skbcnt

Let's play save and initialize this skbcnt as well.

Suggested-by: Jakub Kicinski <kuba@kernel.org>
Fixes: 9d71dd0c7009 ("can: add support of SAE J1939 protocol")
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/can/j1939/transport.c |    1 +
 1 file changed, 1 insertion(+)

--- a/net/can/j1939/transport.c
+++ b/net/can/j1939/transport.c
@@ -1488,6 +1488,7 @@ j1939_session *j1939_session_fresh_new(s
 	skb->dev = priv->ndev;
 	can_skb_reserve(skb);
 	can_skb_prv(skb)->ifindex = priv->ndev->ifindex;
+	can_skb_prv(skb)->skbcnt = 0;
 	skcb = j1939_skb_to_cb(skb);
 	memcpy(skcb, rel_skcb, sizeof(*skcb));
 



^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 023/633] net/ipv4: always honour route mtu during forwarding
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (21 preceding siblings ...)
  2020-10-27 13:46 ` [PATCH 5.8 022/633] net: j1939: j1939_session_fresh_new(): " Greg Kroah-Hartman
@ 2020-10-27 13:46 ` Greg Kroah-Hartman
  2020-10-27 13:46 ` [PATCH 5.8 024/633] net_sched: remove a redundant goto chain check Greg Kroah-Hartman
                   ` (612 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Maciej Żenczykowski,
	Eric Dumazet, Willem de Bruijn, Lorenzo Colitti,
	Sunmeet Gill (Sunny),
	Vinay Paradkar, Tyler Wear, David Ahern

From: "Maciej Żenczykowski" <maze@google.com>

[ Upstream commit 02a1b175b0e92d9e0fa5df3957ade8d733ceb6a0 ]

Documentation/networking/ip-sysctl.txt:46 says:
  ip_forward_use_pmtu - BOOLEAN
    By default we don't trust protocol path MTUs while forwarding
    because they could be easily forged and can lead to unwanted
    fragmentation by the router.
    You only need to enable this if you have user-space software
    which tries to discover path mtus by itself and depends on the
    kernel honoring this information. This is normally not the case.
    Default: 0 (disabled)
    Possible values:
    0 - disabled
    1 - enabled

Which makes it pretty clear that setting it to 1 is a potential
security/safety/DoS issue, and yet it is entirely reasonable to want
forwarded traffic to honour explicitly administrator configured
route mtus (instead of defaulting to device mtu).

Indeed, I can't think of a single reason why you wouldn't want to.
Since you configured a route mtu you probably know better...

It is pretty common to have a higher device mtu to allow receiving
large (jumbo) frames, while having some routes via that interface
(potentially including the default route to the internet) specify
a lower mtu.

Note that ipv6 forwarding uses device mtu unless the route is locked
(in which case it will use the route mtu).

This approach is not usable for IPv4 where an 'mtu lock' on a route
also has the side effect of disabling TCP path mtu discovery via
disabling the IPv4 DF (don't frag) bit on all outgoing frames.

I'm not aware of a way to lock a route from an IPv6 RA, so that also
potentially seems wrong.

Signed-off-by: Maciej Żenczykowski <maze@google.com>
Cc: Eric Dumazet <edumazet@google.com>
Cc: Willem de Bruijn <willemb@google.com>
Cc: Lorenzo Colitti <lorenzo@google.com>
Cc: Sunmeet Gill (Sunny) <sgill@quicinc.com>
Cc: Vinay Paradkar <vparadka@qti.qualcomm.com>
Cc: Tyler Wear <twear@quicinc.com>
Cc: David Ahern <dsahern@kernel.org>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/net/ip.h |    6 ++++++
 1 file changed, 6 insertions(+)

--- a/include/net/ip.h
+++ b/include/net/ip.h
@@ -439,12 +439,18 @@ static inline unsigned int ip_dst_mtu_ma
 						    bool forwarding)
 {
 	struct net *net = dev_net(dst->dev);
+	unsigned int mtu;
 
 	if (net->ipv4.sysctl_ip_fwd_use_pmtu ||
 	    ip_mtu_locked(dst) ||
 	    !forwarding)
 		return dst_mtu(dst);
 
+	/* 'forwarding = true' case should always honour route mtu */
+	mtu = dst_metric_raw(dst, RTAX_MTU);
+	if (mtu)
+		return mtu;
+
 	return min(READ_ONCE(dst->dev->mtu), IP_MAX_MTU);
 }
 



^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 024/633] net_sched: remove a redundant goto chain check
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (22 preceding siblings ...)
  2020-10-27 13:46 ` [PATCH 5.8 023/633] net/ipv4: always honour route mtu during forwarding Greg Kroah-Hartman
@ 2020-10-27 13:46 ` Greg Kroah-Hartman
  2020-10-27 13:46 ` [PATCH 5.8 025/633] r8169: fix data corruption issue on RTL8402 Greg Kroah-Hartman
                   ` (611 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Vlad Buslov, Davide Caratti,
	Jamal Hadi Salim, Jiri Pirko, Cong Wang

From: Cong Wang <xiyou.wangcong@gmail.com>

[ Upstream commit 1aad8049909a6d3379175ef2824a68ac35c0b564 ]

All TC actions call tcf_action_check_ctrlact() to validate
goto chain, so this check in tcf_action_init_1() is actually
redundant. Remove it to save troubles of leaking memory.

Fixes: e49d8c22f126 ("net_sched: defer tcf_idr_insert() in tcf_action_init_1()")
Reported-by: Vlad Buslov <vladbu@mellanox.com>
Suggested-by: Davide Caratti <dcaratti@redhat.com>
Cc: Jamal Hadi Salim <jhs@mojatatu.com>
Cc: Jiri Pirko <jiri@resnulli.us>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Reviewed-by: Davide Caratti <dcaratti@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/sched/act_api.c |   14 --------------
 1 file changed, 14 deletions(-)

--- a/net/sched/act_api.c
+++ b/net/sched/act_api.c
@@ -722,13 +722,6 @@ int tcf_action_destroy(struct tc_action
 	return ret;
 }
 
-static int tcf_action_destroy_1(struct tc_action *a, int bind)
-{
-	struct tc_action *actions[] = { a, NULL };
-
-	return tcf_action_destroy(actions, bind);
-}
-
 static int tcf_action_put(struct tc_action *p)
 {
 	return __tcf_action_put(p, false);
@@ -1000,13 +993,6 @@ struct tc_action *tcf_action_init_1(stru
 	if (err < 0)
 		goto err_mod;
 
-	if (TC_ACT_EXT_CMP(a->tcfa_action, TC_ACT_GOTO_CHAIN) &&
-	    !rcu_access_pointer(a->goto_chain)) {
-		tcf_action_destroy_1(a, bind);
-		NL_SET_ERR_MSG(extack, "can't use goto chain with NULL chain");
-		return ERR_PTR(-EINVAL);
-	}
-
 	if (!name && tb[TCA_ACT_COOKIE])
 		tcf_set_action_cookie(&a->act_cookie, cookie);
 



^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 025/633] r8169: fix data corruption issue on RTL8402
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (23 preceding siblings ...)
  2020-10-27 13:46 ` [PATCH 5.8 024/633] net_sched: remove a redundant goto chain check Greg Kroah-Hartman
@ 2020-10-27 13:46 ` Greg Kroah-Hartman
  2020-10-27 13:46 ` [PATCH 5.8 026/633] binder: fix UAF when releasing todo list Greg Kroah-Hartman
                   ` (610 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:46 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Petr Tesarik, Heiner Kallweit

From: Heiner Kallweit <hkallweit1@gmail.com>

[ Upstream commit ef9da46ddef071e1bbb943afbbe9b38771855554 ]

Petr reported that after resume from suspend RTL8402 partially
truncates incoming packets, and re-initializing register RxConfig
before the actual chip re-initialization sequence is needed to avoid
the issue.

Reported-by: Petr Tesarik <ptesarik@suse.cz>
Proposed-by: Petr Tesarik <ptesarik@suse.cz>
Tested-by: Petr Tesarik <ptesarik@suse.cz>
Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/realtek/r8169_main.c |    4 ++++
 1 file changed, 4 insertions(+)

--- a/drivers/net/ethernet/realtek/r8169_main.c
+++ b/drivers/net/ethernet/realtek/r8169_main.c
@@ -4871,6 +4871,10 @@ static int __maybe_unused rtl8169_resume
 	if (netif_running(tp->dev))
 		__rtl8169_resume(tp);
 
+	/* Reportedly at least Asus X453MA truncates packets otherwise */
+	if (tp->mac_version == RTL_GIGA_MAC_VER_37)
+		rtl_init_rxcfg(tp);
+
 	return 0;
 }
 



^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 026/633] binder: fix UAF when releasing todo list
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (24 preceding siblings ...)
  2020-10-27 13:46 ` [PATCH 5.8 025/633] r8169: fix data corruption issue on RTL8402 Greg Kroah-Hartman
@ 2020-10-27 13:46 ` Greg Kroah-Hartman
  2020-10-27 13:46 ` [PATCH 5.8 027/633] ALSA: bebob: potential info leak in hwdep_read() Greg Kroah-Hartman
                   ` (609 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:46 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Todd Kjos

From: Todd Kjos <tkjos@google.com>

commit f3277cbfba763cd2826396521b9296de67cf1bbc upstream.

When releasing a thread todo list when tearing down
a binder_proc, the following race was possible which
could result in a use-after-free:

1.  Thread 1: enter binder_release_work from binder_thread_release
2.  Thread 2: binder_update_ref_for_handle() -> binder_dec_node_ilocked()
3.  Thread 2: dec nodeA --> 0 (will free node)
4.  Thread 1: ACQ inner_proc_lock
5.  Thread 2: block on inner_proc_lock
6.  Thread 1: dequeue work (BINDER_WORK_NODE, part of nodeA)
7.  Thread 1: REL inner_proc_lock
8.  Thread 2: ACQ inner_proc_lock
9.  Thread 2: todo list cleanup, but work was already dequeued
10. Thread 2: free node
11. Thread 2: REL inner_proc_lock
12. Thread 1: deref w->type (UAF)

The problem was that for a BINDER_WORK_NODE, the binder_work element
must not be accessed after releasing the inner_proc_lock while
processing the todo list elements since another thread might be
handling a deref on the node containing the binder_work element
leading to the node being freed.

Signed-off-by: Todd Kjos <tkjos@google.com>
Link: https://lore.kernel.org/r/20201009232455.4054810-1-tkjos@google.com
Cc: <stable@vger.kernel.org> # 4.14, 4.19, 5.4, 5.8
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/android/binder.c |   35 ++++++++++-------------------------
 1 file changed, 10 insertions(+), 25 deletions(-)

--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -223,7 +223,7 @@ static struct binder_transaction_log_ent
 struct binder_work {
 	struct list_head entry;
 
-	enum {
+	enum binder_work_type {
 		BINDER_WORK_TRANSACTION = 1,
 		BINDER_WORK_TRANSACTION_COMPLETE,
 		BINDER_WORK_RETURN_ERROR,
@@ -885,27 +885,6 @@ static struct binder_work *binder_dequeu
 	return w;
 }
 
-/**
- * binder_dequeue_work_head() - Dequeues the item at head of list
- * @proc:         binder_proc associated with list
- * @list:         list to dequeue head
- *
- * Removes the head of the list if there are items on the list
- *
- * Return: pointer dequeued binder_work, NULL if list was empty
- */
-static struct binder_work *binder_dequeue_work_head(
-					struct binder_proc *proc,
-					struct list_head *list)
-{
-	struct binder_work *w;
-
-	binder_inner_proc_lock(proc);
-	w = binder_dequeue_work_head_ilocked(list);
-	binder_inner_proc_unlock(proc);
-	return w;
-}
-
 static void
 binder_defer_work(struct binder_proc *proc, enum binder_deferred_state defer);
 static void binder_free_thread(struct binder_thread *thread);
@@ -4589,13 +4568,17 @@ static void binder_release_work(struct b
 				struct list_head *list)
 {
 	struct binder_work *w;
+	enum binder_work_type wtype;
 
 	while (1) {
-		w = binder_dequeue_work_head(proc, list);
+		binder_inner_proc_lock(proc);
+		w = binder_dequeue_work_head_ilocked(list);
+		wtype = w ? w->type : 0;
+		binder_inner_proc_unlock(proc);
 		if (!w)
 			return;
 
-		switch (w->type) {
+		switch (wtype) {
 		case BINDER_WORK_TRANSACTION: {
 			struct binder_transaction *t;
 
@@ -4629,9 +4612,11 @@ static void binder_release_work(struct b
 			kfree(death);
 			binder_stats_deleted(BINDER_STAT_DEATH);
 		} break;
+		case BINDER_WORK_NODE:
+			break;
 		default:
 			pr_err("unexpected work type, %d, not freed\n",
-			       w->type);
+			       wtype);
 			break;
 		}
 	}



^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 027/633] ALSA: bebob: potential info leak in hwdep_read()
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (25 preceding siblings ...)
  2020-10-27 13:46 ` [PATCH 5.8 026/633] binder: fix UAF when releasing todo list Greg Kroah-Hartman
@ 2020-10-27 13:46 ` Greg Kroah-Hartman
  2020-10-27 13:46 ` [PATCH 5.8 028/633] ALSA: hda: fix jack detection with Realtek codecs when in D3 Greg Kroah-Hartman
                   ` (608 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Takashi Sakamoto,
	Takashi Iwai

From: Dan Carpenter <dan.carpenter@oracle.com>

commit b41c15f4e1c1f1657da15c482fa837c1b7384452 upstream.

The "count" variable needs to be capped on every path so that we don't
copy too much information to the user.

Fixes: 618eabeae711 ("ALSA: bebob: Add hwdep interface")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201007074928.GA2529578@mwanda
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/firewire/bebob/bebob_hwdep.c |    3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

--- a/sound/firewire/bebob/bebob_hwdep.c
+++ b/sound/firewire/bebob/bebob_hwdep.c
@@ -36,12 +36,11 @@ hwdep_read(struct snd_hwdep *hwdep, char
 	}
 
 	memset(&event, 0, sizeof(event));
+	count = min_t(long, count, sizeof(event.lock_status));
 	if (bebob->dev_lock_changed) {
 		event.lock_status.type = SNDRV_FIREWIRE_EVENT_LOCK_STATUS;
 		event.lock_status.status = (bebob->dev_lock_count > 0);
 		bebob->dev_lock_changed = false;
-
-		count = min_t(long, count, sizeof(event.lock_status));
 	}
 
 	spin_unlock_irq(&bebob->lock);



^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 028/633] ALSA: hda: fix jack detection with Realtek codecs when in D3
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (26 preceding siblings ...)
  2020-10-27 13:46 ` [PATCH 5.8 027/633] ALSA: bebob: potential info leak in hwdep_read() Greg Kroah-Hartman
@ 2020-10-27 13:46 ` Greg Kroah-Hartman
  2020-10-27 13:46 ` [PATCH 5.8 029/633] ALSA: hda/hdmi: fix incorrect locking in hdmi_pcm_close Greg Kroah-Hartman
                   ` (607 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Kailang Yang, Kai-Heng Feng,
	Kai Vehmanen, Takashi Iwai

From: Kai Vehmanen <kai.vehmanen@linux.intel.com>

commit a6e7d0a4bdb02a7a3ffe0b44aaa8842b7efdd056 upstream.

In case HDA controller becomes active, but codec is runtime suspended,
jack detection is not successful and no interrupt is raised. This has
been observed with multiple Realtek codecs and HDA controllers from
different vendors. Bug does not occur if both codec and controller are
active, or both are in suspend. Bug can be easily hit on desktop systems
with no built-in speaker.

The problem can be fixed by powering up the codec once after every
controller runtime resume. Even if codec goes back to suspend later, the
jack detection will continue to work. Add a flag to 'hda_codec' to
describe codecs that require this flow from the controller driver.
Modify __azx_runtime_resume() to use pm_request_resume() to make the
intent clearer.

Mark all Realtek codecs with the new forced_resume flag.

BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=209379
Cc: Kailang Yang <kailang@realtek.com>
Co-developed-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
Signed-off-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201012102704.794423-1-kai.vehmanen@linux.intel.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 include/sound/hda_codec.h     |    1 +
 sound/pci/hda/hda_intel.c     |   14 ++++++++------
 sound/pci/hda/patch_realtek.c |    1 +
 3 files changed, 10 insertions(+), 6 deletions(-)

--- a/include/sound/hda_codec.h
+++ b/include/sound/hda_codec.h
@@ -253,6 +253,7 @@ struct hda_codec {
 	unsigned int force_pin_prefix:1; /* Add location prefix */
 	unsigned int link_down_at_suspend:1; /* link down at runtime suspend */
 	unsigned int relaxed_resume:1;	/* don't resume forcibly for jack */
+	unsigned int forced_resume:1; /* forced resume for jack */
 	unsigned int mst_no_extra_pcms:1; /* no backup PCMs for DP-MST */
 
 #ifdef CONFIG_PM
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -1003,12 +1003,14 @@ static void __azx_runtime_resume(struct
 	azx_init_pci(chip);
 	hda_intel_init_chip(chip, true);
 
-	if (status && from_rt) {
-		list_for_each_codec(codec, &chip->bus)
-			if (!codec->relaxed_resume &&
-			    (status & (1 << codec->addr)))
-				schedule_delayed_work(&codec->jackpoll_work,
-						      codec->jackpoll_interval);
+	if (from_rt) {
+		list_for_each_codec(codec, &chip->bus) {
+			if (codec->relaxed_resume)
+				continue;
+
+			if (codec->forced_resume || (status & (1 << codec->addr)))
+				pm_request_resume(hda_codec_dev(codec));
+		}
 	}
 
 	/* power down again for link-controlled chips */
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -1142,6 +1142,7 @@ static int alc_alloc_spec(struct hda_cod
 	codec->single_adc_amp = 1;
 	/* FIXME: do we need this for all Realtek codec models? */
 	codec->spdif_status_reset = 1;
+	codec->forced_resume = 1;
 	codec->patch_ops = alc_patch_ops;
 
 	err = alc_codec_rename_from_preset(codec);



^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 029/633] ALSA: hda/hdmi: fix incorrect locking in hdmi_pcm_close
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (27 preceding siblings ...)
  2020-10-27 13:46 ` [PATCH 5.8 028/633] ALSA: hda: fix jack detection with Realtek codecs when in D3 Greg Kroah-Hartman
@ 2020-10-27 13:46 ` Greg Kroah-Hartman
  2020-10-27 13:46 ` [PATCH 5.8 030/633] tipc: re-configure queue limit for broadcast link Greg Kroah-Hartman
                   ` (606 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:46 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Kai Vehmanen, Takashi Iwai

From: Kai Vehmanen <kai.vehmanen@linux.intel.com>

commit ce1558c285f9ad04c03b46833a028230771cc0a7 upstream.

A race exists between closing a PCM and update of ELD data. In
hdmi_pcm_close(), hinfo->nid value is modified without taking
spec->pcm_lock. If this happens concurrently while processing an ELD
update in hdmi_pcm_setup_pin(), converter assignment may be done
incorrectly.

This bug was found by hitting a WARN_ON in snd_hda_spdif_ctls_assign()
in a HDMI receiver connection stress test:

[2739.684569] WARNING: CPU: 5 PID: 2090 at sound/pci/hda/patch_hdmi.c:1898 check_non_pcm_per_cvt+0x41/0x50 [snd_hda_codec_hdmi]
...
[2739.684707] Call Trace:
[2739.684720]  update_eld+0x121/0x5a0 [snd_hda_codec_hdmi]
[2739.684736]  hdmi_present_sense+0x21e/0x3b0 [snd_hda_codec_hdmi]
[2739.684750]  check_presence_and_report+0x81/0xd0 [snd_hda_codec_hdmi]
[2739.684842]  intel_audio_codec_enable+0x122/0x190 [i915]

Fixes: 42b2987079ec ("ALSA: hda - hdmi playback without monitor in dynamic pcm bind mode")
Signed-off-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201013152628.920764-1-kai.vehmanen@linux.intel.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/pci/hda/patch_hdmi.c |   20 ++++++++++++--------
 1 file changed, 12 insertions(+), 8 deletions(-)

--- a/sound/pci/hda/patch_hdmi.c
+++ b/sound/pci/hda/patch_hdmi.c
@@ -1989,22 +1989,25 @@ static int hdmi_pcm_close(struct hda_pcm
 	int pinctl;
 	int err = 0;
 
+	mutex_lock(&spec->pcm_lock);
 	if (hinfo->nid) {
 		pcm_idx = hinfo_to_pcm_index(codec, hinfo);
-		if (snd_BUG_ON(pcm_idx < 0))
-			return -EINVAL;
+		if (snd_BUG_ON(pcm_idx < 0)) {
+			err = -EINVAL;
+			goto unlock;
+		}
 		cvt_idx = cvt_nid_to_cvt_index(codec, hinfo->nid);
-		if (snd_BUG_ON(cvt_idx < 0))
-			return -EINVAL;
+		if (snd_BUG_ON(cvt_idx < 0)) {
+			err = -EINVAL;
+			goto unlock;
+		}
 		per_cvt = get_cvt(spec, cvt_idx);
-
 		snd_BUG_ON(!per_cvt->assigned);
 		per_cvt->assigned = 0;
 		hinfo->nid = 0;
 
 		azx_stream(get_azx_dev(substream))->stripe = 0;
 
-		mutex_lock(&spec->pcm_lock);
 		snd_hda_spdif_ctls_unassign(codec, pcm_idx);
 		clear_bit(pcm_idx, &spec->pcm_in_use);
 		pin_idx = hinfo_to_pin_index(codec, hinfo);
@@ -2034,10 +2037,11 @@ static int hdmi_pcm_close(struct hda_pcm
 		per_pin->setup = false;
 		per_pin->channels = 0;
 		mutex_unlock(&per_pin->lock);
-	unlock:
-		mutex_unlock(&spec->pcm_lock);
 	}
 
+unlock:
+	mutex_unlock(&spec->pcm_lock);
+
 	return err;
 }
 



^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 030/633] tipc: re-configure queue limit for broadcast link
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (28 preceding siblings ...)
  2020-10-27 13:46 ` [PATCH 5.8 029/633] ALSA: hda/hdmi: fix incorrect locking in hdmi_pcm_close Greg Kroah-Hartman
@ 2020-10-27 13:46 ` Greg Kroah-Hartman
  2020-10-27 13:46 ` [PATCH 5.8 031/633] tipc: fix incorrect setting window for bcast link Greg Kroah-Hartman
                   ` (605 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jon Maloy, Hoang Huu Le, Jakub Kicinski

From: Hoang Huu Le <hoang.h.le@dektech.com.au>

[ Upstream commit 75cee397ae6f1020fbb75db90aa22a51bc3318ac ]

The queue limit of the broadcast link is being calculated base on initial
MTU. However, when MTU value changed (e.g manual changing MTU on NIC
device, MTU negotiation etc.,) we do not re-calculate queue limit.
This gives throughput does not reflect with the change.

So fix it by calling the function to re-calculate queue limit of the
broadcast link.

Acked-by: Jon Maloy <jmaloy@redhat.com>
Signed-off-by: Hoang Huu Le <hoang.h.le@dektech.com.au>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/tipc/bcast.c |    6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

--- a/net/tipc/bcast.c
+++ b/net/tipc/bcast.c
@@ -108,6 +108,7 @@ static void tipc_bcbase_select_primary(s
 {
 	struct tipc_bc_base *bb = tipc_bc_base(net);
 	int all_dests =  tipc_link_bc_peers(bb->link);
+	int max_win = tipc_link_max_win(bb->link);
 	int i, mtu, prim;
 
 	bb->primary_bearer = INVALID_BEARER_ID;
@@ -121,8 +122,11 @@ static void tipc_bcbase_select_primary(s
 			continue;
 
 		mtu = tipc_bearer_mtu(net, i);
-		if (mtu < tipc_link_mtu(bb->link))
+		if (mtu < tipc_link_mtu(bb->link)) {
 			tipc_link_set_mtu(bb->link, mtu);
+			tipc_link_set_queue_limits(bb->link, max_win,
+						   max_win);
+		}
 		bb->bcast_support &= tipc_bearer_bcast_support(net, i);
 		if (bb->dests[i] < all_dests)
 			continue;



^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 031/633] tipc: fix incorrect setting window for bcast link
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (29 preceding siblings ...)
  2020-10-27 13:46 ` [PATCH 5.8 030/633] tipc: re-configure queue limit for broadcast link Greg Kroah-Hartman
@ 2020-10-27 13:46 ` Greg Kroah-Hartman
  2020-10-27 13:46 ` [PATCH 5.8 032/633] chelsio/chtls: fix socket lock Greg Kroah-Hartman
                   ` (604 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jon Maloy, Hoang Huu Le, Jakub Kicinski

From: Hoang Huu Le <hoang.h.le@dektech.com.au>

[ Upstream commit ec78e31852c9bb7d96b6557468fecb6f6f3b28f3 ]

In commit 16ad3f4022bb
("tipc: introduce variable window congestion control"), we applied
the algorithm to select window size from minimum window to the
configured maximum window for unicast link, and, besides we chose
to keep the window size for broadcast link unchanged and equal (i.e
fix window 50)

However, when setting maximum window variable via command, the window
variable was re-initialized to unexpect value (i.e 32).

We fix this by updating the fix window for broadcast as we stated.

Fixes: 16ad3f4022bb ("tipc: introduce variable window congestion control")
Acked-by: Jon Maloy <jmaloy@redhat.com>
Signed-off-by: Hoang Huu Le <hoang.h.le@dektech.com.au>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/tipc/bcast.c |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

--- a/net/tipc/bcast.c
+++ b/net/tipc/bcast.c
@@ -109,6 +109,7 @@ static void tipc_bcbase_select_primary(s
 	struct tipc_bc_base *bb = tipc_bc_base(net);
 	int all_dests =  tipc_link_bc_peers(bb->link);
 	int max_win = tipc_link_max_win(bb->link);
+	int min_win = tipc_link_min_win(bb->link);
 	int i, mtu, prim;
 
 	bb->primary_bearer = INVALID_BEARER_ID;
@@ -124,7 +125,8 @@ static void tipc_bcbase_select_primary(s
 		mtu = tipc_bearer_mtu(net, i);
 		if (mtu < tipc_link_mtu(bb->link)) {
 			tipc_link_set_mtu(bb->link, mtu);
-			tipc_link_set_queue_limits(bb->link, max_win,
+			tipc_link_set_queue_limits(bb->link,
+						   min_win,
 						   max_win);
 		}
 		bb->bcast_support &= tipc_bearer_bcast_support(net, i);
@@ -589,7 +591,7 @@ static int tipc_bc_link_set_queue_limits
 	if (max_win > TIPC_MAX_LINK_WIN)
 		return -EINVAL;
 	tipc_bcast_lock(net);
-	tipc_link_set_queue_limits(l, BCLINK_WIN_MIN, max_win);
+	tipc_link_set_queue_limits(l, tipc_link_min_win(l), max_win);
 	tipc_bcast_unlock(net);
 	return 0;
 }



^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 032/633] chelsio/chtls: fix socket lock
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (30 preceding siblings ...)
  2020-10-27 13:46 ` [PATCH 5.8 031/633] tipc: fix incorrect setting window for bcast link Greg Kroah-Hartman
@ 2020-10-27 13:46 ` Greg Kroah-Hartman
  2020-10-27 13:46 ` [PATCH 5.8 033/633] chelsio/chtls: correct netdevice for vlan interface Greg Kroah-Hartman
                   ` (603 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Vinay Kumar Yadav, Jakub Kicinski

From: Vinay Kumar Yadav <vinay.yadav@chelsio.com>

[ Upstream commit 0fb5f0160a36d7acaa8e84ce873af99f94b60484 ]

In chtls_sendpage() socket lock is released but not acquired,
fix it by taking lock.

Fixes: 36bedb3f2e5b ("crypto: chtls - Inline TLS record Tx")
Signed-off-by: Vinay Kumar Yadav <vinay.yadav@chelsio.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/crypto/chelsio/chtls/chtls_io.c |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/crypto/chelsio/chtls/chtls_io.c
+++ b/drivers/crypto/chelsio/chtls/chtls_io.c
@@ -1240,6 +1240,7 @@ int chtls_sendpage(struct sock *sk, stru
 	copied = 0;
 	csk = rcu_dereference_sk_user_data(sk);
 	cdev = csk->cdev;
+	lock_sock(sk);
 	timeo = sock_sndtimeo(sk, flags & MSG_DONTWAIT);
 
 	err = sk_stream_wait_connect(sk, &timeo);



^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 033/633] chelsio/chtls: correct netdevice for vlan interface
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (31 preceding siblings ...)
  2020-10-27 13:46 ` [PATCH 5.8 032/633] chelsio/chtls: fix socket lock Greg Kroah-Hartman
@ 2020-10-27 13:46 ` Greg Kroah-Hartman
  2020-10-27 13:46 ` [PATCH 5.8 034/633] chelsio/chtls: fix panic when server is on ipv6 Greg Kroah-Hartman
                   ` (602 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Venkatesh Ellapu, Vinay Kumar Yadav,
	Jakub Kicinski

From: Vinay Kumar Yadav <vinay.yadav@chelsio.com>

[ Upstream commit 81519d1f7df7ed1bd5b1397540c8884438f57ae2 ]

Check if netdevice is a vlan interface and find real vlan netdevice.

Fixes: cc35c88ae4db ("crypto : chtls - CPL handler definition")
Signed-off-by: Venkatesh Ellapu <venkatesh.e@chelsio.com>
Signed-off-by: Vinay Kumar Yadav <vinay.yadav@chelsio.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/crypto/chelsio/chtls/chtls_cm.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/drivers/crypto/chelsio/chtls/chtls_cm.c
+++ b/drivers/crypto/chelsio/chtls/chtls_cm.c
@@ -1156,6 +1156,9 @@ static struct sock *chtls_recv_sock(stru
 	ndev = n->dev;
 	if (!ndev)
 		goto free_dst;
+	if (is_vlan_dev(ndev))
+		ndev = vlan_dev_real_dev(ndev);
+
 	port_id = cxgb4_port_idx(ndev);
 
 	csk = chtls_sock_create(cdev);



^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 034/633] chelsio/chtls: fix panic when server is on ipv6
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (32 preceding siblings ...)
  2020-10-27 13:46 ` [PATCH 5.8 033/633] chelsio/chtls: correct netdevice for vlan interface Greg Kroah-Hartman
@ 2020-10-27 13:46 ` Greg Kroah-Hartman
  2020-10-27 13:46 ` [PATCH 5.8 035/633] chelsio/chtls: Fix panic when listen on multiadapter Greg Kroah-Hartman
                   ` (601 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Venkatesh Ellapu, Vinay Kumar Yadav,
	Jakub Kicinski

From: Vinay Kumar Yadav <vinay.yadav@chelsio.com>

[ Upstream commit 86cdf9ca4409d997a391103e480b3f77b7ccc19b ]

Netdev is filled in egress_dev when connection is established,
If connection is closed before establishment, then egress_dev
is NULL, Fix it using ip_dev_find() rather then extracting from
egress_dev.

Fixes: 6abde0b24122 ("crypto/chtls: IPv6 support for inline TLS")
Signed-off-by: Venkatesh Ellapu <venkatesh.e@chelsio.com>
Signed-off-by: Vinay Kumar Yadav <vinay.yadav@chelsio.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/crypto/chelsio/chtls/chtls_cm.c |    5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

--- a/drivers/crypto/chelsio/chtls/chtls_cm.c
+++ b/drivers/crypto/chelsio/chtls/chtls_cm.c
@@ -736,14 +736,13 @@ void chtls_listen_stop(struct chtls_dev
 
 #if IS_ENABLED(CONFIG_IPV6)
 	if (sk->sk_family == PF_INET6) {
-		struct chtls_sock *csk;
+		struct net_device *ndev = chtls_find_netdev(cdev, sk);
 		int addr_type = 0;
 
-		csk = rcu_dereference_sk_user_data(sk);
 		addr_type = ipv6_addr_type((const struct in6_addr *)
 					  &sk->sk_v6_rcv_saddr);
 		if (addr_type != IPV6_ADDR_ANY)
-			cxgb4_clip_release(csk->egress_dev, (const u32 *)
+			cxgb4_clip_release(ndev, (const u32 *)
 					   &sk->sk_v6_rcv_saddr, 1);
 	}
 #endif



^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 035/633] chelsio/chtls: Fix panic when listen on multiadapter
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (33 preceding siblings ...)
  2020-10-27 13:46 ` [PATCH 5.8 034/633] chelsio/chtls: fix panic when server is on ipv6 Greg Kroah-Hartman
@ 2020-10-27 13:46 ` Greg Kroah-Hartman
  2020-10-27 13:46 ` [PATCH 5.8 036/633] chelsio/chtls: correct function return and return type Greg Kroah-Hartman
                   ` (600 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Venkatesh Ellapu, Vinay Kumar Yadav,
	Jakub Kicinski

From: Vinay Kumar Yadav <vinay.yadav@chelsio.com>

[ Upstream commit 9819f22c410b4bf6589d3126e8bc3952db507cbf ]

Add the logic to compare net_device returned by ip_dev_find()
with the net_device list in cdev->ports[] array and return
net_device if matched else NULL.

Fixes: 6abde0b24122 ("crypto/chtls: IPv6 support for inline TLS")
Signed-off-by: Venkatesh Ellapu <venkatesh.e@chelsio.com>
Signed-off-by: Vinay Kumar Yadav <vinay.yadav@chelsio.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/crypto/chelsio/chtls/chtls_cm.c |   10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

--- a/drivers/crypto/chelsio/chtls/chtls_cm.c
+++ b/drivers/crypto/chelsio/chtls/chtls_cm.c
@@ -92,11 +92,13 @@ static void chtls_sock_release(struct kr
 static struct net_device *chtls_find_netdev(struct chtls_dev *cdev,
 					    struct sock *sk)
 {
+	struct adapter *adap = pci_get_drvdata(cdev->pdev);
 	struct net_device *ndev = cdev->ports[0];
 #if IS_ENABLED(CONFIG_IPV6)
 	struct net_device *temp;
 	int addr_type;
 #endif
+	int i;
 
 	switch (sk->sk_family) {
 	case PF_INET:
@@ -127,8 +129,12 @@ static struct net_device *chtls_find_net
 		return NULL;
 
 	if (is_vlan_dev(ndev))
-		return vlan_dev_real_dev(ndev);
-	return ndev;
+		ndev = vlan_dev_real_dev(ndev);
+
+	for_each_port(adap, i)
+		if (cdev->ports[i] == ndev)
+			return ndev;
+	return NULL;
 }
 
 static void assign_rxopt(struct sock *sk, unsigned int opt)



^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 036/633] chelsio/chtls: correct function return and return type
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (34 preceding siblings ...)
  2020-10-27 13:46 ` [PATCH 5.8 035/633] chelsio/chtls: Fix panic when listen on multiadapter Greg Kroah-Hartman
@ 2020-10-27 13:46 ` Greg Kroah-Hartman
  2020-10-27 13:46 ` [PATCH 5.8 037/633] chelsio/chtls: fix writing freed memory Greg Kroah-Hartman
                   ` (599 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Vinay Kumar Yadav, Jakub Kicinski

From: Vinay Kumar Yadav <vinay.yadav@chelsio.com>

[ Upstream commit 8580a61aede28d441e1c80588803411ee86aa299 ]

csk_mem_free() should return true if send buffer is available,
false otherwise.

Fixes: 3b8305f5c844 ("crypto: chtls - wait for memory sendmsg, sendpage")
Signed-off-by: Vinay Kumar Yadav <vinay.yadav@chelsio.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/crypto/chelsio/chtls/chtls_io.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/crypto/chelsio/chtls/chtls_io.c
+++ b/drivers/crypto/chelsio/chtls/chtls_io.c
@@ -902,9 +902,9 @@ static int chtls_skb_copy_to_page_nocach
 	return 0;
 }
 
-static int csk_mem_free(struct chtls_dev *cdev, struct sock *sk)
+static bool csk_mem_free(struct chtls_dev *cdev, struct sock *sk)
 {
-	return (cdev->max_host_sndbuf - sk->sk_wmem_queued);
+	return (cdev->max_host_sndbuf - sk->sk_wmem_queued > 0);
 }
 
 static int csk_wait_memory(struct chtls_dev *cdev,



^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 037/633] chelsio/chtls: fix writing freed memory
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (35 preceding siblings ...)
  2020-10-27 13:46 ` [PATCH 5.8 036/633] chelsio/chtls: correct function return and return type Greg Kroah-Hartman
@ 2020-10-27 13:46 ` Greg Kroah-Hartman
  2020-10-27 13:46 ` [PATCH 5.8 038/633] ibmvnic: save changed mac address to adapter->mac_addr Greg Kroah-Hartman
                   ` (598 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Vinay Kumar Yadav, Jakub Kicinski

From: Vinay Kumar Yadav <vinay.yadav@chelsio.com>

[ Upstream commit da1a039bcf293e4699d413c9f65d975da2d7c0bd ]

When chtls_sock *csk is freed, same memory can be allocated
to different csk in chtls_sock_create().
csk->cdev = NULL; statement might ends up modifying wrong
csk, eventually causing kernel panic.
removing (csk->cdev = NULL) statement as it is not required.

Fixes: 3a0a97838923 ("crypto/chtls: Fix chtls crash in connection cleanup")
Signed-off-by: Vinay Kumar Yadav <vinay.yadav@chelsio.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/crypto/chelsio/chtls/chtls_cm.c |    1 -
 1 file changed, 1 deletion(-)

--- a/drivers/crypto/chelsio/chtls/chtls_cm.c
+++ b/drivers/crypto/chelsio/chtls/chtls_cm.c
@@ -483,7 +483,6 @@ void chtls_destroy_sock(struct sock *sk)
 	chtls_purge_write_queue(sk);
 	free_tls_keyid(sk);
 	kref_put(&csk->kref, chtls_sock_release);
-	csk->cdev = NULL;
 	if (sk->sk_family == AF_INET)
 		sk->sk_prot = &tcp_prot;
 #if IS_ENABLED(CONFIG_IPV6)



^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 038/633] ibmvnic: save changed mac address to adapter->mac_addr
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (36 preceding siblings ...)
  2020-10-27 13:46 ` [PATCH 5.8 037/633] chelsio/chtls: fix writing freed memory Greg Kroah-Hartman
@ 2020-10-27 13:46 ` Greg Kroah-Hartman
  2020-10-27 13:46 ` [PATCH 5.8 039/633] icmp: randomize the global rate limiter Greg Kroah-Hartman
                   ` (597 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:46 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Lijun Pan, Jakub Kicinski

From: Lijun Pan <ljp@linux.ibm.com>

[ Upstream commit d9b0e599b2b892422f1cbc5d2658049b895b2b58 ]

After mac address change request completes successfully, the new mac
address need to be saved to adapter->mac_addr as well as
netdev->dev_addr. Otherwise, adapter->mac_addr still holds old
data.

Fixes: 62740e97881c ("net/ibmvnic: Update MAC address settings after adapter reset")
Signed-off-by: Lijun Pan <ljp@linux.ibm.com>
Link: https://lore.kernel.org/r/20201020223919.46106-1-ljp@linux.ibm.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/ibm/ibmvnic.c |    5 +++++
 1 file changed, 5 insertions(+)

--- a/drivers/net/ethernet/ibm/ibmvnic.c
+++ b/drivers/net/ethernet/ibm/ibmvnic.c
@@ -4194,8 +4194,13 @@ static int handle_change_mac_rsp(union i
 		dev_err(dev, "Error %ld in CHANGE_MAC_ADDR_RSP\n", rc);
 		goto out;
 	}
+	/* crq->change_mac_addr.mac_addr is the requested one
+	 * crq->change_mac_addr_rsp.mac_addr is the returned valid one.
+	 */
 	ether_addr_copy(netdev->dev_addr,
 			&crq->change_mac_addr_rsp.mac_addr[0]);
+	ether_addr_copy(adapter->mac_addr,
+			&crq->change_mac_addr_rsp.mac_addr[0]);
 out:
 	complete(&adapter->fw_done);
 	return rc;



^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 039/633] icmp: randomize the global rate limiter
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (37 preceding siblings ...)
  2020-10-27 13:46 ` [PATCH 5.8 038/633] ibmvnic: save changed mac address to adapter->mac_addr Greg Kroah-Hartman
@ 2020-10-27 13:46 ` Greg Kroah-Hartman
  2020-10-27 13:46 ` [PATCH 5.8 040/633] mptcp: initialize mptcp_options_receiveds ahmac Greg Kroah-Hartman
                   ` (596 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Eric Dumazet, Keyu Man, Jakub Kicinski

From: Eric Dumazet <edumazet@google.com>

[ Upstream commit b38e7819cae946e2edf869e604af1e65a5d241c5 ]

Keyu Man reported that the ICMP rate limiter could be used
by attackers to get useful signal. Details will be provided
in an upcoming academic publication.

Our solution is to add some noise, so that the attackers
no longer can get help from the predictable token bucket limiter.

Fixes: 4cdf507d5452 ("icmp: add a global rate limitation")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Keyu Man <kman001@ucr.edu>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Documentation/networking/ip-sysctl.rst |    4 +++-
 net/ipv4/icmp.c                        |    7 +++++--
 2 files changed, 8 insertions(+), 3 deletions(-)

--- a/Documentation/networking/ip-sysctl.rst
+++ b/Documentation/networking/ip-sysctl.rst
@@ -1142,13 +1142,15 @@ icmp_ratelimit - INTEGER
 icmp_msgs_per_sec - INTEGER
 	Limit maximal number of ICMP packets sent per second from this host.
 	Only messages whose type matches icmp_ratemask (see below) are
-	controlled by this limit.
+	controlled by this limit. For security reasons, the precise count
+	of messages per second is randomized.
 
 	Default: 1000
 
 icmp_msgs_burst - INTEGER
 	icmp_msgs_per_sec controls number of ICMP packets sent per second,
 	while icmp_msgs_burst controls the burst size of these packets.
+	For security reasons, the precise burst size is randomized.
 
 	Default: 50
 
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -239,7 +239,7 @@ static struct {
 /**
  * icmp_global_allow - Are we allowed to send one more ICMP message ?
  *
- * Uses a token bucket to limit our ICMP messages to sysctl_icmp_msgs_per_sec.
+ * Uses a token bucket to limit our ICMP messages to ~sysctl_icmp_msgs_per_sec.
  * Returns false if we reached the limit and can not send another packet.
  * Note: called with BH disabled
  */
@@ -267,7 +267,10 @@ bool icmp_global_allow(void)
 	}
 	credit = min_t(u32, icmp_global.credit + incr, sysctl_icmp_msgs_burst);
 	if (credit) {
-		credit--;
+		/* We want to use a credit of one in average, but need to randomize
+		 * it for security reasons.
+		 */
+		credit = max_t(int, credit - prandom_u32_max(3), 0);
 		rc = true;
 	}
 	WRITE_ONCE(icmp_global.credit, credit);



^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 040/633] mptcp: initialize mptcp_options_receiveds ahmac
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (38 preceding siblings ...)
  2020-10-27 13:46 ` [PATCH 5.8 039/633] icmp: randomize the global rate limiter Greg Kroah-Hartman
@ 2020-10-27 13:46 ` Greg Kroah-Hartman
  2020-10-27 13:46 ` [PATCH 5.8 041/633] net: ftgmac100: Fix Aspeed ast2600 TX hang issue Greg Kroah-Hartman
                   ` (595 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Geliang Tang, Matthieu Baerts,
	Jakub Kicinski

From: Geliang Tang <geliangtang@gmail.com>

[ Upstream commit fe2d9b1a0e7805384770ec0ddd34c9f1e9fe6fa8 ]

Initialize mptcp_options_received's ahmac to zero, otherwise it
will be a random number when receiving ADD_ADDR suboption with echo-flag=1.

Fixes: 3df523ab582c5 ("mptcp: Add ADD_ADDR handling")
Signed-off-by: Geliang Tang <geliangtang@gmail.com>
Reviewed-by: Matthieu Baerts <matthieu.baerts@tessares.net>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/mptcp/options.c |    1 +
 1 file changed, 1 insertion(+)

--- a/net/mptcp/options.c
+++ b/net/mptcp/options.c
@@ -296,6 +296,7 @@ void mptcp_get_options(const struct sk_b
 	mp_opt->mp_capable = 0;
 	mp_opt->mp_join = 0;
 	mp_opt->add_addr = 0;
+	mp_opt->ahmac = 0;
 	mp_opt->rm_addr = 0;
 	mp_opt->dss = 0;
 



^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 041/633] net: ftgmac100: Fix Aspeed ast2600 TX hang issue
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (39 preceding siblings ...)
  2020-10-27 13:46 ` [PATCH 5.8 040/633] mptcp: initialize mptcp_options_receiveds ahmac Greg Kroah-Hartman
@ 2020-10-27 13:46 ` Greg Kroah-Hartman
  2020-10-27 13:46 ` [PATCH 5.8 042/633] net: hdlc: In hdlc_rcv, check to make sure dev is an HDLC device Greg Kroah-Hartman
                   ` (594 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dylan Hung, Joel Stanley, Jakub Kicinski

From: Dylan Hung <dylan_hung@aspeedtech.com>

[ Upstream commit 137d23cea1c044b2d4853ac71bc68126b25fdbb2 ]

The new HW arbitration feature on Aspeed ast2600 will cause MAC TX to
hang when handling scatter-gather DMA.  Disable the problematic feature
by setting MAC register 0x58 bit28 and bit27.

Fixes: 39bfab8844a0 ("net: ftgmac100: Add support for DT phy-handle property")
Signed-off-by: Dylan Hung <dylan_hung@aspeedtech.com>
Reviewed-by: Joel Stanley <joel@jms.id.au>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/faraday/ftgmac100.c |    5 +++++
 drivers/net/ethernet/faraday/ftgmac100.h |    8 ++++++++
 2 files changed, 13 insertions(+)

--- a/drivers/net/ethernet/faraday/ftgmac100.c
+++ b/drivers/net/ethernet/faraday/ftgmac100.c
@@ -1817,6 +1817,11 @@ static int ftgmac100_probe(struct platfo
 		priv->rxdes0_edorr_mask = BIT(30);
 		priv->txdes0_edotr_mask = BIT(30);
 		priv->is_aspeed = true;
+		/* Disable ast2600 problematic HW arbitration */
+		if (of_device_is_compatible(np, "aspeed,ast2600-mac")) {
+			iowrite32(FTGMAC100_TM_DEFAULT,
+				  priv->base + FTGMAC100_OFFSET_TM);
+		}
 	} else {
 		priv->rxdes0_edorr_mask = BIT(15);
 		priv->txdes0_edotr_mask = BIT(15);
--- a/drivers/net/ethernet/faraday/ftgmac100.h
+++ b/drivers/net/ethernet/faraday/ftgmac100.h
@@ -170,6 +170,14 @@
 #define FTGMAC100_MACCR_SW_RST		(1 << 31)
 
 /*
+ * test mode control register
+ */
+#define FTGMAC100_TM_RQ_TX_VALID_DIS (1 << 28)
+#define FTGMAC100_TM_RQ_RR_IDLE_PREV (1 << 27)
+#define FTGMAC100_TM_DEFAULT                                                   \
+	(FTGMAC100_TM_RQ_TX_VALID_DIS | FTGMAC100_TM_RQ_RR_IDLE_PREV)
+
+/*
  * PHY control register
  */
 #define FTGMAC100_PHYCR_MDC_CYCTHR_MASK	0x3f



^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 042/633] net: hdlc: In hdlc_rcv, check to make sure dev is an HDLC device
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (40 preceding siblings ...)
  2020-10-27 13:46 ` [PATCH 5.8 041/633] net: ftgmac100: Fix Aspeed ast2600 TX hang issue Greg Kroah-Hartman
@ 2020-10-27 13:46 ` Greg Kroah-Hartman
  2020-10-27 13:46 ` [PATCH 5.8 043/633] net: hdlc_raw_eth: Clear the IFF_TX_SKB_SHARING flag after calling ether_setup Greg Kroah-Hartman
                   ` (593 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Krzysztof Halasa, Xie He, Jakub Kicinski

From: Xie He <xie.he.0141@gmail.com>

[ Upstream commit 01c4ceae0a38a0bdbfea6896f41efcd985a9c064 ]

The hdlc_rcv function is used as hdlc_packet_type.func to process any
skb received in the kernel with skb->protocol == htons(ETH_P_HDLC).
The purpose of this function is to provide second-stage processing for
skbs not assigned a "real" L3 skb->protocol value in the first stage.

This function assumes the device from which the skb is received is an
HDLC device (a device created by this module). It assumes that
netdev_priv(dev) returns a pointer to "struct hdlc_device".

However, it is possible that some driver in the kernel (not necessarily
in our control) submits a received skb with skb->protocol ==
htons(ETH_P_HDLC), from a non-HDLC device. In this case, the skb would
still be received by hdlc_rcv. This will cause problems.

hdlc_rcv should be able to recognize and drop invalid skbs. It should
first make sure "dev" is actually an HDLC device, before starting its
processing. This patch adds this check to hdlc_rcv.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: Krzysztof Halasa <khc@pm.waw.pl>
Signed-off-by: Xie He <xie.he.0141@gmail.com>
Link: https://lore.kernel.org/r/20201020013152.89259-1-xie.he.0141@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wan/hdlc.c |   10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

--- a/drivers/net/wan/hdlc.c
+++ b/drivers/net/wan/hdlc.c
@@ -46,7 +46,15 @@ static struct hdlc_proto *first_proto;
 static int hdlc_rcv(struct sk_buff *skb, struct net_device *dev,
 		    struct packet_type *p, struct net_device *orig_dev)
 {
-	struct hdlc_device *hdlc = dev_to_hdlc(dev);
+	struct hdlc_device *hdlc;
+
+	/* First make sure "dev" is an HDLC device */
+	if (!(dev->priv_flags & IFF_WAN_HDLC)) {
+		kfree_skb(skb);
+		return NET_RX_SUCCESS;
+	}
+
+	hdlc = dev_to_hdlc(dev);
 
 	if (!net_eq(dev_net(dev), &init_net)) {
 		kfree_skb(skb);



^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 043/633] net: hdlc_raw_eth: Clear the IFF_TX_SKB_SHARING flag after calling ether_setup
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (41 preceding siblings ...)
  2020-10-27 13:46 ` [PATCH 5.8 042/633] net: hdlc: In hdlc_rcv, check to make sure dev is an HDLC device Greg Kroah-Hartman
@ 2020-10-27 13:46 ` Greg Kroah-Hartman
  2020-10-27 13:46 ` [PATCH 5.8 044/633] net: Properly typecast int values to set sk_max_pacing_rate Greg Kroah-Hartman
                   ` (592 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Neil Horman, Krzysztof Halasa,
	Xie He, Jakub Kicinski

From: Xie He <xie.he.0141@gmail.com>

[ Upstream commit 5fce1e43e2d5bf2f7e3224d7b99b1c65ab2c26e2 ]

This driver calls ether_setup to set up the network device.
The ether_setup function would add the IFF_TX_SKB_SHARING flag to the
device. This flag indicates that it is safe to transmit shared skbs to
the device.

However, this is not true. This driver may pad the frame (in eth_tx)
before transmission, so the skb may be modified.

Fixes: 550fd08c2ceb ("net: Audit drivers to identify those needing IFF_TX_SKB_SHARING cleared")
Cc: Neil Horman <nhorman@tuxdriver.com>
Cc: Krzysztof Halasa <khc@pm.waw.pl>
Signed-off-by: Xie He <xie.he.0141@gmail.com>
Link: https://lore.kernel.org/r/20201020063420.187497-1-xie.he.0141@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wan/hdlc_raw_eth.c |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/net/wan/hdlc_raw_eth.c
+++ b/drivers/net/wan/hdlc_raw_eth.c
@@ -99,6 +99,7 @@ static int raw_eth_ioctl(struct net_devi
 		old_qlen = dev->tx_queue_len;
 		ether_setup(dev);
 		dev->tx_queue_len = old_qlen;
+		dev->priv_flags &= ~IFF_TX_SKB_SHARING;
 		eth_hw_addr_random(dev);
 		call_netdevice_notifiers(NETDEV_POST_TYPE_CHANGE, dev);
 		netif_dormant_off(dev);



^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 044/633] net: Properly typecast int values to set sk_max_pacing_rate
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (42 preceding siblings ...)
  2020-10-27 13:46 ` [PATCH 5.8 043/633] net: hdlc_raw_eth: Clear the IFF_TX_SKB_SHARING flag after calling ether_setup Greg Kroah-Hartman
@ 2020-10-27 13:46 ` Greg Kroah-Hartman
  2020-10-27 13:46 ` [PATCH 5.8 045/633] net/sched: act_ct: Fix adding udp port mangle operation Greg Kroah-Hartman
                   ` (591 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ji Li, Ke Li, Eric Dumazet, Jakub Kicinski

From: Ke Li <keli@akamai.com>

[ Upstream commit 700465fd338fe5df08a1b2e27fa16981f562547f ]

In setsockopt(SO_MAX_PACING_RATE) on 64bit systems, sk_max_pacing_rate,
after extended from 'u32' to 'unsigned long', takes unintentionally
hiked value whenever assigned from an 'int' value with MSB=1, due to
binary sign extension in promoting s32 to u64, e.g. 0x80000000 becomes
0xFFFFFFFF80000000.

Thus inflated sk_max_pacing_rate causes subsequent getsockopt to return
~0U unexpectedly. It may also result in increased pacing rate.

Fix by explicitly casting the 'int' value to 'unsigned int' before
assigning it to sk_max_pacing_rate, for zero extension to happen.

Fixes: 76a9ebe811fb ("net: extend sk_pacing_rate to unsigned long")
Signed-off-by: Ji Li <jli@akamai.com>
Signed-off-by: Ke Li <keli@akamai.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://lore.kernel.org/r/20201022064146.79873-1-keli@akamai.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/core/filter.c |    3 ++-
 net/core/sock.c   |    2 +-
 2 files changed, 3 insertions(+), 2 deletions(-)

--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -4323,7 +4323,8 @@ static int _bpf_setsockopt(struct sock *
 				cmpxchg(&sk->sk_pacing_status,
 					SK_PACING_NONE,
 					SK_PACING_NEEDED);
-			sk->sk_max_pacing_rate = (val == ~0U) ? ~0UL : val;
+			sk->sk_max_pacing_rate = (val == ~0U) ?
+						 ~0UL : (unsigned int)val;
 			sk->sk_pacing_rate = min(sk->sk_pacing_rate,
 						 sk->sk_max_pacing_rate);
 			break;
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -1184,7 +1184,7 @@ set_sndbuf:
 
 	case SO_MAX_PACING_RATE:
 		{
-		unsigned long ulval = (val == ~0U) ? ~0UL : val;
+		unsigned long ulval = (val == ~0U) ? ~0UL : (unsigned int)val;
 
 		if (sizeof(ulval) != sizeof(val) &&
 		    optlen >= sizeof(ulval) &&



^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 045/633] net/sched: act_ct: Fix adding udp port mangle operation
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (43 preceding siblings ...)
  2020-10-27 13:46 ` [PATCH 5.8 044/633] net: Properly typecast int values to set sk_max_pacing_rate Greg Kroah-Hartman
@ 2020-10-27 13:46 ` Greg Kroah-Hartman
  2020-10-27 13:46 ` [PATCH 5.8 046/633] net/sched: act_tunnel_key: fix OOB write in case of IPv6 ERSPAN tunnels Greg Kroah-Hartman
                   ` (590 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Roi Dayan, Paul Blakey, Jakub Kicinski

From: Roi Dayan <roid@nvidia.com>

[ Upstream commit 47b5d2a107396ab05e83a4dfbd30b563ecbc83af ]

Need to use the udp header type and not tcp.

Fixes: 9c26ba9b1f45 ("net/sched: act_ct: Instantiate flow table entry actions")
Signed-off-by: Roi Dayan <roid@nvidia.com>
Reviewed-by: Paul Blakey <paulb@nvidia.com>
Link: https://lore.kernel.org/r/20201019090244.3015186-1-roid@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/sched/act_ct.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/net/sched/act_ct.c
+++ b/net/sched/act_ct.c
@@ -156,11 +156,11 @@ tcf_ct_flow_table_add_action_nat_udp(con
 	__be16 target_dst = target.dst.u.udp.port;
 
 	if (target_src != tuple->src.u.udp.port)
-		tcf_ct_add_mangle_action(action, FLOW_ACT_MANGLE_HDR_TYPE_TCP,
+		tcf_ct_add_mangle_action(action, FLOW_ACT_MANGLE_HDR_TYPE_UDP,
 					 offsetof(struct udphdr, source),
 					 0xFFFF, be16_to_cpu(target_src));
 	if (target_dst != tuple->dst.u.udp.port)
-		tcf_ct_add_mangle_action(action, FLOW_ACT_MANGLE_HDR_TYPE_TCP,
+		tcf_ct_add_mangle_action(action, FLOW_ACT_MANGLE_HDR_TYPE_UDP,
 					 offsetof(struct udphdr, dest),
 					 0xFFFF, be16_to_cpu(target_dst));
 }



^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 046/633] net/sched: act_tunnel_key: fix OOB write in case of IPv6 ERSPAN tunnels
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (44 preceding siblings ...)
  2020-10-27 13:46 ` [PATCH 5.8 045/633] net/sched: act_ct: Fix adding udp port mangle operation Greg Kroah-Hartman
@ 2020-10-27 13:46 ` Greg Kroah-Hartman
  2020-10-27 13:46 ` [PATCH 5.8 047/633] nexthop: Fix performance regression in nexthop deletion Greg Kroah-Hartman
                   ` (589 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Shuang Li, Davide Caratti, Cong Wang,
	Jakub Kicinski

From: Davide Caratti <dcaratti@redhat.com>

[ Upstream commit a7a12b5a0f950bc6b9f7153390634ea798738db9 ]

the following command

 # tc action add action tunnel_key \
 > set src_ip 2001:db8::1 dst_ip 2001:db8::2 id 10 erspan_opts 1:6789:0:0

generates the following splat:

 BUG: KASAN: slab-out-of-bounds in tunnel_key_copy_opts+0xcc9/0x1010 [act_tunnel_key]
 Write of size 4 at addr ffff88813f5f1cc8 by task tc/873

 CPU: 2 PID: 873 Comm: tc Not tainted 5.9.0+ #282
 Hardware name: Red Hat KVM, BIOS 1.11.1-4.module+el8.1.0+4066+0f1aadab 04/01/2014
 Call Trace:
  dump_stack+0x99/0xcb
  print_address_description.constprop.7+0x1e/0x230
  kasan_report.cold.13+0x37/0x7c
  tunnel_key_copy_opts+0xcc9/0x1010 [act_tunnel_key]
  tunnel_key_init+0x160c/0x1f40 [act_tunnel_key]
  tcf_action_init_1+0x5b5/0x850
  tcf_action_init+0x15d/0x370
  tcf_action_add+0xd9/0x2f0
  tc_ctl_action+0x29b/0x3a0
  rtnetlink_rcv_msg+0x341/0x8d0
  netlink_rcv_skb+0x120/0x380
  netlink_unicast+0x439/0x630
  netlink_sendmsg+0x719/0xbf0
  sock_sendmsg+0xe2/0x110
  ____sys_sendmsg+0x5ba/0x890
  ___sys_sendmsg+0xe9/0x160
  __sys_sendmsg+0xd3/0x170
  do_syscall_64+0x33/0x40
  entry_SYSCALL_64_after_hwframe+0x44/0xa9
 RIP: 0033:0x7f872a96b338
 Code: 89 02 48 c7 c0 ff ff ff ff eb b5 0f 1f 80 00 00 00 00 f3 0f 1e fa 48 8d 05 25 43 2c 00 8b 00 85 c0 75 17 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 58 c3 0f 1f 80 00 00 00 00 41 54 41 89 d4 55
 RSP: 002b:00007ffffe367518 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
 RAX: ffffffffffffffda RBX: 000000005f8f5aed RCX: 00007f872a96b338
 RDX: 0000000000000000 RSI: 00007ffffe367580 RDI: 0000000000000003
 RBP: 0000000000000000 R08: 0000000000000001 R09: 000000000000001c
 R10: 000000000000000b R11: 0000000000000246 R12: 0000000000000001
 R13: 0000000000686760 R14: 0000000000000601 R15: 0000000000000000

 Allocated by task 873:
  kasan_save_stack+0x19/0x40
  __kasan_kmalloc.constprop.7+0xc1/0xd0
  __kmalloc+0x151/0x310
  metadata_dst_alloc+0x20/0x40
  tunnel_key_init+0xfff/0x1f40 [act_tunnel_key]
  tcf_action_init_1+0x5b5/0x850
  tcf_action_init+0x15d/0x370
  tcf_action_add+0xd9/0x2f0
  tc_ctl_action+0x29b/0x3a0
  rtnetlink_rcv_msg+0x341/0x8d0
  netlink_rcv_skb+0x120/0x380
  netlink_unicast+0x439/0x630
  netlink_sendmsg+0x719/0xbf0
  sock_sendmsg+0xe2/0x110
  ____sys_sendmsg+0x5ba/0x890
  ___sys_sendmsg+0xe9/0x160
  __sys_sendmsg+0xd3/0x170
  do_syscall_64+0x33/0x40
  entry_SYSCALL_64_after_hwframe+0x44/0xa9

 The buggy address belongs to the object at ffff88813f5f1c00
  which belongs to the cache kmalloc-256 of size 256
 The buggy address is located 200 bytes inside of
  256-byte region [ffff88813f5f1c00, ffff88813f5f1d00)
 The buggy address belongs to the page:
 page:0000000011b48a19 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x13f5f0
 head:0000000011b48a19 order:1 compound_mapcount:0
 flags: 0x17ffffc0010200(slab|head)
 raw: 0017ffffc0010200 0000000000000000 0000000d00000001 ffff888107c43400
 raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
 page dumped because: kasan: bad access detected

 Memory state around the buggy address:
  ffff88813f5f1b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
  ffff88813f5f1c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 >ffff88813f5f1c80: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc
                                               ^
  ffff88813f5f1d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
  ffff88813f5f1d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc

using IPv6 tunnels, act_tunnel_key allocates a fixed amount of memory for
the tunnel metadata, but then it expects additional bytes to store tunnel
specific metadata with tunnel_key_copy_opts().

Fix the arguments of __ipv6_tun_set_dst(), so that 'md_size' contains the
size previously computed by tunnel_key_get_opts_len(), like it's done for
IPv4 tunnels.

Fixes: 0ed5269f9e41 ("net/sched: add tunnel option support to act_tunnel_key")
Reported-by: Shuang Li <shuali@redhat.com>
Signed-off-by: Davide Caratti <dcaratti@redhat.com>
Acked-by: Cong Wang <xiyou.wangcong@gmail.com>
Link: https://lore.kernel.org/r/36ebe969f6d13ff59912d6464a4356fe6f103766.1603231100.git.dcaratti@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/sched/act_tunnel_key.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/net/sched/act_tunnel_key.c
+++ b/net/sched/act_tunnel_key.c
@@ -458,7 +458,7 @@ static int tunnel_key_init(struct net *n
 
 			metadata = __ipv6_tun_set_dst(&saddr, &daddr, tos, ttl, dst_port,
 						      0, flags,
-						      key_id, 0);
+						      key_id, opts_len);
 		} else {
 			NL_SET_ERR_MSG(extack, "Missing either ipv4 or ipv6 src and dst");
 			ret = -EINVAL;



^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 047/633] nexthop: Fix performance regression in nexthop deletion
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (45 preceding siblings ...)
  2020-10-27 13:46 ` [PATCH 5.8 046/633] net/sched: act_tunnel_key: fix OOB write in case of IPv6 ERSPAN tunnels Greg Kroah-Hartman
@ 2020-10-27 13:46 ` Greg Kroah-Hartman
  2020-10-27 13:46 ` [PATCH 5.8 048/633] nfc: Ensure presence of NFC_ATTR_FIRMWARE_NAME attribute in nfc_genl_fw_download() Greg Kroah-Hartman
                   ` (588 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ido Schimmel, Jesse Brandeburg,
	David Ahern, Nikolay Aleksandrov, Jakub Kicinski

From: Ido Schimmel <idosch@nvidia.com>

[ Upstream commit df6afe2f7c19349de2ee560dc62ea4d9ad3ff889 ]

While insertion of 16k nexthops all using the same netdev ('dummy10')
takes less than a second, deletion takes about 130 seconds:

# time -p ip -b nexthop.batch
real 0.29
user 0.01
sys 0.15

# time -p ip link set dev dummy10 down
real 131.03
user 0.06
sys 0.52

This is because of repeated calls to synchronize_rcu() whenever a
nexthop is removed from a nexthop group:

# /usr/share/bcc/tools/offcputime -p `pgrep -nx ip` -K
...
    b'finish_task_switch'
    b'schedule'
    b'schedule_timeout'
    b'wait_for_completion'
    b'__wait_rcu_gp'
    b'synchronize_rcu.part.0'
    b'synchronize_rcu'
    b'__remove_nexthop'
    b'remove_nexthop'
    b'nexthop_flush_dev'
    b'nh_netdev_event'
    b'raw_notifier_call_chain'
    b'call_netdevice_notifiers_info'
    b'__dev_notify_flags'
    b'dev_change_flags'
    b'do_setlink'
    b'__rtnl_newlink'
    b'rtnl_newlink'
    b'rtnetlink_rcv_msg'
    b'netlink_rcv_skb'
    b'rtnetlink_rcv'
    b'netlink_unicast'
    b'netlink_sendmsg'
    b'____sys_sendmsg'
    b'___sys_sendmsg'
    b'__sys_sendmsg'
    b'__x64_sys_sendmsg'
    b'do_syscall_64'
    b'entry_SYSCALL_64_after_hwframe'
    -                ip (277)
        126554955

Since nexthops are always deleted under RTNL, synchronize_net() can be
used instead. It will call synchronize_rcu_expedited() which only blocks
for several microseconds as opposed to multiple milliseconds like
synchronize_rcu().

With this patch deletion of 16k nexthops takes less than a second:

# time -p ip link set dev dummy10 down
real 0.12
user 0.00
sys 0.04

Tested with fib_nexthops.sh which includes torture tests that prompted
the initial change:

# ./fib_nexthops.sh
...
Tests passed: 134
Tests failed:   0

Fixes: 90f33bffa382 ("nexthops: don't modify published nexthop groups")
Signed-off-by: Ido Schimmel <idosch@nvidia.com>
Reviewed-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
Reviewed-by: David Ahern <dsahern@gmail.com>
Acked-by: Nikolay Aleksandrov <nikolay@nvidia.com>
Link: https://lore.kernel.org/r/20201016172914.643282-1-idosch@idosch.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv4/nexthop.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/net/ipv4/nexthop.c
+++ b/net/ipv4/nexthop.c
@@ -842,7 +842,7 @@ static void remove_nexthop_from_groups(s
 		remove_nh_grp_entry(net, nhge, nlinfo);
 
 	/* make sure all see the newly published array before releasing rtnl */
-	synchronize_rcu();
+	synchronize_net();
 }
 
 static void remove_nexthop_group(struct nexthop *nh, struct nl_info *nlinfo)



^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 048/633] nfc: Ensure presence of NFC_ATTR_FIRMWARE_NAME attribute in nfc_genl_fw_download()
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (46 preceding siblings ...)
  2020-10-27 13:46 ` [PATCH 5.8 047/633] nexthop: Fix performance regression in nexthop deletion Greg Kroah-Hartman
@ 2020-10-27 13:46 ` Greg Kroah-Hartman
  2020-10-27 13:46 ` [PATCH 5.8 049/633] r8169: fix operation under forced interrupt threading Greg Kroah-Hartman
                   ` (587 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:46 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Defang Bo, Jakub Kicinski

From: Defang Bo <bodefang@126.com>

[ Upstream commit 280e3ebdafb863b3cb50d5842f056267e15bf40c ]

Check that the NFC_ATTR_FIRMWARE_NAME attributes are provided by
the netlink client prior to accessing them.This prevents potential
unhandled NULL pointer dereference exceptions which can be triggered
by malicious user-mode programs, if they omit one or both of these
attributes.

Similar to commit a0323b979f81 ("nfc: Ensure presence of required attributes in the activate_target handler").

Fixes: 9674da8759df ("NFC: Add firmware upload netlink command")
Signed-off-by: Defang Bo <bodefang@126.com>
Link: https://lore.kernel.org/r/1603107538-4744-1-git-send-email-bodefang@126.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/nfc/netlink.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/net/nfc/netlink.c
+++ b/net/nfc/netlink.c
@@ -1217,7 +1217,7 @@ static int nfc_genl_fw_download(struct s
 	u32 idx;
 	char firmware_name[NFC_FIRMWARE_NAME_MAXSIZE + 1];
 
-	if (!info->attrs[NFC_ATTR_DEVICE_INDEX])
+	if (!info->attrs[NFC_ATTR_DEVICE_INDEX] || !info->attrs[NFC_ATTR_FIRMWARE_NAME])
 		return -EINVAL;
 
 	idx = nla_get_u32(info->attrs[NFC_ATTR_DEVICE_INDEX]);



^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 049/633] r8169: fix operation under forced interrupt threading
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (47 preceding siblings ...)
  2020-10-27 13:46 ` [PATCH 5.8 048/633] nfc: Ensure presence of NFC_ATTR_FIRMWARE_NAME attribute in nfc_genl_fw_download() Greg Kroah-Hartman
@ 2020-10-27 13:46 ` Greg Kroah-Hartman
  2020-10-27 13:46 ` [PATCH 5.8 050/633] selftests: forwarding: Add missing rp_filter configuration Greg Kroah-Hartman
                   ` (586 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:46 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Heiner Kallweit, Jakub Kicinski

From: Heiner Kallweit <hkallweit1@gmail.com>

[ Upstream commit 424a646e072a887aa87283b53aa6f8b19c2a7bef ]

For several network drivers it was reported that using
__napi_schedule_irqoff() is unsafe with forced threading. One way to
fix this is switching back to __napi_schedule, but then we lose the
benefit of the irqoff version in general. As stated by Eric it doesn't
make sense to make the minimal hard irq handlers in drivers using NAPI
a thread. Therefore ensure that the hard irq handler is never
thread-ified.

Fixes: 9a899a35b0d6 ("r8169: switch to napi_schedule_irqoff")
Link: https://lkml.org/lkml/2020/10/18/19
Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
Link: https://lore.kernel.org/r/4d3ef84a-c812-5072-918a-22a6f6468310@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/realtek/r8169_main.c |    8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

--- a/drivers/net/ethernet/realtek/r8169_main.c
+++ b/drivers/net/ethernet/realtek/r8169_main.c
@@ -4675,7 +4675,7 @@ static int rtl8169_close(struct net_devi
 
 	phy_disconnect(tp->phydev);
 
-	pci_free_irq(pdev, 0, tp);
+	free_irq(pci_irq_vector(pdev, 0), tp);
 
 	dma_free_coherent(&pdev->dev, R8169_RX_RING_BYTES, tp->RxDescArray,
 			  tp->RxPhyAddr);
@@ -4726,8 +4726,8 @@ static int rtl_open(struct net_device *d
 
 	rtl_request_firmware(tp);
 
-	retval = pci_request_irq(pdev, 0, rtl8169_interrupt, NULL, tp,
-				 dev->name);
+	retval = request_irq(pci_irq_vector(pdev, 0), rtl8169_interrupt,
+			     IRQF_NO_THREAD | IRQF_SHARED, dev->name, tp);
 	if (retval < 0)
 		goto err_release_fw_2;
 
@@ -4759,7 +4759,7 @@ out:
 	return retval;
 
 err_free_irq:
-	pci_free_irq(pdev, 0, tp);
+	free_irq(pci_irq_vector(pdev, 0), tp);
 err_release_fw_2:
 	rtl_release_firmware(tp);
 	rtl8169_rx_clear(tp);



^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 050/633] selftests: forwarding: Add missing rp_filter configuration
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (48 preceding siblings ...)
  2020-10-27 13:46 ` [PATCH 5.8 049/633] r8169: fix operation under forced interrupt threading Greg Kroah-Hartman
@ 2020-10-27 13:46 ` Greg Kroah-Hartman
  2020-10-27 13:46 ` [PATCH 5.8 051/633] selftests: rtnetlink: load fou module for kci_test_encap_fou() test Greg Kroah-Hartman
                   ` (585 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ido Schimmel, Hangbin Liu, Jakub Kicinski

From: Ido Schimmel <idosch@nvidia.com>

[ Upstream commit 71a0e29e99405d89b695882d52eec60844173697 ]

When 'rp_filter' is configured in strict mode (1) the tests fail because
packets received from the macvlan netdevs would not be forwarded through
them on the reverse path.

Fix this by disabling the 'rp_filter', meaning no source validation is
performed.

Fixes: 1538812e0880 ("selftests: forwarding: Add a test for VXLAN asymmetric routing")
Fixes: 438a4f5665b2 ("selftests: forwarding: Add a test for VXLAN symmetric routing")
Signed-off-by: Ido Schimmel <idosch@nvidia.com>
Reported-by: Hangbin Liu <liuhangbin@gmail.com>
Tested-by: Hangbin Liu <liuhangbin@gmail.com>
Link: https://lore.kernel.org/r/20201015084525.135121-1-idosch@idosch.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 tools/testing/selftests/net/forwarding/vxlan_asymmetric.sh |   10 ++++++++++
 tools/testing/selftests/net/forwarding/vxlan_symmetric.sh  |   10 ++++++++++
 2 files changed, 20 insertions(+)

--- a/tools/testing/selftests/net/forwarding/vxlan_asymmetric.sh
+++ b/tools/testing/selftests/net/forwarding/vxlan_asymmetric.sh
@@ -215,10 +215,16 @@ switch_create()
 
 	bridge fdb add 00:00:5e:00:01:01 dev br1 self local vlan 10
 	bridge fdb add 00:00:5e:00:01:01 dev br1 self local vlan 20
+
+	sysctl_set net.ipv4.conf.all.rp_filter 0
+	sysctl_set net.ipv4.conf.vlan10-v.rp_filter 0
+	sysctl_set net.ipv4.conf.vlan20-v.rp_filter 0
 }
 
 switch_destroy()
 {
+	sysctl_restore net.ipv4.conf.all.rp_filter
+
 	bridge fdb del 00:00:5e:00:01:01 dev br1 self local vlan 20
 	bridge fdb del 00:00:5e:00:01:01 dev br1 self local vlan 10
 
@@ -359,6 +365,10 @@ ns_switch_create()
 
 	bridge fdb add 00:00:5e:00:01:01 dev br1 self local vlan 10
 	bridge fdb add 00:00:5e:00:01:01 dev br1 self local vlan 20
+
+	sysctl_set net.ipv4.conf.all.rp_filter 0
+	sysctl_set net.ipv4.conf.vlan10-v.rp_filter 0
+	sysctl_set net.ipv4.conf.vlan20-v.rp_filter 0
 }
 export -f ns_switch_create
 
--- a/tools/testing/selftests/net/forwarding/vxlan_symmetric.sh
+++ b/tools/testing/selftests/net/forwarding/vxlan_symmetric.sh
@@ -237,10 +237,16 @@ switch_create()
 
 	bridge fdb add 00:00:5e:00:01:01 dev br1 self local vlan 10
 	bridge fdb add 00:00:5e:00:01:01 dev br1 self local vlan 20
+
+	sysctl_set net.ipv4.conf.all.rp_filter 0
+	sysctl_set net.ipv4.conf.vlan10-v.rp_filter 0
+	sysctl_set net.ipv4.conf.vlan20-v.rp_filter 0
 }
 
 switch_destroy()
 {
+	sysctl_restore net.ipv4.conf.all.rp_filter
+
 	bridge fdb del 00:00:5e:00:01:01 dev br1 self local vlan 20
 	bridge fdb del 00:00:5e:00:01:01 dev br1 self local vlan 10
 
@@ -402,6 +408,10 @@ ns_switch_create()
 
 	bridge fdb add 00:00:5e:00:01:01 dev br1 self local vlan 10
 	bridge fdb add 00:00:5e:00:01:01 dev br1 self local vlan 20
+
+	sysctl_set net.ipv4.conf.all.rp_filter 0
+	sysctl_set net.ipv4.conf.vlan10-v.rp_filter 0
+	sysctl_set net.ipv4.conf.vlan20-v.rp_filter 0
 }
 export -f ns_switch_create
 



^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 051/633] selftests: rtnetlink: load fou module for kci_test_encap_fou() test
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (49 preceding siblings ...)
  2020-10-27 13:46 ` [PATCH 5.8 050/633] selftests: forwarding: Add missing rp_filter configuration Greg Kroah-Hartman
@ 2020-10-27 13:46 ` Greg Kroah-Hartman
  2020-10-27 13:46 ` [PATCH 5.8 052/633] tcp: fix to update snd_wl1 in bulk receiver fast path Greg Kroah-Hartman
                   ` (584 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:46 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Po-Hsu Lin, Jakub Kicinski

From: Po-Hsu Lin <po-hsu.lin@canonical.com>

[ Upstream commit 26ebd6fed9bb3aa480c7c0f147ac0e7b11000f65 ]

The kci_test_encap_fou() test from kci_test_encap() in rtnetlink.sh
needs the fou module to work. Otherwise it will fail with:

  $ ip netns exec "$testns" ip fou add port 7777 ipproto 47
  RTNETLINK answers: No such file or directory
  Error talking to the kernel

Add the CONFIG_NET_FOU into the config file as well. Which needs at
least to be set as a loadable module.

Fixes: 6227efc1a20b ("selftests: rtnetlink.sh: add vxlan and fou test cases")
Signed-off-by: Po-Hsu Lin <po-hsu.lin@canonical.com>
Link: https://lore.kernel.org/r/20201019030928.9859-1-po-hsu.lin@canonical.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 tools/testing/selftests/net/config       |    1 +
 tools/testing/selftests/net/rtnetlink.sh |    5 +++++
 2 files changed, 6 insertions(+)

--- a/tools/testing/selftests/net/config
+++ b/tools/testing/selftests/net/config
@@ -31,3 +31,4 @@ CONFIG_NET_SCH_ETF=m
 CONFIG_NET_SCH_NETEM=y
 CONFIG_TEST_BLACKHOLE_DEV=m
 CONFIG_KALLSYMS=y
+CONFIG_NET_FOU=m
--- a/tools/testing/selftests/net/rtnetlink.sh
+++ b/tools/testing/selftests/net/rtnetlink.sh
@@ -521,6 +521,11 @@ kci_test_encap_fou()
 		return $ksft_skip
 	fi
 
+	if ! /sbin/modprobe -q -n fou; then
+		echo "SKIP: module fou is not found"
+		return $ksft_skip
+	fi
+	/sbin/modprobe -q fou
 	ip -netns "$testns" fou add port 7777 ipproto 47 2>/dev/null
 	if [ $? -ne 0 ];then
 		echo "FAIL: can't add fou port 7777, skipping test"



^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 052/633] tcp: fix to update snd_wl1 in bulk receiver fast path
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (50 preceding siblings ...)
  2020-10-27 13:46 ` [PATCH 5.8 051/633] selftests: rtnetlink: load fou module for kci_test_encap_fou() test Greg Kroah-Hartman
@ 2020-10-27 13:46 ` Greg Kroah-Hartman
  2020-10-27 13:46 ` [PATCH 5.8 053/633] net: ethernet: mtk-star-emac: select REGMAP_MMIO Greg Kroah-Hartman
                   ` (583 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Neal Cardwell,
	Apollon Oikonomopoulos, Soheil Hassas Yeganeh, Yuchung Cheng,
	Eric Dumazet, Jakub Kicinski

From: Neal Cardwell <ncardwell@google.com>

[ Upstream commit 18ded910b589839e38a51623a179837ab4cc3789 ]

In the header prediction fast path for a bulk data receiver, if no
data is newly acknowledged then we do not call tcp_ack() and do not
call tcp_ack_update_window(). This means that a bulk receiver that
receives large amounts of data can have the incoming sequence numbers
wrap, so that the check in tcp_may_update_window fails:
   after(ack_seq, tp->snd_wl1)

If the incoming receive windows are zero in this state, and then the
connection that was a bulk data receiver later wants to send data,
that connection can find itself persistently rejecting the window
updates in incoming ACKs. This means the connection can persistently
fail to discover that the receive window has opened, which in turn
means that the connection is unable to send anything, and the
connection's sending process can get permanently "stuck".

The fix is to update snd_wl1 in the header prediction fast path for a
bulk data receiver, so that it keeps up and does not see wrapping
problems.

This fix is based on a very nice and thorough analysis and diagnosis
by Apollon Oikonomopoulos (see link below).

This is a stable candidate but there is no Fixes tag here since the
bug predates current git history. Just for fun: looks like the bug
dates back to when header prediction was added in Linux v2.1.8 in Nov
1996. In that version tcp_rcv_established() was added, and the code
only updates snd_wl1 in tcp_ack(), and in the new "Bulk data transfer:
receiver" code path it does not call tcp_ack(). This fix seems to
apply cleanly at least as far back as v3.2.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Neal Cardwell <ncardwell@google.com>
Reported-by: Apollon Oikonomopoulos <apoikos@dmesg.gr>
Tested-by: Apollon Oikonomopoulos <apoikos@dmesg.gr>
Link: https://www.spinics.net/lists/netdev/msg692430.html
Acked-by: Soheil Hassas Yeganeh <soheil@google.com>
Acked-by: Yuchung Cheng <ycheng@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Link: https://lore.kernel.org/r/20201022143331.1887495-1-ncardwell.kernel@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv4/tcp_input.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -5716,6 +5716,8 @@ void tcp_rcv_established(struct sock *sk
 				tcp_data_snd_check(sk);
 				if (!inet_csk_ack_scheduled(sk))
 					goto no_ack;
+			} else {
+				tcp_update_wl(tp, TCP_SKB_CB(skb)->seq);
 			}
 
 			__tcp_ack_snd_check(sk, 0);



^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 053/633] net: ethernet: mtk-star-emac: select REGMAP_MMIO
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (51 preceding siblings ...)
  2020-10-27 13:46 ` [PATCH 5.8 052/633] tcp: fix to update snd_wl1 in bulk receiver fast path Greg Kroah-Hartman
@ 2020-10-27 13:46 ` Greg Kroah-Hartman
  2020-10-27 13:46 ` [PATCH 5.8 054/633] net/sched: act_gate: Unlock ->tcfa_lock in tc_setup_flow_action() Greg Kroah-Hartman
                   ` (582 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Bartosz Golaszewski, Jakub Kicinski

From: Bartosz Golaszewski <bgolaszewski@baylibre.com>

[ Upstream commit 5403caf21648d739bf2b1266c33e34384c313379 ]

The driver depends on mmio regmap API but doesn't select the appropriate
Kconfig option. This fixes it.

Fixes: 8c7bd5a454ff ("net: ethernet: mtk-star-emac: new driver")
Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
Link: https://lore.kernel.org/r/20201020073515.22769-1-brgl@bgdev.pl
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/mediatek/Kconfig |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/net/ethernet/mediatek/Kconfig
+++ b/drivers/net/ethernet/mediatek/Kconfig
@@ -17,6 +17,7 @@ config NET_MEDIATEK_SOC
 config NET_MEDIATEK_STAR_EMAC
 	tristate "MediaTek STAR Ethernet MAC support"
 	select PHYLIB
+	select REGMAP_MMIO
 	help
 	  This driver supports the ethernet MAC IP first used on
 	  MediaTek MT85** SoCs.



^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 054/633] net/sched: act_gate: Unlock ->tcfa_lock in tc_setup_flow_action()
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (52 preceding siblings ...)
  2020-10-27 13:46 ` [PATCH 5.8 053/633] net: ethernet: mtk-star-emac: select REGMAP_MMIO Greg Kroah-Hartman
@ 2020-10-27 13:46 ` Greg Kroah-Hartman
  2020-10-27 13:46 ` [PATCH 5.8 055/633] ALSA: hda - Dont register a cb func if it is registered already Greg Kroah-Hartman
                   ` (581 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Guillaume Nault, Cong Wang, Jakub Kicinski

From: Guillaume Nault <gnault@redhat.com>

[ Upstream commit b130762161374b1ef31549bef8ebd4abeb998d94 ]

We need to jump to the "err_out_locked" label when
tcf_gate_get_entries() fails. Otherwise, tc_setup_flow_action() exits
with ->tcfa_lock still held.

Fixes: d29bdd69ecdd ("net: schedule: add action gate offloading")
Signed-off-by: Guillaume Nault <gnault@redhat.com>
Acked-by: Cong Wang <xiyou.wangcong@gmail.com>
Link: https://lore.kernel.org/r/12f60e385584c52c22863701c0185e40ab08a7a7.1603207948.git.gnault@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/sched/cls_api.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/net/sched/cls_api.c
+++ b/net/sched/cls_api.c
@@ -3707,7 +3707,7 @@ int tc_setup_flow_action(struct flow_act
 			entry->gate.num_entries = tcf_gate_num_entries(act);
 			err = tcf_gate_get_entries(entry, act);
 			if (err)
-				goto err_out;
+				goto err_out_locked;
 		} else {
 			err = -EOPNOTSUPP;
 			goto err_out_locked;



^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 055/633] ALSA: hda - Dont register a cb func if it is registered already
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (53 preceding siblings ...)
  2020-10-27 13:46 ` [PATCH 5.8 054/633] net/sched: act_gate: Unlock ->tcfa_lock in tc_setup_flow_action() Greg Kroah-Hartman
@ 2020-10-27 13:46 ` Greg Kroah-Hartman
  2020-10-27 13:46 ` [PATCH 5.8 056/633] ALSA: hda - Fix the return value if cb func is already registered Greg Kroah-Hartman
                   ` (580 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:46 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Hui Wang, Takashi Iwai

From: Hui Wang <hui.wang@canonical.com>

commit f4794c6064a83d2c57b264bd299c367d172d1044 upstream.

If the caller of enable_callback_mst() passes a cb func, the callee
function will malloc memory and link this cb func to the list
unconditionally. This will introduce problem if caller is in the
hda_codec_ops.init() since the init() will be repeatedly called in the
codec rt_resume().

So far, the patch_hdmi.c and patch_ca0132.c call enable_callback_mst()
in the hda_codec_ops.init().

Signed-off-by: Hui Wang <hui.wang@canonical.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200930055146.5665-1-hui.wang@canonical.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/pci/hda/hda_jack.c |   14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

--- a/sound/pci/hda/hda_jack.c
+++ b/sound/pci/hda/hda_jack.c
@@ -275,6 +275,18 @@ int snd_hda_jack_detect_state_mst(struct
 }
 EXPORT_SYMBOL_GPL(snd_hda_jack_detect_state_mst);
 
+static bool func_is_already_in_callback_list(struct hda_jack_tbl *jack,
+					     hda_jack_callback_fn func)
+{
+	struct hda_jack_callback *cb;
+
+	for (cb = jack->callback; cb; cb = cb->next) {
+		if (cb->func == func)
+			return true;
+	}
+	return false;
+}
+
 /**
  * snd_hda_jack_detect_enable_mst - enable the jack-detection
  * @codec: the HDA codec
@@ -297,7 +309,7 @@ snd_hda_jack_detect_enable_callback_mst(
 	jack = snd_hda_jack_tbl_new(codec, nid, dev_id);
 	if (!jack)
 		return ERR_PTR(-ENOMEM);
-	if (func) {
+	if (func && !func_is_already_in_callback_list(jack, func)) {
 		callback = kzalloc(sizeof(*callback), GFP_KERNEL);
 		if (!callback)
 			return ERR_PTR(-ENOMEM);



^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 056/633] ALSA: hda - Fix the return value if cb func is already registered
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (54 preceding siblings ...)
  2020-10-27 13:46 ` [PATCH 5.8 055/633] ALSA: hda - Dont register a cb func if it is registered already Greg Kroah-Hartman
@ 2020-10-27 13:46 ` Greg Kroah-Hartman
  2020-10-27 13:46 ` [PATCH 5.8 057/633] ALSA: usb-audio: Line6 Pod Go interface requires static clock rate quirk Greg Kroah-Hartman
                   ` (579 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hui Wang, Takashi Iwai, Dan Carpenter

From: Hui Wang <hui.wang@canonical.com>

commit 033e4040d453f1f7111e5957a54f3019eb089cc6 upstream.

If the cb function is already registered, should return the pointer
of the structure hda_jack_callback which contains this cb func, but
instead it returns the NULL.

Now fix it by replacing func_is_already_in_callback_list() with
find_callback_from_list().

Fixes: f4794c6064a8 ("ALSA: hda - Don't register a cb func if it is registered already")
Reported-and-suggested-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Hui Wang <hui.wang@canonical.com>
Link: https://lore.kernel.org/r/20201022030221.22393-1-hui.wang@canonical.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/pci/hda/hda_jack.c |   18 +++++++++++++-----
 1 file changed, 13 insertions(+), 5 deletions(-)

--- a/sound/pci/hda/hda_jack.c
+++ b/sound/pci/hda/hda_jack.c
@@ -275,16 +275,21 @@ int snd_hda_jack_detect_state_mst(struct
 }
 EXPORT_SYMBOL_GPL(snd_hda_jack_detect_state_mst);
 
-static bool func_is_already_in_callback_list(struct hda_jack_tbl *jack,
-					     hda_jack_callback_fn func)
+static struct hda_jack_callback *
+find_callback_from_list(struct hda_jack_tbl *jack,
+			hda_jack_callback_fn func)
 {
 	struct hda_jack_callback *cb;
 
+	if (!func)
+		return NULL;
+
 	for (cb = jack->callback; cb; cb = cb->next) {
 		if (cb->func == func)
-			return true;
+			return cb;
 	}
-	return false;
+
+	return NULL;
 }
 
 /**
@@ -309,7 +314,10 @@ snd_hda_jack_detect_enable_callback_mst(
 	jack = snd_hda_jack_tbl_new(codec, nid, dev_id);
 	if (!jack)
 		return ERR_PTR(-ENOMEM);
-	if (func && !func_is_already_in_callback_list(jack, func)) {
+
+	callback = find_callback_from_list(jack, func);
+
+	if (func && !callback) {
 		callback = kzalloc(sizeof(*callback), GFP_KERNEL);
 		if (!callback)
 			return ERR_PTR(-ENOMEM);



^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 057/633] ALSA: usb-audio: Line6 Pod Go interface requires static clock rate quirk
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (55 preceding siblings ...)
  2020-10-27 13:46 ` [PATCH 5.8 056/633] ALSA: hda - Fix the return value if cb func is already registered Greg Kroah-Hartman
@ 2020-10-27 13:46 ` Greg Kroah-Hartman
  2020-10-27 13:46 ` [PATCH 5.8 058/633] ALSA: hda/realtek - The front Mic on a HP machine doesnt work Greg Kroah-Hartman
                   ` (578 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:46 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Lukasz Halman, Takashi Iwai

From: Lukasz Halman <lukasz.halman@gmail.com>

commit 7da4c510abff8ad47eb2d7cc9a97def5a411947f upstream.

Recently released Line6 Pod Go requires static clock rate quirk to make
its usb audio interface working. Added its usb id to the list of similar
line6 devices.

Signed-off-by: Lukasz Halman <lukasz.halman@gmail.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201020061409.GA24382@TAG009442538903
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/usb/format.c |    1 +
 1 file changed, 1 insertion(+)

--- a/sound/usb/format.c
+++ b/sound/usb/format.c
@@ -406,6 +406,7 @@ static int line6_parse_audio_format_rate
 	case USB_ID(0x0e41, 0x4242): /* Line6 Helix Rack */
 	case USB_ID(0x0e41, 0x4244): /* Line6 Helix LT */
 	case USB_ID(0x0e41, 0x4246): /* Line6 HX-Stomp */
+	case USB_ID(0x0e41, 0x4247): /* Line6 Pod Go */
 	case USB_ID(0x0e41, 0x4248): /* Line6 Helix >= fw 2.82 */
 	case USB_ID(0x0e41, 0x4249): /* Line6 Helix Rack >= fw 2.82 */
 	case USB_ID(0x0e41, 0x424a): /* Line6 Helix LT >= fw 2.82 */



^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 058/633] ALSA: hda/realtek - The front Mic on a HP machine doesnt work
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (56 preceding siblings ...)
  2020-10-27 13:46 ` [PATCH 5.8 057/633] ALSA: usb-audio: Line6 Pod Go interface requires static clock rate quirk Greg Kroah-Hartman
@ 2020-10-27 13:46 ` Greg Kroah-Hartman
  2020-10-27 13:46 ` [PATCH 5.8 059/633] ALSA: hda/realtek - set mic to auto detect on a HP AIO machine Greg Kroah-Hartman
                   ` (577 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:46 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jeremy Szu, Takashi Iwai

From: Jeremy Szu <jeremy.szu@canonical.com>

commit 148ebf548a1af366fc797fcc7d03f0bb92b12a79 upstream.

On a HP ZCentral, the front Mic could not be detected.

The codec of the HP ZCentrol is alc671 and it needs to override the pin
configuration to enable the headset mic.

Signed-off-by: Jeremy Szu <jeremy.szu@canonical.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201008105645.65505-1-jeremy.szu@canonical.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/pci/hda/patch_realtek.c |    1 +
 1 file changed, 1 insertion(+)

--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -9635,6 +9635,7 @@ static const struct snd_pci_quirk alc662
 	SND_PCI_QUIRK(0x1028, 0x0698, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1028, 0x069f, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x103c, 0x1632, "HP RP5800", ALC662_FIXUP_HP_RP5800),
+	SND_PCI_QUIRK(0x103c, 0x873e, "HP", ALC671_FIXUP_HP_HEADSET_MIC2),
 	SND_PCI_QUIRK(0x1043, 0x1080, "Asus UX501VW", ALC668_FIXUP_HEADSET_MODE),
 	SND_PCI_QUIRK(0x1043, 0x11cd, "Asus N550", ALC662_FIXUP_ASUS_Nx50),
 	SND_PCI_QUIRK(0x1043, 0x13df, "Asus N550JX", ALC662_FIXUP_BASS_1A),



^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 059/633] ALSA: hda/realtek - set mic to auto detect on a HP AIO machine
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (57 preceding siblings ...)
  2020-10-27 13:46 ` [PATCH 5.8 058/633] ALSA: hda/realtek - The front Mic on a HP machine doesnt work Greg Kroah-Hartman
@ 2020-10-27 13:46 ` Greg Kroah-Hartman
  2020-10-27 13:46 ` [PATCH 5.8 060/633] ALSA: hda/realtek - Add mute Led support for HP Elitebook 845 G7 Greg Kroah-Hartman
                   ` (576 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:46 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Hui Wang, Takashi Iwai

From: Hui Wang <hui.wang@canonical.com>

commit 13468bfa8c58731dc9ecda1cd9b22a191114f944 upstream.

Recently we enabled a HP AIO machine, we found the mic on the machine
couldn't record any sound and it couldn't detect plugging and
unplugging as well.

Through debugging we found the mic is set to manual detect mode, after
setting it to auto detect mode, it could detect plugging and
unplugging and could record sound.

Cc: <stable@vger.kernel.org>
Signed-off-by: Hui Wang <hui.wang@canonical.com>
Link: https://lore.kernel.org/r/20200928080117.12435-1-hui.wang@canonical.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/pci/hda/patch_realtek.c |   11 +++++++++++
 1 file changed, 11 insertions(+)

--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -6246,6 +6246,7 @@ enum {
 	ALC269_FIXUP_LEMOTE_A190X,
 	ALC256_FIXUP_INTEL_NUC8_RUGGED,
 	ALC255_FIXUP_XIAOMI_HEADSET_MIC,
+	ALC274_FIXUP_HP_MIC,
 };
 
 static const struct hda_fixup alc269_fixups[] = {
@@ -7625,6 +7626,14 @@ static const struct hda_fixup alc269_fix
 		.chained = true,
 		.chain_id = ALC289_FIXUP_ASUS_GA401
 	},
+	[ALC274_FIXUP_HP_MIC] = {
+		.type = HDA_FIXUP_VERBS,
+		.v.verbs = (const struct hda_verb[]) {
+			{ 0x20, AC_VERB_SET_COEF_INDEX, 0x45 },
+			{ 0x20, AC_VERB_SET_PROC_COEF, 0x5089 },
+			{ }
+		},
+	},
 };
 
 static const struct snd_pci_quirk alc269_fixup_tbl[] = {
@@ -7776,6 +7785,7 @@ static const struct snd_pci_quirk alc269
 	SND_PCI_QUIRK(0x103c, 0x869d, "HP", ALC236_FIXUP_HP_MUTE_LED),
 	SND_PCI_QUIRK(0x103c, 0x8729, "HP", ALC285_FIXUP_HP_GPIO_LED),
 	SND_PCI_QUIRK(0x103c, 0x8736, "HP", ALC285_FIXUP_HP_GPIO_AMP_INIT),
+	SND_PCI_QUIRK(0x103c, 0x874e, "HP", ALC274_FIXUP_HP_MIC),
 	SND_PCI_QUIRK(0x103c, 0x877a, "HP", ALC285_FIXUP_HP_MUTE_LED),
 	SND_PCI_QUIRK(0x103c, 0x877d, "HP", ALC236_FIXUP_HP_MUTE_LED),
 	SND_PCI_QUIRK(0x1043, 0x103e, "ASUS X540SA", ALC256_FIXUP_ASUS_MIC),
@@ -8101,6 +8111,7 @@ static const struct hda_model_fixup alc2
 	{.id = ALC256_FIXUP_MEDION_HEADSET_NO_PRESENCE, .name = "alc256-medion-headset"},
 	{.id = ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET, .name = "alc298-samsung-headphone"},
 	{.id = ALC255_FIXUP_XIAOMI_HEADSET_MIC, .name = "alc255-xiaomi-headset"},
+	{.id = ALC274_FIXUP_HP_MIC, .name = "alc274-hp-mic-detect"},
 	{}
 };
 #define ALC225_STANDARD_PINS \



^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 060/633] ALSA: hda/realtek - Add mute Led support for HP Elitebook 845 G7
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (58 preceding siblings ...)
  2020-10-27 13:46 ` [PATCH 5.8 059/633] ALSA: hda/realtek - set mic to auto detect on a HP AIO machine Greg Kroah-Hartman
@ 2020-10-27 13:46 ` Greg Kroah-Hartman
  2020-10-27 13:46 ` [PATCH 5.8 061/633] ALSA: hda/realtek: Enable audio jacks of ASUS D700SA with ALC887 Greg Kroah-Hartman
                   ` (575 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:46 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Qiu Wenbo, Takashi Iwai

From: Qiu Wenbo <qiuwenbo@kylinos.com.cn>

commit 08befca40026136c14c3cd84f9e36c4cd20a358e upstream.

After installing archlinux, the mute led and micmute led are not working
at all. This patch fix this issue by applying a fixup from similar
model. These mute leds are confirmed working on HP Elitebook 845 G7.

Signed-off-by: Qiu Wenbo <qiuwenbo@kylinos.com.cn>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201002124454.7240-1-qiuwenbo@kylinos.com.cn
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/pci/hda/patch_realtek.c |    1 +
 1 file changed, 1 insertion(+)

--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -7786,6 +7786,7 @@ static const struct snd_pci_quirk alc269
 	SND_PCI_QUIRK(0x103c, 0x8729, "HP", ALC285_FIXUP_HP_GPIO_LED),
 	SND_PCI_QUIRK(0x103c, 0x8736, "HP", ALC285_FIXUP_HP_GPIO_AMP_INIT),
 	SND_PCI_QUIRK(0x103c, 0x874e, "HP", ALC274_FIXUP_HP_MIC),
+	SND_PCI_QUIRK(0x103c, 0x8760, "HP", ALC285_FIXUP_HP_MUTE_LED),
 	SND_PCI_QUIRK(0x103c, 0x877a, "HP", ALC285_FIXUP_HP_MUTE_LED),
 	SND_PCI_QUIRK(0x103c, 0x877d, "HP", ALC236_FIXUP_HP_MUTE_LED),
 	SND_PCI_QUIRK(0x1043, 0x103e, "ASUS X540SA", ALC256_FIXUP_ASUS_MIC),



^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 061/633] ALSA: hda/realtek: Enable audio jacks of ASUS D700SA with ALC887
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (59 preceding siblings ...)
  2020-10-27 13:46 ` [PATCH 5.8 060/633] ALSA: hda/realtek - Add mute Led support for HP Elitebook 845 G7 Greg Kroah-Hartman
@ 2020-10-27 13:46 ` Greg Kroah-Hartman
  2020-10-27 13:46 ` [PATCH 5.8 062/633] cifs: remove bogus debug code Greg Kroah-Hartman
                   ` (574 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jian-Hong Pan, Kailang Yang, Takashi Iwai

From: Jian-Hong Pan <jhp@endlessos.org>

commit ca184355db8e60290fa34bf61c13308e6f4f50d3 upstream.

The ASUS D700SA desktop's audio (1043:2390) with ALC887 cannot detect
the headset microphone and another headphone jack until
ALC887_FIXUP_ASUS_HMIC and ALC887_FIXUP_ASUS_AUDIO quirks are applied.
The NID 0x15 maps as the headset microphone and NID 0x19 maps as another
headphone jack. Also need the function like alc887_fixup_asus_jack to
enable the audio jacks.

Signed-off-by: Jian-Hong Pan <jhp@endlessos.org>
Signed-off-by: Kailang Yang <kailang@realtek.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201007052224.22611-1-jhp@endlessos.org
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/pci/hda/patch_realtek.c |   42 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 42 insertions(+)

--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -1922,6 +1922,8 @@ enum {
 	ALC1220_FIXUP_CLEVO_P950,
 	ALC1220_FIXUP_CLEVO_PB51ED,
 	ALC1220_FIXUP_CLEVO_PB51ED_PINS,
+	ALC887_FIXUP_ASUS_AUDIO,
+	ALC887_FIXUP_ASUS_HMIC,
 };
 
 static void alc889_fixup_coef(struct hda_codec *codec,
@@ -2134,6 +2136,31 @@ static void alc1220_fixup_clevo_pb51ed(s
 	alc_fixup_headset_mode_no_hp_mic(codec, fix, action);
 }
 
+static void alc887_asus_hp_automute_hook(struct hda_codec *codec,
+					 struct hda_jack_callback *jack)
+{
+	struct alc_spec *spec = codec->spec;
+	unsigned int vref;
+
+	snd_hda_gen_hp_automute(codec, jack);
+
+	if (spec->gen.hp_jack_present)
+		vref = AC_PINCTL_VREF_80;
+	else
+		vref = AC_PINCTL_VREF_HIZ;
+	snd_hda_set_pin_ctl(codec, 0x19, PIN_HP | vref);
+}
+
+static void alc887_fixup_asus_jack(struct hda_codec *codec,
+				     const struct hda_fixup *fix, int action)
+{
+	struct alc_spec *spec = codec->spec;
+	if (action != HDA_FIXUP_ACT_PROBE)
+		return;
+	snd_hda_set_pin_ctl_cache(codec, 0x1b, PIN_HP);
+	spec->gen.hp_automute_hook = alc887_asus_hp_automute_hook;
+}
+
 static const struct hda_fixup alc882_fixups[] = {
 	[ALC882_FIXUP_ABIT_AW9D_MAX] = {
 		.type = HDA_FIXUP_PINS,
@@ -2391,6 +2418,20 @@ static const struct hda_fixup alc882_fix
 		.chained = true,
 		.chain_id = ALC1220_FIXUP_CLEVO_PB51ED,
 	},
+	[ALC887_FIXUP_ASUS_AUDIO] = {
+		.type = HDA_FIXUP_PINS,
+		.v.pins = (const struct hda_pintbl[]) {
+			{ 0x15, 0x02a14150 }, /* use as headset mic, without its own jack detect */
+			{ 0x19, 0x22219420 },
+			{}
+		},
+	},
+	[ALC887_FIXUP_ASUS_HMIC] = {
+		.type = HDA_FIXUP_FUNC,
+		.v.func = alc887_fixup_asus_jack,
+		.chained = true,
+		.chain_id = ALC887_FIXUP_ASUS_AUDIO,
+	},
 };
 
 static const struct snd_pci_quirk alc882_fixup_tbl[] = {
@@ -2424,6 +2465,7 @@ static const struct snd_pci_quirk alc882
 	SND_PCI_QUIRK(0x1043, 0x13c2, "Asus A7M", ALC882_FIXUP_EAPD),
 	SND_PCI_QUIRK(0x1043, 0x1873, "ASUS W90V", ALC882_FIXUP_ASUS_W90V),
 	SND_PCI_QUIRK(0x1043, 0x1971, "Asus W2JC", ALC882_FIXUP_ASUS_W2JC),
+	SND_PCI_QUIRK(0x1043, 0x2390, "Asus D700SA", ALC887_FIXUP_ASUS_HMIC),
 	SND_PCI_QUIRK(0x1043, 0x835f, "Asus Eee 1601", ALC888_FIXUP_EEE1601),
 	SND_PCI_QUIRK(0x1043, 0x84bc, "ASUS ET2700", ALC887_FIXUP_ASUS_BASS),
 	SND_PCI_QUIRK(0x1043, 0x8691, "ASUS ROG Ranger VIII", ALC882_FIXUP_GPIO3),



^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 062/633] cifs: remove bogus debug code
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (60 preceding siblings ...)
  2020-10-27 13:46 ` [PATCH 5.8 061/633] ALSA: hda/realtek: Enable audio jacks of ASUS D700SA with ALC887 Greg Kroah-Hartman
@ 2020-10-27 13:46 ` Greg Kroah-Hartman
  2020-10-27 13:46 ` [PATCH 5.8 063/633] cifs: Return the error from crypt_message when enc/dec key not found Greg Kroah-Hartman
                   ` (573 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dominik Maier, Dan Carpenter, Steve French

From: Dan Carpenter <dan.carpenter@oracle.com>

commit d367cb960ce88914898cbfa43645c2e43ede9465 upstream.

The "end" pointer is either NULL or it points to the next byte to parse.
If there isn't a next byte then dereferencing "end" is an off-by-one out
of bounds error.  And, of course, if it's NULL that leads to an Oops.
Printing "*end" doesn't seem very useful so let's delete this code.

Also for the last debug statement, I noticed that it should be printing
"sequence_end" instead of "end" so fix that as well.

Reported-by: Dominik Maier <dmaier@sect.tu-berlin.de>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/cifs/asn1.c |   16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

--- a/fs/cifs/asn1.c
+++ b/fs/cifs/asn1.c
@@ -530,8 +530,8 @@ decode_negTokenInit(unsigned char *secur
 		return 0;
 	} else if ((cls != ASN1_CTX) || (con != ASN1_CON)
 		   || (tag != ASN1_EOC)) {
-		cifs_dbg(FYI, "cls = %d con = %d tag = %d end = %p (%d) exit 0\n",
-			 cls, con, tag, end, *end);
+		cifs_dbg(FYI, "cls = %d con = %d tag = %d end = %p exit 0\n",
+			 cls, con, tag, end);
 		return 0;
 	}
 
@@ -541,8 +541,8 @@ decode_negTokenInit(unsigned char *secur
 		return 0;
 	} else if ((cls != ASN1_UNI) || (con != ASN1_CON)
 		   || (tag != ASN1_SEQ)) {
-		cifs_dbg(FYI, "cls = %d con = %d tag = %d end = %p (%d) exit 1\n",
-			 cls, con, tag, end, *end);
+		cifs_dbg(FYI, "cls = %d con = %d tag = %d end = %p exit 1\n",
+			 cls, con, tag, end);
 		return 0;
 	}
 
@@ -552,8 +552,8 @@ decode_negTokenInit(unsigned char *secur
 		return 0;
 	} else if ((cls != ASN1_CTX) || (con != ASN1_CON)
 		   || (tag != ASN1_EOC)) {
-		cifs_dbg(FYI, "cls = %d con = %d tag = %d end = %p (%d) exit 0\n",
-			 cls, con, tag, end, *end);
+		cifs_dbg(FYI, "cls = %d con = %d tag = %d end = %p exit 0\n",
+			 cls, con, tag, end);
 		return 0;
 	}
 
@@ -564,8 +564,8 @@ decode_negTokenInit(unsigned char *secur
 		return 0;
 	} else if ((cls != ASN1_UNI) || (con != ASN1_CON)
 		   || (tag != ASN1_SEQ)) {
-		cifs_dbg(FYI, "cls = %d con = %d tag = %d end = %p (%d) exit 1\n",
-			 cls, con, tag, end, *end);
+		cifs_dbg(FYI, "cls = %d con = %d tag = %d sequence_end = %p exit 1\n",
+			 cls, con, tag, sequence_end);
 		return 0;
 	}
 



^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 063/633] cifs: Return the error from crypt_message when enc/dec key not found.
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (61 preceding siblings ...)
  2020-10-27 13:46 ` [PATCH 5.8 062/633] cifs: remove bogus debug code Greg Kroah-Hartman
@ 2020-10-27 13:46 ` Greg Kroah-Hartman
  2020-10-27 13:46 ` [PATCH 5.8 064/633] SMB3: Resolve data corruption of TCP server info fields Greg Kroah-Hartman
                   ` (572 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Shyam Prasad N, Pavel Shilovsky,
	Ronnie Sahlberg, Steve French

From: Shyam Prasad N <sprasad@microsoft.com>

commit 0bd294b55a5de442370c29fa53bab17aef3ff318 upstream.

In crypt_message, when smb2_get_enc_key returns error, we need to
return the error back to the caller. If not, we end up processing
the message further, causing a kernel oops due to unwarranted access
of memory.

Call Trace:
smb3_receive_transform+0x120/0x870 [cifs]
cifs_demultiplex_thread+0xb53/0xc20 [cifs]
? cifs_handle_standard+0x190/0x190 [cifs]
kthread+0x116/0x130
? kthread_park+0x80/0x80
ret_from_fork+0x1f/0x30

Signed-off-by: Shyam Prasad N <sprasad@microsoft.com>
Reviewed-by: Pavel Shilovsky <pshilov@microsoft.com>
Reviewed-by: Ronnie Sahlberg <lsahlber@redhat.com>
CC: Stable <stable@vger.kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/cifs/smb2ops.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/fs/cifs/smb2ops.c
+++ b/fs/cifs/smb2ops.c
@@ -3924,7 +3924,7 @@ crypt_message(struct TCP_Server_Info *se
 	if (rc) {
 		cifs_server_dbg(VFS, "%s: Could not get %scryption key\n", __func__,
 			 enc ? "en" : "de");
-		return 0;
+		return rc;
 	}
 
 	rc = smb3_crypto_aead_allocate(server);



^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 064/633] SMB3: Resolve data corruption of TCP server info fields
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (62 preceding siblings ...)
  2020-10-27 13:46 ` [PATCH 5.8 063/633] cifs: Return the error from crypt_message when enc/dec key not found Greg Kroah-Hartman
@ 2020-10-27 13:46 ` Greg Kroah-Hartman
  2020-10-27 13:46 ` [PATCH 5.8 065/633] SMB3.1.1: Fix ids returned in POSIX query dir Greg Kroah-Hartman
                   ` (571 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Rohith Surabattula, Aurelien Aptel,
	Pavel Shilovsky, Steve French

From: Rohith Surabattula <rohiths@microsoft.com>

commit 62593011247c8a8cfeb0c86aff84688b196727c2 upstream.

TCP server info field server->total_read is modified in parallel by
demultiplex thread and decrypt offload worker thread. server->total_read
is used in calculation to discard the remaining data of PDU which is
not read into memory.

Because of parallel modification, server->total_read can get corrupted
and can result in discarding the valid data of next PDU.

Signed-off-by: Rohith Surabattula <rohiths@microsoft.com>
Reviewed-by: Aurelien Aptel <aaptel@suse.com>
Reviewed-by: Pavel Shilovsky <pshilov@microsoft.com>
CC: Stable <stable@vger.kernel.org> #5.4+
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/cifs/smb2ops.c |   12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

--- a/fs/cifs/smb2ops.c
+++ b/fs/cifs/smb2ops.c
@@ -4103,7 +4103,8 @@ smb3_is_transform_hdr(void *buf)
 static int
 decrypt_raw_data(struct TCP_Server_Info *server, char *buf,
 		 unsigned int buf_data_size, struct page **pages,
-		 unsigned int npages, unsigned int page_data_size)
+		 unsigned int npages, unsigned int page_data_size,
+		 bool is_offloaded)
 {
 	struct kvec iov[2];
 	struct smb_rqst rqst = {NULL};
@@ -4129,7 +4130,8 @@ decrypt_raw_data(struct TCP_Server_Info
 
 	memmove(buf, iov[1].iov_base, buf_data_size);
 
-	server->total_read = buf_data_size + page_data_size;
+	if (!is_offloaded)
+		server->total_read = buf_data_size + page_data_size;
 
 	return rc;
 }
@@ -4342,7 +4344,7 @@ static void smb2_decrypt_offload(struct
 	struct mid_q_entry *mid;
 
 	rc = decrypt_raw_data(dw->server, dw->buf, dw->server->vals->read_rsp_size,
-			      dw->ppages, dw->npages, dw->len);
+			      dw->ppages, dw->npages, dw->len, true);
 	if (rc) {
 		cifs_dbg(VFS, "error decrypting rc=%d\n", rc);
 		goto free_pages;
@@ -4448,7 +4450,7 @@ receive_encrypted_read(struct TCP_Server
 
 non_offloaded_decrypt:
 	rc = decrypt_raw_data(server, buf, server->vals->read_rsp_size,
-			      pages, npages, len);
+			      pages, npages, len, false);
 	if (rc)
 		goto free_pages;
 
@@ -4504,7 +4506,7 @@ receive_encrypted_standard(struct TCP_Se
 	server->total_read += length;
 
 	buf_size = pdu_length - sizeof(struct smb2_transform_hdr);
-	length = decrypt_raw_data(server, buf, buf_size, NULL, 0, 0);
+	length = decrypt_raw_data(server, buf, buf_size, NULL, 0, 0, false);
 	if (length)
 		return length;
 



^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 065/633] SMB3.1.1: Fix ids returned in POSIX query dir
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (63 preceding siblings ...)
  2020-10-27 13:46 ` [PATCH 5.8 064/633] SMB3: Resolve data corruption of TCP server info fields Greg Kroah-Hartman
@ 2020-10-27 13:46 ` Greg Kroah-Hartman
  2020-10-27 13:46 ` [PATCH 5.8 066/633] smb3: do not try to cache root directory if dir leases not supported Greg Kroah-Hartman
                   ` (570 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:46 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Aurelien Aptel, Steve French

From: Steve French <stfrench@microsoft.com>

commit 9934430e2178d5164eb1ac91a9b092f9e7e64745 upstream.

We were setting the uid/gid to the default in each dir entry
in the parsing of the POSIX query dir response, rather
than attempting to map the user and group SIDs returned by
the server to well known SIDs (or upcall if not found).

CC: Stable <stable@vger.kernel.org>
Reviewed-by: Aurelien Aptel <aaptel@suse.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/cifs/cifsacl.c   |    5 +++--
 fs/cifs/cifsproto.h |    2 ++
 fs/cifs/readdir.c   |    5 ++---
 3 files changed, 7 insertions(+), 5 deletions(-)

--- a/fs/cifs/cifsacl.c
+++ b/fs/cifs/cifsacl.c
@@ -338,7 +338,7 @@ invalidate_key:
 	goto out_key_put;
 }
 
-static int
+int
 sid_to_id(struct cifs_sb_info *cifs_sb, struct cifs_sid *psid,
 		struct cifs_fattr *fattr, uint sidtype)
 {
@@ -359,7 +359,8 @@ sid_to_id(struct cifs_sb_info *cifs_sb,
 		return -EIO;
 	}
 
-	if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_UID_FROM_ACL) {
+	if ((cifs_sb->mnt_cifs_flags & CIFS_MOUNT_UID_FROM_ACL) ||
+	    (cifs_sb_master_tcon(cifs_sb)->posix_extensions)) {
 		uint32_t unix_id;
 		bool is_group;
 
--- a/fs/cifs/cifsproto.h
+++ b/fs/cifs/cifsproto.h
@@ -208,6 +208,8 @@ extern int cifs_set_file_info(struct ino
 extern int cifs_rename_pending_delete(const char *full_path,
 				      struct dentry *dentry,
 				      const unsigned int xid);
+extern int sid_to_id(struct cifs_sb_info *cifs_sb, struct cifs_sid *psid,
+				struct cifs_fattr *fattr, uint sidtype);
 extern int cifs_acl_to_fattr(struct cifs_sb_info *cifs_sb,
 			      struct cifs_fattr *fattr, struct inode *inode,
 			      bool get_mode_from_special_sid,
--- a/fs/cifs/readdir.c
+++ b/fs/cifs/readdir.c
@@ -267,9 +267,8 @@ cifs_posix_to_fattr(struct cifs_fattr *f
 	if (reparse_file_needs_reval(fattr))
 		fattr->cf_flags |= CIFS_FATTR_NEED_REVAL;
 
-	/* TODO map SIDs */
-	fattr->cf_uid = cifs_sb->mnt_uid;
-	fattr->cf_gid = cifs_sb->mnt_gid;
+	sid_to_id(cifs_sb, &parsed.owner, fattr, SIDOWNER);
+	sid_to_id(cifs_sb, &parsed.group, fattr, SIDGROUP);
 }
 
 static void __dir_info_to_fattr(struct cifs_fattr *fattr, const void *info)



^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 066/633] smb3: do not try to cache root directory if dir leases not supported
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (64 preceding siblings ...)
  2020-10-27 13:46 ` [PATCH 5.8 065/633] SMB3.1.1: Fix ids returned in POSIX query dir Greg Kroah-Hartman
@ 2020-10-27 13:46 ` Greg Kroah-Hartman
  2020-10-27 13:46 ` [PATCH 5.8 067/633] smb3: fix stat when special device file and mounted with modefromsid Greg Kroah-Hartman
                   ` (569 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:46 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Steve French

From: Steve French <stfrench@microsoft.com>

commit 3c6e65e679182d55779ef6f8582f0945af4319b0 upstream.

To servers which do not support directory leases (e.g. Samba)
it is wasteful to try to open_shroot (ie attempt to cache the
root directory handle).  Skip attempt to open_shroot when
server does not indicate support for directory leases.

Cuts the number of requests on mount from 17 to 15, and
cuts the number of requests on stat of the root directory
from 4 to 3.

Signed-off-by: Steve French <stfrench@microsoft.com>
CC: Stable <stable@vger.kernel.org> # v5.1+
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/cifs/connect.c |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -3594,7 +3594,10 @@ cifs_get_tcon(struct cifs_ses *ses, stru
 	 */
 	tcon->retry = volume_info->retry;
 	tcon->nocase = volume_info->nocase;
-	tcon->nohandlecache = volume_info->nohandlecache;
+	if (ses->server->capabilities & SMB2_GLOBAL_CAP_DIRECTORY_LEASING)
+		tcon->nohandlecache = volume_info->nohandlecache;
+	else
+		tcon->nohandlecache = 1;
 	tcon->nodelete = volume_info->nodelete;
 	tcon->local_lease = volume_info->local_lease;
 	INIT_LIST_HEAD(&tcon->pending_opens);



^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 067/633] smb3: fix stat when special device file and mounted with modefromsid
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (65 preceding siblings ...)
  2020-10-27 13:46 ` [PATCH 5.8 066/633] smb3: do not try to cache root directory if dir leases not supported Greg Kroah-Hartman
@ 2020-10-27 13:46 ` Greg Kroah-Hartman
  2020-10-27 13:46 ` [PATCH 5.8 068/633] arm64: Make use of ARCH_WORKAROUND_1 even when KVM is not enabled Greg Kroah-Hartman
                   ` (568 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Steve French, Ronnie Sahlberg,
	Shyam Prasad N

From: Steve French <stfrench@microsoft.com>

commit 3c3317daef0afa0cd541fc9c1bfd6ce8bbf1129a upstream.

When mounting with modefromsid mount option, it was possible to
get the error on stat of a fifo or char or block device:
        "cannot stat <filename>: Operation not supported"

Special devices can be stored as reparse points by some servers
(e.g. Windows NFS server and when using the SMB3.1.1 POSIX
Extensions) but when the modefromsid mount option is used
the client attempts to get the ACL for the file which requires
opening with OPEN_REPARSE_POINT create option.

Signed-off-by: Steve French <stfrench@microsoft.com>
CC: Stable <stable@vger.kernel.org>
Reviewed-by: Ronnie Sahlberg <lsahlber@redhat.com>
Reviewed-by: Shyam Prasad N <sprasad@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/cifs/smb2ops.c |    7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

--- a/fs/cifs/smb2ops.c
+++ b/fs/cifs/smb2ops.c
@@ -3072,7 +3072,12 @@ get_smb2_acl_by_path(struct cifs_sb_info
 	oparms.tcon = tcon;
 	oparms.desired_access = READ_CONTROL;
 	oparms.disposition = FILE_OPEN;
-	oparms.create_options = cifs_create_options(cifs_sb, 0);
+	/*
+	 * When querying an ACL, even if the file is a symlink we want to open
+	 * the source not the target, and so the protocol requires that the
+	 * client specify this flag when opening a reparse point
+	 */
+	oparms.create_options = cifs_create_options(cifs_sb, 0) | OPEN_REPARSE_POINT;
 	oparms.fid = &fid;
 	oparms.reconnect = false;
 



^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 068/633] arm64: Make use of ARCH_WORKAROUND_1 even when KVM is not enabled
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (66 preceding siblings ...)
  2020-10-27 13:46 ` [PATCH 5.8 067/633] smb3: fix stat when special device file and mounted with modefromsid Greg Kroah-Hartman
@ 2020-10-27 13:46 ` Greg Kroah-Hartman
  2020-10-27 13:46 ` [PATCH 5.8 069/633] KVM: nVMX: Morph notification vector IRQ on nested VM-Enter to pending PI Greg Kroah-Hartman
                   ` (567 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:46 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Marc Zyngier, Will Deacon

From: Marc Zyngier <maz@kernel.org>

commit b11483ef5a502663732c6ca1b58d14ff9eedd6f7 upstream.

We seem to be pretending that we don't have any firmware mitigation
when KVM is not compiled in, which is not quite expected.

Bring back the mitigation in this case.

Fixes: 4db61fef16a1 ("arm64: kvm: Modernize __smccc_workaround_1_smc_start annotations")
Cc: <stable@vger.kernel.org>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/arm64/kernel/cpu_errata.c |    7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

--- a/arch/arm64/kernel/cpu_errata.c
+++ b/arch/arm64/kernel/cpu_errata.c
@@ -234,14 +234,17 @@ static int detect_harden_bp_fw(void)
 		smccc_end = NULL;
 		break;
 
-#if IS_ENABLED(CONFIG_KVM)
 	case SMCCC_CONDUIT_SMC:
 		cb = call_smc_arch_workaround_1;
+#if IS_ENABLED(CONFIG_KVM)
 		smccc_start = __smccc_workaround_1_smc;
 		smccc_end = __smccc_workaround_1_smc +
 			__SMCCC_WORKAROUND_1_SMC_SZ;
-		break;
+#else
+		smccc_start = NULL;
+		smccc_end = NULL;
 #endif
+		break;
 
 	default:
 		return -1;



^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 069/633] KVM: nVMX: Morph notification vector IRQ on nested VM-Enter to pending PI
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (67 preceding siblings ...)
  2020-10-27 13:46 ` [PATCH 5.8 068/633] arm64: Make use of ARCH_WORKAROUND_1 even when KVM is not enabled Greg Kroah-Hartman
@ 2020-10-27 13:46 ` Greg Kroah-Hartman
  2020-10-27 13:46 ` [PATCH 5.8 070/633] KVM: nVMX: Reset the segment cache when stuffing guest segs Greg Kroah-Hartman
                   ` (566 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Liran Alon, Sean Christopherson,
	Paolo Bonzini

From: Sean Christopherson <sean.j.christopherson@intel.com>

commit 25bb2cf97139f81e3bb8910d26016a529019528e upstream.

On successful nested VM-Enter, check for pending interrupts and convert
the highest priority interrupt to a pending posted interrupt if it
matches L2's notification vector.  If the vCPU receives a notification
interrupt before nested VM-Enter (assuming L1 disables IRQs before doing
VM-Enter), the pending interrupt (for L1) should be recognized and
processed as a posted interrupt when interrupts become unblocked after
VM-Enter to L2.

This fixes a bug where L1/L2 will get stuck in an infinite loop if L1 is
trying to inject an interrupt into L2 by setting the appropriate bit in
L2's PIR and sending a self-IPI prior to VM-Enter (as opposed to KVM's
method of manually moving the vector from PIR->vIRR/RVI).  KVM will
observe the IPI while the vCPU is in L1 context and so won't immediately
morph it to a posted interrupt for L2.  The pending interrupt will be
seen by vmx_check_nested_events(), cause KVM to force an immediate exit
after nested VM-Enter, and eventually be reflected to L1 as a VM-Exit.
After handling the VM-Exit, L1 will see that L2 has a pending interrupt
in PIR, send another IPI, and repeat until L2 is killed.

Note, posted interrupts require virtual interrupt deliveriy, and virtual
interrupt delivery requires exit-on-interrupt, ergo interrupts will be
unconditionally unmasked on VM-Enter if posted interrupts are enabled.

Fixes: 705699a13994 ("KVM: nVMX: Enable nested posted interrupt processing")
Cc: stable@vger.kernel.org
Cc: Liran Alon <liran.alon@oracle.com>
Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com>
Message-Id: <20200812175129.12172-1-sean.j.christopherson@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/x86/kvm/lapic.c      |    7 +++++++
 arch/x86/kvm/lapic.h      |    1 +
 arch/x86/kvm/vmx/nested.c |    8 ++++++++
 3 files changed, 16 insertions(+)

--- a/arch/x86/kvm/lapic.c
+++ b/arch/x86/kvm/lapic.c
@@ -490,6 +490,12 @@ static inline void apic_clear_irr(int ve
 	}
 }
 
+void kvm_apic_clear_irr(struct kvm_vcpu *vcpu, int vec)
+{
+	apic_clear_irr(vec, vcpu->arch.apic);
+}
+EXPORT_SYMBOL_GPL(kvm_apic_clear_irr);
+
 static inline void apic_set_isr(int vec, struct kvm_lapic *apic)
 {
 	struct kvm_vcpu *vcpu;
@@ -2462,6 +2468,7 @@ int kvm_apic_has_interrupt(struct kvm_vc
 	__apic_update_ppr(apic, &ppr);
 	return apic_has_interrupt_for_ppr(apic, ppr);
 }
+EXPORT_SYMBOL_GPL(kvm_apic_has_interrupt);
 
 int kvm_apic_accept_pic_intr(struct kvm_vcpu *vcpu)
 {
--- a/arch/x86/kvm/lapic.h
+++ b/arch/x86/kvm/lapic.h
@@ -89,6 +89,7 @@ int kvm_lapic_reg_read(struct kvm_lapic
 bool kvm_apic_match_dest(struct kvm_vcpu *vcpu, struct kvm_lapic *source,
 			   int shorthand, unsigned int dest, int dest_mode);
 int kvm_apic_compare_prio(struct kvm_vcpu *vcpu1, struct kvm_vcpu *vcpu2);
+void kvm_apic_clear_irr(struct kvm_vcpu *vcpu, int vec);
 bool __kvm_apic_update_irr(u32 *pir, void *regs, int *max_irr);
 bool kvm_apic_update_irr(struct kvm_vcpu *vcpu, u32 *pir, int *max_irr);
 void kvm_apic_update_ppr(struct kvm_vcpu *vcpu);
--- a/arch/x86/kvm/vmx/nested.c
+++ b/arch/x86/kvm/vmx/nested.c
@@ -3480,6 +3480,14 @@ static int nested_vmx_run(struct kvm_vcp
 	if (unlikely(status != NVMX_VMENTRY_SUCCESS))
 		goto vmentry_failed;
 
+	/* Emulate processing of posted interrupts on VM-Enter. */
+	if (nested_cpu_has_posted_intr(vmcs12) &&
+	    kvm_apic_has_interrupt(vcpu) == vmx->nested.posted_intr_nv) {
+		vmx->nested.pi_pending = true;
+		kvm_make_request(KVM_REQ_EVENT, vcpu);
+		kvm_apic_clear_irr(vcpu, vmx->nested.posted_intr_nv);
+	}
+
 	/* Hide L1D cache contents from the nested guest.  */
 	vmx->vcpu.arch.l1tf_flush_l1d = true;
 



^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 070/633] KVM: nVMX: Reset the segment cache when stuffing guest segs
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (68 preceding siblings ...)
  2020-10-27 13:46 ` [PATCH 5.8 069/633] KVM: nVMX: Morph notification vector IRQ on nested VM-Enter to pending PI Greg Kroah-Hartman
@ 2020-10-27 13:46 ` Greg Kroah-Hartman
  2020-10-27 13:46 ` [PATCH 5.8 071/633] KVM: nVMX: Reload vmcs01 if getting vmcs12s pages fails Greg Kroah-Hartman
                   ` (565 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sean Christopherson, Paolo Bonzini

From: Sean Christopherson <sean.j.christopherson@intel.com>

commit fc387d8daf3960c5e1bc18fa353768056f4fd394 upstream.

Explicitly reset the segment cache after stuffing guest segment regs in
prepare_vmcs02_rare().  Although the cache is reset when switching to
vmcs02, there is nothing that prevents KVM from re-populating the cache
prior to writing vmcs02 with vmcs12's values.  E.g. if the vCPU is
preempted after switching to vmcs02 but before prepare_vmcs02_rare(),
kvm_arch_vcpu_put() will dereference GUEST_SS_AR_BYTES via .get_cpl()
and cache the stale vmcs02 value.  While the current code base only
caches stale data in the preemption case, it's theoretically possible
future code could read a segment register during the nested flow itself,
i.e. this isn't technically illegal behavior in kvm_arch_vcpu_put(),
although it did introduce the bug.

This manifests as an unexpected nested VM-Enter failure when running
with unrestricted guest disabled if the above preemption case coincides
with L1 switching L2's CPL, e.g. when switching from a L2 vCPU at CPL3
to to a L2 vCPU at CPL0.  stack_segment_valid() will see the new SS_SEL
but the old SS_AR_BYTES and incorrectly mark the guest state as invalid
due to SS.dpl != SS.rpl.

Don't bother updating the cache even though prepare_vmcs02_rare() writes
every segment.  With unrestricted guest, guest segments are almost never
read, let alone L2 guest segments.  On the other hand, populating the
cache requires a large number of memory writes, i.e. it's unlikely to be
a net win.  Updating the cache would be a win when unrestricted guest is
not supported, as guest_state_valid() will immediately cache all segment
registers.  But, nested virtualization without unrestricted guest is
dirt slow, saving some VMREADs won't change that, and every CPU
manufactured in the last decade supports unrestricted guest.  In other
words, the extra (minor) complexity isn't worth the trouble.

Note, kvm_arch_vcpu_put() may see stale data when querying guest CPL
depending on when preemption occurs.  This is "ok" in that the usage is
imperfect by nature, i.e. it's used heuristically to improve performance
but doesn't affect functionality.  kvm_arch_vcpu_put() could be "fixed"
by also disabling preemption while loading segments, but that's
pointless and misleading as reading state from kvm_sched_{in,out}() is
guaranteed to see stale data in one form or another.  E.g. even if all
the usage of regs_avail is fixed to call kvm_register_mark_available()
after the associated state is set, the individual state might still be
stale with respect to the overall vCPU state.  I.e. making functional
decisions in an asynchronous hook is doomed from the get go.  Thankfully
KVM doesn't do that.

Fixes: de63ad4cf4973 ("KVM: X86: implement the logic for spinlock optimization")
Cc: stable@vger.kernel.org
Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com>
Message-Id: <20200923184452.980-2-sean.j.christopherson@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/x86/kvm/vmx/nested.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/arch/x86/kvm/vmx/nested.c
+++ b/arch/x86/kvm/vmx/nested.c
@@ -2402,6 +2402,8 @@ static void prepare_vmcs02_rare(struct v
 		vmcs_writel(GUEST_TR_BASE, vmcs12->guest_tr_base);
 		vmcs_writel(GUEST_GDTR_BASE, vmcs12->guest_gdtr_base);
 		vmcs_writel(GUEST_IDTR_BASE, vmcs12->guest_idtr_base);
+
+		vmx->segment_cache.bitmask = 0;
 	}
 
 	if (!hv_evmcs || !(hv_evmcs->hv_clean_fields &



^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 071/633] KVM: nVMX: Reload vmcs01 if getting vmcs12s pages fails
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (69 preceding siblings ...)
  2020-10-27 13:46 ` [PATCH 5.8 070/633] KVM: nVMX: Reset the segment cache when stuffing guest segs Greg Kroah-Hartman
@ 2020-10-27 13:46 ` Greg Kroah-Hartman
  2020-10-27 13:46 ` [PATCH 5.8 072/633] KVM: x86/mmu: Commit zap of remaining invalid pages when recovering lpages Greg Kroah-Hartman
                   ` (564 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Cross, Jim Mattson, Peter Shier,
	Sean Christopherson, Paolo Bonzini

From: Sean Christopherson <sean.j.christopherson@intel.com>

commit b89d5ad00e789967a5e2c5335f75c48755bebd88 upstream.

Reload vmcs01 when bailing from nested_vmx_enter_non_root_mode() as KVM
expects vmcs01 to be loaded when is_guest_mode() is false.

Fixes: 671ddc700fd08 ("KVM: nVMX: Don't leak L1 MMIO regions to L2")
Cc: stable@vger.kernel.org
Cc: Dan Cross <dcross@google.com>
Cc: Jim Mattson <jmattson@google.com>
Cc: Peter Shier <pshier@google.com>
Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com>
Message-Id: <20200923184452.980-3-sean.j.christopherson@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/x86/kvm/vmx/nested.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/arch/x86/kvm/vmx/nested.c
+++ b/arch/x86/kvm/vmx/nested.c
@@ -3297,8 +3297,10 @@ enum nvmx_vmentry_status nested_vmx_ente
 	prepare_vmcs02_early(vmx, vmcs12);
 
 	if (from_vmentry) {
-		if (unlikely(!nested_get_vmcs12_pages(vcpu)))
+		if (unlikely(!nested_get_vmcs12_pages(vcpu))) {
+			vmx_switch_vmcs(vcpu, &vmx->vmcs01);
 			return NVMX_VMENTRY_KVM_INTERNAL_ERROR;
+		}
 
 		if (nested_vmx_check_vmentry_hw(vcpu)) {
 			vmx_switch_vmcs(vcpu, &vmx->vmcs01);



^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 072/633] KVM: x86/mmu: Commit zap of remaining invalid pages when recovering lpages
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (70 preceding siblings ...)
  2020-10-27 13:46 ` [PATCH 5.8 071/633] KVM: nVMX: Reload vmcs01 if getting vmcs12s pages fails Greg Kroah-Hartman
@ 2020-10-27 13:46 ` Greg Kroah-Hartman
  2020-10-27 13:46 ` [PATCH 5.8 073/633] KVM: x86: Intercept LA57 to inject #GP fault when its reserved Greg Kroah-Hartman
                   ` (563 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Junaid Shahid, Sean Christopherson,
	Paolo Bonzini

From: Sean Christopherson <sean.j.christopherson@intel.com>

commit e89505698c9f70125651060547da4ff5046124fc upstream.

Call kvm_mmu_commit_zap_page() after exiting the "prepare zap" loop in
kvm_recover_nx_lpages() to finish zapping pages in the unlikely event
that the loop exited due to lpage_disallowed_mmu_pages being empty.
Because the recovery thread drops mmu_lock() when rescheduling, it's
possible that lpage_disallowed_mmu_pages could be emptied by a different
thread without to_zap reaching zero despite to_zap being derived from
the number of disallowed lpages.

Fixes: 1aa9b9572b105 ("kvm: x86: mmu: Recovery of shattered NX large pages")
Cc: Junaid Shahid <junaids@google.com>
Cc: stable@vger.kernel.org
Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com>
Message-Id: <20200923183735.584-2-sean.j.christopherson@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/x86/kvm/mmu/mmu.c |    1 +
 1 file changed, 1 insertion(+)

--- a/arch/x86/kvm/mmu/mmu.c
+++ b/arch/x86/kvm/mmu/mmu.c
@@ -6341,6 +6341,7 @@ static void kvm_recover_nx_lpages(struct
 				cond_resched_lock(&kvm->mmu_lock);
 		}
 	}
+	kvm_mmu_commit_zap_page(kvm, &invalid_list);
 
 	spin_unlock(&kvm->mmu_lock);
 	srcu_read_unlock(&kvm->srcu, rcu_idx);



^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 073/633] KVM: x86: Intercept LA57 to inject #GP fault when its reserved
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (71 preceding siblings ...)
  2020-10-27 13:46 ` [PATCH 5.8 072/633] KVM: x86/mmu: Commit zap of remaining invalid pages when recovering lpages Greg Kroah-Hartman
@ 2020-10-27 13:46 ` Greg Kroah-Hartman
  2020-10-27 13:46 ` [PATCH 5.8 074/633] KVM: SVM: Initialize prev_ga_tag before use Greg Kroah-Hartman
                   ` (562 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lai Jiangshan, Lai Jiangshan,
	Sean Christopherson, Paolo Bonzini

From: Lai Jiangshan <laijs@linux.alibaba.com>

commit 6e1d849fa3296526e64b75fa227b6377cd0fd3da upstream.

Unconditionally intercept changes to CR4.LA57 so that KVM correctly
injects a #GP fault if the guest attempts to set CR4.LA57 when it's
supported in hardware but not exposed to the guest.

Long term, KVM needs to properly handle CR4 bits that can be under guest
control but also may be reserved from the guest's perspective.  But, KVM
currently sets the CR4 guest/host mask only during vCPU creation, and
reworking flows to change that will take a bit of elbow grease.

Even if/when generic support for intercepting reserved bits exists, it's
probably not worth letting the guest set CR4.LA57 directly.  LA57 can't
be toggled while long mode is enabled, thus it's all but guaranteed to
be set once (maybe twice, e.g. by BIOS and kernel) during boot and never
touched again.  On the flip side, letting the guest own CR4.LA57 may
incur extra VMREADs.  In other words, this temporary "hack" is probably
also the right long term fix.

Fixes: fd8cb433734e ("KVM: MMU: Expose the LA57 feature to VM.")
Cc: stable@vger.kernel.org
Cc: Lai Jiangshan <jiangshanlai@gmail.com>
Signed-off-by: Lai Jiangshan <laijs@linux.alibaba.com>
[sean: rewrote changelog]
Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com>
Message-Id: <20200930041659.28181-2-sean.j.christopherson@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/x86/kvm/kvm_cache_regs.h |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/x86/kvm/kvm_cache_regs.h
+++ b/arch/x86/kvm/kvm_cache_regs.h
@@ -7,7 +7,7 @@
 #define KVM_POSSIBLE_CR0_GUEST_BITS X86_CR0_TS
 #define KVM_POSSIBLE_CR4_GUEST_BITS				  \
 	(X86_CR4_PVI | X86_CR4_DE | X86_CR4_PCE | X86_CR4_OSFXSR  \
-	 | X86_CR4_OSXMMEXCPT | X86_CR4_LA57 | X86_CR4_PGE | X86_CR4_TSD)
+	 | X86_CR4_OSXMMEXCPT | X86_CR4_PGE | X86_CR4_TSD)
 
 #define BUILD_KVM_GPR_ACCESSORS(lname, uname)				      \
 static __always_inline unsigned long kvm_##lname##_read(struct kvm_vcpu *vcpu)\



^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 074/633] KVM: SVM: Initialize prev_ga_tag before use
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (72 preceding siblings ...)
  2020-10-27 13:46 ` [PATCH 5.8 073/633] KVM: x86: Intercept LA57 to inject #GP fault when its reserved Greg Kroah-Hartman
@ 2020-10-27 13:46 ` Greg Kroah-Hartman
  2020-10-27 13:46 ` [PATCH 5.8 075/633] ima: Dont ignore errors from crypto_shash_update() Greg Kroah-Hartman
                   ` (561 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Suravee Suthikulpanit, Paolo Bonzini

From: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>

commit f6426ab9c957e97418ac5b0466538792767b1738 upstream.

The function amd_ir_set_vcpu_affinity makes use of the parameter struct
amd_iommu_pi_data.prev_ga_tag to determine if it should delete struct
amd_iommu_pi_data from a list when not running in AVIC mode.

However, prev_ga_tag is initialized only when AVIC is enabled. The non-zero
uninitialized value can cause unintended code path, which ends up making
use of the struct vcpu_svm.ir_list and ir_list_lock without being
initialized (since they are intended only for the AVIC case).

This triggers NULL pointer dereference bug in the function vm_ir_list_del
with the following call trace:

    svm_update_pi_irte+0x3c2/0x550 [kvm_amd]
    ? proc_create_single_data+0x41/0x50
    kvm_arch_irq_bypass_add_producer+0x40/0x60 [kvm]
    __connect+0x5f/0xb0 [irqbypass]
    irq_bypass_register_producer+0xf8/0x120 [irqbypass]
    vfio_msi_set_vector_signal+0x1de/0x2d0 [vfio_pci]
    vfio_msi_set_block+0x77/0xe0 [vfio_pci]
    vfio_pci_set_msi_trigger+0x25c/0x2f0 [vfio_pci]
    vfio_pci_set_irqs_ioctl+0x88/0xb0 [vfio_pci]
    vfio_pci_ioctl+0x2ea/0xed0 [vfio_pci]
    ? alloc_file_pseudo+0xa5/0x100
    vfio_device_fops_unl_ioctl+0x26/0x30 [vfio]
    ? vfio_device_fops_unl_ioctl+0x26/0x30 [vfio]
    __x64_sys_ioctl+0x96/0xd0
    do_syscall_64+0x37/0x80
    entry_SYSCALL_64_after_hwframe+0x44/0xa9

Therefore, initialize prev_ga_tag to zero before use. This should be safe
because ga_tag value 0 is invalid (see function avic_vm_init).

Fixes: dfa20099e26e ("KVM: SVM: Refactor AVIC vcpu initialization into avic_init_vcpu()")
Signed-off-by: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
Message-Id: <20201003232707.4662-1-suravee.suthikulpanit@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/x86/kvm/svm/avic.c |    1 +
 1 file changed, 1 insertion(+)

--- a/arch/x86/kvm/svm/avic.c
+++ b/arch/x86/kvm/svm/avic.c
@@ -868,6 +868,7 @@ int svm_update_pi_irte(struct kvm *kvm,
 			 * - Tell IOMMU to use legacy mode for this interrupt.
 			 * - Retrieve ga_tag of prior interrupt remapping data.
 			 */
+			pi.prev_ga_tag = 0;
 			pi.is_guest_mode = false;
 			ret = irq_set_vcpu_affinity(host_irq, &pi);
 



^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 075/633] ima: Dont ignore errors from crypto_shash_update()
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (73 preceding siblings ...)
  2020-10-27 13:46 ` [PATCH 5.8 074/633] KVM: SVM: Initialize prev_ga_tag before use Greg Kroah-Hartman
@ 2020-10-27 13:46 ` Greg Kroah-Hartman
  2020-10-27 13:46 ` [PATCH 5.8 076/633] crypto: algif_aead - Do not set MAY_BACKLOG on the async path Greg Kroah-Hartman
                   ` (560 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:46 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Roberto Sassu, Mimi Zohar

From: Roberto Sassu <roberto.sassu@huawei.com>

commit 60386b854008adc951c470067f90a2d85b5d520f upstream.

Errors returned by crypto_shash_update() are not checked in
ima_calc_boot_aggregate_tfm() and thus can be overwritten at the next
iteration of the loop. This patch adds a check after calling
crypto_shash_update() and returns immediately if the result is not zero.

Cc: stable@vger.kernel.org
Fixes: 3323eec921efd ("integrity: IMA as an integrity service provider")
Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 security/integrity/ima/ima_crypto.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/security/integrity/ima/ima_crypto.c
+++ b/security/integrity/ima/ima_crypto.c
@@ -829,6 +829,8 @@ static int ima_calc_boot_aggregate_tfm(c
 		/* now accumulate with current aggregate */
 		rc = crypto_shash_update(shash, d.digest,
 					 crypto_shash_digestsize(tfm));
+		if (rc != 0)
+			return rc;
 	}
 	/*
 	 * Extend cumulative digest over TPM registers 8-9, which contain



^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 076/633] crypto: algif_aead - Do not set MAY_BACKLOG on the async path
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (74 preceding siblings ...)
  2020-10-27 13:46 ` [PATCH 5.8 075/633] ima: Dont ignore errors from crypto_shash_update() Greg Kroah-Hartman
@ 2020-10-27 13:46 ` Greg Kroah-Hartman
  2020-10-27 13:47 ` [PATCH 5.8 077/633] crypto: caam/qi - add fallback for XTS with more than 8B IV Greg Kroah-Hartman
                   ` (559 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:46 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Herbert Xu

From: Herbert Xu <herbert@gondor.apana.org.au>

commit cbdad1f246dd98e6c9c32a6e5212337f542aa7e0 upstream.

The async path cannot use MAY_BACKLOG because it is not meant to
block, which is what MAY_BACKLOG does.  On the other hand, both
the sync and async paths can make use of MAY_SLEEP.

Fixes: 83094e5e9e49 ("crypto: af_alg - add async support to...")
Cc: <stable@vger.kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 crypto/algif_aead.c |    7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

--- a/crypto/algif_aead.c
+++ b/crypto/algif_aead.c
@@ -78,7 +78,7 @@ static int crypto_aead_copy_sgl(struct c
 	SYNC_SKCIPHER_REQUEST_ON_STACK(skreq, null_tfm);
 
 	skcipher_request_set_sync_tfm(skreq, null_tfm);
-	skcipher_request_set_callback(skreq, CRYPTO_TFM_REQ_MAY_BACKLOG,
+	skcipher_request_set_callback(skreq, CRYPTO_TFM_REQ_MAY_SLEEP,
 				      NULL, NULL);
 	skcipher_request_set_crypt(skreq, src, dst, len, NULL);
 
@@ -291,19 +291,20 @@ static int _aead_recvmsg(struct socket *
 		areq->outlen = outlen;
 
 		aead_request_set_callback(&areq->cra_u.aead_req,
-					  CRYPTO_TFM_REQ_MAY_BACKLOG,
+					  CRYPTO_TFM_REQ_MAY_SLEEP,
 					  af_alg_async_cb, areq);
 		err = ctx->enc ? crypto_aead_encrypt(&areq->cra_u.aead_req) :
 				 crypto_aead_decrypt(&areq->cra_u.aead_req);
 
 		/* AIO operation in progress */
-		if (err == -EINPROGRESS || err == -EBUSY)
+		if (err == -EINPROGRESS)
 			return -EIOCBQUEUED;
 
 		sock_put(sk);
 	} else {
 		/* Synchronous operation */
 		aead_request_set_callback(&areq->cra_u.aead_req,
+					  CRYPTO_TFM_REQ_MAY_SLEEP |
 					  CRYPTO_TFM_REQ_MAY_BACKLOG,
 					  crypto_req_done, &ctx->wait);
 		err = crypto_wait_req(ctx->enc ?



^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 077/633] crypto: caam/qi - add fallback for XTS with more than 8B IV
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (75 preceding siblings ...)
  2020-10-27 13:46 ` [PATCH 5.8 076/633] crypto: algif_aead - Do not set MAY_BACKLOG on the async path Greg Kroah-Hartman
@ 2020-10-27 13:47 ` Greg Kroah-Hartman
  2020-10-27 13:47 ` [PATCH 5.8 078/633] crypto: caam/qi - add support for more XTS key lengths Greg Kroah-Hartman
                   ` (558 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Andrei Botila, Horia Geantă, Herbert Xu

From: Andrei Botila <andrei.botila@nxp.com>

commit 83e8aa9121380b23ebae6e413962fa2a7b52cf92 upstream.

A hardware limitation exists for CAAM until Era 9 which restricts
the accelerator to IVs with only 8 bytes. When CAAM has a lower era
a fallback is necessary to process 16 bytes IV.

Fixes: b189817cf789 ("crypto: caam/qi - add ablkcipher and authenc algorithms")
Cc: <stable@vger.kernel.org> # v4.12+
Signed-off-by: Andrei Botila <andrei.botila@nxp.com>
Reviewed-by: Horia Geantă <horia.geanta@nxp.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/crypto/caam/Kconfig      |    1 
 drivers/crypto/caam/caamalg_qi.c |   70 ++++++++++++++++++++++++++++++++++++---
 2 files changed, 67 insertions(+), 4 deletions(-)

--- a/drivers/crypto/caam/Kconfig
+++ b/drivers/crypto/caam/Kconfig
@@ -114,6 +114,7 @@ config CRYPTO_DEV_FSL_CAAM_CRYPTO_API_QI
 	select CRYPTO_AUTHENC
 	select CRYPTO_SKCIPHER
 	select CRYPTO_DES
+	select CRYPTO_XTS
 	help
 	  Selecting this will use CAAM Queue Interface (QI) for sending
 	  & receiving crypto jobs to/from CAAM. This gives better performance
--- a/drivers/crypto/caam/caamalg_qi.c
+++ b/drivers/crypto/caam/caamalg_qi.c
@@ -18,6 +18,7 @@
 #include "qi.h"
 #include "jr.h"
 #include "caamalg_desc.h"
+#include <asm/unaligned.h>
 
 /*
  * crypto alg
@@ -67,6 +68,11 @@ struct caam_ctx {
 	struct device *qidev;
 	spinlock_t lock;	/* Protects multiple init of driver context */
 	struct caam_drv_ctx *drv_ctx[NUM_OP];
+	struct crypto_skcipher *fallback;
+};
+
+struct caam_skcipher_req_ctx {
+	struct skcipher_request fallback_req;
 };
 
 static int aead_set_sh_desc(struct crypto_aead *aead)
@@ -726,12 +732,17 @@ static int xts_skcipher_setkey(struct cr
 	struct caam_ctx *ctx = crypto_skcipher_ctx(skcipher);
 	struct device *jrdev = ctx->jrdev;
 	int ret = 0;
+	int err;
 
 	if (keylen != 2 * AES_MIN_KEY_SIZE  && keylen != 2 * AES_MAX_KEY_SIZE) {
 		dev_dbg(jrdev, "key size mismatch\n");
 		return -EINVAL;
 	}
 
+	err = crypto_skcipher_setkey(ctx->fallback, key, keylen);
+	if (err)
+		return err;
+
 	ctx->cdata.keylen = keylen;
 	ctx->cdata.key_virt = key;
 	ctx->cdata.key_inline = true;
@@ -1373,6 +1384,14 @@ static struct skcipher_edesc *skcipher_e
 	return edesc;
 }
 
+static inline bool xts_skcipher_ivsize(struct skcipher_request *req)
+{
+	struct crypto_skcipher *skcipher = crypto_skcipher_reqtfm(req);
+	unsigned int ivsize = crypto_skcipher_ivsize(skcipher);
+
+	return !!get_unaligned((u64 *)(req->iv + (ivsize / 2)));
+}
+
 static inline int skcipher_crypt(struct skcipher_request *req, bool encrypt)
 {
 	struct skcipher_edesc *edesc;
@@ -1383,6 +1402,21 @@ static inline int skcipher_crypt(struct
 	if (!req->cryptlen)
 		return 0;
 
+	if (ctx->fallback && xts_skcipher_ivsize(req)) {
+		struct caam_skcipher_req_ctx *rctx = skcipher_request_ctx(req);
+
+		skcipher_request_set_tfm(&rctx->fallback_req, ctx->fallback);
+		skcipher_request_set_callback(&rctx->fallback_req,
+					      req->base.flags,
+					      req->base.complete,
+					      req->base.data);
+		skcipher_request_set_crypt(&rctx->fallback_req, req->src,
+					   req->dst, req->cryptlen, req->iv);
+
+		return encrypt ? crypto_skcipher_encrypt(&rctx->fallback_req) :
+				 crypto_skcipher_decrypt(&rctx->fallback_req);
+	}
+
 	if (unlikely(caam_congested))
 		return -EAGAIN;
 
@@ -1507,6 +1541,7 @@ static struct caam_skcipher_alg driver_a
 			.base = {
 				.cra_name = "xts(aes)",
 				.cra_driver_name = "xts-aes-caam-qi",
+				.cra_flags = CRYPTO_ALG_NEED_FALLBACK,
 				.cra_blocksize = AES_BLOCK_SIZE,
 			},
 			.setkey = xts_skcipher_setkey,
@@ -2440,9 +2475,32 @@ static int caam_cra_init(struct crypto_s
 	struct skcipher_alg *alg = crypto_skcipher_alg(tfm);
 	struct caam_skcipher_alg *caam_alg =
 		container_of(alg, typeof(*caam_alg), skcipher);
+	struct caam_ctx *ctx = crypto_skcipher_ctx(tfm);
+	u32 alg_aai = caam_alg->caam.class1_alg_type & OP_ALG_AAI_MASK;
+	int ret = 0;
+
+	if (alg_aai == OP_ALG_AAI_XTS) {
+		const char *tfm_name = crypto_tfm_alg_name(&tfm->base);
+		struct crypto_skcipher *fallback;
+
+		fallback = crypto_alloc_skcipher(tfm_name, 0,
+						 CRYPTO_ALG_NEED_FALLBACK);
+		if (IS_ERR(fallback)) {
+			dev_err(ctx->jrdev, "Failed to allocate %s fallback: %ld\n",
+				tfm_name, PTR_ERR(fallback));
+			return PTR_ERR(fallback);
+		}
+
+		ctx->fallback = fallback;
+		crypto_skcipher_set_reqsize(tfm, sizeof(struct caam_skcipher_req_ctx) +
+					    crypto_skcipher_reqsize(fallback));
+	}
+
+	ret = caam_init_common(ctx, &caam_alg->caam, false);
+	if (ret && ctx->fallback)
+		crypto_free_skcipher(ctx->fallback);
 
-	return caam_init_common(crypto_skcipher_ctx(tfm), &caam_alg->caam,
-				false);
+	return ret;
 }
 
 static int caam_aead_init(struct crypto_aead *tfm)
@@ -2468,7 +2526,11 @@ static void caam_exit_common(struct caam
 
 static void caam_cra_exit(struct crypto_skcipher *tfm)
 {
-	caam_exit_common(crypto_skcipher_ctx(tfm));
+	struct caam_ctx *ctx = crypto_skcipher_ctx(tfm);
+
+	if (ctx->fallback)
+		crypto_free_skcipher(ctx->fallback);
+	caam_exit_common(ctx);
 }
 
 static void caam_aead_exit(struct crypto_aead *tfm)
@@ -2502,7 +2564,7 @@ static void caam_skcipher_alg_init(struc
 	alg->base.cra_module = THIS_MODULE;
 	alg->base.cra_priority = CAAM_CRA_PRIORITY;
 	alg->base.cra_ctxsize = sizeof(struct caam_ctx);
-	alg->base.cra_flags = CRYPTO_ALG_ASYNC | CRYPTO_ALG_KERN_DRIVER_ONLY;
+	alg->base.cra_flags |= CRYPTO_ALG_ASYNC | CRYPTO_ALG_KERN_DRIVER_ONLY;
 
 	alg->init = caam_cra_init;
 	alg->exit = caam_cra_exit;



^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 078/633] crypto: caam/qi - add support for more XTS key lengths
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (76 preceding siblings ...)
  2020-10-27 13:47 ` [PATCH 5.8 077/633] crypto: caam/qi - add fallback for XTS with more than 8B IV Greg Kroah-Hartman
@ 2020-10-27 13:47 ` Greg Kroah-Hartman
  2020-10-27 13:47 ` [PATCH 5.8 079/633] RAS/CEC: Fix cec_init() prototype Greg Kroah-Hartman
                   ` (557 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Andrei Botila, Horia Geantă, Herbert Xu

From: Andrei Botila <andrei.botila@nxp.com>

commit 62b9a6690926ee199445b23fd46e6349d9057146 upstream.

CAAM accelerator only supports XTS-AES-128 and XTS-AES-256 since
it adheres strictly to the standard. All the other key lengths
are accepted and processed through a fallback as long as they pass
the xts_verify_key() checks.

Fixes: b189817cf789 ("crypto: caam/qi - add ablkcipher and authenc algorithms")
Cc: <stable@vger.kernel.org> # v4.12+
Signed-off-by: Andrei Botila <andrei.botila@nxp.com>
Reviewed-by: Horia Geantă <horia.geanta@nxp.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/crypto/caam/caamalg_qi.c |   13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

--- a/drivers/crypto/caam/caamalg_qi.c
+++ b/drivers/crypto/caam/caamalg_qi.c
@@ -18,6 +18,7 @@
 #include "qi.h"
 #include "jr.h"
 #include "caamalg_desc.h"
+#include <crypto/xts.h>
 #include <asm/unaligned.h>
 
 /*
@@ -68,6 +69,7 @@ struct caam_ctx {
 	struct device *qidev;
 	spinlock_t lock;	/* Protects multiple init of driver context */
 	struct caam_drv_ctx *drv_ctx[NUM_OP];
+	bool xts_key_fallback;
 	struct crypto_skcipher *fallback;
 };
 
@@ -734,11 +736,15 @@ static int xts_skcipher_setkey(struct cr
 	int ret = 0;
 	int err;
 
-	if (keylen != 2 * AES_MIN_KEY_SIZE  && keylen != 2 * AES_MAX_KEY_SIZE) {
+	err = xts_verify_key(skcipher, key, keylen);
+	if (err) {
 		dev_dbg(jrdev, "key size mismatch\n");
-		return -EINVAL;
+		return err;
 	}
 
+	if (keylen != 2 * AES_KEYSIZE_128 && keylen != 2 * AES_KEYSIZE_256)
+		ctx->xts_key_fallback = true;
+
 	err = crypto_skcipher_setkey(ctx->fallback, key, keylen);
 	if (err)
 		return err;
@@ -1402,7 +1408,8 @@ static inline int skcipher_crypt(struct
 	if (!req->cryptlen)
 		return 0;
 
-	if (ctx->fallback && xts_skcipher_ivsize(req)) {
+	if (ctx->fallback && (xts_skcipher_ivsize(req) ||
+			      ctx->xts_key_fallback)) {
 		struct caam_skcipher_req_ctx *rctx = skcipher_request_ctx(req);
 
 		skcipher_request_set_tfm(&rctx->fallback_req, ctx->fallback);



^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 079/633] RAS/CEC: Fix cec_init() prototype
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (77 preceding siblings ...)
  2020-10-27 13:47 ` [PATCH 5.8 078/633] crypto: caam/qi - add support for more XTS key lengths Greg Kroah-Hartman
@ 2020-10-27 13:47 ` Greg Kroah-Hartman
  2020-10-27 13:47 ` [PATCH 5.8 080/633] sched/fair: Fix wrong negative conversion in find_energy_efficient_cpu() Greg Kroah-Hartman
                   ` (556 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Luca Stefani, Borislav Petkov,
	Sami Tolvanen, Sasha Levin

From: Luca Stefani <luca.stefani.ge1@gmail.com>

[ Upstream commit 85e6084e0b436cabe9c909e679937998ffbf9c9d ]

late_initcall() expects a function that returns an integer. Update the
function signature to match.

 [ bp: Massage commit message into proper sentences. ]

Fixes: 9554bfe403bd ("x86/mce: Convert the CEC to use the MCE notifier")
Signed-off-by: Luca Stefani <luca.stefani.ge1@gmail.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Reviewed-by: Sami Tolvanen <samitolvanen@google.com>
Tested-by: Sami Tolvanen <samitolvanen@google.com>
Link: https://lkml.kernel.org/r/20200805095708.83939-1-luca.stefani.ge1@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/ras/cec.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/drivers/ras/cec.c b/drivers/ras/cec.c
index 569d9ad2c5942..6939aa5b3dc7f 100644
--- a/drivers/ras/cec.c
+++ b/drivers/ras/cec.c
@@ -553,20 +553,20 @@ static struct notifier_block cec_nb = {
 	.priority	= MCE_PRIO_CEC,
 };
 
-static void __init cec_init(void)
+static int __init cec_init(void)
 {
 	if (ce_arr.disabled)
-		return;
+		return -ENODEV;
 
 	ce_arr.array = (void *)get_zeroed_page(GFP_KERNEL);
 	if (!ce_arr.array) {
 		pr_err("Error allocating CE array page!\n");
-		return;
+		return -ENOMEM;
 	}
 
 	if (create_debugfs_nodes()) {
 		free_page((unsigned long)ce_arr.array);
-		return;
+		return -ENOMEM;
 	}
 
 	INIT_DELAYED_WORK(&cec_work, cec_work_fn);
@@ -575,6 +575,7 @@ static void __init cec_init(void)
 	mce_register_decode_chain(&cec_nb);
 
 	pr_info("Correctable Errors collector initialized.\n");
+	return 0;
 }
 late_initcall(cec_init);
 
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 080/633] sched/fair: Fix wrong negative conversion in find_energy_efficient_cpu()
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (78 preceding siblings ...)
  2020-10-27 13:47 ` [PATCH 5.8 079/633] RAS/CEC: Fix cec_init() prototype Greg Kroah-Hartman
@ 2020-10-27 13:47 ` Greg Kroah-Hartman
  2020-10-27 13:47 ` [PATCH 5.8 081/633] microblaze: fix kbuild redundant file warning Greg Kroah-Hartman
                   ` (555 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lukasz Luba, Peter Zijlstra (Intel),
	Valentin Schneider, Sasha Levin

From: Lukasz Luba <lukasz.luba@arm.com>

[ Upstream commit da0777d35f47892f359c3f73ea155870bb595700 ]

In find_energy_efficient_cpu() 'cpu_cap' could be less that 'util'.
It might be because of RT, DL (so higher sched class than CFS), irq or
thermal pressure signal, which reduce the capacity value.
In such situation the result of 'cpu_cap - util' might be negative but
stored in the unsigned long. Then it might be compared with other unsigned
long when uclamp_rq_util_with() reduced the 'util' such that is passes the
fits_capacity() check.

Prevent this situation and make the arithmetic more safe.

Fixes: 1d42509e475cd ("sched/fair: Make EAS wakeup placement consider uclamp restrictions")
Signed-off-by: Lukasz Luba <lukasz.luba@arm.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Valentin Schneider <valentin.schneider@arm.com>
Link: https://lkml.kernel.org/r/20200810083004.26420-1-lukasz.luba@arm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/sched/fair.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index 6b3b59cc51d6c..f71e8b0e0346a 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -6586,7 +6586,8 @@ static int find_energy_efficient_cpu(struct task_struct *p, int prev_cpu)
 
 			util = cpu_util_next(cpu, p, cpu);
 			cpu_cap = capacity_of(cpu);
-			spare_cap = cpu_cap - util;
+			spare_cap = cpu_cap;
+			lsub_positive(&spare_cap, util);
 
 			/*
 			 * Skip CPUs that cannot satisfy the capacity request.
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 081/633] microblaze: fix kbuild redundant file warning
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (79 preceding siblings ...)
  2020-10-27 13:47 ` [PATCH 5.8 080/633] sched/fair: Fix wrong negative conversion in find_energy_efficient_cpu() Greg Kroah-Hartman
@ 2020-10-27 13:47 ` Greg Kroah-Hartman
  2020-10-27 13:47 ` [PATCH 5.8 082/633] EDAC/i5100: Fix error handling order in i5100_init_one() Greg Kroah-Hartman
                   ` (554 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Randy Dunlap, Michal Simek,
	Michal Simek, Masahiro Yamada, Sasha Levin

From: Randy Dunlap <rdunlap@infradead.org>

[ Upstream commit 4a17e8513376bb23f814d3e340a5692a12c69369 ]

Fix build warning since this file is already listed in
include/asm-generic/Kbuild.

../scripts/Makefile.asm-generic:25: redundant generic-y found in arch/microblaze/include/asm/Kbuild: hw_irq.h

Fixes: 630f289b7114 ("asm-generic: make more kernel-space headers mandatory")
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Cc: Michal Simek <monstr@monstr.eu>
Cc: Michal Simek <michal.simek@xilinx.com>
Cc: Masahiro Yamada <masahiroy@kernel.org>
Reviewed-by: Masahiro Yamada <masahiroy@kernel.org>
Link: https://lore.kernel.org/r/4d992aee-8a69-1769-e622-8d6d6e316346@infradead.org
Signed-off-by: Michal Simek <michal.simek@xilinx.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/microblaze/include/asm/Kbuild | 1 -
 1 file changed, 1 deletion(-)

diff --git a/arch/microblaze/include/asm/Kbuild b/arch/microblaze/include/asm/Kbuild
index 2e87a9b6d312f..63bce836b9f10 100644
--- a/arch/microblaze/include/asm/Kbuild
+++ b/arch/microblaze/include/asm/Kbuild
@@ -1,7 +1,6 @@
 # SPDX-License-Identifier: GPL-2.0
 generated-y += syscall_table.h
 generic-y += extable.h
-generic-y += hw_irq.h
 generic-y += kvm_para.h
 generic-y += local64.h
 generic-y += mcs_spinlock.h
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 082/633] EDAC/i5100: Fix error handling order in i5100_init_one()
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (80 preceding siblings ...)
  2020-10-27 13:47 ` [PATCH 5.8 081/633] microblaze: fix kbuild redundant file warning Greg Kroah-Hartman
@ 2020-10-27 13:47 ` Greg Kroah-Hartman
  2020-10-27 13:47 ` [PATCH 5.8 083/633] EDAC/aspeed: Fix handling of platform_get_irq() error Greg Kroah-Hartman
                   ` (553 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dinghao Liu, Borislav Petkov, Sasha Levin

From: Dinghao Liu <dinghao.liu@zju.edu.cn>

[ Upstream commit 857a3139bd8be4f702c030c8ca06f3fd69c1741a ]

When pci_get_device_func() fails, the driver doesn't need to execute
pci_dev_put(). mci should still be freed, though, to prevent a memory
leak. When pci_enable_device() fails, the error injection PCI device
"einj" doesn't need to be disabled either.

 [ bp: Massage commit message, rename label to "bail_mc_free". ]

Fixes: 52608ba205461 ("i5100_edac: probe for device 19 function 0")
Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
Signed-off-by: Borislav Petkov <bp@suse.de>
Link: https://lkml.kernel.org/r/20200826121437.31606-1-dinghao.liu@zju.edu.cn
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/edac/i5100_edac.c | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/drivers/edac/i5100_edac.c b/drivers/edac/i5100_edac.c
index 191aa7c19ded7..324a46b8479b0 100644
--- a/drivers/edac/i5100_edac.c
+++ b/drivers/edac/i5100_edac.c
@@ -1061,16 +1061,15 @@ static int i5100_init_one(struct pci_dev *pdev, const struct pci_device_id *id)
 				    PCI_DEVICE_ID_INTEL_5100_19, 0);
 	if (!einj) {
 		ret = -ENODEV;
-		goto bail_einj;
+		goto bail_mc_free;
 	}
 
 	rc = pci_enable_device(einj);
 	if (rc < 0) {
 		ret = rc;
-		goto bail_disable_einj;
+		goto bail_einj;
 	}
 
-
 	mci->pdev = &pdev->dev;
 
 	priv = mci->pvt_info;
@@ -1136,14 +1135,14 @@ static int i5100_init_one(struct pci_dev *pdev, const struct pci_device_id *id)
 bail_scrub:
 	priv->scrub_enable = 0;
 	cancel_delayed_work_sync(&(priv->i5100_scrubbing));
-	edac_mc_free(mci);
-
-bail_disable_einj:
 	pci_disable_device(einj);
 
 bail_einj:
 	pci_dev_put(einj);
 
+bail_mc_free:
+	edac_mc_free(mci);
+
 bail_disable_ch1:
 	pci_disable_device(ch1mm);
 
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 083/633] EDAC/aspeed: Fix handling of platform_get_irq() error
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (81 preceding siblings ...)
  2020-10-27 13:47 ` [PATCH 5.8 082/633] EDAC/i5100: Fix error handling order in i5100_init_one() Greg Kroah-Hartman
@ 2020-10-27 13:47 ` Greg Kroah-Hartman
  2020-10-27 13:47 ` [PATCH 5.8 084/633] EDAC/ti: " Greg Kroah-Hartman
                   ` (552 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Krzysztof Kozlowski, Borislav Petkov,
	Stefan Schaeckeler, Sasha Levin

From: Krzysztof Kozlowski <krzk@kernel.org>

[ Upstream commit afce6996943be265fa39240b67025cfcb1bcdfb1 ]

platform_get_irq() returns a negative error number on error. In such a
case, comparison to 0 would pass the check therefore check the return
value properly, whether it is negative.

 [ bp: Massage commit message. ]

Fixes: 9b7e6242ee4e ("EDAC, aspeed: Add an Aspeed AST2500 EDAC driver")
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Borislav Petkov <bp@suse.de>
Reviewed-by: Stefan Schaeckeler <schaecsn@gmx.net>
Link: https://lkml.kernel.org/r/20200827070743.26628-1-krzk@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/edac/aspeed_edac.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/edac/aspeed_edac.c b/drivers/edac/aspeed_edac.c
index b194658b8b5c9..fbec28dc661d7 100644
--- a/drivers/edac/aspeed_edac.c
+++ b/drivers/edac/aspeed_edac.c
@@ -209,8 +209,8 @@ static int config_irq(void *ctx, struct platform_device *pdev)
 	/* register interrupt handler */
 	irq = platform_get_irq(pdev, 0);
 	dev_dbg(&pdev->dev, "got irq %d\n", irq);
-	if (!irq)
-		return -ENODEV;
+	if (irq < 0)
+		return irq;
 
 	rc = devm_request_irq(&pdev->dev, irq, mcr_isr, IRQF_TRIGGER_HIGH,
 			      DRV_NAME, ctx);
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 084/633] EDAC/ti: Fix handling of platform_get_irq() error
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (82 preceding siblings ...)
  2020-10-27 13:47 ` [PATCH 5.8 083/633] EDAC/aspeed: Fix handling of platform_get_irq() error Greg Kroah-Hartman
@ 2020-10-27 13:47 ` Greg Kroah-Hartman
  2020-10-27 13:47 ` [PATCH 5.8 085/633] perf/x86/intel/ds: Fix x86_pmu_stop warning for large PEBS Greg Kroah-Hartman
                   ` (551 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Krzysztof Kozlowski, Borislav Petkov,
	Tero Kristo, Sasha Levin

From: Krzysztof Kozlowski <krzk@kernel.org>

[ Upstream commit 66077adb70a2a9e92540155b2ace33ec98299c90 ]

platform_get_irq() returns a negative error number on error. In such a
case, comparison to 0 would pass the check therefore check the return
value properly, whether it is negative.

 [ bp: Massage commit message. ]

Fixes: 86a18ee21e5e ("EDAC, ti: Add support for TI keystone and DRA7xx EDAC")
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Borislav Petkov <bp@suse.de>
Reviewed-by: Tero Kristo <t-kristo@ti.com>
Link: https://lkml.kernel.org/r/20200827070743.26628-2-krzk@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/edac/ti_edac.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/edac/ti_edac.c b/drivers/edac/ti_edac.c
index 8be3e89a510e4..d7419a90a2f5b 100644
--- a/drivers/edac/ti_edac.c
+++ b/drivers/edac/ti_edac.c
@@ -278,7 +278,8 @@ static int ti_edac_probe(struct platform_device *pdev)
 
 	/* add EMIF ECC error handler */
 	error_irq = platform_get_irq(pdev, 0);
-	if (!error_irq) {
+	if (error_irq < 0) {
+		ret = error_irq;
 		edac_printk(KERN_ERR, EDAC_MOD_NAME,
 			    "EMIF irq number not defined.\n");
 		goto err;
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 085/633] perf/x86/intel/ds: Fix x86_pmu_stop warning for large PEBS
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (83 preceding siblings ...)
  2020-10-27 13:47 ` [PATCH 5.8 084/633] EDAC/ti: " Greg Kroah-Hartman
@ 2020-10-27 13:47 ` Greg Kroah-Hartman
  2020-10-27 13:47 ` [PATCH 5.8 086/633] x86/fpu: Allow multiple bits in clearcpuid= parameter Greg Kroah-Hartman
                   ` (550 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Like Xu, Peter Zijlstra (Intel),
	Kan Liang, Sasha Levin

From: Kan Liang <kan.liang@linux.intel.com>

[ Upstream commit 35d1ce6bec133679ff16325d335217f108b84871 ]

A warning as below may be triggered when sampling with large PEBS.

[  410.411250] perf: interrupt took too long (72145 > 71975), lowering
kernel.perf_event_max_sample_rate to 2000
[  410.724923] ------------[ cut here ]------------
[  410.729822] WARNING: CPU: 0 PID: 16397 at arch/x86/events/core.c:1422
x86_pmu_stop+0x95/0xa0
[  410.933811]  x86_pmu_del+0x50/0x150
[  410.937304]  event_sched_out.isra.0+0xbc/0x210
[  410.941751]  group_sched_out.part.0+0x53/0xd0
[  410.946111]  ctx_sched_out+0x193/0x270
[  410.949862]  __perf_event_task_sched_out+0x32c/0x890
[  410.954827]  ? set_next_entity+0x98/0x2d0
[  410.958841]  __schedule+0x592/0x9c0
[  410.962332]  schedule+0x5f/0xd0
[  410.965477]  exit_to_usermode_loop+0x73/0x120
[  410.969837]  prepare_exit_to_usermode+0xcd/0xf0
[  410.974369]  ret_from_intr+0x2a/0x3a
[  410.977946] RIP: 0033:0x40123c
[  411.079661] ---[ end trace bc83adaea7bb664a ]---

In the non-overflow context, e.g., context switch, with large PEBS, perf
may stop an event twice. An example is below.

  //max_samples_per_tick is adjusted to 2
  //NMI is triggered
  intel_pmu_handle_irq()
     handle_pmi_common()
       drain_pebs()
         __intel_pmu_pebs_event()
           perf_event_overflow()
             __perf_event_account_interrupt()
               hwc->interrupts = 1
               return 0
  //A context switch happens right after the NMI.
  //In the same tick, the perf_throttled_seq is not changed.
  perf_event_task_sched_out()
     perf_pmu_sched_task()
       intel_pmu_drain_pebs_buffer()
         __intel_pmu_pebs_event()
           perf_event_overflow()
             __perf_event_account_interrupt()
               ++hwc->interrupts >= max_samples_per_tick
               return 1
           x86_pmu_stop();  # First stop
     perf_event_context_sched_out()
       task_ctx_sched_out()
         ctx_sched_out()
           event_sched_out()
             x86_pmu_del()
               x86_pmu_stop();  # Second stop and trigger the warning

Perf should only invoke the perf_event_overflow() in the overflow
context.

Current drain_pebs() is called from:
- handle_pmi_common()			-- overflow context
- intel_pmu_pebs_sched_task()		-- non-overflow context
- intel_pmu_pebs_disable()		-- non-overflow context
- intel_pmu_auto_reload_read()		-- possible overflow context
  With PERF_SAMPLE_READ + PERF_FORMAT_GROUP, the function may be
  invoked in the NMI handler. But, before calling the function, the
  PEBS buffer has already been drained. The __intel_pmu_pebs_event()
  will not be called in the possible overflow context.

To fix the issue, an indicator is required to distinguish between the
overflow context aka handle_pmi_common() and other cases.
The dummy regs pointer can be used as the indicator.

In the non-overflow context, perf should treat the last record the same
as other PEBS records, and doesn't invoke the generic overflow handler.

Fixes: 21509084f999 ("perf/x86/intel: Handle multiple records in the PEBS buffer")
Reported-by: Like Xu <like.xu@linux.intel.com>
Suggested-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Kan Liang <kan.liang@linux.intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Tested-by: Like Xu <like.xu@linux.intel.com>
Link: https://lkml.kernel.org/r/20200902210649.2743-1-kan.liang@linux.intel.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/events/intel/ds.c | 32 ++++++++++++++++++++------------
 1 file changed, 20 insertions(+), 12 deletions(-)

diff --git a/arch/x86/events/intel/ds.c b/arch/x86/events/intel/ds.c
index dc43cc124e096..221d1766d6e6c 100644
--- a/arch/x86/events/intel/ds.c
+++ b/arch/x86/events/intel/ds.c
@@ -670,9 +670,7 @@ int intel_pmu_drain_bts_buffer(void)
 
 static inline void intel_pmu_drain_pebs_buffer(void)
 {
-	struct pt_regs regs;
-
-	x86_pmu.drain_pebs(&regs);
+	x86_pmu.drain_pebs(NULL);
 }
 
 /*
@@ -1737,6 +1735,7 @@ static void __intel_pmu_pebs_event(struct perf_event *event,
 	struct x86_perf_regs perf_regs;
 	struct pt_regs *regs = &perf_regs.regs;
 	void *at = get_next_pebs_record_by_bit(base, top, bit);
+	struct pt_regs dummy_iregs;
 
 	if (hwc->flags & PERF_X86_EVENT_AUTO_RELOAD) {
 		/*
@@ -1749,6 +1748,9 @@ static void __intel_pmu_pebs_event(struct perf_event *event,
 	} else if (!intel_pmu_save_and_restart(event))
 		return;
 
+	if (!iregs)
+		iregs = &dummy_iregs;
+
 	while (count > 1) {
 		setup_sample(event, iregs, at, &data, regs);
 		perf_event_output(event, &data, regs);
@@ -1758,16 +1760,22 @@ static void __intel_pmu_pebs_event(struct perf_event *event,
 	}
 
 	setup_sample(event, iregs, at, &data, regs);
-
-	/*
-	 * All but the last records are processed.
-	 * The last one is left to be able to call the overflow handler.
-	 */
-	if (perf_event_overflow(event, &data, regs)) {
-		x86_pmu_stop(event, 0);
-		return;
+	if (iregs == &dummy_iregs) {
+		/*
+		 * The PEBS records may be drained in the non-overflow context,
+		 * e.g., large PEBS + context switch. Perf should treat the
+		 * last record the same as other PEBS records, and doesn't
+		 * invoke the generic overflow handler.
+		 */
+		perf_event_output(event, &data, regs);
+	} else {
+		/*
+		 * All but the last records are processed.
+		 * The last one is left to be able to call the overflow handler.
+		 */
+		if (perf_event_overflow(event, &data, regs))
+			x86_pmu_stop(event, 0);
 	}
-
 }
 
 static void intel_pmu_drain_pebs_core(struct pt_regs *iregs)
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 086/633] x86/fpu: Allow multiple bits in clearcpuid= parameter
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (84 preceding siblings ...)
  2020-10-27 13:47 ` [PATCH 5.8 085/633] perf/x86/intel/ds: Fix x86_pmu_stop warning for large PEBS Greg Kroah-Hartman
@ 2020-10-27 13:47 ` Greg Kroah-Hartman
  2020-10-27 13:47 ` [PATCH 5.8 087/633] arm64: kprobe: add checks for ARMv8.3-PAuth combined instructions Greg Kroah-Hartman
                   ` (549 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Arvind Sankar, Borislav Petkov, Sasha Levin

From: Arvind Sankar <nivedita@alum.mit.edu>

[ Upstream commit 0a4bb5e5507a585532cc413125b921c8546fc39f ]

Commit

  0c2a3913d6f5 ("x86/fpu: Parse clearcpuid= as early XSAVE argument")

changed clearcpuid parsing from __setup() to cmdline_find_option().
While the __setup() function would have been called for each clearcpuid=
parameter on the command line, cmdline_find_option() will only return
the last one, so the change effectively made it impossible to disable
more than one bit.

Allow a comma-separated list of bit numbers as the argument for
clearcpuid to allow multiple bits to be disabled again. Log the bits
being disabled for informational purposes.

Also fix the check on the return value of cmdline_find_option(). It
returns -1 when the option is not found, so testing as a boolean is
incorrect.

Fixes: 0c2a3913d6f5 ("x86/fpu: Parse clearcpuid= as early XSAVE argument")
Signed-off-by: Arvind Sankar <nivedita@alum.mit.edu>
Signed-off-by: Borislav Petkov <bp@suse.de>
Link: https://lkml.kernel.org/r/20200907213919.2423441-1-nivedita@alum.mit.edu
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../admin-guide/kernel-parameters.txt         |  2 +-
 arch/x86/kernel/fpu/init.c                    | 30 ++++++++++++++-----
 2 files changed, 23 insertions(+), 9 deletions(-)

diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
index fb95fad81c79a..6746f91ebc490 100644
--- a/Documentation/admin-guide/kernel-parameters.txt
+++ b/Documentation/admin-guide/kernel-parameters.txt
@@ -577,7 +577,7 @@
 			loops can be debugged more effectively on production
 			systems.
 
-	clearcpuid=BITNUM [X86]
+	clearcpuid=BITNUM[,BITNUM...] [X86]
 			Disable CPUID feature X for the kernel. See
 			arch/x86/include/asm/cpufeatures.h for the valid bit
 			numbers. Note the Linux specific bits are not necessarily
diff --git a/arch/x86/kernel/fpu/init.c b/arch/x86/kernel/fpu/init.c
index 61ddc3a5e5c2b..f8ff895aaf7e1 100644
--- a/arch/x86/kernel/fpu/init.c
+++ b/arch/x86/kernel/fpu/init.c
@@ -243,9 +243,9 @@ static void __init fpu__init_system_ctx_switch(void)
  */
 static void __init fpu__init_parse_early_param(void)
 {
-	char arg[32];
+	char arg[128];
 	char *argptr = arg;
-	int bit;
+	int arglen, res, bit;
 
 #ifdef CONFIG_X86_32
 	if (cmdline_find_option_bool(boot_command_line, "no387"))
@@ -268,12 +268,26 @@ static void __init fpu__init_parse_early_param(void)
 	if (cmdline_find_option_bool(boot_command_line, "noxsaves"))
 		setup_clear_cpu_cap(X86_FEATURE_XSAVES);
 
-	if (cmdline_find_option(boot_command_line, "clearcpuid", arg,
-				sizeof(arg)) &&
-	    get_option(&argptr, &bit) &&
-	    bit >= 0 &&
-	    bit < NCAPINTS * 32)
-		setup_clear_cpu_cap(bit);
+	arglen = cmdline_find_option(boot_command_line, "clearcpuid", arg, sizeof(arg));
+	if (arglen <= 0)
+		return;
+
+	pr_info("Clearing CPUID bits:");
+	do {
+		res = get_option(&argptr, &bit);
+		if (res == 0 || res == 3)
+			break;
+
+		/* If the argument was too long, the last bit may be cut off */
+		if (res == 1 && arglen >= sizeof(arg))
+			break;
+
+		if (bit >= 0 && bit < NCAPINTS * 32) {
+			pr_cont(" " X86_CAP_FMT, x86_cap_flag(bit));
+			setup_clear_cpu_cap(bit);
+		}
+	} while (res == 2);
+	pr_cont("\n");
 }
 
 /*
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 087/633] arm64: kprobe: add checks for ARMv8.3-PAuth combined instructions
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (85 preceding siblings ...)
  2020-10-27 13:47 ` [PATCH 5.8 086/633] x86/fpu: Allow multiple bits in clearcpuid= parameter Greg Kroah-Hartman
@ 2020-10-27 13:47 ` Greg Kroah-Hartman
  2020-10-27 13:47 ` [PATCH 5.8 088/633] drivers/perf: xgene_pmu: Fix uninitialized resource struct Greg Kroah-Hartman
                   ` (548 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Amit Daniel Kachhap, Dave Martin,
	Will Deacon, Sasha Levin

From: Amit Daniel Kachhap <amit.kachhap@arm.com>

[ Upstream commit 93396936ed0ce2c6f44140bd14728611d0bb065e ]

Currently the ARMv8.3-PAuth combined branch instructions (braa, retaa
etc.) are not simulated for out-of-line execution with a handler. Hence the
uprobe of such instructions leads to kernel warnings in a loop as they are
not explicitly checked and fall into INSN_GOOD categories. Other combined
instructions like LDRAA and LDRBB can be probed.

The issue of the combined branch instructions is fixed by adding
group definitions of all such instructions and rejecting their probes.
The instruction groups added are br_auth(braa, brab, braaz and brabz),
blr_auth(blraa, blrab, blraaz and blrabz), ret_auth(retaa and retab) and
eret_auth(eretaa and eretab).

Warning log:
 WARNING: CPU: 0 PID: 156 at arch/arm64/kernel/probes/uprobes.c:182 uprobe_single_step_handler+0x34/0x50
 Modules linked in:
 CPU: 0 PID: 156 Comm: func Not tainted 5.9.0-rc3 #188
 Hardware name: Foundation-v8A (DT)
 pstate: 804003c9 (Nzcv DAIF +PAN -UAO BTYPE=--)
 pc : uprobe_single_step_handler+0x34/0x50
 lr : single_step_handler+0x70/0xf8
 sp : ffff800012af3e30
 x29: ffff800012af3e30 x28: ffff000878723b00
 x27: 0000000000000000 x26: 0000000000000000
 x25: 0000000000000000 x24: 0000000000000000
 x23: 0000000060001000 x22: 00000000cb000022
 x21: ffff800012065ce8 x20: ffff800012af3ec0
 x19: ffff800012068d50 x18: 0000000000000000
 x17: 0000000000000000 x16: 0000000000000000
 x15: 0000000000000000 x14: 0000000000000000
 x13: 0000000000000000 x12: 0000000000000000
 x11: 0000000000000000 x10: 0000000000000000
 x9 : ffff800010085c90 x8 : 0000000000000000
 x7 : 0000000000000000 x6 : ffff80001205a9c8
 x5 : ffff80001205a000 x4 : ffff80001233db80
 x3 : ffff8000100a7a60 x2 : 0020000000000003
 x1 : 0000fffffffff008 x0 : ffff800012af3ec0
 Call trace:
  uprobe_single_step_handler+0x34/0x50
  single_step_handler+0x70/0xf8
  do_debug_exception+0xb8/0x130
  el0_sync_handler+0x138/0x1b8
  el0_sync+0x158/0x180

Fixes: 74afda4016a7 ("arm64: compile the kernel with ptrauth return address signing")
Fixes: 04ca3204fa09 ("arm64: enable pointer authentication")
Signed-off-by: Amit Daniel Kachhap <amit.kachhap@arm.com>
Reviewed-by: Dave Martin <Dave.Martin@arm.com>
Link: https://lore.kernel.org/r/20200914083656.21428-2-amit.kachhap@arm.com
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/include/asm/insn.h          | 4 ++++
 arch/arm64/kernel/insn.c               | 5 ++++-
 arch/arm64/kernel/probes/decode-insn.c | 3 ++-
 3 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/arch/arm64/include/asm/insn.h b/arch/arm64/include/asm/insn.h
index 0bc46149e4917..4b39293d0f72d 100644
--- a/arch/arm64/include/asm/insn.h
+++ b/arch/arm64/include/asm/insn.h
@@ -359,9 +359,13 @@ __AARCH64_INSN_FUNCS(brk,	0xFFE0001F, 0xD4200000)
 __AARCH64_INSN_FUNCS(exception,	0xFF000000, 0xD4000000)
 __AARCH64_INSN_FUNCS(hint,	0xFFFFF01F, 0xD503201F)
 __AARCH64_INSN_FUNCS(br,	0xFFFFFC1F, 0xD61F0000)
+__AARCH64_INSN_FUNCS(br_auth,	0xFEFFF800, 0xD61F0800)
 __AARCH64_INSN_FUNCS(blr,	0xFFFFFC1F, 0xD63F0000)
+__AARCH64_INSN_FUNCS(blr_auth,	0xFEFFF800, 0xD63F0800)
 __AARCH64_INSN_FUNCS(ret,	0xFFFFFC1F, 0xD65F0000)
+__AARCH64_INSN_FUNCS(ret_auth,	0xFFFFFBFF, 0xD65F0BFF)
 __AARCH64_INSN_FUNCS(eret,	0xFFFFFFFF, 0xD69F03E0)
+__AARCH64_INSN_FUNCS(eret_auth,	0xFFFFFBFF, 0xD69F0BFF)
 __AARCH64_INSN_FUNCS(mrs,	0xFFF00000, 0xD5300000)
 __AARCH64_INSN_FUNCS(msr_imm,	0xFFF8F01F, 0xD500401F)
 __AARCH64_INSN_FUNCS(msr_reg,	0xFFF00000, 0xD5100000)
diff --git a/arch/arm64/kernel/insn.c b/arch/arm64/kernel/insn.c
index a107375005bc9..ccc8c9e22b258 100644
--- a/arch/arm64/kernel/insn.c
+++ b/arch/arm64/kernel/insn.c
@@ -176,7 +176,7 @@ bool __kprobes aarch64_insn_uses_literal(u32 insn)
 
 bool __kprobes aarch64_insn_is_branch(u32 insn)
 {
-	/* b, bl, cb*, tb*, b.cond, br, blr */
+	/* b, bl, cb*, tb*, ret*, b.cond, br*, blr* */
 
 	return aarch64_insn_is_b(insn) ||
 		aarch64_insn_is_bl(insn) ||
@@ -185,8 +185,11 @@ bool __kprobes aarch64_insn_is_branch(u32 insn)
 		aarch64_insn_is_tbz(insn) ||
 		aarch64_insn_is_tbnz(insn) ||
 		aarch64_insn_is_ret(insn) ||
+		aarch64_insn_is_ret_auth(insn) ||
 		aarch64_insn_is_br(insn) ||
+		aarch64_insn_is_br_auth(insn) ||
 		aarch64_insn_is_blr(insn) ||
+		aarch64_insn_is_blr_auth(insn) ||
 		aarch64_insn_is_bcond(insn);
 }
 
diff --git a/arch/arm64/kernel/probes/decode-insn.c b/arch/arm64/kernel/probes/decode-insn.c
index 263d5fba4c8a3..c541fb48886e3 100644
--- a/arch/arm64/kernel/probes/decode-insn.c
+++ b/arch/arm64/kernel/probes/decode-insn.c
@@ -29,7 +29,8 @@ static bool __kprobes aarch64_insn_is_steppable(u32 insn)
 		    aarch64_insn_is_msr_imm(insn) ||
 		    aarch64_insn_is_msr_reg(insn) ||
 		    aarch64_insn_is_exception(insn) ||
-		    aarch64_insn_is_eret(insn))
+		    aarch64_insn_is_eret(insn) ||
+		    aarch64_insn_is_eret_auth(insn))
 			return false;
 
 		/*
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 088/633] drivers/perf: xgene_pmu: Fix uninitialized resource struct
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (86 preceding siblings ...)
  2020-10-27 13:47 ` [PATCH 5.8 087/633] arm64: kprobe: add checks for ARMv8.3-PAuth combined instructions Greg Kroah-Hartman
@ 2020-10-27 13:47 ` Greg Kroah-Hartman
  2020-10-27 13:47 ` [PATCH 5.8 089/633] drivers/perf: thunderx2_pmu: Fix memory resource error handling Greg Kroah-Hartman
                   ` (547 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Mark Salter, Will Deacon, Sasha Levin

From: Mark Salter <msalter@redhat.com>

[ Upstream commit a76b8236edcf5b785d044b930f9e14ad02b4a484 ]

This splat was reported on newer Fedora kernels booting on certain
X-gene based machines:

 xgene-pmu APMC0D83:00: X-Gene PMU version 3
 Unable to handle kernel read from unreadable memory at virtual \
 address 0000000000004006
 ...
 Call trace:
  string+0x50/0x100
  vsnprintf+0x160/0x750
  devm_kvasprintf+0x5c/0xb4
  devm_kasprintf+0x54/0x60
  __devm_ioremap_resource+0xdc/0x1a0
  devm_ioremap_resource+0x14/0x20
  acpi_get_pmu_hw_inf.isra.0+0x84/0x15c
  acpi_pmu_dev_add+0xbc/0x21c
  acpi_ns_walk_namespace+0x16c/0x1e4
  acpi_walk_namespace+0xb4/0xfc
  xgene_pmu_probe_pmu_dev+0x7c/0xe0
  xgene_pmu_probe.part.0+0x2c0/0x310
  xgene_pmu_probe+0x54/0x64
  platform_drv_probe+0x60/0xb4
  really_probe+0xe8/0x4a0
  driver_probe_device+0xe4/0x100
  device_driver_attach+0xcc/0xd4
  __driver_attach+0xb0/0x17c
  bus_for_each_dev+0x6c/0xb0
  driver_attach+0x30/0x40
  bus_add_driver+0x154/0x250
  driver_register+0x84/0x140
  __platform_driver_register+0x54/0x60
  xgene_pmu_driver_init+0x28/0x34
  do_one_initcall+0x40/0x204
  do_initcalls+0x104/0x144
  kernel_init_freeable+0x198/0x210
  kernel_init+0x20/0x12c
  ret_from_fork+0x10/0x18
 Code: 91000400 110004e1 eb08009f 540000c0 (38646846)
 ---[ end trace f08c10566496a703 ]---

This is due to use of an uninitialized local resource struct in the xgene
pmu driver. The thunderx2_pmu driver avoids this by using the resource list
constructed by acpi_dev_get_resources() rather than using a callback from
that function. The callback in the xgene driver didn't fully initialize
the resource. So get rid of the callback and search the resource list as
done by thunderx2.

Fixes: 832c927d119b ("perf: xgene: Add APM X-Gene SoC Performance Monitoring Unit driver")
Signed-off-by: Mark Salter <msalter@redhat.com>
Link: https://lore.kernel.org/r/20200915204110.326138-1-msalter@redhat.com
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/perf/xgene_pmu.c | 32 +++++++++++++++++---------------
 1 file changed, 17 insertions(+), 15 deletions(-)

diff --git a/drivers/perf/xgene_pmu.c b/drivers/perf/xgene_pmu.c
index edac28cd25ddc..633cf07ba6723 100644
--- a/drivers/perf/xgene_pmu.c
+++ b/drivers/perf/xgene_pmu.c
@@ -1453,17 +1453,6 @@ static char *xgene_pmu_dev_name(struct device *dev, u32 type, int id)
 }
 
 #if defined(CONFIG_ACPI)
-static int acpi_pmu_dev_add_resource(struct acpi_resource *ares, void *data)
-{
-	struct resource *res = data;
-
-	if (ares->type == ACPI_RESOURCE_TYPE_FIXED_MEMORY32)
-		acpi_dev_resource_memory(ares, res);
-
-	/* Always tell the ACPI core to skip this resource */
-	return 1;
-}
-
 static struct
 xgene_pmu_dev_ctx *acpi_get_pmu_hw_inf(struct xgene_pmu *xgene_pmu,
 				       struct acpi_device *adev, u32 type)
@@ -1475,6 +1464,7 @@ xgene_pmu_dev_ctx *acpi_get_pmu_hw_inf(struct xgene_pmu *xgene_pmu,
 	struct hw_pmu_info *inf;
 	void __iomem *dev_csr;
 	struct resource res;
+	struct resource_entry *rentry;
 	int enable_bit;
 	int rc;
 
@@ -1483,11 +1473,23 @@ xgene_pmu_dev_ctx *acpi_get_pmu_hw_inf(struct xgene_pmu *xgene_pmu,
 		return NULL;
 
 	INIT_LIST_HEAD(&resource_list);
-	rc = acpi_dev_get_resources(adev, &resource_list,
-				    acpi_pmu_dev_add_resource, &res);
+	rc = acpi_dev_get_resources(adev, &resource_list, NULL, NULL);
+	if (rc <= 0) {
+		dev_err(dev, "PMU type %d: No resources found\n", type);
+		return NULL;
+	}
+
+	list_for_each_entry(rentry, &resource_list, node) {
+		if (resource_type(rentry->res) == IORESOURCE_MEM) {
+			res = *rentry->res;
+			rentry = NULL;
+			break;
+		}
+	}
 	acpi_dev_free_resource_list(&resource_list);
-	if (rc < 0) {
-		dev_err(dev, "PMU type %d: No resource address found\n", type);
+
+	if (rentry) {
+		dev_err(dev, "PMU type %d: No memory resource found\n", type);
 		return NULL;
 	}
 
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 089/633] drivers/perf: thunderx2_pmu: Fix memory resource error handling
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (87 preceding siblings ...)
  2020-10-27 13:47 ` [PATCH 5.8 088/633] drivers/perf: xgene_pmu: Fix uninitialized resource struct Greg Kroah-Hartman
@ 2020-10-27 13:47 ` Greg Kroah-Hartman
  2020-10-27 13:47 ` [PATCH 5.8 090/633] sched/fair: Fix wrong cpu selecting from isolated domain Greg Kroah-Hartman
                   ` (546 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Mark Salter, Will Deacon, Sasha Levin

From: Mark Salter <msalter@redhat.com>

[ Upstream commit 688494a407d1419a6b158c644b262c61cde39f48 ]

In tx2_uncore_pmu_init_dev(), a call to acpi_dev_get_resources() is used
to create a list _CRS resources which is searched for the device base
address. There is an error check following this:

   if (!rentry->res)
           return NULL

In no case, will rentry->res be NULL, so the test is useless. Even
if the test worked, it comes before the resource list memory is
freed. None of this really matters as long as the ACPI table has
the memory resource. Let's clean it up so that it makes sense and
will give a meaningful error should firmware leave out the memory
resource.

Fixes: 69c32972d593 ("drivers/perf: Add Cavium ThunderX2 SoC UNCORE PMU driver")
Signed-off-by: Mark Salter <msalter@redhat.com>
Link: https://lore.kernel.org/r/20200915204110.326138-2-msalter@redhat.com
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/perf/thunderx2_pmu.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/perf/thunderx2_pmu.c b/drivers/perf/thunderx2_pmu.c
index aac9823b0c6bb..e116815fa8092 100644
--- a/drivers/perf/thunderx2_pmu.c
+++ b/drivers/perf/thunderx2_pmu.c
@@ -805,14 +805,17 @@ static struct tx2_uncore_pmu *tx2_uncore_pmu_init_dev(struct device *dev,
 	list_for_each_entry(rentry, &list, node) {
 		if (resource_type(rentry->res) == IORESOURCE_MEM) {
 			res = *rentry->res;
+			rentry = NULL;
 			break;
 		}
 	}
+	acpi_dev_free_resource_list(&list);
 
-	if (!rentry->res)
+	if (rentry) {
+		dev_err(dev, "PMU type %d: Fail to find resource\n", type);
 		return NULL;
+	}
 
-	acpi_dev_free_resource_list(&list);
 	base = devm_ioremap_resource(dev, &res);
 	if (IS_ERR(base)) {
 		dev_err(dev, "PMU type %d: Fail to map resource\n", type);
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 090/633] sched/fair: Fix wrong cpu selecting from isolated domain
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (88 preceding siblings ...)
  2020-10-27 13:47 ` [PATCH 5.8 089/633] drivers/perf: thunderx2_pmu: Fix memory resource error handling Greg Kroah-Hartman
@ 2020-10-27 13:47 ` Greg Kroah-Hartman
  2020-10-27 13:47 ` [PATCH 5.8 091/633] sched/fair: Use dst group while checking imbalance for NUMA balancer Greg Kroah-Hartman
                   ` (545 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Wetp Zhang, Xunlei Pang,
	Peter Zijlstra (Intel),
	Jiang Biao, Vincent Guittot, Sasha Levin

From: Xunlei Pang <xlpang@linux.alibaba.com>

[ Upstream commit df3cb4ea1fb63ff326488efd671ba3c39034255e ]

We've met problems that occasionally tasks with full cpumask
(e.g. by putting it into a cpuset or setting to full affinity)
were migrated to our isolated cpus in production environment.

After some analysis, we found that it is due to the current
select_idle_smt() not considering the sched_domain mask.

Steps to reproduce on my 31-CPU hyperthreads machine:
1. with boot parameter: "isolcpus=domain,2-31"
   (thread lists: 0,16 and 1,17)
2. cgcreate -g cpu:test; cgexec -g cpu:test "test_threads"
3. some threads will be migrated to the isolated cpu16~17.

Fix it by checking the valid domain mask in select_idle_smt().

Fixes: 10e2f1acd010 ("sched/core: Rewrite and improve select_idle_siblings())
Reported-by: Wetp Zhang <wetp.zy@linux.alibaba.com>
Signed-off-by: Xunlei Pang <xlpang@linux.alibaba.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Jiang Biao <benbjiang@tencent.com>
Reviewed-by: Vincent Guittot <vincent.guittot@linaro.org>
Link: https://lkml.kernel.org/r/1600930127-76857-1-git-send-email-xlpang@linux.alibaba.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/sched/fair.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index f71e8b0e0346a..60c5a80f325b6 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -6067,7 +6067,7 @@ static int select_idle_core(struct task_struct *p, struct sched_domain *sd, int
 /*
  * Scan the local SMT mask for idle CPUs.
  */
-static int select_idle_smt(struct task_struct *p, int target)
+static int select_idle_smt(struct task_struct *p, struct sched_domain *sd, int target)
 {
 	int cpu;
 
@@ -6075,7 +6075,8 @@ static int select_idle_smt(struct task_struct *p, int target)
 		return -1;
 
 	for_each_cpu(cpu, cpu_smt_mask(target)) {
-		if (!cpumask_test_cpu(cpu, p->cpus_ptr))
+		if (!cpumask_test_cpu(cpu, p->cpus_ptr) ||
+		    !cpumask_test_cpu(cpu, sched_domain_span(sd)))
 			continue;
 		if (available_idle_cpu(cpu) || sched_idle_cpu(cpu))
 			return cpu;
@@ -6091,7 +6092,7 @@ static inline int select_idle_core(struct task_struct *p, struct sched_domain *s
 	return -1;
 }
 
-static inline int select_idle_smt(struct task_struct *p, int target)
+static inline int select_idle_smt(struct task_struct *p, struct sched_domain *sd, int target)
 {
 	return -1;
 }
@@ -6266,7 +6267,7 @@ static int select_idle_sibling(struct task_struct *p, int prev, int target)
 	if ((unsigned)i < nr_cpumask_bits)
 		return i;
 
-	i = select_idle_smt(p, target);
+	i = select_idle_smt(p, sd, target);
 	if ((unsigned)i < nr_cpumask_bits)
 		return i;
 
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 091/633] sched/fair: Use dst group while checking imbalance for NUMA balancer
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (89 preceding siblings ...)
  2020-10-27 13:47 ` [PATCH 5.8 090/633] sched/fair: Fix wrong cpu selecting from isolated domain Greg Kroah-Hartman
@ 2020-10-27 13:47 ` Greg Kroah-Hartman
  2020-10-27 13:47 ` [PATCH 5.8 092/633] arm64: perf: Add missing ISB in armv8pmu_enable_counter() Greg Kroah-Hartman
                   ` (544 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Barry Song, Mel Gorman,
	Peter Zijlstra (Intel),
	Sasha Levin

From: Barry Song <song.bao.hua@hisilicon.com>

[ Upstream commit 233e7aca4c8a2c764f556bba9644c36154017e7f ]

Barry Song noted the following

	Something is wrong. In find_busiest_group(), we are checking if
	src has higher load, however, in task_numa_find_cpu(), we are
	checking if dst will have higher load after balancing. It seems
	it is not sensible to check src.

	It maybe cause wrong imbalance value, for example,

	if dst_running = env->dst_stats.nr_running + 1 results in 3 or
	above, and src_running = env->src_stats.nr_running - 1 results
	in 1;

	The current code is thinking imbalance as 0 since src_running is
	smaller than 2.  This is inconsistent with load balancer.

Basically, in find_busiest_group(), the NUMA imbalance is ignored if moving
a task "from an almost idle domain" to a "domain with spare capacity". This
patch forbids movement "from a misplaced domain" to "an almost idle domain"
as that is closer to what the CPU load balancer expects.

This patch is not a universal win. The old behaviour was intended to allow
a task from an almost idle NUMA node to migrate to its preferred node if
the destination had capacity but there are corner cases.  For example,
a NAS compute load could be parallelised to use 1/3rd of available CPUs
but not all those potential tasks are active at all times allowing this
logic to trigger. An obvious example is specjbb 2005 running various
numbers of warehouses on a 2 socket box with 80 cpus.

specjbb
                               5.9.0-rc4              5.9.0-rc4
                                 vanilla        dstbalance-v1r1
Hmean     tput-1     46425.00 (   0.00%)    43394.00 *  -6.53%*
Hmean     tput-2     98416.00 (   0.00%)    96031.00 *  -2.42%*
Hmean     tput-3    150184.00 (   0.00%)   148783.00 *  -0.93%*
Hmean     tput-4    200683.00 (   0.00%)   197906.00 *  -1.38%*
Hmean     tput-5    236305.00 (   0.00%)   245549.00 *   3.91%*
Hmean     tput-6    281559.00 (   0.00%)   285692.00 *   1.47%*
Hmean     tput-7    338558.00 (   0.00%)   334467.00 *  -1.21%*
Hmean     tput-8    340745.00 (   0.00%)   372501.00 *   9.32%*
Hmean     tput-9    424343.00 (   0.00%)   413006.00 *  -2.67%*
Hmean     tput-10   421854.00 (   0.00%)   434261.00 *   2.94%*
Hmean     tput-11   493256.00 (   0.00%)   485330.00 *  -1.61%*
Hmean     tput-12   549573.00 (   0.00%)   529959.00 *  -3.57%*
Hmean     tput-13   593183.00 (   0.00%)   555010.00 *  -6.44%*
Hmean     tput-14   588252.00 (   0.00%)   599166.00 *   1.86%*
Hmean     tput-15   623065.00 (   0.00%)   642713.00 *   3.15%*
Hmean     tput-16   703924.00 (   0.00%)   660758.00 *  -6.13%*
Hmean     tput-17   666023.00 (   0.00%)   697675.00 *   4.75%*
Hmean     tput-18   761502.00 (   0.00%)   758360.00 *  -0.41%*
Hmean     tput-19   796088.00 (   0.00%)   798368.00 *   0.29%*
Hmean     tput-20   733564.00 (   0.00%)   823086.00 *  12.20%*
Hmean     tput-21   840980.00 (   0.00%)   856711.00 *   1.87%*
Hmean     tput-22   804285.00 (   0.00%)   872238.00 *   8.45%*
Hmean     tput-23   795208.00 (   0.00%)   889374.00 *  11.84%*
Hmean     tput-24   848619.00 (   0.00%)   966783.00 *  13.92%*
Hmean     tput-25   750848.00 (   0.00%)   903790.00 *  20.37%*
Hmean     tput-26   780523.00 (   0.00%)   962254.00 *  23.28%*
Hmean     tput-27  1042245.00 (   0.00%)   991544.00 *  -4.86%*
Hmean     tput-28  1090580.00 (   0.00%)  1035926.00 *  -5.01%*
Hmean     tput-29   999483.00 (   0.00%)  1082948.00 *   8.35%*
Hmean     tput-30  1098663.00 (   0.00%)  1113427.00 *   1.34%*
Hmean     tput-31  1125671.00 (   0.00%)  1134175.00 *   0.76%*
Hmean     tput-32   968167.00 (   0.00%)  1250286.00 *  29.14%*
Hmean     tput-33  1077676.00 (   0.00%)  1060893.00 *  -1.56%*
Hmean     tput-34  1090538.00 (   0.00%)  1090933.00 *   0.04%*
Hmean     tput-35   967058.00 (   0.00%)  1107421.00 *  14.51%*
Hmean     tput-36  1051745.00 (   0.00%)  1210663.00 *  15.11%*
Hmean     tput-37  1019465.00 (   0.00%)  1351446.00 *  32.56%*
Hmean     tput-38  1083102.00 (   0.00%)  1064541.00 *  -1.71%*
Hmean     tput-39  1232990.00 (   0.00%)  1303623.00 *   5.73%*
Hmean     tput-40  1175542.00 (   0.00%)  1340943.00 *  14.07%*
Hmean     tput-41  1127826.00 (   0.00%)  1339492.00 *  18.77%*
Hmean     tput-42  1198313.00 (   0.00%)  1411023.00 *  17.75%*
Hmean     tput-43  1163733.00 (   0.00%)  1228253.00 *   5.54%*
Hmean     tput-44  1305562.00 (   0.00%)  1357886.00 *   4.01%*
Hmean     tput-45  1326752.00 (   0.00%)  1406061.00 *   5.98%*
Hmean     tput-46  1339424.00 (   0.00%)  1418451.00 *   5.90%*
Hmean     tput-47  1415057.00 (   0.00%)  1381570.00 *  -2.37%*
Hmean     tput-48  1392003.00 (   0.00%)  1421167.00 *   2.10%*
Hmean     tput-49  1408374.00 (   0.00%)  1418659.00 *   0.73%*
Hmean     tput-50  1359822.00 (   0.00%)  1391070.00 *   2.30%*
Hmean     tput-51  1414246.00 (   0.00%)  1392679.00 *  -1.52%*
Hmean     tput-52  1432352.00 (   0.00%)  1354020.00 *  -5.47%*
Hmean     tput-53  1387563.00 (   0.00%)  1409563.00 *   1.59%*
Hmean     tput-54  1406420.00 (   0.00%)  1388711.00 *  -1.26%*
Hmean     tput-55  1438804.00 (   0.00%)  1387472.00 *  -3.57%*
Hmean     tput-56  1399465.00 (   0.00%)  1400296.00 *   0.06%*
Hmean     tput-57  1428132.00 (   0.00%)  1396399.00 *  -2.22%*
Hmean     tput-58  1432385.00 (   0.00%)  1386253.00 *  -3.22%*
Hmean     tput-59  1421612.00 (   0.00%)  1371416.00 *  -3.53%*
Hmean     tput-60  1429423.00 (   0.00%)  1389412.00 *  -2.80%*
Hmean     tput-61  1396230.00 (   0.00%)  1351122.00 *  -3.23%*
Hmean     tput-62  1418396.00 (   0.00%)  1383098.00 *  -2.49%*
Hmean     tput-63  1409918.00 (   0.00%)  1374662.00 *  -2.50%*
Hmean     tput-64  1410236.00 (   0.00%)  1376216.00 *  -2.41%*
Hmean     tput-65  1396405.00 (   0.00%)  1364418.00 *  -2.29%*
Hmean     tput-66  1395975.00 (   0.00%)  1357326.00 *  -2.77%*
Hmean     tput-67  1392986.00 (   0.00%)  1349642.00 *  -3.11%*
Hmean     tput-68  1386541.00 (   0.00%)  1343261.00 *  -3.12%*
Hmean     tput-69  1374407.00 (   0.00%)  1342588.00 *  -2.32%*
Hmean     tput-70  1377513.00 (   0.00%)  1334654.00 *  -3.11%*
Hmean     tput-71  1369319.00 (   0.00%)  1334952.00 *  -2.51%*
Hmean     tput-72  1354635.00 (   0.00%)  1329005.00 *  -1.89%*
Hmean     tput-73  1350933.00 (   0.00%)  1318942.00 *  -2.37%*
Hmean     tput-74  1351714.00 (   0.00%)  1316347.00 *  -2.62%*
Hmean     tput-75  1352198.00 (   0.00%)  1309974.00 *  -3.12%*
Hmean     tput-76  1349490.00 (   0.00%)  1286064.00 *  -4.70%*
Hmean     tput-77  1336131.00 (   0.00%)  1303684.00 *  -2.43%*
Hmean     tput-78  1308896.00 (   0.00%)  1271024.00 *  -2.89%*
Hmean     tput-79  1326703.00 (   0.00%)  1290862.00 *  -2.70%*
Hmean     tput-80  1336199.00 (   0.00%)  1291629.00 *  -3.34%*

The performance at the mid-point is better but not universally better. The
patch is a mixed bag depending on the workload, machine and overall
levels of utilisation. Sometimes it's better (sometimes much better),
other times it is worse (sometimes much worse). Given that there isn't a
universally good decision in this section and more people seem to prefer
the patch then it may be best to keep the LB decisions consistent and
revisit imbalance handling when the load balancer code changes settle down.

Jirka Hladky added the following observation.

	Our results are mostly in line with what you see. We observe
	big gains (20-50%) when the system is loaded to 1/3 of the
	maximum capacity and mixed results at the full load - some
	workloads benefit from the patch at the full load, others not,
	but performance changes at the full load are mostly within the
	noise of results (+/-5%). Overall, we think this patch is helpful.

[mgorman@techsingularity.net: Rewrote changelog]
Fixes: fb86f5b211 ("sched/numa: Use similar logic to the load balancer for moving between domains with spare capacity")
Signed-off-by: Barry Song <song.bao.hua@hisilicon.com>
Signed-off-by: Mel Gorman <mgorman@techsingularity.net>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/20200921221849.GI3179@techsingularity.net
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/sched/fair.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index 60c5a80f325b6..f3496556b6992 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -1550,7 +1550,7 @@ struct task_numa_env {
 
 static unsigned long cpu_load(struct rq *rq);
 static unsigned long cpu_util(int cpu);
-static inline long adjust_numa_imbalance(int imbalance, int src_nr_running);
+static inline long adjust_numa_imbalance(int imbalance, int nr_running);
 
 static inline enum
 numa_type numa_classify(unsigned int imbalance_pct,
@@ -1927,7 +1927,7 @@ static void task_numa_find_cpu(struct task_numa_env *env,
 		src_running = env->src_stats.nr_running - 1;
 		dst_running = env->dst_stats.nr_running + 1;
 		imbalance = max(0, dst_running - src_running);
-		imbalance = adjust_numa_imbalance(imbalance, src_running);
+		imbalance = adjust_numa_imbalance(imbalance, dst_running);
 
 		/* Use idle CPU if there is no imbalance */
 		if (!imbalance) {
@@ -8945,7 +8945,7 @@ static inline void update_sd_lb_stats(struct lb_env *env, struct sd_lb_stats *sd
 	}
 }
 
-static inline long adjust_numa_imbalance(int imbalance, int src_nr_running)
+static inline long adjust_numa_imbalance(int imbalance, int nr_running)
 {
 	unsigned int imbalance_min;
 
@@ -8954,7 +8954,7 @@ static inline long adjust_numa_imbalance(int imbalance, int src_nr_running)
 	 * tasks that remain local when the source domain is almost idle.
 	 */
 	imbalance_min = 2;
-	if (src_nr_running <= imbalance_min)
+	if (nr_running <= imbalance_min)
 		return 0;
 
 	return imbalance;
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 092/633] arm64: perf: Add missing ISB in armv8pmu_enable_counter()
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (90 preceding siblings ...)
  2020-10-27 13:47 ` [PATCH 5.8 091/633] sched/fair: Use dst group while checking imbalance for NUMA balancer Greg Kroah-Hartman
@ 2020-10-27 13:47 ` Greg Kroah-Hartman
  2020-10-27 13:47 ` [PATCH 5.8 093/633] perf/x86/intel/uncore: Update Ice Lake uncore units Greg Kroah-Hartman
                   ` (543 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Julien Thierry, Alexandru Elisei,
	Julien Thierry, Will Deacon, Mark Rutland, Peter Zijlstra,
	Ingo Molnar, Arnaldo Carvalho de Melo, Alexander Shishkin,
	Jiri Olsa, Namhyung Kim, Catalin Marinas, Will Deacon,
	Sasha Levin, Sumit Garg

From: Alexandru Elisei <alexandru.elisei@arm.com>

[ Upstream commit 490d7b7c0845eacf5593db333fd2ae7715416e16 ]

Writes to the PMXEVTYPER_EL0 register are not self-synchronising. In
armv8pmu_enable_event(), the PE can reorder configuring the event type
after we have enabled the counter and the interrupt. This can lead to an
interrupt being asserted because of the previous event type that we were
counting using the same counter, not the one that we've just configured.

The same rationale applies to writes to the PMINTENSET_EL1 register. The PE
can reorder enabling the interrupt at any point in the future after we have
enabled the event.

Prevent both situations from happening by adding an ISB just before we
enable the event counter.

Fixes: 030896885ade ("arm64: Performance counters support")
Reported-by: Julien Thierry <julien.thierry@arm.com>
Signed-off-by: Alexandru Elisei <alexandru.elisei@arm.com>
Tested-by: Sumit Garg <sumit.garg@linaro.org> (Developerbox)
Cc: Julien Thierry <julien.thierry.kdev@gmail.com>
Cc: Will Deacon <will.deacon@arm.com>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Link: https://lore.kernel.org/r/20200924110706.254996-2-alexandru.elisei@arm.com
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/kernel/perf_event.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/arch/arm64/kernel/perf_event.c b/arch/arm64/kernel/perf_event.c
index 581602413a130..c26d84ff0e224 100644
--- a/arch/arm64/kernel/perf_event.c
+++ b/arch/arm64/kernel/perf_event.c
@@ -510,6 +510,11 @@ static u32 armv8pmu_event_cnten_mask(struct perf_event *event)
 
 static inline void armv8pmu_enable_counter(u32 mask)
 {
+	/*
+	 * Make sure event configuration register writes are visible before we
+	 * enable the counter.
+	 * */
+	isb();
 	write_sysreg(mask, pmcntenset_el0);
 }
 
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 093/633] perf/x86/intel/uncore: Update Ice Lake uncore units
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (91 preceding siblings ...)
  2020-10-27 13:47 ` [PATCH 5.8 092/633] arm64: perf: Add missing ISB in armv8pmu_enable_counter() Greg Kroah-Hartman
@ 2020-10-27 13:47 ` Greg Kroah-Hartman
  2020-10-27 13:47 ` [PATCH 5.8 094/633] perf/x86/intel/uncore: Reduce the number of CBOX counters Greg Kroah-Hartman
                   ` (542 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Kan Liang, Peter Zijlstra (Intel),
	Sasha Levin

From: Kan Liang <kan.liang@linux.intel.com>

[ Upstream commit 8f5d41f3a0f495435c88ebba8fc150c931c10fef ]

There are some updates for the Icelake model specific uncore performance
monitors. (The update can be found at 10th generation intel core
processors families specification update Revision 004, ICL068)

1) Counter 0 of ARB uncore unit is not available for software use
2) The global 'enable bit' (bit 29) and 'freeze bit' (bit 31) of
   MSR_UNC_PERF_GLOBAL_CTRL cannot be used to control counter behavior.
   Needs to use local enable in event select MSR.

Accessing the modified bit/registers will be ignored by HW. Users may
observe inaccurate results with the current code.

The changes of the MSR_UNC_PERF_GLOBAL_CTRL imply that groups cannot be
read atomically anymore. Although the error of the result for a group
becomes a bit bigger, it still far lower than not using a group. The
group support is still kept. Only Remove the *_box() related
implementation.

Since the counter 0 of ARB uncore unit is not available, update the MSR
address for the ARB uncore unit.

There is no change for IMC uncore unit, which only include free-running
counters.

Fixes: 6e394376ee89 ("perf/x86/intel/uncore: Add Intel Icelake uncore support")
Signed-off-by: Kan Liang <kan.liang@linux.intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/20200925134905.8839-2-kan.liang@linux.intel.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/events/intel/uncore_snb.c | 29 +++++++++++++++++++++++++----
 1 file changed, 25 insertions(+), 4 deletions(-)

diff --git a/arch/x86/events/intel/uncore_snb.c b/arch/x86/events/intel/uncore_snb.c
index 1038e9f1e3542..300937cc8795b 100644
--- a/arch/x86/events/intel/uncore_snb.c
+++ b/arch/x86/events/intel/uncore_snb.c
@@ -115,6 +115,10 @@
 #define ICL_UNC_CBO_0_PER_CTR0			0x702
 #define ICL_UNC_CBO_MSR_OFFSET			0x8
 
+/* ICL ARB register */
+#define ICL_UNC_ARB_PER_CTR			0x3b1
+#define ICL_UNC_ARB_PERFEVTSEL			0x3b3
+
 DEFINE_UNCORE_FORMAT_ATTR(event, event, "config:0-7");
 DEFINE_UNCORE_FORMAT_ATTR(umask, umask, "config:8-15");
 DEFINE_UNCORE_FORMAT_ATTR(edge, edge, "config:18");
@@ -302,6 +306,12 @@ void skl_uncore_cpu_init(void)
 	snb_uncore_arb.ops = &skl_uncore_msr_ops;
 }
 
+static struct intel_uncore_ops icl_uncore_msr_ops = {
+	.disable_event	= snb_uncore_msr_disable_event,
+	.enable_event	= snb_uncore_msr_enable_event,
+	.read_counter	= uncore_msr_read_counter,
+};
+
 static struct intel_uncore_type icl_uncore_cbox = {
 	.name		= "cbox",
 	.num_counters   = 4,
@@ -310,7 +320,7 @@ static struct intel_uncore_type icl_uncore_cbox = {
 	.event_ctl	= SNB_UNC_CBO_0_PERFEVTSEL0,
 	.event_mask	= SNB_UNC_RAW_EVENT_MASK,
 	.msr_offset	= ICL_UNC_CBO_MSR_OFFSET,
-	.ops		= &skl_uncore_msr_ops,
+	.ops		= &icl_uncore_msr_ops,
 	.format_group	= &snb_uncore_format_group,
 };
 
@@ -339,13 +349,25 @@ static struct intel_uncore_type icl_uncore_clockbox = {
 	.single_fixed	= 1,
 	.event_mask	= SNB_UNC_CTL_EV_SEL_MASK,
 	.format_group	= &icl_uncore_clock_format_group,
-	.ops		= &skl_uncore_msr_ops,
+	.ops		= &icl_uncore_msr_ops,
 	.event_descs	= icl_uncore_events,
 };
 
+static struct intel_uncore_type icl_uncore_arb = {
+	.name		= "arb",
+	.num_counters   = 1,
+	.num_boxes	= 1,
+	.perf_ctr_bits	= 44,
+	.perf_ctr	= ICL_UNC_ARB_PER_CTR,
+	.event_ctl	= ICL_UNC_ARB_PERFEVTSEL,
+	.event_mask	= SNB_UNC_RAW_EVENT_MASK,
+	.ops		= &icl_uncore_msr_ops,
+	.format_group	= &snb_uncore_format_group,
+};
+
 static struct intel_uncore_type *icl_msr_uncores[] = {
 	&icl_uncore_cbox,
-	&snb_uncore_arb,
+	&icl_uncore_arb,
 	&icl_uncore_clockbox,
 	NULL,
 };
@@ -363,7 +385,6 @@ void icl_uncore_cpu_init(void)
 {
 	uncore_msr_uncores = icl_msr_uncores;
 	icl_uncore_cbox.num_boxes = icl_get_cbox_num();
-	snb_uncore_arb.ops = &skl_uncore_msr_ops;
 }
 
 enum {
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 094/633] perf/x86/intel/uncore: Reduce the number of CBOX counters
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (92 preceding siblings ...)
  2020-10-27 13:47 ` [PATCH 5.8 093/633] perf/x86/intel/uncore: Update Ice Lake uncore units Greg Kroah-Hartman
@ 2020-10-27 13:47 ` Greg Kroah-Hartman
  2020-10-27 13:47 ` [PATCH 5.8 095/633] perf/x86/intel/uncore: Fix the scale of the IMC free-running events Greg Kroah-Hartman
                   ` (541 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Kan Liang, Peter Zijlstra (Intel),
	Sasha Levin

From: Kan Liang <kan.liang@linux.intel.com>

[ Upstream commit ee139385432e919f4d1f59b80edbc073cdae1391 ]

An oops is triggered by the fuzzy test.

[  327.853081] unchecked MSR access error: RDMSR from 0x70c at rIP:
0xffffffffc082c820 (uncore_msr_read_counter+0x10/0x50 [intel_uncore])
[  327.853083] Call Trace:
[  327.853085]  <IRQ>
[  327.853089]  uncore_pmu_event_start+0x85/0x170 [intel_uncore]
[  327.853093]  uncore_pmu_event_add+0x1a4/0x410 [intel_uncore]
[  327.853097]  ? event_sched_in.isra.118+0xca/0x240

There are 2 GP counters for each CBOX, but the current code claims 4
counters. Accessing the invalid registers triggers the oops.

Fixes: 6e394376ee89 ("perf/x86/intel/uncore: Add Intel Icelake uncore support")
Signed-off-by: Kan Liang <kan.liang@linux.intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/20200925134905.8839-3-kan.liang@linux.intel.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/events/intel/uncore_snb.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/events/intel/uncore_snb.c b/arch/x86/events/intel/uncore_snb.c
index 300937cc8795b..3b70c2ff177c0 100644
--- a/arch/x86/events/intel/uncore_snb.c
+++ b/arch/x86/events/intel/uncore_snb.c
@@ -314,7 +314,7 @@ static struct intel_uncore_ops icl_uncore_msr_ops = {
 
 static struct intel_uncore_type icl_uncore_cbox = {
 	.name		= "cbox",
-	.num_counters   = 4,
+	.num_counters   = 2,
 	.perf_ctr_bits	= 44,
 	.perf_ctr	= ICL_UNC_CBO_0_PER_CTR0,
 	.event_ctl	= SNB_UNC_CBO_0_PERFEVTSEL0,
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 095/633] perf/x86/intel/uncore: Fix the scale of the IMC free-running events
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (93 preceding siblings ...)
  2020-10-27 13:47 ` [PATCH 5.8 094/633] perf/x86/intel/uncore: Reduce the number of CBOX counters Greg Kroah-Hartman
@ 2020-10-27 13:47 ` Greg Kroah-Hartman
  2020-10-27 13:47 ` [PATCH 5.8 096/633] x86/nmi: Fix nmi_handle() duration miscalculation Greg Kroah-Hartman
                   ` (540 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Kan Liang, Peter Zijlstra (Intel),
	Sasha Levin

From: Kan Liang <kan.liang@linux.intel.com>

[ Upstream commit 8191016a026b8dfbb14dea64efc8e723ee99fe65 ]

The "MiB" result of the IMC free-running bandwidth events,
uncore_imc_free_running/read/ and uncore_imc_free_running/write/ are 16
times too small.

The "MiB" value equals the raw IMC free-running bandwidth counter value
times a "scale" which is inaccurate.

The IMC free-running bandwidth events should be incremented per 64B
cache line, not DWs (4 bytes). The "scale" should be 6.103515625e-5.
Fix the "scale" for both Snow Ridge and Ice Lake.

Fixes: 2b3b76b5ec67 ("perf/x86/intel/uncore: Add Ice Lake server uncore support")
Fixes: ee49532b38dd ("perf/x86/intel/uncore: Add IMC uncore support for Snow Ridge")
Signed-off-by: Kan Liang <kan.liang@linux.intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/20200928133240.12977-1-kan.liang@linux.intel.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/events/intel/uncore_snbep.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/arch/x86/events/intel/uncore_snbep.c b/arch/x86/events/intel/uncore_snbep.c
index 07652fa20ebbe..6a03fe8054a81 100644
--- a/arch/x86/events/intel/uncore_snbep.c
+++ b/arch/x86/events/intel/uncore_snbep.c
@@ -4550,10 +4550,10 @@ static struct uncore_event_desc snr_uncore_imc_freerunning_events[] = {
 	INTEL_UNCORE_EVENT_DESC(dclk,		"event=0xff,umask=0x10"),
 
 	INTEL_UNCORE_EVENT_DESC(read,		"event=0xff,umask=0x20"),
-	INTEL_UNCORE_EVENT_DESC(read.scale,	"3.814697266e-6"),
+	INTEL_UNCORE_EVENT_DESC(read.scale,	"6.103515625e-5"),
 	INTEL_UNCORE_EVENT_DESC(read.unit,	"MiB"),
 	INTEL_UNCORE_EVENT_DESC(write,		"event=0xff,umask=0x21"),
-	INTEL_UNCORE_EVENT_DESC(write.scale,	"3.814697266e-6"),
+	INTEL_UNCORE_EVENT_DESC(write.scale,	"6.103515625e-5"),
 	INTEL_UNCORE_EVENT_DESC(write.unit,	"MiB"),
 	{ /* end: all zeroes */ },
 };
@@ -5009,17 +5009,17 @@ static struct uncore_event_desc icx_uncore_imc_freerunning_events[] = {
 	INTEL_UNCORE_EVENT_DESC(dclk,			"event=0xff,umask=0x10"),
 
 	INTEL_UNCORE_EVENT_DESC(read,			"event=0xff,umask=0x20"),
-	INTEL_UNCORE_EVENT_DESC(read.scale,		"3.814697266e-6"),
+	INTEL_UNCORE_EVENT_DESC(read.scale,		"6.103515625e-5"),
 	INTEL_UNCORE_EVENT_DESC(read.unit,		"MiB"),
 	INTEL_UNCORE_EVENT_DESC(write,			"event=0xff,umask=0x21"),
-	INTEL_UNCORE_EVENT_DESC(write.scale,		"3.814697266e-6"),
+	INTEL_UNCORE_EVENT_DESC(write.scale,		"6.103515625e-5"),
 	INTEL_UNCORE_EVENT_DESC(write.unit,		"MiB"),
 
 	INTEL_UNCORE_EVENT_DESC(ddrt_read,		"event=0xff,umask=0x30"),
-	INTEL_UNCORE_EVENT_DESC(ddrt_read.scale,	"3.814697266e-6"),
+	INTEL_UNCORE_EVENT_DESC(ddrt_read.scale,	"6.103515625e-5"),
 	INTEL_UNCORE_EVENT_DESC(ddrt_read.unit,		"MiB"),
 	INTEL_UNCORE_EVENT_DESC(ddrt_write,		"event=0xff,umask=0x31"),
-	INTEL_UNCORE_EVENT_DESC(ddrt_write.scale,	"3.814697266e-6"),
+	INTEL_UNCORE_EVENT_DESC(ddrt_write.scale,	"6.103515625e-5"),
 	INTEL_UNCORE_EVENT_DESC(ddrt_write.unit,	"MiB"),
 	{ /* end: all zeroes */ },
 };
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 096/633] x86/nmi: Fix nmi_handle() duration miscalculation
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (94 preceding siblings ...)
  2020-10-27 13:47 ` [PATCH 5.8 095/633] perf/x86/intel/uncore: Fix the scale of the IMC free-running events Greg Kroah-Hartman
@ 2020-10-27 13:47 ` Greg Kroah-Hartman
  2020-10-27 13:47 ` [PATCH 5.8 097/633] x86/events/amd/iommu: Fix sizeof mismatch Greg Kroah-Hartman
                   ` (539 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Peter Zijlstra (Intel),
	Libing Zhou, Borislav Petkov, Changbin Du, Sasha Levin

From: Libing Zhou <libing.zhou@nokia-sbell.com>

[ Upstream commit f94c91f7ba3ba7de2bc8aa31be28e1abb22f849e ]

When nmi_check_duration() is checking the time an NMI handler took to
execute, the whole_msecs value used should be read from the @duration
argument, not from the ->max_duration, the latter being used to store
the current maximal duration.

 [ bp: Rewrite commit message. ]

Fixes: 248ed51048c4 ("x86/nmi: Remove irq_work from the long duration NMI handler")
Suggested-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Libing Zhou <libing.zhou@nokia-sbell.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Cc: Changbin Du <changbin.du@gmail.com>
Link: https://lkml.kernel.org/r/20200820025641.44075-1-libing.zhou@nokia-sbell.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/kernel/nmi.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/arch/x86/kernel/nmi.c b/arch/x86/kernel/nmi.c
index d7c5e44b26f73..091752c3a19e2 100644
--- a/arch/x86/kernel/nmi.c
+++ b/arch/x86/kernel/nmi.c
@@ -102,7 +102,6 @@ fs_initcall(nmi_warning_debugfs);
 
 static void nmi_check_duration(struct nmiaction *action, u64 duration)
 {
-	u64 whole_msecs = READ_ONCE(action->max_duration);
 	int remainder_ns, decimal_msecs;
 
 	if (duration < nmi_longest_ns || duration < action->max_duration)
@@ -110,12 +109,12 @@ static void nmi_check_duration(struct nmiaction *action, u64 duration)
 
 	action->max_duration = duration;
 
-	remainder_ns = do_div(whole_msecs, (1000 * 1000));
+	remainder_ns = do_div(duration, (1000 * 1000));
 	decimal_msecs = remainder_ns / 1000;
 
 	printk_ratelimited(KERN_INFO
 		"INFO: NMI handler (%ps) took too long to run: %lld.%03d msecs\n",
-		action->handler, whole_msecs, decimal_msecs);
+		action->handler, duration, decimal_msecs);
 }
 
 static int nmi_handle(unsigned int type, struct pt_regs *regs)
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 097/633] x86/events/amd/iommu: Fix sizeof mismatch
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (95 preceding siblings ...)
  2020-10-27 13:47 ` [PATCH 5.8 096/633] x86/nmi: Fix nmi_handle() duration miscalculation Greg Kroah-Hartman
@ 2020-10-27 13:47 ` Greg Kroah-Hartman
  2020-10-27 13:47 ` [PATCH 5.8 098/633] pinctrl: qcom: Set IRQCHIP_SET_TYPE_MASKED and IRQCHIP_MASK_ON_SUSPEND flags Greg Kroah-Hartman
                   ` (538 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Colin Ian King,
	Peter Zijlstra (Intel),
	Sasha Levin

From: Colin Ian King <colin.king@canonical.com>

[ Upstream commit 59d5396a4666195f89a67e118e9e627ddd6f53a1 ]

An incorrect sizeof is being used, struct attribute ** is not correct,
it should be struct attribute *. Note that since ** is the same size as
* this is not causing any issues.  Improve this fix by using sizeof(*attrs)
as this allows us to not even reference the type of the pointer.

Addresses-Coverity: ("Sizeof not portable (SIZEOF_MISMATCH)")
Fixes: 51686546304f ("x86/events/amd/iommu: Fix sysfs perf attribute groups")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/20201001113900.58889-1-colin.king@canonical.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/events/amd/iommu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/events/amd/iommu.c b/arch/x86/events/amd/iommu.c
index fb616203ce427..be50ef8572cce 100644
--- a/arch/x86/events/amd/iommu.c
+++ b/arch/x86/events/amd/iommu.c
@@ -379,7 +379,7 @@ static __init int _init_events_attrs(void)
 	while (amd_iommu_v2_event_descs[i].attr.attr.name)
 		i++;
 
-	attrs = kcalloc(i + 1, sizeof(struct attribute **), GFP_KERNEL);
+	attrs = kcalloc(i + 1, sizeof(*attrs), GFP_KERNEL);
 	if (!attrs)
 		return -ENOMEM;
 
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 098/633] pinctrl: qcom: Set IRQCHIP_SET_TYPE_MASKED and IRQCHIP_MASK_ON_SUSPEND flags
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (96 preceding siblings ...)
  2020-10-27 13:47 ` [PATCH 5.8 097/633] x86/events/amd/iommu: Fix sizeof mismatch Greg Kroah-Hartman
@ 2020-10-27 13:47 ` Greg Kroah-Hartman
  2020-10-27 13:47 ` [PATCH 5.8 099/633] pinctrl: qcom: Use return value from irq_set_wake() call Greg Kroah-Hartman
                   ` (537 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Maulik Shah, Marc Zyngier,
	Stephen Boyd, Douglas Anderson, Bjorn Andersson, Linus Walleij,
	Sasha Levin

From: Maulik Shah <mkshah@codeaurora.org>

[ Upstream commit c5f72aeb659eb2f809b9531d759651514d42aa3a ]

Both IRQCHIP_SET_TYPE_MASKED and IRQCHIP_MASK_ON_SUSPEND flags are already
set for msmgpio's parent PDC irqchip but GPIO interrupts do not get masked
during suspend or during setting irq type since genirq checks irqchip flag
of msmgpio irqchip which forwards these calls to its parent PDC irqchip.

Add irqchip specific flags for msmgpio irqchip to mask non wakeirqs during
suspend and mask before setting irq type. Masking before changing type make
sures any spurious interrupt is not detected during this operation.

Fixes: e35a6ae0eb3a ("pinctrl/msm: Setup GPIO chip in hierarchy")
Signed-off-by: Maulik Shah <mkshah@codeaurora.org>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Tested-by: Stephen Boyd <swboyd@chromium.org>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Acked-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Acked-by: Linus Walleij <linus.walleij@linaro.org>
Link: https://lore.kernel.org/r/1601267524-20199-2-git-send-email-mkshah@codeaurora.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pinctrl/qcom/pinctrl-msm.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/pinctrl/qcom/pinctrl-msm.c b/drivers/pinctrl/qcom/pinctrl-msm.c
index c322f30a20648..a28a96ac2b671 100644
--- a/drivers/pinctrl/qcom/pinctrl-msm.c
+++ b/drivers/pinctrl/qcom/pinctrl-msm.c
@@ -1226,6 +1226,8 @@ static int msm_gpio_init(struct msm_pinctrl *pctrl)
 	pctrl->irq_chip.irq_release_resources = msm_gpio_irq_relres;
 	pctrl->irq_chip.irq_set_affinity = msm_gpio_irq_set_affinity;
 	pctrl->irq_chip.irq_set_vcpu_affinity = msm_gpio_irq_set_vcpu_affinity;
+	pctrl->irq_chip.flags = IRQCHIP_MASK_ON_SUSPEND |
+				IRQCHIP_SET_TYPE_MASKED;
 
 	np = of_parse_phandle(pctrl->dev->of_node, "wakeup-parent", 0);
 	if (np) {
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 099/633] pinctrl: qcom: Use return value from irq_set_wake() call
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (97 preceding siblings ...)
  2020-10-27 13:47 ` [PATCH 5.8 098/633] pinctrl: qcom: Set IRQCHIP_SET_TYPE_MASKED and IRQCHIP_MASK_ON_SUSPEND flags Greg Kroah-Hartman
@ 2020-10-27 13:47 ` Greg Kroah-Hartman
  2020-10-27 13:47 ` [PATCH 5.8 100/633] perf/x86: Fix n_pair for cancelled txn Greg Kroah-Hartman
                   ` (536 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Maulik Shah, Marc Zyngier,
	Stephen Boyd, Douglas Anderson, Bjorn Andersson, Linus Walleij,
	Sasha Levin

From: Maulik Shah <mkshah@codeaurora.org>

[ Upstream commit f41aaca593377a4fe3984459fd4539481263b4cd ]

msmgpio irqchip was not using return value of irq_set_irq_wake() callback
since previously GIC-v3 irqchip neither had IRQCHIP_SKIP_SET_WAKE flag nor
it implemented .irq_set_wake callback. This lead to irq_set_irq_wake()
return error -ENXIO.

However from 'commit 4110b5cbb014 ("irqchip/gic-v3: Allow interrupt to be
configured as wake-up sources")' GIC irqchip has IRQCHIP_SKIP_SET_WAKE
flag.

Use return value from irq_set_irq_wake() and irq_chip_set_wake_parent()
instead of always returning success.

Fixes: e35a6ae0eb3a ("pinctrl/msm: Setup GPIO chip in hierarchy")
Signed-off-by: Maulik Shah <mkshah@codeaurora.org>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Tested-by: Stephen Boyd <swboyd@chromium.org>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Reviewed-by: Stephen Boyd <swboyd@chromium.org>
Acked-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Acked-by: Linus Walleij <linus.walleij@linaro.org>
Link: https://lore.kernel.org/r/1601267524-20199-3-git-send-email-mkshah@codeaurora.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pinctrl/qcom/pinctrl-msm.c | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/drivers/pinctrl/qcom/pinctrl-msm.c b/drivers/pinctrl/qcom/pinctrl-msm.c
index a28a96ac2b671..22283ba797cd0 100644
--- a/drivers/pinctrl/qcom/pinctrl-msm.c
+++ b/drivers/pinctrl/qcom/pinctrl-msm.c
@@ -1060,12 +1060,10 @@ static int msm_gpio_irq_set_wake(struct irq_data *d, unsigned int on)
 	 * when TLMM is powered on. To allow that, enable the GPIO
 	 * summary line to be wakeup capable at GIC.
 	 */
-	if (d->parent_data)
-		irq_chip_set_wake_parent(d, on);
-
-	irq_set_irq_wake(pctrl->irq, on);
+	if (d->parent_data && test_bit(d->hwirq, pctrl->skip_wake_irqs))
+		return irq_chip_set_wake_parent(d, on);
 
-	return 0;
+	return irq_set_irq_wake(pctrl->irq, on);
 }
 
 static int msm_gpio_irq_reqres(struct irq_data *d)
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 100/633] perf/x86: Fix n_pair for cancelled txn
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (98 preceding siblings ...)
  2020-10-27 13:47 ` [PATCH 5.8 099/633] pinctrl: qcom: Use return value from irq_set_wake() call Greg Kroah-Hartman
@ 2020-10-27 13:47 ` Greg Kroah-Hartman
  2020-10-27 13:47 ` [PATCH 5.8 101/633] perf/core: Fix race in the perf_mmap_close() function Greg Kroah-Hartman
                   ` (535 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Kan Liang, Peter Zijlstra (Intel),
	Kim Phillips, Sasha Levin

[ Upstream commit 871a93b0aad65a7f44ee25f2d17932ef6d559850 ]

Kan reported that n_metric gets corrupted for cancelled transactions;
a similar issue exists for n_pair for AMD's Large Increment thing.

The problem was confirmed and confirmed fixed by Kim using:

  sudo perf stat -e "{cycles,cycles,cycles,cycles}:D" -a sleep 10 &

  # should succeed:
  sudo perf stat -e "{fp_ret_sse_avx_ops.all}:D" -a workload

  # should fail:
  sudo perf stat -e "{fp_ret_sse_avx_ops.all,fp_ret_sse_avx_ops.all,cycles}:D" -a workload

  # previously failed, now succeeds with this patch:
  sudo perf stat -e "{fp_ret_sse_avx_ops.all}:D" -a workload

Fixes: 5738891229a2 ("perf/x86/amd: Add support for Large Increment per Cycle Events")
Reported-by: Kan Liang <kan.liang@linux.intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Tested-by: Kim Phillips <kim.phillips@amd.com>
Link: https://lkml.kernel.org/r/20201005082516.GG2628@hirez.programming.kicks-ass.net
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/events/core.c       | 6 +++++-
 arch/x86/events/perf_event.h | 1 +
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/arch/x86/events/core.c b/arch/x86/events/core.c
index 4103665c6e032..29640b4079af0 100644
--- a/arch/x86/events/core.c
+++ b/arch/x86/events/core.c
@@ -1087,8 +1087,10 @@ static int collect_events(struct cpu_hw_events *cpuc, struct perf_event *leader,
 
 		cpuc->event_list[n] = event;
 		n++;
-		if (is_counter_pair(&event->hw))
+		if (is_counter_pair(&event->hw)) {
 			cpuc->n_pair++;
+			cpuc->n_txn_pair++;
+		}
 	}
 	return n;
 }
@@ -1953,6 +1955,7 @@ static void x86_pmu_start_txn(struct pmu *pmu, unsigned int txn_flags)
 
 	perf_pmu_disable(pmu);
 	__this_cpu_write(cpu_hw_events.n_txn, 0);
+	__this_cpu_write(cpu_hw_events.n_txn_pair, 0);
 }
 
 /*
@@ -1978,6 +1981,7 @@ static void x86_pmu_cancel_txn(struct pmu *pmu)
 	 */
 	__this_cpu_sub(cpu_hw_events.n_added, __this_cpu_read(cpu_hw_events.n_txn));
 	__this_cpu_sub(cpu_hw_events.n_events, __this_cpu_read(cpu_hw_events.n_txn));
+	__this_cpu_sub(cpu_hw_events.n_pair, __this_cpu_read(cpu_hw_events.n_txn_pair));
 	perf_pmu_enable(pmu);
 }
 
diff --git a/arch/x86/events/perf_event.h b/arch/x86/events/perf_event.h
index e17a3d8a47ede..d4d482d16fe18 100644
--- a/arch/x86/events/perf_event.h
+++ b/arch/x86/events/perf_event.h
@@ -198,6 +198,7 @@ struct cpu_hw_events {
 					     they've never been enabled yet */
 	int			n_txn;    /* the # last events in the below arrays;
 					     added in the current transaction */
+	int			n_txn_pair;
 	int			assign[X86_PMC_IDX_MAX]; /* event to counter assignment */
 	u64			tags[X86_PMC_IDX_MAX];
 
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 101/633] perf/core: Fix race in the perf_mmap_close() function
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (99 preceding siblings ...)
  2020-10-27 13:47 ` [PATCH 5.8 100/633] perf/x86: Fix n_pair for cancelled txn Greg Kroah-Hartman
@ 2020-10-27 13:47 ` Greg Kroah-Hartman
  2020-10-27 13:47 ` [PATCH 5.8 102/633] crypto: algif_skcipher - EBUSY on aio should be an error Greg Kroah-Hartman
                   ` (534 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Michael Petlan, Jiri Olsa,
	Ingo Molnar, Peter Zijlstra, Namhyung Kim, Wade Mealing,
	Sasha Levin

From: Jiri Olsa <jolsa@redhat.com>

[ Upstream commit f91072ed1b7283b13ca57fcfbece5a3b92726143 ]

There's a possible race in perf_mmap_close() when checking ring buffer's
mmap_count refcount value. The problem is that the mmap_count check is
not atomic because we call atomic_dec() and atomic_read() separately.

  perf_mmap_close:
  ...
   atomic_dec(&rb->mmap_count);
   ...
   if (atomic_read(&rb->mmap_count))
      goto out_put;

   <ring buffer detach>
   free_uid

out_put:
  ring_buffer_put(rb); /* could be last */

The race can happen when we have two (or more) events sharing same ring
buffer and they go through atomic_dec() and then they both see 0 as refcount
value later in atomic_read(). Then both will go on and execute code which
is meant to be run just once.

The code that detaches ring buffer is probably fine to be executed more
than once, but the problem is in calling free_uid(), which will later on
demonstrate in related crashes and refcount warnings, like:

  refcount_t: addition on 0; use-after-free.
  ...
  RIP: 0010:refcount_warn_saturate+0x6d/0xf
  ...
  Call Trace:
  prepare_creds+0x190/0x1e0
  copy_creds+0x35/0x172
  copy_process+0x471/0x1a80
  _do_fork+0x83/0x3a0
  __do_sys_wait4+0x83/0x90
  __do_sys_clone+0x85/0xa0
  do_syscall_64+0x5b/0x1e0
  entry_SYSCALL_64_after_hwframe+0x44/0xa9

Using atomic decrease and check instead of separated calls.

Tested-by: Michael Petlan <mpetlan@redhat.com>
Signed-off-by: Jiri Olsa <jolsa@kernel.org>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Acked-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
Acked-by: Namhyung Kim <namhyung@kernel.org>
Acked-by: Wade Mealing <wmealing@redhat.com>
Fixes: 9bb5d40cd93c ("perf: Fix mmap() accounting hole");
Link: https://lore.kernel.org/r/20200916115311.GE2301783@krava
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/events/core.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/kernel/events/core.c b/kernel/events/core.c
index fd8cd00099dae..38eeb297255e4 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -5852,11 +5852,11 @@ static void perf_pmu_output_stop(struct perf_event *event);
 static void perf_mmap_close(struct vm_area_struct *vma)
 {
 	struct perf_event *event = vma->vm_file->private_data;
-
 	struct perf_buffer *rb = ring_buffer_get(event);
 	struct user_struct *mmap_user = rb->mmap_user;
 	int mmap_locked = rb->mmap_locked;
 	unsigned long size = perf_data_size(rb);
+	bool detach_rest = false;
 
 	if (event->pmu->event_unmapped)
 		event->pmu->event_unmapped(event, vma->vm_mm);
@@ -5887,7 +5887,8 @@ static void perf_mmap_close(struct vm_area_struct *vma)
 		mutex_unlock(&event->mmap_mutex);
 	}
 
-	atomic_dec(&rb->mmap_count);
+	if (atomic_dec_and_test(&rb->mmap_count))
+		detach_rest = true;
 
 	if (!atomic_dec_and_mutex_lock(&event->mmap_count, &event->mmap_mutex))
 		goto out_put;
@@ -5896,7 +5897,7 @@ static void perf_mmap_close(struct vm_area_struct *vma)
 	mutex_unlock(&event->mmap_mutex);
 
 	/* If there's still other mmap()s of this buffer, we're done. */
-	if (atomic_read(&rb->mmap_count))
+	if (!detach_rest)
 		goto out_put;
 
 	/*
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 102/633] crypto: algif_skcipher - EBUSY on aio should be an error
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (100 preceding siblings ...)
  2020-10-27 13:47 ` [PATCH 5.8 101/633] perf/core: Fix race in the perf_mmap_close() function Greg Kroah-Hartman
@ 2020-10-27 13:47 ` Greg Kroah-Hartman
  2020-10-27 13:47 ` [PATCH 5.8 103/633] crypto: mediatek - Fix wrong return value in mtk_desc_ring_alloc() Greg Kroah-Hartman
                   ` (533 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:47 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Herbert Xu, Sasha Levin

From: Herbert Xu <herbert@gondor.apana.org.au>

[ Upstream commit 2a05b029c1ee045b886ebf9efef9985ca23450de ]

I removed the MAY_BACKLOG flag on the aio path a while ago but
the error check still incorrectly interpreted EBUSY as success.
This may cause the submitter to wait for a request that will never
complete.

Fixes: dad419970637 ("crypto: algif_skcipher - Do not set...")
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 crypto/algif_skcipher.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/crypto/algif_skcipher.c b/crypto/algif_skcipher.c
index 81c4022285a7c..30069a92a9b22 100644
--- a/crypto/algif_skcipher.c
+++ b/crypto/algif_skcipher.c
@@ -123,7 +123,7 @@ static int _skcipher_recvmsg(struct socket *sock, struct msghdr *msg,
 			crypto_skcipher_decrypt(&areq->cra_u.skcipher_req);
 
 		/* AIO operation in progress */
-		if (err == -EINPROGRESS || err == -EBUSY)
+		if (err == -EINPROGRESS)
 			return -EIOCBQUEUED;
 
 		sock_put(sk);
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 103/633] crypto: mediatek - Fix wrong return value in mtk_desc_ring_alloc()
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (101 preceding siblings ...)
  2020-10-27 13:47 ` [PATCH 5.8 102/633] crypto: algif_skcipher - EBUSY on aio should be an error Greg Kroah-Hartman
@ 2020-10-27 13:47 ` Greg Kroah-Hartman
  2020-10-27 13:47 ` [PATCH 5.8 104/633] crypto: ixp4xx - Fix the size used in a dma_free_coherent() call Greg Kroah-Hartman
                   ` (532 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ryder Lee, Tianjia Zhang, Herbert Xu,
	Sasha Levin

From: Tianjia Zhang <tianjia.zhang@linux.alibaba.com>

[ Upstream commit 8cbde6c6a6d2b1599ff90f932304aab7e32fce89 ]

In case of memory allocation failure, a negative error code should
be returned.

Fixes: 785e5c616c849 ("crypto: mediatek - Add crypto driver support for some MediaTek chips")
Cc: Ryder Lee <ryder.lee@mediatek.com>
Signed-off-by: Tianjia Zhang <tianjia.zhang@linux.alibaba.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/mediatek/mtk-platform.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/crypto/mediatek/mtk-platform.c b/drivers/crypto/mediatek/mtk-platform.c
index 7e3ad085b5bdd..ef4339e84d034 100644
--- a/drivers/crypto/mediatek/mtk-platform.c
+++ b/drivers/crypto/mediatek/mtk-platform.c
@@ -442,7 +442,7 @@ static void mtk_desc_dma_free(struct mtk_cryp *cryp)
 static int mtk_desc_ring_alloc(struct mtk_cryp *cryp)
 {
 	struct mtk_ring **ring = cryp->ring;
-	int i, err = ENOMEM;
+	int i;
 
 	for (i = 0; i < MTK_RING_MAX; i++) {
 		ring[i] = kzalloc(sizeof(**ring), GFP_KERNEL);
@@ -476,7 +476,7 @@ static int mtk_desc_ring_alloc(struct mtk_cryp *cryp)
 				  ring[i]->cmd_base, ring[i]->cmd_dma);
 		kfree(ring[i]);
 	}
-	return err;
+	return -ENOMEM;
 }
 
 static int mtk_crypto_probe(struct platform_device *pdev)
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 104/633] crypto: ixp4xx - Fix the size used in a dma_free_coherent() call
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (102 preceding siblings ...)
  2020-10-27 13:47 ` [PATCH 5.8 103/633] crypto: mediatek - Fix wrong return value in mtk_desc_ring_alloc() Greg Kroah-Hartman
@ 2020-10-27 13:47 ` Greg Kroah-Hartman
  2020-10-27 13:47 ` [PATCH 5.8 105/633] crypto: picoxcell - Fix potential race condition bug Greg Kroah-Hartman
                   ` (531 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christophe JAILLET, Herbert Xu, Sasha Levin

From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>

[ Upstream commit f7ade9aaf66bd5599690acf0597df2c0f6cd825a ]

Update the size used in 'dma_free_coherent()' in order to match the one
used in the corresponding 'dma_alloc_coherent()', in 'setup_crypt_desc()'.

Fixes: 81bef0150074 ("crypto: ixp4xx - Hardware crypto support for IXP4xx CPUs")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/ixp4xx_crypto.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/crypto/ixp4xx_crypto.c b/drivers/crypto/ixp4xx_crypto.c
index ad73fc9466821..3be6e0db0f9fc 100644
--- a/drivers/crypto/ixp4xx_crypto.c
+++ b/drivers/crypto/ixp4xx_crypto.c
@@ -528,7 +528,7 @@ static void release_ixp_crypto(struct device *dev)
 
 	if (crypt_virt) {
 		dma_free_coherent(dev,
-			NPE_QLEN_TOTAL * sizeof( struct crypt_ctl),
+			NPE_QLEN * sizeof(struct crypt_ctl),
 			crypt_virt, crypt_phys);
 	}
 }
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 105/633] crypto: picoxcell - Fix potential race condition bug
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (103 preceding siblings ...)
  2020-10-27 13:47 ` [PATCH 5.8 104/633] crypto: ixp4xx - Fix the size used in a dma_free_coherent() call Greg Kroah-Hartman
@ 2020-10-27 13:47 ` Greg Kroah-Hartman
  2020-10-27 13:47 ` [PATCH 5.8 106/633] media: vivid: Fix global-out-of-bounds read in precalculate_color() Greg Kroah-Hartman
                   ` (530 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Madhuparna Bhowmik, Jamie Iles,
	Herbert Xu, Sasha Levin

From: Madhuparna Bhowmik <madhuparnabhowmik10@gmail.com>

[ Upstream commit 64f4a62e3b17f1e473f971127c2924cae42afc82 ]

engine->stat_irq_thresh was initialized after device_create_file() in
the probe function, the initialization may race with call to
spacc_stat_irq_thresh_store() which updates engine->stat_irq_thresh,
therefore initialize it before creating the file in probe function.

Found by Linux Driver Verification project (linuxtesting.org).

Fixes: ce92136843cb ("crypto: picoxcell - add support for the...")
Signed-off-by: Madhuparna Bhowmik <madhuparnabhowmik10@gmail.com>
Acked-by: Jamie Iles <jamie@jamieiles.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/picoxcell_crypto.c | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/drivers/crypto/picoxcell_crypto.c b/drivers/crypto/picoxcell_crypto.c
index 7384e91c8b32b..0d32b641a7f9d 100644
--- a/drivers/crypto/picoxcell_crypto.c
+++ b/drivers/crypto/picoxcell_crypto.c
@@ -1666,11 +1666,6 @@ static int spacc_probe(struct platform_device *pdev)
 		goto err_clk_put;
 	}
 
-	ret = device_create_file(&pdev->dev, &dev_attr_stat_irq_thresh);
-	if (ret)
-		goto err_clk_disable;
-
-
 	/*
 	 * Use an IRQ threshold of 50% as a default. This seems to be a
 	 * reasonable trade off of latency against throughput but can be
@@ -1678,6 +1673,10 @@ static int spacc_probe(struct platform_device *pdev)
 	 */
 	engine->stat_irq_thresh = (engine->fifo_sz / 2);
 
+	ret = device_create_file(&pdev->dev, &dev_attr_stat_irq_thresh);
+	if (ret)
+		goto err_clk_disable;
+
 	/*
 	 * Configure the interrupts. We only use the STAT_CNT interrupt as we
 	 * only submit a new packet for processing when we complete another in
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 106/633] media: vivid: Fix global-out-of-bounds read in precalculate_color()
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (104 preceding siblings ...)
  2020-10-27 13:47 ` [PATCH 5.8 105/633] crypto: picoxcell - Fix potential race condition bug Greg Kroah-Hartman
@ 2020-10-27 13:47 ` Greg Kroah-Hartman
  2020-10-27 13:47 ` [PATCH 5.8 107/633] media: tuner-simple: fix regression in simple_set_radio_freq Greg Kroah-Hartman
                   ` (529 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hans Verkuil, Peilin Ye,
	Mauro Carvalho Chehab, Sasha Levin, syzbot+02d9172bf4c43104cd70

From: Peilin Ye <yepeilin.cs@gmail.com>

[ Upstream commit e3158a5e7e661786b3ab650c7e4d21024e8eff0f ]

vivid_meta_out_process() is setting `brightness`, `contrast`, `saturation`
and `hue` using tpg_s_*(). This is wrong, since tpg_s_*() do not provide
range checks. Using tpg_s_*() here also makes the control framework
out-of-sync with the actual values. Use v4l2_ctrl_s_ctrl() instead.

This issue has been reported by syzbot as an out-of-bounds read bug in
precalculate_color().

Reported-and-tested-by: syzbot+02d9172bf4c43104cd70@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?extid=02d9172bf4c43104cd70

Fixes: 746facd39370 ("media: vivid: Add metadata output support")
Suggested-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Peilin Ye <yepeilin.cs@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/test-drivers/vivid/vivid-meta-out.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/drivers/media/test-drivers/vivid/vivid-meta-out.c b/drivers/media/test-drivers/vivid/vivid-meta-out.c
index ff8a039aba72e..95835b52b58fc 100644
--- a/drivers/media/test-drivers/vivid/vivid-meta-out.c
+++ b/drivers/media/test-drivers/vivid/vivid-meta-out.c
@@ -164,10 +164,11 @@ void vivid_meta_out_process(struct vivid_dev *dev,
 {
 	struct vivid_meta_out_buf *meta = vb2_plane_vaddr(&buf->vb.vb2_buf, 0);
 
-	tpg_s_brightness(&dev->tpg, meta->brightness);
-	tpg_s_contrast(&dev->tpg, meta->contrast);
-	tpg_s_saturation(&dev->tpg, meta->saturation);
-	tpg_s_hue(&dev->tpg, meta->hue);
+	v4l2_ctrl_s_ctrl(dev->brightness, meta->brightness);
+	v4l2_ctrl_s_ctrl(dev->contrast, meta->contrast);
+	v4l2_ctrl_s_ctrl(dev->saturation, meta->saturation);
+	v4l2_ctrl_s_ctrl(dev->hue, meta->hue);
+
 	dprintk(dev, 2, " %s brightness %u contrast %u saturation %u hue %d\n",
 		__func__, meta->brightness, meta->contrast,
 		meta->saturation, meta->hue);
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 107/633] media: tuner-simple: fix regression in simple_set_radio_freq
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (105 preceding siblings ...)
  2020-10-27 13:47 ` [PATCH 5.8 106/633] media: vivid: Fix global-out-of-bounds read in precalculate_color() Greg Kroah-Hartman
@ 2020-10-27 13:47 ` Greg Kroah-Hartman
  2020-10-27 13:47 ` [PATCH 5.8 108/633] crypto: ccree - fix runtime PM imbalance on error Greg Kroah-Hartman
                   ` (528 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Tom Rix, Hans Verkuil,
	Mauro Carvalho Chehab, Sasha Levin

From: Tom Rix <trix@redhat.com>

[ Upstream commit 505bfc2a142f12ce7bc7a878b44abc3496f2e747 ]

clang static analysis reports this problem

tuner-simple.c:714:13: warning: Assigned value is
  garbage or undefined
        buffer[1] = buffer[3];
                  ^ ~~~~~~~~~
In simple_set_radio_freq buffer[3] used to be done
in-function with a switch of tuner type, now done
by a call to simple_radio_bandswitch which has this case

	case TUNER_TENA_9533_DI:
	case TUNER_YMEC_TVF_5533MF:
		tuner_dbg("This tuner doesn't ...
		return 0;

which does not set buffer[3].  In the old logic, this case
would have returned 0 from simple_set_radio_freq.

Recover this old behavior by returning an error for this
codition. Since the old simple_set_radio_freq behavior
returned a 0, do the same.

Fixes: c7a9f3aa1e1b ("V4L/DVB (7129): tuner-simple: move device-specific code into three separate functions")
Signed-off-by: Tom Rix <trix@redhat.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/tuners/tuner-simple.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/media/tuners/tuner-simple.c b/drivers/media/tuners/tuner-simple.c
index b6e70fada3fb2..8fb186b25d6af 100644
--- a/drivers/media/tuners/tuner-simple.c
+++ b/drivers/media/tuners/tuner-simple.c
@@ -500,7 +500,7 @@ static int simple_radio_bandswitch(struct dvb_frontend *fe, u8 *buffer)
 	case TUNER_TENA_9533_DI:
 	case TUNER_YMEC_TVF_5533MF:
 		tuner_dbg("This tuner doesn't have FM. Most cards have a TEA5767 for FM\n");
-		return 0;
+		return -EINVAL;
 	case TUNER_PHILIPS_FM1216ME_MK3:
 	case TUNER_PHILIPS_FM1236_MK3:
 	case TUNER_PHILIPS_FMD1216ME_MK3:
@@ -702,7 +702,8 @@ static int simple_set_radio_freq(struct dvb_frontend *fe,
 		    TUNER_RATIO_SELECT_50; /* 50 kHz step */
 
 	/* Bandswitch byte */
-	simple_radio_bandswitch(fe, &buffer[0]);
+	if (simple_radio_bandswitch(fe, &buffer[0]))
+		return 0;
 
 	/* Convert from 1/16 kHz V4L steps to 1/20 MHz (=50 kHz) PLL steps
 	   freq * (1 Mhz / 16000 V4L steps) * (20 PLL steps / 1 MHz) =
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 108/633] crypto: ccree - fix runtime PM imbalance on error
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (106 preceding siblings ...)
  2020-10-27 13:47 ` [PATCH 5.8 107/633] media: tuner-simple: fix regression in simple_set_radio_freq Greg Kroah-Hartman
@ 2020-10-27 13:47 ` Greg Kroah-Hartman
  2020-10-27 13:47 ` [PATCH 5.8 109/633] media: Revert "media: exynos4-is: Add missed check for pinctrl_lookup_state()" Greg Kroah-Hartman
                   ` (527 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dinghao Liu, Herbert Xu, Sasha Levin

From: dinghao.liu@zju.edu.cn <dinghao.liu@zju.edu.cn>

[ Upstream commit b7b57a5643c2ae45afe6aa5e73363b553cacd14b ]

pm_runtime_get_sync() increments the runtime PM usage counter
even when it returns an error code. However, users of cc_pm_get(),
a direct wrapper of pm_runtime_get_sync(), assume that PM usage
counter will not change on error. Thus a pairing decrement is needed
on the error handling path to keep the counter balanced.

Fixes: 8c7849a30255c ("crypto: ccree - simplify Runtime PM handling")
Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/ccree/cc_pm.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/crypto/ccree/cc_pm.c b/drivers/crypto/ccree/cc_pm.c
index d39e1664fc7ed..3c65bf070c908 100644
--- a/drivers/crypto/ccree/cc_pm.c
+++ b/drivers/crypto/ccree/cc_pm.c
@@ -65,8 +65,12 @@ const struct dev_pm_ops ccree_pm = {
 int cc_pm_get(struct device *dev)
 {
 	int rc = pm_runtime_get_sync(dev);
+	if (rc < 0) {
+		pm_runtime_put_noidle(dev);
+		return rc;
+	}
 
-	return (rc == 1 ? 0 : rc);
+	return 0;
 }
 
 void cc_pm_put_suspend(struct device *dev)
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 109/633] media: Revert "media: exynos4-is: Add missed check for pinctrl_lookup_state()"
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (107 preceding siblings ...)
  2020-10-27 13:47 ` [PATCH 5.8 108/633] crypto: ccree - fix runtime PM imbalance on error Greg Kroah-Hartman
@ 2020-10-27 13:47 ` Greg Kroah-Hartman
  2020-10-27 13:47 ` [PATCH 5.8 110/633] media: hantro: h264: Get the correct fallback reference buffer Greg Kroah-Hartman
                   ` (526 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sylwester Nawrocki, Hans Verkuil,
	Mauro Carvalho Chehab, Sasha Levin

From: Sylwester Nawrocki <s.nawrocki@samsung.com>

[ Upstream commit 00d21f325d58567d81d9172096692d0a9ea7f725 ]

The "idle" pinctrl state is optional as documented in the DT binding.
The change introduced by the commit being reverted makes that pinctrl state
mandatory and breaks initialization of the whole media driver, since the
"idle" state is not specified in any mainline dts.

This reverts commit 18ffec750578 ("media: exynos4-is: Add missed check for pinctrl_lookup_state()")
to fix the regression.

Fixes: 18ffec750578 ("media: exynos4-is: Add missed check for pinctrl_lookup_state()")
Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/exynos4-is/media-dev.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/drivers/media/platform/exynos4-is/media-dev.c b/drivers/media/platform/exynos4-is/media-dev.c
index 9c31d950cddf7..2f90607c3797d 100644
--- a/drivers/media/platform/exynos4-is/media-dev.c
+++ b/drivers/media/platform/exynos4-is/media-dev.c
@@ -1268,11 +1268,9 @@ static int fimc_md_get_pinctrl(struct fimc_md *fmd)
 	if (IS_ERR(pctl->state_default))
 		return PTR_ERR(pctl->state_default);
 
+	/* PINCTRL_STATE_IDLE is optional */
 	pctl->state_idle = pinctrl_lookup_state(pctl->pinctrl,
 					PINCTRL_STATE_IDLE);
-	if (IS_ERR(pctl->state_idle))
-		return PTR_ERR(pctl->state_idle);
-
 	return 0;
 }
 
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 110/633] media: hantro: h264: Get the correct fallback reference buffer
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (108 preceding siblings ...)
  2020-10-27 13:47 ` [PATCH 5.8 109/633] media: Revert "media: exynos4-is: Add missed check for pinctrl_lookup_state()" Greg Kroah-Hartman
@ 2020-10-27 13:47 ` Greg Kroah-Hartman
  2020-10-27 13:47 ` [PATCH 5.8 111/633] media: hantro: postproc: Fix motion vector space allocation Greg Kroah-Hartman
                   ` (525 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ezequiel Garcia, Philipp Zabel,
	Hans Verkuil, Mauro Carvalho Chehab, Sasha Levin

From: Ezequiel Garcia <ezequiel@collabora.com>

[ Upstream commit 6d9e8cd0553bb03e8ab9d4d2d7d17f3fb639bd86 ]

If the bitstream and the application are incorrectly configuring
the reference pictures, the hardware will need to fallback
to using some other reference picture.

When the post-processor is enabled, the fallback buffer
should be a shadow buffer (postproc.dec_q), and not a
CAPTURE queue buffer, since the latter is post-processed
and not really the output of the decoder core.

Fixes: 8c2d66b036c77 ("media: hantro: Support color conversion via post-processing")
Signed-off-by: Ezequiel Garcia <ezequiel@collabora.com>
Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/staging/media/hantro/hantro_h264.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/media/hantro/hantro_h264.c b/drivers/staging/media/hantro/hantro_h264.c
index d561f125085a7..d72ebbd17a692 100644
--- a/drivers/staging/media/hantro/hantro_h264.c
+++ b/drivers/staging/media/hantro/hantro_h264.c
@@ -327,7 +327,7 @@ dma_addr_t hantro_h264_get_ref_buf(struct hantro_ctx *ctx,
 		 */
 		dst_buf = hantro_get_dst_buf(ctx);
 		buf = &dst_buf->vb2_buf;
-		dma_addr = vb2_dma_contig_plane_dma_addr(buf, 0);
+		dma_addr = hantro_get_dec_buf_addr(ctx, buf);
 	}
 
 	return dma_addr;
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 111/633] media: hantro: postproc: Fix motion vector space allocation
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (109 preceding siblings ...)
  2020-10-27 13:47 ` [PATCH 5.8 110/633] media: hantro: h264: Get the correct fallback reference buffer Greg Kroah-Hartman
@ 2020-10-27 13:47 ` Greg Kroah-Hartman
  2020-10-27 13:47 ` [PATCH 5.8 112/633] media: ov5640: Correct Bit Div register in clock tree diagram Greg Kroah-Hartman
                   ` (524 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ezequiel Garcia, Philipp Zabel,
	Hans Verkuil, Mauro Carvalho Chehab, Sasha Levin

From: Ezequiel Garcia <ezequiel@collabora.com>

[ Upstream commit 669ccf19ed2059b9d517664a2dbbf6bde87e1414 ]

When the post-processor is enabled, the driver allocates
"shadow buffers" which are used for the decoder core,
and exposes the post-processed buffers to userspace.

For this reason, extra motion vector space has to
be allocated on the shadow buffers, which the driver
wasn't doing. Fix it.

This fix should address artifacts on high profile bitstreams.

Fixes: 8c2d66b036c77 ("media: hantro: Support color conversion via post-processing")
Signed-off-by: Ezequiel Garcia <ezequiel@collabora.com>
Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/staging/media/hantro/hantro_postproc.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/staging/media/hantro/hantro_postproc.c b/drivers/staging/media/hantro/hantro_postproc.c
index 44062ffceaea7..6d2a8f2a8f0bb 100644
--- a/drivers/staging/media/hantro/hantro_postproc.c
+++ b/drivers/staging/media/hantro/hantro_postproc.c
@@ -118,7 +118,9 @@ int hantro_postproc_alloc(struct hantro_ctx *ctx)
 	unsigned int num_buffers = cap_queue->num_buffers;
 	unsigned int i, buf_size;
 
-	buf_size = ctx->dst_fmt.plane_fmt[0].sizeimage;
+	buf_size = ctx->dst_fmt.plane_fmt[0].sizeimage +
+		   hantro_h264_mv_size(ctx->dst_fmt.width,
+				       ctx->dst_fmt.height);
 
 	for (i = 0; i < num_buffers; ++i) {
 		struct hantro_aux_buf *priv = &ctx->postproc.dec_q[i];
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 112/633] media: ov5640: Correct Bit Div register in clock tree diagram
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (110 preceding siblings ...)
  2020-10-27 13:47 ` [PATCH 5.8 111/633] media: hantro: postproc: Fix motion vector space allocation Greg Kroah-Hartman
@ 2020-10-27 13:47 ` Greg Kroah-Hartman
  2020-10-27 13:47 ` [PATCH 5.8 113/633] media: m5mols: Check function pointer in m5mols_sensor_power Greg Kroah-Hartman
                   ` (523 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Paul Kocialkowski, Jacopo Mondi,
	Sakari Ailus, Mauro Carvalho Chehab, Sasha Levin

From: Paul Kocialkowski <paul.kocialkowski@bootlin.com>

[ Upstream commit 4c85f628f6639e3e3e0a7788416154f28dfcae4f ]

Although the code is correct and doing the right thing, the clock diagram
showed the wrong register for the bit divider, which had me doubting the
understanding of the tree. Fix this to avoid doubts in the future.

Signed-off-by: Paul Kocialkowski <paul.kocialkowski@bootlin.com>
Fixes: aa2882481cada ("media: ov5640: Adjust the clock based on the expected rate")
Acked-by: Jacopo Mondi <jacopo@jmondi.org>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/i2c/ov5640.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/i2c/ov5640.c b/drivers/media/i2c/ov5640.c
index 2fe4a7ac05929..ab19e04720d3a 100644
--- a/drivers/media/i2c/ov5640.c
+++ b/drivers/media/i2c/ov5640.c
@@ -751,7 +751,7 @@ static int ov5640_mod_reg(struct ov5640_dev *sensor, u16 reg,
  *               +->| PLL Root Div | - reg 0x3037, bit 4
  *                  +-+------------+
  *                    |  +---------+
- *                    +->| Bit Div | - reg 0x3035, bits 0-3
+ *                    +->| Bit Div | - reg 0x3034, bits 0-3
  *                       +-+-------+
  *                         |  +-------------+
  *                         +->| SCLK Div    | - reg 0x3108, bits 0-1
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 113/633] media: m5mols: Check function pointer in m5mols_sensor_power
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (111 preceding siblings ...)
  2020-10-27 13:47 ` [PATCH 5.8 112/633] media: ov5640: Correct Bit Div register in clock tree diagram Greg Kroah-Hartman
@ 2020-10-27 13:47 ` Greg Kroah-Hartman
  2020-10-27 13:47 ` [PATCH 5.8 114/633] fscrypt: restrict IV_INO_LBLK_32 to ino_bits <= 32 Greg Kroah-Hartman
                   ` (522 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Tom Rix, Sakari Ailus,
	Mauro Carvalho Chehab, Sasha Levin

From: Tom Rix <trix@redhat.com>

[ Upstream commit 52438c4463ac904d14bf3496765e67750766f3a6 ]

clang static analysis reports this error

m5mols_core.c:767:4: warning: Called function pointer
  is null (null dereference) [core.CallAndMessage]
    info->set_power(&client->dev, 0);
    ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

In other places, the set_power ptr is checked.
So add a check.

Fixes: bc125106f8af ("[media] Add support for M-5MOLS 8 Mega Pixel camera ISP")
Signed-off-by: Tom Rix <trix@redhat.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/i2c/m5mols/m5mols_core.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/media/i2c/m5mols/m5mols_core.c b/drivers/media/i2c/m5mols/m5mols_core.c
index de295114ca482..21666d705e372 100644
--- a/drivers/media/i2c/m5mols/m5mols_core.c
+++ b/drivers/media/i2c/m5mols/m5mols_core.c
@@ -764,7 +764,8 @@ static int m5mols_sensor_power(struct m5mols_info *info, bool enable)
 
 		ret = regulator_bulk_enable(ARRAY_SIZE(supplies), supplies);
 		if (ret) {
-			info->set_power(&client->dev, 0);
+			if (info->set_power)
+				info->set_power(&client->dev, 0);
 			return ret;
 		}
 
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 114/633] fscrypt: restrict IV_INO_LBLK_32 to ino_bits <= 32
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (112 preceding siblings ...)
  2020-10-27 13:47 ` [PATCH 5.8 113/633] media: m5mols: Check function pointer in m5mols_sensor_power Greg Kroah-Hartman
@ 2020-10-27 13:47 ` Greg Kroah-Hartman
  2020-10-27 13:47 ` [PATCH 5.8 115/633] media: uvcvideo: Set media controller entity functions Greg Kroah-Hartman
                   ` (521 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jeff Layton, Eric Biggers, Sasha Levin

From: Eric Biggers <ebiggers@google.com>

[ Upstream commit 5e895bd4d5233cb054447d0491d4e63c8496d419 ]

When an encryption policy has the IV_INO_LBLK_32 flag set, the IV
generation method involves hashing the inode number.  This is different
from fscrypt's other IV generation methods, where the inode number is
either not used at all or is included directly in the IVs.

Therefore, in principle IV_INO_LBLK_32 can work with any length inode
number.  However, currently fscrypt gets the inode number from
inode::i_ino, which is 'unsigned long'.  So currently the implementation
limit is actually 32 bits (like IV_INO_LBLK_64), since longer inode
numbers will have been truncated by the VFS on 32-bit platforms.

Fix fscrypt_supported_v2_policy() to enforce the correct limit.

This doesn't actually matter currently, since only ext4 and f2fs support
IV_INO_LBLK_32, and they both only support 32-bit inode numbers.  But we
might as well fix it in case it matters in the future.

Ideally inode::i_ino would instead be made 64-bit, but for now it's not
needed.  (Note, this limit does *not* prevent filesystems with 64-bit
inode numbers from adding fscrypt support, since IV_INO_LBLK_* support
is optional and is useful only on certain hardware.)

Fixes: e3b1078bedd3 ("fscrypt: add support for IV_INO_LBLK_32 policies")
Reported-by: Jeff Layton <jlayton@kernel.org>
Link: https://lore.kernel.org/r/20200824203841.1707847-1-ebiggers@kernel.org
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/crypto/policy.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/fs/crypto/policy.c b/fs/crypto/policy.c
index d23ff162c78bc..0b32c64eb4053 100644
--- a/fs/crypto/policy.c
+++ b/fs/crypto/policy.c
@@ -178,10 +178,15 @@ static bool fscrypt_supported_v2_policy(const struct fscrypt_policy_v2 *policy,
 					  32, 32))
 		return false;
 
+	/*
+	 * IV_INO_LBLK_32 hashes the inode number, so in principle it can
+	 * support any ino_bits.  However, currently the inode number is gotten
+	 * from inode::i_ino which is 'unsigned long'.  So for now the
+	 * implementation limit is 32 bits.
+	 */
 	if ((policy->flags & FSCRYPT_POLICY_FLAG_IV_INO_LBLK_32) &&
-	    /* This uses hashed inode numbers, so ino_bits doesn't matter. */
 	    !supported_iv_ino_lblk_policy(policy, inode, "IV_INO_LBLK_32",
-					  INT_MAX, 32))
+					  32, 32))
 		return false;
 
 	if (memchr_inv(policy->__reserved, 0, sizeof(policy->__reserved))) {
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 115/633] media: uvcvideo: Set media controller entity functions
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (113 preceding siblings ...)
  2020-10-27 13:47 ` [PATCH 5.8 114/633] fscrypt: restrict IV_INO_LBLK_32 to ino_bits <= 32 Greg Kroah-Hartman
@ 2020-10-27 13:47 ` Greg Kroah-Hartman
  2020-10-27 13:47 ` [PATCH 5.8 116/633] media: uvcvideo: Silence shift-out-of-bounds warning Greg Kroah-Hartman
                   ` (520 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Laurent Pinchart, Kieran Bingham,
	Mauro Carvalho Chehab, Sasha Levin

From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>

[ Upstream commit d6834b4b58d110814aaf3469e7fd87d34ae5ae81 ]

The media controller core prints a warning when an entity is registered
without a function being set. This affects the uvcvideo driver, as the
warning was added without first addressing the issue in existing
drivers. The problem is harmless, but unnecessarily worries users. Fix
it by mapping UVC entity types to MC entity functions as accurately as
possible using the existing functions.

Fixes: b50bde4e476d ("[media] v4l2-subdev: use MEDIA_ENT_T_UNKNOWN for new subdevs")
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Reviewed-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/usb/uvc/uvc_entity.c | 35 ++++++++++++++++++++++++++++++
 1 file changed, 35 insertions(+)

diff --git a/drivers/media/usb/uvc/uvc_entity.c b/drivers/media/usb/uvc/uvc_entity.c
index b4499cddeffe5..ca3a9c2eec271 100644
--- a/drivers/media/usb/uvc/uvc_entity.c
+++ b/drivers/media/usb/uvc/uvc_entity.c
@@ -73,10 +73,45 @@ static int uvc_mc_init_entity(struct uvc_video_chain *chain,
 	int ret;
 
 	if (UVC_ENTITY_TYPE(entity) != UVC_TT_STREAMING) {
+		u32 function;
+
 		v4l2_subdev_init(&entity->subdev, &uvc_subdev_ops);
 		strscpy(entity->subdev.name, entity->name,
 			sizeof(entity->subdev.name));
 
+		switch (UVC_ENTITY_TYPE(entity)) {
+		case UVC_VC_SELECTOR_UNIT:
+			function = MEDIA_ENT_F_VID_MUX;
+			break;
+		case UVC_VC_PROCESSING_UNIT:
+		case UVC_VC_EXTENSION_UNIT:
+			/* For lack of a better option. */
+			function = MEDIA_ENT_F_PROC_VIDEO_PIXEL_FORMATTER;
+			break;
+		case UVC_COMPOSITE_CONNECTOR:
+		case UVC_COMPONENT_CONNECTOR:
+			function = MEDIA_ENT_F_CONN_COMPOSITE;
+			break;
+		case UVC_SVIDEO_CONNECTOR:
+			function = MEDIA_ENT_F_CONN_SVIDEO;
+			break;
+		case UVC_ITT_CAMERA:
+			function = MEDIA_ENT_F_CAM_SENSOR;
+			break;
+		case UVC_TT_VENDOR_SPECIFIC:
+		case UVC_ITT_VENDOR_SPECIFIC:
+		case UVC_ITT_MEDIA_TRANSPORT_INPUT:
+		case UVC_OTT_VENDOR_SPECIFIC:
+		case UVC_OTT_DISPLAY:
+		case UVC_OTT_MEDIA_TRANSPORT_OUTPUT:
+		case UVC_EXTERNAL_VENDOR_SPECIFIC:
+		default:
+			function = MEDIA_ENT_F_V4L2_SUBDEV_UNKNOWN;
+			break;
+		}
+
+		entity->subdev.entity.function = function;
+
 		ret = media_entity_pads_init(&entity->subdev.entity,
 					entity->num_pads, entity->pads);
 
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 116/633] media: uvcvideo: Silence shift-out-of-bounds warning
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (114 preceding siblings ...)
  2020-10-27 13:47 ` [PATCH 5.8 115/633] media: uvcvideo: Set media controller entity functions Greg Kroah-Hartman
@ 2020-10-27 13:47 ` Greg Kroah-Hartman
  2020-10-27 13:47 ` [PATCH 5.8 117/633] media: staging/intel-ipu3: css: Correctly reset some memory Greg Kroah-Hartman
                   ` (519 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Bart Van Assche, Laurent Pinchart,
	Mauro Carvalho Chehab, Sasha Levin

From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>

[ Upstream commit 171994e498a0426cbe17f874c5c6af3c0af45200 ]

UBSAN reports a shift-out-of-bounds warning in uvc_get_le_value(). The
report is correct, but the issue should be harmless as the computed
value isn't used when the shift is negative. This may however cause
incorrect behaviour if a negative shift could generate adverse side
effects (such as a trap on some architectures for instance).

Regardless of whether that may happen or not, silence the warning as a
full WARN backtrace isn't nice.

Reported-by: Bart Van Assche <bvanassche@acm.org>
Fixes: c0efd232929c ("V4L/DVB (8145a): USB Video Class driver")
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Tested-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/usb/uvc/uvc_ctrl.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c
index e399b9fad7574..a30a8a731eda8 100644
--- a/drivers/media/usb/uvc/uvc_ctrl.c
+++ b/drivers/media/usb/uvc/uvc_ctrl.c
@@ -773,12 +773,16 @@ static s32 uvc_get_le_value(struct uvc_control_mapping *mapping,
 	offset &= 7;
 	mask = ((1LL << bits) - 1) << offset;
 
-	for (; bits > 0; data++) {
+	while (1) {
 		u8 byte = *data & mask;
 		value |= offset > 0 ? (byte >> offset) : (byte << (-offset));
 		bits -= 8 - (offset > 0 ? offset : 0);
+		if (bits <= 0)
+			break;
+
 		offset -= 8;
 		mask = (1 << bits) - 1;
+		data++;
 	}
 
 	/* Sign-extend the value if needed. */
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 117/633] media: staging/intel-ipu3: css: Correctly reset some memory
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (115 preceding siblings ...)
  2020-10-27 13:47 ` [PATCH 5.8 116/633] media: uvcvideo: Silence shift-out-of-bounds warning Greg Kroah-Hartman
@ 2020-10-27 13:47 ` Greg Kroah-Hartman
  2020-10-27 13:47 ` [PATCH 5.8 118/633] media: omap3isp: Fix memleak in isp_probe Greg Kroah-Hartman
                   ` (518 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christophe JAILLET, Bingbu Cao,
	Sakari Ailus, Mauro Carvalho Chehab, Sasha Levin

From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>

[ Upstream commit 08913a8e458e03f886a1a1154a6501fcb9344c39 ]

The intent here is to reset the whole 'scaler_coeffs_luma' array, not just
the first element.

Fixes: e11110a5b744 ("media: staging/intel-ipu3: css: Compute and program ccs")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Reviewed-by: Bingbu Cao <bingbu.cao@intel.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/staging/media/ipu3/ipu3-css-params.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/media/ipu3/ipu3-css-params.c b/drivers/staging/media/ipu3/ipu3-css-params.c
index fbd53d7c097cd..e9d6bd9e9332a 100644
--- a/drivers/staging/media/ipu3/ipu3-css-params.c
+++ b/drivers/staging/media/ipu3/ipu3-css-params.c
@@ -159,7 +159,7 @@ imgu_css_scaler_calc(u32 input_width, u32 input_height, u32 target_width,
 
 	memset(&cfg->scaler_coeffs_chroma, 0,
 	       sizeof(cfg->scaler_coeffs_chroma));
-	memset(&cfg->scaler_coeffs_luma, 0, sizeof(*cfg->scaler_coeffs_luma));
+	memset(&cfg->scaler_coeffs_luma, 0, sizeof(cfg->scaler_coeffs_luma));
 	do {
 		phase_step_correction++;
 
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 118/633] media: omap3isp: Fix memleak in isp_probe
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (116 preceding siblings ...)
  2020-10-27 13:47 ` [PATCH 5.8 117/633] media: staging/intel-ipu3: css: Correctly reset some memory Greg Kroah-Hartman
@ 2020-10-27 13:47 ` Greg Kroah-Hartman
  2020-10-27 13:47 ` [PATCH 5.8 119/633] media: i2c: ov5640: Remain in power down for DVP mode unless streaming Greg Kroah-Hartman
                   ` (517 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dinghao Liu, Sakari Ailus,
	Mauro Carvalho Chehab, Sasha Levin

From: Dinghao Liu <dinghao.liu@zju.edu.cn>

[ Upstream commit d8fc21c17099635e8ebd986d042be65a6c6b5bd0 ]

When devm_ioremap_resource() fails, isp should be
freed just like other error paths in isp_probe.

Fixes: 8644cdf972dd6 ("[media] omap3isp: Replace many MMIO regions by two")
Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/omap3isp/isp.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/media/platform/omap3isp/isp.c b/drivers/media/platform/omap3isp/isp.c
index b91e472ee764e..de066757726de 100644
--- a/drivers/media/platform/omap3isp/isp.c
+++ b/drivers/media/platform/omap3isp/isp.c
@@ -2328,8 +2328,10 @@ static int isp_probe(struct platform_device *pdev)
 		mem = platform_get_resource(pdev, IORESOURCE_MEM, i);
 		isp->mmio_base[map_idx] =
 			devm_ioremap_resource(isp->dev, mem);
-		if (IS_ERR(isp->mmio_base[map_idx]))
-			return PTR_ERR(isp->mmio_base[map_idx]);
+		if (IS_ERR(isp->mmio_base[map_idx])) {
+			ret = PTR_ERR(isp->mmio_base[map_idx]);
+			goto error;
+		}
 	}
 
 	ret = isp_get_clocks(isp);
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 119/633] media: i2c: ov5640: Remain in power down for DVP mode unless streaming
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (117 preceding siblings ...)
  2020-10-27 13:47 ` [PATCH 5.8 118/633] media: omap3isp: Fix memleak in isp_probe Greg Kroah-Hartman
@ 2020-10-27 13:47 ` Greg Kroah-Hartman
  2020-10-27 13:47 ` [PATCH 5.8 120/633] media: i2c: ov5640: Separate out mipi configuration from s_power Greg Kroah-Hartman
                   ` (516 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lad Prabhakar, Biju Das,
	Jacopo Mondi, Sakari Ailus, Mauro Carvalho Chehab, Sasha Levin

From: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>

[ Upstream commit 3b987d70e903962eb8c5961ba166c345a49d1a0b ]

Keep the sensor in software power down mode and wake up only in
ov5640_set_stream_dvp() callback.

Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
Reviewed-by: Biju Das <biju.das.jz@bp.renesas.com>
Tested-by: Jacopo Mondi <jacopo@jmondi.org>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/i2c/ov5640.c | 19 ++++++++++++++++---
 1 file changed, 16 insertions(+), 3 deletions(-)

diff --git a/drivers/media/i2c/ov5640.c b/drivers/media/i2c/ov5640.c
index ab19e04720d3a..6e558a7e2d244 100644
--- a/drivers/media/i2c/ov5640.c
+++ b/drivers/media/i2c/ov5640.c
@@ -34,6 +34,8 @@
 #define OV5640_REG_SYS_RESET02		0x3002
 #define OV5640_REG_SYS_CLOCK_ENABLE02	0x3006
 #define OV5640_REG_SYS_CTRL0		0x3008
+#define OV5640_REG_SYS_CTRL0_SW_PWDN	0x42
+#define OV5640_REG_SYS_CTRL0_SW_PWUP	0x02
 #define OV5640_REG_CHIP_ID		0x300a
 #define OV5640_REG_IO_MIPI_CTRL00	0x300e
 #define OV5640_REG_PAD_OUTPUT_ENABLE01	0x3017
@@ -1120,6 +1122,12 @@ static int ov5640_load_regs(struct ov5640_dev *sensor,
 		val = regs->val;
 		mask = regs->mask;
 
+		/* remain in power down mode for DVP */
+		if (regs->reg_addr == OV5640_REG_SYS_CTRL0 &&
+		    val == OV5640_REG_SYS_CTRL0_SW_PWUP &&
+		    sensor->ep.bus_type != V4L2_MBUS_CSI2_DPHY)
+			continue;
+
 		if (mask)
 			ret = ov5640_mod_reg(sensor, reg_addr, mask, val);
 		else
@@ -1297,9 +1305,14 @@ static int ov5640_set_stream_dvp(struct ov5640_dev *sensor, bool on)
 	 * PAD OUTPUT ENABLE 02
 	 * - [7:2]:	D[5:0] output enable
 	 */
-	return ov5640_write_reg(sensor,
-				OV5640_REG_PAD_OUTPUT_ENABLE02,
-				on ? 0xfc : 0);
+	ret = ov5640_write_reg(sensor, OV5640_REG_PAD_OUTPUT_ENABLE02,
+			       on ? 0xfc : 0);
+	if (ret)
+		return ret;
+
+	return ov5640_write_reg(sensor, OV5640_REG_SYS_CTRL0, on ?
+				OV5640_REG_SYS_CTRL0_SW_PWUP :
+				OV5640_REG_SYS_CTRL0_SW_PWDN);
 }
 
 static int ov5640_set_stream_mipi(struct ov5640_dev *sensor, bool on)
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 120/633] media: i2c: ov5640: Separate out mipi configuration from s_power
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (118 preceding siblings ...)
  2020-10-27 13:47 ` [PATCH 5.8 119/633] media: i2c: ov5640: Remain in power down for DVP mode unless streaming Greg Kroah-Hartman
@ 2020-10-27 13:47 ` Greg Kroah-Hartman
  2020-10-27 13:47 ` [PATCH 5.8 121/633] media: i2c: ov5640: Enable data pins on poweron for DVP mode Greg Kroah-Hartman
                   ` (515 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lad Prabhakar, Biju Das,
	Jacopo Mondi, Sakari Ailus, Mauro Carvalho Chehab, Sasha Levin

From: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>

[ Upstream commit b1751ae652fb95919c08df5bdd739ccf9886158a ]

In preparation for adding DVP configuration in s_power callback
move mipi configuration into separate function

Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
Reviewed-by: Biju Das <biju.das.jz@bp.renesas.com>
Tested-by: Jacopo Mondi <jacopo@jmondi.org>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/i2c/ov5640.c | 116 +++++++++++++++++++------------------
 1 file changed, 60 insertions(+), 56 deletions(-)

diff --git a/drivers/media/i2c/ov5640.c b/drivers/media/i2c/ov5640.c
index 6e558a7e2d244..90db5443c4248 100644
--- a/drivers/media/i2c/ov5640.c
+++ b/drivers/media/i2c/ov5640.c
@@ -2014,6 +2014,61 @@ static void ov5640_set_power_off(struct ov5640_dev *sensor)
 	clk_disable_unprepare(sensor->xclk);
 }
 
+static int ov5640_set_power_mipi(struct ov5640_dev *sensor, bool on)
+{
+	int ret;
+
+	if (!on) {
+		/* Reset MIPI bus settings to their default values. */
+		ov5640_write_reg(sensor, OV5640_REG_IO_MIPI_CTRL00, 0x58);
+		ov5640_write_reg(sensor, OV5640_REG_MIPI_CTRL00, 0x04);
+		ov5640_write_reg(sensor, OV5640_REG_PAD_OUTPUT00, 0x00);
+		return 0;
+	}
+
+	/*
+	 * Power up MIPI HS Tx and LS Rx; 2 data lanes mode
+	 *
+	 * 0x300e = 0x40
+	 * [7:5] = 010	: 2 data lanes mode (see FIXME note in
+	 *		  "ov5640_set_stream_mipi()")
+	 * [4] = 0	: Power up MIPI HS Tx
+	 * [3] = 0	: Power up MIPI LS Rx
+	 * [2] = 0	: MIPI interface disabled
+	 */
+	ret = ov5640_write_reg(sensor, OV5640_REG_IO_MIPI_CTRL00, 0x40);
+	if (ret)
+		return ret;
+
+	/*
+	 * Gate clock and set LP11 in 'no packets mode' (idle)
+	 *
+	 * 0x4800 = 0x24
+	 * [5] = 1	: Gate clock when 'no packets'
+	 * [2] = 1	: MIPI bus in LP11 when 'no packets'
+	 */
+	ret = ov5640_write_reg(sensor, OV5640_REG_MIPI_CTRL00, 0x24);
+	if (ret)
+		return ret;
+
+	/*
+	 * Set data lanes and clock in LP11 when 'sleeping'
+	 *
+	 * 0x3019 = 0x70
+	 * [6] = 1	: MIPI data lane 2 in LP11 when 'sleeping'
+	 * [5] = 1	: MIPI data lane 1 in LP11 when 'sleeping'
+	 * [4] = 1	: MIPI clock lane in LP11 when 'sleeping'
+	 */
+	ret = ov5640_write_reg(sensor, OV5640_REG_PAD_OUTPUT00, 0x70);
+	if (ret)
+		return ret;
+
+	/* Give lanes some time to coax into LP11 state. */
+	usleep_range(500, 1000);
+
+	return 0;
+}
+
 static int ov5640_set_power(struct ov5640_dev *sensor, bool on)
 {
 	int ret = 0;
@@ -2026,67 +2081,16 @@ static int ov5640_set_power(struct ov5640_dev *sensor, bool on)
 		ret = ov5640_restore_mode(sensor);
 		if (ret)
 			goto power_off;
+	}
 
-		/* We're done here for DVP bus, while CSI-2 needs setup. */
-		if (sensor->ep.bus_type != V4L2_MBUS_CSI2_DPHY)
-			return 0;
-
-		/*
-		 * Power up MIPI HS Tx and LS Rx; 2 data lanes mode
-		 *
-		 * 0x300e = 0x40
-		 * [7:5] = 010	: 2 data lanes mode (see FIXME note in
-		 *		  "ov5640_set_stream_mipi()")
-		 * [4] = 0	: Power up MIPI HS Tx
-		 * [3] = 0	: Power up MIPI LS Rx
-		 * [2] = 0	: MIPI interface disabled
-		 */
-		ret = ov5640_write_reg(sensor,
-				       OV5640_REG_IO_MIPI_CTRL00, 0x40);
-		if (ret)
-			goto power_off;
-
-		/*
-		 * Gate clock and set LP11 in 'no packets mode' (idle)
-		 *
-		 * 0x4800 = 0x24
-		 * [5] = 1	: Gate clock when 'no packets'
-		 * [2] = 1	: MIPI bus in LP11 when 'no packets'
-		 */
-		ret = ov5640_write_reg(sensor,
-				       OV5640_REG_MIPI_CTRL00, 0x24);
-		if (ret)
-			goto power_off;
-
-		/*
-		 * Set data lanes and clock in LP11 when 'sleeping'
-		 *
-		 * 0x3019 = 0x70
-		 * [6] = 1	: MIPI data lane 2 in LP11 when 'sleeping'
-		 * [5] = 1	: MIPI data lane 1 in LP11 when 'sleeping'
-		 * [4] = 1	: MIPI clock lane in LP11 when 'sleeping'
-		 */
-		ret = ov5640_write_reg(sensor,
-				       OV5640_REG_PAD_OUTPUT00, 0x70);
+	if (sensor->ep.bus_type == V4L2_MBUS_CSI2_DPHY) {
+		ret = ov5640_set_power_mipi(sensor, on);
 		if (ret)
 			goto power_off;
+	}
 
-		/* Give lanes some time to coax into LP11 state. */
-		usleep_range(500, 1000);
-
-	} else {
-		if (sensor->ep.bus_type == V4L2_MBUS_CSI2_DPHY) {
-			/* Reset MIPI bus settings to their default values. */
-			ov5640_write_reg(sensor,
-					 OV5640_REG_IO_MIPI_CTRL00, 0x58);
-			ov5640_write_reg(sensor,
-					 OV5640_REG_MIPI_CTRL00, 0x04);
-			ov5640_write_reg(sensor,
-					 OV5640_REG_PAD_OUTPUT00, 0x00);
-		}
-
+	if (!on)
 		ov5640_set_power_off(sensor);
-	}
 
 	return 0;
 
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 121/633] media: i2c: ov5640: Enable data pins on poweron for DVP mode
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (119 preceding siblings ...)
  2020-10-27 13:47 ` [PATCH 5.8 120/633] media: i2c: ov5640: Separate out mipi configuration from s_power Greg Kroah-Hartman
@ 2020-10-27 13:47 ` Greg Kroah-Hartman
  2020-10-27 13:47 ` [PATCH 5.8 122/633] media: rcar_drif: Fix fwnode reference leak when parsing DT Greg Kroah-Hartman
                   ` (514 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lad Prabhakar, Biju Das,
	Jacopo Mondi, Sakari Ailus, Mauro Carvalho Chehab, Sasha Levin

From: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>

[ Upstream commit 576f5d4ba8f672953513280510abf9a736b015cc ]

During testing this sensor on iW-RainboW-G21D-Qseven platform in 8-bit DVP
mode with rcar-vin bridge noticed the capture worked fine for the first run
(with yavta), but for subsequent runs the bridge driver waited for the
frame to be captured. Debugging further noticed the data lines were
enabled/disabled in stream on/off callback and dumping the register
contents 0x3017/0x3018 in ov5640_set_stream_dvp() reported the correct
values, but yet frame capturing failed.

To get around this issue data lines are enabled in s_power callback.
(Also the sensor remains in power down mode if not streaming so power
consumption shouldn't be affected)

Fixes: f22996db44e2d ("media: ov5640: add support of DVP parallel interface")
Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
Reviewed-by: Biju Das <biju.das.jz@bp.renesas.com>
Tested-by: Jacopo Mondi <jacopo@jmondi.org>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/i2c/ov5640.c | 73 +++++++++++++++++++++-----------------
 1 file changed, 40 insertions(+), 33 deletions(-)

diff --git a/drivers/media/i2c/ov5640.c b/drivers/media/i2c/ov5640.c
index 90db5443c4248..3a4268aa5f023 100644
--- a/drivers/media/i2c/ov5640.c
+++ b/drivers/media/i2c/ov5640.c
@@ -276,8 +276,7 @@ static inline struct v4l2_subdev *ctrl_to_sd(struct v4l2_ctrl *ctrl)
 /* YUV422 UYVY VGA@30fps */
 static const struct reg_value ov5640_init_setting_30fps_VGA[] = {
 	{0x3103, 0x11, 0, 0}, {0x3008, 0x82, 0, 5}, {0x3008, 0x42, 0, 0},
-	{0x3103, 0x03, 0, 0}, {0x3017, 0x00, 0, 0}, {0x3018, 0x00, 0, 0},
-	{0x3630, 0x36, 0, 0},
+	{0x3103, 0x03, 0, 0}, {0x3630, 0x36, 0, 0},
 	{0x3631, 0x0e, 0, 0}, {0x3632, 0xe2, 0, 0}, {0x3633, 0x12, 0, 0},
 	{0x3621, 0xe0, 0, 0}, {0x3704, 0xa0, 0, 0}, {0x3703, 0x5a, 0, 0},
 	{0x3715, 0x78, 0, 0}, {0x3717, 0x01, 0, 0}, {0x370b, 0x60, 0, 0},
@@ -1283,33 +1282,6 @@ static int ov5640_set_stream_dvp(struct ov5640_dev *sensor, bool on)
 	if (ret)
 		return ret;
 
-	/*
-	 * enable VSYNC/HREF/PCLK DVP control lines
-	 * & D[9:6] DVP data lines
-	 *
-	 * PAD OUTPUT ENABLE 01
-	 * - 6:		VSYNC output enable
-	 * - 5:		HREF output enable
-	 * - 4:		PCLK output enable
-	 * - [3:0]:	D[9:6] output enable
-	 */
-	ret = ov5640_write_reg(sensor,
-			       OV5640_REG_PAD_OUTPUT_ENABLE01,
-			       on ? 0x7f : 0);
-	if (ret)
-		return ret;
-
-	/*
-	 * enable D[5:0] DVP data lines
-	 *
-	 * PAD OUTPUT ENABLE 02
-	 * - [7:2]:	D[5:0] output enable
-	 */
-	ret = ov5640_write_reg(sensor, OV5640_REG_PAD_OUTPUT_ENABLE02,
-			       on ? 0xfc : 0);
-	if (ret)
-		return ret;
-
 	return ov5640_write_reg(sensor, OV5640_REG_SYS_CTRL0, on ?
 				OV5640_REG_SYS_CTRL0_SW_PWUP :
 				OV5640_REG_SYS_CTRL0_SW_PWDN);
@@ -2069,6 +2041,40 @@ static int ov5640_set_power_mipi(struct ov5640_dev *sensor, bool on)
 	return 0;
 }
 
+static int ov5640_set_power_dvp(struct ov5640_dev *sensor, bool on)
+{
+	int ret;
+
+	if (!on) {
+		/* Reset settings to their default values. */
+		ov5640_write_reg(sensor, OV5640_REG_PAD_OUTPUT_ENABLE01, 0x00);
+		ov5640_write_reg(sensor, OV5640_REG_PAD_OUTPUT_ENABLE02, 0x00);
+		return 0;
+	}
+
+	/*
+	 * enable VSYNC/HREF/PCLK DVP control lines
+	 * & D[9:6] DVP data lines
+	 *
+	 * PAD OUTPUT ENABLE 01
+	 * - 6:		VSYNC output enable
+	 * - 5:		HREF output enable
+	 * - 4:		PCLK output enable
+	 * - [3:0]:	D[9:6] output enable
+	 */
+	ret = ov5640_write_reg(sensor, OV5640_REG_PAD_OUTPUT_ENABLE01, 0x7f);
+	if (ret)
+		return ret;
+
+	/*
+	 * enable D[5:0] DVP data lines
+	 *
+	 * PAD OUTPUT ENABLE 02
+	 * - [7:2]:	D[5:0] output enable
+	 */
+	return ov5640_write_reg(sensor, OV5640_REG_PAD_OUTPUT_ENABLE02, 0xfc);
+}
+
 static int ov5640_set_power(struct ov5640_dev *sensor, bool on)
 {
 	int ret = 0;
@@ -2083,11 +2089,12 @@ static int ov5640_set_power(struct ov5640_dev *sensor, bool on)
 			goto power_off;
 	}
 
-	if (sensor->ep.bus_type == V4L2_MBUS_CSI2_DPHY) {
+	if (sensor->ep.bus_type == V4L2_MBUS_CSI2_DPHY)
 		ret = ov5640_set_power_mipi(sensor, on);
-		if (ret)
-			goto power_off;
-	}
+	else
+		ret = ov5640_set_power_dvp(sensor, on);
+	if (ret)
+		goto power_off;
 
 	if (!on)
 		ov5640_set_power_off(sensor);
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 122/633] media: rcar_drif: Fix fwnode reference leak when parsing DT
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (120 preceding siblings ...)
  2020-10-27 13:47 ` [PATCH 5.8 121/633] media: i2c: ov5640: Enable data pins on poweron for DVP mode Greg Kroah-Hartman
@ 2020-10-27 13:47 ` Greg Kroah-Hartman
  2020-10-27 13:47 ` [PATCH 5.8 123/633] media: rcar_drif: Allocate v4l2_async_subdev dynamically Greg Kroah-Hartman
                   ` (513 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Laurent Pinchart, Sakari Ailus,
	Mauro Carvalho Chehab, Sasha Levin

From: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>

[ Upstream commit cdd4f7824994c9254acc6e415750529ea2d2cfe0 ]

The fwnode reference corresponding to the endpoint is leaked in an error
path of the rcar_drif_parse_subdevs() function. Fix it, and reorganize
fwnode reference handling in the function to release references early,
simplifying error paths.

Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/rcar_drif.c | 16 +++++-----------
 1 file changed, 5 insertions(+), 11 deletions(-)

diff --git a/drivers/media/platform/rcar_drif.c b/drivers/media/platform/rcar_drif.c
index 3d2451ac347d7..3f1e5cb8b1976 100644
--- a/drivers/media/platform/rcar_drif.c
+++ b/drivers/media/platform/rcar_drif.c
@@ -1227,28 +1227,22 @@ static int rcar_drif_parse_subdevs(struct rcar_drif_sdr *sdr)
 	if (!ep)
 		return 0;
 
+	/* Get the endpoint properties */
+	rcar_drif_get_ep_properties(sdr, ep);
+
 	fwnode = fwnode_graph_get_remote_port_parent(ep);
+	fwnode_handle_put(ep);
 	if (!fwnode) {
 		dev_warn(sdr->dev, "bad remote port parent\n");
-		fwnode_handle_put(ep);
 		return -EINVAL;
 	}
 
 	sdr->ep.asd.match.fwnode = fwnode;
 	sdr->ep.asd.match_type = V4L2_ASYNC_MATCH_FWNODE;
 	ret = v4l2_async_notifier_add_subdev(notifier, &sdr->ep.asd);
-	if (ret) {
-		fwnode_handle_put(fwnode);
-		return ret;
-	}
-
-	/* Get the endpoint properties */
-	rcar_drif_get_ep_properties(sdr, ep);
-
 	fwnode_handle_put(fwnode);
-	fwnode_handle_put(ep);
 
-	return 0;
+	return ret;
 }
 
 /* Check if the given device is the primary bond */
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 123/633] media: rcar_drif: Allocate v4l2_async_subdev dynamically
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (121 preceding siblings ...)
  2020-10-27 13:47 ` [PATCH 5.8 122/633] media: rcar_drif: Fix fwnode reference leak when parsing DT Greg Kroah-Hartman
@ 2020-10-27 13:47 ` Greg Kroah-Hartman
  2020-10-27 13:47 ` [PATCH 5.8 124/633] media: rcar-csi2: " Greg Kroah-Hartman
                   ` (512 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Laurent Pinchart, Sakari Ailus,
	Mauro Carvalho Chehab, Sasha Levin

From: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>

[ Upstream commit 468e986dac0e94194334ca6d0abf3af8c250792e ]

v4l2_async_notifier_add_subdev() requires the asd to be allocated
dynamically, but the rcar-drif driver embeds it in the
rcar_drif_graph_ep structure. This causes memory corruption when the
notifier is destroyed at remove time with v4l2_async_notifier_cleanup().

Fix this issue by registering the asd with
v4l2_async_notifier_add_fwnode_subdev(), which allocates it dynamically
internally.

Fixes: d079f94c9046 ("media: platform: Switch to v4l2_async_notifier_add_subdev")
Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/rcar_drif.c | 18 ++++++------------
 1 file changed, 6 insertions(+), 12 deletions(-)

diff --git a/drivers/media/platform/rcar_drif.c b/drivers/media/platform/rcar_drif.c
index 3f1e5cb8b1976..f318cd4b8086f 100644
--- a/drivers/media/platform/rcar_drif.c
+++ b/drivers/media/platform/rcar_drif.c
@@ -185,7 +185,6 @@ struct rcar_drif_frame_buf {
 /* OF graph endpoint's V4L2 async data */
 struct rcar_drif_graph_ep {
 	struct v4l2_subdev *subdev;	/* Async matched subdev */
-	struct v4l2_async_subdev asd;	/* Async sub-device descriptor */
 };
 
 /* DMA buffer */
@@ -1109,12 +1108,6 @@ static int rcar_drif_notify_bound(struct v4l2_async_notifier *notifier,
 	struct rcar_drif_sdr *sdr =
 		container_of(notifier, struct rcar_drif_sdr, notifier);
 
-	if (sdr->ep.asd.match.fwnode !=
-	    of_fwnode_handle(subdev->dev->of_node)) {
-		rdrif_err(sdr, "subdev %s cannot bind\n", subdev->name);
-		return -EINVAL;
-	}
-
 	v4l2_set_subdev_hostdata(subdev, sdr);
 	sdr->ep.subdev = subdev;
 	rdrif_dbg(sdr, "bound asd %s\n", subdev->name);
@@ -1218,7 +1211,7 @@ static int rcar_drif_parse_subdevs(struct rcar_drif_sdr *sdr)
 {
 	struct v4l2_async_notifier *notifier = &sdr->notifier;
 	struct fwnode_handle *fwnode, *ep;
-	int ret;
+	struct v4l2_async_subdev *asd;
 
 	v4l2_async_notifier_init(notifier);
 
@@ -1237,12 +1230,13 @@ static int rcar_drif_parse_subdevs(struct rcar_drif_sdr *sdr)
 		return -EINVAL;
 	}
 
-	sdr->ep.asd.match.fwnode = fwnode;
-	sdr->ep.asd.match_type = V4L2_ASYNC_MATCH_FWNODE;
-	ret = v4l2_async_notifier_add_subdev(notifier, &sdr->ep.asd);
+	asd = v4l2_async_notifier_add_fwnode_subdev(notifier, fwnode,
+						    sizeof(*asd));
 	fwnode_handle_put(fwnode);
+	if (IS_ERR(asd))
+		return PTR_ERR(asd);
 
-	return ret;
+	return 0;
 }
 
 /* Check if the given device is the primary bond */
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 124/633] media: rcar-csi2: Allocate v4l2_async_subdev dynamically
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (122 preceding siblings ...)
  2020-10-27 13:47 ` [PATCH 5.8 123/633] media: rcar_drif: Allocate v4l2_async_subdev dynamically Greg Kroah-Hartman
@ 2020-10-27 13:47 ` Greg Kroah-Hartman
  2020-10-27 13:47 ` [PATCH 5.8 125/633] spi: fsi: Handle 9 to 15 byte transfers lengths Greg Kroah-Hartman
                   ` (511 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Laurent Pinchart, Sakari Ailus,
	Mauro Carvalho Chehab, Sasha Levin

From: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>

[ Upstream commit 2cac7cbfb4099980e78244359ab9c6f056d6a7ec ]

v4l2_async_notifier_add_subdev() requires the asd to be allocated
dynamically, but the rcar-csi2 driver embeds it in the rcar_csi2
structure. This causes memory corruption when the notifier is destroyed
at remove time with v4l2_async_notifier_cleanup().

Fix this issue by registering the asd with
v4l2_async_notifier_add_fwnode_subdev(), which allocates it dynamically
internally.

Fixes: 769afd212b16 ("media: rcar-csi2: add Renesas R-Car MIPI CSI-2 receiver driver")
Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/rcar-vin/rcar-csi2.c | 24 +++++++++------------
 1 file changed, 10 insertions(+), 14 deletions(-)

diff --git a/drivers/media/platform/rcar-vin/rcar-csi2.c b/drivers/media/platform/rcar-vin/rcar-csi2.c
index 151e6a90c5fbc..d9bc8cef7db58 100644
--- a/drivers/media/platform/rcar-vin/rcar-csi2.c
+++ b/drivers/media/platform/rcar-vin/rcar-csi2.c
@@ -361,7 +361,6 @@ struct rcar_csi2 {
 	struct media_pad pads[NR_OF_RCAR_CSI2_PAD];
 
 	struct v4l2_async_notifier notifier;
-	struct v4l2_async_subdev asd;
 	struct v4l2_subdev *remote;
 
 	struct v4l2_mbus_framefmt mf;
@@ -810,6 +809,8 @@ static int rcsi2_parse_v4l2(struct rcar_csi2 *priv,
 
 static int rcsi2_parse_dt(struct rcar_csi2 *priv)
 {
+	struct v4l2_async_subdev *asd;
+	struct fwnode_handle *fwnode;
 	struct device_node *ep;
 	struct v4l2_fwnode_endpoint v4l2_ep = { .bus_type = 0 };
 	int ret;
@@ -833,24 +834,19 @@ static int rcsi2_parse_dt(struct rcar_csi2 *priv)
 		return ret;
 	}
 
-	priv->asd.match.fwnode =
-		fwnode_graph_get_remote_endpoint(of_fwnode_handle(ep));
-	priv->asd.match_type = V4L2_ASYNC_MATCH_FWNODE;
-
+	fwnode = fwnode_graph_get_remote_endpoint(of_fwnode_handle(ep));
 	of_node_put(ep);
 
-	v4l2_async_notifier_init(&priv->notifier);
-
-	ret = v4l2_async_notifier_add_subdev(&priv->notifier, &priv->asd);
-	if (ret) {
-		fwnode_handle_put(priv->asd.match.fwnode);
-		return ret;
-	}
+	dev_dbg(priv->dev, "Found '%pOF'\n", to_of_node(fwnode));
 
+	v4l2_async_notifier_init(&priv->notifier);
 	priv->notifier.ops = &rcar_csi2_notify_ops;
 
-	dev_dbg(priv->dev, "Found '%pOF'\n",
-		to_of_node(priv->asd.match.fwnode));
+	asd = v4l2_async_notifier_add_fwnode_subdev(&priv->notifier, fwnode,
+						    sizeof(*asd));
+	fwnode_handle_put(fwnode);
+	if (IS_ERR(asd))
+		return PTR_ERR(asd);
 
 	ret = v4l2_async_subdev_notifier_register(&priv->subdev,
 						  &priv->notifier);
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 125/633] spi: fsi: Handle 9 to 15 byte transfers lengths
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (123 preceding siblings ...)
  2020-10-27 13:47 ` [PATCH 5.8 124/633] media: rcar-csi2: " Greg Kroah-Hartman
@ 2020-10-27 13:47 ` Greg Kroah-Hartman
  2020-10-27 13:47 ` [PATCH 5.8 126/633] spi: fsi: Fix use of the bneq+ sequencer instruction Greg Kroah-Hartman
                   ` (510 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Brad Bishop, Eddie James,
	Joel Stanley, Mark Brown, Sasha Levin

From: Brad Bishop <bradleyb@fuzziesquirrel.com>

[ Upstream commit 2b3cef0fc757bd06ed9b83bd4c436bfa55f47370 ]

The trailing <len> - 8 bytes of transfer data in this size range is no
longer ignored.

Fixes: bbb6b2f9865b ("spi: Add FSI-attached SPI controller driver")
Signed-off-by: Brad Bishop <bradleyb@fuzziesquirrel.com>
Signed-off-by: Eddie James <eajames@linux.ibm.com>
Reviewed-by: Joel Stanley <joel@jms.id.au>
Signed-off-by: Joel Stanley <joel@jms.id.au>
Link: https://lore.kernel.org/r/20200909222857.28653-2-eajames@linux.ibm.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-fsi.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/spi/spi-fsi.c b/drivers/spi/spi-fsi.c
index 37a3e0f8e7526..8f64af0140e09 100644
--- a/drivers/spi/spi-fsi.c
+++ b/drivers/spi/spi-fsi.c
@@ -258,15 +258,15 @@ static int fsi_spi_sequence_transfer(struct fsi_spi *ctx,
 	if (loops > 1) {
 		fsi_spi_sequence_add(seq, SPI_FSI_SEQUENCE_BRANCH(idx));
 
-		if (rem)
-			fsi_spi_sequence_add(seq, rem);
-
 		rc = fsi_spi_write_reg(ctx, SPI_FSI_COUNTER_CFG,
 				       SPI_FSI_COUNTER_CFG_LOOPS(loops - 1));
 		if (rc)
 			return rc;
 	}
 
+	if (rem)
+		fsi_spi_sequence_add(seq, rem);
+
 	return 0;
 }
 
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 126/633] spi: fsi: Fix use of the bneq+ sequencer instruction
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (124 preceding siblings ...)
  2020-10-27 13:47 ` [PATCH 5.8 125/633] spi: fsi: Handle 9 to 15 byte transfers lengths Greg Kroah-Hartman
@ 2020-10-27 13:47 ` Greg Kroah-Hartman
  2020-10-27 13:47 ` [PATCH 5.8 127/633] spi: fsi: Implement restricted size for certain controllers Greg Kroah-Hartman
                   ` (509 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Brad Bishop, Eddie James,
	Joel Stanley, Mark Brown, Sasha Levin

From: Brad Bishop <bradleyb@fuzziesquirrel.com>

[ Upstream commit 7909eebb2bea7fdbb2de0aa794cf29843761ed5b ]

All of the switches in N2_count_control in the counter configuration are
required to make the branch if not equal and increment command work.
Set them when using bneq+.

A side effect of this mode requires a dummy write to TDR when both
transmitting and receiving otherwise the controller won't start shifting
receive data.

It is likely not possible to avoid TDR underrun errors in this mode and
they are harmless, so do not check for them.

Fixes: bbb6b2f9865b ("spi: Add FSI-attached SPI controller driver")
Signed-off-by: Brad Bishop <bradleyb@fuzziesquirrel.com>
Signed-off-by: Eddie James <eajames@linux.ibm.com>
Reviewed-by: Joel Stanley <joel@jms.id.au>
Signed-off-by: Joel Stanley <joel@jms.id.au>
Link: https://lore.kernel.org/r/20200909222857.28653-4-eajames@linux.ibm.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-fsi.c | 28 +++++++++++++++++++++++++---
 1 file changed, 25 insertions(+), 3 deletions(-)

diff --git a/drivers/spi/spi-fsi.c b/drivers/spi/spi-fsi.c
index 8f64af0140e09..bb18b407cdcf3 100644
--- a/drivers/spi/spi-fsi.c
+++ b/drivers/spi/spi-fsi.c
@@ -29,6 +29,10 @@
 #define SPI_FSI_ERROR			0x0
 #define SPI_FSI_COUNTER_CFG		0x1
 #define  SPI_FSI_COUNTER_CFG_LOOPS(x)	 (((u64)(x) & 0xffULL) << 32)
+#define  SPI_FSI_COUNTER_CFG_N2_RX	 BIT_ULL(8)
+#define  SPI_FSI_COUNTER_CFG_N2_TX	 BIT_ULL(9)
+#define  SPI_FSI_COUNTER_CFG_N2_IMPLICIT BIT_ULL(10)
+#define  SPI_FSI_COUNTER_CFG_N2_RELOAD	 BIT_ULL(11)
 #define SPI_FSI_CFG1			0x2
 #define SPI_FSI_CLOCK_CFG		0x3
 #define  SPI_FSI_CLOCK_CFG_MM_ENABLE	 BIT_ULL(32)
@@ -61,7 +65,7 @@
 #define  SPI_FSI_STATUS_RDR_OVERRUN	 BIT_ULL(62)
 #define  SPI_FSI_STATUS_RDR_FULL	 BIT_ULL(63)
 #define  SPI_FSI_STATUS_ANY_ERROR	 \
-	(SPI_FSI_STATUS_ERROR | SPI_FSI_STATUS_TDR_UNDERRUN | \
+	(SPI_FSI_STATUS_ERROR | \
 	 SPI_FSI_STATUS_TDR_OVERRUN | SPI_FSI_STATUS_RDR_UNDERRUN | \
 	 SPI_FSI_STATUS_RDR_OVERRUN)
 #define SPI_FSI_PORT_CTRL		0x9
@@ -238,6 +242,7 @@ static int fsi_spi_sequence_transfer(struct fsi_spi *ctx,
 	int rc;
 	u8 len = min(transfer->len, 8U);
 	u8 rem = transfer->len % len;
+	u64 cfg = 0ULL;
 
 	loops = transfer->len / len;
 
@@ -258,8 +263,14 @@ static int fsi_spi_sequence_transfer(struct fsi_spi *ctx,
 	if (loops > 1) {
 		fsi_spi_sequence_add(seq, SPI_FSI_SEQUENCE_BRANCH(idx));
 
-		rc = fsi_spi_write_reg(ctx, SPI_FSI_COUNTER_CFG,
-				       SPI_FSI_COUNTER_CFG_LOOPS(loops - 1));
+		cfg = SPI_FSI_COUNTER_CFG_LOOPS(loops - 1);
+		if (transfer->rx_buf)
+			cfg |= SPI_FSI_COUNTER_CFG_N2_RX |
+				SPI_FSI_COUNTER_CFG_N2_TX |
+				SPI_FSI_COUNTER_CFG_N2_IMPLICIT |
+				SPI_FSI_COUNTER_CFG_N2_RELOAD;
+
+		rc = fsi_spi_write_reg(ctx, SPI_FSI_COUNTER_CFG, cfg);
 		if (rc)
 			return rc;
 	}
@@ -275,6 +286,7 @@ static int fsi_spi_transfer_data(struct fsi_spi *ctx,
 {
 	int rc = 0;
 	u64 status = 0ULL;
+	u64 cfg = 0ULL;
 
 	if (transfer->tx_buf) {
 		int nb;
@@ -312,6 +324,16 @@ static int fsi_spi_transfer_data(struct fsi_spi *ctx,
 		u64 in = 0ULL;
 		u8 *rx = transfer->rx_buf;
 
+		rc = fsi_spi_read_reg(ctx, SPI_FSI_COUNTER_CFG, &cfg);
+		if (rc)
+			return rc;
+
+		if (cfg & SPI_FSI_COUNTER_CFG_N2_IMPLICIT) {
+			rc = fsi_spi_write_reg(ctx, SPI_FSI_DATA_TX, 0);
+			if (rc)
+				return rc;
+		}
+
 		while (transfer->len > recv) {
 			do {
 				rc = fsi_spi_read_reg(ctx, SPI_FSI_STATUS,
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 127/633] spi: fsi: Implement restricted size for certain controllers
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (125 preceding siblings ...)
  2020-10-27 13:47 ` [PATCH 5.8 126/633] spi: fsi: Fix use of the bneq+ sequencer instruction Greg Kroah-Hartman
@ 2020-10-27 13:47 ` Greg Kroah-Hartman
  2020-10-27 13:47 ` [PATCH 5.8 128/633] spi: dw-pci: free previously allocated IRQs if desc->setup() fails Greg Kroah-Hartman
                   ` (508 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Eddie James, Joel Stanley,
	Mark Brown, Sasha Levin

From: Eddie James <eajames@linux.ibm.com>

[ Upstream commit 49c9fc1d7c101eceaddb655e4f0e062b0c8f403b ]

Some of the FSI-attached SPI controllers cannot use the loop command in
programming the sequencer due to security requirements. Check the
devicetree compatibility that indicates this condition and restrict the
size for these controllers. Also, add more transfers directly in the
sequence up to the length of the sequence register.

Fixes: bbb6b2f9865b ("spi: Add FSI-attached SPI controller driver")
Signed-off-by: Eddie James <eajames@linux.ibm.com>
Reviewed-by: Joel Stanley <joel@jms.id.au>
Signed-off-by: Joel Stanley <joel@jms.id.au>
Link: https://lore.kernel.org/r/20200909222857.28653-6-eajames@linux.ibm.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-fsi.c | 65 +++++++++++++++++++++++++++++++++++--------
 1 file changed, 53 insertions(+), 12 deletions(-)

diff --git a/drivers/spi/spi-fsi.c b/drivers/spi/spi-fsi.c
index bb18b407cdcf3..ef5e0826a53c3 100644
--- a/drivers/spi/spi-fsi.c
+++ b/drivers/spi/spi-fsi.c
@@ -24,7 +24,8 @@
 
 #define SPI_FSI_BASE			0x70000
 #define SPI_FSI_INIT_TIMEOUT_MS		1000
-#define SPI_FSI_MAX_TRANSFER_SIZE	2048
+#define SPI_FSI_MAX_XFR_SIZE		2048
+#define SPI_FSI_MAX_XFR_SIZE_RESTRICTED	32
 
 #define SPI_FSI_ERROR			0x0
 #define SPI_FSI_COUNTER_CFG		0x1
@@ -74,6 +75,8 @@ struct fsi_spi {
 	struct device *dev;	/* SPI controller device */
 	struct fsi_device *fsi;	/* FSI2SPI CFAM engine device */
 	u32 base;
+	size_t max_xfr_size;
+	bool restricted;
 };
 
 struct fsi_spi_sequence {
@@ -209,8 +212,12 @@ static int fsi_spi_reset(struct fsi_spi *ctx)
 	if (rc)
 		return rc;
 
-	return fsi_spi_write_reg(ctx, SPI_FSI_CLOCK_CFG,
-				 SPI_FSI_CLOCK_CFG_RESET2);
+	rc = fsi_spi_write_reg(ctx, SPI_FSI_CLOCK_CFG,
+			       SPI_FSI_CLOCK_CFG_RESET2);
+	if (rc)
+		return rc;
+
+	return fsi_spi_write_reg(ctx, SPI_FSI_STATUS, 0ULL);
 }
 
 static int fsi_spi_sequence_add(struct fsi_spi_sequence *seq, u8 val)
@@ -218,8 +225,8 @@ static int fsi_spi_sequence_add(struct fsi_spi_sequence *seq, u8 val)
 	/*
 	 * Add the next byte of instruction to the 8-byte sequence register.
 	 * Then decrement the counter so that the next instruction will go in
-	 * the right place. Return the number of "slots" left in the sequence
-	 * register.
+	 * the right place. Return the index of the slot we just filled in the
+	 * sequence register.
 	 */
 	seq->data |= (u64)val << seq->bit;
 	seq->bit -= 8;
@@ -237,9 +244,11 @@ static int fsi_spi_sequence_transfer(struct fsi_spi *ctx,
 				     struct fsi_spi_sequence *seq,
 				     struct spi_transfer *transfer)
 {
+	bool docfg = false;
 	int loops;
 	int idx;
 	int rc;
+	u8 val = 0;
 	u8 len = min(transfer->len, 8U);
 	u8 rem = transfer->len % len;
 	u64 cfg = 0ULL;
@@ -247,22 +256,42 @@ static int fsi_spi_sequence_transfer(struct fsi_spi *ctx,
 	loops = transfer->len / len;
 
 	if (transfer->tx_buf) {
-		idx = fsi_spi_sequence_add(seq,
-					   SPI_FSI_SEQUENCE_SHIFT_OUT(len));
+		val = SPI_FSI_SEQUENCE_SHIFT_OUT(len);
+		idx = fsi_spi_sequence_add(seq, val);
+
 		if (rem)
 			rem = SPI_FSI_SEQUENCE_SHIFT_OUT(rem);
 	} else if (transfer->rx_buf) {
-		idx = fsi_spi_sequence_add(seq,
-					   SPI_FSI_SEQUENCE_SHIFT_IN(len));
+		val = SPI_FSI_SEQUENCE_SHIFT_IN(len);
+		idx = fsi_spi_sequence_add(seq, val);
+
 		if (rem)
 			rem = SPI_FSI_SEQUENCE_SHIFT_IN(rem);
 	} else {
 		return -EINVAL;
 	}
 
+	if (ctx->restricted) {
+		const int eidx = rem ? 5 : 6;
+
+		while (loops > 1 && idx <= eidx) {
+			idx = fsi_spi_sequence_add(seq, val);
+			loops--;
+			docfg = true;
+		}
+
+		if (loops > 1) {
+			dev_warn(ctx->dev, "No sequencer slots; aborting.\n");
+			return -EINVAL;
+		}
+	}
+
 	if (loops > 1) {
 		fsi_spi_sequence_add(seq, SPI_FSI_SEQUENCE_BRANCH(idx));
+		docfg = true;
+	}
 
+	if (docfg) {
 		cfg = SPI_FSI_COUNTER_CFG_LOOPS(loops - 1);
 		if (transfer->rx_buf)
 			cfg |= SPI_FSI_COUNTER_CFG_N2_RX |
@@ -273,6 +302,8 @@ static int fsi_spi_sequence_transfer(struct fsi_spi *ctx,
 		rc = fsi_spi_write_reg(ctx, SPI_FSI_COUNTER_CFG, cfg);
 		if (rc)
 			return rc;
+	} else {
+		fsi_spi_write_reg(ctx, SPI_FSI_COUNTER_CFG, 0ULL);
 	}
 
 	if (rem)
@@ -429,7 +460,7 @@ static int fsi_spi_transfer_one_message(struct spi_controller *ctlr,
 
 		/* Sequencer must do shift out (tx) first. */
 		if (!transfer->tx_buf ||
-		    transfer->len > SPI_FSI_MAX_TRANSFER_SIZE) {
+		    transfer->len > (ctx->max_xfr_size + 8)) {
 			rc = -EINVAL;
 			goto error;
 		}
@@ -453,7 +484,7 @@ static int fsi_spi_transfer_one_message(struct spi_controller *ctlr,
 
 			/* Sequencer can only do shift in (rx) after tx. */
 			if (next->rx_buf) {
-				if (next->len > SPI_FSI_MAX_TRANSFER_SIZE) {
+				if (next->len > ctx->max_xfr_size) {
 					rc = -EINVAL;
 					goto error;
 				}
@@ -498,7 +529,9 @@ static int fsi_spi_transfer_one_message(struct spi_controller *ctlr,
 
 static size_t fsi_spi_max_transfer_size(struct spi_device *spi)
 {
-	return SPI_FSI_MAX_TRANSFER_SIZE;
+	struct fsi_spi *ctx = spi_controller_get_devdata(spi->controller);
+
+	return ctx->max_xfr_size;
 }
 
 static int fsi_spi_probe(struct device *dev)
@@ -546,6 +579,14 @@ static int fsi_spi_probe(struct device *dev)
 		ctx->fsi = fsi;
 		ctx->base = base + SPI_FSI_BASE;
 
+		if (of_device_is_compatible(np, "ibm,fsi2spi-restricted")) {
+			ctx->restricted = true;
+			ctx->max_xfr_size = SPI_FSI_MAX_XFR_SIZE_RESTRICTED;
+		} else {
+			ctx->restricted = false;
+			ctx->max_xfr_size = SPI_FSI_MAX_XFR_SIZE;
+		}
+
 		rc = devm_spi_register_controller(dev, ctlr);
 		if (rc)
 			spi_controller_put(ctlr);
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 128/633] spi: dw-pci: free previously allocated IRQs if desc->setup() fails
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (126 preceding siblings ...)
  2020-10-27 13:47 ` [PATCH 5.8 127/633] spi: fsi: Implement restricted size for certain controllers Greg Kroah-Hartman
@ 2020-10-27 13:47 ` Greg Kroah-Hartman
  2020-10-27 13:47 ` [PATCH 5.8 129/633] crypto: omap-sham - fix digcnt register handling with export/import Greg Kroah-Hartman
                   ` (507 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Felipe Balbi, Jay Fang, Mark Brown,
	Sasha Levin

From: Jay Fang <f.fangjian@huawei.com>

[ Upstream commit 9599f341889c87e56bb944659c32490d05e2532f ]

Free previously allocated IRQs when return an error code of desc->setup()
which is not always successful. And simplify the code by adding a goto
label.

Fixes: 8f5c285f3ef5 ("SPI: designware: pci: Switch over to MSI interrupts")
CC: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Jay Fang <f.fangjian@huawei.com>
Link: https://lore.kernel.org/r/1600132969-53037-1-git-send-email-f.fangjian@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-dw-pci.c | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

diff --git a/drivers/spi/spi-dw-pci.c b/drivers/spi/spi-dw-pci.c
index 2ea73809ca345..271839a8add0e 100644
--- a/drivers/spi/spi-dw-pci.c
+++ b/drivers/spi/spi-dw-pci.c
@@ -127,18 +127,16 @@ static int spi_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 		if (desc->setup) {
 			ret = desc->setup(dws);
 			if (ret)
-				return ret;
+				goto err_free_irq_vectors;
 		}
 	} else {
-		pci_free_irq_vectors(pdev);
-		return -ENODEV;
+		ret = -ENODEV;
+		goto err_free_irq_vectors;
 	}
 
 	ret = dw_spi_add_host(&pdev->dev, dws);
-	if (ret) {
-		pci_free_irq_vectors(pdev);
-		return ret;
-	}
+	if (ret)
+		goto err_free_irq_vectors;
 
 	/* PCI hook and SPI hook use the same drv data */
 	pci_set_drvdata(pdev, dws);
@@ -152,6 +150,10 @@ static int spi_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 	pm_runtime_allow(&pdev->dev);
 
 	return 0;
+
+err_free_irq_vectors:
+	pci_free_irq_vectors(pdev);
+	return ret;
 }
 
 static void spi_pci_remove(struct pci_dev *pdev)
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 129/633] crypto: omap-sham - fix digcnt register handling with export/import
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (127 preceding siblings ...)
  2020-10-27 13:47 ` [PATCH 5.8 128/633] spi: dw-pci: free previously allocated IRQs if desc->setup() fails Greg Kroah-Hartman
@ 2020-10-27 13:47 ` Greg Kroah-Hartman
  2020-10-27 13:47 ` [PATCH 5.8 130/633] hwmon: (pmbus/max34440) Fix status register reads for MAX344{51,60,61} Greg Kroah-Hartman
                   ` (506 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Tero Kristo, Herbert Xu, Sasha Levin

From: Tero Kristo <t-kristo@ti.com>

[ Upstream commit 3faf757bad75f3fc1b2736f0431e295a073a7423 ]

Running export/import for hashes in peculiar order (mostly done by
openssl) can mess up the internal book keeping of the OMAP SHA core.
Fix by forcibly writing the correct DIGCNT back to hardware. This issue
was noticed while transitioning to openssl 1.1 support.

Fixes: 0d373d603202 ("crypto: omap-sham - Add OMAP4/AM33XX SHAM Support")
Signed-off-by: Tero Kristo <t-kristo@ti.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/omap-sham.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/crypto/omap-sham.c b/drivers/crypto/omap-sham.c
index 82691a057d2a1..bc956dfb34de6 100644
--- a/drivers/crypto/omap-sham.c
+++ b/drivers/crypto/omap-sham.c
@@ -456,6 +456,9 @@ static void omap_sham_write_ctrl_omap4(struct omap_sham_dev *dd, size_t length,
 	struct omap_sham_reqctx *ctx = ahash_request_ctx(dd->req);
 	u32 val, mask;
 
+	if (likely(ctx->digcnt))
+		omap_sham_write(dd, SHA_REG_DIGCNT(dd), ctx->digcnt);
+
 	/*
 	 * Setting ALGO_CONST only for the first iteration and
 	 * CLOSE_HASH only for the last one. Note that flags mode bits
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 130/633] hwmon: (pmbus/max34440) Fix status register reads for MAX344{51,60,61}
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (128 preceding siblings ...)
  2020-10-27 13:47 ` [PATCH 5.8 129/633] crypto: omap-sham - fix digcnt register handling with export/import Greg Kroah-Hartman
@ 2020-10-27 13:47 ` Greg Kroah-Hartman
  2020-10-27 13:47 ` [PATCH 5.8 131/633] hwmon: (w83627ehf) Fix a resource leak in probe Greg Kroah-Hartman
                   ` (505 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Steve Foreman, Guenter Roeck, Sasha Levin

From: Guenter Roeck <linux@roeck-us.net>

[ Upstream commit 6c094b31ea2ad773824362ba0fccb88d36f8d32d ]

Starting with MAX34451, the chips of this series support STATUS_IOUT and
STATUS_TEMPERATURE commands, and no longer report over-current and
over-temperature status with STATUS_MFR_SPECIFIC.

Fixes: 7a001dbab4ade ("hwmon: (pmbus/max34440) Add support for MAX34451.")
Fixes: 50115ac9b6f35 ("hwmon: (pmbus/max34440) Add support for MAX34460 and MAX34461")
Reported-by: Steve Foreman <foremans@google.com>
Cc: Steve Foreman <foremans@google.com>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hwmon/pmbus/max34440.c | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/drivers/hwmon/pmbus/max34440.c b/drivers/hwmon/pmbus/max34440.c
index 18b4e071067f7..de04dff28945b 100644
--- a/drivers/hwmon/pmbus/max34440.c
+++ b/drivers/hwmon/pmbus/max34440.c
@@ -388,7 +388,6 @@ static struct pmbus_driver_info max34440_info[] = {
 		.func[18] = PMBUS_HAVE_TEMP | PMBUS_HAVE_STATUS_TEMP,
 		.func[19] = PMBUS_HAVE_TEMP | PMBUS_HAVE_STATUS_TEMP,
 		.func[20] = PMBUS_HAVE_TEMP | PMBUS_HAVE_STATUS_TEMP,
-		.read_byte_data = max34440_read_byte_data,
 		.read_word_data = max34440_read_word_data,
 		.write_word_data = max34440_write_word_data,
 	},
@@ -419,7 +418,6 @@ static struct pmbus_driver_info max34440_info[] = {
 		.func[15] = PMBUS_HAVE_TEMP | PMBUS_HAVE_STATUS_TEMP,
 		.func[16] = PMBUS_HAVE_TEMP | PMBUS_HAVE_STATUS_TEMP,
 		.func[17] = PMBUS_HAVE_TEMP | PMBUS_HAVE_STATUS_TEMP,
-		.read_byte_data = max34440_read_byte_data,
 		.read_word_data = max34440_read_word_data,
 		.write_word_data = max34440_write_word_data,
 	},
@@ -455,7 +453,6 @@ static struct pmbus_driver_info max34440_info[] = {
 		.func[19] = PMBUS_HAVE_TEMP | PMBUS_HAVE_STATUS_TEMP,
 		.func[20] = PMBUS_HAVE_TEMP | PMBUS_HAVE_STATUS_TEMP,
 		.func[21] = PMBUS_HAVE_TEMP | PMBUS_HAVE_STATUS_TEMP,
-		.read_byte_data = max34440_read_byte_data,
 		.read_word_data = max34440_read_word_data,
 		.write_word_data = max34440_write_word_data,
 	},
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 131/633] hwmon: (w83627ehf) Fix a resource leak in probe
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (129 preceding siblings ...)
  2020-10-27 13:47 ` [PATCH 5.8 130/633] hwmon: (pmbus/max34440) Fix status register reads for MAX344{51,60,61} Greg Kroah-Hartman
@ 2020-10-27 13:47 ` Greg Kroah-Hartman
  2020-10-27 13:47 ` [PATCH 5.8 132/633] cypto: mediatek - fix leaks in mtk_desc_ring_alloc Greg Kroah-Hartman
                   ` (504 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter,
	Dr. David Alan Gilbert, Guenter Roeck, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit 18360b33a071e5883250fd1e04bfdeff8c3887a3 ]

Smatch has a new check for resource leaks which found a bug in probe:

    drivers/hwmon/w83627ehf.c:2417 w83627ehf_probe()
    warn: 'res->start' not released on lines: 2412.

We need to clean up if devm_hwmon_device_register_with_info() fails.

Fixes: 266cd5835947 ("hwmon: (w83627ehf) convert to with_info interface")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Dr. David Alan Gilbert <linux@treblig.org>
Link: https://lore.kernel.org/r/20200921125212.GA1128194@mwanda
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hwmon/w83627ehf.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/hwmon/w83627ehf.c b/drivers/hwmon/w83627ehf.c
index 5a5120121e507..3964ceab2817c 100644
--- a/drivers/hwmon/w83627ehf.c
+++ b/drivers/hwmon/w83627ehf.c
@@ -1951,8 +1951,12 @@ static int w83627ehf_probe(struct platform_device *pdev)
 							 data,
 							 &w83627ehf_chip_info,
 							 w83627ehf_groups);
+	if (IS_ERR(hwmon_dev)) {
+		err = PTR_ERR(hwmon_dev);
+		goto exit_release;
+	}
 
-	return PTR_ERR_OR_ZERO(hwmon_dev);
+	return 0;
 
 exit_release:
 	release_region(res->start, IOREGION_LENGTH);
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 132/633] cypto: mediatek - fix leaks in mtk_desc_ring_alloc
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (130 preceding siblings ...)
  2020-10-27 13:47 ` [PATCH 5.8 131/633] hwmon: (w83627ehf) Fix a resource leak in probe Greg Kroah-Hartman
@ 2020-10-27 13:47 ` Greg Kroah-Hartman
  2020-10-27 13:47 ` [PATCH 5.8 133/633] crypto: stm32/crc32 - Avoid lock if hardware is already used Greg Kroah-Hartman
                   ` (503 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ryder Lee, Xiaoliang Pang,
	Herbert Xu, Sasha Levin

From: Xiaoliang Pang <dawning.pang@gmail.com>

[ Upstream commit 228d284aac61283cde508a925d666f854b57af63 ]

In the init loop, if an error occurs in function 'dma_alloc_coherent',
then goto the err_cleanup section, after run i--,
in the array ring, the struct mtk_ring with index i will not be released,
causing memory leaks

Fixes: 785e5c616c849 ("crypto: mediatek - Add crypto driver support for some MediaTek chips")
Cc: Ryder Lee <ryder.lee@mediatek.com>
Signed-off-by: Xiaoliang Pang <dawning.pang@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/mediatek/mtk-platform.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/crypto/mediatek/mtk-platform.c b/drivers/crypto/mediatek/mtk-platform.c
index ef4339e84d034..efce3a83b35a8 100644
--- a/drivers/crypto/mediatek/mtk-platform.c
+++ b/drivers/crypto/mediatek/mtk-platform.c
@@ -469,13 +469,13 @@ static int mtk_desc_ring_alloc(struct mtk_cryp *cryp)
 	return 0;
 
 err_cleanup:
-	for (; i--; ) {
+	do {
 		dma_free_coherent(cryp->dev, MTK_DESC_RING_SZ,
 				  ring[i]->res_base, ring[i]->res_dma);
 		dma_free_coherent(cryp->dev, MTK_DESC_RING_SZ,
 				  ring[i]->cmd_base, ring[i]->cmd_dma);
 		kfree(ring[i]);
-	}
+	} while (i--);
 	return -ENOMEM;
 }
 
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 133/633] crypto: stm32/crc32 - Avoid lock if hardware is already used
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (131 preceding siblings ...)
  2020-10-27 13:47 ` [PATCH 5.8 132/633] cypto: mediatek - fix leaks in mtk_desc_ring_alloc Greg Kroah-Hartman
@ 2020-10-27 13:47 ` Greg Kroah-Hartman
  2020-10-27 13:47 ` [PATCH 5.8 134/633] crypto: sun8i-ce - handle endianness of t_common_ctl Greg Kroah-Hartman
                   ` (502 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Nicolas Toromanoff, Herbert Xu, Sasha Levin

From: Nicolas Toromanoff <nicolas.toromanoff@st.com>

[ Upstream commit bbf2cb1ea1e1428589d7f4d652bed15b265ce92d ]

If STM32 CRC device is already in use, calculate CRC by software.

This will release CPU constraint for a concurrent access to the
hardware, and avoid masking irqs during the whole block processing.

Fixes: 7795c0baf5ac ("crypto: stm32/crc32 - protect from concurrent accesses")

Signed-off-by: Nicolas Toromanoff <nicolas.toromanoff@st.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/stm32/Kconfig       |  1 +
 drivers/crypto/stm32/stm32-crc32.c | 15 ++++++++++++---
 2 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/drivers/crypto/stm32/Kconfig b/drivers/crypto/stm32/Kconfig
index 4ef3eb11361c2..4a4c3284ae1f3 100644
--- a/drivers/crypto/stm32/Kconfig
+++ b/drivers/crypto/stm32/Kconfig
@@ -3,6 +3,7 @@ config CRYPTO_DEV_STM32_CRC
 	tristate "Support for STM32 crc accelerators"
 	depends on ARCH_STM32
 	select CRYPTO_HASH
+	select CRC32
 	help
 	  This enables support for the CRC32 hw accelerator which can be found
 	  on STMicroelectronics STM32 SOC.
diff --git a/drivers/crypto/stm32/stm32-crc32.c b/drivers/crypto/stm32/stm32-crc32.c
index 3ba41148c2a46..2c13f5214d2cf 100644
--- a/drivers/crypto/stm32/stm32-crc32.c
+++ b/drivers/crypto/stm32/stm32-crc32.c
@@ -6,6 +6,7 @@
 
 #include <linux/bitrev.h>
 #include <linux/clk.h>
+#include <linux/crc32.h>
 #include <linux/crc32poly.h>
 #include <linux/module.h>
 #include <linux/mod_devicetable.h>
@@ -147,7 +148,6 @@ static int burst_update(struct shash_desc *desc, const u8 *d8,
 	struct stm32_crc_desc_ctx *ctx = shash_desc_ctx(desc);
 	struct stm32_crc_ctx *mctx = crypto_shash_ctx(desc->tfm);
 	struct stm32_crc *crc;
-	unsigned long flags;
 
 	crc = stm32_crc_get_next_crc();
 	if (!crc)
@@ -155,7 +155,15 @@ static int burst_update(struct shash_desc *desc, const u8 *d8,
 
 	pm_runtime_get_sync(crc->dev);
 
-	spin_lock_irqsave(&crc->lock, flags);
+	if (!spin_trylock(&crc->lock)) {
+		/* Hardware is busy, calculate crc32 by software */
+		if (mctx->poly == CRC32_POLY_LE)
+			ctx->partial = crc32_le(ctx->partial, d8, length);
+		else
+			ctx->partial = __crc32c_le(ctx->partial, d8, length);
+
+		goto pm_out;
+	}
 
 	/*
 	 * Restore previously calculated CRC for this context as init value
@@ -195,8 +203,9 @@ static int burst_update(struct shash_desc *desc, const u8 *d8,
 	/* Store partial result */
 	ctx->partial = readl_relaxed(crc->regs + CRC_DR);
 
-	spin_unlock_irqrestore(&crc->lock, flags);
+	spin_unlock(&crc->lock);
 
+pm_out:
 	pm_runtime_mark_last_busy(crc->dev);
 	pm_runtime_put_autosuspend(crc->dev);
 
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 134/633] crypto: sun8i-ce - handle endianness of t_common_ctl
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (132 preceding siblings ...)
  2020-10-27 13:47 ` [PATCH 5.8 133/633] crypto: stm32/crc32 - Avoid lock if hardware is already used Greg Kroah-Hartman
@ 2020-10-27 13:47 ` Greg Kroah-Hartman
  2020-10-27 13:47 ` [PATCH 5.8 135/633] media: mx2_emmaprp: Fix memleak in emmaprp_probe Greg Kroah-Hartman
                   ` (501 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Corentin Labbe, Herbert Xu, Sasha Levin

From: Corentin Labbe <clabbe@baylibre.com>

[ Upstream commit 87f34260f5e09a4578132ad1c05aef2d707dd4bf ]

t_common_ctl is LE32 so we need to convert its value before using it.
This value is only used on H6 (ignored on other SoCs) and not handling
the endianness cause failure on xRNG/hashes operations on H6 when running BE.

Fixes: 06f751b61329 ("crypto: allwinner - Add sun8i-ce Crypto Engine")
Signed-off-by: Corentin Labbe <clabbe@baylibre.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/allwinner/sun8i-ce/sun8i-ce-core.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-core.c b/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-core.c
index b957061424a1f..8f3d6d31da52f 100644
--- a/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-core.c
+++ b/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-core.c
@@ -120,7 +120,10 @@ int sun8i_ce_run_task(struct sun8i_ce_dev *ce, int flow, const char *name)
 	/* Be sure all data is written before enabling the task */
 	wmb();
 
-	v = 1 | (ce->chanlist[flow].tl->t_common_ctl & 0x7F) << 8;
+	/* Only H6 needs to write a part of t_common_ctl along with "1", but since it is ignored
+	 * on older SoCs, we have no reason to complicate things.
+	 */
+	v = 1 | ((le32_to_cpu(ce->chanlist[flow].tl->t_common_ctl) & 0x7F) << 8);
 	writel(v, ce->base + CE_TLR);
 	mutex_unlock(&ce->mlock);
 
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 135/633] media: mx2_emmaprp: Fix memleak in emmaprp_probe
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (133 preceding siblings ...)
  2020-10-27 13:47 ` [PATCH 5.8 134/633] crypto: sun8i-ce - handle endianness of t_common_ctl Greg Kroah-Hartman
@ 2020-10-27 13:47 ` Greg Kroah-Hartman
  2020-10-27 13:47 ` [PATCH 5.8 136/633] media: tc358743: initialize variable Greg Kroah-Hartman
                   ` (500 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dinghao Liu, Fabio Estevam,
	Hans Verkuil, Mauro Carvalho Chehab, Sasha Levin

From: Dinghao Liu <dinghao.liu@zju.edu.cn>

[ Upstream commit 21d387b8d372f859d9e87fdcc7c3b4a432737f4d ]

When platform_get_irq() fails, we should release
vfd and unregister pcdev->v4l2_dev just like the
subsequent error paths.

Fixes: d4e192cc44914 ("media: mx2_emmaprp: Check for platform_get_irq() error")
Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
Reviewed-by: Fabio Estevam <festevam@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/mx2_emmaprp.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/media/platform/mx2_emmaprp.c b/drivers/media/platform/mx2_emmaprp.c
index df78df59da456..08a5473b56104 100644
--- a/drivers/media/platform/mx2_emmaprp.c
+++ b/drivers/media/platform/mx2_emmaprp.c
@@ -852,8 +852,11 @@ static int emmaprp_probe(struct platform_device *pdev)
 	platform_set_drvdata(pdev, pcdev);
 
 	irq = platform_get_irq(pdev, 0);
-	if (irq < 0)
-		return irq;
+	if (irq < 0) {
+		ret = irq;
+		goto rel_vdev;
+	}
+
 	ret = devm_request_irq(&pdev->dev, irq, emmaprp_irq, 0,
 			       dev_name(&pdev->dev), pcdev);
 	if (ret)
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 136/633] media: tc358743: initialize variable
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (134 preceding siblings ...)
  2020-10-27 13:47 ` [PATCH 5.8 135/633] media: mx2_emmaprp: Fix memleak in emmaprp_probe Greg Kroah-Hartman
@ 2020-10-27 13:47 ` Greg Kroah-Hartman
  2020-10-27 13:48 ` [PATCH 5.8 137/633] media: tc358743: cleanup tc358743_cec_isr Greg Kroah-Hartman
                   ` (499 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:47 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Tom Rix, Hans Verkuil,
	Mauro Carvalho Chehab, Sasha Levin

From: Tom Rix <trix@redhat.com>

[ Upstream commit 274cf92d5dff5c2fec1a518078542ffe70d07646 ]

clang static analysis flags this error

tc358743.c:1468:9: warning: Branch condition evaluates
  to a garbage value
        return handled ? IRQ_HANDLED : IRQ_NONE;
               ^~~~~~~
handled should be initialized to false.

Fixes: d747b806abf4 ("[media] tc358743: add direct interrupt handling")
Signed-off-by: Tom Rix <trix@redhat.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/i2c/tc358743.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/i2c/tc358743.c b/drivers/media/i2c/tc358743.c
index dbbab75f135ec..211caade9f998 100644
--- a/drivers/media/i2c/tc358743.c
+++ b/drivers/media/i2c/tc358743.c
@@ -1461,7 +1461,7 @@ static int tc358743_isr(struct v4l2_subdev *sd, u32 status, bool *handled)
 static irqreturn_t tc358743_irq_handler(int irq, void *dev_id)
 {
 	struct tc358743_state *state = dev_id;
-	bool handled;
+	bool handled = false;
 
 	tc358743_isr(&state->sd, 0, &handled);
 
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 137/633] media: tc358743: cleanup tc358743_cec_isr
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (135 preceding siblings ...)
  2020-10-27 13:47 ` [PATCH 5.8 136/633] media: tc358743: initialize variable Greg Kroah-Hartman
@ 2020-10-27 13:48 ` Greg Kroah-Hartman
  2020-10-27 13:48 ` [PATCH 5.8 138/633] media: rcar-vin: Fix a reference count leak Greg Kroah-Hartman
                   ` (498 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Tom Rix, Hans Verkuil,
	Mauro Carvalho Chehab, Sasha Levin

From: Tom Rix <trix@redhat.com>

[ Upstream commit 877cb8a444dad2304e891294afb0915fe3c278d6 ]

tc358743_cec_isr is misnammed, it is not the main isr.
So rename it to be consistent with its siblings,
tc358743_cec_handler.

It also does not check if its input parameter 'handled' is
is non NULL like its siblings, so add a check.

Fixes: a0ec8d1dc42e ("media: tc358743: add CEC support")
Signed-off-by: Tom Rix <trix@redhat.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/i2c/tc358743.c | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/drivers/media/i2c/tc358743.c b/drivers/media/i2c/tc358743.c
index 211caade9f998..cff99cf61ed4d 100644
--- a/drivers/media/i2c/tc358743.c
+++ b/drivers/media/i2c/tc358743.c
@@ -919,8 +919,8 @@ static const struct cec_adap_ops tc358743_cec_adap_ops = {
 	.adap_monitor_all_enable = tc358743_cec_adap_monitor_all_enable,
 };
 
-static void tc358743_cec_isr(struct v4l2_subdev *sd, u16 intstatus,
-			     bool *handled)
+static void tc358743_cec_handler(struct v4l2_subdev *sd, u16 intstatus,
+				 bool *handled)
 {
 	struct tc358743_state *state = to_state(sd);
 	unsigned int cec_rxint, cec_txint;
@@ -953,7 +953,8 @@ static void tc358743_cec_isr(struct v4l2_subdev *sd, u16 intstatus,
 			cec_transmit_attempt_done(state->cec_adap,
 						  CEC_TX_STATUS_ERROR);
 		}
-		*handled = true;
+		if (handled)
+			*handled = true;
 	}
 	if ((intstatus & MASK_CEC_RINT) &&
 	    (cec_rxint & MASK_CECRIEND)) {
@@ -968,7 +969,8 @@ static void tc358743_cec_isr(struct v4l2_subdev *sd, u16 intstatus,
 			msg.msg[i] = v & 0xff;
 		}
 		cec_received_msg(state->cec_adap, &msg);
-		*handled = true;
+		if (handled)
+			*handled = true;
 	}
 	i2c_wr16(sd, INTSTATUS,
 		 intstatus & (MASK_CEC_RINT | MASK_CEC_TINT));
@@ -1432,7 +1434,7 @@ static int tc358743_isr(struct v4l2_subdev *sd, u32 status, bool *handled)
 
 #ifdef CONFIG_VIDEO_TC358743_CEC
 	if (intstatus & (MASK_CEC_RINT | MASK_CEC_TINT)) {
-		tc358743_cec_isr(sd, intstatus, handled);
+		tc358743_cec_handler(sd, intstatus, handled);
 		i2c_wr16(sd, INTSTATUS,
 			 intstatus & (MASK_CEC_RINT | MASK_CEC_TINT));
 		intstatus &= ~(MASK_CEC_RINT | MASK_CEC_TINT);
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 138/633] media: rcar-vin: Fix a reference count leak.
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (136 preceding siblings ...)
  2020-10-27 13:48 ` [PATCH 5.8 137/633] media: tc358743: cleanup tc358743_cec_isr Greg Kroah-Hartman
@ 2020-10-27 13:48 ` Greg Kroah-Hartman
  2020-10-27 13:48 ` [PATCH 5.8 139/633] media: rockchip/rga: " Greg Kroah-Hartman
                   ` (497 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Qiushi Wu, Hans Verkuil,
	Mauro Carvalho Chehab, Sasha Levin

From: Qiushi Wu <wu000273@umn.edu>

[ Upstream commit aaffa0126a111d65f4028c503c76192d4cc93277 ]

pm_runtime_get_sync() increments the runtime PM usage counter even
when it returns an error code. Thus call pm_runtime_put_noidle()
if pm_runtime_get_sync() fails.

Fixes: 90dedce9bc54 ("media: rcar-vin: add function to manipulate Gen3 chsel value")
Signed-off-by: Qiushi Wu <wu000273@umn.edu>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/rcar-vin/rcar-dma.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/media/platform/rcar-vin/rcar-dma.c b/drivers/media/platform/rcar-vin/rcar-dma.c
index 1a30cd0363711..95bc9e0e87926 100644
--- a/drivers/media/platform/rcar-vin/rcar-dma.c
+++ b/drivers/media/platform/rcar-vin/rcar-dma.c
@@ -1392,8 +1392,10 @@ int rvin_set_channel_routing(struct rvin_dev *vin, u8 chsel)
 	int ret;
 
 	ret = pm_runtime_get_sync(vin->dev);
-	if (ret < 0)
+	if (ret < 0) {
+		pm_runtime_put_noidle(vin->dev);
 		return ret;
+	}
 
 	/* Make register writes take effect immediately. */
 	vnmc = rvin_read(vin, VNMC_REG);
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 139/633] media: rockchip/rga: Fix a reference count leak.
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (137 preceding siblings ...)
  2020-10-27 13:48 ` [PATCH 5.8 138/633] media: rcar-vin: Fix a reference count leak Greg Kroah-Hartman
@ 2020-10-27 13:48 ` Greg Kroah-Hartman
  2020-10-27 13:48 ` [PATCH 5.8 140/633] media: platform: fcp: " Greg Kroah-Hartman
                   ` (496 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Qiushi Wu, Heiko Stuebner,
	Hans Verkuil, Mauro Carvalho Chehab, Sasha Levin

From: Qiushi Wu <wu000273@umn.edu>

[ Upstream commit 884d638e0853c4b5f01eb6d048fc3b6239012404 ]

pm_runtime_get_sync() increments the runtime PM usage counter even
when it returns an error code. Thus call pm_runtime_put_noidle()
if pm_runtime_get_sync() fails.

Fixes: f7e7b48e6d79 ("[media] rockchip/rga: v4l2 m2m support")
Signed-off-by: Qiushi Wu <wu000273@umn.edu>
Reviewed-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/rockchip/rga/rga-buf.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/media/platform/rockchip/rga/rga-buf.c b/drivers/media/platform/rockchip/rga/rga-buf.c
index 36b821ccc1dba..bf9a75b75083b 100644
--- a/drivers/media/platform/rockchip/rga/rga-buf.c
+++ b/drivers/media/platform/rockchip/rga/rga-buf.c
@@ -81,6 +81,7 @@ static int rga_buf_start_streaming(struct vb2_queue *q, unsigned int count)
 
 	ret = pm_runtime_get_sync(rga->dev);
 	if (ret < 0) {
+		pm_runtime_put_noidle(rga->dev);
 		rga_buf_return_buffers(q, VB2_BUF_STATE_QUEUED);
 		return ret;
 	}
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 140/633] media: platform: fcp: Fix a reference count leak.
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (138 preceding siblings ...)
  2020-10-27 13:48 ` [PATCH 5.8 139/633] media: rockchip/rga: " Greg Kroah-Hartman
@ 2020-10-27 13:48 ` Greg Kroah-Hartman
  2020-10-27 13:48 ` [PATCH 5.8 141/633] media: camss: " Greg Kroah-Hartman
                   ` (495 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Qiushi Wu, Hans Verkuil,
	Mauro Carvalho Chehab, Sasha Levin

From: Qiushi Wu <wu000273@umn.edu>

[ Upstream commit 63e36a381d92a9cded97e90d481ee22566557dd1 ]

pm_runtime_get_sync() increments the runtime PM usage counter even
when it returns an error code, causing incorrect ref count if
pm_runtime_put_noidle() is not called in error handling paths.
Thus call pm_runtime_put_noidle() if pm_runtime_get_sync() fails.

Fixes: 6eaafbdb668b ("[media] v4l: rcar-fcp: Keep the coding style consistent")
Signed-off-by: Qiushi Wu <wu000273@umn.edu>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/rcar-fcp.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/media/platform/rcar-fcp.c b/drivers/media/platform/rcar-fcp.c
index 5c6b00737fe75..05c712e00a2a7 100644
--- a/drivers/media/platform/rcar-fcp.c
+++ b/drivers/media/platform/rcar-fcp.c
@@ -103,8 +103,10 @@ int rcar_fcp_enable(struct rcar_fcp_device *fcp)
 		return 0;
 
 	ret = pm_runtime_get_sync(fcp->dev);
-	if (ret < 0)
+	if (ret < 0) {
+		pm_runtime_put_noidle(fcp->dev);
 		return ret;
+	}
 
 	return 0;
 }
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 141/633] media: camss: Fix a reference count leak.
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (139 preceding siblings ...)
  2020-10-27 13:48 ` [PATCH 5.8 140/633] media: platform: fcp: " Greg Kroah-Hartman
@ 2020-10-27 13:48 ` Greg Kroah-Hartman
  2020-10-27 13:48 ` [PATCH 5.8 142/633] media: s5p-mfc: " Greg Kroah-Hartman
                   ` (494 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Qiushi Wu, Hans Verkuil,
	Mauro Carvalho Chehab, Sasha Levin

From: Qiushi Wu <wu000273@umn.edu>

[ Upstream commit d0675b67b42eb4f1a840d1513b5b00f78312f833 ]

pm_runtime_get_sync() increments the runtime PM usage counter even
when it returns an error code, causing incorrect ref count if
PM runtime put is not called in error handling paths.
Thus call pm_runtime_put_sync() if pm_runtime_get_sync() fails.

Fixes: 02afa816dbbf ("media: camss: Add basic runtime PM support")
Signed-off-by: Qiushi Wu <wu000273@umn.edu>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/qcom/camss/camss-csiphy.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/media/platform/qcom/camss/camss-csiphy.c b/drivers/media/platform/qcom/camss/camss-csiphy.c
index 008afb85023be..3c5b9082ad723 100644
--- a/drivers/media/platform/qcom/camss/camss-csiphy.c
+++ b/drivers/media/platform/qcom/camss/camss-csiphy.c
@@ -176,8 +176,10 @@ static int csiphy_set_power(struct v4l2_subdev *sd, int on)
 		int ret;
 
 		ret = pm_runtime_get_sync(dev);
-		if (ret < 0)
+		if (ret < 0) {
+			pm_runtime_put_sync(dev);
 			return ret;
+		}
 
 		ret = csiphy_set_clock_rates(csiphy);
 		if (ret < 0) {
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 142/633] media: s5p-mfc: Fix a reference count leak
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (140 preceding siblings ...)
  2020-10-27 13:48 ` [PATCH 5.8 141/633] media: camss: " Greg Kroah-Hartman
@ 2020-10-27 13:48 ` Greg Kroah-Hartman
  2020-10-27 13:48 ` [PATCH 5.8 143/633] media: stm32-dcmi: " Greg Kroah-Hartman
                   ` (493 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Qiushi Wu, Hans Verkuil,
	Mauro Carvalho Chehab, Sasha Levin

From: Qiushi Wu <wu000273@umn.edu>

[ Upstream commit 78741ce98c2e36188e2343434406b0e0bc50b0e7 ]

pm_runtime_get_sync() increments the runtime PM usage counter even
when it returns an error code, causing incorrect ref count if
pm_runtime_put_noidle() is not called in error handling paths.
Thus call pm_runtime_put_noidle() if pm_runtime_get_sync() fails.

Fixes: c5086f130a77 ("[media] s5p-mfc: Use clock gating only on MFC v5 hardware")
Signed-off-by: Qiushi Wu <wu000273@umn.edu>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/s5p-mfc/s5p_mfc_pm.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc_pm.c b/drivers/media/platform/s5p-mfc/s5p_mfc_pm.c
index 7d52431c2c837..62d2320a72186 100644
--- a/drivers/media/platform/s5p-mfc/s5p_mfc_pm.c
+++ b/drivers/media/platform/s5p-mfc/s5p_mfc_pm.c
@@ -79,8 +79,10 @@ int s5p_mfc_power_on(void)
 	int i, ret = 0;
 
 	ret = pm_runtime_get_sync(pm->device);
-	if (ret < 0)
+	if (ret < 0) {
+		pm_runtime_put_noidle(pm->device);
 		return ret;
+	}
 
 	/* clock control */
 	for (i = 0; i < pm->num_clocks; i++) {
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 143/633] media: stm32-dcmi: Fix a reference count leak
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (141 preceding siblings ...)
  2020-10-27 13:48 ` [PATCH 5.8 142/633] media: s5p-mfc: " Greg Kroah-Hartman
@ 2020-10-27 13:48 ` Greg Kroah-Hartman
  2020-10-27 13:48 ` [PATCH 5.8 144/633] media: ti-vpe: Fix a missing check and " Greg Kroah-Hartman
                   ` (492 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Qiushi Wu, Hans Verkuil,
	Mauro Carvalho Chehab, Sasha Levin

From: Qiushi Wu <wu000273@umn.edu>

[ Upstream commit 88f50a05f907d96a27a9ce3cc9e8cbb91a6f0f22 ]

Calling pm_runtime_get_sync increments the counter even in case of
failure, causing incorrect ref count if pm_runtime_put is not
called in error handling paths. Thus replace the jump target
"err_release_buffers" by "err_pm_putw".

Fixes: 152e0bf60219 ("media: stm32-dcmi: add power saving support")
Signed-off-by: Qiushi Wu <wu000273@umn.edu>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/stm32/stm32-dcmi.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/drivers/media/platform/stm32/stm32-dcmi.c b/drivers/media/platform/stm32/stm32-dcmi.c
index b8931490b83b7..fd1c41cba52fc 100644
--- a/drivers/media/platform/stm32/stm32-dcmi.c
+++ b/drivers/media/platform/stm32/stm32-dcmi.c
@@ -733,7 +733,7 @@ static int dcmi_start_streaming(struct vb2_queue *vq, unsigned int count)
 	if (ret < 0) {
 		dev_err(dcmi->dev, "%s: Failed to start streaming, cannot get sync (%d)\n",
 			__func__, ret);
-		goto err_release_buffers;
+		goto err_pm_put;
 	}
 
 	ret = media_pipeline_start(&dcmi->vdev->entity, &dcmi->pipeline);
@@ -837,8 +837,6 @@ static int dcmi_start_streaming(struct vb2_queue *vq, unsigned int count)
 
 err_pm_put:
 	pm_runtime_put(dcmi->dev);
-
-err_release_buffers:
 	spin_lock_irq(&dcmi->irqlock);
 	/*
 	 * Return all buffers to vb2 in QUEUED state.
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 144/633] media: ti-vpe: Fix a missing check and reference count leak
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (142 preceding siblings ...)
  2020-10-27 13:48 ` [PATCH 5.8 143/633] media: stm32-dcmi: " Greg Kroah-Hartman
@ 2020-10-27 13:48 ` Greg Kroah-Hartman
  2020-10-27 13:48 ` [PATCH 5.8 145/633] regulator: resolve supply after creating regulator Greg Kroah-Hartman
                   ` (491 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Qiushi Wu, Hans Verkuil,
	Mauro Carvalho Chehab, Sasha Levin

From: Qiushi Wu <wu000273@umn.edu>

[ Upstream commit 7dae2aaaf432767ca7aa11fa84643a7c2600dbdd ]

pm_runtime_get_sync() increments the runtime PM usage counter even
when it returns an error code, causing incorrect ref count if
pm_runtime_put_noidle() is not called in error handling paths.
And also, when the call of function vpe_runtime_get() failed,
we won't call vpe_runtime_put().
Thus call pm_runtime_put_noidle() if pm_runtime_get_sync() fails
inside vpe_runtime_get().

Fixes: 4571912743ac ("[media] v4l: ti-vpe: Add VPE mem to mem driver")
Signed-off-by: Qiushi Wu <wu000273@umn.edu>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/ti-vpe/vpe.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/media/platform/ti-vpe/vpe.c b/drivers/media/platform/ti-vpe/vpe.c
index cff2fcd6d812a..82d3ee45e2e90 100644
--- a/drivers/media/platform/ti-vpe/vpe.c
+++ b/drivers/media/platform/ti-vpe/vpe.c
@@ -2475,6 +2475,8 @@ static int vpe_runtime_get(struct platform_device *pdev)
 
 	r = pm_runtime_get_sync(&pdev->dev);
 	WARN_ON(r < 0);
+	if (r)
+		pm_runtime_put_noidle(&pdev->dev);
 	return r < 0 ? r : 0;
 }
 
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 145/633] regulator: resolve supply after creating regulator
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (143 preceding siblings ...)
  2020-10-27 13:48 ` [PATCH 5.8 144/633] media: ti-vpe: Fix a missing check and " Greg Kroah-Hartman
@ 2020-10-27 13:48 ` Greg Kroah-Hartman
  2020-10-27 13:48 ` [PATCH 5.8 146/633] pinctrl: bcm: fix kconfig dependency warning when !GPIOLIB Greg Kroah-Hartman
                   ` (490 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Michał Mirosław,
	Mark Brown, Sasha Levin

From: Michał Mirosław <mirq-linux@rere.qmqm.pl>

[ Upstream commit aea6cb99703e17019e025aa71643b4d3e0a24413 ]

When creating a new regulator its supply cannot create the sysfs link
because the device is not yet published. Remove early supply resolving
since it will be done later anyway. This makes the following error
disappear and the symlinks get created instead.

  DCDC_REG1: supplied by VSYS
  VSYS: could not add device link regulator.3 err -2

Note: It doesn't fix the problem for bypassed regulators, though.

Fixes: 45389c47526d ("regulator: core: Add early supply resolution for regulators")
Signed-off-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
Link: https://lore.kernel.org/r/ba09e0a8617ffeeb25cb4affffe6f3149319cef8.1601155770.git.mirq-linux@rere.qmqm.pl
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/regulator/core.c | 21 +++++++++++++--------
 1 file changed, 13 insertions(+), 8 deletions(-)

diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
index be8c709a74883..25e601bf9383e 100644
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -5187,15 +5187,20 @@ regulator_register(const struct regulator_desc *regulator_desc,
 	else if (regulator_desc->supply_name)
 		rdev->supply_name = regulator_desc->supply_name;
 
-	/*
-	 * Attempt to resolve the regulator supply, if specified,
-	 * but don't return an error if we fail because we will try
-	 * to resolve it again later as more regulators are added.
-	 */
-	if (regulator_resolve_supply(rdev))
-		rdev_dbg(rdev, "unable to resolve supply\n");
-
 	ret = set_machine_constraints(rdev, constraints);
+	if (ret == -EPROBE_DEFER) {
+		/* Regulator might be in bypass mode and so needs its supply
+		 * to set the constraints */
+		/* FIXME: this currently triggers a chicken-and-egg problem
+		 * when creating -SUPPLY symlink in sysfs to a regulator
+		 * that is just being created */
+		ret = regulator_resolve_supply(rdev);
+		if (!ret)
+			ret = set_machine_constraints(rdev, constraints);
+		else
+			rdev_dbg(rdev, "unable to resolve supply early: %pe\n",
+				 ERR_PTR(ret));
+	}
 	if (ret < 0)
 		goto wash;
 
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 146/633] pinctrl: bcm: fix kconfig dependency warning when !GPIOLIB
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (144 preceding siblings ...)
  2020-10-27 13:48 ` [PATCH 5.8 145/633] regulator: resolve supply after creating regulator Greg Kroah-Hartman
@ 2020-10-27 13:48 ` Greg Kroah-Hartman
  2020-10-27 13:48 ` [PATCH 5.8 147/633] spi: spi-s3c64xx: swap s3c64xx_spi_set_cs() and s3c64xx_enable_datapath() Greg Kroah-Hartman
                   ` (489 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Necip Fazil Yildiran, Linus Walleij,
	Sasha Levin

From: Necip Fazil Yildiran <fazilyildiran@gmail.com>

[ Upstream commit 513034d8b089b9a49dab57845aee70e830fe7334 ]

When PINCTRL_BCM2835 is enabled and GPIOLIB is disabled, it results in the
following Kbuild warning:

WARNING: unmet direct dependencies detected for GPIOLIB_IRQCHIP
  Depends on [n]: GPIOLIB [=n]
  Selected by [y]:
  - PINCTRL_BCM2835 [=y] && PINCTRL [=y] && OF [=y] && (ARCH_BCM2835 [=n] || ARCH_BRCMSTB [=n] || COMPILE_TEST [=y])

The reason is that PINCTRL_BCM2835 selects GPIOLIB_IRQCHIP without
depending on or selecting GPIOLIB while GPIOLIB_IRQCHIP is subordinate to
GPIOLIB.

Honor the kconfig menu hierarchy to remove kconfig dependency warnings.

Fixes: 85ae9e512f43 ("pinctrl: bcm2835: switch to GPIOLIB_IRQCHIP")
Signed-off-by: Necip Fazil Yildiran <fazilyildiran@gmail.com>
Link: https://lore.kernel.org/r/20200914144025.371370-1-fazilyildiran@gmail.com
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pinctrl/bcm/Kconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/pinctrl/bcm/Kconfig b/drivers/pinctrl/bcm/Kconfig
index dcf7df797af75..0ed14de0134cf 100644
--- a/drivers/pinctrl/bcm/Kconfig
+++ b/drivers/pinctrl/bcm/Kconfig
@@ -23,6 +23,7 @@ config PINCTRL_BCM2835
 	select PINMUX
 	select PINCONF
 	select GENERIC_PINCONF
+	select GPIOLIB
 	select GPIOLIB_IRQCHIP
 	default ARCH_BCM2835 || ARCH_BRCMSTB
 	help
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 147/633] spi: spi-s3c64xx: swap s3c64xx_spi_set_cs() and s3c64xx_enable_datapath()
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (145 preceding siblings ...)
  2020-10-27 13:48 ` [PATCH 5.8 146/633] pinctrl: bcm: fix kconfig dependency warning when !GPIOLIB Greg Kroah-Hartman
@ 2020-10-27 13:48 ` Greg Kroah-Hartman
  2020-10-27 13:48 ` [PATCH 5.8 148/633] spi: spi-s3c64xx: Check return values Greg Kroah-Hartman
                   ` (488 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Krzysztof Kozlowski,
	Łukasz Stelmach, Mark Brown, Sasha Levin

From: Łukasz Stelmach <l.stelmach@samsung.com>

[ Upstream commit 581e2b41977dfc2d4c26c8e976f89c43bb92f9bf ]

Fix issues with DMA transfers bigger than 512 bytes on Exynos3250. Without
the patches such transfers fail to complete. This solution to the problem
is found in the vendor kernel for ARTIK5 boards based on Exynos3250.

Reviewed-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Łukasz Stelmach <l.stelmach@samsung.com>
Link: https://lore.kernel.org/r/20201002122243.26849-2-l.stelmach@samsung.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-s3c64xx.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/spi/spi-s3c64xx.c b/drivers/spi/spi-s3c64xx.c
index cf67ea60dc0ed..fb5e2ba4b6b97 100644
--- a/drivers/spi/spi-s3c64xx.c
+++ b/drivers/spi/spi-s3c64xx.c
@@ -678,11 +678,11 @@ static int s3c64xx_spi_transfer_one(struct spi_master *master,
 		sdd->state &= ~RXBUSY;
 		sdd->state &= ~TXBUSY;
 
-		s3c64xx_enable_datapath(sdd, xfer, use_dma);
-
 		/* Start the signals */
 		s3c64xx_spi_set_cs(spi, true);
 
+		s3c64xx_enable_datapath(sdd, xfer, use_dma);
+
 		spin_unlock_irqrestore(&sdd->lock, flags);
 
 		if (use_dma)
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 148/633] spi: spi-s3c64xx: Check return values
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (146 preceding siblings ...)
  2020-10-27 13:48 ` [PATCH 5.8 147/633] spi: spi-s3c64xx: swap s3c64xx_spi_set_cs() and s3c64xx_enable_datapath() Greg Kroah-Hartman
@ 2020-10-27 13:48 ` Greg Kroah-Hartman
  2020-10-27 13:48 ` [PATCH 5.8 149/633] hwmon: (bt1-pvt) Test sensor power supply on probe Greg Kroah-Hartman
                   ` (487 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Krzysztof Kozlowski,
	Łukasz Stelmach, Mark Brown, Sasha Levin

From: Łukasz Stelmach <l.stelmach@samsung.com>

[ Upstream commit 2f4db6f705c5cba85d23836c19b44d9687dc1334 ]

Check return values in prepare_dma() and s3c64xx_spi_config() and
propagate errors upwards.

Fixes: 788437273fa8 ("spi: s3c64xx: move to generic dmaengine API")
Reviewed-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Łukasz Stelmach <l.stelmach@samsung.com>
Link: https://lore.kernel.org/r/20201002122243.26849-4-l.stelmach@samsung.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-s3c64xx.c | 50 ++++++++++++++++++++++++++++++++-------
 1 file changed, 41 insertions(+), 9 deletions(-)

diff --git a/drivers/spi/spi-s3c64xx.c b/drivers/spi/spi-s3c64xx.c
index fb5e2ba4b6b97..6587a7dc3f5ba 100644
--- a/drivers/spi/spi-s3c64xx.c
+++ b/drivers/spi/spi-s3c64xx.c
@@ -122,6 +122,7 @@
 
 struct s3c64xx_spi_dma_data {
 	struct dma_chan *ch;
+	dma_cookie_t cookie;
 	enum dma_transfer_direction direction;
 };
 
@@ -264,12 +265,13 @@ static void s3c64xx_spi_dmacb(void *data)
 	spin_unlock_irqrestore(&sdd->lock, flags);
 }
 
-static void prepare_dma(struct s3c64xx_spi_dma_data *dma,
+static int prepare_dma(struct s3c64xx_spi_dma_data *dma,
 			struct sg_table *sgt)
 {
 	struct s3c64xx_spi_driver_data *sdd;
 	struct dma_slave_config config;
 	struct dma_async_tx_descriptor *desc;
+	int ret;
 
 	memset(&config, 0, sizeof(config));
 
@@ -293,12 +295,24 @@ static void prepare_dma(struct s3c64xx_spi_dma_data *dma,
 
 	desc = dmaengine_prep_slave_sg(dma->ch, sgt->sgl, sgt->nents,
 				       dma->direction, DMA_PREP_INTERRUPT);
+	if (!desc) {
+		dev_err(&sdd->pdev->dev, "unable to prepare %s scatterlist",
+			dma->direction == DMA_DEV_TO_MEM ? "rx" : "tx");
+		return -ENOMEM;
+	}
 
 	desc->callback = s3c64xx_spi_dmacb;
 	desc->callback_param = dma;
 
-	dmaengine_submit(desc);
+	dma->cookie = dmaengine_submit(desc);
+	ret = dma_submit_error(dma->cookie);
+	if (ret) {
+		dev_err(&sdd->pdev->dev, "DMA submission failed");
+		return -EIO;
+	}
+
 	dma_async_issue_pending(dma->ch);
+	return 0;
 }
 
 static void s3c64xx_spi_set_cs(struct spi_device *spi, bool enable)
@@ -348,11 +362,12 @@ static bool s3c64xx_spi_can_dma(struct spi_master *master,
 	return xfer->len > (FIFO_LVL_MASK(sdd) >> 1) + 1;
 }
 
-static void s3c64xx_enable_datapath(struct s3c64xx_spi_driver_data *sdd,
+static int s3c64xx_enable_datapath(struct s3c64xx_spi_driver_data *sdd,
 				    struct spi_transfer *xfer, int dma_mode)
 {
 	void __iomem *regs = sdd->regs;
 	u32 modecfg, chcfg;
+	int ret = 0;
 
 	modecfg = readl(regs + S3C64XX_SPI_MODE_CFG);
 	modecfg &= ~(S3C64XX_SPI_MODE_TXDMA_ON | S3C64XX_SPI_MODE_RXDMA_ON);
@@ -378,7 +393,7 @@ static void s3c64xx_enable_datapath(struct s3c64xx_spi_driver_data *sdd,
 		chcfg |= S3C64XX_SPI_CH_TXCH_ON;
 		if (dma_mode) {
 			modecfg |= S3C64XX_SPI_MODE_TXDMA_ON;
-			prepare_dma(&sdd->tx_dma, &xfer->tx_sg);
+			ret = prepare_dma(&sdd->tx_dma, &xfer->tx_sg);
 		} else {
 			switch (sdd->cur_bpw) {
 			case 32:
@@ -410,12 +425,17 @@ static void s3c64xx_enable_datapath(struct s3c64xx_spi_driver_data *sdd,
 			writel(((xfer->len * 8 / sdd->cur_bpw) & 0xffff)
 					| S3C64XX_SPI_PACKET_CNT_EN,
 					regs + S3C64XX_SPI_PACKET_CNT);
-			prepare_dma(&sdd->rx_dma, &xfer->rx_sg);
+			ret = prepare_dma(&sdd->rx_dma, &xfer->rx_sg);
 		}
 	}
 
+	if (ret)
+		return ret;
+
 	writel(modecfg, regs + S3C64XX_SPI_MODE_CFG);
 	writel(chcfg, regs + S3C64XX_SPI_CH_CFG);
+
+	return 0;
 }
 
 static u32 s3c64xx_spi_wait_for_timeout(struct s3c64xx_spi_driver_data *sdd,
@@ -548,9 +568,10 @@ static int s3c64xx_wait_for_pio(struct s3c64xx_spi_driver_data *sdd,
 	return 0;
 }
 
-static void s3c64xx_spi_config(struct s3c64xx_spi_driver_data *sdd)
+static int s3c64xx_spi_config(struct s3c64xx_spi_driver_data *sdd)
 {
 	void __iomem *regs = sdd->regs;
+	int ret;
 	u32 val;
 
 	/* Disable Clock */
@@ -598,7 +619,9 @@ static void s3c64xx_spi_config(struct s3c64xx_spi_driver_data *sdd)
 
 	if (sdd->port_conf->clk_from_cmu) {
 		/* The src_clk clock is divided internally by 2 */
-		clk_set_rate(sdd->src_clk, sdd->cur_speed * 2);
+		ret = clk_set_rate(sdd->src_clk, sdd->cur_speed * 2);
+		if (ret)
+			return ret;
 	} else {
 		/* Configure Clock */
 		val = readl(regs + S3C64XX_SPI_CLK_CFG);
@@ -612,6 +635,8 @@ static void s3c64xx_spi_config(struct s3c64xx_spi_driver_data *sdd)
 		val |= S3C64XX_SPI_ENCLK_ENABLE;
 		writel(val, regs + S3C64XX_SPI_CLK_CFG);
 	}
+
+	return 0;
 }
 
 #define XFER_DMAADDR_INVALID DMA_BIT_MASK(32)
@@ -654,7 +679,9 @@ static int s3c64xx_spi_transfer_one(struct spi_master *master,
 		sdd->cur_bpw = bpw;
 		sdd->cur_speed = speed;
 		sdd->cur_mode = spi->mode;
-		s3c64xx_spi_config(sdd);
+		status = s3c64xx_spi_config(sdd);
+		if (status)
+			return status;
 	}
 
 	if (!is_polling(sdd) && (xfer->len > fifo_len) &&
@@ -681,10 +708,15 @@ static int s3c64xx_spi_transfer_one(struct spi_master *master,
 		/* Start the signals */
 		s3c64xx_spi_set_cs(spi, true);
 
-		s3c64xx_enable_datapath(sdd, xfer, use_dma);
+		status = s3c64xx_enable_datapath(sdd, xfer, use_dma);
 
 		spin_unlock_irqrestore(&sdd->lock, flags);
 
+		if (status) {
+			dev_err(&spi->dev, "failed to enable data path for transfer: %d\n", status);
+			break;
+		}
+
 		if (use_dma)
 			status = s3c64xx_wait_for_dma(sdd, xfer);
 		else
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 149/633] hwmon: (bt1-pvt) Test sensor power supply on probe
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (147 preceding siblings ...)
  2020-10-27 13:48 ` [PATCH 5.8 148/633] spi: spi-s3c64xx: Check return values Greg Kroah-Hartman
@ 2020-10-27 13:48 ` Greg Kroah-Hartman
  2020-10-27 13:48 ` [PATCH 5.8 150/633] hwmon: (bt1-pvt) Cache current update timeout Greg Kroah-Hartman
                   ` (486 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Serge Semin, Guenter Roeck, Sasha Levin

From: Serge Semin <Sergey.Semin@baikalelectronics.ru>

[ Upstream commit a6db1561291fc0f2f9aa23bf38f381adc63e7b14 ]

Baikal-T1 PVT sensor has got a dedicated power supply domain (feed up by
the external GPVT/VPVT_18 pins). In case if it isn't powered up, the
registers will be accessible, but the sensor conversion just won't happen.
Due to that an attempt to read data from any PVT sensor will cause the
task hanging up.  For instance that will happen if XP11 jumper isn't
installed on the Baikal-T1-based BFK3.1 board. Let's at least test whether
the conversion work on the device probe procedure. By doing so will make
sure that the PVT sensor is powered up at least at boot time.

Fixes: 87976ce2825d ("hwmon: Add Baikal-T1 PVT sensor driver")
Signed-off-by: Serge Semin <Sergey.Semin@baikalelectronics.ru>
Link: https://lore.kernel.org/r/20200920110924.19741-2-Sergey.Semin@baikalelectronics.ru
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hwmon/bt1-pvt.c | 40 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 40 insertions(+)

diff --git a/drivers/hwmon/bt1-pvt.c b/drivers/hwmon/bt1-pvt.c
index 94698cae04971..f4b7353c078a8 100644
--- a/drivers/hwmon/bt1-pvt.c
+++ b/drivers/hwmon/bt1-pvt.c
@@ -13,6 +13,7 @@
 #include <linux/bitops.h>
 #include <linux/clk.h>
 #include <linux/completion.h>
+#include <linux/delay.h>
 #include <linux/device.h>
 #include <linux/hwmon-sysfs.h>
 #include <linux/hwmon.h>
@@ -982,6 +983,41 @@ static int pvt_request_clks(struct pvt_hwmon *pvt)
 	return 0;
 }
 
+static int pvt_check_pwr(struct pvt_hwmon *pvt)
+{
+	unsigned long tout;
+	int ret = 0;
+	u32 data;
+
+	/*
+	 * Test out the sensor conversion functionality. If it is not done on
+	 * time then the domain must have been unpowered and we won't be able
+	 * to use the device later in this driver.
+	 * Note If the power source is lost during the normal driver work the
+	 * data read procedure will either return -ETIMEDOUT (for the
+	 * alarm-less driver configuration) or just stop the repeated
+	 * conversion. In the later case alas we won't be able to detect the
+	 * problem.
+	 */
+	pvt_update(pvt->regs + PVT_INTR_MASK, PVT_INTR_ALL, PVT_INTR_ALL);
+	pvt_update(pvt->regs + PVT_CTRL, PVT_CTRL_EN, PVT_CTRL_EN);
+	pvt_set_tout(pvt, 0);
+	readl(pvt->regs + PVT_DATA);
+
+	tout = PVT_TOUT_MIN / NSEC_PER_USEC;
+	usleep_range(tout, 2 * tout);
+
+	data = readl(pvt->regs + PVT_DATA);
+	if (!(data & PVT_DATA_VALID)) {
+		ret = -ENODEV;
+		dev_err(pvt->dev, "Sensor is powered down\n");
+	}
+
+	pvt_update(pvt->regs + PVT_CTRL, PVT_CTRL_EN, 0);
+
+	return ret;
+}
+
 static void pvt_init_iface(struct pvt_hwmon *pvt)
 {
 	u32 trim, temp;
@@ -1109,6 +1145,10 @@ static int pvt_probe(struct platform_device *pdev)
 	if (ret)
 		return ret;
 
+	ret = pvt_check_pwr(pvt);
+	if (ret)
+		return ret;
+
 	pvt_init_iface(pvt);
 
 	ret = pvt_request_irq(pvt);
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 150/633] hwmon: (bt1-pvt) Cache current update timeout
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (148 preceding siblings ...)
  2020-10-27 13:48 ` [PATCH 5.8 149/633] hwmon: (bt1-pvt) Test sensor power supply on probe Greg Kroah-Hartman
@ 2020-10-27 13:48 ` Greg Kroah-Hartman
  2020-10-27 13:48 ` [PATCH 5.8 151/633] hwmon: (bt1-pvt) Wait for the completion with timeout Greg Kroah-Hartman
                   ` (485 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Serge Semin, Guenter Roeck, Sasha Levin

From: Serge Semin <Sergey.Semin@baikalelectronics.ru>

[ Upstream commit 0015503e5f6357f286bef34d039e43359fa4efd4 ]

Instead of converting the update timeout data to the milliseconds each
time on the read procedure let's preserve the currently set timeout in the
dedicated driver private data cache. The cached value will be then used in
the timeout read method and in the alarm-less data conversion to prevent
the caller task hanging up in case if the PVT sensor is suddenly powered
down.

Fixes: 87976ce2825d ("hwmon: Add Baikal-T1 PVT sensor driver")
Signed-off-by: Serge Semin <Sergey.Semin@baikalelectronics.ru>
Link: https://lore.kernel.org/r/20200920110924.19741-3-Sergey.Semin@baikalelectronics.ru
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hwmon/bt1-pvt.c | 85 ++++++++++++++++++++++-------------------
 drivers/hwmon/bt1-pvt.h |  3 ++
 2 files changed, 49 insertions(+), 39 deletions(-)

diff --git a/drivers/hwmon/bt1-pvt.c b/drivers/hwmon/bt1-pvt.c
index f4b7353c078a8..2600426a3b21c 100644
--- a/drivers/hwmon/bt1-pvt.c
+++ b/drivers/hwmon/bt1-pvt.c
@@ -655,44 +655,16 @@ static int pvt_write_trim(struct pvt_hwmon *pvt, long val)
 
 static int pvt_read_timeout(struct pvt_hwmon *pvt, long *val)
 {
-	unsigned long rate;
-	ktime_t kt;
-	u32 data;
-
-	rate = clk_get_rate(pvt->clks[PVT_CLOCK_REF].clk);
-	if (!rate)
-		return -ENODEV;
-
-	/*
-	 * Don't bother with mutex here, since we just read data from MMIO.
-	 * We also have to scale the ticks timeout up to compensate the
-	 * ms-ns-data translations.
-	 */
-	data = readl(pvt->regs + PVT_TTIMEOUT) + 1;
+	int ret;
 
-	/*
-	 * Calculate ref-clock based delay (Ttotal) between two consecutive
-	 * data samples of the same sensor. So we first must calculate the
-	 * delay introduced by the internal ref-clock timer (Tref * Fclk).
-	 * Then add the constant timeout cuased by each conversion latency
-	 * (Tmin). The basic formulae for each conversion is following:
-	 *   Ttotal = Tref * Fclk + Tmin
-	 * Note if alarms are enabled the sensors are polled one after
-	 * another, so in order to have the delay being applicable for each
-	 * sensor the requested value must be equally redistirbuted.
-	 */
-#if defined(CONFIG_SENSORS_BT1_PVT_ALARMS)
-	kt = ktime_set(PVT_SENSORS_NUM * (u64)data, 0);
-	kt = ktime_divns(kt, rate);
-	kt = ktime_add_ns(kt, PVT_SENSORS_NUM * PVT_TOUT_MIN);
-#else
-	kt = ktime_set(data, 0);
-	kt = ktime_divns(kt, rate);
-	kt = ktime_add_ns(kt, PVT_TOUT_MIN);
-#endif
+	ret = mutex_lock_interruptible(&pvt->iface_mtx);
+	if (ret)
+		return ret;
 
 	/* Return the result in msec as hwmon sysfs interface requires. */
-	*val = ktime_to_ms(kt);
+	*val = ktime_to_ms(pvt->timeout);
+
+	mutex_unlock(&pvt->iface_mtx);
 
 	return 0;
 }
@@ -700,7 +672,7 @@ static int pvt_read_timeout(struct pvt_hwmon *pvt, long *val)
 static int pvt_write_timeout(struct pvt_hwmon *pvt, long val)
 {
 	unsigned long rate;
-	ktime_t kt;
+	ktime_t kt, cache;
 	u32 data;
 	int ret;
 
@@ -713,7 +685,7 @@ static int pvt_write_timeout(struct pvt_hwmon *pvt, long val)
 	 * between all available sensors to have the requested delay
 	 * applicable to each individual sensor.
 	 */
-	kt = ms_to_ktime(val);
+	cache = kt = ms_to_ktime(val);
 #if defined(CONFIG_SENSORS_BT1_PVT_ALARMS)
 	kt = ktime_divns(kt, PVT_SENSORS_NUM);
 #endif
@@ -742,6 +714,7 @@ static int pvt_write_timeout(struct pvt_hwmon *pvt, long val)
 		return ret;
 
 	pvt_set_tout(pvt, data);
+	pvt->timeout = cache;
 
 	mutex_unlock(&pvt->iface_mtx);
 
@@ -1018,10 +991,17 @@ static int pvt_check_pwr(struct pvt_hwmon *pvt)
 	return ret;
 }
 
-static void pvt_init_iface(struct pvt_hwmon *pvt)
+static int pvt_init_iface(struct pvt_hwmon *pvt)
 {
+	unsigned long rate;
 	u32 trim, temp;
 
+	rate = clk_get_rate(pvt->clks[PVT_CLOCK_REF].clk);
+	if (!rate) {
+		dev_err(pvt->dev, "Invalid reference clock rate\n");
+		return -ENODEV;
+	}
+
 	/*
 	 * Make sure all interrupts and controller are disabled so not to
 	 * accidentally have ISR executed before the driver data is fully
@@ -1036,12 +1016,37 @@ static void pvt_init_iface(struct pvt_hwmon *pvt)
 	pvt_set_mode(pvt, pvt_info[pvt->sensor].mode);
 	pvt_set_tout(pvt, PVT_TOUT_DEF);
 
+	/*
+	 * Preserve the current ref-clock based delay (Ttotal) between the
+	 * sensors data samples in the driver data so not to recalculate it
+	 * each time on the data requests and timeout reads. It consists of the
+	 * delay introduced by the internal ref-clock timer (N / Fclk) and the
+	 * constant timeout caused by each conversion latency (Tmin):
+	 *   Ttotal = N / Fclk + Tmin
+	 * If alarms are enabled the sensors are polled one after another and
+	 * in order to get the next measurement of a particular sensor the
+	 * caller will have to wait for at most until all the others are
+	 * polled. In that case the formulae will look a bit different:
+	 *   Ttotal = 5 * (N / Fclk + Tmin)
+	 */
+#if defined(CONFIG_SENSORS_BT1_PVT_ALARMS)
+	pvt->timeout = ktime_set(PVT_SENSORS_NUM * PVT_TOUT_DEF, 0);
+	pvt->timeout = ktime_divns(pvt->timeout, rate);
+	pvt->timeout = ktime_add_ns(pvt->timeout, PVT_SENSORS_NUM * PVT_TOUT_MIN);
+#else
+	pvt->timeout = ktime_set(PVT_TOUT_DEF, 0);
+	pvt->timeout = ktime_divns(pvt->timeout, rate);
+	pvt->timeout = ktime_add_ns(pvt->timeout, PVT_TOUT_MIN);
+#endif
+
 	trim = PVT_TRIM_DEF;
 	if (!of_property_read_u32(pvt->dev->of_node,
 	     "baikal,pvt-temp-offset-millicelsius", &temp))
 		trim = pvt_calc_trim(temp);
 
 	pvt_set_trim(pvt, trim);
+
+	return 0;
 }
 
 static int pvt_request_irq(struct pvt_hwmon *pvt)
@@ -1149,7 +1154,9 @@ static int pvt_probe(struct platform_device *pdev)
 	if (ret)
 		return ret;
 
-	pvt_init_iface(pvt);
+	ret = pvt_init_iface(pvt);
+	if (ret)
+		return ret;
 
 	ret = pvt_request_irq(pvt);
 	if (ret)
diff --git a/drivers/hwmon/bt1-pvt.h b/drivers/hwmon/bt1-pvt.h
index 5eac73e948854..93b8dd5e7c944 100644
--- a/drivers/hwmon/bt1-pvt.h
+++ b/drivers/hwmon/bt1-pvt.h
@@ -10,6 +10,7 @@
 #include <linux/completion.h>
 #include <linux/hwmon.h>
 #include <linux/kernel.h>
+#include <linux/ktime.h>
 #include <linux/mutex.h>
 #include <linux/seqlock.h>
 
@@ -201,6 +202,7 @@ struct pvt_cache {
  *	       if alarms are disabled).
  * @sensor: current PVT sensor the data conversion is being performed for.
  * @cache: data cache descriptor.
+ * @timeout: conversion timeout cache.
  */
 struct pvt_hwmon {
 	struct device *dev;
@@ -214,6 +216,7 @@ struct pvt_hwmon {
 	struct mutex iface_mtx;
 	enum pvt_sensor_type sensor;
 	struct pvt_cache cache[PVT_SENSORS_NUM];
+	ktime_t timeout;
 };
 
 /*
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 151/633] hwmon: (bt1-pvt) Wait for the completion with timeout
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (149 preceding siblings ...)
  2020-10-27 13:48 ` [PATCH 5.8 150/633] hwmon: (bt1-pvt) Cache current update timeout Greg Kroah-Hartman
@ 2020-10-27 13:48 ` Greg Kroah-Hartman
  2020-10-27 13:48 ` [PATCH 5.8 152/633] btrfs: add owner and fs_info to alloc_state io_tree Greg Kroah-Hartman
                   ` (484 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Serge Semin, Guenter Roeck, Sasha Levin

From: Serge Semin <Sergey.Semin@baikalelectronics.ru>

[ Upstream commit 0ffd21d5985506d164ada9e8fff6daae8ef469a1 ]

If the PVT sensor is suddenly powered down while a caller is waiting for
the conversion completion, the request won't be finished and the task will
hang up on this procedure until the power is back up again. Let's call the
wait_for_completion_timeout() method instead to prevent that. The cached
timeout is exactly what we need to predict for how long conversion could
normally last.

Fixes: 87976ce2825d ("hwmon: Add Baikal-T1 PVT sensor driver")
Signed-off-by: Serge Semin <Sergey.Semin@baikalelectronics.ru>
Link: https://lore.kernel.org/r/20200920110924.19741-4-Sergey.Semin@baikalelectronics.ru
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hwmon/bt1-pvt.c | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/drivers/hwmon/bt1-pvt.c b/drivers/hwmon/bt1-pvt.c
index 2600426a3b21c..3e1d56585b91a 100644
--- a/drivers/hwmon/bt1-pvt.c
+++ b/drivers/hwmon/bt1-pvt.c
@@ -477,6 +477,7 @@ static int pvt_read_data(struct pvt_hwmon *pvt, enum pvt_sensor_type type,
 			 long *val)
 {
 	struct pvt_cache *cache = &pvt->cache[type];
+	unsigned long timeout;
 	u32 data;
 	int ret;
 
@@ -500,7 +501,14 @@ static int pvt_read_data(struct pvt_hwmon *pvt, enum pvt_sensor_type type,
 	pvt_update(pvt->regs + PVT_INTR_MASK, PVT_INTR_DVALID, 0);
 	pvt_update(pvt->regs + PVT_CTRL, PVT_CTRL_EN, PVT_CTRL_EN);
 
-	wait_for_completion(&cache->conversion);
+	/*
+	 * Wait with timeout since in case if the sensor is suddenly powered
+	 * down the request won't be completed and the caller will hang up on
+	 * this procedure until the power is back up again. Multiply the
+	 * timeout by the factor of two to prevent a false timeout.
+	 */
+	timeout = 2 * usecs_to_jiffies(ktime_to_us(pvt->timeout));
+	ret = wait_for_completion_timeout(&cache->conversion, timeout);
 
 	pvt_update(pvt->regs + PVT_CTRL, PVT_CTRL_EN, 0);
 	pvt_update(pvt->regs + PVT_INTR_MASK, PVT_INTR_DVALID,
@@ -510,6 +518,9 @@ static int pvt_read_data(struct pvt_hwmon *pvt, enum pvt_sensor_type type,
 
 	mutex_unlock(&pvt->iface_mtx);
 
+	if (!ret)
+		return -ETIMEDOUT;
+
 	if (type == PVT_TEMP)
 		*val = pvt_calc_poly(&poly_N_to_temp, data);
 	else
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 152/633] btrfs: add owner and fs_info to alloc_state io_tree
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (150 preceding siblings ...)
  2020-10-27 13:48 ` [PATCH 5.8 151/633] hwmon: (bt1-pvt) Wait for the completion with timeout Greg Kroah-Hartman
@ 2020-10-27 13:48 ` Greg Kroah-Hartman
  2020-10-27 13:48 ` [PATCH 5.8 153/633] blk-mq: move cancel of hctx->run_work to the front of blk_exit_queue Greg Kroah-Hartman
                   ` (483 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Nikolay Borisov, Qu Wenruo,
	David Sterba, Sasha Levin

From: Qu Wenruo <wqu@suse.com>

[ Upstream commit 154f7cb86809a3a796bffbc7a5a7ce0dee585eaa ]

Commit 1c11b63eff2a ("btrfs: replace pending/pinned chunks lists with io
tree") introduced btrfs_device::alloc_state extent io tree, but it
doesn't initialize the fs_info and owner member.

This means the following features are not properly supported:

- Fs owner report for insert_state() error
  Without fs_info initialized, although btrfs_err() won't panic, it
  won't output which fs is causing the error.

- Wrong owner for trace events
  alloc_state will get the owner as pinned extents.

Fix this by assiging proper fs_info and owner for
btrfs_device::alloc_state.

Fixes: 1c11b63eff2a ("btrfs: replace pending/pinned chunks lists with io tree")
Reviewed-by: Nikolay Borisov <nborisov@suse.com>
Signed-off-by: Qu Wenruo <wqu@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/btrfs/extent-io-tree.h | 1 +
 fs/btrfs/volumes.c        | 7 ++++---
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/fs/btrfs/extent-io-tree.h b/fs/btrfs/extent-io-tree.h
index 8bbb734f3f514..49384d55a908f 100644
--- a/fs/btrfs/extent-io-tree.h
+++ b/fs/btrfs/extent-io-tree.h
@@ -48,6 +48,7 @@ enum {
 	IO_TREE_INODE_FILE_EXTENT,
 	IO_TREE_LOG_CSUM_RANGE,
 	IO_TREE_SELFTEST,
+	IO_TREE_DEVICE_ALLOC_STATE,
 };
 
 struct extent_io_tree {
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index 79e9a80bd37a0..f9d8bd3099488 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -406,7 +406,7 @@ void __exit btrfs_cleanup_fs_uuids(void)
  * Returned struct is not linked onto any lists and must be destroyed using
  * btrfs_free_device.
  */
-static struct btrfs_device *__alloc_device(void)
+static struct btrfs_device *__alloc_device(struct btrfs_fs_info *fs_info)
 {
 	struct btrfs_device *dev;
 
@@ -433,7 +433,8 @@ static struct btrfs_device *__alloc_device(void)
 	btrfs_device_data_ordered_init(dev);
 	INIT_RADIX_TREE(&dev->reada_zones, GFP_NOFS & ~__GFP_DIRECT_RECLAIM);
 	INIT_RADIX_TREE(&dev->reada_extents, GFP_NOFS & ~__GFP_DIRECT_RECLAIM);
-	extent_io_tree_init(NULL, &dev->alloc_state, 0, NULL);
+	extent_io_tree_init(fs_info, &dev->alloc_state,
+			    IO_TREE_DEVICE_ALLOC_STATE, NULL);
 
 	return dev;
 }
@@ -6545,7 +6546,7 @@ struct btrfs_device *btrfs_alloc_device(struct btrfs_fs_info *fs_info,
 	if (WARN_ON(!devid && !fs_info))
 		return ERR_PTR(-EINVAL);
 
-	dev = __alloc_device();
+	dev = __alloc_device(fs_info);
 	if (IS_ERR(dev))
 		return dev;
 
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 153/633] blk-mq: move cancel of hctx->run_work to the front of blk_exit_queue
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (151 preceding siblings ...)
  2020-10-27 13:48 ` [PATCH 5.8 152/633] btrfs: add owner and fs_info to alloc_state io_tree Greg Kroah-Hartman
@ 2020-10-27 13:48 ` Greg Kroah-Hartman
  2020-10-27 13:48 ` [PATCH 5.8 154/633] ath10k: provide survey info as accumulated data Greg Kroah-Hartman
                   ` (482 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yang Yang, Ming Lei, Jens Axboe, Sasha Levin

From: Yang Yang <yang.yang@vivo.com>

[ Upstream commit 47ce030b7ac5a5259a9a5919f230b52497afc31a ]

blk_exit_queue will free elevator_data, while blk_mq_run_work_fn
will access it. Move cancel of hctx->run_work to the front of
blk_exit_queue to avoid use-after-free.

Fixes: 1b97871b501f ("blk-mq: move cancel of hctx->run_work into blk_mq_hw_sysfs_release")
Signed-off-by: Yang Yang <yang.yang@vivo.com>
Reviewed-by: Ming Lei <ming.lei@redhat.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 block/blk-mq-sysfs.c | 2 --
 block/blk-sysfs.c    | 9 ++++++++-
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/block/blk-mq-sysfs.c b/block/blk-mq-sysfs.c
index 062229395a507..7b52e7657b2d1 100644
--- a/block/blk-mq-sysfs.c
+++ b/block/blk-mq-sysfs.c
@@ -36,8 +36,6 @@ static void blk_mq_hw_sysfs_release(struct kobject *kobj)
 	struct blk_mq_hw_ctx *hctx = container_of(kobj, struct blk_mq_hw_ctx,
 						  kobj);
 
-	cancel_delayed_work_sync(&hctx->run_work);
-
 	if (hctx->flags & BLK_MQ_F_BLOCKING)
 		cleanup_srcu_struct(hctx->srcu);
 	blk_free_flush_queue(hctx->fq);
diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c
index 02643e149d5e1..95fea6c18baf7 100644
--- a/block/blk-sysfs.c
+++ b/block/blk-sysfs.c
@@ -896,9 +896,16 @@ static void __blk_release_queue(struct work_struct *work)
 
 	blk_free_queue_stats(q->stats);
 
-	if (queue_is_mq(q))
+	if (queue_is_mq(q)) {
+		struct blk_mq_hw_ctx *hctx;
+		int i;
+
 		cancel_delayed_work_sync(&q->requeue_work);
 
+		queue_for_each_hw_ctx(q, hctx, i)
+			cancel_delayed_work_sync(&hctx->run_work);
+	}
+
 	blk_exit_queue(q);
 
 	blk_queue_free_zone_bitmaps(q);
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 154/633] ath10k: provide survey info as accumulated data
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (152 preceding siblings ...)
  2020-10-27 13:48 ` [PATCH 5.8 153/633] blk-mq: move cancel of hctx->run_work to the front of blk_exit_queue Greg Kroah-Hartman
@ 2020-10-27 13:48 ` Greg Kroah-Hartman
  2020-10-27 13:48 ` [PATCH 5.8 155/633] drm/vkms: fix xrgb on compute crc Greg Kroah-Hartman
                   ` (481 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Venkateswara Naralasetty,
	Markus Theil, John Deere, Sven Eckelmann, Kalle Valo,
	Sasha Levin

From: Venkateswara Naralasetty <vnaralas@codeaurora.org>

[ Upstream commit 720e5c03e5cb26d33d97f55192b791bb48478aa5 ]

It is expected that the returned counters by .get_survey are monotonic
increasing. But the data from ath10k gets reset to zero regularly. Channel
active/busy time are then showing incorrect values (less than previous or
sometimes zero) for the currently active channel during successive survey
dump commands.

example:

  $ iw dev wlan0 survey dump
  Survey data from wlan0
  	frequency:                      5180 MHz [in use]
  	channel active time:            54995 ms
  	channel busy time:              432 ms
  	channel receive time:           0 ms
  	channel transmit time:          59 ms
  ...

  $ iw dev wlan0 survey dump
  Survey data from wlan0
  	frequency:                      5180 MHz [in use]
  	channel active time:            32592 ms
  	channel busy time:              254 ms
  	channel receive time:           0 ms
  	channel transmit time:          0 ms
  ...

The correct way to handle this is to use the non-clearing
WMI_BSS_SURVEY_REQ_TYPE_READ wmi_bss_survey_req_type. The firmware will
then accumulate the survey data and handle wrap arounds.

Tested-on: QCA9984 hw1.0 10.4-3.5.3-00057
Tested-on: QCA988X hw2.0 10.2.4-1.0-00047
Tested-on: QCA9888 hw2.0 10.4-3.9.0.2-00024
Tested-on: QCA4019 hw1.0 10.4-3.6-00140

Fixes: fa7937e3d5c2 ("ath10k: update bss channel survey information")
Signed-off-by: Venkateswara Naralasetty <vnaralas@codeaurora.org>
Tested-by: Markus Theil <markus.theil@tu-ilmenau.de>
Tested-by: John Deere <24601deerej@gmail.com>
[sven@narfation.org: adjust commit message]
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/1592232686-28712-1-git-send-email-kvalo@codeaurora.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath10k/mac.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
index 919d15584d4a2..77daca67a8e14 100644
--- a/drivers/net/wireless/ath/ath10k/mac.c
+++ b/drivers/net/wireless/ath/ath10k/mac.c
@@ -7283,7 +7283,7 @@ ath10k_mac_update_bss_chan_survey(struct ath10k *ar,
 				  struct ieee80211_channel *channel)
 {
 	int ret;
-	enum wmi_bss_survey_req_type type = WMI_BSS_SURVEY_REQ_TYPE_READ_CLEAR;
+	enum wmi_bss_survey_req_type type = WMI_BSS_SURVEY_REQ_TYPE_READ;
 
 	lockdep_assert_held(&ar->conf_mutex);
 
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 155/633] drm/vkms: fix xrgb on compute crc
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (153 preceding siblings ...)
  2020-10-27 13:48 ` [PATCH 5.8 154/633] ath10k: provide survey info as accumulated data Greg Kroah-Hartman
@ 2020-10-27 13:48 ` Greg Kroah-Hartman
  2020-10-27 13:48 ` [PATCH 5.8 156/633] Bluetooth: hci_uart: Cancel init work before unregistering Greg Kroah-Hartman
                   ` (480 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Melissa Wen, Daniel Vetter, Sasha Levin

From: Melissa Wen <melissa.srw@gmail.com>

[ Upstream commit 0986191186128b10b6bbfa5220fc587ed5725e49 ]

The previous memset operation was not correctly zeroing the alpha
channel to compute the crc, and as a result, the IGT subtest
kms_cursor_crc/pipe-A-cursor-alpha-transparent fails.

Fixes: db7f419c06d7c ("drm/vkms: Compute CRC with Cursor Plane")

Signed-off-by: Melissa Wen <melissa.srw@gmail.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20200730202524.5upzuh4irboru7my@smtp.gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/vkms/vkms_composer.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/vkms/vkms_composer.c b/drivers/gpu/drm/vkms/vkms_composer.c
index 4af2f19480f4f..b8b060354667e 100644
--- a/drivers/gpu/drm/vkms/vkms_composer.c
+++ b/drivers/gpu/drm/vkms/vkms_composer.c
@@ -33,7 +33,7 @@ static uint32_t compute_crc(void *vaddr_out, struct vkms_composer *composer)
 				     + (i * composer->pitch)
 				     + (j * composer->cpp);
 			/* XRGB format ignores Alpha channel */
-			memset(vaddr_out + src_offset + 24, 0,  8);
+			bitmap_clear(vaddr_out + src_offset, 24, 8);
 			crc = crc32_le(crc, vaddr_out + src_offset,
 				       sizeof(u32));
 		}
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 156/633] Bluetooth: hci_uart: Cancel init work before unregistering
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (154 preceding siblings ...)
  2020-10-27 13:48 ` [PATCH 5.8 155/633] drm/vkms: fix xrgb on compute crc Greg Kroah-Hartman
@ 2020-10-27 13:48 ` Greg Kroah-Hartman
  2020-10-27 13:48 ` [PATCH 5.8 157/633] drm/amd/display: Fix wrong return value in dm_update_plane_state() Greg Kroah-Hartman
                   ` (479 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Samuel Holland, Marcel Holtmann, Sasha Levin

From: Samuel Holland <samuel@sholland.org>

[ Upstream commit 3b799254cf6f481460719023d7a18f46651e5e7f ]

If hci_uart_tty_close() or hci_uart_unregister_device() is called while
hu->init_ready is scheduled, hci_register_dev() could be called after
the hci_uart is torn down. Avoid this by ensuring the work is complete
or canceled before checking the HCI_UART_REGISTERED flag.

Fixes: 9f2aee848fe6 ("Bluetooth: Add delayed init sequence support for UART controllers")
Signed-off-by: Samuel Holland <samuel@sholland.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/bluetooth/hci_ldisc.c  | 1 +
 drivers/bluetooth/hci_serdev.c | 2 ++
 2 files changed, 3 insertions(+)

diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c
index 85a30fb9177bb..f83d67eafc9f0 100644
--- a/drivers/bluetooth/hci_ldisc.c
+++ b/drivers/bluetooth/hci_ldisc.c
@@ -538,6 +538,7 @@ static void hci_uart_tty_close(struct tty_struct *tty)
 		clear_bit(HCI_UART_PROTO_READY, &hu->flags);
 		percpu_up_write(&hu->proto_lock);
 
+		cancel_work_sync(&hu->init_ready);
 		cancel_work_sync(&hu->write_work);
 
 		if (hdev) {
diff --git a/drivers/bluetooth/hci_serdev.c b/drivers/bluetooth/hci_serdev.c
index 7b233312e723f..3977bba485c22 100644
--- a/drivers/bluetooth/hci_serdev.c
+++ b/drivers/bluetooth/hci_serdev.c
@@ -355,6 +355,8 @@ void hci_uart_unregister_device(struct hci_uart *hu)
 	struct hci_dev *hdev = hu->hdev;
 
 	clear_bit(HCI_UART_PROTO_READY, &hu->flags);
+
+	cancel_work_sync(&hu->init_ready);
 	if (test_bit(HCI_UART_REGISTERED, &hu->flags))
 		hci_unregister_dev(hdev);
 	hci_free_dev(hdev);
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 157/633] drm/amd/display: Fix wrong return value in dm_update_plane_state()
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (155 preceding siblings ...)
  2020-10-27 13:48 ` [PATCH 5.8 156/633] Bluetooth: hci_uart: Cancel init work before unregistering Greg Kroah-Hartman
@ 2020-10-27 13:48 ` Greg Kroah-Hartman
  2020-10-27 13:48 ` [PATCH 5.8 158/633] drm/vgem: add missing platform_device_unregister() in vgem_init() Greg Kroah-Hartman
                   ` (478 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Leo Li, Tianjia Zhang, Alex Deucher,
	Sasha Levin

From: Tianjia Zhang <tianjia.zhang@linux.alibaba.com>

[ Upstream commit c35376137e940c3389df2726a92649c01a9844b4 ]

On an error exit path, a negative error code should be returned
instead of a positive return value.

Fixes: 9e869063b0021 ("drm/amd/display: Move iteration out of dm_update_planes")
Cc: Leo Li <sunpeng.li@amd.com>
Signed-off-by: Tianjia Zhang <tianjia.zhang@linux.alibaba.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index 7c1cc0ba30a55..78cf9e4fddbdf 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -8178,8 +8178,7 @@ static int dm_update_plane_state(struct dc *dc,
 				dm_old_plane_state->dc_state,
 				dm_state->context)) {
 
-			ret = EINVAL;
-			return ret;
+			return -EINVAL;
 		}
 
 
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 158/633] drm/vgem: add missing platform_device_unregister() in vgem_init()
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (156 preceding siblings ...)
  2020-10-27 13:48 ` [PATCH 5.8 157/633] drm/amd/display: Fix wrong return value in dm_update_plane_state() Greg Kroah-Hartman
@ 2020-10-27 13:48 ` Greg Kroah-Hartman
  2020-10-27 13:48 ` [PATCH 5.8 159/633] drm/vkms: add missing platform_device_unregister() in vkms_init() Greg Kroah-Hartman
                   ` (477 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Qinglang Miao, Daniel Vetter, Sasha Levin

From: Qinglang Miao <miaoqinglang@huawei.com>

[ Upstream commit 57fb54082d5d14512dfd21bc39d91945d3ad1ee9 ]

When vgem_init() get into out_put, the unregister call of
vgem_device->platform is missing. So add it before return.

Fixes: 363de9e7d4f6 ("drm/vgem: Use drmm_add_final_kfree")
Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20200810125942.186637-1-miaoqinglang@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/vgem/vgem_drv.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/vgem/vgem_drv.c b/drivers/gpu/drm/vgem/vgem_drv.c
index fa39d140adc6c..94825ec3a09d8 100644
--- a/drivers/gpu/drm/vgem/vgem_drv.c
+++ b/drivers/gpu/drm/vgem/vgem_drv.c
@@ -471,8 +471,8 @@ static int __init vgem_init(void)
 
 out_put:
 	drm_dev_put(&vgem_device->drm);
+	platform_device_unregister(vgem_device->platform);
 	return ret;
-
 out_unregister:
 	platform_device_unregister(vgem_device->platform);
 out_free:
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 159/633] drm/vkms: add missing platform_device_unregister() in vkms_init()
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (157 preceding siblings ...)
  2020-10-27 13:48 ` [PATCH 5.8 158/633] drm/vgem: add missing platform_device_unregister() in vgem_init() Greg Kroah-Hartman
@ 2020-10-27 13:48 ` Greg Kroah-Hartman
  2020-10-27 13:48 ` [PATCH 5.8 160/633] drm: panel: Fix bus format for OrtusTech COM43H4M85ULC panel Greg Kroah-Hartman
                   ` (476 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Qinglang Miao, Daniel Vetter, Sasha Levin

From: Qinglang Miao <miaoqinglang@huawei.com>

[ Upstream commit 7995bd13296111d672d8c5959f5e81dbbbda5286 ]

When vkms_init() get into out_put, the unregister call of
vkms_device->platform is missing. So add it before return.

Fixes: ac19f140bc27 ("drm/vkms: Use drmm_add_final_kfree")
Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20200810130011.187691-1-miaoqinglang@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/vkms/vkms_drv.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/vkms/vkms_drv.c b/drivers/gpu/drm/vkms/vkms_drv.c
index 1e8b2169d8341..e6a3ea1b399a7 100644
--- a/drivers/gpu/drm/vkms/vkms_drv.c
+++ b/drivers/gpu/drm/vkms/vkms_drv.c
@@ -188,8 +188,8 @@ static int __init vkms_init(void)
 
 out_put:
 	drm_dev_put(&vkms_device->drm);
+	platform_device_unregister(vkms_device->platform);
 	return ret;
-
 out_unregister:
 	platform_device_unregister(vkms_device->platform);
 out_free:
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 160/633] drm: panel: Fix bus format for OrtusTech COM43H4M85ULC panel
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (158 preceding siblings ...)
  2020-10-27 13:48 ` [PATCH 5.8 159/633] drm/vkms: add missing platform_device_unregister() in vkms_init() Greg Kroah-Hartman
@ 2020-10-27 13:48 ` Greg Kroah-Hartman
  2020-10-27 13:48 ` [PATCH 5.8 161/633] ath6kl: prevent potential array overflow in ath6kl_add_new_sta() Greg Kroah-Hartman
                   ` (475 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Laurent Pinchart, Sam Ravnborg, Sasha Levin

From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>

[ Upstream commit f098f168e91ca915c6cf8aa316136af647792f2f ]

The OrtusTech COM43H4M85ULC panel is a 18-bit RGB panel, set the bus
format to MEDIA_BUS_FMT_RGB666_1X18.

Fixes: 725c9d40f3fe ("drm/panel: Add support for OrtusTech COM43H4M85ULC panel")
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Sam Ravnborg <sam.ravnborg@gmail.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20200812220244.24500-1-laurent.pinchart@ideasonboard.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/panel/panel-simple.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c
index 7debf2ca42522..85fa4027d82d7 100644
--- a/drivers/gpu/drm/panel/panel-simple.c
+++ b/drivers/gpu/drm/panel/panel-simple.c
@@ -2867,7 +2867,7 @@ static const struct panel_desc ortustech_com43h4m85ulc = {
 		.width = 56,
 		.height = 93,
 	},
-	.bus_format = MEDIA_BUS_FMT_RGB888_1X24,
+	.bus_format = MEDIA_BUS_FMT_RGB666_1X18,
 	.bus_flags = DRM_BUS_FLAG_DE_HIGH | DRM_BUS_FLAG_PIXDATA_DRIVE_POSEDGE,
 	.connector_type = DRM_MODE_CONNECTOR_DPI,
 };
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 161/633] ath6kl: prevent potential array overflow in ath6kl_add_new_sta()
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (159 preceding siblings ...)
  2020-10-27 13:48 ` [PATCH 5.8 160/633] drm: panel: Fix bus format for OrtusTech COM43H4M85ULC panel Greg Kroah-Hartman
@ 2020-10-27 13:48 ` Greg Kroah-Hartman
  2020-10-27 13:48 ` [PATCH 5.8 162/633] ath9k: Fix potential out of bounds in ath9k_htc_txcompletion_cb() Greg Kroah-Hartman
                   ` (474 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Kalle Valo, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit 54f9ab7b870934b70e5a21786d951fbcf663970f ]

The value for "aid" comes from skb->data so Smatch marks it as
untrusted.  If it's invalid then it can result in an out of bounds array
access in ath6kl_add_new_sta().

Fixes: 572e27c00c9d ("ath6kl: Fix AP mode connect event parsing and TIM updates")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20200813141315.GB457408@mwanda
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath6kl/main.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/wireless/ath/ath6kl/main.c b/drivers/net/wireless/ath/ath6kl/main.c
index 5e7ea838a9218..814131a0680a4 100644
--- a/drivers/net/wireless/ath/ath6kl/main.c
+++ b/drivers/net/wireless/ath/ath6kl/main.c
@@ -430,6 +430,9 @@ void ath6kl_connect_ap_mode_sta(struct ath6kl_vif *vif, u16 aid, u8 *mac_addr,
 
 	ath6kl_dbg(ATH6KL_DBG_TRC, "new station %pM aid=%d\n", mac_addr, aid);
 
+	if (aid < 1 || aid > AP_MAX_NUM_STA)
+		return;
+
 	if (assoc_req_len > sizeof(struct ieee80211_hdr_3addr)) {
 		struct ieee80211_mgmt *mgmt =
 			(struct ieee80211_mgmt *) assoc_info;
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 162/633] ath9k: Fix potential out of bounds in ath9k_htc_txcompletion_cb()
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (160 preceding siblings ...)
  2020-10-27 13:48 ` [PATCH 5.8 161/633] ath6kl: prevent potential array overflow in ath6kl_add_new_sta() Greg Kroah-Hartman
@ 2020-10-27 13:48 ` Greg Kroah-Hartman
  2020-10-27 13:48 ` [PATCH 5.8 163/633] ath10k: Fix the size used in a dma_free_coherent() call in an error handling path Greg Kroah-Hartman
                   ` (473 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Kalle Valo, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit 2705cd7558e718a7240c64eb0afb2edad5f8c190 ]

The value of "htc_hdr->endpoint_id" comes from skb->data so Smatch marks
it as untrusted so we have to check it before using it as an array
offset.

This is similar to a bug that syzkaller found in commit e4ff08a4d727
("ath9k: Fix use-after-free Write in ath9k_htc_rx_msg") so it is
probably a real issue.

Fixes: fb9987d0f748 ("ath9k_htc: Support for AR9271 chipset.")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20200813141253.GA457408@mwanda
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath9k/htc_hst.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.c b/drivers/net/wireless/ath/ath9k/htc_hst.c
index d2e062eaf5614..510e61e97dbcb 100644
--- a/drivers/net/wireless/ath/ath9k/htc_hst.c
+++ b/drivers/net/wireless/ath/ath9k/htc_hst.c
@@ -339,6 +339,8 @@ void ath9k_htc_txcompletion_cb(struct htc_target *htc_handle,
 
 	if (skb) {
 		htc_hdr = (struct htc_frame_hdr *) skb->data;
+		if (htc_hdr->endpoint_id >= ARRAY_SIZE(htc_handle->endpoint))
+			goto ret;
 		endpoint = &htc_handle->endpoint[htc_hdr->endpoint_id];
 		skb_pull(skb, sizeof(struct htc_frame_hdr));
 
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 163/633] ath10k: Fix the size used in a dma_free_coherent() call in an error handling path
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (161 preceding siblings ...)
  2020-10-27 13:48 ` [PATCH 5.8 162/633] ath9k: Fix potential out of bounds in ath9k_htc_txcompletion_cb() Greg Kroah-Hartman
@ 2020-10-27 13:48 ` Greg Kroah-Hartman
  2020-10-27 13:48 ` [PATCH 5.8 164/633] wcn36xx: Fix reported 802.11n rx_highest rate wcn3660/wcn3680 Greg Kroah-Hartman
                   ` (472 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christophe JAILLET, Rakesh Pillai,
	Kalle Valo, Sasha Levin

From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>

[ Upstream commit 454530a9950b5a26d4998908249564cedfc4babc ]

Update the size used in 'dma_free_coherent()' in order to match the one
used in the corresponding 'dma_alloc_coherent()'.

Fixes: 1863008369ae ("ath10k: fix shadow register implementation for WCN3990")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Reviewed-by: Rakesh Pillai <pillair@codeaurora.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20200802122227.678637-1-christophe.jaillet@wanadoo.fr
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath10k/ce.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/ath/ath10k/ce.c b/drivers/net/wireless/ath/ath10k/ce.c
index 294fbc1e89ab8..e6e0284e47837 100644
--- a/drivers/net/wireless/ath/ath10k/ce.c
+++ b/drivers/net/wireless/ath/ath10k/ce.c
@@ -1555,7 +1555,7 @@ ath10k_ce_alloc_src_ring(struct ath10k *ar, unsigned int ce_id,
 		ret = ath10k_ce_alloc_shadow_base(ar, src_ring, nentries);
 		if (ret) {
 			dma_free_coherent(ar->dev,
-					  (nentries * sizeof(struct ce_desc_64) +
+					  (nentries * sizeof(struct ce_desc) +
 					   CE_DESC_RING_ALIGN),
 					  src_ring->base_addr_owner_space_unaligned,
 					  base_addr);
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 164/633] wcn36xx: Fix reported 802.11n rx_highest rate wcn3660/wcn3680
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (162 preceding siblings ...)
  2020-10-27 13:48 ` [PATCH 5.8 163/633] ath10k: Fix the size used in a dma_free_coherent() call in an error handling path Greg Kroah-Hartman
@ 2020-10-27 13:48 ` Greg Kroah-Hartman
  2020-10-27 13:48 ` [PATCH 5.8 165/633] ASoC: qcom: lpass-platform: fix memory leak Greg Kroah-Hartman
                   ` (471 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Bryan ODonoghue, Kalle Valo, Sasha Levin

From: Bryan O'Donoghue <bryan.odonoghue@linaro.org>

[ Upstream commit 3b9fb6791e7113679b1eb472e6ce1659e80f5797 ]

Qualcomm's document "80-WL007-1 Rev. J" states that the highest rx rate for
the WCN3660 and WCN3680 on MCS 7 is 150 Mbps not the 72 Mbps stated here.

This patch fixes the data-rate declared in the 5GHz table.

Fixes: 8e84c2582169 ("wcn36xx: mac80211 driver for Qualcomm WCN3660/WCN3680
hardware")

Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20200802004824.1307124-1-bryan.odonoghue@linaro.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/wcn36xx/main.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/ath/wcn36xx/main.c b/drivers/net/wireless/ath/wcn36xx/main.c
index 702b689c06df3..f3ea629764fa8 100644
--- a/drivers/net/wireless/ath/wcn36xx/main.c
+++ b/drivers/net/wireless/ath/wcn36xx/main.c
@@ -163,7 +163,7 @@ static struct ieee80211_supported_band wcn_band_5ghz = {
 		.ampdu_density = IEEE80211_HT_MPDU_DENSITY_16,
 		.mcs = {
 			.rx_mask = { 0xff, 0, 0, 0, 0, 0, 0, 0, 0, 0, },
-			.rx_highest = cpu_to_le16(72),
+			.rx_highest = cpu_to_le16(150),
 			.tx_params = IEEE80211_HT_MCS_TX_DEFINED,
 		}
 	}
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 165/633] ASoC: qcom: lpass-platform: fix memory leak
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (163 preceding siblings ...)
  2020-10-27 13:48 ` [PATCH 5.8 164/633] wcn36xx: Fix reported 802.11n rx_highest rate wcn3660/wcn3680 Greg Kroah-Hartman
@ 2020-10-27 13:48 ` Greg Kroah-Hartman
  2020-10-27 13:48 ` [PATCH 5.8 166/633] ASoC: qcom: lpass-cpu: fix concurrency issue Greg Kroah-Hartman
                   ` (470 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Rohit kumar, Srinivas Kandagatla,
	Mark Brown, Sasha Levin

From: Rohit kumar <rohitkr@codeaurora.org>

[ Upstream commit 5fd188215d4eb52703600d8986b22311099a5940 ]

lpass_pcm_data is never freed. Free it in close
ops to avoid memory leak.

Fixes: 022d00ee0b55 ("ASoC: lpass-platform: Fix broken pcm data usage")
Signed-off-by: Rohit kumar <rohitkr@codeaurora.org>
Reviewed-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Link: https://lore.kernel.org/r/1597402388-14112-5-git-send-email-rohitkr@codeaurora.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/qcom/lpass-platform.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/sound/soc/qcom/lpass-platform.c b/sound/soc/qcom/lpass-platform.c
index 34f7fd1bab1cf..693839deebfe8 100644
--- a/sound/soc/qcom/lpass-platform.c
+++ b/sound/soc/qcom/lpass-platform.c
@@ -61,7 +61,7 @@ static int lpass_platform_pcmops_open(struct snd_soc_component *component,
 	int ret, dma_ch, dir = substream->stream;
 	struct lpass_pcm_data *data;
 
-	data = devm_kzalloc(soc_runtime->dev, sizeof(*data), GFP_KERNEL);
+	data = kzalloc(sizeof(*data), GFP_KERNEL);
 	if (!data)
 		return -ENOMEM;
 
@@ -118,6 +118,7 @@ static int lpass_platform_pcmops_close(struct snd_soc_component *component,
 	if (v->free_dma_channel)
 		v->free_dma_channel(drvdata, data->dma_ch);
 
+	kfree(data);
 	return 0;
 }
 
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 166/633] ASoC: qcom: lpass-cpu: fix concurrency issue
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (164 preceding siblings ...)
  2020-10-27 13:48 ` [PATCH 5.8 165/633] ASoC: qcom: lpass-platform: fix memory leak Greg Kroah-Hartman
@ 2020-10-27 13:48 ` Greg Kroah-Hartman
  2020-10-27 13:48 ` [PATCH 5.8 167/633] ath11k: Fix possible memleak in ath11k_qmi_init_service Greg Kroah-Hartman
                   ` (469 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Rohit kumar, Srinivas Kandagatla,
	Mark Brown, Sasha Levin

From: Rohit kumar <rohitkr@codeaurora.org>

[ Upstream commit 753a6e17942f6f425ca622e1610625998312ad89 ]

i2sctl register value is set to 0 during hw_free(). This
impacts any ongoing concurrent session on the same i2s
port. As trigger() stop already resets enable bit to 0,
there is no need of explicit hw_free. Removing it to
fix the issue.

Fixes: 80beab8e1d86 ("ASoC: qcom: Add LPASS CPU DAI driver")
Signed-off-by: Rohit kumar <rohitkr@codeaurora.org>
Reviewed-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Link: https://lore.kernel.org/r/1597402388-14112-7-git-send-email-rohitkr@codeaurora.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/qcom/lpass-cpu.c | 16 ----------------
 1 file changed, 16 deletions(-)

diff --git a/sound/soc/qcom/lpass-cpu.c b/sound/soc/qcom/lpass-cpu.c
index e00a4af29c13f..f25da84f175ac 100644
--- a/sound/soc/qcom/lpass-cpu.c
+++ b/sound/soc/qcom/lpass-cpu.c
@@ -209,21 +209,6 @@ static int lpass_cpu_daiops_hw_params(struct snd_pcm_substream *substream,
 	return 0;
 }
 
-static int lpass_cpu_daiops_hw_free(struct snd_pcm_substream *substream,
-		struct snd_soc_dai *dai)
-{
-	struct lpass_data *drvdata = snd_soc_dai_get_drvdata(dai);
-	int ret;
-
-	ret = regmap_write(drvdata->lpaif_map,
-			   LPAIF_I2SCTL_REG(drvdata->variant, dai->driver->id),
-			   0);
-	if (ret)
-		dev_err(dai->dev, "error writing to i2sctl reg: %d\n", ret);
-
-	return ret;
-}
-
 static int lpass_cpu_daiops_prepare(struct snd_pcm_substream *substream,
 		struct snd_soc_dai *dai)
 {
@@ -304,7 +289,6 @@ const struct snd_soc_dai_ops asoc_qcom_lpass_cpu_dai_ops = {
 	.startup	= lpass_cpu_daiops_startup,
 	.shutdown	= lpass_cpu_daiops_shutdown,
 	.hw_params	= lpass_cpu_daiops_hw_params,
-	.hw_free	= lpass_cpu_daiops_hw_free,
 	.prepare	= lpass_cpu_daiops_prepare,
 	.trigger	= lpass_cpu_daiops_trigger,
 };
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 167/633] ath11k: Fix possible memleak in ath11k_qmi_init_service
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (165 preceding siblings ...)
  2020-10-27 13:48 ` [PATCH 5.8 166/633] ASoC: qcom: lpass-cpu: fix concurrency issue Greg Kroah-Hartman
@ 2020-10-27 13:48 ` Greg Kroah-Hartman
  2020-10-27 13:48 ` [PATCH 5.8 168/633] brcmfmac: check ndev pointer Greg Kroah-Hartman
                   ` (468 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Wang Yufen, Kalle Valo,
	Sasha Levin

From: Wang Yufen <wangyufen@huawei.com>

[ Upstream commit 28f1632118818d9dccabf4c0fccfe49686742317 ]

When qmi_add_lookup fail, we should destroy the workqueue

Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Wang Yufen <wangyufen@huawei.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/1595237804-66297-1-git-send-email-wangyufen@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath11k/qmi.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/wireless/ath/ath11k/qmi.c b/drivers/net/wireless/ath/ath11k/qmi.c
index c00a99ad8dbc1..497cff7e64cc5 100644
--- a/drivers/net/wireless/ath/ath11k/qmi.c
+++ b/drivers/net/wireless/ath/ath11k/qmi.c
@@ -2419,6 +2419,7 @@ int ath11k_qmi_init_service(struct ath11k_base *ab)
 			     ATH11K_QMI_WLFW_SERVICE_INS_ID_V01);
 	if (ret < 0) {
 		ath11k_warn(ab, "failed to add qmi lookup\n");
+		destroy_workqueue(ab->qmi.event_wq);
 		return ret;
 	}
 
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 168/633] brcmfmac: check ndev pointer
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (166 preceding siblings ...)
  2020-10-27 13:48 ` [PATCH 5.8 167/633] ath11k: Fix possible memleak in ath11k_qmi_init_service Greg Kroah-Hartman
@ 2020-10-27 13:48 ` Greg Kroah-Hartman
  2020-10-27 13:48 ` [PATCH 5.8 169/633] mwifiex: Do not use GFP_KERNEL in atomic context Greg Kroah-Hartman
                   ` (467 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:48 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Tom Rix, Kalle Valo, Sasha Levin

From: Tom Rix <trix@redhat.com>

[ Upstream commit 9c9f015bc9f8839831c7ba0a6d731a3853c464e2 ]

Clang static analysis reports this error

brcmfmac/core.c:490:4: warning: Dereference of null pointer
        (*ifp)->ndev->stats.rx_errors++;
        ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

In this block of code

	if (ret || !(*ifp) || !(*ifp)->ndev) {
		if (ret != -ENODATA && *ifp)
			(*ifp)->ndev->stats.rx_errors++;
		brcmu_pkt_buf_free_skb(skb);
		return -ENODATA;
	}

(*ifp)->ndev being NULL is caught as an error
But then it is used to report the error.

So add a check before using it.

Fixes: 91b632803ee4 ("brcmfmac: Use net_device_stats from struct net_device")
Signed-off-by: Tom Rix <trix@redhat.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20200802161804.6126-1-trix@redhat.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
index c88655acc78c7..76b478f70b4bb 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
@@ -483,7 +483,7 @@ static int brcmf_rx_hdrpull(struct brcmf_pub *drvr, struct sk_buff *skb,
 	ret = brcmf_proto_hdrpull(drvr, true, skb, ifp);
 
 	if (ret || !(*ifp) || !(*ifp)->ndev) {
-		if (ret != -ENODATA && *ifp)
+		if (ret != -ENODATA && *ifp && (*ifp)->ndev)
 			(*ifp)->ndev->stats.rx_errors++;
 		brcmu_pkt_buf_free_skb(skb);
 		return -ENODATA;
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 169/633] mwifiex: Do not use GFP_KERNEL in atomic context
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (167 preceding siblings ...)
  2020-10-27 13:48 ` [PATCH 5.8 168/633] brcmfmac: check ndev pointer Greg Kroah-Hartman
@ 2020-10-27 13:48 ` Greg Kroah-Hartman
  2020-10-27 13:48 ` [PATCH 5.8 170/633] staging: rtl8192u: " Greg Kroah-Hartman
                   ` (466 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christophe JAILLET, Kalle Valo, Sasha Levin

From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>

[ Upstream commit d2ab7f00f4321370a8ee14e5630d4349fdacc42e ]

A possible call chain is as follow:
  mwifiex_sdio_interrupt                            (sdio.c)
    --> mwifiex_main_process                        (main.c)
      --> mwifiex_process_cmdresp                   (cmdevt.c)
        --> mwifiex_process_sta_cmdresp             (sta_cmdresp.c)
          --> mwifiex_ret_802_11_scan               (scan.c)
            --> mwifiex_parse_single_response_buf   (scan.c)

'mwifiex_sdio_interrupt()' is an interrupt function.

Also note that 'mwifiex_ret_802_11_scan()' already uses GFP_ATOMIC.

So use GFP_ATOMIC instead of GFP_KERNEL when memory is allocated in
'mwifiex_parse_single_response_buf()'.

Fixes: 7c6fa2a843c5 ("mwifiex: use cfg80211 dynamic scan table and cfg80211_get_bss API")
or
Fixes: 601216e12c65e ("mwifiex: process RX packets in SDIO IRQ thread directly")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20200809092906.744621-1-christophe.jaillet@wanadoo.fr
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/marvell/mwifiex/scan.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/marvell/mwifiex/scan.c b/drivers/net/wireless/marvell/mwifiex/scan.c
index ff932627a46c1..2fb69a590bd8e 100644
--- a/drivers/net/wireless/marvell/mwifiex/scan.c
+++ b/drivers/net/wireless/marvell/mwifiex/scan.c
@@ -1889,7 +1889,7 @@ mwifiex_parse_single_response_buf(struct mwifiex_private *priv, u8 **bss_info,
 					    chan, CFG80211_BSS_FTYPE_UNKNOWN,
 					    bssid, timestamp,
 					    cap_info_bitmap, beacon_period,
-					    ie_buf, ie_len, rssi, GFP_KERNEL);
+					    ie_buf, ie_len, rssi, GFP_ATOMIC);
 			if (bss) {
 				bss_priv = (struct mwifiex_bss_priv *)bss->priv;
 				bss_priv->band = band;
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 170/633] staging: rtl8192u: Do not use GFP_KERNEL in atomic context
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (168 preceding siblings ...)
  2020-10-27 13:48 ` [PATCH 5.8 169/633] mwifiex: Do not use GFP_KERNEL in atomic context Greg Kroah-Hartman
@ 2020-10-27 13:48 ` Greg Kroah-Hartman
  2020-10-27 13:48 ` [PATCH 5.8 171/633] drm/amd/display: fix potential integer overflow when shifting 32 bit variable bl_pwm Greg Kroah-Hartman
                   ` (465 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:48 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Christophe JAILLET, Sasha Levin

From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>

[ Upstream commit acac75bb451fd39344eb54fad6602dfc9482e970 ]

'rtl8192_irq_rx_tasklet()' is a tasklet initialized in
'rtl8192_init_priv_task()'.
>From this function it is possible to allocate some memory with the
GFP_KERNEL flag, which is not allowed in the atomic context of a tasklet.

Use GFP_ATOMIC instead.

The call chain is:
  rtl8192_irq_rx_tasklet            (in r8192U_core.c)
    --> rtl8192_rx_nomal            (in r8192U_core.c)
      --> ieee80211_rx              (in ieee80211/ieee80211_rx.c)
        --> RxReorderIndicatePacket (in ieee80211/ieee80211_rx.c)

Fixes: 79a5ccd97209 ("staging: rtl8192u: fix large frame size compiler warning")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Link: https://lore.kernel.org/r/20200813173458.758284-1-christophe.jaillet@wanadoo.fr
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/staging/rtl8192u/ieee80211/ieee80211_rx.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/rtl8192u/ieee80211/ieee80211_rx.c b/drivers/staging/rtl8192u/ieee80211/ieee80211_rx.c
index 195d963c4fbb4..b6fee7230ce05 100644
--- a/drivers/staging/rtl8192u/ieee80211/ieee80211_rx.c
+++ b/drivers/staging/rtl8192u/ieee80211/ieee80211_rx.c
@@ -597,7 +597,7 @@ static void RxReorderIndicatePacket(struct ieee80211_device *ieee,
 
 	prxbIndicateArray = kmalloc_array(REORDER_WIN_SIZE,
 					  sizeof(struct ieee80211_rxb *),
-					  GFP_KERNEL);
+					  GFP_ATOMIC);
 	if (!prxbIndicateArray)
 		return;
 
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 171/633] drm/amd/display: fix potential integer overflow when shifting 32 bit variable bl_pwm
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (169 preceding siblings ...)
  2020-10-27 13:48 ` [PATCH 5.8 170/633] staging: rtl8192u: " Greg Kroah-Hartman
@ 2020-10-27 13:48 ` Greg Kroah-Hartman
  2020-10-27 13:48 ` [PATCH 5.8 172/633] selftests/bpf: Fix test_vmlinux test to use bpf_probe_read_user() Greg Kroah-Hartman
                   ` (464 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Colin Ian King, Alex Deucher, Sasha Levin

From: Colin Ian King <colin.king@canonical.com>

[ Upstream commit 1d5503331b12a76266049289747dfd94f1643fde ]

The 32 bit unsigned integer bl_pwm is being shifted using 32 bit arithmetic
and then being assigned to a 64 bit unsigned integer.  There is a potential
for a 32 bit overflow so cast bl_pwm to enforce a 64 bit shift operation
to avoid this.

Addresses-Coverity: ("unintentional integer overflow")
Fixes: 3ba01817365c ("drm/amd/display: Move panel_cntl specific register from abm to panel_cntl.")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/display/dc/dce/dce_panel_cntl.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_panel_cntl.c b/drivers/gpu/drm/amd/display/dc/dce/dce_panel_cntl.c
index ebff9b1e312e5..124c081a0f2ca 100644
--- a/drivers/gpu/drm/amd/display/dc/dce/dce_panel_cntl.c
+++ b/drivers/gpu/drm/amd/display/dc/dce/dce_panel_cntl.c
@@ -75,7 +75,7 @@ static unsigned int calculate_16_bit_backlight_from_pwm(struct dce_panel_cntl *d
 	else
 		bl_pwm &= 0xFFFF;
 
-	current_backlight = bl_pwm << (1 + bl_int_count);
+	current_backlight = (uint64_t)bl_pwm << (1 + bl_int_count);
 
 	if (bl_period == 0)
 		bl_period = 0xFFFF;
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 172/633] selftests/bpf: Fix test_vmlinux test to use bpf_probe_read_user()
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (170 preceding siblings ...)
  2020-10-27 13:48 ` [PATCH 5.8 171/633] drm/amd/display: fix potential integer overflow when shifting 32 bit variable bl_pwm Greg Kroah-Hartman
@ 2020-10-27 13:48 ` Greg Kroah-Hartman
  2020-10-27 13:48 ` [PATCH 5.8 173/633] drm/gma500: fix error check Greg Kroah-Hartman
                   ` (463 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Andrii Nakryiko, Alexei Starovoitov,
	Sasha Levin

From: Andrii Nakryiko <andriin@fb.com>

[ Upstream commit 02f47faa25db134f6043fb6b12a68b5d4c980bb6 ]

The test is reading UAPI kernel structure from user-space. So it doesn't need
CO-RE relocations and has to use bpf_probe_read_user().

Fixes: acbd06206bbb ("selftests/bpf: Add vmlinux.h selftest exercising tracing of syscalls")
Signed-off-by: Andrii Nakryiko <andriin@fb.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://lore.kernel.org/bpf/20200818213356.2629020-6-andriin@fb.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/testing/selftests/bpf/progs/test_vmlinux.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/tools/testing/selftests/bpf/progs/test_vmlinux.c b/tools/testing/selftests/bpf/progs/test_vmlinux.c
index 5611b564d3b1c..f54b2293c490f 100644
--- a/tools/testing/selftests/bpf/progs/test_vmlinux.c
+++ b/tools/testing/selftests/bpf/progs/test_vmlinux.c
@@ -19,12 +19,14 @@ SEC("tp/syscalls/sys_enter_nanosleep")
 int handle__tp(struct trace_event_raw_sys_enter *args)
 {
 	struct __kernel_timespec *ts;
+	long tv_nsec;
 
 	if (args->id != __NR_nanosleep)
 		return 0;
 
 	ts = (void *)args->args[0];
-	if (BPF_CORE_READ(ts, tv_nsec) != MY_TV_NSEC)
+	if (bpf_probe_read_user(&tv_nsec, sizeof(ts->tv_nsec), &ts->tv_nsec) ||
+	    tv_nsec != MY_TV_NSEC)
 		return 0;
 
 	tp_called = true;
@@ -35,12 +37,14 @@ SEC("raw_tp/sys_enter")
 int BPF_PROG(handle__raw_tp, struct pt_regs *regs, long id)
 {
 	struct __kernel_timespec *ts;
+	long tv_nsec;
 
 	if (id != __NR_nanosleep)
 		return 0;
 
 	ts = (void *)PT_REGS_PARM1_CORE(regs);
-	if (BPF_CORE_READ(ts, tv_nsec) != MY_TV_NSEC)
+	if (bpf_probe_read_user(&tv_nsec, sizeof(ts->tv_nsec), &ts->tv_nsec) ||
+	    tv_nsec != MY_TV_NSEC)
 		return 0;
 
 	raw_tp_called = true;
@@ -51,12 +55,14 @@ SEC("tp_btf/sys_enter")
 int BPF_PROG(handle__tp_btf, struct pt_regs *regs, long id)
 {
 	struct __kernel_timespec *ts;
+	long tv_nsec;
 
 	if (id != __NR_nanosleep)
 		return 0;
 
 	ts = (void *)PT_REGS_PARM1_CORE(regs);
-	if (BPF_CORE_READ(ts, tv_nsec) != MY_TV_NSEC)
+	if (bpf_probe_read_user(&tv_nsec, sizeof(ts->tv_nsec), &ts->tv_nsec) ||
+	    tv_nsec != MY_TV_NSEC)
 		return 0;
 
 	tp_btf_called = true;
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 173/633] drm/gma500: fix error check
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (171 preceding siblings ...)
  2020-10-27 13:48 ` [PATCH 5.8 172/633] selftests/bpf: Fix test_vmlinux test to use bpf_probe_read_user() Greg Kroah-Hartman
@ 2020-10-27 13:48 ` Greg Kroah-Hartman
  2020-10-27 13:48 ` [PATCH 5.8 174/633] scsi: qla4xxx: Fix an error handling path in qla4xxx_get_host_stats() Greg Kroah-Hartman
                   ` (462 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Tom Rix, Patrik Jakobsson, Sasha Levin

From: Tom Rix <trix@redhat.com>

[ Upstream commit cdd296cdae1af2d27dae3fcfbdf12c5252ab78cf ]

Reviewing this block of code in cdv_intel_dp_init()

ret = cdv_intel_dp_aux_native_read(gma_encoder, DP_DPCD_REV, ...

cdv_intel_edp_panel_vdd_off(gma_encoder);
if (ret == 0) {
	/* if this fails, presume the device is a ghost */
	DRM_INFO("failed to retrieve link info, disabling eDP\n");
	drm_encoder_cleanup(encoder);
	cdv_intel_dp_destroy(connector);
	goto err_priv;
} else {

The (ret == 0) is not strict enough.
cdv_intel_dp_aux_native_read() returns > 0 on success
otherwise it is failure.

So change to <=

Fixes: d112a8163f83 ("gma500/cdv: Add eDP support")

Signed-off-by: Tom Rix <trix@redhat.com>
Signed-off-by: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20200805205911.20927-1-trix@redhat.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/gma500/cdv_intel_dp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/gma500/cdv_intel_dp.c b/drivers/gpu/drm/gma500/cdv_intel_dp.c
index f41cbb753bb46..720a767118c9c 100644
--- a/drivers/gpu/drm/gma500/cdv_intel_dp.c
+++ b/drivers/gpu/drm/gma500/cdv_intel_dp.c
@@ -2078,7 +2078,7 @@ cdv_intel_dp_init(struct drm_device *dev, struct psb_intel_mode_device *mode_dev
 					       intel_dp->dpcd,
 					       sizeof(intel_dp->dpcd));
 		cdv_intel_edp_panel_vdd_off(gma_encoder);
-		if (ret == 0) {
+		if (ret <= 0) {
 			/* if this fails, presume the device is a ghost */
 			DRM_INFO("failed to retrieve link info, disabling eDP\n");
 			drm_encoder_cleanup(encoder);
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 174/633] scsi: qla4xxx: Fix an error handling path in qla4xxx_get_host_stats()
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (172 preceding siblings ...)
  2020-10-27 13:48 ` [PATCH 5.8 173/633] drm/gma500: fix error check Greg Kroah-Hartman
@ 2020-10-27 13:48 ` Greg Kroah-Hartman
  2020-10-27 13:48 ` [PATCH 5.8 175/633] scsi: qla2xxx: Fix the size used in a dma_free_coherent() call Greg Kroah-Hartman
                   ` (461 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christophe JAILLET,
	Martin K. Petersen, Sasha Levin

From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>

[ Upstream commit 574918e69720fe62ab3eb42ec3750230c8d16b06 ]

Update the size used in 'dma_free_coherent()' in order to match the one
used in the corresponding 'dma_alloc_coherent()'.

Link: https://lore.kernel.org/r/20200802101527.676054-1-christophe.jaillet@wanadoo.fr
Fixes: 4161cee52df8 ("[SCSI] qla4xxx: Add host statistics support")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/qla4xxx/ql4_os.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c
index 5dc697ce8b5dd..4a6b15dc36aaf 100644
--- a/drivers/scsi/qla4xxx/ql4_os.c
+++ b/drivers/scsi/qla4xxx/ql4_os.c
@@ -1220,7 +1220,7 @@ static int qla4xxx_get_host_stats(struct Scsi_Host *shost, char *buf, int len)
 			le64_to_cpu(ql_iscsi_stats->iscsi_sequence_error);
 exit_host_stats:
 	if (ql_iscsi_stats)
-		dma_free_coherent(&ha->pdev->dev, host_stats_size,
+		dma_free_coherent(&ha->pdev->dev, stats_size,
 				  ql_iscsi_stats, iscsi_stats_dma);
 
 	ql4_printk(KERN_INFO, ha, "%s: Get host stats done\n",
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 175/633] scsi: qla2xxx: Fix the size used in a dma_free_coherent() call
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (173 preceding siblings ...)
  2020-10-27 13:48 ` [PATCH 5.8 174/633] scsi: qla4xxx: Fix an error handling path in qla4xxx_get_host_stats() Greg Kroah-Hartman
@ 2020-10-27 13:48 ` Greg Kroah-Hartman
  2020-10-27 13:48 ` [PATCH 5.8 176/633] scsi: qla2xxx: Fix wrong return value in qlt_chk_unresolv_exchg() Greg Kroah-Hartman
                   ` (460 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christophe JAILLET,
	Martin K. Petersen, Sasha Levin

From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>

[ Upstream commit 650b323c8e7c3ac4830a20895b1d444fd68dd787 ]

Update the size used in 'dma_free_coherent()' in order to match the one
used in the corresponding 'dma_alloc_coherent()'.

[mkp: removed memset() hunk that has already been addressed]

Link: https://lore.kernel.org/r/20200802110721.677707-1-christophe.jaillet@wanadoo.fr
Fixes: 4161cee52df8 ("[SCSI] qla4xxx: Add host statistics support")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/qla2xxx/qla_mbx.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c
index fdb2ce7acb912..9f5d3aa1d8745 100644
--- a/drivers/scsi/qla2xxx/qla_mbx.c
+++ b/drivers/scsi/qla2xxx/qla_mbx.c
@@ -4908,7 +4908,7 @@ qla25xx_set_els_cmds_supported(scsi_qla_host_t *vha)
 		    "Done %s.\n", __func__);
 	}
 
-	dma_free_coherent(&ha->pdev->dev, DMA_POOL_SIZE,
+	dma_free_coherent(&ha->pdev->dev, ELS_CMD_MAP_SIZE,
 	   els_cmd_map, els_cmd_map_dma);
 
 	return rval;
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 176/633] scsi: qla2xxx: Fix wrong return value in qlt_chk_unresolv_exchg()
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (174 preceding siblings ...)
  2020-10-27 13:48 ` [PATCH 5.8 175/633] scsi: qla2xxx: Fix the size used in a dma_free_coherent() call Greg Kroah-Hartman
@ 2020-10-27 13:48 ` Greg Kroah-Hartman
  2020-10-27 13:48 ` [PATCH 5.8 177/633] scsi: qla2xxx: Fix wrong return value in qla_nvme_register_hba() Greg Kroah-Hartman
                   ` (459 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Quinn Tran, Tianjia Zhang,
	Martin K. Petersen, Sasha Levin

From: Tianjia Zhang <tianjia.zhang@linux.alibaba.com>

[ Upstream commit bbf2d06a9d767718bfe6028d6288c03edb98554a ]

In the case of a failed retry, a positive value EIO is returned here.  I
think this is a typo error. It is necessary to return an error value.

[mkp: caller checks != 0 but the rest of the file uses -Exxx so fix this up
to be consistent]

Link: https://lore.kernel.org/r/20200802111528.4974-1-tianjia.zhang@linux.alibaba.com
Fixes: 0691094ff3f2 ("scsi: qla2xxx: Add logic to detect ABTS hang and response completion")
Cc: Quinn Tran <quinn.tran@cavium.com>
Signed-off-by: Tianjia Zhang <tianjia.zhang@linux.alibaba.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/qla2xxx/qla_target.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
index 90289162dbd4c..a034e9caa2997 100644
--- a/drivers/scsi/qla2xxx/qla_target.c
+++ b/drivers/scsi/qla2xxx/qla_target.c
@@ -5668,7 +5668,7 @@ static int qlt_chk_unresolv_exchg(struct scsi_qla_host *vha,
 		/* found existing exchange */
 		qpair->retry_term_cnt++;
 		if (qpair->retry_term_cnt >= 5) {
-			rc = EIO;
+			rc = -EIO;
 			qpair->retry_term_cnt = 0;
 			ql_log(ql_log_warn, vha, 0xffff,
 			    "Unable to send ABTS Respond. Dumping firmware.\n");
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 177/633] scsi: qla2xxx: Fix wrong return value in qla_nvme_register_hba()
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (175 preceding siblings ...)
  2020-10-27 13:48 ` [PATCH 5.8 176/633] scsi: qla2xxx: Fix wrong return value in qlt_chk_unresolv_exchg() Greg Kroah-Hartman
@ 2020-10-27 13:48 ` Greg Kroah-Hartman
  2020-10-27 13:48 ` [PATCH 5.8 178/633] scsi: csiostor: Fix wrong return value in csio_hw_prep_fw() Greg Kroah-Hartman
                   ` (458 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Quinn Tran, Tianjia Zhang,
	Martin K. Petersen, Sasha Levin

From: Tianjia Zhang <tianjia.zhang@linux.alibaba.com>

[ Upstream commit ca4fb89a3d714a770e9c73c649da830f3f4a5326 ]

On an error exit path, a negative error code should be returned instead of
a positive return value.

Link: https://lore.kernel.org/r/20200802111530.5020-1-tianjia.zhang@linux.alibaba.com
Fixes: 8777e4314d39 ("scsi: qla2xxx: Migrate NVME N2N handling into state machine")
Cc: Quinn Tran <quinn.tran@cavium.com>
Signed-off-by: Tianjia Zhang <tianjia.zhang@linux.alibaba.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/qla2xxx/qla_nvme.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/scsi/qla2xxx/qla_nvme.c b/drivers/scsi/qla2xxx/qla_nvme.c
index 262dfd7635a48..7b14fd1cb0309 100644
--- a/drivers/scsi/qla2xxx/qla_nvme.c
+++ b/drivers/scsi/qla2xxx/qla_nvme.c
@@ -683,7 +683,7 @@ int qla_nvme_register_hba(struct scsi_qla_host *vha)
 	struct nvme_fc_port_template *tmpl;
 	struct qla_hw_data *ha;
 	struct nvme_fc_port_info pinfo;
-	int ret = EINVAL;
+	int ret = -EINVAL;
 
 	if (!IS_ENABLED(CONFIG_NVME_FC))
 		return ret;
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 178/633] scsi: csiostor: Fix wrong return value in csio_hw_prep_fw()
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (176 preceding siblings ...)
  2020-10-27 13:48 ` [PATCH 5.8 177/633] scsi: qla2xxx: Fix wrong return value in qla_nvme_register_hba() Greg Kroah-Hartman
@ 2020-10-27 13:48 ` Greg Kroah-Hartman
  2020-10-27 13:48 ` [PATCH 5.8 179/633] libbpf: Fix unintentional success return code in bpf_object__load Greg Kroah-Hartman
                   ` (457 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Praveen Madhavan, Tianjia Zhang,
	Martin K. Petersen, Sasha Levin

From: Tianjia Zhang <tianjia.zhang@linux.alibaba.com>

[ Upstream commit 44f4daf8678ae5f08c93bbe70792f90cd88e4649 ]

On an error exit path, a negative error code should be returned instead of
a positive return value.

Link: https://lore.kernel.org/r/20200802111531.5065-1-tianjia.zhang@linux.alibaba.com
Fixes: f40e74ffa3de ("csiostor:firmware upgrade fix")
Cc: Praveen Madhavan <praveenm@chelsio.com>
Signed-off-by: Tianjia Zhang <tianjia.zhang@linux.alibaba.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/csiostor/csio_hw.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/scsi/csiostor/csio_hw.c b/drivers/scsi/csiostor/csio_hw.c
index 950f9cdf0577f..5d0f42031d121 100644
--- a/drivers/scsi/csiostor/csio_hw.c
+++ b/drivers/scsi/csiostor/csio_hw.c
@@ -2384,7 +2384,7 @@ static int csio_hw_prep_fw(struct csio_hw *hw, struct fw_info *fw_info,
 			FW_HDR_FW_VER_MICRO_G(c), FW_HDR_FW_VER_BUILD_G(c),
 			FW_HDR_FW_VER_MAJOR_G(k), FW_HDR_FW_VER_MINOR_G(k),
 			FW_HDR_FW_VER_MICRO_G(k), FW_HDR_FW_VER_BUILD_G(k));
-		ret = EINVAL;
+		ret = -EINVAL;
 		goto bye;
 	}
 
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 179/633] libbpf: Fix unintentional success return code in bpf_object__load
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (177 preceding siblings ...)
  2020-10-27 13:48 ` [PATCH 5.8 178/633] scsi: csiostor: Fix wrong return value in csio_hw_prep_fw() Greg Kroah-Hartman
@ 2020-10-27 13:48 ` Greg Kroah-Hartman
  2020-10-27 13:48 ` [PATCH 5.8 180/633] wilc1000: Fix memleak in wilc_sdio_probe Greg Kroah-Hartman
                   ` (456 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Alex Gartrell, Alexei Starovoitov,
	Sasha Levin

From: Alex Gartrell <alexgartrell@gmail.com>

[ Upstream commit ef05afa66c59c2031a3798916ef3ff3778232129 ]

There are code paths where EINVAL is returned directly without setting
errno. In that case, errno could be 0, which would mask the
failure. For example, if a careless programmer set log_level to 10000
out of laziness, they would have to spend a long time trying to figure
out why.

Fixes: 4f33ddb4e3e2 ("libbpf: Propagate EPERM to caller on program load")
Signed-off-by: Alex Gartrell <alexgartrell@gmail.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://lore.kernel.org/bpf/20200826075549.1858580-1-alexgartrell@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/lib/bpf/libbpf.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
index 236c91aff48f8..e4d304247c1ba 100644
--- a/tools/lib/bpf/libbpf.c
+++ b/tools/lib/bpf/libbpf.c
@@ -5253,7 +5253,7 @@ load_program(struct bpf_program *prog, struct bpf_insn *insns, int insns_cnt,
 		free(log_buf);
 		goto retry_load;
 	}
-	ret = -errno;
+	ret = errno ? -errno : -LIBBPF_ERRNO__LOAD;
 	cp = libbpf_strerror_r(errno, errmsg, sizeof(errmsg));
 	pr_warn("load bpf program failed: %s\n", cp);
 	pr_perm_msg(ret);
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 180/633] wilc1000: Fix memleak in wilc_sdio_probe
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (178 preceding siblings ...)
  2020-10-27 13:48 ` [PATCH 5.8 179/633] libbpf: Fix unintentional success return code in bpf_object__load Greg Kroah-Hartman
@ 2020-10-27 13:48 ` Greg Kroah-Hartman
  2020-10-27 13:48 ` [PATCH 5.8 181/633] wilc1000: Fix memleak in wilc_bus_probe Greg Kroah-Hartman
                   ` (455 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dinghao Liu, Ajay Singh, Kalle Valo,
	Sasha Levin

From: Dinghao Liu <dinghao.liu@zju.edu.cn>

[ Upstream commit 8d95ab34b21ee0f870a9185b6457e8f6eb54914c ]

When devm_clk_get() returns -EPROBE_DEFER, sdio_priv
should be freed just like when wilc_cfg80211_init()
fails.

Fixes: 8692b047e86cf ("staging: wilc1000: look for rtc_clk clock")
Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
Acked-by: Ajay Singh <ajay.kathat@microchip.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20200820054819.23365-1-dinghao.liu@zju.edu.cn
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/staging/wilc1000/sdio.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/staging/wilc1000/sdio.c b/drivers/staging/wilc1000/sdio.c
index 36eb589263bfd..b14e4ed6134fc 100644
--- a/drivers/staging/wilc1000/sdio.c
+++ b/drivers/staging/wilc1000/sdio.c
@@ -151,9 +151,10 @@ static int wilc_sdio_probe(struct sdio_func *func,
 	wilc->dev = &func->dev;
 
 	wilc->rtc_clk = devm_clk_get(&func->card->dev, "rtc");
-	if (PTR_ERR_OR_ZERO(wilc->rtc_clk) == -EPROBE_DEFER)
+	if (PTR_ERR_OR_ZERO(wilc->rtc_clk) == -EPROBE_DEFER) {
+		kfree(sdio_priv);
 		return -EPROBE_DEFER;
-	else if (!IS_ERR(wilc->rtc_clk))
+	} else if (!IS_ERR(wilc->rtc_clk))
 		clk_prepare_enable(wilc->rtc_clk);
 
 	dev_info(&func->dev, "Driver Initializing success\n");
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 181/633] wilc1000: Fix memleak in wilc_bus_probe
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (179 preceding siblings ...)
  2020-10-27 13:48 ` [PATCH 5.8 180/633] wilc1000: Fix memleak in wilc_sdio_probe Greg Kroah-Hartman
@ 2020-10-27 13:48 ` Greg Kroah-Hartman
  2020-10-27 13:48 ` [PATCH 5.8 182/633] rtw88: dont treat NULL pointer as an array Greg Kroah-Hartman
                   ` (454 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dinghao Liu, Ajay Singh, Kalle Valo,
	Sasha Levin

From: Dinghao Liu <dinghao.liu@zju.edu.cn>

[ Upstream commit 9a19a939abfa7d949f584a7ad872e683473fdc14 ]

When devm_clk_get() returns -EPROBE_DEFER, spi_priv
should be freed just like when wilc_cfg80211_init()
fails.

Fixes: 854d66df74aed ("staging: wilc1000: look for rtc_clk clock in spi mode")
Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
Acked-by: Ajay Singh <ajay.kathat@microchip.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20200820055256.24333-1-dinghao.liu@zju.edu.cn
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/staging/wilc1000/spi.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/staging/wilc1000/spi.c b/drivers/staging/wilc1000/spi.c
index 3f19e3f38a397..a18dac0aa6b67 100644
--- a/drivers/staging/wilc1000/spi.c
+++ b/drivers/staging/wilc1000/spi.c
@@ -112,9 +112,10 @@ static int wilc_bus_probe(struct spi_device *spi)
 	wilc->dev_irq_num = spi->irq;
 
 	wilc->rtc_clk = devm_clk_get(&spi->dev, "rtc_clk");
-	if (PTR_ERR_OR_ZERO(wilc->rtc_clk) == -EPROBE_DEFER)
+	if (PTR_ERR_OR_ZERO(wilc->rtc_clk) == -EPROBE_DEFER) {
+		kfree(spi_priv);
 		return -EPROBE_DEFER;
-	else if (!IS_ERR(wilc->rtc_clk))
+	} else if (!IS_ERR(wilc->rtc_clk))
 		clk_prepare_enable(wilc->rtc_clk);
 
 	return 0;
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 182/633] rtw88: dont treat NULL pointer as an array
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (180 preceding siblings ...)
  2020-10-27 13:48 ` [PATCH 5.8 181/633] wilc1000: Fix memleak in wilc_bus_probe Greg Kroah-Hartman
@ 2020-10-27 13:48 ` Greg Kroah-Hartman
  2020-10-27 13:48 ` [PATCH 5.8 183/633] backlight: sky81452-backlight: Fix refcount imbalance on error Greg Kroah-Hartman
                   ` (453 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Brian Norris, Yan-Hsuan Chuang,
	Kalle Valo, Sasha Levin

From: Brian Norris <briannorris@chromium.org>

[ Upstream commit 22b726cbdd09d9891ede8aa122a950d2d0ae5e09 ]

I'm not a standards expert, but this really looks to be undefined
behavior, when chip->dig_cck may be NULL. (And, we're trying to do a
NULL check a few lines down, because some chip variants will use NULL.)

Fixes: fc637a860a82 ("rtw88: 8723d: Set IG register for CCK rate")
Signed-off-by: Brian Norris <briannorris@chromium.org>
Acked-by: Yan-Hsuan Chuang <yhchuang@realtek.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20200821211716.1631556-1-briannorris@chromium.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/realtek/rtw88/phy.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/realtek/rtw88/phy.c b/drivers/net/wireless/realtek/rtw88/phy.c
index 8d93f31597469..9687b376d221b 100644
--- a/drivers/net/wireless/realtek/rtw88/phy.c
+++ b/drivers/net/wireless/realtek/rtw88/phy.c
@@ -147,12 +147,13 @@ void rtw_phy_dig_write(struct rtw_dev *rtwdev, u8 igi)
 {
 	struct rtw_chip_info *chip = rtwdev->chip;
 	struct rtw_hal *hal = &rtwdev->hal;
-	const struct rtw_hw_reg *dig_cck = &chip->dig_cck[0];
 	u32 addr, mask;
 	u8 path;
 
-	if (dig_cck)
+	if (chip->dig_cck) {
+		const struct rtw_hw_reg *dig_cck = &chip->dig_cck[0];
 		rtw_write32_mask(rtwdev, dig_cck->addr, dig_cck->mask, igi >> 1);
+	}
 
 	for (path = 0; path < hal->rf_path_num; path++) {
 		addr = chip->dig[path].addr;
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 183/633] backlight: sky81452-backlight: Fix refcount imbalance on error
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (181 preceding siblings ...)
  2020-10-27 13:48 ` [PATCH 5.8 182/633] rtw88: dont treat NULL pointer as an array Greg Kroah-Hartman
@ 2020-10-27 13:48 ` Greg Kroah-Hartman
  2020-10-27 13:48 ` [PATCH 5.8 184/633] staging: emxx_udc: Fix passing of NULL to dma_alloc_coherent() Greg Kroah-Hartman
                   ` (452 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dinghao Liu, Daniel Thompson,
	Lee Jones, Sasha Levin

From: dinghao.liu@zju.edu.cn <dinghao.liu@zju.edu.cn>

[ Upstream commit b7a4f80bc316a56d6ec8750e93e66f42431ed960 ]

When of_property_read_u32_array() returns an error code, a
pairing refcount decrement is needed to keep np's refcount
balanced.

Fixes: f705806c9f355 ("backlight: Add support Skyworks SKY81452 backlight driver")
Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
Reviewed-by: Daniel Thompson <daniel.thompson@linaro.org>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/video/backlight/sky81452-backlight.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/video/backlight/sky81452-backlight.c b/drivers/video/backlight/sky81452-backlight.c
index 2355f00f57732..1f6301375fd33 100644
--- a/drivers/video/backlight/sky81452-backlight.c
+++ b/drivers/video/backlight/sky81452-backlight.c
@@ -196,6 +196,7 @@ static struct sky81452_bl_platform_data *sky81452_bl_parse_dt(
 					num_entry);
 		if (ret < 0) {
 			dev_err(dev, "led-sources node is invalid.\n");
+			of_node_put(np);
 			return ERR_PTR(-EINVAL);
 		}
 
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 184/633] staging: emxx_udc: Fix passing of NULL to dma_alloc_coherent()
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (182 preceding siblings ...)
  2020-10-27 13:48 ` [PATCH 5.8 183/633] backlight: sky81452-backlight: Fix refcount imbalance on error Greg Kroah-Hartman
@ 2020-10-27 13:48 ` Greg Kroah-Hartman
  2020-10-27 13:48 ` [PATCH 5.8 185/633] VMCI: check return value of get_user_pages_fast() for errors Greg Kroah-Hartman
                   ` (451 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Alex Dewar, Sasha Levin

From: Alex Dewar <alex.dewar90@gmail.com>

[ Upstream commit cc34073c6248e9cec801bf690d1455f264d12357 ]

In nbu2ss_eq_queue() memory is allocated with dma_alloc_coherent(),
though, strangely, NULL is passed as the struct device* argument. Pass
the UDC's device instead. Fix up the corresponding call to
dma_free_coherent() in the same way.

Build-tested on x86 only.

Fixes: 33aa8d45a4fe ("staging: emxx_udc: Add Emma Mobile USB Gadget driver")
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Alex Dewar <alex.dewar90@gmail.com>
Link: https://lore.kernel.org/r/20200825091928.55794-1-alex.dewar90@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/staging/emxx_udc/emxx_udc.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/staging/emxx_udc/emxx_udc.c b/drivers/staging/emxx_udc/emxx_udc.c
index 03929b9d3a8bc..d0725bc8b48a4 100644
--- a/drivers/staging/emxx_udc/emxx_udc.c
+++ b/drivers/staging/emxx_udc/emxx_udc.c
@@ -2593,7 +2593,7 @@ static int nbu2ss_ep_queue(struct usb_ep *_ep,
 
 	if (req->unaligned) {
 		if (!ep->virt_buf)
-			ep->virt_buf = dma_alloc_coherent(NULL, PAGE_SIZE,
+			ep->virt_buf = dma_alloc_coherent(udc->dev, PAGE_SIZE,
 							  &ep->phys_buf,
 							  GFP_ATOMIC | GFP_DMA);
 		if (ep->epnum > 0)  {
@@ -3148,7 +3148,7 @@ static int nbu2ss_drv_remove(struct platform_device *pdev)
 	for (i = 0; i < NUM_ENDPOINTS; i++) {
 		ep = &udc->ep[i];
 		if (ep->virt_buf)
-			dma_free_coherent(NULL, PAGE_SIZE, (void *)ep->virt_buf,
+			dma_free_coherent(udc->dev, PAGE_SIZE, (void *)ep->virt_buf,
 					  ep->phys_buf);
 	}
 
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 185/633] VMCI: check return value of get_user_pages_fast() for errors
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (183 preceding siblings ...)
  2020-10-27 13:48 ` [PATCH 5.8 184/633] staging: emxx_udc: Fix passing of NULL to dma_alloc_coherent() Greg Kroah-Hartman
@ 2020-10-27 13:48 ` Greg Kroah-Hartman
  2020-10-27 13:48 ` [PATCH 5.8 186/633] mm/error_inject: Fix allow_error_inject function signatures Greg Kroah-Hartman
                   ` (450 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:48 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Alex Dewar, Sasha Levin

From: Alex Dewar <alex.dewar90@gmail.com>

[ Upstream commit 90ca6333fd65f318c47bff425e1ea36c0a5539f6 ]

In a couple of places in qp_host_get_user_memory(),
get_user_pages_fast() is called without properly checking for errors. If
e.g. -EFAULT is returned, this negative value will then be passed on to
qp_release_pages(), which expects a u64 as input.

Fix this by only calling qp_release_pages() when we have a positive
number returned.

Fixes: 06164d2b72aa ("VMCI: queue pairs implementation.")
Signed-off-by: Alex Dewar <alex.dewar90@gmail.com>
Link: https://lore.kernel.org/r/20200825164522.412392-1-alex.dewar90@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/misc/vmw_vmci/vmci_queue_pair.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/drivers/misc/vmw_vmci/vmci_queue_pair.c b/drivers/misc/vmw_vmci/vmci_queue_pair.c
index 8531ae7811956..c49065887e8f5 100644
--- a/drivers/misc/vmw_vmci/vmci_queue_pair.c
+++ b/drivers/misc/vmw_vmci/vmci_queue_pair.c
@@ -657,8 +657,9 @@ static int qp_host_get_user_memory(u64 produce_uva,
 	if (retval < (int)produce_q->kernel_if->num_pages) {
 		pr_debug("get_user_pages_fast(produce) failed (retval=%d)",
 			retval);
-		qp_release_pages(produce_q->kernel_if->u.h.header_page,
-				 retval, false);
+		if (retval > 0)
+			qp_release_pages(produce_q->kernel_if->u.h.header_page,
+					retval, false);
 		err = VMCI_ERROR_NO_MEM;
 		goto out;
 	}
@@ -670,8 +671,9 @@ static int qp_host_get_user_memory(u64 produce_uva,
 	if (retval < (int)consume_q->kernel_if->num_pages) {
 		pr_debug("get_user_pages_fast(consume) failed (retval=%d)",
 			retval);
-		qp_release_pages(consume_q->kernel_if->u.h.header_page,
-				 retval, false);
+		if (retval > 0)
+			qp_release_pages(consume_q->kernel_if->u.h.header_page,
+					retval, false);
 		qp_release_pages(produce_q->kernel_if->u.h.header_page,
 				 produce_q->kernel_if->num_pages, false);
 		err = VMCI_ERROR_NO_MEM;
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 186/633] mm/error_inject: Fix allow_error_inject function signatures.
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (184 preceding siblings ...)
  2020-10-27 13:48 ` [PATCH 5.8 185/633] VMCI: check return value of get_user_pages_fast() for errors Greg Kroah-Hartman
@ 2020-10-27 13:48 ` Greg Kroah-Hartman
  2020-10-27 13:48 ` [PATCH 5.8 187/633] drm: panel: Fix bpc for OrtusTech COM43H4M85ULC panel Greg Kroah-Hartman
                   ` (449 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Alexei Starovoitov, Daniel Borkmann,
	Josef Bacik, Sasha Levin

From: Alexei Starovoitov <ast@kernel.org>

[ Upstream commit 76cd61739fd107a7f7ec4c24a045e98d8ee150f0 ]

'static' and 'static noinline' function attributes make no guarantees that
gcc/clang won't optimize them. The compiler may decide to inline 'static'
function and in such case ALLOW_ERROR_INJECT becomes meaningless. The compiler
could have inlined __add_to_page_cache_locked() in one callsite and didn't
inline in another. In such case injecting errors into it would cause
unpredictable behavior. It's worse with 'static noinline' which won't be
inlined, but it still can be optimized. Like the compiler may decide to remove
one argument or constant propagate the value depending on the callsite.

To avoid such issues make sure that these functions are global noinline.

Fixes: af3b854492f3 ("mm/page_alloc.c: allow error injection")
Fixes: cfcbfb1382db ("mm/filemap.c: enable error injection at add_to_page_cache()")
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Reviewed-by: Josef Bacik <josef@toxicpanda.com>
Link: https://lore.kernel.org/bpf/20200827220114.69225-2-alexei.starovoitov@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 mm/filemap.c    | 8 ++++----
 mm/page_alloc.c | 2 +-
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/mm/filemap.c b/mm/filemap.c
index 385759c4ce4be..6c3b879116212 100644
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -826,10 +826,10 @@ int replace_page_cache_page(struct page *old, struct page *new, gfp_t gfp_mask)
 }
 EXPORT_SYMBOL_GPL(replace_page_cache_page);
 
-static int __add_to_page_cache_locked(struct page *page,
-				      struct address_space *mapping,
-				      pgoff_t offset, gfp_t gfp_mask,
-				      void **shadowp)
+noinline int __add_to_page_cache_locked(struct page *page,
+					struct address_space *mapping,
+					pgoff_t offset, gfp_t gfp_mask,
+					void **shadowp)
 {
 	XA_STATE(xas, &mapping->i_pages, offset);
 	int huge = PageHuge(page);
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 43f6d91f57156..802f00540a3d2 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -3487,7 +3487,7 @@ static inline bool __should_fail_alloc_page(gfp_t gfp_mask, unsigned int order)
 
 #endif /* CONFIG_FAIL_PAGE_ALLOC */
 
-static noinline bool should_fail_alloc_page(gfp_t gfp_mask, unsigned int order)
+noinline bool should_fail_alloc_page(gfp_t gfp_mask, unsigned int order)
 {
 	return __should_fail_alloc_page(gfp_mask, order);
 }
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 187/633] drm: panel: Fix bpc for OrtusTech COM43H4M85ULC panel
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (185 preceding siblings ...)
  2020-10-27 13:48 ` [PATCH 5.8 186/633] mm/error_inject: Fix allow_error_inject function signatures Greg Kroah-Hartman
@ 2020-10-27 13:48 ` Greg Kroah-Hartman
  2020-10-27 13:48 ` [PATCH 5.8 188/633] samples/bpf: Fix to xdpsock to avoid recycling frames Greg Kroah-Hartman
                   ` (448 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Laurent Pinchart, Sam Ravnborg, Sasha Levin

From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>

[ Upstream commit 3b8095169982ff4ec2a1b4be61b7224bbef23b48 ]

The OrtusTech COM43H4M85ULC panel is a 18-bit RGB panel. Commit
f098f168e91c ("drm: panel: Fix bus format for OrtusTech COM43H4M85ULC
panel") has fixed the bus formats, but forgot to address the bpc value.
Set it to 6.

Fixes: f098f168e91c ("drm: panel: Fix bus format for OrtusTech COM43H4M85ULC panel")
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20200824003254.21904-1-laurent.pinchart@ideasonboard.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/panel/panel-simple.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c
index 85fa4027d82d7..4b4ca31a2d577 100644
--- a/drivers/gpu/drm/panel/panel-simple.c
+++ b/drivers/gpu/drm/panel/panel-simple.c
@@ -2862,7 +2862,7 @@ static const struct drm_display_mode ortustech_com43h4m85ulc_mode  = {
 static const struct panel_desc ortustech_com43h4m85ulc = {
 	.modes = &ortustech_com43h4m85ulc_mode,
 	.num_modes = 1,
-	.bpc = 8,
+	.bpc = 6,
 	.size = {
 		.width = 56,
 		.height = 93,
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 188/633] samples/bpf: Fix to xdpsock to avoid recycling frames
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (186 preceding siblings ...)
  2020-10-27 13:48 ` [PATCH 5.8 187/633] drm: panel: Fix bpc for OrtusTech COM43H4M85ULC panel Greg Kroah-Hartman
@ 2020-10-27 13:48 ` Greg Kroah-Hartman
  2020-10-27 13:48 ` [PATCH 5.8 189/633] drm/crc-debugfs: Fix memleak in crc_control_write Greg Kroah-Hartman
                   ` (447 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Weqaar Janjua, Daniel Borkmann,
	Björn Töpel, Sasha Levin

From: Weqaar Janjua <weqaar.a.janjua@intel.com>

[ Upstream commit b69e56cf765155dcac0037d7d0f162a2afab76c2 ]

The txpush program in the xdpsock sample application is supposed
to send out all packets in the umem in a round-robin fashion.
The problem is that it only cycled through the first BATCH_SIZE
worth of packets. Fixed this so that it cycles through all buffers
in the umem as intended.

Fixes: 248c7f9c0e21 ("samples/bpf: convert xdpsock to use libbpf for AF_XDP access")
Signed-off-by: Weqaar Janjua <weqaar.a.janjua@intel.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Björn Töpel <bjorn.topel@intel.com>
Link: https://lore.kernel.org/bpf/20200828161717.42705-1-weqaar.a.janjua@intel.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 samples/bpf/xdpsock_user.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/samples/bpf/xdpsock_user.c b/samples/bpf/xdpsock_user.c
index c91e91362a0c6..0151bb0b2fc71 100644
--- a/samples/bpf/xdpsock_user.c
+++ b/samples/bpf/xdpsock_user.c
@@ -921,7 +921,7 @@ static void rx_drop_all(void)
 	}
 }
 
-static void tx_only(struct xsk_socket_info *xsk, u32 frame_nb, int batch_size)
+static void tx_only(struct xsk_socket_info *xsk, u32 *frame_nb, int batch_size)
 {
 	u32 idx;
 	unsigned int i;
@@ -934,14 +934,14 @@ static void tx_only(struct xsk_socket_info *xsk, u32 frame_nb, int batch_size)
 	for (i = 0; i < batch_size; i++) {
 		struct xdp_desc *tx_desc = xsk_ring_prod__tx_desc(&xsk->tx,
 								  idx + i);
-		tx_desc->addr = (frame_nb + i) << XSK_UMEM__DEFAULT_FRAME_SHIFT;
+		tx_desc->addr = (*frame_nb + i) << XSK_UMEM__DEFAULT_FRAME_SHIFT;
 		tx_desc->len = PKT_SIZE;
 	}
 
 	xsk_ring_prod__submit(&xsk->tx, batch_size);
 	xsk->outstanding_tx += batch_size;
-	frame_nb += batch_size;
-	frame_nb %= NUM_FRAMES;
+	*frame_nb += batch_size;
+	*frame_nb %= NUM_FRAMES;
 	complete_tx_only(xsk, batch_size);
 }
 
@@ -997,7 +997,7 @@ static void tx_only_all(void)
 		}
 
 		for (i = 0; i < num_socks; i++)
-			tx_only(xsks[i], frame_nb[i], batch_size);
+			tx_only(xsks[i], &frame_nb[i], batch_size);
 
 		pkt_cnt += batch_size;
 
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 189/633] drm/crc-debugfs: Fix memleak in crc_control_write
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (187 preceding siblings ...)
  2020-10-27 13:48 ` [PATCH 5.8 188/633] samples/bpf: Fix to xdpsock to avoid recycling frames Greg Kroah-Hartman
@ 2020-10-27 13:48 ` Greg Kroah-Hartman
  2020-10-27 13:48 ` [PATCH 5.8 190/633] Bluetooth: Clear suspend tasks on unregister Greg Kroah-Hartman
                   ` (446 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dinghao Liu, Laurent Pinchart,
	Daniel Vetter, Sasha Levin

From: Dinghao Liu <dinghao.liu@zju.edu.cn>

[ Upstream commit f7ec68b341dbd5da13d4c65ce444dcd605f1c42e ]

When verify_crc_source() fails, source needs to be freed.
However, current code is returning directly and ends up
leaking memory.

Fixes: d5cc15a0c66e ("drm: crc: Introduce verify_crc_source callback")
Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
[danvet: change Fixes: tag per Laurent's review]
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20200819082228.26847-1-dinghao.liu@zju.edu.cn
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/drm_debugfs_crc.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/drm_debugfs_crc.c b/drivers/gpu/drm/drm_debugfs_crc.c
index 5d67a41f7c3a8..3dd70d813f694 100644
--- a/drivers/gpu/drm/drm_debugfs_crc.c
+++ b/drivers/gpu/drm/drm_debugfs_crc.c
@@ -144,8 +144,10 @@ static ssize_t crc_control_write(struct file *file, const char __user *ubuf,
 		source[len - 1] = '\0';
 
 	ret = crtc->funcs->verify_crc_source(crtc, source, &values_cnt);
-	if (ret)
+	if (ret) {
+		kfree(source);
 		return ret;
+	}
 
 	spin_lock_irq(&crc->lock);
 
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 190/633] Bluetooth: Clear suspend tasks on unregister
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (188 preceding siblings ...)
  2020-10-27 13:48 ` [PATCH 5.8 189/633] drm/crc-debugfs: Fix memleak in crc_control_write Greg Kroah-Hartman
@ 2020-10-27 13:48 ` Greg Kroah-Hartman
  2020-10-27 13:48 ` [PATCH 5.8 191/633] selftests: vm: add fragment CONFIG_GUP_BENCHMARK Greg Kroah-Hartman
                   ` (445 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Abhishek Pandit-Subedi,
	Marcel Holtmann, Sasha Levin

From: Abhishek Pandit-Subedi <abhishekpandit@chromium.org>

[ Upstream commit 0e9952804ec9c8ba60f131225eab80634339f042 ]

While unregistering, make sure to clear the suspend tasks before
cancelling the work. If the unregister is called during resume from
suspend, this will unnecessarily add 2s to the resume time otherwise.

Fixes: 4e8c36c3b0d73d (Bluetooth: Fix suspend notifier race)
Signed-off-by: Abhishek Pandit-Subedi <abhishekpandit@chromium.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/bluetooth/hci_core.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index fc28dc201b936..0f4e5a31f983c 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -3280,6 +3280,16 @@ void hci_copy_identity_address(struct hci_dev *hdev, bdaddr_t *bdaddr,
 	}
 }
 
+static void hci_suspend_clear_tasks(struct hci_dev *hdev)
+{
+	int i;
+
+	for (i = 0; i < __SUSPEND_NUM_TASKS; i++)
+		clear_bit(i, hdev->suspend_tasks);
+
+	wake_up(&hdev->suspend_wait_q);
+}
+
 static int hci_suspend_wait_event(struct hci_dev *hdev)
 {
 #define WAKE_COND                                                              \
@@ -3609,6 +3619,7 @@ void hci_unregister_dev(struct hci_dev *hdev)
 	cancel_work_sync(&hdev->power_on);
 
 	unregister_pm_notifier(&hdev->suspend_notifier);
+	hci_suspend_clear_tasks(hdev);
 	cancel_work_sync(&hdev->suspend_prepare);
 
 	hci_dev_do_close(hdev);
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 191/633] selftests: vm: add fragment CONFIG_GUP_BENCHMARK
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (189 preceding siblings ...)
  2020-10-27 13:48 ` [PATCH 5.8 190/633] Bluetooth: Clear suspend tasks on unregister Greg Kroah-Hartman
@ 2020-10-27 13:48 ` Greg Kroah-Hartman
  2020-10-27 13:48 ` [PATCH 5.8 192/633] scsi: ufs: Make ufshcd_print_trs() consider UFSHCD_QUIRK_PRDT_BYTE_GRAN Greg Kroah-Hartman
                   ` (444 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Anatoly Pugachev, Jiri Kosina,
	Shuah Khan, Jiri Kosina, Sasha Levin

From: Anatoly Pugachev <matorola@gmail.com>

[ Upstream commit cae1d5a2c5a491141faa747e9944ba40ab4ab786 ]

When running gup_benchmark test the following output states that
the config options is missing.

$ sudo ./gup_benchmark
open: No such file or directory

$ sudo strace -e trace=file ./gup_benchmark 2>&1 | tail -3
openat(AT_FDCWD, "/sys/kernel/debug/gup_benchmark", O_RDWR) = -1 ENOENT
(No such file or directory)
open: No such file or directory
+++ exited with 1 +++

Fix it by adding config option fragment.

Fixes: 64c349f4ae78 ("mm: add infrastructure for get_user_pages_fast() benchmarking")
Signed-off-by: Anatoly Pugachev <matorola@gmail.com>
CC: Jiri Kosina <trivial@kernel.org>
CC: Shuah Khan <shuah@kernel.org>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/testing/selftests/vm/config | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tools/testing/selftests/vm/config b/tools/testing/selftests/vm/config
index 3ba674b64fa9f..69dd0d1aa30b2 100644
--- a/tools/testing/selftests/vm/config
+++ b/tools/testing/selftests/vm/config
@@ -3,3 +3,4 @@ CONFIG_USERFAULTFD=y
 CONFIG_TEST_VMALLOC=m
 CONFIG_DEVICE_PRIVATE=y
 CONFIG_TEST_HMM=m
+CONFIG_GUP_BENCHMARK=y
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 192/633] scsi: ufs: Make ufshcd_print_trs() consider UFSHCD_QUIRK_PRDT_BYTE_GRAN
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (190 preceding siblings ...)
  2020-10-27 13:48 ` [PATCH 5.8 191/633] selftests: vm: add fragment CONFIG_GUP_BENCHMARK Greg Kroah-Hartman
@ 2020-10-27 13:48 ` Greg Kroah-Hartman
  2020-10-27 13:48 ` [PATCH 5.8 193/633] binder: Remove bogus warning on failed same-process transaction Greg Kroah-Hartman
                   ` (443 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Alim Akhtar, Kiwoong Kim,
	Eric Biggers, Martin K. Petersen, Sasha Levin

From: Eric Biggers <ebiggers@google.com>

[ Upstream commit cc770ce34aeeff21991f162f0db1a758ea672727 ]

Fix ufshcd_print_trs() to consider UFSHCD_QUIRK_PRDT_BYTE_GRAN when using
utp_transfer_req_desc::prd_table_length, so that it doesn't treat the
number of bytes as the number of entries.

Originally from Kiwoong Kim
(https://lkml.kernel.org/r/20200218233115.8185-1-kwmad.kim@samsung.com).

Link: https://lore.kernel.org/r/20200826021040.152148-1-ebiggers@kernel.org
Fixes: 26f968d7de82 ("scsi: ufs: Introduce UFSHCD_QUIRK_PRDT_BYTE_GRAN quirk")
Cc: Alim Akhtar <alim.akhtar@samsung.com>
Cc: Kiwoong Kim <kwmad.kim@samsung.com>
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/ufs/ufshcd.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
index 8bc8e4e62c045..e5f75b2e07e2c 100644
--- a/drivers/scsi/ufs/ufshcd.c
+++ b/drivers/scsi/ufs/ufshcd.c
@@ -484,6 +484,9 @@ void ufshcd_print_trs(struct ufs_hba *hba, unsigned long bitmap, bool pr_prdt)
 
 		prdt_length = le16_to_cpu(
 			lrbp->utr_descriptor_ptr->prd_table_length);
+		if (hba->quirks & UFSHCD_QUIRK_PRDT_BYTE_GRAN)
+			prdt_length /= sizeof(struct ufshcd_sg_entry);
+
 		dev_err(hba->dev,
 			"UPIU[%d] - PRDT - %d entries  phys@0x%llx\n",
 			tag, prdt_length,
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 193/633] binder: Remove bogus warning on failed same-process transaction
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (191 preceding siblings ...)
  2020-10-27 13:48 ` [PATCH 5.8 192/633] scsi: ufs: Make ufshcd_print_trs() consider UFSHCD_QUIRK_PRDT_BYTE_GRAN Greg Kroah-Hartman
@ 2020-10-27 13:48 ` Greg Kroah-Hartman
  2020-10-27 13:48 ` [PATCH 5.8 194/633] tty: serial: earlycon dependency Greg Kroah-Hartman
                   ` (442 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, syzbot+e113a0b970b7b3f394ba,
	Christian Brauner, Todd Kjos, Jann Horn, Sasha Levin

From: Jann Horn <jannh@google.com>

[ Upstream commit e8b8ae7ce32e17a5c29f0289e9e2a39c7dcaa1b8 ]

While binder transactions with the same binder_proc as sender and recipient
are forbidden, transactions with the same task_struct as sender and
recipient are possible (even though currently there is a weird check in
binder_transaction() that rejects them in the target==0 case).
Therefore, task_struct identities can't be used to distinguish whether
the caller is running in the context of the sender or the recipient.

Since I see no easy way to make this WARN_ON() useful and correct, let's
just remove it.

Fixes: 44d8047f1d87 ("binder: use standard functions to allocate fds")
Reported-by: syzbot+e113a0b970b7b3f394ba@syzkaller.appspotmail.com
Acked-by: Christian Brauner <christian.brauner@ubuntu.com>
Acked-by: Todd Kjos <tkjos@google.com>
Signed-off-by: Jann Horn <jannh@google.com>
Link: https://lore.kernel.org/r/20200806165359.2381483-1-jannh@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/android/binder.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index af85d37aef680..adab46ca5dff7 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -2324,8 +2324,6 @@ static void binder_transaction_buffer_release(struct binder_proc *proc,
 			 * file is done when the transaction is torn
 			 * down.
 			 */
-			WARN_ON(failed_at &&
-				proc->tsk == current->group_leader);
 		} break;
 		case BINDER_TYPE_PTR:
 			/*
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 194/633] tty: serial: earlycon dependency
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (192 preceding siblings ...)
  2020-10-27 13:48 ` [PATCH 5.8 193/633] binder: Remove bogus warning on failed same-process transaction Greg Kroah-Hartman
@ 2020-10-27 13:48 ` Greg Kroah-Hartman
  2020-10-27 13:48 ` [PATCH 5.8 195/633] tty: hvcs: Dont NULL tty->driver_data until hvcs_cleanup() Greg Kroah-Hartman
                   ` (441 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:48 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Tong Zhang, Sasha Levin

From: Tong Zhang <ztong0001@gmail.com>

[ Upstream commit 0fb9342d06b0f667b915ba58bfefc030e534a218 ]

parse_options() in drivers/tty/serial/earlycon.c calls uart_parse_earlycon
in drivers/tty/serial/serial_core.c therefore selecting SERIAL_EARLYCON
should automatically select SERIAL_CORE, otherwise will result in symbol
not found error during linking if SERIAL_CORE is not configured as builtin

Fixes: 9aac5887595b ("tty/serial: add generic serial earlycon")
Signed-off-by: Tong Zhang <ztong0001@gmail.com>
Link: https://lore.kernel.org/r/20200828123949.2642-1-ztong0001@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/serial/Kconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/tty/serial/Kconfig b/drivers/tty/serial/Kconfig
index 780908d435577..896b9c77117d3 100644
--- a/drivers/tty/serial/Kconfig
+++ b/drivers/tty/serial/Kconfig
@@ -8,6 +8,7 @@ menu "Serial drivers"
 
 config SERIAL_EARLYCON
 	bool
+	depends on SERIAL_CORE
 	help
 	  Support for early consoles with the earlycon parameter. This enables
 	  the console before standard serial driver is probed. The console is
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 195/633] tty: hvcs: Dont NULL tty->driver_data until hvcs_cleanup()
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (193 preceding siblings ...)
  2020-10-27 13:48 ` [PATCH 5.8 194/633] tty: serial: earlycon dependency Greg Kroah-Hartman
@ 2020-10-27 13:48 ` Greg Kroah-Hartman
  2020-10-27 13:48 ` [PATCH 5.8 196/633] pty: do tty_flip_buffer_push without port->lock in pty_write Greg Kroah-Hartman
                   ` (440 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:48 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Tyrel Datwyler, Sasha Levin

From: Tyrel Datwyler <tyreld@linux.ibm.com>

[ Upstream commit 63ffcbdad738e3d1c857027789a2273df3337624 ]

The code currently NULLs tty->driver_data in hvcs_close() with the
intent of informing the next call to hvcs_open() that device needs to be
reconfigured. However, when hvcs_cleanup() is called we copy hvcsd from
tty->driver_data which was previoulsy NULLed by hvcs_close() and our
call to tty_port_put(&hvcsd->port) doesn't actually do anything since
&hvcsd->port ends up translating to NULL by chance. This has the side
effect that when hvcs_remove() is called we have one too many port
references preventing hvcs_destuct_port() from ever being called. This
also prevents us from reusing the /dev/hvcsX node in a future
hvcs_probe() and we can eventually run out of /dev/hvcsX devices.

Fix this by waiting to NULL tty->driver_data in hvcs_cleanup().

Fixes: 27bf7c43a19c ("TTY: hvcs, add tty install")
Signed-off-by: Tyrel Datwyler <tyreld@linux.ibm.com>
Link: https://lore.kernel.org/r/20200820234643.70412-1-tyreld@linux.ibm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/hvc/hvcs.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/drivers/tty/hvc/hvcs.c b/drivers/tty/hvc/hvcs.c
index 55105ac38f89b..509d1042825a1 100644
--- a/drivers/tty/hvc/hvcs.c
+++ b/drivers/tty/hvc/hvcs.c
@@ -1216,13 +1216,6 @@ static void hvcs_close(struct tty_struct *tty, struct file *filp)
 
 		tty_wait_until_sent(tty, HVCS_CLOSE_WAIT);
 
-		/*
-		 * This line is important because it tells hvcs_open that this
-		 * device needs to be re-configured the next time hvcs_open is
-		 * called.
-		 */
-		tty->driver_data = NULL;
-
 		free_irq(irq, hvcsd);
 		return;
 	} else if (hvcsd->port.count < 0) {
@@ -1237,6 +1230,13 @@ static void hvcs_cleanup(struct tty_struct * tty)
 {
 	struct hvcs_struct *hvcsd = tty->driver_data;
 
+	/*
+	 * This line is important because it tells hvcs_open that this
+	 * device needs to be re-configured the next time hvcs_open is
+	 * called.
+	 */
+	tty->driver_data = NULL;
+
 	tty_port_put(&hvcsd->port);
 }
 
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 196/633] pty: do tty_flip_buffer_push without port->lock in pty_write
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (194 preceding siblings ...)
  2020-10-27 13:48 ` [PATCH 5.8 195/633] tty: hvcs: Dont NULL tty->driver_data until hvcs_cleanup() Greg Kroah-Hartman
@ 2020-10-27 13:48 ` Greg Kroah-Hartman
  2020-10-27 13:49 ` [PATCH 5.8 197/633] pwm: lpss: Fix off by one error in base_unit math in pwm_lpss_prepare() Greg Kroah-Hartman
                   ` (439 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:48 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Artem Savkov, Jiri Slaby, Sasha Levin

From: Artem Savkov <asavkov@redhat.com>

[ Upstream commit 71a174b39f10b4b93223d374722aa894b5d8a82e ]

b6da31b2c07c "tty: Fix data race in tty_insert_flip_string_fixed_flag"
puts tty_flip_buffer_push under port->lock introducing the following
possible circular locking dependency:

[30129.876566] ======================================================
[30129.876566] WARNING: possible circular locking dependency detected
[30129.876567] 5.9.0-rc2+ #3 Tainted: G S      W
[30129.876568] ------------------------------------------------------
[30129.876568] sysrq.sh/1222 is trying to acquire lock:
[30129.876569] ffffffff92c39480 (console_owner){....}-{0:0}, at: console_unlock+0x3fe/0xa90

[30129.876572] but task is already holding lock:
[30129.876572] ffff888107cb9018 (&pool->lock/1){-.-.}-{2:2}, at: show_workqueue_state.cold.55+0x15b/0x6ca

[30129.876576] which lock already depends on the new lock.

[30129.876577] the existing dependency chain (in reverse order) is:

[30129.876578] -> #3 (&pool->lock/1){-.-.}-{2:2}:
[30129.876581]        _raw_spin_lock+0x30/0x70
[30129.876581]        __queue_work+0x1a3/0x10f0
[30129.876582]        queue_work_on+0x78/0x80
[30129.876582]        pty_write+0x165/0x1e0
[30129.876583]        n_tty_write+0x47f/0xf00
[30129.876583]        tty_write+0x3d6/0x8d0
[30129.876584]        vfs_write+0x1a8/0x650

[30129.876588] -> #2 (&port->lock#2){-.-.}-{2:2}:
[30129.876590]        _raw_spin_lock_irqsave+0x3b/0x80
[30129.876591]        tty_port_tty_get+0x1d/0xb0
[30129.876592]        tty_port_default_wakeup+0xb/0x30
[30129.876592]        serial8250_tx_chars+0x3d6/0x970
[30129.876593]        serial8250_handle_irq.part.12+0x216/0x380
[30129.876593]        serial8250_default_handle_irq+0x82/0xe0
[30129.876594]        serial8250_interrupt+0xdd/0x1b0
[30129.876595]        __handle_irq_event_percpu+0xfc/0x850

[30129.876602] -> #1 (&port->lock){-.-.}-{2:2}:
[30129.876605]        _raw_spin_lock_irqsave+0x3b/0x80
[30129.876605]        serial8250_console_write+0x12d/0x900
[30129.876606]        console_unlock+0x679/0xa90
[30129.876606]        register_console+0x371/0x6e0
[30129.876607]        univ8250_console_init+0x24/0x27
[30129.876607]        console_init+0x2f9/0x45e

[30129.876609] -> #0 (console_owner){....}-{0:0}:
[30129.876611]        __lock_acquire+0x2f70/0x4e90
[30129.876612]        lock_acquire+0x1ac/0xad0
[30129.876612]        console_unlock+0x460/0xa90
[30129.876613]        vprintk_emit+0x130/0x420
[30129.876613]        printk+0x9f/0xc5
[30129.876614]        show_pwq+0x154/0x618
[30129.876615]        show_workqueue_state.cold.55+0x193/0x6ca
[30129.876615]        __handle_sysrq+0x244/0x460
[30129.876616]        write_sysrq_trigger+0x48/0x4a
[30129.876616]        proc_reg_write+0x1a6/0x240
[30129.876617]        vfs_write+0x1a8/0x650

[30129.876619] other info that might help us debug this:

[30129.876620] Chain exists of:
[30129.876621]   console_owner --> &port->lock#2 --> &pool->lock/1

[30129.876625]  Possible unsafe locking scenario:

[30129.876626]        CPU0                    CPU1
[30129.876626]        ----                    ----
[30129.876627]   lock(&pool->lock/1);
[30129.876628]                                lock(&port->lock#2);
[30129.876630]                                lock(&pool->lock/1);
[30129.876631]   lock(console_owner);

[30129.876633]  *** DEADLOCK ***

[30129.876634] 5 locks held by sysrq.sh/1222:
[30129.876634]  #0: ffff8881d3ce0470 (sb_writers#3){.+.+}-{0:0}, at: vfs_write+0x359/0x650
[30129.876637]  #1: ffffffff92c612c0 (rcu_read_lock){....}-{1:2}, at: __handle_sysrq+0x4d/0x460
[30129.876640]  #2: ffffffff92c612c0 (rcu_read_lock){....}-{1:2}, at: show_workqueue_state+0x5/0xf0
[30129.876642]  #3: ffff888107cb9018 (&pool->lock/1){-.-.}-{2:2}, at: show_workqueue_state.cold.55+0x15b/0x6ca
[30129.876645]  #4: ffffffff92c39980 (console_lock){+.+.}-{0:0}, at: vprintk_emit+0x123/0x420

[30129.876648] stack backtrace:
[30129.876649] CPU: 3 PID: 1222 Comm: sysrq.sh Tainted: G S      W         5.9.0-rc2+ #3
[30129.876649] Hardware name: Intel Corporation 2012 Client Platform/Emerald Lake 2, BIOS ACRVMBY1.86C.0078.P00.1201161002 01/16/2012
[30129.876650] Call Trace:
[30129.876650]  dump_stack+0x9d/0xe0
[30129.876651]  check_noncircular+0x34f/0x410
[30129.876653]  __lock_acquire+0x2f70/0x4e90
[30129.876656]  lock_acquire+0x1ac/0xad0
[30129.876658]  console_unlock+0x460/0xa90
[30129.876660]  vprintk_emit+0x130/0x420
[30129.876660]  printk+0x9f/0xc5
[30129.876661]  show_pwq+0x154/0x618
[30129.876662]  show_workqueue_state.cold.55+0x193/0x6ca
[30129.876664]  __handle_sysrq+0x244/0x460
[30129.876665]  write_sysrq_trigger+0x48/0x4a
[30129.876665]  proc_reg_write+0x1a6/0x240
[30129.876666]  vfs_write+0x1a8/0x650

It looks like the commit was aimed to protect tty_insert_flip_string and
there is no need for tty_flip_buffer_push to be under this lock.

Fixes: b6da31b2c07c ("tty: Fix data race in tty_insert_flip_string_fixed_flag")
Signed-off-by: Artem Savkov <asavkov@redhat.com>
Acked-by: Jiri Slaby <jirislaby@kernel.org>
Link: https://lore.kernel.org/r/20200902120045.3693075-1-asavkov@redhat.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/pty.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/tty/pty.c b/drivers/tty/pty.c
index 00099a8439d21..c6a1d8c4e6894 100644
--- a/drivers/tty/pty.c
+++ b/drivers/tty/pty.c
@@ -120,10 +120,10 @@ static int pty_write(struct tty_struct *tty, const unsigned char *buf, int c)
 		spin_lock_irqsave(&to->port->lock, flags);
 		/* Stuff the data into the input queue of the other end */
 		c = tty_insert_flip_string(to->port, buf, c);
+		spin_unlock_irqrestore(&to->port->lock, flags);
 		/* And shovel */
 		if (c)
 			tty_flip_buffer_push(to->port);
-		spin_unlock_irqrestore(&to->port->lock, flags);
 	}
 	return c;
 }
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 197/633] pwm: lpss: Fix off by one error in base_unit math in pwm_lpss_prepare()
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (195 preceding siblings ...)
  2020-10-27 13:48 ` [PATCH 5.8 196/633] pty: do tty_flip_buffer_push without port->lock in pty_write Greg Kroah-Hartman
@ 2020-10-27 13:49 ` Greg Kroah-Hartman
  2020-10-27 13:49 ` [PATCH 5.8 198/633] pwm: lpss: Add range limit check for the base_unit register value Greg Kroah-Hartman
                   ` (438 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Andy Shevchenko,
	Uwe Kleine-König, Thierry Reding, Hans de Goede,
	Sasha Levin

From: Hans de Goede <hdegoede@redhat.com>

[ Upstream commit 181f4d2f44463fe09fe4df02e03095cb87151c29 ]

According to the data-sheet the way the PWM controller works is that
each input clock-cycle the base_unit gets added to a N bit counter and
that counter overflowing determines the PWM output frequency.

So assuming e.g. a 16 bit counter this means that if base_unit is set to 1,
after 65535 input clock-cycles the counter has been increased from 0 to
65535 and it will overflow on the next cycle, so it will overflow after
every 65536 clock cycles and thus the calculations done in
pwm_lpss_prepare() should use 65536 and not 65535.

This commit fixes this. Note this also aligns the calculations in
pwm_lpss_prepare() with those in pwm_lpss_get_state().

Note this effectively reverts commit 684309e5043e ("pwm: lpss: Avoid
potential overflow of base_unit"). The next patch in this series really
fixes the potential overflow of the base_unit value.

Fixes: 684309e5043e ("pwm: lpss: Avoid potential overflow of base_unit")
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Acked-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Acked-by: Thierry Reding <thierry.reding@gmail.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20200903112337.4113-4-hdegoede@redhat.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pwm/pwm-lpss.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/pwm/pwm-lpss.c b/drivers/pwm/pwm-lpss.c
index 9d965ffe66d1e..43b1fc634af1a 100644
--- a/drivers/pwm/pwm-lpss.c
+++ b/drivers/pwm/pwm-lpss.c
@@ -93,7 +93,7 @@ static void pwm_lpss_prepare(struct pwm_lpss_chip *lpwm, struct pwm_device *pwm,
 	 * The equation is:
 	 * base_unit = round(base_unit_range * freq / c)
 	 */
-	base_unit_range = BIT(lpwm->info->base_unit_bits) - 1;
+	base_unit_range = BIT(lpwm->info->base_unit_bits);
 	freq *= base_unit_range;
 
 	base_unit = DIV_ROUND_CLOSEST_ULL(freq, c);
@@ -104,8 +104,8 @@ static void pwm_lpss_prepare(struct pwm_lpss_chip *lpwm, struct pwm_device *pwm,
 
 	orig_ctrl = ctrl = pwm_lpss_read(pwm);
 	ctrl &= ~PWM_ON_TIME_DIV_MASK;
-	ctrl &= ~(base_unit_range << PWM_BASE_UNIT_SHIFT);
-	base_unit &= base_unit_range;
+	ctrl &= ~((base_unit_range - 1) << PWM_BASE_UNIT_SHIFT);
+	base_unit &= (base_unit_range - 1);
 	ctrl |= (u32) base_unit << PWM_BASE_UNIT_SHIFT;
 	ctrl |= on_time_div;
 
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 198/633] pwm: lpss: Add range limit check for the base_unit register value
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (196 preceding siblings ...)
  2020-10-27 13:49 ` [PATCH 5.8 197/633] pwm: lpss: Fix off by one error in base_unit math in pwm_lpss_prepare() Greg Kroah-Hartman
@ 2020-10-27 13:49 ` Greg Kroah-Hartman
  2020-10-27 13:49 ` [PATCH 5.8 199/633] drivers/virt/fsl_hypervisor: Fix error handling path Greg Kroah-Hartman
                   ` (437 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Andy Shevchenko, Thierry Reding,
	Hans de Goede, Sasha Levin

From: Hans de Goede <hdegoede@redhat.com>

[ Upstream commit ef9f60daab309558c8bb3e086a9a11ee40bd6061 ]

When the user requests a high enough period ns value, then the
calculations in pwm_lpss_prepare() might result in a base_unit value of 0.

But according to the data-sheet the way the PWM controller works is that
each input clock-cycle the base_unit gets added to a N bit counter and
that counter overflowing determines the PWM output frequency. Adding 0
to the counter is a no-op. The data-sheet even explicitly states that
writing 0 to the base_unit bits will result in the PWM outputting a
continuous 0 signal.

When the user requestes a low enough period ns value, then the
calculations in pwm_lpss_prepare() might result in a base_unit value
which is bigger then base_unit_range - 1. Currently the codes for this
deals with this by applying a mask:

	base_unit &= (base_unit_range - 1);

But this means that we let the value overflow the range, we throw away the
higher bits and store whatever value is left in the lower bits into the
register leading to a random output frequency, rather then clamping the
output frequency to the highest frequency which the hardware can do.

This commit fixes both issues by clamping the base_unit value to be
between 1 and (base_unit_range - 1).

Fixes: 684309e5043e ("pwm: lpss: Avoid potential overflow of base_unit")
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Acked-by: Thierry Reding <thierry.reding@gmail.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20200903112337.4113-5-hdegoede@redhat.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pwm/pwm-lpss.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/pwm/pwm-lpss.c b/drivers/pwm/pwm-lpss.c
index 43b1fc634af1a..da9bc3d10104a 100644
--- a/drivers/pwm/pwm-lpss.c
+++ b/drivers/pwm/pwm-lpss.c
@@ -97,6 +97,8 @@ static void pwm_lpss_prepare(struct pwm_lpss_chip *lpwm, struct pwm_device *pwm,
 	freq *= base_unit_range;
 
 	base_unit = DIV_ROUND_CLOSEST_ULL(freq, c);
+	/* base_unit must not be 0 and we also want to avoid overflowing it */
+	base_unit = clamp_val(base_unit, 1, base_unit_range - 1);
 
 	on_time_div = 255ULL * duty_ns;
 	do_div(on_time_div, period_ns);
@@ -105,7 +107,6 @@ static void pwm_lpss_prepare(struct pwm_lpss_chip *lpwm, struct pwm_device *pwm,
 	orig_ctrl = ctrl = pwm_lpss_read(pwm);
 	ctrl &= ~PWM_ON_TIME_DIV_MASK;
 	ctrl &= ~((base_unit_range - 1) << PWM_BASE_UNIT_SHIFT);
-	base_unit &= (base_unit_range - 1);
 	ctrl |= (u32) base_unit << PWM_BASE_UNIT_SHIFT;
 	ctrl |= on_time_div;
 
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 199/633] drivers/virt/fsl_hypervisor: Fix error handling path
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (197 preceding siblings ...)
  2020-10-27 13:49 ` [PATCH 5.8 198/633] pwm: lpss: Add range limit check for the base_unit register value Greg Kroah-Hartman
@ 2020-10-27 13:49 ` Greg Kroah-Hartman
  2020-10-27 13:49 ` [PATCH 5.8 200/633] ath11k: fix a double free and a memory leak Greg Kroah-Hartman
                   ` (436 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Souptick Joarder, Dan Carpenter,
	John Hubbard, Sasha Levin

From: Souptick Joarder <jrdr.linux@gmail.com>

[ Upstream commit 7f360bec37857bfd5a48cef21d86f58a09a3df63 ]

First, when memory allocation for sg_list_unaligned failed, there
is a bug of calling put_pages() as we haven't pinned any pages.

Second, if get_user_pages_fast() failed we should unpin num_pinned
pages.

This will address both.

As part of these changes, minor update in documentation.

Fixes: 6db7199407ca ("drivers/virt: introduce Freescale hypervisor management driver")
Signed-off-by: Souptick Joarder <jrdr.linux@gmail.com>
Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: John Hubbard <jhubbard@nvidia.com>
Link: https://lore.kernel.org/r/1598995271-6755-1-git-send-email-jrdr.linux@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/virt/fsl_hypervisor.c | 17 ++++++++---------
 1 file changed, 8 insertions(+), 9 deletions(-)

diff --git a/drivers/virt/fsl_hypervisor.c b/drivers/virt/fsl_hypervisor.c
index 1b0b11b55d2a0..46ee0a0998b6f 100644
--- a/drivers/virt/fsl_hypervisor.c
+++ b/drivers/virt/fsl_hypervisor.c
@@ -157,7 +157,7 @@ static long ioctl_memcpy(struct fsl_hv_ioctl_memcpy __user *p)
 
 	unsigned int i;
 	long ret = 0;
-	int num_pinned; /* return value from get_user_pages() */
+	int num_pinned = 0; /* return value from get_user_pages_fast() */
 	phys_addr_t remote_paddr; /* The next address in the remote buffer */
 	uint32_t count; /* The number of bytes left to copy */
 
@@ -174,7 +174,7 @@ static long ioctl_memcpy(struct fsl_hv_ioctl_memcpy __user *p)
 		return -EINVAL;
 
 	/*
-	 * The array of pages returned by get_user_pages() covers only
+	 * The array of pages returned by get_user_pages_fast() covers only
 	 * page-aligned memory.  Since the user buffer is probably not
 	 * page-aligned, we need to handle the discrepancy.
 	 *
@@ -224,7 +224,7 @@ static long ioctl_memcpy(struct fsl_hv_ioctl_memcpy __user *p)
 
 	/*
 	 * 'pages' is an array of struct page pointers that's initialized by
-	 * get_user_pages().
+	 * get_user_pages_fast().
 	 */
 	pages = kcalloc(num_pages, sizeof(struct page *), GFP_KERNEL);
 	if (!pages) {
@@ -241,7 +241,7 @@ static long ioctl_memcpy(struct fsl_hv_ioctl_memcpy __user *p)
 	if (!sg_list_unaligned) {
 		pr_debug("fsl-hv: could not allocate S/G list\n");
 		ret = -ENOMEM;
-		goto exit;
+		goto free_pages;
 	}
 	sg_list = PTR_ALIGN(sg_list_unaligned, sizeof(struct fh_sg_list));
 
@@ -250,7 +250,6 @@ static long ioctl_memcpy(struct fsl_hv_ioctl_memcpy __user *p)
 		num_pages, param.source != -1 ? FOLL_WRITE : 0, pages);
 
 	if (num_pinned != num_pages) {
-		/* get_user_pages() failed */
 		pr_debug("fsl-hv: could not lock source buffer\n");
 		ret = (num_pinned < 0) ? num_pinned : -EFAULT;
 		goto exit;
@@ -292,13 +291,13 @@ static long ioctl_memcpy(struct fsl_hv_ioctl_memcpy __user *p)
 		virt_to_phys(sg_list), num_pages);
 
 exit:
-	if (pages) {
-		for (i = 0; i < num_pages; i++)
-			if (pages[i])
-				put_page(pages[i]);
+	if (pages && (num_pinned > 0)) {
+		for (i = 0; i < num_pinned; i++)
+			put_page(pages[i]);
 	}
 
 	kfree(sg_list_unaligned);
+free_pages:
 	kfree(pages);
 
 	if (!ret)
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 200/633] ath11k: fix a double free and a memory leak
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (198 preceding siblings ...)
  2020-10-27 13:49 ` [PATCH 5.8 199/633] drivers/virt/fsl_hypervisor: Fix error handling path Greg Kroah-Hartman
@ 2020-10-27 13:49 ` Greg Kroah-Hartman
  2020-10-27 13:49 ` [PATCH 5.8 201/633] video: fbdev: vga16fb: fix setting of pixclock because a pass-by-value error Greg Kroah-Hartman
                   ` (435 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:49 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Tom Rix, Kalle Valo, Sasha Levin

From: Tom Rix <trix@redhat.com>

[ Upstream commit 7e8453e35e406981d7c529ff8f804285bc894ba3 ]

clang static analyzer reports this problem

mac.c:6204:2: warning: Attempt to free released memory
        kfree(ar->mac.sbands[NL80211_BAND_2GHZ].channels);
        ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

The channels pointer is allocated in ath11k_mac_setup_channels_rates()
When it fails midway, it cleans up the memory it has already allocated.
So the error handling needs to skip freeing the memory.

There is a second problem.
ath11k_mac_setup_channels_rates(), allocates 3 channels. err_free
misses releasing ar->mac.sbands[NL80211_BAND_6GHZ].channels

Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices")
Signed-off-by: Tom Rix <trix@redhat.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20200906212625.17059-1-trix@redhat.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath11k/mac.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c
index 2836a0f197ab0..fc5be7e8c043e 100644
--- a/drivers/net/wireless/ath/ath11k/mac.c
+++ b/drivers/net/wireless/ath/ath11k/mac.c
@@ -5824,7 +5824,7 @@ static int __ath11k_mac_register(struct ath11k *ar)
 	ret = ath11k_mac_setup_channels_rates(ar,
 					      cap->supported_bands);
 	if (ret)
-		goto err_free;
+		goto err;
 
 	ath11k_mac_setup_ht_vht_cap(ar, cap, &ht_cap);
 	ath11k_mac_setup_he_cap(ar, cap);
@@ -5938,7 +5938,9 @@ static int __ath11k_mac_register(struct ath11k *ar)
 err_free:
 	kfree(ar->mac.sbands[NL80211_BAND_2GHZ].channels);
 	kfree(ar->mac.sbands[NL80211_BAND_5GHZ].channels);
+	kfree(ar->mac.sbands[NL80211_BAND_6GHZ].channels);
 
+err:
 	SET_IEEE80211_DEV(ar->hw, NULL);
 	return ret;
 }
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 201/633] video: fbdev: vga16fb: fix setting of pixclock because a pass-by-value error
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (199 preceding siblings ...)
  2020-10-27 13:49 ` [PATCH 5.8 200/633] ath11k: fix a double free and a memory leak Greg Kroah-Hartman
@ 2020-10-27 13:49 ` Greg Kroah-Hartman
  2020-10-27 13:49 ` [PATCH 5.8 202/633] video: fbdev: sis: fix null ptr dereference Greg Kroah-Hartman
                   ` (434 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Colin Ian King, Daniel Vetter,
	Jani Nikula, Bartlomiej Zolnierkiewicz, Sasha Levin

From: Colin Ian King <colin.king@canonical.com>

[ Upstream commit c72fab81ceaa54408b827a2f0486d9a0f4be34cf ]

The pixclock is being set locally because it is being passed as a
pass-by-value argument rather than pass-by-reference, so the computed
pixclock is never being set in var->pixclock. Fix this by passing
by reference.

[This dates back to 2002, I found the offending commit from the git
history git://git.kernel.org/pub/scm/linux/kernel/git/tglx/history.git ]

Addresses-Coverity: ("Unused value")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
Cc: Jani Nikula <jani.nikula@intel.com>
[b.zolnierkie: minor patch summary fixup]
[b.zolnierkie: removed "Fixes:" tag (not in upstream tree)]
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20200723170227.996229-1-colin.king@canonical.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/video/fbdev/vga16fb.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/drivers/video/fbdev/vga16fb.c b/drivers/video/fbdev/vga16fb.c
index 578d3541e3d6f..1e8a38a7967d8 100644
--- a/drivers/video/fbdev/vga16fb.c
+++ b/drivers/video/fbdev/vga16fb.c
@@ -243,7 +243,7 @@ static void vga16fb_update_fix(struct fb_info *info)
 }
 
 static void vga16fb_clock_chip(struct vga16fb_par *par,
-			       unsigned int pixclock,
+			       unsigned int *pixclock,
 			       const struct fb_info *info,
 			       int mul, int div)
 {
@@ -259,14 +259,14 @@ static void vga16fb_clock_chip(struct vga16fb_par *par,
 		{     0 /* bad */,    0x00, 0x00}};
 	int err;
 
-	pixclock = (pixclock * mul) / div;
+	*pixclock = (*pixclock * mul) / div;
 	best = vgaclocks;
-	err = pixclock - best->pixclock;
+	err = *pixclock - best->pixclock;
 	if (err < 0) err = -err;
 	for (ptr = vgaclocks + 1; ptr->pixclock; ptr++) {
 		int tmp;
 
-		tmp = pixclock - ptr->pixclock;
+		tmp = *pixclock - ptr->pixclock;
 		if (tmp < 0) tmp = -tmp;
 		if (tmp < err) {
 			err = tmp;
@@ -275,7 +275,7 @@ static void vga16fb_clock_chip(struct vga16fb_par *par,
 	}
 	par->misc |= best->misc;
 	par->clkdiv = best->seq_clock_mode;
-	pixclock = (best->pixclock * div) / mul;		
+	*pixclock = (best->pixclock * div) / mul;
 }
 			       
 #define FAIL(X) return -EINVAL
@@ -497,10 +497,10 @@ static int vga16fb_check_var(struct fb_var_screeninfo *var,
 
 	if (mode & MODE_8BPP)
 		/* pixel clock == vga clock / 2 */
-		vga16fb_clock_chip(par, var->pixclock, info, 1, 2);
+		vga16fb_clock_chip(par, &var->pixclock, info, 1, 2);
 	else
 		/* pixel clock == vga clock */
-		vga16fb_clock_chip(par, var->pixclock, info, 1, 1);
+		vga16fb_clock_chip(par, &var->pixclock, info, 1, 1);
 	
 	var->red.offset = var->green.offset = var->blue.offset = 
 	var->transp.offset = 0;
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 202/633] video: fbdev: sis: fix null ptr dereference
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (200 preceding siblings ...)
  2020-10-27 13:49 ` [PATCH 5.8 201/633] video: fbdev: vga16fb: fix setting of pixclock because a pass-by-value error Greg Kroah-Hartman
@ 2020-10-27 13:49 ` Greg Kroah-Hartman
  2020-10-27 13:49 ` [PATCH 5.8 203/633] video: fbdev: radeon: Fix memleak in radeonfb_pci_register Greg Kroah-Hartman
                   ` (433 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Tom Rix, Thomas Winischhofer,
	Andrew Morton, Bartlomiej Zolnierkiewicz, Sasha Levin

From: Tom Rix <trix@redhat.com>

[ Upstream commit ad6f93e9cd56f0b10e9b22e3e137d17a1a035242 ]

Clang static analysis reports this representative error

init.c:2501:18: warning: Array access (from variable 'queuedata') results
  in a null pointer dereference
      templ |= ((queuedata[i] & 0xc0) << 3);

This is the problem block of code

   if(ModeNo > 0x13) {
      ...
      if(SiS_Pr->ChipType == SIS_730) {
	 queuedata = &FQBQData730[0];
      } else {
	 queuedata = &FQBQData[0];
      }
   } else {

   }

queuedata is not set in the else block

Reviewing the old code, the arrays FQBQData730 and FQBQData were
used directly.

So hoist the setting of queuedata out of the if-else block.

Fixes: 544393fe584d ("[PATCH] sisfb update")
Signed-off-by: Tom Rix <trix@redhat.com>
Cc: Thomas Winischhofer <thomas@winischhofer.net>
Cc: Andrew Morton <akpm@osdl.org>
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20200805145208.17727-1-trix@redhat.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/video/fbdev/sis/init.c | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/drivers/video/fbdev/sis/init.c b/drivers/video/fbdev/sis/init.c
index dfe3eb769638b..fde27feae5d0c 100644
--- a/drivers/video/fbdev/sis/init.c
+++ b/drivers/video/fbdev/sis/init.c
@@ -2428,6 +2428,11 @@ SiS_SetCRT1FIFO_630(struct SiS_Private *SiS_Pr, unsigned short ModeNo,
 
    i = 0;
 
+	if (SiS_Pr->ChipType == SIS_730)
+		queuedata = &FQBQData730[0];
+	else
+		queuedata = &FQBQData[0];
+
    if(ModeNo > 0x13) {
 
       /* Get VCLK  */
@@ -2445,12 +2450,6 @@ SiS_SetCRT1FIFO_630(struct SiS_Private *SiS_Pr, unsigned short ModeNo,
       /* Get half colordepth */
       colorth = colortharray[(SiS_Pr->SiS_ModeType - ModeEGA)];
 
-      if(SiS_Pr->ChipType == SIS_730) {
-	 queuedata = &FQBQData730[0];
-      } else {
-	 queuedata = &FQBQData[0];
-      }
-
       do {
 	 templ = SiS_CalcDelay2(SiS_Pr, queuedata[i]) * VCLK * colorth;
 
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 203/633] video: fbdev: radeon: Fix memleak in radeonfb_pci_register
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (201 preceding siblings ...)
  2020-10-27 13:49 ` [PATCH 5.8 202/633] video: fbdev: sis: fix null ptr dereference Greg Kroah-Hartman
@ 2020-10-27 13:49 ` Greg Kroah-Hartman
  2020-10-27 13:49 ` [PATCH 5.8 204/633] ASoC: fsl: imx-es8328: add missing put_device() call in imx_es8328_probe() Greg Kroah-Hartman
                   ` (432 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dinghao Liu, Mathieu Malaterre,
	Kangjie Lu, Benjamin Herrenschmidt, Bartlomiej Zolnierkiewicz,
	Sasha Levin

From: Dinghao Liu <dinghao.liu@zju.edu.cn>

[ Upstream commit fe6c6a4af2be8c15bac77f7ea160f947c04840d1 ]

When radeon_kick_out_firmware_fb() fails, info should be
freed just like the subsequent error paths.

Fixes: 069ee21a82344 ("fbdev: Fix loading of module radeonfb on PowerMac")
Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
Reviewed-by: Mathieu Malaterre <malat@debian.org>
Cc: Kangjie Lu <kjlu@umn.edu>
Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20200825062900.11210-1-dinghao.liu@zju.edu.cn
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/video/fbdev/aty/radeon_base.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/video/fbdev/aty/radeon_base.c b/drivers/video/fbdev/aty/radeon_base.c
index e116a3f9ad566..687bd2c0d5040 100644
--- a/drivers/video/fbdev/aty/radeon_base.c
+++ b/drivers/video/fbdev/aty/radeon_base.c
@@ -2311,7 +2311,7 @@ static int radeonfb_pci_register(struct pci_dev *pdev,
 
 	ret = radeon_kick_out_firmware_fb(pdev);
 	if (ret)
-		return ret;
+		goto err_release_fb;
 
 	/* request the mem regions */
 	ret = pci_request_region(pdev, 0, "radeonfb framebuffer");
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 204/633] ASoC: fsl: imx-es8328: add missing put_device() call in imx_es8328_probe()
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (202 preceding siblings ...)
  2020-10-27 13:49 ` [PATCH 5.8 203/633] video: fbdev: radeon: Fix memleak in radeonfb_pci_register Greg Kroah-Hartman
@ 2020-10-27 13:49 ` Greg Kroah-Hartman
  2020-10-27 13:49 ` [PATCH 5.8 205/633] scsi: ufs: ufs-mediatek: Fix HOST_PA_TACTIVATE quirk Greg Kroah-Hartman
                   ` (431 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:49 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Yu Kuai, Mark Brown, Sasha Levin

From: Yu Kuai <yukuai3@huawei.com>

[ Upstream commit e525db7e4b44c5b2b5aac0dad24e23cb58c54d22 ]

if of_find_device_by_node() succeed, imx_es8328_probe() doesn't have
a corresponding put_device(). Thus add a jump target to fix the exception
handling for this function implementation.

Fixes: 7e7292dba215 ("ASoC: fsl: add imx-es8328 machine driver")
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
Link: https://lore.kernel.org/r/20200825130224.1488694-1-yukuai3@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/fsl/imx-es8328.c | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/sound/soc/fsl/imx-es8328.c b/sound/soc/fsl/imx-es8328.c
index 15a27a2cd0cae..fad1eb6253d53 100644
--- a/sound/soc/fsl/imx-es8328.c
+++ b/sound/soc/fsl/imx-es8328.c
@@ -145,13 +145,13 @@ static int imx_es8328_probe(struct platform_device *pdev)
 	data = devm_kzalloc(dev, sizeof(*data), GFP_KERNEL);
 	if (!data) {
 		ret = -ENOMEM;
-		goto fail;
+		goto put_device;
 	}
 
 	comp = devm_kzalloc(dev, 3 * sizeof(*comp), GFP_KERNEL);
 	if (!comp) {
 		ret = -ENOMEM;
-		goto fail;
+		goto put_device;
 	}
 
 	data->dev = dev;
@@ -182,12 +182,12 @@ static int imx_es8328_probe(struct platform_device *pdev)
 	ret = snd_soc_of_parse_card_name(&data->card, "model");
 	if (ret) {
 		dev_err(dev, "Unable to parse card name\n");
-		goto fail;
+		goto put_device;
 	}
 	ret = snd_soc_of_parse_audio_routing(&data->card, "audio-routing");
 	if (ret) {
 		dev_err(dev, "Unable to parse routing: %d\n", ret);
-		goto fail;
+		goto put_device;
 	}
 	data->card.num_links = 1;
 	data->card.owner = THIS_MODULE;
@@ -196,10 +196,12 @@ static int imx_es8328_probe(struct platform_device *pdev)
 	ret = snd_soc_register_card(&data->card);
 	if (ret) {
 		dev_err(dev, "Unable to register: %d\n", ret);
-		goto fail;
+		goto put_device;
 	}
 
 	platform_set_drvdata(pdev, data);
+put_device:
+	put_device(&ssi_pdev->dev);
 fail:
 	of_node_put(ssi_np);
 	of_node_put(codec_np);
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 205/633] scsi: ufs: ufs-mediatek: Fix HOST_PA_TACTIVATE quirk
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (203 preceding siblings ...)
  2020-10-27 13:49 ` [PATCH 5.8 204/633] ASoC: fsl: imx-es8328: add missing put_device() call in imx_es8328_probe() Greg Kroah-Hartman
@ 2020-10-27 13:49 ` Greg Kroah-Hartman
  2020-10-27 13:49 ` [PATCH 5.8 206/633] HID: roccat: add bounds checking in kone_sysfs_write_settings() Greg Kroah-Hartman
                   ` (430 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Stanley Chu, Martin K. Petersen, Sasha Levin

From: Stanley Chu <stanley.chu@mediatek.com>

[ Upstream commit a3e40b80dc951057033dce86f0e675b2b822b513 ]

Simply add HOST_PA_TACTIVATE quirk back since it was incorrectly removed
before.

Link: https://lore.kernel.org/r/20200908064507.30774-3-stanley.chu@mediatek.com
Fixes: 47d054580a75 ("scsi: ufs-mediatek: fix HOST_PA_TACTIVATE quirk for Samsung UFS Devices")
Signed-off-by: Stanley Chu <stanley.chu@mediatek.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/ufs/ufs-mediatek.c | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/drivers/scsi/ufs/ufs-mediatek.c b/drivers/scsi/ufs/ufs-mediatek.c
index d56ce8d97d4e8..7ad127f213977 100644
--- a/drivers/scsi/ufs/ufs-mediatek.c
+++ b/drivers/scsi/ufs/ufs-mediatek.c
@@ -585,13 +585,7 @@ static int ufs_mtk_apply_dev_quirks(struct ufs_hba *hba)
 
 static void ufs_mtk_fixup_dev_quirks(struct ufs_hba *hba)
 {
-	struct ufs_dev_info *dev_info = &hba->dev_info;
-	u16 mid = dev_info->wmanufacturerid;
-
 	ufshcd_fixup_dev_quirks(hba, ufs_mtk_dev_fixups);
-
-	if (mid == UFS_VENDOR_SAMSUNG)
-		hba->dev_quirks &= ~UFS_DEVICE_QUIRK_HOST_PA_TACTIVATE;
 }
 
 /**
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 206/633] HID: roccat: add bounds checking in kone_sysfs_write_settings()
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (204 preceding siblings ...)
  2020-10-27 13:49 ` [PATCH 5.8 205/633] scsi: ufs: ufs-mediatek: Fix HOST_PA_TACTIVATE quirk Greg Kroah-Hartman
@ 2020-10-27 13:49 ` Greg Kroah-Hartman
  2020-10-27 13:49 ` [PATCH 5.8 207/633] drm/msm: Avoid div-by-zero in dpu_crtc_atomic_check() Greg Kroah-Hartman
                   ` (429 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Jiri Kosina, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit d4f98dbfe717490e771b6e701904bfcf4b4557f0 ]

This code doesn't check if "settings->startup_profile" is within bounds
and that could result in an out of bounds array access.  What the code
does do is it checks if the settings can be written to the firmware, so
it's possible that the firmware has a bounds check?  It's safer and
easier to verify when the bounds checking is done in the kernel.

Fixes: 14bf62cde794 ("HID: add driver for Roccat Kone gaming mouse")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hid/hid-roccat-kone.c | 23 ++++++++++++++++-------
 1 file changed, 16 insertions(+), 7 deletions(-)

diff --git a/drivers/hid/hid-roccat-kone.c b/drivers/hid/hid-roccat-kone.c
index 1a6e600197d0b..509b9bb1362cb 100644
--- a/drivers/hid/hid-roccat-kone.c
+++ b/drivers/hid/hid-roccat-kone.c
@@ -294,31 +294,40 @@ static ssize_t kone_sysfs_write_settings(struct file *fp, struct kobject *kobj,
 	struct kone_device *kone = hid_get_drvdata(dev_get_drvdata(dev));
 	struct usb_device *usb_dev = interface_to_usbdev(to_usb_interface(dev));
 	int retval = 0, difference, old_profile;
+	struct kone_settings *settings = (struct kone_settings *)buf;
 
 	/* I need to get my data in one piece */
 	if (off != 0 || count != sizeof(struct kone_settings))
 		return -EINVAL;
 
 	mutex_lock(&kone->kone_lock);
-	difference = memcmp(buf, &kone->settings, sizeof(struct kone_settings));
+	difference = memcmp(settings, &kone->settings,
+			    sizeof(struct kone_settings));
 	if (difference) {
-		retval = kone_set_settings(usb_dev,
-				(struct kone_settings const *)buf);
-		if (retval) {
-			mutex_unlock(&kone->kone_lock);
-			return retval;
+		if (settings->startup_profile < 1 ||
+		    settings->startup_profile > 5) {
+			retval = -EINVAL;
+			goto unlock;
 		}
 
+		retval = kone_set_settings(usb_dev, settings);
+		if (retval)
+			goto unlock;
+
 		old_profile = kone->settings.startup_profile;
-		memcpy(&kone->settings, buf, sizeof(struct kone_settings));
+		memcpy(&kone->settings, settings, sizeof(struct kone_settings));
 
 		kone_profile_activated(kone, kone->settings.startup_profile);
 
 		if (kone->settings.startup_profile != old_profile)
 			kone_profile_report(kone, kone->settings.startup_profile);
 	}
+unlock:
 	mutex_unlock(&kone->kone_lock);
 
+	if (retval)
+		return retval;
+
 	return sizeof(struct kone_settings);
 }
 static BIN_ATTR(settings, 0660, kone_sysfs_read_settings,
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 207/633] drm/msm: Avoid div-by-zero in dpu_crtc_atomic_check()
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (205 preceding siblings ...)
  2020-10-27 13:49 ` [PATCH 5.8 206/633] HID: roccat: add bounds checking in kone_sysfs_write_settings() Greg Kroah-Hartman
@ 2020-10-27 13:49 ` Greg Kroah-Hartman
  2020-10-27 13:49 ` [PATCH 5.8 208/633] drm/panfrost: Ensure GPU quirks are always initialised Greg Kroah-Hartman
                   ` (428 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Abhinav Kumar, Jeykumar Sankaran,
	Jordan Crouse, Sean Paul, Stephen Boyd, Sai Prakash Ranjan,
	Rob Clark, Sasha Levin

From: Stephen Boyd <swboyd@chromium.org>

[ Upstream commit 22f760941844dbcee6ee446e1896532f6dff01ef ]

The cstate->num_mixers member is only set to a non-zero value once
dpu_encoder_virt_mode_set() is called, but the atomic check function can
be called by userspace before that. Let's avoid the div-by-zero here and
inside _dpu_crtc_setup_lm_bounds() by skipping this part of the atomic
check if dpu_encoder_virt_mode_set() hasn't been called yet. This fixes
an UBSAN warning:

 UBSAN: Undefined behaviour in drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c:860:31
 division by zero
 CPU: 7 PID: 409 Comm: frecon Tainted: G S                5.4.31 #128
 Hardware name: Google Trogdor (rev0) (DT)
 Call trace:
  dump_backtrace+0x0/0x14c
  show_stack+0x20/0x2c
  dump_stack+0xa0/0xd8
  __ubsan_handle_divrem_overflow+0xec/0x110
  dpu_crtc_atomic_check+0x97c/0x9d4
  drm_atomic_helper_check_planes+0x160/0x1c8
  drm_atomic_helper_check+0x54/0xbc
  drm_atomic_check_only+0x6a8/0x880
  drm_atomic_commit+0x20/0x5c
  drm_atomic_helper_set_config+0x98/0xa0
  drm_mode_setcrtc+0x308/0x5dc
  drm_ioctl_kernel+0x9c/0x114
  drm_ioctl+0x2ac/0x4b0
  drm_compat_ioctl+0xe8/0x13c
  __arm64_compat_sys_ioctl+0x184/0x324
  el0_svc_common+0xa4/0x154
  el0_svc_compat_handler+0x

Cc: Abhinav Kumar <abhinavk@codeaurora.org>
Cc: Jeykumar Sankaran <jsanka@codeaurora.org>
Cc: Jordan Crouse <jcrouse@codeaurora.org>
Cc: Sean Paul <seanpaul@chromium.org>
Fixes: 25fdd5933e4c ("drm/msm: Add SDM845 DPU support")
Signed-off-by: Stephen Boyd <swboyd@chromium.org>
Reviewed-by: Abhinav Kumar <abhinavk@codeaurora.org>
Tested-by: Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
Signed-off-by: Rob Clark <robdclark@chromium.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c
index 1026e1e5bec10..4d81a0c73616f 100644
--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c
+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c
@@ -881,7 +881,7 @@ static int dpu_crtc_atomic_check(struct drm_crtc *crtc,
 	struct drm_plane *plane;
 	struct drm_display_mode *mode;
 
-	int cnt = 0, rc = 0, mixer_width, i, z_pos;
+	int cnt = 0, rc = 0, mixer_width = 0, i, z_pos;
 
 	struct dpu_multirect_plane_states multirect_plane[DPU_STAGE_MAX * 2];
 	int multirect_count = 0;
@@ -914,9 +914,11 @@ static int dpu_crtc_atomic_check(struct drm_crtc *crtc,
 
 	memset(pipe_staged, 0, sizeof(pipe_staged));
 
-	mixer_width = mode->hdisplay / cstate->num_mixers;
+	if (cstate->num_mixers) {
+		mixer_width = mode->hdisplay / cstate->num_mixers;
 
-	_dpu_crtc_setup_lm_bounds(crtc, state);
+		_dpu_crtc_setup_lm_bounds(crtc, state);
+	}
 
 	crtc_rect.x2 = mode->hdisplay;
 	crtc_rect.y2 = mode->vdisplay;
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 208/633] drm/panfrost: Ensure GPU quirks are always initialised
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (206 preceding siblings ...)
  2020-10-27 13:49 ` [PATCH 5.8 207/633] drm/msm: Avoid div-by-zero in dpu_crtc_atomic_check() Greg Kroah-Hartman
@ 2020-10-27 13:49 ` Greg Kroah-Hartman
  2020-10-27 13:49 ` [PATCH 5.8 209/633] iomap: Clear page error before beginning a write Greg Kroah-Hartman
                   ` (427 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Steven Price, Alyssa Rosenzweig, Sasha Levin

From: Steven Price <steven.price@arm.com>

[ Upstream commit 8c3c818c23a5bbce6ff180dd2ee04415241df77c ]

The GPU 'CONFIG' registers used to work around hardware issues are
cleared on reset so need to be programmed every time the GPU is reset.
However panfrost_device_reset() failed to do this.

To avoid this in future instead move the call to
panfrost_gpu_init_quirks() to panfrost_gpu_power_on() so that the
regsiters are always programmed just before the cores are powered.

Fixes: f3ba91228e8e ("drm/panfrost: Add initial panfrost driver")
Signed-off-by: Steven Price <steven.price@arm.com>
Reviewed-by: Alyssa Rosenzweig <alyssa.rosenzweig@collabora.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20200909122957.51667-1-steven.price@arm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/panfrost/panfrost_gpu.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/panfrost/panfrost_gpu.c b/drivers/gpu/drm/panfrost/panfrost_gpu.c
index f2c1ddc41a9bf..689b92893e0e1 100644
--- a/drivers/gpu/drm/panfrost/panfrost_gpu.c
+++ b/drivers/gpu/drm/panfrost/panfrost_gpu.c
@@ -304,6 +304,8 @@ void panfrost_gpu_power_on(struct panfrost_device *pfdev)
 	int ret;
 	u32 val;
 
+	panfrost_gpu_init_quirks(pfdev);
+
 	/* Just turn on everything for now */
 	gpu_write(pfdev, L2_PWRON_LO, pfdev->features.l2_present);
 	ret = readl_relaxed_poll_timeout(pfdev->iomem + L2_READY_LO,
@@ -355,7 +357,6 @@ int panfrost_gpu_init(struct panfrost_device *pfdev)
 		return err;
 	}
 
-	panfrost_gpu_init_quirks(pfdev);
 	panfrost_gpu_power_on(pfdev);
 
 	return 0;
-- 
2.25.1




^ permalink raw reply	[flat|nested] 639+ messages in thread

* [PATCH 5.8 209/633] iomap: Clear page error before beginning a write
  2020-10-27 13:45 [PATCH 5.8 000/633] 5.8.17-rc1 review Greg Kroah-Hartman
                   ` (207 preceding siblings ...)
  2020-10-27 13:49 ` [PATCH 5.8 208/633] drm/panfrost: Ensure GPU quirks are always initialised Greg Kroah-Hartman
@ 2020-10-27 13:49 ` Greg Kroah-Hartman
  2020-10-27 13:49 ` [PATCH 5.8 210/633] iomap: Mark read blocks uptodate in write_begin Greg Kroah-Hartman
                   ` (426 subsequent siblings)
  635 siblings, 0 replies; 639+ messages in thread
From: Greg Kroah-Hartman @ 2020-10-27 13:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Matthew Wilcox (Oracle),
	Darrick J. Wong, Christoph Hellwig, Sasha Levin

From: Matthew Wilcox (Oracle) <willy@infradead.org>

[ Upstream commit e6e7ca92623a43156100306861272e04d46385fc ]

If we find a page in write_begin which is !Uptodate, we need
to clear any error on the page before starting to read data
into it.  This matches how filemap_fault(), do_read_cache_page()
and generic_file_buffered_read() handle PageError on !Uptodate pages.
When calling iomap_set_range_uptodate() in __iomap_write_begin(), blocks
were not being marked as uptodate.

This was found with generic/127 and a specially modified kernel which
would fail (some) readahead I/Os.  The test read some bytes in a prior
page which caused readahead to extend into page 0x34.  There was
a subsequent write to page 0x34, followed by a read to page 0x34.
Because the blocks were still marked as !Uptodate, the read caused all
blocks to be re-read, overwriting the write.  With this change, and the
next one, the bytes which were written are marked as being Uptodate, so
even though the page is still marked as !Uptodate, the blocks containing
the written data are not re-read from storage.

Fixes: 9dc55f1389f9 ("iomap: add support for sub-pagesize buffered I/O without buffer heads")
Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/iomap/buffered-io.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/iomap/buffered-io.c b/fs/iomap/buffered-io.c
index bcfc288dba3fb..c95454784df48 100644
--- a/fs/iomap/buffered-io.c
+++ b/fs/iomap/buffered-io.c
@@ -578,6 +578,7 @@ __iomap_write_begin(struct inode *inode, loff_t pos, unsigned len, int flags,
 
 	if (PageUptodate(page))
 		return 0;
+	ClearPageError(page);
 
 	do {
 		iomap_adjust_read_range(inode, iop, &block_start,
-- 
2.25.1